| /* |
| * IMAGEHLP library |
| * |
| * Copyright 1998 Patrik Stridvall |
| * Copyright 2003 Mike McCormack |
| * Copyright 2009 Owen Rudge for CodeWeavers |
| * Copyright 2010 Juan Lang |
| * Copyright 2010 Andrey Turkin |
| * |
| * This library is free software; you can redistribute it and/or |
| * modify it under the terms of the GNU Lesser General Public |
| * License as published by the Free Software Foundation; either |
| * version 2.1 of the License, or (at your option) any later version. |
| * |
| * This library is distributed in the hope that it will be useful, |
| * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
| * Lesser General Public License for more details. |
| * |
| * You should have received a copy of the GNU Lesser General Public |
| * License along with this library; if not, write to the Free Software |
| * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA |
| */ |
| |
| #include <stdarg.h> |
| |
| #include "windef.h" |
| #include "winbase.h" |
| #include "winerror.h" |
| #include "winternl.h" |
| #include "winnt.h" |
| #include "imagehlp.h" |
| #include "wine/debug.h" |
| |
| WINE_DEFAULT_DEBUG_CHANNEL(imagehlp); |
| |
| /* |
| * These functions are partially documented at: |
| * http://www.cs.auckland.ac.nz/~pgut001/pubs/authenticode.txt |
| */ |
| |
| #define HDR_FAIL -1 |
| #define HDR_NT32 0 |
| #define HDR_NT64 1 |
| |
| /*********************************************************************** |
| * IMAGEHLP_GetNTHeaders (INTERNAL) |
| * |
| * Return the IMAGE_NT_HEADERS for a PE file, after validating magic |
| * numbers and distinguishing between 32-bit and 64-bit files. |
| */ |
| static int IMAGEHLP_GetNTHeaders(HANDLE handle, DWORD *pe_offset, IMAGE_NT_HEADERS32 *nt32, IMAGE_NT_HEADERS64 *nt64) |
| { |
| IMAGE_DOS_HEADER dos_hdr; |
| DWORD count; |
| BOOL r; |
| |
| TRACE("handle %p\n", handle); |
| |
| if ((!nt32) || (!nt64)) |
| return HDR_FAIL; |
| |
| /* read the DOS header */ |
| count = SetFilePointer(handle, 0, NULL, FILE_BEGIN); |
| |
| if (count == INVALID_SET_FILE_POINTER) |
| return HDR_FAIL; |
| |
| count = 0; |
| |
| r = ReadFile(handle, &dos_hdr, sizeof dos_hdr, &count, NULL); |
| |
| if (!r) |
| return HDR_FAIL; |
| |
| if (count != sizeof dos_hdr) |
| return HDR_FAIL; |
| |
| /* verify magic number of 'MZ' */ |
| if (dos_hdr.e_magic != IMAGE_DOS_SIGNATURE) |
| return HDR_FAIL; |
| |
| if (pe_offset != NULL) |
| *pe_offset = dos_hdr.e_lfanew; |
| |
| /* read the PE header */ |
| count = SetFilePointer(handle, dos_hdr.e_lfanew, NULL, FILE_BEGIN); |
| |
| if (count == INVALID_SET_FILE_POINTER) |
| return HDR_FAIL; |
| |
| count = 0; |
| |
| r = ReadFile(handle, nt32, sizeof(IMAGE_NT_HEADERS32), &count, NULL); |
| |
| if (!r) |
| return HDR_FAIL; |
| |
| if (count != sizeof(IMAGE_NT_HEADERS32)) |
| return HDR_FAIL; |
| |
| /* verify NT signature */ |
| if (nt32->Signature != IMAGE_NT_SIGNATURE) |
| return HDR_FAIL; |
| |
| /* check if we have a 32-bit or 64-bit executable */ |
| switch (nt32->OptionalHeader.Magic) |
| { |
| case IMAGE_NT_OPTIONAL_HDR32_MAGIC: |
| return HDR_NT32; |
