diff options
Diffstat (limited to 'src/logic')
| -rw-r--r-- | src/logic/pe_image_meta_data.c | 106 | ||||
| -rw-r--r-- | src/logic/pe_image_raw_data.c | 2 |
2 files changed, 91 insertions, 17 deletions
diff --git a/src/logic/pe_image_meta_data.c b/src/logic/pe_image_meta_data.c index 9753487..9846818 100644 --- a/src/logic/pe_image_meta_data.c +++ b/src/logic/pe_image_meta_data.c @@ -1,6 +1,6 @@ /***************************************************************/ /* perk: PE Resource Kit */ -/* Copyright (C) 2015--2021 SysDeer Technologies, LLC */ +/* Copyright (C) 2015--2025 SysDeer Technologies, LLC */ /* Released under GPLv2 and GPLv3; see COPYING.PERK. */ /***************************************************************/ @@ -26,7 +26,11 @@ static int pe_free_image_meta_impl(struct pe_image_meta * meta, int ret) for (i=0; i<meta->m_stats.t_nimplibs; i++) free(meta->m_idata[i].ih_items); + free(meta->m_symvec_crc32); + free(meta->m_symvec_crc64); + free(meta->m_idata); + free(meta->m_symtbl); free(meta->m_sectbl); free(meta); } @@ -39,6 +43,24 @@ void pe_meta_free_image_meta(struct pe_image_meta * meta) pe_free_image_meta_impl(meta,0); } +static int pe_symrec_crc32_compare(const void * a, const void * b) +{ + struct pe_meta_coff_symbol * syma = *(struct pe_meta_coff_symbol **)a; + struct pe_meta_coff_symbol * symb = *(struct pe_meta_coff_symbol **)b; + int eqor = !!(syma->cs_crc32 - symb->cs_crc32); + + return eqor * (syma->cs_crc32 > symb->cs_crc32 ? (1) : (-1)); +} + +static int pe_symrec_crc64_compare(const void * a, const void * b) +{ + struct pe_meta_coff_symbol * syma = *(struct pe_meta_coff_symbol **)a; + struct pe_meta_coff_symbol * symb = *(struct pe_meta_coff_symbol **)b; + int eqor = !!(syma->cs_crc64 - symb->cs_crc64); + + return eqor * (syma->cs_crc64 > symb->cs_crc64 ? (1) : (-1)); +} + static int pe_get_named_section_index(const struct pe_image_meta * m, const char * name) { int i; for (i=0; i<m->m_coff.cfh_num_of_sections; i++) @@ -330,18 +352,24 @@ static void pe_detect_image_framework(struct pe_image_meta * m) } int pe_meta_get_image_meta( - const struct pe_driver_ctx * dctx, - const struct pe_raw_image * image, - struct pe_image_meta ** meta) + const struct pe_driver_ctx * dctx, + const struct pe_raw_image * image, + struct pe_image_meta ** meta) { - int ret; - int i,s; - long l; - unsigned j; - const unsigned char * mark; - struct pe_image_meta * m; - char * base; - uint64_t vaddr; + int ret; + int i,s; + long l; + unsigned j; + + void * addr; + char * base; + const unsigned char * mark; + uint64_t vaddr; + + struct pe_image_meta * m; + struct pe_meta_coff_symbol * symrec; + int nrecs; + int nsyms; base = image->map_addr; @@ -365,13 +393,59 @@ int pe_meta_get_image_meta( m,PERK_CUSTOM_ERROR(dctx,ret)); } - mark = (const unsigned char *)base + m->m_coff.cfh_ptr_to_sym_tbl; - mark += m->m_coff.cfh_num_of_syms * sizeof(struct pe_raw_coff_symbol); - if (m->m_coff.cfh_ptr_to_sym_tbl) { + mark = (const unsigned char *)base+ + m->m_coff.cfh_ptr_to_sym_tbl; + m->r_symtbl = (struct pe_raw_coff_symbol *)mark; + mark += m->m_coff.cfh_size_of_sym_tbl; + m->m_coff.cfh_ptr_to_str_tbl = m->m_coff.cfh_ptr_to_sym_tbl; - m->m_coff.cfh_ptr_to_str_tbl += m->m_coff.cfh_num_of_syms * sizeof(struct pe_raw_coff_symbol); + m->m_coff.cfh_ptr_to_str_tbl += m->m_coff.cfh_size_of_sym_tbl; m->m_coff.cfh_size_of_str_tbl = pe_read_long(mark); + + } + + if ((nrecs = m->m_coff.cfh_size_of_sym_tbl/sizeof(struct pe_raw_coff_symbol))) + if (!(m->m_symtbl = calloc(nrecs+1,sizeof(struct pe_meta_coff_symbol)))) + return PERK_SYSTEM_ERROR(dctx); + + for (i=0,symrec=m->m_symtbl; i<nrecs; i++,symrec++) { + pe_read_coff_symbol( + &m->r_symtbl[i],symrec, + &m->m_coff,base); + + addr = symrec->cs_name; + mark = addr; + + symrec->cs_crc32 = pe_hash_mbstr_crc32(mark); + symrec->cs_crc64 = pe_hash_mbstr_crc64(mark); + + i += m->r_symtbl[i].cs_num_of_aux_recs[0]; + } + + m->m_stats.t_nsymbols = symrec - m->m_symtbl; + + if ((nsyms = m->m_stats.t_nsymbols) && true) { + if (!(m->m_symvec_crc32 = calloc(nsyms,sizeof(*m->m_symvec_crc32)))) + return PERK_SYSTEM_ERROR(dctx); + + for (i=0; i<nsyms; i++) + m->m_symvec_crc32[i] = &m->m_symtbl[i]; + + qsort(&m->m_symvec_crc32[0],nsyms, + sizeof(*m->m_symvec_crc32), + pe_symrec_crc32_compare); + } + + if (nsyms && true) { + if (!(m->m_symvec_crc64 = calloc(nsyms,sizeof(*m->m_symvec_crc64)))) + return PERK_SYSTEM_ERROR(dctx); + + for (i=0; i<nsyms; i++) + m->m_symvec_crc64[i] = &m->m_symtbl[i]; + + qsort(m->m_symvec_crc64,nsyms, + sizeof(*m->m_symvec_crc64), + pe_symrec_crc64_compare); } if (m->r_dos) { diff --git a/src/logic/pe_image_raw_data.c b/src/logic/pe_image_raw_data.c index 7ab6da6..c6b3cb3 100644 --- a/src/logic/pe_image_raw_data.c +++ b/src/logic/pe_image_raw_data.c @@ -1,6 +1,6 @@ /***************************************************************/ /* perk: PE Resource Kit */ -/* Copyright (C) 2015--2021 SysDeer Technologies, LLC */ +/* Copyright (C) 2015--2025 SysDeer Technologies, LLC */ /* Released under GPLv2 and GPLv3; see COPYING.PERK. */ /***************************************************************/ |