pe_info.hpp 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431
  1. // Copyright 2014 Renato Tegon Forti, Antony Polukhin.
  2. // Copyright 2015 Antony Polukhin.
  3. //
  4. // Distributed under the Boost Software License, Version 1.0.
  5. // (See accompanying file LICENSE_1_0.txt
  6. // or copy at http://www.boost.org/LICENSE_1_0.txt)
  7. #ifndef BOOST_DLL_DETAIL_WINDOWS_PE_INFO_HPP
  8. #define BOOST_DLL_DETAIL_WINDOWS_PE_INFO_HPP
  9. #include <boost/config.hpp>
  10. #ifdef BOOST_HAS_PRAGMA_ONCE
  11. # pragma once
  12. #endif
  13. #include <boost/cstdint.hpp>
  14. #include <boost/filesystem/fstream.hpp>
  15. #include <boost/dll/detail/x_info_interface.hpp>
  16. namespace boost { namespace dll { namespace detail {
  17. // reference:
  18. // http://www.joachim-bauch.de/tutorials/loading-a-dll-from-memory/
  19. // http://msdn.microsoft.com/en-us/magazine/ms809762.aspx
  20. // http://msdn.microsoft.com/en-us/magazine/cc301808.aspx
  21. //
  22. // Basic Windows typedefs. We can not use <boost/winapi/basic_types.hpp> header
  23. // because that header must be included only on Windows platform
  24. typedef unsigned char BYTE_;
  25. typedef unsigned short WORD_;
  26. typedef boost::uint32_t DWORD_;
  27. typedef boost::int32_t LONG_;
  28. typedef boost::uint32_t ULONG_;
  29. typedef boost::int64_t LONGLONG_;
  30. typedef boost::uint64_t ULONGLONG_;
  31. struct IMAGE_DOS_HEADER_ { // 32/64 independent header
  32. boost::dll::detail::WORD_ e_magic; // Magic number
  33. boost::dll::detail::WORD_ e_cblp; // Bytes on last page of file
  34. boost::dll::detail::WORD_ e_cp; // Pages in file
  35. boost::dll::detail::WORD_ e_crlc; // Relocations
  36. boost::dll::detail::WORD_ e_cparhdr; // Size of header in paragraphs
  37. boost::dll::detail::WORD_ e_minalloc; // Minimum extra paragraphs needed
  38. boost::dll::detail::WORD_ e_maxalloc; // Maximum extra paragraphs needed
  39. boost::dll::detail::WORD_ e_ss; // Initial (relative) SS value
  40. boost::dll::detail::WORD_ e_sp; // Initial SP value
  41. boost::dll::detail::WORD_ e_csum; // Checksum
  42. boost::dll::detail::WORD_ e_ip; // Initial IP value
  43. boost::dll::detail::WORD_ e_cs; // Initial (relative) CS value
  44. boost::dll::detail::WORD_ e_lfarlc; // File address of relocation table
  45. boost::dll::detail::WORD_ e_ovno; // Overlay number
  46. boost::dll::detail::WORD_ e_res[4]; // Reserved words
  47. boost::dll::detail::WORD_ e_oemid; // OEM identifier (for e_oeminfo)
  48. boost::dll::detail::WORD_ e_oeminfo; // OEM information; e_oemid specific
  49. boost::dll::detail::WORD_ e_res2[10]; // Reserved words
  50. boost::dll::detail::LONG_ e_lfanew; // File address of new exe header
  51. };
  52. struct IMAGE_FILE_HEADER_ { // 32/64 independent header
  53. boost::dll::detail::WORD_ Machine;
  54. boost::dll::detail::WORD_ NumberOfSections;
  55. boost::dll::detail::DWORD_ TimeDateStamp;
  56. boost::dll::detail::DWORD_ PointerToSymbolTable;
  57. boost::dll::detail::DWORD_ NumberOfSymbols;
  58. boost::dll::detail::WORD_ SizeOfOptionalHeader;
  59. boost::dll::detail::WORD_ Characteristics;
  60. };
  61. struct IMAGE_DATA_DIRECTORY_ { // 32/64 independent header
