4#define getStructFieldOffset(STRUCT, FIELD) ((ULONGLONG) &(STRUCT.FIELD) - (ULONGLONG)&STRUCT)
6bufsize_t LdConfigDirWrapper::getLdConfigDirSize()
11 dirSize =
sizeof(pe::IMAGE_LOAD_CONFIG_DIRECTORY32);
13 dirSize =
sizeof(pe::IMAGE_LOAD_CONFIG_DIRECTORY64);
18bufsize_t LdConfigDirWrapper::getHdrDefinedSize()
32 pe::IMAGE_LOAD_CONFIG_DIRECTORY32 ld = { 0 };
36 pe::IMAGE_LOAD_CONFIG_DIRECTORY64 ld = { 0 };
40 if (!sizePtr)
return 0;
44void* LdConfigDirWrapper::getLdConfigDirPtr()
51bool LdConfigDirWrapper::wrapSubentriesTable(
size_t parentFieldId,
size_t counterFieldId)
54 size_t count = this->
getNumValue(counterFieldId, &isOk);
58 for (
size_t i = 0 ; i < count; i++) {
60 if (!entry || !entry->
getPtr()) {
65 this->subEntriesMap[parentFieldId].push_back(entry);
73 if (!
getPtr())
return false;
89 return getLdConfigDirPtr();
94 std::map<uint32_t, std::vector<ExeNodeWrapper*> >::iterator mapItr;
95 for (mapItr = this->subEntriesMap.begin(); mapItr != this->subEntriesMap.end(); ++mapItr) {
96 std::vector<ExeNodeWrapper*> &vec = mapItr->second;
106 if (!isOk)
return NULL;
113 if (!ptr)
return NULL;
125 const bufsize_t hdrSize = this->getHdrDefinedSize();
126 const bufsize_t structSize = getLdConfigDirSize();
127 const bufsize_t totalSize = (hdrSize < structSize) ? hdrSize : structSize;
129 const offset_t rvaEnd = rva + totalSize - 1;
136offset_t LdConfigDirWrapper::_getFieldDelta(
bool is32b,
size_t fId)
138 static pe::IMAGE_LOAD_CONFIG_DIRECTORY32 ld32 = { 0 };
139 static pe::IMAGE_LOAD_CONFIG_DIRECTORY64 ld64 = { 0 };
302 offset_t fieldDelta = _getFieldDelta(is32b, fId);
304 const offset_t hdrSize = this->getHdrDefinedSize();
305 if (fieldDelta >= hdrSize) {
315 if (!
m_Exe)
return "";
318 case SIZE :
return "Size";
319 case TIMEST :
return "TimeDateStamp";
328 case MAX_ALLOC :
return "MaximumAllocationSize";
329 case VIRTUAL_MEM :
return "VirtualMemoryThreshold";
332 return (is32bit) ?
"ProcessHeapFlags" :
"ProcessAffinityMask";
336 return (is32bit) ?
"ProcessAffinityMask" :
"ProcessHeapFlags";
338 case CSD_VER :
return "CSDVersion";
342 case SEH_TABLE :
return "SEHandlerTable";
343 case SEH_COUNT :
return "SEHandlerCount";
345 case GUARD_CHECK :
return "GuardCFCheckFunctionPtr";
405 const size_t guardFlagsCount = 13;
406 const DWORD guardFlags[guardFlagsCount] = {
407 IMAGE_GUARD_CF_INSTRUMENTED,
408 IMAGE_GUARD_CFW_INSTRUMENTED,
409 IMAGE_GUARD_CF_FUNCTION_TABLE_PRESENT,
410 IMAGE_GUARD_SECURITY_COOKIE_UNUSED,
411 IMAGE_GUARD_PROTECT_DELAYLOAD_IAT,
412 IMAGE_GUARD_DELAYLOAD_IAT_IN_ITS_OWN_SECTION,
413 IMAGE_GUARD_CF_EXPORT_SUPPRESSION_INFO_PRESENT,
414 IMAGE_GUARD_CF_ENABLE_EXPORT_SUPPRESSION,
415 IMAGE_GUARD_CF_LONGJUMP_TABLE_PRESENT,
416 IMAGE_GUARD_RF_INSTRUMENTED,
417 IMAGE_GUARD_RF_ENABLE,
418 IMAGE_GUARD_RF_STRICT,
419 IMAGE_GUARD_RETPOLINE_PRESENT
421 std::set<DWORD> allFlags;
422 for (
size_t i = 0; i < guardFlagsCount; ++i) {
423 const DWORD nextFlag = guardFlags[i];
424 if (flags & nextFlag) {
425 allFlags.insert(nextFlag);
433 if (flags & IMAGE_GUARD_CF_INSTRUMENTED) {
434 return (
"CF_INSTRUMENTED");
436 if (flags & IMAGE_GUARD_CFW_INSTRUMENTED) {
