imports_uneraser.h

Go to the documentation of this file.

 
#pragma once
 
#include <windows.h>
 
#include <string>
 
#include <set>
#include <map>
 
#include <iterator>
#include "fix_imports.h"
#include "caves.h"
 
namespace peconv {
 
    class ImportsUneraser
    {
    public:
        ImportsUneraser(PVOID _modulePtr, size_t _moduleSize)
            : modulePtr((PBYTE)_modulePtr), moduleSize(_moduleSize)
        {
            is64 = peconv::is64bit((BYTE*)modulePtr);
        }
 
        bool uneraseDllImports(IN OUT IMAGE_IMPORT_DESCRIPTOR* lib_desc, IN ImportedDllCoverage &dllCoverage, OUT OPTIONAL ImpsNotCovered* not_covered);
 
        bool uneraseDllName(IMAGE_IMPORT_DESCRIPTOR* lib_desc, const std::string &dll_name);
 
    protected:
        bool writeFoundDllName(IMAGE_IMPORT_DESCRIPTOR* lib_desc, const std::string &dll_name);
 
        template <typename FIELD_T, typename IMAGE_THUNK_DATA_T>
        bool fillImportNames(IN OUT IMAGE_IMPORT_DESCRIPTOR* lib_desc,
                IN const FIELD_T ordinal_flag,
                IN std::map<ULONGLONG, std::set<ExportedFunc>> &addr_to_func,
                OUT OPTIONAL ImpsNotCovered* not_covered
            );
 
        template <typename FIELD_T>
        bool findNameInBinaryAndFill(IMAGE_IMPORT_DESCRIPTOR* lib_desc,
            LPVOID call_via_ptr,
            LPVOID thunk_ptr,
            const FIELD_T ordinal_flag,
            std::map<ULONGLONG, std::set<ExportedFunc>> &addr_to_func
        );
 
        template <typename FIELD_T, typename IMAGE_THUNK_DATA_T>
        bool writeFoundFunction(IMAGE_THUNK_DATA_T* desc, const FIELD_T ordinal_flag, const ExportedFunc &foundFunc);
 
        PBYTE modulePtr;
        size_t moduleSize;
        bool is64;
    };
}