pedump.c

F:反汇编源码代码学习disasm.ZIP

void   WINAPI StrangeMenuFill (char **, WORD **, int);
int	   WINAPI GetContentsOfMenu (LPVOID, char **);
int	   WINAPI PrintMenu (int, char **);
int	   WINAPI PrintStrangeMenu (char **);

/* debug section info */
BOOL   WINAPI IsDebugInfoStripped (LPVOID);
int	   WINAPI RetrieveModuleName (LPVOID, char **);
BOOL   WINAPI IsDebugFile (LPVOID);
BOOL   WINAPI GetSeparateDebugHeader (LPVOID, PIMAGE_SEPARATE_DEBUG_HEADER);


/* copy dos header information to structure */
BOOL  WINAPI GetDosHeader (
    LPVOID		 lpFile,
    PIMAGE_DOS_HEADER	 pHeader)
{
    /* dos header rpresents first structure of bytes in file */
    if (*(USHORT *)lpFile == IMAGE_DOS_SIGNATURE)
	bcopy(lpFile, (LPVOID)pHeader, sizeof (IMAGE_DOS_HEADER));
    else
	return FALSE;

    return TRUE;
}




/* return file signature */
DWORD  WINAPI ImageFileType (
    LPVOID    lpFile)
{
    /* dos file signature comes first */
    if (*(USHORT *)lpFile == IMAGE_DOS_SIGNATURE)
	{
	/* determine location of PE File header from dos header */
	if (LOWORD (*(DWORD *)NTSIGNATURE (lpFile)) == IMAGE_OS2_SIGNATURE ||
	    LOWORD (*(DWORD *)NTSIGNATURE (lpFile)) == IMAGE_OS2_SIGNATURE_LE)
	    return (DWORD)LOWORD(*(DWORD *)NTSIGNATURE (lpFile));

	else if (*(DWORD *)NTSIGNATURE (lpFile) == IMAGE_NT_SIGNATURE)
	    return IMAGE_NT_SIGNATURE;

	else
	    return IMAGE_DOS_SIGNATURE;
	}

    else
	/* unknown file type */
	return 0;
}




/* copy file header information to structure */
BOOL  WINAPI GetPEFileHeader (
    LPVOID		  lpFile,
    PIMAGE_FILE_HEADER	  pHeader)
{
    /* file header follows dos header */
    if (ImageFileType (lpFile) == IMAGE_NT_SIGNATURE)
	bcopy(PEFHDROFFSET (lpFile), (LPVOID)pHeader,  sizeof (IMAGE_FILE_HEADER));
    else
	return FALSE;

    return TRUE;
}





/* copy optional header info to structure */
BOOL WINAPI GetPEOptionalHeader (
    LPVOID		      lpFile,
    PIMAGE_OPTIONAL_HEADER    pHeader)
{
    /* optional header follows file header and dos header */
    if (ImageFileType (lpFile) == IMAGE_NT_SIGNATURE)
	bcopy (OPTHDROFFSET (lpFile), (LPVOID)pHeader,  sizeof (IMAGE_OPTIONAL_HEADER));
    else
	return FALSE;

    return TRUE;
}




/* function returns the entry point for an exe module lpFile must
   be a memory mapped file pointer to the beginning of the image file */
LPVOID	WINAPI GetModuleEntryPoint (
    LPVOID    lpFile)
{
    PIMAGE_OPTIONAL_HEADER   poh = (PIMAGE_OPTIONAL_HEADER)OPTHDROFFSET (lpFile);

    if (poh != NULL)
	return (LPVOID)(poh->AddressOfEntryPoint);
    else
	return NULL;
}




/* return the total number of sections in the module */
int   WINAPI NumOfSections (
    LPVOID    lpFile)
{
    /* number os sections is indicated in file header */
    return ((int)((PIMAGE_FILE_HEADER)PEFHDROFFSET (lpFile))->NumberOfSections);
}