| |
| case IMAGE_NT_OPTIONAL_HDR64_MAGIC: |
| /* Re-read as 64-bit */ |
| |
| count = SetFilePointer(handle, dos_hdr.e_lfanew, NULL, FILE_BEGIN); |
| |
| if (count == INVALID_SET_FILE_POINTER) |
| return HDR_FAIL; |
| |
| count = 0; |
| |
| r = ReadFile(handle, nt64, sizeof(IMAGE_NT_HEADERS64), &count, NULL); |
| |
| if (!r) |
| return HDR_FAIL; |
| |
| if (count != sizeof(IMAGE_NT_HEADERS64)) |
| return HDR_FAIL; |
| |
| /* verify NT signature */ |
| if (nt64->Signature != IMAGE_NT_SIGNATURE) |
| return HDR_FAIL; |
| |
| return HDR_NT64; |
| } |
| |
| return HDR_FAIL; |
| } |
| |
| /*********************************************************************** |
| * IMAGEHLP_GetSecurityDirOffset (INTERNAL) |
| * |
| * Read a file's PE header, and return the offset and size of the |
| * security directory. |
| */ |
| static BOOL IMAGEHLP_GetSecurityDirOffset( HANDLE handle, |
| DWORD *pdwOfs, DWORD *pdwSize ) |
| { |
| IMAGE_NT_HEADERS32 nt_hdr32; |
| IMAGE_NT_HEADERS64 nt_hdr64; |
| IMAGE_DATA_DIRECTORY *sd; |
| int ret; |
| |
| ret = IMAGEHLP_GetNTHeaders(handle, NULL, &nt_hdr32, &nt_hdr64); |
| |
| if (ret == HDR_NT32) |
| sd = &nt_hdr32.OptionalHeader.DataDirectory[IMAGE_FILE_SECURITY_DIRECTORY]; |
| else if (ret == HDR_NT64) |
| sd = &nt_hdr64.OptionalHeader.DataDirectory[IMAGE_FILE_SECURITY_DIRECTORY]; |
| else |
| return FALSE; |
| |
| TRACE("ret = %d size = %x addr = %x\n", ret, sd->Size, sd->VirtualAddress); |
| |
| *pdwSize = sd->Size; |
| *pdwOfs = sd->VirtualAddress; |
| |
| return TRUE; |
| } |
| |
| /*********************************************************************** |
| * IMAGEHLP_SetSecurityDirOffset (INTERNAL) |
| * |
| * Read a file's PE header, and update the offset and size of the |
| * security directory. |
| */ |
| static BOOL IMAGEHLP_SetSecurityDirOffset(HANDLE handle, |
| DWORD dwOfs, DWORD dwSize) |
| { |
| IMAGE_NT_HEADERS32 nt_hdr32; |
| IMAGE_NT_HEADERS64 nt_hdr64; |
| IMAGE_DATA_DIRECTORY *sd; |
| int ret, nt_hdr_size = 0; |
| DWORD pe_offset; |
| void *nt_hdr; |
| DWORD count; |
| BOOL r; |
| |
| ret = IMAGEHLP_GetNTHeaders(handle, &pe_offset, &nt_hdr32, &nt_hdr64); |
| |
| if (ret == HDR_NT32) |
| { |
| sd = &nt_hdr32.OptionalHeader.DataDirectory[IMAGE_FILE_SECURITY_DIRECTORY]; |
| |
| nt_hdr = &nt_hdr32; |
| nt_hdr_size = sizeof(IMAGE_NT_HEADERS32); |
| } |
| else if (ret == HDR_NT64) |
| { |
| sd = &nt_hdr64.OptionalHeader.DataDirectory[IMAGE_FILE_SECURITY_DIRECTORY]; |
| |
| nt_hdr = &nt_hdr64; |
| nt_hdr_size = sizeof(IMAGE_NT_HEADERS64); |
| } |
| else |
| return FALSE; |
| |
| sd->Size = dwSize; |
| sd->VirtualAddress = dwOfs; |
| |
| TRACE("size = %x addr = %x\n", sd->Size, sd->VirtualAddress); |
| |
| /* write the header back again */ |
| count = SetFilePointer(handle, pe_offset, NULL, FILE_BEGIN); |
| |
| if (count == INVALID_SET_FILE_POINTER) |
| return FALSE; |
| |
| count = 0; |
| |
| r = WriteFile(handle, nt_hdr, nt_hdr_size, &count, NULL); |
| |
| if (!r) |
| return FALSE; |
| |
| if (count != nt_hdr_size) |
| return FALSE; |
| |
| return TRUE; |
| } |
| |
