pedump.c

win32program disassembler

    //
    // sometimes there may be no section for idata or edata
    // instead rdata or data section may contain these sections ..
    // or even module names or function names are in different section.
    // so that's why we need to get actual address of RVAs each time.
    //         ...................sang cho..................
    //
    // PIMAGE_SECTION_HEADER     psh = (PIMAGE_SECTION_HEADER)
    // ImageDirectorySection (lpFile, IMAGE_DIRECTORY_ENTRY_IMPORT);
    // BYTE                  *pData = (BYTE *)pid;
    // DWORD            *pdw = (DWORD *)pid;
    int               nCnt = 0, nSize = 0, i;
    char             *pModule[1024];  /* hardcoded maximum number of modules?? */
    int               pidTab[1024];
    char                 *psz;

    if (pid == NULL) return 0;

    // pData = (BYTE *)((int)lpFile + psh->PointerToRawData - psh->VirtualAddress);

    /* extract all import modules */
    while (pid->dwRVAModuleName)
    {
    /* allocate temporary buffer for absolute string offsets */
        //pModule[nCnt] = (char *)(pData + pid->dwRVAModuleName);
        pModule[nCnt] = (char *)GetActualAddress (lpFile, pid->dwRVAModuleName);
        pidTab[nCnt] = (int)pid;
        nSize += strlen (pModule[nCnt]) + 1 + 4;

    /* increment to the next import directory entry */
        pid++;
        nCnt++;
    }

    /* copy all strings to one chunk of memory */
    *pszModules = (char *)calloc(nSize, 1);
    piNameBuffSize = nSize;
    psz = *pszModules;
    for (i=0; i<nCnt; i++)
    {
        *(int *)psz = pidTab[i]; 
        strcpy (psz+4, pModule[i]);
        psz += strlen (psz+4) + 1 + 4;
    }
    return nCnt;
}

//
// This function is rewritten by sang cho
//
//
/* get import module function names separated by null terminators, return function count */
int  WINAPI GetImportFunctionNamesByModule (
    LPVOID      lpFile,
    char       *pszModule,
    char      **pszFunctions)
{
    PIMAGE_IMPORT_MODULE_DIRECTORY  pid;
    
    //
    // sometimes there may be no section for idata or edata
    // instead rdata or data section may contain these sections ..
    // or even module names or function names are in different section.
    // so that's why we need to get actual address each time.
    //         ...................sang cho..................
    //
    
    int              nCnt = 0, nSize = 0;
    int              nnid = 0;
    int              mnlength, i;
    DWORD            dwFunctionName;
    DWORD            dwFunctionAddress;
    char             name[128];
    char             buff[256];             // enough for any string ??
    char            *psz;
    DWORD           *pdw;
    int              r,rr;
    _key_            k;


    pid = (PIMAGE_IMPORT_MODULE_DIRECTORY)(*(DWORD *)pszModule);

    /* exit if the module is not found */
    if (!pid->dwRVAModuleName)
    return 0;

    // I am doing this to get rid of .dll from module name
    strcpy (name, pszModule+4);
    mnlength = strlen (pszModule+4);
    for (i=0; i<mnlength; i++) if (name[i] == '.') break;
    name[i] = 0;
    mnlength = i;

    /* count number of function names and length of strings */
    dwFunctionName = pid->dwRVAFunctionNameList;
    
    // IMAGE_IMPORT_BY_NAME OR IMAGE_THUNK_DATA
    // modified by Sang Cho
    
    //fprintf(stderr,"pid = %08X dwFunctionName = %08X name = %s", 
    //(int)pid-(int)lpFile, dwFunctionName,name),getch();

    // modified by sang cho 1998.1.24

    if (dwFunctionName==0) dwFunctionName = pid->dwRVAFunctionAddressList;

    while (dwFunctionName &&
       *(pdw=(DWORD *)GetActualAddress (lpFile, dwFunctionName)) )      
    {
        if ((*pdw) & 0x80000000 )   nSize += mnlength + 11 + 1 + 6;
        else nSize += strlen ((char *)GetActualAddress (lpFile, *pdw+2)) + 1+6;
        dwFunctionName += 4;
        nCnt++;
    }
    
    /* allocate memory  for function names */
    *pszFunctions = (char *)calloc (nSize, 1);
    psz = *pszFunctions;