437 return (
"CFW_INSTRUMENTED");
439 if (flags & IMAGE_GUARD_CF_FUNCTION_TABLE_PRESENT) {
440 return (
"CF_FUNCTION_TABLE_PRESENT");
442 if (flags & IMAGE_GUARD_SECURITY_COOKIE_UNUSED) {
443 return (
"SECURITY_COOKIE_UNUSED");
445 if (flags & IMAGE_GUARD_PROTECT_DELAYLOAD_IAT) {
446 return (
"PROTECT_DELAYLOAD_IAT");
448 if (flags & IMAGE_GUARD_DELAYLOAD_IAT_IN_ITS_OWN_SECTION) {
449 return (
"DELAYLOAD_IAT_IN_ITS_OWN_SECTION");
451 if (flags & IMAGE_GUARD_CF_EXPORT_SUPPRESSION_INFO_PRESENT) {
452 return (
"CF_EXPORT_SUPPRESSION_INFO_PRESENT");
454 if (flags & IMAGE_GUARD_CF_ENABLE_EXPORT_SUPPRESSION) {
455 return (
"CF_ENABLE_EXPORT_SUPPRESSION");
457 if (flags & IMAGE_GUARD_CF_LONGJUMP_TABLE_PRESENT) {
458 return (
"CF_LONGJUMP_TABLE_PRESENT");
460 if (flags & IMAGE_GUARD_RF_INSTRUMENTED) {
461 return (
"RF_INSTRUMENTED");
463 if (flags & IMAGE_GUARD_RF_ENABLE) {
464 return (
"RF_ENABLE");
466 if (flags & IMAGE_GUARD_RF_STRICT) {
467 return (
"RF_STRICT");
469 if (flags & IMAGE_GUARD_RETPOLINE_PRESENT) {
470 return (
"RETPOLINE_PRESENT");
483 std::set<DWORD>::iterator itr;
485 for (itr = flagsSet.begin() ; itr != flagsSet.end(); ++itr) {
486 const DWORD nextFlag = *itr;
488 if (flagInfo.length() == 0)
continue;
489 list.append(flagInfo);
491 return list.join(delim);
505 if (this->parentDir == NULL)
return NULL;
508 if (first == NULL)
return NULL;
510 if (fieldSize == 0)
return NULL;
517 offset += fieldOffset;
524 if (this->parentDir == NULL)
return 0;
533 if (!ptr)
return NULL;
535 if (fieldId ==
NONE) {
539 if (fieldId >= counter)
return NULL;
543 return (
void*)((ULONGLONG)ptr +
sizeof(DWORD));
549 if (fieldId >= count) {
553 return sizeof(DWORD);
const offset_t INVALID_ADDR
#define getStructFieldOffset(STRUCT, FIELD)
offset_t getDirEntryAddress()
virtual offset_t getOffset()
virtual uint64_t getNumValue(size_t fieldId, size_t subField, bool *isOk)
std::vector< ExeNodeWrapper * > entries
virtual exe_bits getBitMode()
virtual bool isValidAddr(offset_t addr, addr_type addrType)
BYTE * getContentAt(offset_t offset, bufsize_t size, bool allowExceptions=false)
virtual offset_t rvaToRaw(offset_t rva)=0
virtual void * getFieldPtr(size_t fieldId, size_t subField)
virtual bufsize_t getSize()
size_t firstSubEntrySize(size_t parentId)
static QString translateGuardFlag(DWORD flags)
QString translateGuardFlagsContent(const QString &delim)
static std::set< DWORD > getGuardFlagsSet(DWORD flags)
virtual QString getFieldName(size_t fieldId)
void * firstSubEntryPtr(size_t parentId)
virtual QString getName()
virtual QString translateFieldContent(size_t fieldId)
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField=FIELD_NONE)
@ DYNAMIC_VAL_RELOC_TABLE_SECTION
@ DYNAMIC_VAL_RELOC_TABLE_OFFSET
@ GUARD_ADDR_IAT_ENTRY_TABLE
@ CODE_INTEGRITY_RESERVED
@ GUARD_ADDR_IAT_ENTRY_COUNT
@ GUARD_FAILURE_ROUTINE_FUNC_PTR
@ CODE_INTEGRITY_CATALOG_OFFSET
friend class LdConfigEntryWrapper
virtual void * getFieldPtr(size_t fieldId, size_t subField=FIELD_NONE)
virtual bufsize_t getSize()
virtual size_t getFieldsCount()
bufsize_t getFieldSize(size_t fieldId, size_t subField)