Skip to content

Commit 38ad4a2

Browse files
dmexdmex
committed
peview: Highlight overlayed image directories
1 parent 0ff535a commit 38ad4a2

File tree

1 file changed

+133
-64
lines changed

1 file changed

+133
-64
lines changed

‎tools/peview/pedirprp.c

Lines changed: 133 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* Process Hacker -
33
* PE viewer
44
*
5-
* Copyright (C) 2019-2020 dmex
5+
* Copyright (C) 2019-2021 dmex
66
*
77
* This file is part of Process Hacker.
88
*
@@ -22,87 +22,139 @@
2222

2323
#include <peview.h>
2424

25-
VOID PvpPeEnumerateHeaderDirectory(
25+
BOOLEAN PvpPeCheckImageDataEntryAddress(
26+
_In_ ULONG Index,
27+
_In_ ULONG StartRva,
28+
_In_ ULONG EndRva
29+
)
30+
{
31+
PIMAGE_DATA_DIRECTORY directory;
32+
33+
for (ULONG i = 0; i < IMAGE_NUMBEROF_DIRECTORY_ENTRIES; i++)
34+
{
35+
if (i == Index)
36+
continue;
37+
38+
if (NT_SUCCESS(PhGetMappedImageDataEntry(&PvMappedImage, i, &directory)))
39+
{
40+
if ((StartRva >= directory->VirtualAddress) &&
41+
(StartRva < directory->VirtualAddress + directory->Size))
42+
{
43+
return TRUE;
44+
}
45+
46+
if ((EndRva >= directory->VirtualAddress) &&
47+
(EndRva < directory->VirtualAddress + directory->Size))
48+
{
49+
return TRUE;
50+
}
51+
}
52+
else
53+
{
54+
return TRUE;
55+
}
56+
}
57+
58+
return FALSE;
59+
}
60+
61+
VOID PvpPeEnumerateImageDataDirectory(
2662
_In_ HWND ListViewHandle,
2763
_In_ ULONG Index,
2864
_In_ PWSTR Name
2965
)
3066
{
3167
INT lvItemIndex;
68+
ULONG directoryAddress = 0;
69+
ULONG directorySize = 0;
70+
BOOLEAN directoryOverlay = FALSE;
3271
PIMAGE_DATA_DIRECTORY directory;
33-
PIMAGE_SECTION_HEADER section = NULL;
72+
PIMAGE_SECTION_HEADER directorySection = NULL;
3473
WCHAR value[PH_INT64_STR_LEN_1];
3574

36-
PhPrintUInt32(value, Index + 1);
37-
lvItemIndex = PhAddListViewItem(ListViewHandle, MAXINT, value, NULL);
38-
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 1, Name);
39-
4075
if (NT_SUCCESS(PhGetMappedImageDataEntry(&PvMappedImage, Index, &directory)))
4176
{
4277
if (directory->VirtualAddress)
4378
{
44-
section = PhMappedImageRvaToSection(&PvMappedImage, directory->VirtualAddress);
79+
directoryAddress = directory->VirtualAddress;
80+
}
4581

46-
PhPrintPointer(value, UlongToPtr(directory->VirtualAddress));
47-
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 2, value);
82+
if (directory->Size)
83+
{
84+
directorySize = directory->Size;
85+
}
4886

49-
PhPrintPointer(value, PTR_ADD_OFFSET(directory->VirtualAddress, directory->Size));
50-
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 3, value);
87+
if (directoryAddress)
88+
{
89+
directorySection = PhMappedImageRvaToSection(&PvMappedImage, directoryAddress);
5190
}
5291

53-
if (directory->Size)
92+
if (directoryAddress && directorySize)
5493
{
55-
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 4, PhaFormatSize(directory->Size, ULONG_MAX)->Buffer);
94+
directoryOverlay = PvpPeCheckImageDataEntryAddress(
95+
Index,
96+
directoryAddress,
97+
PtrToUlong(PTR_ADD_OFFSET(directoryAddress, directorySize))
98+
);
5699
}
100+
}
101+
102+
PhPrintUInt32(value, Index + 1);
103+
lvItemIndex = PhAddListViewItem(ListViewHandle, MAXINT, value, (PVOID)directoryOverlay);
104+
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 1, Name);
105+
PhPrintPointer(value, UlongToPtr(directoryAddress));
106+
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 2, value);
107+
PhPrintPointer(value, PTR_ADD_OFFSET(directoryAddress, directorySize));
108+
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 3, value);
109+
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 4, PhaFormatSize(directorySize, ULONG_MAX)->Buffer);
57110