/* retrieve entry point */
LPVOID	WINAPI GetImageBase (
    LPVOID    lpFile)
{
    PIMAGE_OPTIONAL_HEADER   poh = (PIMAGE_OPTIONAL_HEADER)OPTHDROFFSET (lpFile);

    if (poh != NULL)
	return (LPVOID)(poh->ImageBase);
    else
	return NULL;
}



//
// This function is written by sang cho
//						   .. october 5, 1997
//
/* function returns the actual address of given RVA,      lpFile must
   be a memory mapped file pointer to the beginning of the image file */
LPVOID	WINAPI GetActualAddress (
	LPVOID	  lpFile,
	DWORD	  dwRVA)
{
    PIMAGE_OPTIONAL_HEADER   poh = (PIMAGE_OPTIONAL_HEADER)OPTHDROFFSET (lpFile);
    PIMAGE_SECTION_HEADER    psh = (PIMAGE_SECTION_HEADER)SECHDROFFSET (lpFile);
    int 		     nSections = NumOfSections (lpFile);
    int 		     i = 0;

    if (dwRVA == NULL) return NULL;
	if (dwRVA & 0x80000000) 
	{
	    //return (LPVOID)dwRVA;
		printf ("\n$$ what is going on $$");
		exit (0);
	}

    /* locate section containing image directory */
    while (i++<nSections)
	{
	    if (psh->VirtualAddress <= (DWORD)dwRVA &&
	        psh->VirtualAddress + psh->SizeOfRawData > (DWORD)dwRVA)
	    break;
	    psh++;
	}

    if (i > nSections)
	return NULL;

    /* return image import directory offset */
    return (LPVOID)(((int)lpFile + (int)dwRVA - psh->VirtualAddress) +
				   (int)psh->PointerToRawData);
}


//
// This function is modified by sang cho
//
//
/* return offset to specified IMAGE_DIRECTORY entry */
LPVOID	WINAPI ImageDirectoryOffset (
	LPVOID	  lpFile,
	DWORD	  dwIMAGE_DIRECTORY)
{
    PIMAGE_OPTIONAL_HEADER   poh = (PIMAGE_OPTIONAL_HEADER)OPTHDROFFSET (lpFile);
    PIMAGE_SECTION_HEADER    psh = (PIMAGE_SECTION_HEADER)SECHDROFFSET (lpFile);
    int 		     nSections = NumOfSections (lpFile);
    int 		     i = 0;
    LPVOID		     VAImageDir;

    /* must be 0 thru (NumberOfRvaAndSizes-1) */
    if (dwIMAGE_DIRECTORY >= poh->NumberOfRvaAndSizes)
	return NULL;

    /* locate specific image directory's relative virtual address */
    VAImageDir = (LPVOID)poh->DataDirectory[dwIMAGE_DIRECTORY].VirtualAddress;

    if (VAImageDir == NULL) return NULL;
    /* locate section containing image directory */
    while (i++<nSections)
	{
	    if (psh->VirtualAddress <= (DWORD)VAImageDir &&
	        psh->VirtualAddress + psh->SizeOfRawData > (DWORD)VAImageDir)
	    break;
	    psh++;
	}

    if (i > nSections)
	return NULL;

    /* return image import directory offset */
    return (LPVOID)(((int)lpFile + (int)VAImageDir - psh->VirtualAddress) +
				   (int)psh->PointerToRawData);
}


/* function retrieve names of all the sections in the file */
int WINAPI GetSectionNames (
    LPVOID    lpFile,
    char      **pszSections)
{
    int 		     nSections = NumOfSections (lpFile);
    int 		     i, nCnt = 0;
    PIMAGE_SECTION_HEADER    psh;
    char		     *ps;


    if (ImageFileType (lpFile) != IMAGE_NT_SIGNATURE ||
	(psh = (PIMAGE_SECTION_HEADER)SECHDROFFSET (lpFile)) == NULL)
	return 0;

    /* count the number of chars used in the section names */
    for (i=0; i<nSections; i++)
	nCnt += strlen (psh[i].Name) + 1;

    /* allocate space for all section names from heap */
    ps = *pszSections = (char *)calloc (nCnt, 1);


    for (i=0; i<nSections; i++)
	{
	    strcpy (ps, psh[i].Name);
	    ps += strlen (psh[i].Name) + 1;
	}

    return nCnt;
}




/* function gets the function header for a section identified by name */
BOOL	WINAPI GetSectionHdrByName (
    LPVOID		     lpFile,
    IMAGE_SECTION_HEADER     *sh,
    char		     *szSection)
{
    PIMAGE_SECTION_HEADER    psh;
    int 		     nSections = NumOfSections (lpFile);
    int 		     i;


    if ((psh = (PIMAGE_SECTION_HEADER)SECHDROFFSET (lpFile)) != NULL)
	{
	/* find the section by name */
	    for (i=0; i<nSections; i++)
	    {
	        if (!strcmp (psh->Name, szSection))
		    {
		        /* copy data to header */
		        bcopy ((LPVOID)psh, (LPVOID)sh, sizeof (IMAGE_SECTION_HEADER));
		        return TRUE;
		    }
	        else psh++;
	    }
	}
    return FALSE;
}