  62. boost::dll::detail::DWORD_ VirtualAddress;
  63. boost::dll::detail::DWORD_ Size;
  64. };
  65. struct IMAGE_EXPORT_DIRECTORY_ { // 32/64 independent header
  66. boost::dll::detail::DWORD_ Characteristics;
  67. boost::dll::detail::DWORD_ TimeDateStamp;
  68. boost::dll::detail::WORD_ MajorVersion;
  69. boost::dll::detail::WORD_ MinorVersion;
  70. boost::dll::detail::DWORD_ Name;
  71. boost::dll::detail::DWORD_ Base;
  72. boost::dll::detail::DWORD_ NumberOfFunctions;
  73. boost::dll::detail::DWORD_ NumberOfNames;
  74. boost::dll::detail::DWORD_ AddressOfFunctions;
  75. boost::dll::detail::DWORD_ AddressOfNames;
  76. boost::dll::detail::DWORD_ AddressOfNameOrdinals;
  77. };
  78. struct IMAGE_SECTION_HEADER_ { // 32/64 independent header
  79. static const std::size_t IMAGE_SIZEOF_SHORT_NAME_ = 8;
  80. boost::dll::detail::BYTE_ Name[IMAGE_SIZEOF_SHORT_NAME_];
  81. union {
  82. boost::dll::detail::DWORD_ PhysicalAddress;
  83. boost::dll::detail::DWORD_ VirtualSize;
  84. } Misc;
  85. boost::dll::detail::DWORD_ VirtualAddress;
  86. boost::dll::detail::DWORD_ SizeOfRawData;
  87. boost::dll::detail::DWORD_ PointerToRawData;
  88. boost::dll::detail::DWORD_ PointerToRelocations;
  89. boost::dll::detail::DWORD_ PointerToLinenumbers;
  90. boost::dll::detail::WORD_ NumberOfRelocations;
  91. boost::dll::detail::WORD_ NumberOfLinenumbers;
  92. boost::dll::detail::DWORD_ Characteristics;
  93. };
  94. template <class AddressOffsetT>
  95. struct IMAGE_OPTIONAL_HEADER_template {
  96. static const std::size_t IMAGE_NUMBEROF_DIRECTORY_ENTRIES_ = 16;
  97. boost::dll::detail::WORD_ Magic;
  98. boost::dll::detail::BYTE_ MajorLinkerVersion;
  99. boost::dll::detail::BYTE_ MinorLinkerVersion;
  100. boost::dll::detail::DWORD_ SizeOfCode;
  101. boost::dll::detail::DWORD_ SizeOfInitializedData;
  102. boost::dll::detail::DWORD_ SizeOfUninitializedData;
  103. boost::dll::detail::DWORD_ AddressOfEntryPoint;
  104. union {
  105. boost::dll::detail::DWORD_ BaseOfCode;
  106. unsigned char padding_[sizeof(AddressOffsetT) == 8 ? 4 : 8]; // in x64 version BaseOfData does not exist
  107. } BaseOfCode_and_BaseOfData;
  108. AddressOffsetT ImageBase;
  109. boost::dll::detail::DWORD_ SectionAlignment;
  110. boost::dll::detail::DWORD_ FileAlignment;
  111. boost::dll::detail::WORD_ MajorOperatingSystemVersion;
  112. boost::dll::detail::WORD_ MinorOperatingSystemVersion;
  113. boost::dll::detail::WORD_ MajorImageVersion;
  114. boost::dll::detail::WORD_ MinorImageVersion;
  115. boost::dll::detail::WORD_ MajorSubsystemVersion;
  116. boost::dll::detail::WORD_ MinorSubsystemVersion;
  117. boost::dll::detail::DWORD_ Win32VersionValue;
  118. boost::dll::detail::DWORD_ SizeOfImage;
  119. boost::dll::detail::DWORD_ SizeOfHeaders;
  120. boost::dll::detail::DWORD_ CheckSum;
  121. boost::dll::detail::WORD_ Subsystem;
  122. boost::dll::detail::WORD_ DllCharacteristics;
  123. AddressOffsetT SizeOfStackReserve;
  124. AddressOffsetT SizeOfStackCommit;
  125. AddressOffsetT SizeOfHeapReserve;
  126. AddressOffsetT SizeOfHeapCommit;
  127. boost::dll::detail::DWORD_ LoaderFlags;
  128. boost::dll::detail::DWORD_ NumberOfRvaAndSizes;
