Skip to content

Commit a88c3ae

Browse files
dmexdmex
committed
peview: Improve import/export symbol lookup
1 parent 106604c commit a88c3ae

File tree

6 files changed

+88
-55
lines changed

6 files changed

+88
-55
lines changed

‎tools/peview/clrprp.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
*/
2323

2424
#include <peview.h>
25-
#include "metahost.h"
25+
#include <metahost.h>
2626

2727
typedef struct _PVP_PE_CLR_CONTEXT
2828
{

‎tools/peview/clrtableimportprp.c

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,21 @@ VOID PvpEnumerateClrImports(
142142

143143
if (importDll->Functions)
144144
{
145+
if (importDll->ImportName)
146+
{
147+
PPH_STRING importDllName;
148+
149+
if (importDllName = PhApiSetResolveToHost(&importDll->ImportName->sr))
150+
{
151+
PhMoveReference(&importDll->ImportName, PhFormatString(
152+
L"%s (%s)",
153+
PhGetString(importDll->ImportName),
154+
PhGetString(importDllName))
155+
);
156+
PhDereferenceObject(importDllName);
157+
}
158+
}
159+
145160
for (j = 0; j < importDll->Functions->Count; j++)
146161
{
147162
PPV_CLR_IMAGE_IMPORT_FUNCTION importFunction = importDll->Functions->Items[j];

‎tools/peview/expprp.c

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -206,8 +206,11 @@ NTSTATUS PvpPeExportsEnumerateThread(
206206
}
207207
else
208208
{
209-
PhPrintPointer(value, exportFunction.Function);
210-
exportNode->AddressString = PhCreateString(value);
209+
if (exportFunction.Function)
210+
{
211+
PhPrintPointer(value, exportFunction.Function);
212+
exportNode->AddressString = PhCreateString(value);
213+
}
211214
}
212215

213216
if (exportEntry.Name)
@@ -257,11 +260,12 @@ NTSTATUS PvpPeExportsEnumerateThread(
257260
);
258261
}
259262

260-
if (exportSymbolName)
263+
if (!PhIsNullOrEmptyString(exportSymbolName))
261264
{
262265
exportNode->NameString = PhConcatStringRefZ(&exportSymbolName->sr, L" (unnamed)");
263266
}
264-
267+
268+
PhClearReference(&exportSymbolName);
265269
PhClearReference(&exportSymbol);
266270
}
267271
}
@@ -746,12 +750,7 @@ BOOLEAN NTAPI PvExportTreeNewCallback(
746750
getCellText->Text = PhGetStringRef(node->AddressString);
747751
break;
748752
case PV_EXPORT_TREE_COLUMN_ITEM_NAME:
749-
{
750-
if (node->NameString)
751-
getCellText->Text = PhGetStringRef(node->NameString);
752-
else
753-
PhInitializeStringRefLongHint(&getCellText->Text, L"(unnamed)");
754-
}
753+
getCellText->Text = PhGetStringRef(node->NameString);
755754
break;
756755
case PV_EXPORT_TREE_COLUMN_ITEM_ORDINAL:
757756
getCellText->Text = PhGetStringRef(node->OrdinalString);

‎tools/peview/impprp.c

Lines changed: 28 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -216,22 +216,29 @@ PPH_STRING PvpQueryModuleOrdinalName(
216216

217217
if (NT_SUCCESS(PhGetProcessMappedFileName(NtCurrentProcess(), (PVOID)mappedImage.ViewBase, &exportFileName)))
218218
{
219-
if (PhLoadModuleSymbolProvider(
220-
PvSymbolProvider,
221-
exportFileName,
222-
(ULONG64)mappedImage.ViewBase,
223-
(ULONG)mappedImage.Size
224-
))
219+
PPH_SYMBOL_PROVIDER moduleSymbolProvider = NULL;
220+
221+
if (PvpLoadDbgHelp(&moduleSymbolProvider))
225222
{
226-
// Try find the export name using symbols.
227-
exportSymbol = PhGetSymbolFromAddress(
228-
PvSymbolProvider,
229-
(ULONG64)PTR_ADD_OFFSET(mappedImage.ViewBase, exportFunction.Function),
230-
NULL,
231-
NULL,
232-
&exportSymbolName,
233-
NULL
234-
);
223+
if (PhLoadModuleSymbolProvider(
224+
moduleSymbolProvider,
225+
exportFileName,
226+
(ULONG64)mappedImage.ViewBase,
227+
(ULONG)mappedImage.Size
228+
))
229+
{
230+
// Try find the export name using symbols.
231+
exportSymbol = PhGetSymbolFromAddress(
232+
moduleSymbolProvider,
233+
(ULONG64)PTR_ADD_OFFSET(mappedImage.ViewBase, exportFunction.Function),
234+
NULL,
235+
NULL,
236+
&exportSymbolName,
237+
NULL
238+
);
239+
}
240+
241+
PhDereferenceObject(moduleSymbolProvider);
235242
}
236243

237244
PhDereferenceObject(exportFileName);
@@ -339,8 +346,13 @@ VOID PvpProcessImports(
339346
if (exportDllName = PhConvertUtf8ToUtf16(importDll.Name))
340347
{
341348
PPH_STRING filePath;
349+
PPH_STRING importDllName;
350+
351+
if (importDllName = PhApiSetResolveToHost(&exportDllName->sr))
352+
{
353+
PhMoveReference(&exportDllName, importDllName);
354+
}
342355

