xlib/pe.cpp at master · manyhelp/xlib · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
#include "pe.h"

#include "ws_s.h"
#include "syssnap.h"

using namespace std;

pe::pe(const HMODULE hMod)
:_hMod(hMod)
  {
  if(hMod != nullptr) return;
#ifndef FOR_RING0
  _hMod = GetModuleHandle(nullptr);
#else
  SysDriverSnap sds;
  for(const SYSTEM_MODULE& st : sds)
    {
    _hMod = (HMODULE)st.ImageBaseAddress;
    break;
    }
#endif
  }

pe::pe(LPCTSTR name)
:_hMod(nullptr)
  {
#ifndef FOR_RING0
  _hMod = GetModuleHandle(name);
#else
# ifdef  UNICODE
  const string s(ws2s(name));
  name = (LPCTSTR)s.c_str();
# endif
  SysDriverSnap sds;
  for(const SYSTEM_MODULE& st : sds)
    {
    if(0 == _stricmp((const char*)name, (const char*)(st.Name + st.NameOffset)))
      {
      _hMod = (HMODULE)st.ImageBaseAddress;
      break;
      }
    }
#endif
  }

const IMAGE_DOS_HEADER* pe::GetDosHead() const
  {
  return (IMAGE_DOS_HEADER*)_hMod;
  }

const IMAGE_NT_HEADERS* pe::GetPeHead() const
  {
  const IMAGE_DOS_HEADER* doshead = GetDosHead();
  return (IMAGE_NT_HEADERS*)
    ((size_t)doshead + (size_t)doshead->e_lfanew);
  }

void* pe::EntryPoint() const
  {
  const IMAGE_NT_HEADERS* pehead = GetPeHead();
  return (void*)(pehead->OptionalHeader.AddressOfEntryPoint +
    (size_t)GetDosHead());
  }

xblk pe::GetImage() const
  {
  const IMAGE_NT_HEADERS* pehead = GetPeHead();
  return xblk(
    (void*)GetDosHead(),
    pehead->OptionalHeader.SizeOfImage);
  }

xblk pe::GetCode() const
  {
  const IMAGE_NT_HEADERS* pehead = GetPeHead();
  return xblk(
    (void*)(pehead->OptionalHeader.BaseOfCode + (size_t)GetDosHead()),
    pehead->OptionalHeader.SizeOfCode);
  }

HMODULE pe::Module() const
  {
  return _hMod;
  }

bool pe::IsPE() const
  {
  const IMAGE_DOS_HEADER* doshead = GetDosHead();
  if(doshead->e_magic != 'ZM')  return false;
  const IMAGE_NT_HEADERS* pehead = GetPeHead();
  return pehead->Signature == 'EP';
  }