| /*********************************************************************** |
| * IMAGEHLP_GetCertificateOffset (INTERNAL) |
| * |
| * Read a file's PE header, and return the offset and size of the |
| * security directory. |
| */ |
| static BOOL IMAGEHLP_GetCertificateOffset( HANDLE handle, DWORD num, |
| DWORD *pdwOfs, DWORD *pdwSize ) |
| { |
| DWORD size, count, offset, len, sd_VirtualAddr; |
| BOOL r; |
| |
| r = IMAGEHLP_GetSecurityDirOffset( handle, &sd_VirtualAddr, &size ); |
| if( !r ) |
| return FALSE; |
| |
| offset = 0; |
| /* take the n'th certificate */ |
| while( 1 ) |
| { |
| /* read the length of the current certificate */ |
| count = SetFilePointer( handle, sd_VirtualAddr + offset, |
| NULL, FILE_BEGIN ); |
| if( count == INVALID_SET_FILE_POINTER ) |
| return FALSE; |
| r = ReadFile( handle, &len, sizeof len, &count, NULL ); |
| if( !r ) |
| return FALSE; |
| if( count != sizeof len ) |
| return FALSE; |
| |
| /* check the certificate is not too big or too small */ |
| if( len < sizeof len ) |
| return FALSE; |
| if( len > (size-offset) ) |
| return FALSE; |
| if( !num-- ) |
| break; |
| |
| /* calculate the offset of the next certificate */ |
| offset += len; |
| |
| /* padded out to the nearest 8-byte boundary */ |
| if( len % 8 ) |
| offset += 8 - (len % 8); |
| |
| if( offset >= size ) |
| return FALSE; |
| } |
| |
| *pdwOfs = sd_VirtualAddr + offset; |
| *pdwSize = len; |
| |
| TRACE("len = %x addr = %x\n", len, sd_VirtualAddr + offset); |
| |
| return TRUE; |
| } |
| |
| /*********************************************************************** |
| * IMAGEHLP_RecalculateChecksum (INTERNAL) |
| * |
| * Update the NT header checksum for the specified file. |
| */ |
| static BOOL IMAGEHLP_RecalculateChecksum(HANDLE handle) |
| { |
| DWORD FileLength, count, HeaderSum, pe_offset, nt_hdr_size; |
| IMAGE_NT_HEADERS32 nt_hdr32; |
| IMAGE_NT_HEADERS64 nt_hdr64; |
| LPVOID BaseAddress; |
| HANDLE hMapping; |
| DWORD *CheckSum; |
| void *nt_hdr; |
| int ret; |
| BOOL r; |
| |
| TRACE("handle %p\n", handle); |
| |
| ret = IMAGEHLP_GetNTHeaders(handle, &pe_offset, &nt_hdr32, &nt_hdr64); |
| |
| if (ret == HDR_NT32) |
| { |
| CheckSum = &nt_hdr32.OptionalHeader.CheckSum; |
| |
| nt_hdr = &nt_hdr32; |
| nt_hdr_size = sizeof(IMAGE_NT_HEADERS32); |
| } |
| else if (ret == HDR_NT64) |
| { |
| CheckSum = &nt_hdr64.OptionalHeader.CheckSum; |
| |
| nt_hdr = &nt_hdr64; |
| nt_hdr_size = sizeof(IMAGE_NT_HEADERS64); |
| } |
| else |
| return FALSE; |
| |
| hMapping = CreateFileMappingW(handle, NULL, PAGE_READONLY, 0, 0, NULL); |
| |
| if (!hMapping) |
| return FALSE; |
| |
| BaseAddress = MapViewOfFile(hMapping, FILE_MAP_READ, 0, 0, 0); |
| |
| if (!BaseAddress) |
| { |
| CloseHandle(hMapping); |
| return FALSE; |
| } |
| |
| FileLength = GetFileSize(handle, NULL); |
| |
| *CheckSum = 0; |
| CheckSumMappedFile(BaseAddress, FileLength, &HeaderSum, CheckSum); |
| |
| UnmapViewOfFile(BaseAddress); |
| CloseHandle(hMapping); |
| |
| if (*CheckSum) |
| { |
| /* write the header back again */ |
| count = SetFilePointer(handle, pe_offset, NULL, FILE_BEGIN); |
