fixed DarthTon#112; RVAtoVA refactored

Author: DarthTon

src/BlackBone/Include/Macro.h

@@ -7,7 +7,6 @@
 // Rebase address
 #define MAKE_PTR(T, pRVA, base)           (T)((ptr_t)pRVA + (ptr_t)base)
 #define REBASE(pRVA, baseOld, baseNew)       ((ptr_t)pRVA - (ptr_t)baseOld + (ptr_t)baseNew)
-#define REBASE2(T, rva, baseOld, baseNew) (T)((uintptr_t)rva - (uintptr_t)baseOld + (uintptr_t)baseNew)
 
 // Field offset info
 #define FIELD_OFFSET2(type, field)  ((LONG)(LONG_PTR)&(((type)0)->field))

src/BlackBone/ManualMap/MMap.cpp

@@ -818,16 +818,16 @@ NTSTATUS MMap::EnableExceptions( ImageContext* pImage )
     if (!_process.nativeLdr().InsertInvertedFunctionTable( pImage->imgMem.ptr<void*>(), pImage->peImage.imageSize(), safeseh ))
     {
         // Retry with documented method
+        auto expTableRVA = pImage->peImage.DirectoryAddress( IMAGE_DIRECTORY_ENTRY_EXCEPTION, pe::RVA );
         size_t size = pImage->peImage.DirectorySize( IMAGE_DIRECTORY_ENTRY_EXCEPTION );
-        auto pExpTable = reinterpret_cast<PIMAGE_RUNTIME_FUNCTION_ENTRY>(pImage->peImage.DirectoryAddress( IMAGE_DIRECTORY_ENTRY_EXCEPTION ));
 
         // Invoke RtlAddFunctionTable
-        if (pExpTable)
+        if (expTableRVA)
         {
             AsmJitHelper a;
             uint64_t result = 0;
-
-            pImage->pExpTableAddr = REBASE( pExpTable, pImage->peImage.base(), pImage->imgMem.ptr<ptr_t>() );
+          
+            pImage->pExpTableAddr = expTableRVA + pImage->imgMem.ptr<ptr_t>();
             auto pAddTable = _process.modules().GetExport(
                 _process.modules().GetModule( L"ntdll.dll", LdrList, pImage->peImage.mType() ),
                 "RtlAddFunctionTable"
@@ -847,9 +847,6 @@ NTSTATUS MMap::EnableExceptions( ImageContext* pImage )
             auto status = _process.remote().ExecInWorkerThread( a->make(), a->getCodeSize(), result );
             if (!NT_SUCCESS( status ))
                 return status;
-
-            return (pImage->flags & CreateLdrRef) ? STATUS_SUCCESS :
-                MExcept::CreateVEH( pImage->imgMem.ptr<uintptr_t>(), pImage->peImage.imageSize(), pImage->peImage.mType(), partial );
         }
         // No exception table
         else

src/BlackBone/PE/PEImage.cpp

@@ -383,64 +383,69 @@ void PEImage::GetExports( vecExports& exports )
 /// <param name="index">Directory index</param>
 /// <param name="keepRelative">Keep address relative to image base</param>
 /// <returns>Directory address</returns>
-size_t PEImage::DirectoryAddress( int index, bool keepRelative /*= false*/ ) const
+uintptr_t PEImage::DirectoryAddress( int index, AddressType type /*= VA*/ ) const
 {
     // Sanity check
     if (index < 0 || index >= IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
         return 0;
 
-    const IMAGE_DATA_DIRECTORY* idd = _is64 ? _pImageHdr64->OptionalHeader.DataDirectory 
-                                            : _pImageHdr32->OptionalHeader.DataDirectory;
+    const auto idd = _is64 ? _pImageHdr64->OptionalHeader.DataDirectory  : _pImageHdr32->OptionalHeader.DataDirectory;
+    return idd[index].VirtualAddress == 0 ? 0 : ResolveRVAToVA( idd[index].VirtualAddress, type );
+}
 
-    if (idd[index].VirtualAddress == 0)
+/// <summary>
+/// Get data directory size
+/// </summary>
+/// <param name="index">Data directory index</param>
+/// <returns>Data directory size</returns>
+size_t PEImage::DirectorySize( int index ) const
+{
+    // Sanity check
+    if (index < 0 || index >= IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
         return 0;
-    else
-        return ResolveRVAToVA( idd[index].VirtualAddress, keepRelative );
+
+    const IMAGE_DATA_DIRECTORY* idd = _is64 ? _pImageHdr64->OptionalHeader.DataDirectory : _pImageHdr32->OptionalHeader.DataDirectory;
+    return idd[index].VirtualAddress != 0 ? static_cast<size_t>(idd[index].Size) : 0;
 }
 