  129. IMAGE_DATA_DIRECTORY_ DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES_];
  130. };
  131. typedef IMAGE_OPTIONAL_HEADER_template<boost::dll::detail::DWORD_> IMAGE_OPTIONAL_HEADER32_;
  132. typedef IMAGE_OPTIONAL_HEADER_template<boost::dll::detail::ULONGLONG_> IMAGE_OPTIONAL_HEADER64_;
  133. template <class AddressOffsetT>
  134. struct IMAGE_NT_HEADERS_template {
  135. boost::dll::detail::DWORD_ Signature;
  136. IMAGE_FILE_HEADER_ FileHeader;
  137. IMAGE_OPTIONAL_HEADER_template<AddressOffsetT> OptionalHeader;
  138. };
  139. typedef IMAGE_NT_HEADERS_template<boost::dll::detail::DWORD_> IMAGE_NT_HEADERS32_;
  140. typedef IMAGE_NT_HEADERS_template<boost::dll::detail::ULONGLONG_> IMAGE_NT_HEADERS64_;
  141. template <class AddressOffsetT>
  142. class pe_info: public x_info_interface {
  143. boost::filesystem::ifstream& f_;
  144. typedef IMAGE_NT_HEADERS_template<AddressOffsetT> header_t;
  145. typedef IMAGE_EXPORT_DIRECTORY_ exports_t;
  146. typedef IMAGE_SECTION_HEADER_ section_t;
  147. typedef IMAGE_DOS_HEADER_ dos_t;
  148. template <class T>
  149. inline void read_raw(T& value, std::size_t size = sizeof(T)) const {
  150. f_.read(reinterpret_cast<char*>(&value), size);
  151. }
  152. public:
  153. static bool parsing_supported(boost::filesystem::ifstream& f) {
  154. dos_t dos;
  155. f.seekg(0);
  156. f.read(reinterpret_cast<char*>(&dos), sizeof(dos));
  157. // 'MZ' and 'ZM' according to Wikipedia
  158. if (dos.e_magic != 0x4D5A && dos.e_magic != 0x5A4D) {
  159. return false;
  160. }
  161. header_t h;
  162. f.seekg(dos.e_lfanew);
  163. f.read(reinterpret_cast<char*>(&h), sizeof(h));
  164. return h.Signature == 0x00004550 // 'PE00'
  165. && h.OptionalHeader.Magic == (sizeof(boost::uint32_t) == sizeof(AddressOffsetT) ? 0x10B : 0x20B);
  166. }
  167. explicit pe_info(boost::filesystem::ifstream& f) BOOST_NOEXCEPT
  168. : f_(f)
  169. {}
  170. private:
  171. inline header_t header() {
  172. header_t h;
  173. dos_t dos;
  174. f_.seekg(0);
  175. read_raw(dos);
  176. f_.seekg(dos.e_lfanew);
  177. read_raw(h);
  178. return h;
  179. }
  180. inline exports_t exports(const header_t& h) {
  181. exports_t exports;
  182. static const unsigned int IMAGE_DIRECTORY_ENTRY_EXPORT_ = 0;
  183. const std::size_t exp_virtual_address = h.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT_].VirtualAddress;
  184. const std::size_t real_offset = get_file_offset(exp_virtual_address, h);
  185. BOOST_ASSERT(real_offset);
  186. f_.seekg(real_offset);
  187. read_raw(exports);
  188. return exports;
  189. }
  190. std::size_t get_file_offset(std::size_t virtual_address, const header_t& h) {
  191. section_t image_section_header;
  192. { // f_.seekg to the beginning on section headers
  193. dos_t dos;
  194. f_.seekg(0);
  195. read_raw(dos);
  196. f_.seekg(dos.e_lfanew + sizeof(header_t));
  197. }
  198. for (std::size_t i = 0;i < h.FileHeader.NumberOfSections;++i) {
  199. read_raw(image_section_header);
  200. if (virtual_address >= image_section_header.VirtualAddress
  201. && virtual_address < image_section_header.VirtualAddress + image_section_header.SizeOfRawData)
  202. {