| |
| if (count == INVALID_SET_FILE_POINTER) |
| return FALSE; |
| |
| count = 0; |
| |
| r = WriteFile(handle, nt_hdr, nt_hdr_size, &count, NULL); |
| |
| if (!r) |
| return FALSE; |
| |
| if (count != nt_hdr_size) |
| return FALSE; |
| |
| return TRUE; |
| } |
| |
| return FALSE; |
| } |
| |
| /*********************************************************************** |
| * ImageAddCertificate (IMAGEHLP.@) |
| * |
| * Adds the specified certificate to the security directory of |
| * open PE file. |
| */ |
| |
| BOOL WINAPI ImageAddCertificate( |
| HANDLE FileHandle, LPWIN_CERTIFICATE Certificate, PDWORD Index) |
| { |
| DWORD size = 0, count = 0, offset = 0, sd_VirtualAddr = 0, index = 0; |
| WIN_CERTIFICATE hdr; |
| const size_t cert_hdr_size = sizeof hdr - sizeof hdr.bCertificate; |
| BOOL r; |
| |
| TRACE("(%p, %p, %p)\n", FileHandle, Certificate, Index); |
| |
| r = IMAGEHLP_GetSecurityDirOffset(FileHandle, &sd_VirtualAddr, &size); |
| |
| /* If we've already got a security directory, find the end of it */ |
| if ((r) && (sd_VirtualAddr != 0)) |
| { |
| /* Check if the security directory is at the end of the file. |
| If not, we should probably relocate it. */ |
| if (GetFileSize(FileHandle, NULL) != sd_VirtualAddr + size) |
| { |
| FIXME("Security directory already present but not located at EOF, not adding certificate\n"); |
| |
| SetLastError(ERROR_NOT_SUPPORTED); |
| return FALSE; |
| } |
| |
| while (offset < size) |
| { |
| /* read the length of the current certificate */ |
| count = SetFilePointer (FileHandle, sd_VirtualAddr + offset, |
| NULL, FILE_BEGIN); |
| |
| if (count == INVALID_SET_FILE_POINTER) |
| return FALSE; |
| |
| r = ReadFile(FileHandle, &hdr, cert_hdr_size, &count, NULL); |
| |
| if (!r) |
| return FALSE; |
| |
| if (count != cert_hdr_size) |
| return FALSE; |
| |
| /* check the certificate is not too big or too small */ |
| if (hdr.dwLength < cert_hdr_size) |
| return FALSE; |
| |
| if (hdr.dwLength > (size-offset)) |
| return FALSE; |
| |
| /* next certificate */ |
| offset += hdr.dwLength; |
| |
| /* padded out to the nearest 8-byte boundary */ |
| if (hdr.dwLength % 8) |
| offset += 8 - (hdr.dwLength % 8); |
| |
| index++; |
| } |
| |
| count = SetFilePointer (FileHandle, sd_VirtualAddr + offset, NULL, FILE_BEGIN); |
| |
| if (count == INVALID_SET_FILE_POINTER) |
| return FALSE; |
| } |
| else |
| { |
| sd_VirtualAddr = SetFilePointer(FileHandle, 0, NULL, FILE_END); |
| |
| if (sd_VirtualAddr == INVALID_SET_FILE_POINTER) |
| return FALSE; |
| } |
| |
| /* Write the certificate to the file */ |
| r = WriteFile(FileHandle, Certificate, Certificate->dwLength, &count, NULL); |
| |
| if (!r) |
| return FALSE; |
| |
| /* Pad out if necessary */ |
| if (Certificate->dwLength % 8) |
| { |
| char null[8]; |
| |
| ZeroMemory(null, 8); |
| WriteFile(FileHandle, null, 8 - (Certificate->dwLength % 8), &count, NULL); |
| |
| size += 8 - (Certificate->dwLength % 8); |
| } |
| |
| size += Certificate->dwLength; |
| |
| /* Update the security directory offset and size */ |
| if (!IMAGEHLP_SetSecurityDirOffset(FileHandle, sd_VirtualAddr, size)) |
