x64dbg
/
GleeBug
mirror of https://github.com/x64dbg/GleeBug
1
0
Fork 0
Code Releases Activity

fixed GetPE32DataW and GetPE32DataFromMappedFile for loading x32 files on x64

This commit is contained in:
mrexodia 2017-07-03 07:42:55 +02:00
parent 7da59f841d
commit d94ad0e74d
No known key found for this signature in database
GPG Key ID: FC89E0AAA0C1AAD8
1 changed files with 25 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
TitanEngineEmulator/Emulator.h
View File

@ -451,21 +451,9 @@ public:
return found->second.pe->ConvertRvaToOffset(uint32(AddressToConvert)); return found->second.pe->ConvertRvaToOffset(uint32(AddressToConvert));
} }
ULONG_PTR GetPE32DataFromMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData) template<typename T>
ULONG_PTR GetPE32DataW_impl(const Region<T> & headers, DWORD WhichSection, DWORD WhichData, const std::vector<Section> & sections)
{ {
auto found = mappedFiles.find(FileMapVA);
if(found == mappedFiles.end())
__debugbreak(); //return 0;
if(!found->second.pe->IsValidPe())
__debugbreak(); //return 0;
#ifdef _WIN64
if(!found->second.pe->IsPe64()) __debugbreak(); //return 0;
auto headers = found->second.pe->GetNtHeaders64();
#else
if(found->second.pe->IsPe64()) __debugbreak(); //return 0;
auto headers = found->second.pe->GetNtHeaders32();
#endif //_WIN64
const auto & sections = found->second.pe->GetSections();
switch(WhichData) switch(WhichData)
{ {
case UE_PE_OFFSET: case UE_PE_OFFSET:
@ -487,17 +475,32 @@ public:
case UE_SECTIONNUMBER: case UE_SECTIONNUMBER:
return sections.size(); return sections.size();
case UE_SECTIONVIRTUALOFFSET: //WhichSection: IMAGE_DIRECTORY_ENTRY_EXCEPTION case UE_SECTIONVIRTUALOFFSET: //WhichSection: IMAGE_DIRECTORY_ENTRY_EXCEPTION
return WhichSection < sections.size() ? sections[WhichSection].GetHeader().VirtualAddress : 0; return WhichSection < sections.size() ? sections.at(WhichSection).GetHeader().VirtualAddress : 0;
case UE_SECTIONVIRTUALSIZE: //WhichSection: IMAGE_DIRECTORY_ENTRY_EXCEPTION case UE_SECTIONVIRTUALSIZE: //WhichSection: IMAGE_DIRECTORY_ENTRY_EXCEPTION
return WhichSection < sections.size() ? sections[WhichSection].GetHeader().Misc.VirtualSize : 0; return WhichSection < sections.size() ? sections.at(WhichSection).GetHeader().Misc.VirtualSize : 0;
case UE_SECTIONNAME: case UE_SECTIONNAME:
return WhichSection < sections.size() ? ULONG_PTR(&sections[WhichSection].GetHeader().Name[0]) : 0; return WhichSection < sections.size() ? ULONG_PTR(&sections.at(WhichSection).GetHeader().Name[0]) : 0;
case UE_IMAGEBASE:
return headers->OptionalHeader.ImageBase;
default: default:
__debugbreak(); __debugbreak();
} }
return 0; return 0;
} }
ULONG_PTR GetPE32DataFromMappedFile(ULONG_PTR FileMapVA, DWORD WhichSection, DWORD WhichData)
{
auto found = mappedFiles.find(FileMapVA);
if(found == mappedFiles.end())
__debugbreak(); //return 0;
if(!found->second.pe->IsValidPe())
__debugbreak(); //return 0;
auto sections = found->second.pe->GetSections();
return found->second.pe->IsPe64()
? GetPE32DataW_impl(found->second.pe->GetNtHeaders64(), WhichSection, WhichData, sections)
: GetPE32DataW_impl(found->second.pe->GetNtHeaders32(), WhichSection, WhichData, sections);
}
ULONG_PTR GetPE32DataW(const wchar_t* szFileName, DWORD WhichSection, DWORD WhichData) ULONG_PTR GetPE32DataW(const wchar_t* szFileName, DWORD WhichSection, DWORD WhichData)
{ {
FileMap<unsigned char> file; FileMap<unsigned char> file;
@ -509,27 +512,12 @@ public:
__debugbreak(); //return 0; __debugbreak(); //return 0;
if(!pe.IsValidPe()) if(!pe.IsValidPe())
__debugbreak(); //return 0; __debugbreak(); //return 0;
#ifdef _WIN64 auto sections = pe.GetSections();
if(!pe.IsPe64()) __debugbreak(); //return 0; return pe.IsPe64()
auto headers = pe.GetNtHeaders64().Data(); ? GetPE32DataW_impl(pe.GetNtHeaders64(), WhichSection, WhichData, sections)
#else : GetPE32DataW_impl(pe.GetNtHeaders32(), WhichSection, WhichData, sections);
if(pe.IsPe64()) __debugbreak(); //return 0;
auto headers = pe.GetNtHeaders32().Data();
#endif //_WIN64
switch(WhichData)
{
case UE_CHARACTERISTICS:
return headers->FileHeader.Characteristics;
case UE_IMAGEBASE:
return headers->OptionalHeader.ImageBase;
case UE_OEP:
return headers->OptionalHeader.AddressOfEntryPoint;
default:
__debugbreak();
}
return 0;
} }
bool IsFileDLLW(const wchar_t* szFileName, ULONG_PTR FileMapVA) bool IsFileDLLW(const wchar_t* szFileName, ULONG_PTR FileMapVA)
{ {
return (GetPE32DataW(szFileName, NULL, UE_CHARACTERISTICS) & IMAGE_FILE_DLL) == IMAGE_FILE_DLL; return (GetPE32DataW(szFileName, NULL, UE_CHARACTERISTICS) & IMAGE_FILE_DLL) == IMAGE_FILE_DLL;