58-
if (section)
111+
if (directorySection)
112+
{
113+
WCHAR sectionName[IMAGE_SIZEOF_SHORT_NAME + 1];
114+
115+
if (PhGetMappedImageSectionName(
116+
directorySection,
117+
sectionName,
118+
RTL_NUMBER_OF(sectionName),
119+
NULL
120+
))
59121
{
60-
WCHAR sectionName[IMAGE_SIZEOF_SHORT_NAME + 1];
61-
62-
if (PhGetMappedImageSectionName(
63-
section,
64-
sectionName,
65-
RTL_NUMBER_OF(sectionName),
66-
NULL
67-
))
68-
{
69-
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 5, sectionName);
70-
}
122+
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 5, sectionName);
71123
}
124+
}
72125

73-
if (directory->VirtualAddress && directory->Size)
126+
if (directoryAddress && directorySize)
127+
{
128+
__try
74129
{
75-
__try
130+
PVOID directoryData;
131+
PH_HASH_CONTEXT hashContext;
132+
PPH_STRING hashString;
133+
UCHAR hash[32];
134+
135+
if (directoryData = PhMappedImageRvaToVa(&PvMappedImage, directoryAddress, NULL))
76136
{
77-
PVOID directoryAddress;
78-
PH_HASH_CONTEXT hashContext;
79-
PPH_STRING hashString;
80-
UCHAR hash[32];
137+
PhInitializeHash(&hashContext, Md5HashAlgorithm);
138+
PhUpdateHash(&hashContext, directoryData, directorySize);
81139

82-
if (directoryAddress = PhMappedImageRvaToVa(&PvMappedImage, directory->VirtualAddress, NULL))
140+
if (PhFinalHash(&hashContext, hash, 16, NULL))
83141
{
84-
PhInitializeHash(&hashContext, Md5HashAlgorithm);
85-
PhUpdateHash(&hashContext, directoryAddress, directory->Size);
86-
87-
if (PhFinalHash(&hashContext, hash, 16, NULL))
142+
if (hashString = PhBufferToHexString(hash, 16))
88143
{
89-
if (hashString = PhBufferToHexString(hash, 16))
90-
{
91-
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 6, hashString->Buffer);
92-
PhDereferenceObject(hashString);
93-
}
144+
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 6, hashString->Buffer);
145+
PhDereferenceObject(hashString);
94146
}
95147
}
96148
}
97-
__except (EXCEPTION_EXECUTE_HANDLER)
98-
{
99-
PPH_STRING message;
149+
}
150+
__except (EXCEPTION_EXECUTE_HANDLER)
151+
{
152+
PPH_STRING message;
100153

101-
//message = PH_AUTO(PhGetNtMessage(GetExceptionCode()));
102-
message = PH_AUTO(PhGetWin32Message(RtlNtStatusToDosError(GetExceptionCode()))); // WIN32_FROM_NTSTATUS
154+
//message = PH_AUTO(PhGetNtMessage(GetExceptionCode()));
155+
message = PH_AUTO(PhGetWin32Message(RtlNtStatusToDosError(GetExceptionCode()))); // WIN32_FROM_NTSTATUS
103156

104-
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 6, PhGetStringOrEmpty(message));
105-
}
157+
PhSetListViewSubItem(ListViewHandle, lvItemIndex, 6, PhGetStringOrEmpty(message));
106158
}
107159
}
108160
}
@@ -114,6 +166,17 @@ typedef struct _PVP_PE_DIRECTORY_CONTEXT
114166
HIMAGELIST ListViewImageList;
115167
} PVP_PE_DIRECTORY_CONTEXT, *PPVP_PE_DIRECTORY_CONTEXT;
116168

