Click here to Skip to main content
15,389,427 members
Home / Discussions / C / C++ / MFC
   

C / C++ / MFC

 
GeneralRe: Local / unique Variable Macro question Pin
ForNow19-Jun-17 3:55
MemberForNow19-Jun-17 3:55 
GeneralRe: Local / unique Variable Macro question Pin
leon de boer19-Jun-17 5:14
Memberleon de boer19-Jun-17 5:14 
GeneralRe: Local / unique Variable Macro question Pin
ForNow19-Jun-17 5:52
MemberForNow19-Jun-17 5:52 
GeneralRe: Local / unique Variable Macro question Pin
leon de boer19-Jun-17 9:16
Memberleon de boer19-Jun-17 9:16 
AnswerRe: Local / unique Variable Macro question Pin
Bram van Kampen28-Jun-17 13:21
MemberBram van Kampen28-Jun-17 13:21 
GeneralRe: Local / unique Variable Macro question Pin
ForNow28-Jun-17 13:47
MemberForNow28-Jun-17 13:47 
GeneralRe: Local / unique Variable Macro question Pin
Bram van Kampen28-Jun-17 14:21
MemberBram van Kampen28-Jun-17 14:21 
QuestionDisecting a PE File Pin
Bram van Kampen16-Jun-17 14:19
MemberBram van Kampen16-Jun-17 14:19 
Hi,

I have ended up in somewhat of a DLL Hell of my own making. In order to resolve this, I have started to write a Tool with view to provide dumps of Imports and Exports. A good starting point was given by Matt Pietreck, in his file PEIMX.C. It works as a Comandline tool, which is not realy convenient. I wrote a simple wrapper in the form of a Dlg based App, where I can specify the Source and Target Files. No problem with that at all. Worked a Dream for Imports, however, export functions are more elusive. Matt makes me look for a section marked '.edata' however, no such section appears to exist in any dll that I can find.

I have the following sections: .text .rdata .data .idata and .reloc I have opened up kernel32.dll, and built my own Test.dll, to no avail,no section marked '.edata'.

Well Bram, I can hear you all say:
"Goto <winnt.h>, where you will somwhere past halfway down, the following:-
IMAGE_DIRECTORY_ENTRY_EXPORT, and IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES].

Go Back to your PE Header, do your arithmetic (Apply a Delta) to compensate for mapping the file differently than that 'LoadLibrary()' does (same as Matt does) and get it that way."

Tried that too, still to no avail. During the debugging I got the impression that Kernel32 has no exports whatsoever. However, the Imports (on the Second Entry, IMAGE_OPTIONAL_HEADER.DataDirectory[1]) are readily reached with a Delta of 0. (that represents the Import Data)

Matt is an Author of international repute, and a Microsoft MVP. What is going wrong here.

Now, in case anyone comments about 64 bit, this code is written and tested in 32 bit Windows XP. This should not really be a question either, seeing that I can retrieve all Import functions.

Because of the size involved, I have just included two snippets.

Nr1 is how our Matt tried to find named sections. Nr2 is how I try to find the relevant section via
the PE optional Header.

Snippet 1. Written by Matt,
C++
if( pNTH->Signature == IMAGE_NT_SIGNATURE ) // PE
     {
       // After the NTHeader come the SectionHeaders --------------
       pSH = ( PIMAGE_SECTION_HEADER ) ( ( DWORD )pNTH +
                                      sizeof( IMAGE_NT_HEADERS ) );

       // Browse all SectionHeaders and search for  ---------------
       // .idata and .edata                         ---------------
       for( i = 0;
            i < pNTH->FileHeader.NumberOfSections;
            i++ )
       {
         if( strcmp( pSH[ i ].Name, ".idata" ) == 0 )
         {
   // Deal with the Imports

         }
         else
         if( strcmp( pSH[ i ].Name, ".edata" ) == 0 )
         {
           // Deal with the Exports

         }
        _getch();// ?? Brams Comment: Why?
     }
     else printf("Not a PE-Header");

The second snippet is my modification to look for the section by RVA, using the values in <winnt.h>.
The code is also encapsulated in a class, so that we can analyse and compare a large amount of dll's.
C++
    // Browse all SectionHeaders and search for  ---------------
    // the .idata and .edata  Sections           ---------------

<pre>
// NOTE: Section Names are Linker Concepts, These may vary amongst linker providers.
// The better idea  is to find the Section Data is via the directory, in the NT Header,
// and comparing Addresses. This was already done in the previous version of this.

