get imports

This commit is contained in:
nora 2025-01-31 17:03:28 +01:00
parent 5dbb27d9d7
commit 389721d5d0
3 changed files with 51 additions and 21 deletions

View file

@ -196,7 +196,7 @@ struct ImportDirectoryTableEntry {
const IMAGE_FILE_MACHINE_AMD64: u16 = 0x8664; const IMAGE_FILE_MACHINE_AMD64: u16 = 0x8664;
const IMAGE_FILE_MACHINE_ARM64: u16 = 0xaa64; const IMAGE_FILE_MACHINE_ARM64: u16 = 0xaa64;
pub fn execute(file: File, pe: &[u8]) { pub fn execute(pe: &[u8]) {
let (header, after_header) = parse_header(pe); let (header, after_header) = parse_header(pe);
match (std::env::consts::ARCH, header.machine) { match (std::env::consts::ARCH, header.machine) {
@ -259,13 +259,13 @@ pub fn execute(file: File, pe: &[u8]) {
let total_size = section_table.last().unwrap().virtual_address as usize; let total_size = section_table.last().unwrap().virtual_address as usize;
unsafe { let a = unsafe {
crate::sys::anon_write_map( crate::sys::anon_write_map(
total_size.next_multiple_of(allocation_granularity), total_size.next_multiple_of(allocation_granularity),
std::ptr::with_exposed_provenance(base), std::ptr::with_exposed_provenance(base),
) )
.unwrap(); .unwrap()
} };
// allocate the sections. // allocate the sections.
for section in section_table { for section in section_table {
@ -286,25 +286,55 @@ pub fn execute(file: File, pe: &[u8]) {
} else { } else {
crate::sys::Mode::Read crate::sys::Mode::Read
}; };
let address =
std::ptr::with_exposed_provenance::<()>(base + section.virtual_address as usize); let section_a = &mut a[section.virtual_address as usize..];
dbg!(section); dbg!(section);
unsafe { section_a[..section.size_of_raw_data as usize].copy_from_slice(
std::slice::from_raw_parts_mut( &pe[section.pointer_to_raw_data as usize..][..section.size_of_raw_data as usize],
address.cast_mut().cast::<u8>(), );
section.size_of_raw_data as usize,
)
.copy_from_slice(
&pe[section.pointer_to_raw_data as usize..][..section.size_of_raw_data as usize],
);
crate::sys::protect(address, section.virtual_size as usize, mode).unwrap(); //crate::sys::protect(
} // section_a.as_ptr().cast(),
// section.virtual_size as usize,
// mode,
//)
//.unwrap();
} }
//let import_directory_table: &[ImportDirectoryTableEntry] = bytemuck::cast_slice(&file[optional_header.import_table.virtual_address as usize..][..optional_header.import_table.size as usize]); let import_directory_table: &[ImportDirectoryTableEntry] = bytemuck::cast_slice(
//dbg!(import_directory_table); &a[optional_header.import_table.virtual_address as usize..]
[..optional_header.import_table.size as usize],
);
for import_directory in import_directory_table {
dbg!(import_directory);
let name = CStr::from_bytes_until_nul(&a[import_directory.name_rva as usize..]).unwrap();
dbg!(name);
let import_lookups = bytemuck::cast_slice::<u8, u64>(
&a[import_directory.import_lookup_table_rva as usize..],
);
for import_lookup in import_lookups {
if *import_lookup == 0 {
break;
}
let ordinal_name_flag = import_lookup >> 63;
if ordinal_name_flag == 1 {
let ordinal_number = import_lookup & 0xFFFF;
eprintln!(" import by ordinal: {ordinal_number}");
} else {
let hint_name_table_rva = import_lookup & 0xFFFF_FFFF;
let hint =
bytemuck::cast_slice::<u8, u16>(&a[hint_name_table_rva as usize..][..2])[0];
let name =
CStr::from_bytes_until_nul(&a[hint_name_table_rva as usize + 2..]).unwrap();
eprintln!(" import by name: hint={hint} name={name:?}");
}
}
}
} }
fn parse_header(pe: &[u8]) -> (&CoffHeader, usize) { fn parse_header(pe: &[u8]) -> (&CoffHeader, usize) {

View file

@ -19,5 +19,5 @@ fn main() {
.unwrap(); .unwrap();
let map = unsafe { memmap2::Mmap::map(&file).unwrap() }; let map = unsafe { memmap2::Mmap::map(&file).unwrap() };
portability::execute(file, &map); portability::execute(&map);
} }

View file

@ -36,7 +36,7 @@ mod imp {
info.dwPageSize as usize info.dwPageSize as usize
} }
pub(crate) unsafe fn anon_write_map(size: usize, address: *const ()) -> io::Result<()> { pub(crate) unsafe fn anon_write_map<'a>(size: usize, address: *const ()) -> io::Result<&'a mut [u8]> {
let map = windows::Win32::System::Memory::CreateFileMappingA( let map = windows::Win32::System::Memory::CreateFileMappingA(
INVALID_HANDLE_VALUE, INVALID_HANDLE_VALUE,
None, None,
@ -67,7 +67,7 @@ mod imp {
if addr.Value.is_null() { if addr.Value.is_null() {
Err(io::Error::last_os_error()) Err(io::Error::last_os_error())
} else { } else {
Ok(()) Ok(std::slice::from_raw_parts_mut(addr.Value.cast(), size))
} }
} }