1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
|
#ifndef PEMAGINE_H
#define PEMAGINE_H
#include "pe_api.h"
#include "pe_consts.h"
#include "pe_structs.h"
#include "pe_ldso.h"
#ifdef __cplusplus
extern "C" {
#endif
enum pe_callback_reason {
PE_CALLBACK_REASON_INIT = 0x00,
PE_CALLBACK_REASON_ITEM = 0x01,
PE_CALLBACK_REASON_INFO = 0x02,
PE_CALLBACK_REASON_QUERY = 0x04,
PE_CALLBACK_REASON_DONE = 0x1000,
PE_CALLBACK_REASON_ERROR = (-1)
};
/* ldso flags */
#define PE_LDSO_INTEGRAL_ONLY 0x00000000
#define PE_LDSO_DEFAULT_EXECUTABLE 0x00000001
#define PE_LDSO_STANDALONE_EXECUTABLE 0x00000002
/* ldso loader context pointer index */
#define PE_LDSO_CTX_IDX_PREV_LOADER 0x0
#define PE_LDSO_CTX_IDX_PREV_ROOT 0x1
#define PE_LDSO_CTX_IDX_RESERVED_1 0x2
#define PE_LDSO_CTX_IDX_RESERVED_2 0x3
/* library specific structures */
struct pe_export_sym {
uint32_t * ordinal_base;
uint16_t * ordinal;
void * addr;
void * forwarder_rva;
char * name;
long status;
};
struct pe_guid {
uint32_t data1;
uint16_t data2;
uint16_t data3;
unsigned char data4[8];
};
struct pe_guid_str_utf16 {
wchar16_t lbrace;
wchar16_t group1[8];
wchar16_t dash1;
wchar16_t group2[4];
wchar16_t dash2;
wchar16_t group3[4];
wchar16_t dash3;
wchar16_t group4[4];
wchar16_t dash4;
wchar16_t group5[12];
wchar16_t rbrace;
};
struct pe_unicode_str {
uint16_t strlen;
uint16_t maxlen;
uint16_t * buffer;
};
struct pe_list_entry {
struct pe_list_entry * flink;
struct pe_list_entry * blink;
};
struct pe_client_id {
uint32_t process_id;
uint32_t thread_id;
};
struct pe_stack_heap_info {
size_t size_of_stack_reserve;
size_t size_of_stack_commit;
size_t size_of_heap_reserve;
size_t size_of_heap_commit;
};
struct pe_peb_ldr_data {
uint32_t length;
uint32_t initialized;
void * ss_handle;
struct pe_list_entry in_load_order_module_list;
struct pe_list_entry in_memory_order_module_list;
struct pe_list_entry in_init_order_module_list;
};
struct pe_ldr_tbl_entry {
struct pe_list_entry in_load_order_links;
struct pe_list_entry in_memory_order_links;
struct pe_list_entry in_init_order_links;
void * dll_base;
void * entry_point;
union {
uint32_t size_of_image;
unsigned char size_of_image_padding[sizeof(uintptr_t)];
};
struct pe_unicode_str full_dll_name;
struct pe_unicode_str base_dll_name;
uint32_t flags;
uint16_t load_count;
uint16_t tls_index;
union {
struct pe_list_entry hash_links;
struct {
void * section_pointer;
uint32_t check_sum;
};
};
union {
void * loaded_imports;
uint32_t time_date_stamp;
};
void * entry_point_activation_context;
void * patch_information;
struct pe_list_entry forwarder_links;
struct pe_list_entry service_tag_links;
struct pe_list_entry static_links;
void * context_information;
uintptr_t original_base;
int64_t load_time;
};
struct pe_framework_runtime_data {
struct pe_guid abi;
void * hself;
void * hparent;
void * himage;
void * hroot;
void * hdsodir;
void * hloader;
void * hexec;
void * hpeer;
void * hcwd;
void * hdrive;
void * hldrctx[__SIZEOF_POINTER__>>1];
};
/* static inlined functions */
static __inline__ void * pe_get_teb_address(void);
static __inline__ void * pe_get_peb_address(void);
static __inline__ void * pe_get_peb_address_alt(void);
static __inline__ void * pe_get_peb_ldr_data_address(void);
static __inline__ void * pe_get_peb_ldr_data_address_alt(void);
static __inline__ uint32_t pe_get_current_process_id(void);
static __inline__ uint32_t pe_get_current_thread_id(void);
static __inline__ uint32_t pe_get_current_session_id(void);
static __inline__ void * pe_va_from_rva(const void * base, intptr_t offset);
#include "pe_inline_asm.h"
/**
* user callback function responses
*
* positive: continue enumeration.
* zero: exit enumeration (ok).
* negative: exit enumeration (error).