+
 /// <summary>
 /// Resolve virtual memory address to physical file offset
 /// </summary>
 /// <param name="Rva">Memory address</param>
 /// <param name="keepRelative">Keep address relative to file start</param>
 /// <returns>Resolved address</returns>
-uintptr_t PEImage::ResolveRVAToVA( uintptr_t Rva, bool keepRelative /*= false*/ ) const
+uintptr_t PEImage::ResolveRVAToVA( uintptr_t Rva, AddressType type /*= VA*/ ) const
 {
-    if (_isPlainData)
+    switch (type)
     {
-        for (auto& sec : _sections)
+    case blackbone::pe::RVA:
+        return Rva;
+
+    case blackbone::pe::VA:
+    case blackbone::pe::RPA:
+        if (_isPlainData)
         {
-            if (Rva >= sec.VirtualAddress && Rva < sec.VirtualAddress + sec.Misc.VirtualSize)
+            for (auto& sec : _sections)
             {
-                if (keepRelative)
-                    return  (Rva - sec.VirtualAddress + sec.PointerToRawData);
-                else
-                    return reinterpret_cast<uintptr_t>(_pFileBase) + (Rva - sec.VirtualAddress + sec.PointerToRawData);
+                if (Rva >= sec.VirtualAddress && Rva < sec.VirtualAddress + sec.Misc.VirtualSize)
+                    if (type == VA)
+                        return reinterpret_cast<uintptr_t>(_pFileBase) + Rva - sec.VirtualAddress + sec.PointerToRawData;
+                    else
+                        return Rva - sec.VirtualAddress + sec.PointerToRawData;
             }
+
+            return 0;
         }
+        else
+            return (type == VA) ? (reinterpret_cast<uintptr_t>(_pFileBase) + Rva) : Rva;
 
+    default:
         return 0;
     }
-    else
-        return (keepRelative ? Rva : (reinterpret_cast<uintptr_t>(_pFileBase) + Rva));
-}
 
-/// <summary>
-/// Get data directory size
-/// </summary>
-/// <param name="index">Data directory index</param>
-/// <returns>Data directory size</returns>
-size_t PEImage::DirectorySize( int index ) const
-{
-    // Sanity check
-    if (index < 0 || index >= IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
-        return 0;
-
-    const IMAGE_DATA_DIRECTORY* idd = _is64 ? _pImageHdr64->OptionalHeader.DataDirectory : _pImageHdr32->OptionalHeader.DataDirectory;
-    return idd[index].VirtualAddress != 0 ? static_cast<size_t>(idd[index].Size) : 0;
 }
 
-
 /// <summary>
 /// Retrieve image TLS callbacks
 /// Callbacks are rebased for target image

src/BlackBone/PE/PEImage.h

@@ -23,6 +23,13 @@ namespace blackbone
 namespace pe
 {
 
+enum AddressType
+{
+    RVA,    // Relative virtual
+    VA,     // Absolute virtual
+    RPA,    // Relative physical
+};
+
 // Relocation block information
 struct RelocData
 {
@@ -150,7 +157,7 @@ class PEImage
     /// <param name="index">Directory index</param>
     /// <param name="keepRelative">Keep address relative to image base</param>
     /// <returns>Directory address</returns>
-    BLACKBONE_API size_t DirectoryAddress( int index, bool keepRelative = false ) const;
+    BLACKBONE_API uintptr_t DirectoryAddress( int index, AddressType type = VA ) const;
 
     /// <summary>
     /// Get data directory size
@@ -163,9 +170,9 @@ class PEImage
     /// Resolve virtual memory address to physical file offset
     /// </summary>
     /// <param name="Rva">Memory address</param>
-    /// <param name="keepRelative">Keep address relative to file start</param>
+    /// <param name="type">Address type to return</param>
     /// <returns>Resolved address</returns>
-    BLACKBONE_API uintptr_t ResolveRVAToVA( uintptr_t Rva, bool keepRelative = false ) const;
+    BLACKBONE_API uintptr_t ResolveRVAToVA( uintptr_t Rva, AddressType type = VA ) const;
 
     /// <summary>
     /// Get image path