169+
COLORREF NTAPI PvPeSectionColorFunction(
170+
_In_ INT Index,
171+
_In_ PVOID Param,
172+
_In_opt_ PVOID Context
173+
)
174+
{
175+
if ((BOOLEAN)Param)
176+
return RGB(0xf0, 0xa0, 0xa0);
177+
return RGB(0xff, 0xff, 0xff);
178+
}
179+
117180
INT_PTR CALLBACK PvpPeDirectoryDlgProc(
118181
_In_ HWND hwndDlg,
119182
_In_ UINT uMsg,
@@ -154,27 +217,28 @@ INT_PTR CALLBACK PvpPeDirectoryDlgProc(
154217
PhAddListViewColumn(context->ListViewHandle, 5, 5, 5, LVCFMT_LEFT, 100, L"Section");
155218
PhAddListViewColumn(context->ListViewHandle, 6, 6, 6, LVCFMT_LEFT, 100, L"Hash");
156219
PhSetExtendedListView(context->ListViewHandle);
220+
ExtendedListView_SetItemColorFunction(context->ListViewHandle, PvPeSectionColorFunction);
157221
PhLoadListViewColumnsFromSetting(L"ImageDirectoryListViewColumns", context->ListViewHandle);
158222

159223
if (context->ListViewImageList = ImageList_Create(2, 20, ILC_MASK | ILC_COLOR, 1, 1))
160224
ListView_SetImageList(context->ListViewHandle, context->ListViewImageList, LVSIL_SMALL);
161225

162226
// for (ULONG i = 0; i < IMAGE_NUMBEROF_DIRECTORY_ENTRIES; i++)
163-
PvpPeEnumerateHeaderDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_EXPORT, L"Export");
164-
PvpPeEnumerateHeaderDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_IMPORT, L"Import");
165-
PvpPeEnumerateHeaderDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_RESOURCE, L"Resource");
166-
PvpPeEnumerateHeaderDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_EXCEPTION, L"Exception");
167-
PvpPeEnumerateHeaderDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_SECURITY, L"Security");
168-
PvpPeEnumerateHeaderDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_BASERELOC, L"Base relocation");
169-
PvpPeEnumerateHeaderDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_DEBUG, L"Debug");
170-
PvpPeEnumerateHeaderDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_ARCHITECTURE, L"Architecture");
171-
PvpPeEnumerateHeaderDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_GLOBALPTR, L"Global PTR");
172-
PvpPeEnumerateHeaderDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_TLS, L"TLS");
173-
PvpPeEnumerateHeaderDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG, L"Load configuration");
174-
PvpPeEnumerateHeaderDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT, L"Bound imports");
175-
PvpPeEnumerateHeaderDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_IAT, L"IAT");
176-
PvpPeEnumerateHeaderDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT, L"Delay load imports");
177-
PvpPeEnumerateHeaderDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR, L"CLR");
227+
PvpPeEnumerateImageDataDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_EXPORT, L"Export");
228+
PvpPeEnumerateImageDataDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_IMPORT, L"Import");
229+
PvpPeEnumerateImageDataDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_RESOURCE, L"Resource");
230+
PvpPeEnumerateImageDataDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_EXCEPTION, L"Exception");
231+
PvpPeEnumerateImageDataDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_SECURITY, L"Security");
232+
PvpPeEnumerateImageDataDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_BASERELOC, L"Base relocation");
233+
PvpPeEnumerateImageDataDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_DEBUG, L"Debug");
234+
PvpPeEnumerateImageDataDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_ARCHITECTURE, L"Architecture");
235+
PvpPeEnumerateImageDataDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_GLOBALPTR, L"Global PTR");
236+
PvpPeEnumerateImageDataDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_TLS, L"TLS");
237+
PvpPeEnumerateImageDataDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG, L"Load configuration");
238+
PvpPeEnumerateImageDataDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT, L"Bound imports");
239+
PvpPeEnumerateImageDataDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_IAT, L"IAT");
240+
PvpPeEnumerateImageDataDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT, L"Delay load imports");
241+
PvpPeEnumerateImageDataDirectory(context->ListViewHandle, IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR, L"CLR");
178242

179243
PhInitializeWindowTheme(hwndDlg, PeEnableThemeSupport);
180244
}
@@ -216,5 +280,10 @@ INT_PTR CALLBACK PvpPeDirectoryDlgProc(
216280
break;
217281
}
218282

283+
if (context)
284+
{
285+
REFLECT_MESSAGE_DLG(hwndDlg, context->ListViewHandle, uMsg, wParam, lParam);
286+
}
287+
219288
return FALSE;
220289
}

0 commit comments

Comments
 (0)