**/
/* callback signatures */
typedef int pe_enum_modules_callback(
struct pe_ldr_tbl_entry * image_ldr_tbl_entry,
enum pe_callback_reason reason,
void * context);
typedef int pe_enum_image_exports_callback(
const void * base,
struct pe_raw_export_hdr * exp_hdr,
struct pe_export_sym * sym,
enum pe_callback_reason reason,
void * context);
typedef int pe_enum_image_import_hdrs_callback(
const void * base,
struct pe_raw_import_hdr * imp_hdr,
enum pe_callback_reason reason,
void * context);
/* image: low-level api */
pe_api struct pe_raw_image_dos_hdr * pe_get_image_dos_hdr_addr (const void * base);
pe_api struct pe_raw_coff_image_hdr * pe_get_image_coff_hdr_addr (const void * base);
pe_api union pe_raw_opt_hdr * pe_get_image_opt_hdr_addr (const void * base);
pe_api struct pe_raw_data_dirs * pe_get_image_data_dirs_addr (const void * base);
pe_api struct pe_raw_sec_hdr * pe_get_image_section_tbl_addr (const void * base);
pe_api struct pe_raw_sec_hdr * pe_get_image_named_section_addr (const void * base, const char * name);
pe_api struct pe_raw_sec_hdr * pe_get_image_block_section_addr (const void * base, uint32_t blk_rva, uint32_t blk_size);
pe_api struct pe_raw_export_hdr * pe_get_image_export_hdr_addr (const void * base, uint32_t * sec_size);
pe_api struct pe_raw_import_hdr * pe_get_image_import_dir_addr (const void * base, uint32_t * sec_size);
/* image: high-level api */
pe_api void * pe_get_image_entry_point_addr (const void * base);
pe_api void * pe_get_image_special_hdr_addr (const void * base, uint32_t ordinal, uint32_t * sec_size);
pe_api int pe_get_image_stack_heap_info (const void * base, struct pe_stack_heap_info *);
/* image: exports api */
pe_api char * pe_get_symbol_name (const void * base, const void * sym_addr);
pe_api struct pe_ldr_tbl_entry * pe_get_symbol_module_info (const void * sym_addr);
pe_api void * pe_get_procedure_address (const void * base, const char * name);
pe_api int pe_get_export_symbol_info (const void * base, const char * name, struct pe_export_sym *);
pe_api int pe_enum_image_exports (const void * base,
pe_enum_image_exports_callback *,
struct pe_export_sym *,
void * ctx);
/* image: imports api */
pe_api char * pe_get_import_symbol_info (const void * sym_addr,
struct pe_ldr_tbl_entry ** ldr_tbl_entry);
pe_api int pe_enum_image_import_hdrs (const void * base,
pe_enum_image_import_hdrs_callback *,
void * ctx);
/* process: address space api */
pe_api int pe_enum_modules_in_load_order (pe_enum_modules_callback *, void * ctx);
pe_api int pe_enum_modules_in_memory_order (pe_enum_modules_callback *, void * ctx);
pe_api int pe_enum_modules_in_init_order (pe_enum_modules_callback *, void * ctx);
pe_api void * pe_get_module_handle (const uint16_t * name);
pe_api void * pe_get_first_module_handle (void);
/* process: system api */
pe_api void * pe_get_ntdll_module_handle (void);
pe_api void * pe_get_kernel32_module_handle (void);
/* ldso */
pe_api wchar16_t * pe_get_peb_command_line(void);
pe_api wchar16_t * pe_get_peb_environment_block(void);
pe_api struct pe_ldr_tbl_entry * pe_get_ldr_entry_from_addr(const void * addr);
pe_api int32_t pe_get_framework_runtime_data(
struct pe_framework_runtime_data ** rtdata,
const wchar16_t * cmdline,
const struct pe_guid * abi);
pe_api int32_t pe_find_framework_loader(
struct pe_framework_runtime_data * rtdata,
const wchar16_t * basename,
const wchar16_t * rrelname,
void * refaddr,
uintptr_t * buffer,
uint32_t bufsize,
uint32_t flags);
pe_api int32_t pe_load_framework_library(
void ** baseaddr,
void * hat,
const wchar16_t * atrelname,
uintptr_t * buffer,
uint32_t bufsize,
uint32_t * sysflags);
pe_api int32_t pe_load_framework_loader(
void ** baseaddr,
struct pe_framework_runtime_data * rtdata,
uintptr_t * buffer,
uint32_t bufsize,
uint32_t * flags);
pe_api int32_t pe_load_framework_loader_ex(
void ** baseaddr,
void ** hroot,
void ** hdsodir,
const struct pe_guid * abi,
const wchar16_t * basename,
const wchar16_t * rrelname,
void * refaddr,
uintptr_t * buffer,
uint32_t bufsize,
uint32_t flags,
uint32_t * sysflags);
pe_api int32_t pe_open_image_from_addr(
void ** himage,
void * addr,
uintptr_t * buffer,
size_t bufsize,
uint32_t oattr,
uint32_t desired_access,
uint32_t share_access,
uint32_t open_options);
pe_api int32_t pe_open_physical_parent_directory(
void ** hparent,
void * href,
uintptr_t * buffer,
uint32_t bufsize,
uint32_t oattr,
uint32_t desired_access,
uint32_t share_access,
uint32_t open_options);
pe_api int32_t pe_terminate_current_process(
int32_t estatus);
#ifdef __cplusplus
}
#endif
#endif
|