    //
    // I modified this part to store function address (4 bytes),
    //                               ord number (2 bytes),
    //                                                      and      name strings (which was there originally)
    // so that's why there are 6 more bytes...... +6,  or +4 and +2 etc.
    // these informations are used where they are needed.
    //                      ...........sang cho..................
    //
    /* copy function names to mempry pointer */
    dwFunctionName = pid->dwRVAFunctionNameList;
    // modified by sang cho 1998.1.24
    if (dwFunctionName==0) dwFunctionName = pid->dwRVAFunctionAddressList;
    dwFunctionAddress = pid->dwRVAFunctionAddressList;
    while (dwFunctionName                          &&
       *(pdw=(DWORD *)GetActualAddress (lpFile, dwFunctionName)) )
    {
        if ((*pdw) & 0x80000000)
        {
        r=*(int *)psz=(int)(*(DWORD *)GetActualAddress (lpFile, dwFunctionAddress));
            psz += 4;
        *(short *)psz=*(short *)pdw;
        psz += 2;        rr=(int)pdw;
        sprintf(buff, "%s:NoName%04d", name, nnid++);
        strcpy (psz, buff);     psz += strlen (buff) + 1;
            // this one is needed to link import function names to codes..
            k.class=992; k.c_ref= r; k.c_pos=-rr;
            MyBtreeInsertX(&k);
            k.class=0; k.c_ref=-rr; k.c_pos=(int)pszModule+4;
            MyBtreeInsertX(&k);
        }
        else
        {
        r=*(int *)psz=(int)(*(DWORD *)GetActualAddress (lpFile, dwFunctionAddress));
            psz += 4;
        *(short *)psz=(*(short *)GetActualAddress(lpFile, *pdw));
        psz += 2;        rr=(int)GetActualAddress(lpFile, *pdw + 2);
        strcpy (psz, (char *)rr);
        psz += strlen ((char *)GetActualAddress(lpFile, *pdw + 2)) + 1;
        
            // this one is needed to link import function names to codes..
            k.class=991; k.c_ref= r; k.c_pos=rr;
            MyBtreeInsertX(&k);
            k.class=0; k.c_ref=rr; k.c_pos=(int)pszModule+4;
            MyBtreeInsertX(&k);
        }
        dwFunctionName += 4;
        dwFunctionAddress += 4;
    }

    return nCnt;
}

//
// This function is written by sang cho
//                                                         October 6, 1997
//
/* get numerically expressed string length */
int WINAPI GetStringLength (
    char      *psz)
{
    if (!isdigit (*psz)) return 0; 
    if (isdigit (*(psz+1))) return (*psz - '0')*10 + *(psz+1) - '0';
    else return *psz - '0';
}

//
// This function is written by sang cho
//                                                         October 12, 1997
//

/* translate parameter part of condensed name */
int   WINAPI GetPreviousParamString ( 
    char       *xpin,                     // read-only source
    char       *xpout)                            // translated result
{
    int         n=0;
    char       *pin, *pout;           

    pin  = xpin;
    pout = xpout;

    pin--;
    if (*pin == ',') pin--;
    else { //printf ("\n **error PreviousParamString1 char = %02X %s", *pin, pin); 
	      return (0); }

    while (*pin)
    {
         if (*pin == '>') n++;
        else if (*pin == '<') n--;
        else if (*pin == ')') n++;
        
        if (n > 0) 
        {
            if (*pin == '(') n--;
        }
        else if (strchr (",(", *pin)) break;
        pin--;
    }

    //printf("\n ----- %s", pin);
    if (strchr (",(", *pin)) {pin++;} // printf("\n %s", pin); }
    else { printf ("\n **error PreviousParamString2"); return (0); }

    n = xpin - pin - 1;
    strncpy (pout, pin, n);
    *(pout + n) = 0;
	return 1;
}

//
// This function is written by sang cho
//                                                         October 10, 1997
//

/* translate parameter part of condensed name */
int   WINAPI TranslateParameters ( 
    char      **ppin,                     // read-only source
    char      **ppout,                            // translated result
    char      **pps)                                          // parameter stack
{
    int         i, n;
    char        c;
    char        name[128];
    char        *pin, *pout, *ps;           

