23 std::cerr <<
"[!] Cannot fill imports into 64 bit PE via 32 bit loader!\n";
33 std::cerr <<
"[!] Cannot fill imports into 32 bit PE via 64 bit loader!\n";
40 template <
typename T_FIELD,
typename T_IMAGE_THUNK_DATA>
53 std::cout <<
"raw ordinal: " << std::hex <<
raw_ordinal << std::endl;
62 std::cout <<
"name: " <<
func_name << std::endl;
68 std::cerr <<
"Could not resolve the function!" << std::endl;
143 template <
typename T_FIELD,
typename T_IMAGE_THUNK_DATA>
178template <
typename T_FIELD,
typename T_IMAGE_THUNK_DATA>
186 for (
size_t index = 0;
true; index++) {
226 std::cout <<
"---IMP---" << std::endl;
231 for (
size_t i = 0;
true;
i++) {
250 std::cout <<
"Imported Lib: " << std::hex <<
lib_desc->FirstThunk <<
" : " << std::hex <<
lib_desc->OriginalFirstThunk <<
" : " <<
lib_desc->Name << std::endl;
271 if (moduleSize == 0) {
274 if (moduleSize == 0)
return false;
291 if (moduleSize == 0)
return false;
299 std::cerr <<
"[ERROR] Loader/Payload bitness mismatch.\n";
#define MASK_TO_DWORD(val)
CollectImportsCallback(BYTE *_modulePtr, size_t _moduleSize, std::map< DWORD, ExportedFunc * > &_thunkToFunc)
bool processThunks_tpl(LPSTR lib_name, T_IMAGE_THUNK_DATA *desc, T_FIELD *call_via, T_FIELD ordinal_flag)
virtual bool processThunks(LPSTR lib_name, ULONG_PTR origFirstThunkPtr, ULONG_PTR firstThunkPtr)
std::map< DWORD, ExportedFunc * > & thunkToFunc
virtual bool processThunks(LPSTR libName, ULONG_PTR origFirstThunkPtr, ULONG_PTR va)
CollectThunksCallback(BYTE *_vBuf, size_t _vBufSize, std::set< DWORD > &_fields)
std::set< DWORD > & fields
FillImportThunks(BYTE *_modulePtr, size_t _moduleSize, t_function_resolver *func_resolver)
bool processThunks_tpl(LPSTR lib_name, T_IMAGE_THUNK_DATA *desc, T_FIELD *call_via, T_FIELD ordinal_flag)
virtual bool processThunks(LPSTR lib_name, ULONG_PTR origFirstThunkPtr, ULONG_PTR firstThunkPtr)
t_function_resolver * funcResolver
virtual FARPROC resolve_func(LPCSTR lib_name, LPCSTR func_name)=0
bool parse_delayed_desc(BYTE *modulePtr, const size_t moduleSize, const ULONGLONG img_base, LPSTR lib_name, const T_FIELD ordinal_flag, IMAGE_DELAYLOAD_DESCRIPTOR *desc, peconv::t_function_resolver *func_resolver)
bool process_dlls(BYTE *modulePtr, size_t module_size, IMAGE_IMPORT_DESCRIPTOR *first_desc, IN ImportThunksCallback *callback)
bool process_imp_functions_tpl(BYTE *modulePtr, size_t module_size, LPSTR lib_name, DWORD call_via, DWORD thunk_addr, IN ImportThunksCallback *callback)
Parsing and filling the Import Table.
bool has_valid_import_table(const PBYTE modulePtr, size_t moduleSize)
bool process_import_table(IN BYTE *modulePtr, IN SIZE_T moduleSize, IN ImportThunksCallback *callback)
bool validate_ptr(IN const void *buffer_bgn, IN size_t buffer_size, IN const void *field_bgn, IN size_t field_size)
DWORD get_image_size(IN const BYTE *payload)
bool collect_thunks(IN BYTE *modulePtr, IN SIZE_T moduleSize, OUT std::set< DWORD > &thunk_rvas)
bool is64bit(IN const BYTE *pe_buffer)
bool is_valid_import_name(const PBYTE modulePtr, const size_t moduleSize, LPSTR lib_name)
IMAGE_DATA_DIRECTORY * get_directory_entry(IN const BYTE *pe_buffer, IN DWORD dir_id, IN bool allow_empty=false)
bool collect_imports(IN BYTE *modulePtr, IN SIZE_T moduleSize, OUT ImportsCollection &collection)
std::string get_dll_shortname(const std::string &str)
bool load_imports(BYTE *modulePtr, t_function_resolver *func_resolver=nullptr)