  203. return image_section_header.PointerToRawData + virtual_address - image_section_header.VirtualAddress;
  204. }
  205. }
  206. return 0;
  207. }
  208. public:
  209. std::vector<std::string> sections() {
  210. std::vector<std::string> ret;
  211. const header_t h = header();
  212. ret.reserve(h.FileHeader.NumberOfSections);
  213. // get names, e.g: .text .rdata .data .rsrc .reloc
  214. section_t image_section_header;
  215. char name_helper[section_t::IMAGE_SIZEOF_SHORT_NAME_ + 1];
  216. std::memset(name_helper, 0, sizeof(name_helper));
  217. for (std::size_t i = 0;i < h.FileHeader.NumberOfSections;++i) {
  218. // There is no terminating null character if the string is exactly eight characters long
  219. read_raw(image_section_header);
  220. std::memcpy(name_helper, image_section_header.Name, section_t::IMAGE_SIZEOF_SHORT_NAME_);
  221. if (name_helper[0] != '/') {
  222. ret.push_back(name_helper);
  223. } else {
  224. // For longer names, image_section_header.Name contains a slash (/) followed by ASCII representation of a decimal number.
  225. // this number is an offset into the string table.
  226. // TODO: fixme
  227. ret.push_back(name_helper);
  228. }
  229. }
  230. return ret;
  231. }
  232. std::vector<std::string> symbols() {
  233. std::vector<std::string> ret;
  234. const header_t h = header();
  235. const exports_t exprt = exports(h);
  236. const std::size_t exported_symbols = exprt.NumberOfNames;
  237. const std::size_t fixed_names_addr = get_file_offset(exprt.AddressOfNames, h);
  238. ret.reserve(exported_symbols);
  239. boost::dll::detail::DWORD_ name_offset;
  240. std::string symbol_name;
  241. for (std::size_t i = 0;i < exported_symbols;++i) {
  242. f_.seekg(fixed_names_addr + i * sizeof(name_offset));
  243. read_raw(name_offset);
  244. f_.seekg(get_file_offset(name_offset, h));
  245. getline(f_, symbol_name, '\0');
  246. ret.push_back(symbol_name);
  247. }
  248. return ret;
  249. }
  250. std::vector<std::string> symbols(const char* section_name) {
  251. std::vector<std::string> ret;
  252. const header_t h = header();
  253. std::size_t section_begin_addr = 0;
  254. std::size_t section_end_addr = 0;
  255. { // getting address range for the section
  256. section_t image_section_header;
  257. char name_helper[section_t::IMAGE_SIZEOF_SHORT_NAME_ + 1];
  258. std::memset(name_helper, 0, sizeof(name_helper));
  259. for (std::size_t i = 0;i < h.FileHeader.NumberOfSections;++i) {
  260. // There is no terminating null character if the string is exactly eight characters long
  261. read_raw(image_section_header);
  262. std::memcpy(name_helper, image_section_header.Name, section_t::IMAGE_SIZEOF_SHORT_NAME_);
  263. if (!std::strcmp(section_name, name_helper)) {
  264. section_begin_addr = image_section_header.PointerToRawData;
  265. section_end_addr = section_begin_addr + image_section_header.SizeOfRawData;
  266. }
  267. }
  268. // returning empty result if section was not found
  269. if(section_begin_addr == 0 || section_end_addr == 0)
  270. return ret;
  271. }
  272. const exports_t exprt = exports(h);
  273. const std::size_t exported_symbols = exprt.NumberOfFunctions;