PIMAGE_DATA_DIRECTORY pDataDirectory=m_pNTH->OptionalHeader.DataDirectory;
PIMAGE_DATA_DIRECTORY pImportData=pDataDirectory+IMAGE_DIRECTORY_ENTRY_IMPORT;
PIMAGE_DATA_DIRECTORY pExportData=pDataDirectory+IMAGE_DIRECTORY_ENTRY_EXPORT;
// We  Need to Calculate a Delta for each of the above sections

m_pImportDirectory=m_pExportDirectory=m_pResourceDirectory=NULL;

int Offset=m_pDH->e_lfanew+sizeof(IMAGE_NT_HEADERS);

PIMAGE_SECTION_HEADER pBase=(PIMAGE_SECTION_HEADER)(m_pBuffer+Offset);

int i;

for( i = 0;
i < m_pNTH->FileHeader.NumberOfSections;
i++ )
{
CString SectionName=m_pSH[i].Name;// Just for Debugging, to see where we are.
if(m_pSH[ i ].VirtualAddress==0)continue;
if(m_pSH[ i ].VirtualAddress==pImportData->VirtualAddress){
if(m_pImportDirectory!=NULL){
m_sErrorString="Not a Valid Executable File: Contains More than One Import Directories";
m_nErrNo=-1;
return false;
}
m_pImportDirectory=m_pSH+i;
continue;
}
if(m_pSH[ i ].VirtualAddress==pExportData->VirtualAddress){
if(m_pExportDirectory!=NULL){
m_sErrorString="Not a Valid Executable File: Contains More than One Export Directories";
m_nErrNo=-1;
return false;
}
m_pExportDirectory=m_pSH+i;
continue;
}
}


Apologies if this is badly formatted. My editor appears to put in tags at will, which do not appear in the 'Edit' window. (So, I cannot remove them).

Anyways, you can get the gist.

Anyone any idea of what is happening here?

Regards.
Bram van Kampen

AnswerRe: Disecting a PE File Pin
leon de boer17-Jun-17 3:17
Memberleon de boer17-Jun-17 3:17 
GeneralRe: Disecting a PE File Pin
Bram van Kampen18-Jun-17 12:46
MemberBram van Kampen18-Jun-17 12:46 
GeneralRe: Disecting a PE File Pin
harold aptroot18-Jun-17 3:11
Memberharold aptroot18-Jun-17 3:11 
GeneralRe: Disecting a PE File Pin
Bram van Kampen18-Jun-17 13:05
MemberBram van Kampen18-Jun-17 13:05 
GeneralRe: Disecting a PE File Pin
harold aptroot18-Jun-17 13:39
Memberharold aptroot18-Jun-17 13:39 
GeneralRe: Disecting a PE File Pin
Bram van Kampen19-Jun-17 13:27
MemberBram van Kampen19-Jun-17 13:27 
GeneralRe: Disecting a PE File Pin
harold aptroot19-Jun-17 14:27
Memberharold aptroot19-Jun-17 14:27 
GeneralRe: Disecting a PE File Pin
Richard MacCutchan19-Jun-17 20:57
mveRichard MacCutchan19-Jun-17 20:57 
GeneralRe: Disecting a PE File Pin
Bram van Kampen29-Jun-17 12:00
MemberBram van Kampen29-Jun-17 12:00 
GeneralRe: Disecting a PE File Pin
Richard MacCutchan29-Jun-17 21:28
mveRichard MacCutchan29-Jun-17 21:28 
GeneralRe: Disecting a PE File Pin
Bram van Kampen30-Jun-17 14:19
MemberBram van Kampen30-Jun-17 14:19 
GeneralRe: Disecting a PE File Pin
Richard MacCutchan30-Jun-17 21:30
mveRichard MacCutchan30-Jun-17 21:30 
GeneralRe: Disecting a PE File Pin
Bram van Kampen2-Jul-17 13:26
MemberBram van Kampen2-Jul-17 13:26 
GeneralRe: Disecting a PE File Pin
Richard MacCutchan2-Jul-17 21:42
mveRichard MacCutchan2-Jul-17 21:42 
QuestionStreamin proc for Rich edit Pin
ForNow16-Jun-17 9:27
MemberForNow16-Jun-17 9:27 
QuestionRe: Streamin proc for Rich edit Pin
David Crow16-Jun-17 17:40
MemberDavid Crow16-Jun-17 17:40 
AnswerRe: Streamin proc for Rich edit Pin
ForNow17-Jun-17 15:43
MemberForNow17-Jun-17 15:43 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.