10template <
typename FIELD_T>
35 if (exportsMap.find_export_by_va(
searchedAddr) !=
nullptr) {
53 std::cerr <<
"Cannot find any DLL exporting: " << std::hex <<
func_addr << std::endl;
85 std::set<ULONGLONG>::iterator
addrItr;
128 if (found_name.length() == 0) {
130 std::cerr <<
"Cannot find a covering DLL" << std::endl;
136 std::cout <<
"[+] Found DLL name: " <<
found_name << std::endl;
149 std::set<ULONGLONG>::iterator
addrItr;
158 std::cerr <<
"Cannot find any DLL exporting: " << std::hex <<
searchedAddr << std::endl;
179 std::cerr <<
"[WARNING] A function: " <<
func->
toString() <<
" not found in the covering DLL: " <<
chosenDll << std::endl;
198 std::cout <<
"[-] Not all addresses are covered! Not found: " << std::dec <<
notFound.size() << std::endl;
201 std::cout <<
"All covered!" << std::endl;
210 std::cerr <<
"[-] Function not recovered: [" << std::hex <<
searchedAddr <<
"] " << std::endl;
238 std::cout <<
"[-] Invalid descriptor pointer!\n";
264 std::set<ULONGLONG> addresses;
305 std::cout <<
"---------" << std::endl;
std::string toString() const
const std::set< ExportedFunc > * find_exports_by_va(ULONGLONG va) const
std::string mappedDllName
const peconv::ExportsMapper & exportsMap
size_t mapAddressesToFunctions(const std::string &_mappedDllName)
std::set< ULONGLONG > notFound
std::set< ULONGLONG > & addresses
std::map< ULONGLONG, std::set< ExportedFunc > > addrToFunc
void insert(DWORD thunkRVA, ULONGLONG searchedAddr)
std::map< DWORD, ULONGLONG > thunkToAddr
bool parse_delayed_desc(BYTE *modulePtr, const size_t moduleSize, const ULONGLONG img_base, LPSTR lib_name, const T_FIELD ordinal_flag, IMAGE_DELAYLOAD_DESCRIPTOR *desc, peconv::t_function_resolver *func_resolver)
Functions related to operations on files. Wrappers for read/write.
std::string find_covering_dll(std::set< ULONGLONG > &addresses, const peconv::ExportsMapper &exportsMap)
size_t map_addresses_to_functions(std::set< ULONGLONG > &addresses, IN const std::string &chosenDll, IN const peconv::ExportsMapper &exportsMap, OUT std::map< ULONGLONG, std::set< ExportedFunc > > &addr_to_func, OUT std::set< ULONGLONG > ¬_found)
std::set< std::string > get_all_dlls_exporting_function(ULONGLONG func_addr, const peconv::ExportsMapper &exportsMap)
size_t find_addresses_to_fill(FIELD_T call_via, FIELD_T thunk_addr, LPVOID modulePtr, size_t moduleSize, IN const peconv::ExportsMapper &exportsMap, OUT std::set< ULONGLONG > &addresses)
std::set< std::string > get_dlls_intersection(const std::set< std::string > &dllNames, const std::set< std::string > &currDllNames)
Functions and classes responsible for fixing Import Table. A definition of ImportedDllCoverage class.
A definition of ImportsUneraser class - for recovery of a partialy erased Import Table.
bool fix_imports(IN OUT PVOID modulePtr, IN size_t moduleSize, IN const peconv::ExportsMapper &exportsMap, OUT OPTIONAL peconv::ImpsNotCovered *notCovered)
bool validate_ptr(IN const void *buffer_bgn, IN size_t buffer_size, IN const void *field_bgn, IN size_t field_size)
bool is64bit(IN const BYTE *pe_buffer)
IMAGE_DATA_DIRECTORY * get_directory_entry(IN const BYTE *pe_buffer, IN DWORD dir_id, IN bool allow_empty=false)
std::string get_dll_shortname(const std::string &str)