//
// This function is modified by sang cho
//
//
/* get import modules names separated by null terminators, return module count */
int  WINAPI GetImportModuleNames (
    LPVOID    lpFile,
    char      **pszModules)
{
    PIMAGE_IMPORT_MODULE_DIRECTORY  pid = (PIMAGE_IMPORT_MODULE_DIRECTORY)
	ImageDirectoryOffset (lpFile, IMAGE_DIRECTORY_ENTRY_IMPORT);
	//
	// sometimes there may be no section for idata or edata
	// instead rdata or data section may contain these sections ..
	// or even module names or function names are in different section.
	// so that's why we need to get actual address of RVAs each time.
	//         ...................sang cho..................
	//
	// PIMAGE_SECTION_HEADER     psh = (PIMAGE_SECTION_HEADER)
	// ImageDirectorySection (lpFile, IMAGE_DIRECTORY_ENTRY_IMPORT);
    // BYTE		     *pData = (BYTE *)pid;
	DWORD            *pdw = (DWORD *)pid;
    int 		     nCnt = 0, nSize = 0, i;
    char		     *pModule[1024];  /* hardcoded maximum number of modules?? */
    int               pidTab[1024];
	char		     *psz;

	if (pid == NULL) return 0;

    // pData = (BYTE *)((int)lpFile + psh->PointerToRawData - psh->VirtualAddress);

    /* extract all import modules */
    while (pid->dwRVAModuleName)
	{
	/* allocate temporary buffer for absolute string offsets */
	    //pModule[nCnt] = (char *)(pData + pid->dwRVAModuleName);
		pModule[nCnt] = (char *)GetActualAddress (lpFile, pid->dwRVAModuleName);
		pidTab[nCnt] = (int)pid;
	    nSize += strlen (pModule[nCnt]) + 1 + 4;

	/* increment to the next import directory entry */
	    pid++;
	    nCnt++;
	}

    /* copy all strings to one chunk of memory */
	*pszModules = (char *)calloc(nSize, 1);
	piNameBuffSize = nSize;
    psz = *pszModules;
    for (i=0; i<nCnt; i++)
	{
	    *(int *)psz = pidTab[i]; 
		strcpy (psz+4, pModule[i]);
	    psz += strlen (psz+4) + 1 + 4;
	}
	return nCnt;
}


//
// This function is rewritten by sang cho
//
//
/* get import module function names separated by null terminators, return function count */
int  WINAPI GetImportFunctionNamesByModule (
    LPVOID    lpFile,
    char      *pszModule,
    char      **pszFunctions)
{
    PIMAGE_IMPORT_MODULE_DIRECTORY  pid;
	
	//= (PIMAGE_IMPORT_MODULE_DIRECTORY)
	//ImageDirectoryOffset (lpFile, IMAGE_DIRECTORY_ENTRY_IMPORT);
	// modified by sangcho 1998.1.25
	
	//
	// sometimes there may be no section for idata or edata
	// instead rdata or data section may contain these sections ..
	// or even module names or function names are in different section.
	// so that's why we need to get actual address each time.
	//         ...................sang cho..................
	//
	//PIMAGE_SECTION_HEADER           psh = (PIMAGE_SECTION_HEADER)
	//ImageDirectorySection (lpFile, IMAGE_DIRECTORY_ENTRY_IMPORT);
    //DWORD		     dwBase;
    
	extern Bnode    *head;	         // label data B-Tree header
    extern int       btn;           // label data B-Tree control number
	
	int 		     nCnt = 0, nSize = 0;
	int              nnid = 0;
	int              mnlength, i;
    DWORD		     dwFunctionName;
	DWORD            dwFunctionAddress;
	char             name[128];
	char             buff[256];		// enough for any string ??
    char		     *psz;
	DWORD            *pdw;
	int              r,rr;
	_key_            k;


   	//dwBase = (DWORD)((int)lpFile + psh->PointerToRawData - psh->VirtualAddress);

    /* find module's pid */
    //while (pid->dwRVAModuleName &&
	//   strcmp (pszModule, (char *)GetActualAddress(lpFile, pid->dwRVAModuleName)))
	//pid++;

    pid = (PIMAGE_IMPORT_MODULE_DIRECTORY)(*(DWORD *)pszModule);