caves.cpp

Go to the documentation of this file.

#include "peconv/caves.h"
#include "peconv/pe_hdrs_helper.h"
#include "peconv/util.h"
#include "peconv/logger.h"
 
using namespace peconv;
 
PBYTE peconv::find_ending_cave(BYTE* modulePtr, size_t moduleSize, const DWORD minimal_size, const DWORD req_charact, bool reserve)
{
    if (!modulePtr || !moduleSize) return nullptr;
 
    size_t sec_count = peconv::get_sections_count(modulePtr, moduleSize);
    if (sec_count == 0) return nullptr;
 
    const size_t last_sec = sec_count - 1;
    const PIMAGE_SECTION_HEADER section_hdr = peconv::get_section_hdr(modulePtr, moduleSize, last_sec);
    if (!section_hdr) return nullptr;
    if (!(section_hdr->Characteristics & req_charact)) return nullptr;
 
    const DWORD raw_size = section_hdr->SizeOfRawData;
    const size_t vsize_full = moduleSize - section_hdr->VirtualAddress;
    if (vsize_full > MAXDWORD) return nullptr;
 
    const DWORD virtual_size = static_cast<DWORD>(vsize_full);
    if (raw_size >= virtual_size) {
        LOG_INFO("Last section's raw_size: 0x%lx >= virtual_size: 0x%lx", raw_size, virtual_size);
        return nullptr;
    }
    const DWORD cave_size = virtual_size - raw_size;
    if (cave_size < minimal_size) {
        LOG_INFO("Cave is too small.");
        return nullptr;
    }
    const PBYTE cave_ptr = modulePtr + section_hdr->VirtualAddress + section_hdr->SizeOfRawData;
    if (!validate_ptr(modulePtr, moduleSize, cave_ptr, minimal_size)) {
        LOG_INFO("Invalid cave pointer.");
        return nullptr;
    }
    if (reserve) {
        section_hdr->SizeOfRawData += minimal_size; //book this cave
    }
    return cave_ptr;
}
 
PBYTE peconv::find_alignment_cave(BYTE* modulePtr, size_t moduleSize, const DWORD minimal_size, const DWORD req_charact, bool reserve)
{
    DWORD alignment = peconv::get_sec_alignment(modulePtr, true);
    if (alignment == 0) return nullptr;
 
    size_t sec_count = peconv::get_sections_count(modulePtr, moduleSize);
    for (size_t i = 0; i < sec_count; i++) {
        PIMAGE_SECTION_HEADER section_hdr = peconv::get_section_hdr(modulePtr, moduleSize, i);
        if (section_hdr == nullptr) continue;
        if (!(section_hdr->Characteristics & req_charact)) continue;
 
        DWORD rem = section_hdr->SizeOfRawData % alignment;
        if (rem == 0) continue;
 
        DWORD new_size = peconv::round_up_to_unit(section_hdr->SizeOfRawData, alignment);
        DWORD cave_size = new_size - section_hdr->SizeOfRawData;
        if (cave_size < minimal_size) {
            LOG_INFO("Cave is too small.");
            continue;
        }
        DWORD sec_start = section_hdr->PointerToRawData;
        if (sec_start == 0) continue;
 
        DWORD sec_end = sec_start + section_hdr->SizeOfRawData;
        LOG_INFO("Section: 0x%lx : 0x%lx", sec_start, sec_end);
        PBYTE cave_ptr = modulePtr + sec_end;
        if (!validate_ptr(modulePtr, moduleSize, cave_ptr, minimal_size)) {
            LOG_INFO("Invalid cave pointer.");
            continue;
        }
        if (reserve) {
            section_hdr->SizeOfRawData += minimal_size; //book this cave
        }
        return cave_ptr;
    }
    LOG_INFO("Cave not found.");
    return nullptr;
}
 
PBYTE peconv::find_padding_cave(BYTE* modulePtr, size_t moduleSize, const size_t minimal_size, const DWORD req_charact)
{
    size_t sec_count = peconv::get_sections_count(modulePtr, moduleSize);
    for (size_t i = 0; i < sec_count; i++) {
        PIMAGE_SECTION_HEADER section_hdr = peconv::get_section_hdr(modulePtr, moduleSize, i);
        if (section_hdr == nullptr) continue;
        if (!(section_hdr->Characteristics & req_charact)) continue;
 
        if (section_hdr->SizeOfRawData < minimal_size) continue;
 
        // we will be searching in the loaded, virtual image:
        DWORD sec_start = section_hdr->VirtualAddress;
        if (sec_start == 0) continue;
 
        DWORD sec_end = sec_start + section_hdr->SizeOfRawData;
        LOG_INFO("Section: 0x%lx : 0x%lx", sec_start, sec_end);
        //offset from the end of the section:
        size_t cave_offset = section_hdr->SizeOfRawData - minimal_size;
        PBYTE cave_ptr = modulePtr + sec_start + cave_offset;
        if (!validate_ptr(modulePtr, moduleSize, cave_ptr, minimal_size)) {
            LOG_INFO("Invalid cave pointer.");
            continue;
        }
        bool found = false;
        if (is_padding(cave_ptr, minimal_size, 0)) {
            found = true;
        }
        //if the section is code, check also code padding:
        if (section_hdr->Characteristics & IMAGE_SCN_MEM_EXECUTE) {
            if (is_padding(cave_ptr, minimal_size, 0xCC)) {
                found = true;
            }
        }
        if (found) {
            return cave_ptr;
        }
    }
    LOG_INFO("Cave not found.");
    return nullptr;
}