343-
// TODO: Implement ApiSet mappings for exportDllName. (dmex)
344356
// TODO: Add DLL directory to PhSearchFilePath for locating non-system images. (dmex)
345357

346358
if (filePath = PhSearchFilePath(exportDllName->Buffer, L".dll"))

‎tools/peview/pdbprp.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* PE viewer -
33
* pdb support
44
*
5-
* Copyright (C) 2017-2021 dmex
5+
* Copyright (C) 2017-2022 dmex
66
*
77
* This file is part of Process Hacker.
88
*
@@ -187,13 +187,13 @@ END_SORT_FUNCTION
187187

188188
BEGIN_SORT_FUNCTION(Symbol)
189189
{
190-
sortResult = PhCompareStringWithNull(node1->Name, node2->Name, FALSE);
190+
sortResult = PhCompareStringWithNull(node1->Name, node2->Name, TRUE);
191191
}
192192
END_SORT_FUNCTION
193193

194194
BEGIN_SORT_FUNCTION(Data)
195195
{
196-
sortResult = PhCompareStringWithNull(node1->Data, node2->Data, FALSE);
196+
sortResult = PhCompareStringWithNull(node1->Data, node2->Data, TRUE);
197197
}
198198
END_SORT_FUNCTION
199199

‎tools/peview/peprp.c

Lines changed: 32 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1126,7 +1126,7 @@ static NTSTATUS PvpEntryPointImageThreadStart(
11261126
{
11271127
ULONG addressOfEntryPoint;
11281128
PPH_STRING string;
1129-
PPH_STRING symbol;
1129+
PPH_STRING symbol = NULL;
11301130
PPH_STRING symbolName = NULL;
11311131
PH_SYMBOL_RESOLVE_LEVEL symbolResolveLevel = PhsrlInvalid;
11321132

@@ -1135,30 +1135,38 @@ static NTSTATUS PvpEntryPointImageThreadStart(
11351135
else
11361136
addressOfEntryPoint = PvMappedImage.NtHeaders->OptionalHeader.AddressOfEntryPoint;
11371137

1138-
if (PvMappedImage.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC)
1138+
if (addressOfEntryPoint)
11391139
{
1140-
symbol = PhGetSymbolFromAddress(
1141-
PvSymbolProvider,
1142-
(ULONG64)PTR_ADD_OFFSET(PvMappedImage.NtHeaders32->OptionalHeader.ImageBase, addressOfEntryPoint),
1143-
&symbolResolveLevel,
1144-
NULL,
1145-
&symbolName,
1146-
NULL
1147-
);
1148-
}
1149-
else
1150-
{
1151-
symbol = PhGetSymbolFromAddress(
1152-
PvSymbolProvider,
1153-
(ULONG64)PTR_ADD_OFFSET(PvMappedImage.NtHeaders->OptionalHeader.ImageBase, addressOfEntryPoint),
1154-
&symbolResolveLevel,
1155-
NULL,
1156-
&symbolName,
1157-
NULL
1158-
);
1140+
if (PvMappedImage.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC)
1141+
{
1142+
symbol = PhGetSymbolFromAddress(
1143+
PvSymbolProvider,
1144+
(ULONG64)PTR_ADD_OFFSET(PvMappedImage.NtHeaders32->OptionalHeader.ImageBase, addressOfEntryPoint),
1145+
&symbolResolveLevel,
1146+
NULL,
1147+
&symbolName,
1148+
NULL
1149+
);
1150+
}
1151+
else
1152+
{
1153+
symbol = PhGetSymbolFromAddress(
1154+
PvSymbolProvider,
1155+
(ULONG64)PTR_ADD_OFFSET(PvMappedImage.NtHeaders->OptionalHeader.ImageBase, addressOfEntryPoint),
1156+
&symbolResolveLevel,
1157+
NULL,
1158+
&symbolName,
1159+
NULL
1160+
);
1161+
}
11591162
}
11601163

1161-
if (symbolName && symbolResolveLevel == PhsrlFunction || symbolResolveLevel == PhsrlModule || symbolResolveLevel == PhsrlAddress)
1164+
if (
1165+
!PhIsNullOrEmptyString(symbolName) && (
1166+
symbolResolveLevel == PhsrlFunction ||
1167+
symbolResolveLevel == PhsrlModule ||
1168+
symbolResolveLevel == PhsrlAddress
1169+
))
11621170
{
11631171
string = PhFormatString(L"0x%I32x (%s)", addressOfEntryPoint, PhGetStringOrEmpty(symbolName));
11641172
PhSetListViewSubItem(Parameter, PVP_IMAGE_GENERAL_INDEX_ENTRYPOINT, 1, string->Buffer);
@@ -1171,9 +1179,8 @@ static NTSTATUS PvpEntryPointImageThreadStart(
11711179
PhDereferenceObject(string);
11721180
}
11731181

1174-
if (symbolName)
1175-
PhDereferenceObject(symbolName);
1176-
PhDereferenceObject(symbol);
1182+
PhClearReference(&symbolName);
1183+
PhClearReference(&symbol);
11771184
return STATUS_SUCCESS;
11781185
}
11791186

0 commit comments

Comments
 (0)