| return FALSE; |
| |
| if (!IMAGEHLP_RecalculateChecksum(FileHandle)) |
| return FALSE; |
| |
| if(Index) |
| *Index = index; |
| return TRUE; |
| } |
| |
| /*********************************************************************** |
| * ImageEnumerateCertificates (IMAGEHLP.@) |
| */ |
| BOOL WINAPI ImageEnumerateCertificates( |
| HANDLE handle, WORD TypeFilter, PDWORD CertificateCount, |
| PDWORD Indices, DWORD IndexCount) |
| { |
| DWORD size, count, offset, sd_VirtualAddr, index; |
| WIN_CERTIFICATE hdr; |
| const size_t cert_hdr_size = sizeof hdr - sizeof hdr.bCertificate; |
| BOOL r; |
| |
| TRACE("%p %hd %p %p %d\n", |
| handle, TypeFilter, CertificateCount, Indices, IndexCount); |
| |
| r = IMAGEHLP_GetSecurityDirOffset( handle, &sd_VirtualAddr, &size ); |
| if( !r ) |
| return FALSE; |
| |
| offset = 0; |
| index = 0; |
| *CertificateCount = 0; |
| while( offset < size ) |
| { |
| /* read the length of the current certificate */ |
| count = SetFilePointer( handle, sd_VirtualAddr + offset, |
| NULL, FILE_BEGIN ); |
| if( count == INVALID_SET_FILE_POINTER ) |
| return FALSE; |
| r = ReadFile( handle, &hdr, cert_hdr_size, &count, NULL ); |
| if( !r ) |
| return FALSE; |
| if( count != cert_hdr_size ) |
| return FALSE; |
| |
| TRACE("Size = %08x id = %08hx\n", |
| hdr.dwLength, hdr.wCertificateType ); |
| |
| /* check the certificate is not too big or too small */ |
| if( hdr.dwLength < cert_hdr_size ) |
| return FALSE; |
| if( hdr.dwLength > (size-offset) ) |
| return FALSE; |
| |
| if( (TypeFilter == CERT_SECTION_TYPE_ANY) || |
| (TypeFilter == hdr.wCertificateType) ) |
| { |
| (*CertificateCount)++; |
| if(Indices && *CertificateCount <= IndexCount) |
| *Indices++ = index; |
| } |
| |
| /* next certificate */ |
| offset += hdr.dwLength; |
| |
| /* padded out to the nearest 8-byte boundary */ |
| if (hdr.dwLength % 8) |
| offset += 8 - (hdr.dwLength % 8); |
| |
| index++; |
| } |
| |
| return TRUE; |
| } |
| |
| /*********************************************************************** |
| * ImageGetCertificateData (IMAGEHLP.@) |
| * |
| * FIXME: not sure that I'm dealing with the Index the right way |
| */ |
| BOOL WINAPI ImageGetCertificateData( |
| HANDLE handle, DWORD Index, |
| LPWIN_CERTIFICATE Certificate, PDWORD RequiredLength) |
| { |
| DWORD r, offset, ofs, size, count; |
| |
| TRACE("%p %d %p %p\n", handle, Index, Certificate, RequiredLength); |
| |
| if( !RequiredLength) |
| { |
| SetLastError( ERROR_INVALID_PARAMETER ); |
| return FALSE; |
| } |
| |
| if( !IMAGEHLP_GetCertificateOffset( handle, Index, &ofs, &size ) ) |
| return FALSE; |
| |
| if( *RequiredLength < size ) |
| { |
| *RequiredLength = size; |
| SetLastError( ERROR_INSUFFICIENT_BUFFER ); |
| return FALSE; |
| } |
| |
| if( !Certificate ) |
| { |
| SetLastError( ERROR_INVALID_PARAMETER ); |
| return FALSE; |
| } |
| |
| *RequiredLength = size; |
| |
| offset = SetFilePointer( handle, ofs, NULL, FILE_BEGIN ); |
| if( offset == INVALID_SET_FILE_POINTER ) |
| return FALSE; |
| |
| r = ReadFile( handle, Certificate, size, &count, NULL ); |