    //printf(" %c ", **in);
    pin  = *ppin;
    pout = *ppout;
    ps   = *pps;
    c = *pin;
    switch (c)
    {
        // types processing
        case 'b': strcpy (pout, "byte");       pout +=  4; pin++;  break;
        case 'c': strcpy (pout, "char");       pout +=  4; pin++;  break; 
        case 'd': strcpy (pout, "double");     pout +=  6; pin++;  break;
        case 'f': strcpy (pout, "float");      pout +=  5; pin++;  break;
        case 'g': strcpy (pout, "long double");pout += 11; pin++;  break;
        case 'i': strcpy (pout, "int");        pout +=  3; pin++;  break; 
        case 'l': strcpy (pout, "long");       pout +=  4; pin++;  break;
        case 's': strcpy (pout, "short");      pout +=  5; pin++;  break; 
        case 'v': strcpy (pout, "void");       pout +=  4; pin++;  break;
        // postfix processing
        case 'M':
        case 'p': 
            if (*(pin+1) == 'p') { *ps++ = 'p'; pin += 2; }
            else { *ps++ = '*'; pin++; }
            *ppin = pin; *ppout = pout; *pps = ps;
            return 1;
        case 'q':
            *pout++ = '('; pin++;
            *ps++ = 'q';
            *ppin = pin; *ppout = pout; *pps = ps;
            return 1;
        case 'r':
            if (*(pin+1) == 'p') { *ps++ = 'r'; pin += 2; }
            else { *ps++ = '&'; pin++; }
            *ppin = pin; *ppout = pout; *pps = ps;
            return 1;
        // repeat processing
        case 't':
            if (isdigit(*(pin+1)))
            { 
                n = *(pin+1) - '0'; pin++; pin++;
                if (GetPreviousParamString (pout, name))
				{
                    strcpy (pout, name); pout += strlen (name);
                    for (i=1; i<n; i++)
                    {
                        *pout++ = ',';
                        strcpy (pout, name); pout += strlen (name);
                    }
                }
				else return 0;
			}
            else pin++;
            break;
        // prefix processing
        case 'u':
            strcpy (pout, "u");        pout +=  1; pin++;  
            *ppin = pin; *ppout = pout; *pps = ps;
            return 1;
        case 'x':
            strcpy (pout, "const ");   pout +=  6; pin++;  
            *ppin = pin; *ppout = pout; *pps = ps;
            return 1;
        case 'z':
            strcpy (pout, "static ");  pout +=  7; pin++;  
            *ppin = pin; *ppout = pout; *pps = ps;
            return 1;
        default:  strcpy (pout, "!1!");pout +=  3; *pout++=*pin++;
            *ppin = pin; *ppout = pout; *pps = ps;
            return 1;
    }
    // need to process postfix finally
    c = *(ps-1);
    if (strchr ("tqx", c))
    { if (*(pin)&& !strchr( "@$%", *(pin))) *pout++ = ','; 
      *ppin = pin; *ppout = pout; *pps = ps; return 1; }
    switch (c)
    {
        case 'r': strcpy (pout, "*&");  pout += 2;  ps--; break;
        case 'p': strcpy (pout, "**");  pout += 2;  ps--; break;
        case '&': strcpy (pout, "&");   pout += 1;  ps--; break;
        case '*': strcpy (pout, "*");   pout += 1;  ps--; break;
        default:  strcpy (pout, "!2!"); pout += 3;  ps--; break;
    }
    if (*(pin) && !strchr( "@$%", *(pin))) *pout++ = ',';
    *ppin = pin; *ppout = pout; *pps = ps;
	return 1;
}

//
// This function is written by sang cho
//                                                         October 11, 1997
//

/* translate parameter part of condensed name */
BOOL   WINAPI StringExpands ( 
    char      **ppin,                     // read-only source
    char      **ppout,                            // translated result
    char      **pps,                                          // parameter stack
    Str_P      *pcstr)                    // currently stored string
{
    // int         n;
    // char        c;
    char        *pin, *pout, *ps;  
    Str_P       c_str;
    BOOL        stringMode = TRUE;

    pin  = *ppin;
    pout = *ppout;
    ps   = *pps;
    c_str = *pcstr;

         if (strncmp (pin, "bctr", 4) == 0)