14 stream << std::hex <<
itr->first <<
" :\n";
16 std::set<ExportedFunc>::const_iterator
itr2;
17 const std::set<ExportedFunc> &
funcs =
itr->second;
27 std::map<ExportedFunc, ULONGLONG>::const_iterator
itr;
30 << std::hex <<
itr->second <<
"\n";
43size_t ExportsMapper::make_ord_lookup_tables(
61 std::cout <<
">>> Skipping 0 function address at RVA:" << std::hex << (
BYTE*)
recordRVA - (
BYTE*)modulePtr<<
"(ord)\n";
82 std::set<ExportedFunc>::iterator
sItr;
109 std::cerr <<
"Skipped invalid forwarder" << std::endl;
143 if (
exp ==
nullptr)
return false;
181 std::cout <<
"FWD " <<
currFunc.toString() <<
" -> " <<
fPtr <<
"\n";
183 return ExportsMapper::RES_FORWARDED;
190 std::cout <<
"Validation failed: " <<
currFunc.toString() <<
"\n";
192 return ExportsMapper::RES_INVALID;
196 return ExportsMapper::RES_MAPPED;
217 const std::string dllName =
info.shortName;
240 std::cout <<
">>> Skipping 0 function address at RVA:" << std::hex << (
BYTE*)
funcRVA - (
BYTE*)modulePtr <<
"(name)\n";
270 std::cout <<
"Finished exports parsing, mapped: "<<
mapped_ctr <<
" forwarded: " <<
forwarded_ctr << std::endl;
282 const std::set<ULONGLONG>&
bases =
itr->second;
283 std::set<ULONGLONG>::const_iterator
bItr;
299 const std::set<ULONGLONG>&
bases =
itr->second;
300 std::set<ULONGLONG>::const_iterator
bItr;
void print_va_to_func(std::stringstream &stream) const
size_t get_dll_paths(IN std::string short_name, OUT std::set< std::string > &paths) const
std::map< ULONGLONG, DllInfo > dll_base_to_info
std::map< std::string, std::set< ULONGLONG > > dll_shortname_to_base
size_t add_to_lookup(std::string moduleName, HMODULE modulePtr, size_t moduleSize, ULONGLONG moduleBase)
void associateVaAndFunc(ULONGLONG va, const ExportedFunc &func)
std::string get_dll_path(ULONGLONG base) const
std::map< ExportedFunc, ULONGLONG > func_to_va
void print_func_to_va(std::stringstream &stream) const
std::map< ExportedFunc, std::set< ExportedFunc > > forwarders_lookup
std::map< ULONGLONG, std::set< ExportedFunc > > va_to_func
bool parse_delayed_desc(BYTE *modulePtr, const size_t moduleSize, const ULONGLONG img_base, LPSTR lib_name, const T_FIELD ordinal_flag, IMAGE_DELAYLOAD_DESCRIPTOR *desc, peconv::t_function_resolver *func_resolver)
ULONGLONG rebase_va(ULONGLONG va, ULONGLONG currBase, ULONGLONG targetBase)
bool is_valid_export_table(IMAGE_EXPORT_DIRECTORY *exp, HMODULE modulePtr, const size_t module_size)
DWORD get_ordinal(PDWORD recordPtr, std::map< PDWORD, DWORD > &va_to_ord)
A definition of ExportsMapper class. Creates a lookup of all the exported functions from the supplied...
size_t forwarder_name_len(BYTE *fPtr)
bool validate_ptr(IN const void *buffer_bgn, IN size_t buffer_size, IN const void *field_bgn, IN size_t field_size)
DWORD get_image_size(IN const BYTE *payload)
bool is64bit(IN const BYTE *pe_buffer)
std::string format_dll_func(const std::string &str)
IMAGE_EXPORT_DIRECTORY * get_export_directory(IN HMODULE modulePtr)