use core::fmt::Debug;
use core::mem;
use crate::read::{Bytes, ReadError, Result};
use crate::{pe, LittleEndian as LE, Pod, U16Bytes};
use super::ImageNtHeaders;
#[derive(Debug, Clone)]
pub struct ImportTable<'data> {
section_data: Bytes<'data>,
section_address: u32,
import_address: u32,
}
impl<'data> ImportTable<'data> {
pub fn new(section_data: &'data [u8], section_address: u32, import_address: u32) -> Self {
ImportTable {
section_data: Bytes(section_data),
section_address,
import_address,
}
}
pub fn descriptors(&self) -> Result<ImportDescriptorIterator<'data>> {
let offset = self.import_address.wrapping_sub(self.section_address);
let mut data = self.section_data;
data.skip(offset as usize)
.read_error("Invalid PE import descriptor address")?;
Ok(ImportDescriptorIterator { data })
}
pub fn name(&self, address: u32) -> Result<&'data [u8]> {
self.section_data
.read_string_at(address.wrapping_sub(self.section_address) as usize)
.read_error("Invalid PE import descriptor name")
}
pub fn thunks(&self, address: u32) -> Result<ImportThunkList<'data>> {
let offset = address.wrapping_sub(self.section_address);
let mut data = self.section_data;
data.skip(offset as usize)
.read_error("Invalid PE import thunk table address")?;
Ok(ImportThunkList { data })
}
pub fn import<Pe: ImageNtHeaders>(&self, thunk: Pe::ImageThunkData) -> Result<Import<'data>> {
if thunk.is_ordinal() {
Ok(Import::Ordinal(thunk.ordinal()))
} else {
let (hint, name) = self.hint_name(thunk.address())?;
Ok(Import::Name(hint, name))
}
}
pub fn hint_name(&self, address: u32) -> Result<(u16, &'data [u8])> {
let offset = address.wrapping_sub(self.section_address);
let mut data = self.section_data;
data.skip(offset as usize)
.read_error("Invalid PE import thunk address")?;
let hint = data
.read::<U16Bytes<LE>>()
.read_error("Missing PE import thunk hint")?
.get(LE);
let name = data
.read_string()
.read_error("Missing PE import thunk name")?;
Ok((hint, name))
}
}
#[derive(Debug, Clone)]
pub struct ImportDescriptorIterator<'data> {
data: Bytes<'data>,
}
impl<'data> ImportDescriptorIterator<'data> {
pub fn next(&mut self) -> Result<Option<&'data pe::ImageImportDescriptor>> {
let import_desc = self
.data
.read::<pe::ImageImportDescriptor>()
.read_error("Missing PE null import descriptor")?;
if import_desc.is_null() {
Ok(None)
} else {
Ok(Some(import_desc))
}
}
}
#[derive(Debug, Clone)]
pub struct ImportThunkList<'data> {
data: Bytes<'data>,
}
impl<'data> ImportThunkList<'data> {
pub fn get<Pe: ImageNtHeaders>(&self, index: usize) -> Result<Pe::ImageThunkData> {
let thunk = self
.data
.read_at(index * mem::size_of::<Pe::ImageThunkData>())
.read_error("Invalid PE import thunk index")?;
Ok(*thunk)
}
pub fn next<Pe: ImageNtHeaders>(&mut self) -> Result<Option<Pe::ImageThunkData>> {
let thunk = self
.data
.read::<Pe::ImageThunkData>()
.read_error("Missing PE null import thunk")?;
if thunk.address() == 0 {
Ok(None)
} else {
Ok(Some(*thunk))
}
}
}
#[derive(Debug, Clone, Copy)]
pub enum Import<'data> {
Ordinal(u16),
Name(u16, &'data [u8]),
}
#[allow(missing_docs)]
pub trait ImageThunkData: Debug + Pod {
fn raw(self) -> u64;
fn is_ordinal(self) -> bool;
fn ordinal(self) -> u16;
fn address(self) -> u32;
}
impl ImageThunkData for pe::ImageThunkData64 {
fn raw(self) -> u64 {
self.0.get(LE)
}
fn is_ordinal(self) -> bool {
self.0.get(LE) & pe::IMAGE_ORDINAL_FLAG64 != 0
}
fn ordinal(self) -> u16 {
self.0.get(LE) as u16
}
fn address(self) -> u32 {
self.0.get(LE) as u32 & 0x7fff_ffff
}
}
impl ImageThunkData for pe::ImageThunkData32 {
fn raw(self) -> u64 {
self.0.get(LE).into()
}
fn is_ordinal(self) -> bool {
self.0.get(LE) & pe::IMAGE_ORDINAL_FLAG32 != 0
}
fn ordinal(self) -> u16 {
self.0.get(LE) as u16
}
fn address(self) -> u32 {
self.0.get(LE) & 0x7fff_ffff
}
}
#[derive(Debug, Clone)]
pub struct DelayLoadImportTable<'data> {
section_data: Bytes<'data>,
section_address: u32,
import_address: u32,
}
impl<'data> DelayLoadImportTable<'data> {
pub fn new(section_data: &'data [u8], section_address: u32, import_address: u32) -> Self {
DelayLoadImportTable {
section_data: Bytes(section_data),
section_address,
import_address,
}
}
pub fn descriptors(&self) -> Result<DelayLoadDescriptorIterator<'data>> {
let offset = self.import_address.wrapping_sub(self.section_address);
let mut data = self.section_data;
data.skip(offset as usize)
.read_error("Invalid PE delay-load import descriptor address")?;
Ok(DelayLoadDescriptorIterator { data })
}
pub fn name(&self, address: u32) -> Result<&'data [u8]> {
self.section_data
.read_string_at(address.wrapping_sub(self.section_address) as usize)
.read_error("Invalid PE import descriptor name")
}
pub fn thunks(&self, address: u32) -> Result<ImportThunkList<'data>> {
let offset = address.wrapping_sub(self.section_address);
let mut data = self.section_data;
data.skip(offset as usize)
.read_error("Invalid PE delay load import thunk table address")?;
Ok(ImportThunkList { data })
}
pub fn import<Pe: ImageNtHeaders>(&self, thunk: Pe::ImageThunkData) -> Result<Import<'data>> {
if thunk.is_ordinal() {
Ok(Import::Ordinal(thunk.ordinal()))
} else {
let (hint, name) = self.hint_name(thunk.address())?;
Ok(Import::Name(hint, name))
}
}
pub fn hint_name(&self, address: u32) -> Result<(u16, &'data [u8])> {
let offset = address.wrapping_sub(self.section_address);
let mut data = self.section_data;
data.skip(offset as usize)
.read_error("Invalid PE delay load import thunk address")?;
let hint = data
.read::<U16Bytes<LE>>()
.read_error("Missing PE delay load import thunk hint")?
.get(LE);
let name = data
.read_string()
.read_error("Missing PE delay load import thunk name")?;
Ok((hint, name))
}
}
#[derive(Debug, Clone)]
pub struct DelayLoadDescriptorIterator<'data> {
data: Bytes<'data>,
}
impl<'data> DelayLoadDescriptorIterator<'data> {
pub fn next(&mut self) -> Result<Option<&'data pe::ImageDelayloadDescriptor>> {
let import_desc = self
.data
.read::<pe::ImageDelayloadDescriptor>()
.read_error("Missing PE null delay-load import descriptor")?;
if import_desc.is_null() {
Ok(None)
} else {
Ok(Some(import_desc))
}
}
}