x64dbg/x64dbg
x64dbg
/
x64dbg
1
0
Fork 0
Code Releases 5 Activity

DBG: exclude some invalid imports + give ordinal imports a name

This commit is contained in:
Duncan Ogilvie 2018-08-07 20:16:52 +02:00
parent 70cfec4094
commit d7f1dadb52
1 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/dbg/module.cpp
View File

@ -114,13 +114,18 @@ static void ReadExportDirectory(MODINFO & Info, ULONG_PTR FileMapVA)
// Note that we're loading this file because the debuggee did; that makes it at least somewhat plausible that we will also survive
for(DWORD i = 0; i < exportDir->NumberOfFunctions; i++)
{
// It is possible the AddressOfFunctions contain zero RVAs. GetProcAddress for these ordinals returns zero.
// "The reason for it is to assign a particular ordinal to a function." - NTCore
if(!addressOfFunctions[i])
continue;
Info.exports.emplace_back();
auto & entry = Info.exports.back();
entry.ordinal = i + exportDir->Base;
entry.rva = addressOfFunctions[i];
const auto entryVa = RvaToVa(FileMapVA, Info.headers, entry.rva);
entry.forwarded = entryVa >= (ULONG64)exportDir;
if(entry.forwarded && entryVa < (ULONG64)exportDir + exportDirSize)
entry.forwarded = entryVa >= (ULONG64)exportDir && entryVa < (ULONG64)exportDir + exportDirSize;
if(entry.forwarded)
{
auto forwardNameOffset = rva2offset(entry.rva);
if(forwardNameOffset) // Silent ignore (1) by ntdll loader: invalid forward names or addresses of forward names
@ -139,6 +144,13 @@ static void ReadExportDirectory(MODINFO & Info, ULONG_PTR FileMapVA)
}
}
// give some kind of name to ordinal functions
for(size_t i = 0; i < Info.exports.size(); i++)
{
if(Info.exports[i].name.empty())
Info.exports[i].name = "Ordinal#" + std::to_string(Info.exports[i].ordinal);
}
// prepare sorted vectors
Info.exportsByName.resize(Info.exports.size());
Info.exportsByRva.resize(Info.exports.size());