1
0

import_table.inc 3.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119
  1. // Copyright (C) 2012 Zeex
  2. //
  3. // Permission is hereby granted, free of charge, to any person obtaining a copy of
  4. // this software and associated documentation files (the "Software"), to deal in
  5. // the Software without restriction, including without limitation the rights to
  6. // use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
  7. // of the Software, and to permit persons to whom the Software is furnished to do
  8. // so, subject to the following conditions:
  9. //
  10. // The above copyright notice and this permission notice shall be included in all
  11. // copies or substantial portions of the Software.
  12. //
  13. // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  14. // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  15. // FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  16. // AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  17. // LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  18. // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  19. // SOFTWARE.
  20. #if defined IMPORT_TABLE_INC
  21. #endinput
  22. #endif
  23. #define IMPORT_TABLE_INC
  24. #include <core>
  25. #include "../phys_memory"
  26. // Helpful resources:
  27. //
  28. // o Peering Inside the PE: A Tour of the Win32 Portable Executable File Format
  29. //
  30. // http://msdn.microsoft.com/en-us/library/ms809762.aspx
  31. //
  32. // o Understanding the Import Address Table
  33. //
  34. // http://sandsprite.com/CodeStuff/Understanding_imports.html
  35. //
  36. // o Microsoft PE and COFF Specification
  37. //
  38. // http://msdn.microsoft.com/en-us/windows/hardware/gg463119.aspx
  39. static stock const DefaultImageBase = 0x00400000;
  40. static stock const SizeOfFileHeader = 0x14;
  41. static stock const SizeOfOptionalHeader = 0xE0;
  42. static stock const SizeOfImportDirectory = 0x14;
  43. stock GetImportPointer(const name[]) {
  44. new DosHeader = DefaultImageBase;
  45. new NtHeaders = DosHeader + ReadDword(DosHeader, 0x3C);
  46. new FileHeader = NtHeaders + 0x04;
  47. new OptionalHeader = FileHeader + SizeOfFileHeader;
  48. new ImageBase = ReadDword(OptionalHeader, 0x1C);
  49. new ImportTableRva = ReadDword(OptionalHeader, 0x68);
  50. new ImportDirectories = ImageBase + ImportTableRva;
  51. for (new i = 0; ; i++) {
  52. new ImportDirectory = ImportDirectories + i * SizeOfImportDirectory;
  53. new Name = ReadDword(ImportDirectory, 0x0C);
  54. if (Name == 0)
  55. break;
  56. new ImportLookupTable = ImageBase + ReadDword(ImportDirectory, 0x00);
  57. new ImportAddressTable = ImageBase + ReadDword(ImportDirectory, 0x10);
  58. for (new j = 0 ; ; j++) {
  59. new NameOrdinal = ReadDword(ImportLookupTable, j * 4);
  60. new bool:NameOrdinalFlag = (NameOrdinal & 0x80000000) != 0;
  61. if (NameOrdinalFlag)
  62. continue;
  63. new ImportByName = NameOrdinal & ~0x80000000;
  64. if (ImportByName == 0)
  65. break;
  66. new iname[256];
  67. ReadString(ImageBase, ImportByName + 2, iname);
  68. if (strcmp(iname, name) == 0) {
  69. return ImportAddressTable + j * 4;
  70. }
  71. }
  72. }
  73. return 0;
  74. }
  75. // Finds a function in the Import Table and returns its address or 0 if found nothing.
  76. stock GetImportAddress(const name[]) {
  77. new ImportPointer = GetImportPointer(name);
  78. if (ImportPointer != 0) {
  79. return ReadDword(ImportPointer, 0);
  80. }
  81. return 0;
  82. }
  83. static stock ToCharString(s[], size = sizeof(s)) {
  84. for (new i = 0; i < size; i++) {
  85. s[i] = swapchars(s[i]);
  86. }
  87. }
  88. static stock ReadDword(base, offset = 0) {
  89. return ReadPhysMemoryCell(base + offset);
  90. }
  91. static stock ReadString(base, offset = 0, dest[], size = sizeof(dest)) {
  92. ReadPhysMemory(base + offset, dest, size);
  93. ToCharString(dest, size);
  94. strunpack(dest, dest, size);
  95. }