| if( !r ) |
| return FALSE; |
| if( count != size ) |
| return FALSE; |
| |
| TRACE("OK\n"); |
| SetLastError( NO_ERROR ); |
| |
| return TRUE; |
| } |
| |
| /*********************************************************************** |
| * ImageGetCertificateHeader (IMAGEHLP.@) |
| */ |
| BOOL WINAPI ImageGetCertificateHeader( |
| HANDLE handle, DWORD index, LPWIN_CERTIFICATE pCert) |
| { |
| DWORD r, offset, ofs, size, count; |
| const size_t cert_hdr_size = sizeof *pCert - sizeof pCert->bCertificate; |
| |
| TRACE("%p %d %p\n", handle, index, pCert); |
| |
| if( !IMAGEHLP_GetCertificateOffset( handle, index, &ofs, &size ) ) |
| return FALSE; |
| |
| if( size < cert_hdr_size ) |
| return FALSE; |
| |
| offset = SetFilePointer( handle, ofs, NULL, FILE_BEGIN ); |
| if( offset == INVALID_SET_FILE_POINTER ) |
| return FALSE; |
| |
| r = ReadFile( handle, pCert, cert_hdr_size, &count, NULL ); |
| if( !r ) |
| return FALSE; |
| if( count != cert_hdr_size ) |
| return FALSE; |
| |
| TRACE("OK\n"); |
| |
| return TRUE; |
| } |
| |
| /* Finds the section named section in the array of IMAGE_SECTION_HEADERs hdr. If |
| * found, returns the offset to the section. Otherwise returns 0. If the section |
| * is found, optionally returns the size of the section (in size) and the base |
| * address of the section (in base.) |
| */ |
| static DWORD IMAGEHLP_GetSectionOffset( IMAGE_SECTION_HEADER *hdr, |
| DWORD num_sections, LPCSTR section, PDWORD size, PDWORD base ) |
| { |
| DWORD i, offset = 0; |
| |
| for( i = 0; !offset && i < num_sections; i++, hdr++ ) |
| { |
| if( !memcmp( hdr->Name, section, strlen(section) ) ) |
| { |
| offset = hdr->PointerToRawData; |
| if( size ) |
| *size = hdr->SizeOfRawData; |
| if( base ) |
| *base = hdr->VirtualAddress; |
| } |
| } |
| return offset; |
| } |
| |
| /* Calls DigestFunction e bytes at offset offset from the file mapped at map. |
| * Returns the return value of DigestFunction, or FALSE if the data is not available. |
| */ |
| static BOOL IMAGEHLP_ReportSectionFromOffset( DWORD offset, DWORD size, |
| BYTE *map, DWORD fileSize, DIGEST_FUNCTION DigestFunction, DIGEST_HANDLE DigestHandle ) |
| { |
| if( offset + size > fileSize ) |
| { |
| SetLastError(ERROR_INVALID_PARAMETER); |
| return FALSE; |
| } |
| return DigestFunction( DigestHandle, map + offset, size ); |
| } |
| |
| /* Finds the section named section among the IMAGE_SECTION_HEADERs in |
| * section_headers and calls DigestFunction for this section. Returns |
| * the return value from DigestFunction, or FALSE if the data could not be read. |
| */ |
| static BOOL IMAGEHLP_ReportSection( IMAGE_SECTION_HEADER *section_headers, |
| DWORD num_sections, LPCSTR section, BYTE *map, DWORD fileSize, |
| DIGEST_FUNCTION DigestFunction, DIGEST_HANDLE DigestHandle ) |
| { |
| DWORD offset, size = 0; |
| |
| offset = IMAGEHLP_GetSectionOffset( section_headers, num_sections, section, |
| &size, NULL ); |
| if( !offset ) |
| return FALSE; |
| return IMAGEHLP_ReportSectionFromOffset( offset, size, map, fileSize, |
| DigestFunction, DigestHandle ); |