  274. const std::size_t fixed_names_addr = get_file_offset(exprt.AddressOfNames, h);
  275. const std::size_t fixed_ordinals_addr = get_file_offset(exprt.AddressOfNameOrdinals, h);
  276. const std::size_t fixed_functions_addr = get_file_offset(exprt.AddressOfFunctions, h);
  277. ret.reserve(exported_symbols);
  278. boost::dll::detail::DWORD_ ptr;
  279. boost::dll::detail::WORD_ ordinal;
  280. std::string symbol_name;
  281. for (std::size_t i = 0;i < exported_symbols;++i) {
  282. // getting ordinal
  283. f_.seekg(fixed_ordinals_addr + i * sizeof(ordinal));
  284. read_raw(ordinal);
  285. // getting function addr
  286. f_.seekg(fixed_functions_addr + ordinal * sizeof(ptr));
  287. read_raw(ptr);
  288. ptr = static_cast<boost::dll::detail::DWORD_>( get_file_offset(ptr, h) );
  289. if (ptr >= section_end_addr || ptr < section_begin_addr) {
  290. continue;
  291. }
  292. f_.seekg(fixed_names_addr + i * sizeof(ptr));
  293. read_raw(ptr);
  294. f_.seekg(get_file_offset(ptr, h));
  295. getline(f_, symbol_name, '\0');
  296. ret.push_back(symbol_name);
  297. }
  298. return ret;
  299. }
  300. // a test method to get dependents modules,
  301. // who my plugin imports (1st level only)
  302. /*
  303. e.g. for myself I get:
  304. KERNEL32.dll
  305. MSVCP110D.dll
  306. boost_system-vc-mt-gd-1_56.dll
  307. MSVCR110D.dll
  308. */
  309. /*
  310. std::vector<std::string> depend_of(boost::system::error_code &ec) BOOST_NOEXCEPT {
  311. std::vector<std::string> ret;
  312. IMAGE_DOS_HEADER* image_dos_header = (IMAGE_DOS_HEADER*)native();
  313. if(!image_dos_header) {
  314. // ERROR_BAD_EXE_FORMAT
  315. ec = boost::system::error_code(
  316. boost::system::errc::executable_format_error,
  317. boost::system::generic_category()
  318. );
  319. return ret;
  320. }
  321. IMAGE_OPTIONAL_HEADER* image_optional_header = (IMAGE_OPTIONAL_HEADER*)((boost::dll::detail::BYTE_*)native() + image_dos_header->e_lfanew + 24);
  322. if(!image_optional_header) {
  323. // ERROR_BAD_EXE_FORMAT
  324. ec = boost::system::error_code(
  325. boost::system::errc::executable_format_error,
  326. boost::system::generic_category()
  327. );
  328. return ret;
  329. }
  330. IMAGE_IMPORT_DESCRIPTOR* image_import_descriptor = (IMAGE_IMPORT_DESCRIPTOR*)((boost::dll::detail::BYTE_*)native() + image_optional_header->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
  331. if(!image_import_descriptor) {
  332. // ERROR_BAD_EXE_FORMAT
  333. ec = boost::system::error_code(
  334. boost::system::errc::executable_format_error,
  335. boost::system::generic_category()
  336. );
  337. return ret;
  338. }
  339. while(image_import_descriptor->FirstThunk) {
  340. std::string module_name = reinterpret_cast<char*>((boost::dll::detail::BYTE_*)native() + image_import_descriptor->Name);
  341. if(module_name.size()) {
  342. ret.push_back(module_name);
  343. }
  344. image_import_descriptor++;
  345. }
  346. return ret;
  347. }
  348. */
  349. };
  350. typedef pe_info<boost::dll::detail::DWORD_> pe_info32;
  351. typedef pe_info<boost::dll::detail::ULONGLONG_> pe_info64;
  352. }}} // namespace boost::dll::detail
  353. #endif // BOOST_DLL_DETAIL_WINDOWS_PE_INFO_HPP