| } |
| |
| /* Calls DigestFunction for all sections with the IMAGE_SCN_CNT_CODE flag set. |
| * Returns the return value from * DigestFunction, or FALSE if a section could not be read. |
| */ |
| static BOOL IMAGEHLP_ReportCodeSections( IMAGE_SECTION_HEADER *hdr, DWORD num_sections, |
| BYTE *map, DWORD fileSize, DIGEST_FUNCTION DigestFunction, DIGEST_HANDLE DigestHandle ) |
| { |
| DWORD i; |
| BOOL ret = TRUE; |
| |
| for( i = 0; ret && i < num_sections; i++, hdr++ ) |
| { |
| if( hdr->Characteristics & IMAGE_SCN_CNT_CODE ) |
| ret = IMAGEHLP_ReportSectionFromOffset( hdr->PointerToRawData, |
| hdr->SizeOfRawData, map, fileSize, DigestFunction, DigestHandle ); |
| } |
| return ret; |
| } |
| |
| /* Reports the import section from the file FileHandle. If |
| * CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO is set in DigestLevel, reports the entire |
| * import section. |
| * FIXME: if it's not set, the function currently fails. |
| */ |
| static BOOL IMAGEHLP_ReportImportSection( IMAGE_SECTION_HEADER *hdr, |
| DWORD num_sections, BYTE *map, DWORD fileSize, DWORD DigestLevel, |
| DIGEST_FUNCTION DigestFunction, DIGEST_HANDLE DigestHandle ) |
| { |
| BOOL ret = FALSE; |
| DWORD offset, size, base; |
| |
| /* Get import data */ |
| offset = IMAGEHLP_GetSectionOffset( hdr, num_sections, ".idata", &size, |
| &base ); |
| if( !offset ) |
| return FALSE; |
| |
| /* If CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO is set, the entire |
| * section is reported. Otherwise, the debug info section is |
| * decoded and reported piecemeal. See tests. However, I haven't been |
| * able to figure out how the native implementation decides which values |
| * to report. Either it's buggy or my understanding is flawed. |
| */ |
| if( DigestLevel & CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO ) |
| ret = IMAGEHLP_ReportSectionFromOffset( offset, size, map, fileSize, |
| DigestFunction, DigestHandle ); |
| else |
| { |
| FIXME("not supported except for CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO\n"); |
| SetLastError(ERROR_INVALID_PARAMETER); |
| ret = FALSE; |
| } |
| |
| return ret; |
| } |
| |
| /*********************************************************************** |
| * ImageGetDigestStream (IMAGEHLP.@) |
| * |
| * Gets a stream of bytes from a PE file over which a hash might be computed to |
| * verify that the image has not changed. Useful for creating a certificate to |
| * be added to the file with ImageAddCertificate. |
| * |
| * PARAMS |
| * FileHandle [In] File for which to return a stream. |
| * DigestLevel [In] Flags to control which portions of the file to return. |
| * 0 is allowed, as is any combination of: |
| * CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO: reports the entire |
| * import section rather than selected portions of it. |
| * CERT_PE_IMAGE_DIGEST_DEBUG_INFO: reports the debug section. |
| * CERT_PE_IMAGE_DIGEST_RESOURCES: reports the resources |
| section. |
| * DigestFunction [In] Callback function. |
| * DigestHandle [In] Handle passed as first parameter to DigestFunction. |
| * |
| * RETURNS |
| * TRUE if successful. |
| * FALSE if unsuccessful. GetLastError returns more about the error. |
| * |
| * NOTES |
| * Only supports 32-bit PE files, not tested with any other format. |
| * Reports data in the following order: |
| * 1. The file headers are reported first |
| * 2. Any code sections are reported next. |
| * 3. The data (".data" and ".rdata") sections are reported next. |
| * 4. The import section is reported next. |
| * 5. If CERT_PE_IMAGE_DIGEST_DEBUG_INFO is set in DigestLevel, the debug section is |
| * reported next. |
| * 6. If CERT_PE_IMAGE_DIGEST_RESOURCES is set in DigestLevel, the resources section |
| * is reported next. |
| * |
| * BUGS |
| * CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO must be specified, returns an error if not. |
| */ |
| BOOL WINAPI ImageGetDigestStream( |
| HANDLE FileHandle, DWORD DigestLevel, |
| DIGEST_FUNCTION DigestFunction, DIGEST_HANDLE DigestHandle) |
| { |
| DWORD error = 0; |
| BOOL ret = FALSE; |
| DWORD offset, size, num_sections, fileSize; |
| HANDLE hMap = INVALID_HANDLE_VALUE; |
| BYTE *map = NULL; |
| IMAGE_DOS_HEADER *dos_hdr; |
| IMAGE_NT_HEADERS *nt_hdr; |
| IMAGE_SECTION_HEADER *section_headers; |
| |
| TRACE("(%p, %d, %p, %p)\n", FileHandle, DigestLevel, DigestFunction, |
| DigestHandle); |
| |
| /* Get the file size */ |
| if( !FileHandle ) |
| goto invalid_parameter; |
| fileSize = GetFileSize( FileHandle, NULL ); |
| if(fileSize == INVALID_FILE_SIZE ) |
| goto invalid_parameter; |
| |
| /* map file */ |
| hMap = CreateFileMappingW( FileHandle, NULL, PAGE_READONLY, 0, 0, NULL ); |
| if( hMap == INVALID_HANDLE_VALUE ) |
| goto invalid_parameter; |
| map = MapViewOfFile( hMap, FILE_MAP_COPY, 0, 0, 0 ); |
| if( !map ) |
| goto invalid_parameter; |
| |
| /* Read the file header */ |
| if( fileSize < sizeof(IMAGE_DOS_HEADER) ) |
| goto invalid_parameter; |
| dos_hdr = (IMAGE_DOS_HEADER *)map; |
| |
| if( dos_hdr->e_magic != IMAGE_DOS_SIGNATURE ) |
| goto invalid_parameter; |
| offset = dos_hdr->e_lfanew; |
| if( !offset || offset > fileSize ) |
| goto invalid_parameter; |
| ret = DigestFunction( DigestHandle, map, offset ); |
| if( !ret ) |
| goto end; |
| |
| /* Read the NT header */ |
| if( offset + sizeof(IMAGE_NT_HEADERS) > fileSize ) |
| goto invalid_parameter; |
| nt_hdr = (IMAGE_NT_HEADERS *)(map + offset); |
| if( nt_hdr->Signature != IMAGE_NT_SIGNATURE ) |
| goto invalid_parameter; |
| /* It's clear why the checksum is cleared, but why only these size headers? |
| */ |
| nt_hdr->OptionalHeader.SizeOfInitializedData = 0; |
| nt_hdr->OptionalHeader.SizeOfImage = 0; |
| nt_hdr->OptionalHeader.CheckSum = 0; |
| size = sizeof(nt_hdr->Signature) + sizeof(nt_hdr->FileHeader) + |
| nt_hdr->FileHeader.SizeOfOptionalHeader; |
| ret = DigestFunction( DigestHandle, map + offset, size ); |
| if( !ret ) |
| goto end; |
| |
| /* Read the section headers */ |
| offset += size; |
| num_sections = nt_hdr->FileHeader.NumberOfSections; |
| size = num_sections * sizeof(IMAGE_SECTION_HEADER); |
| if( offset + size > fileSize ) |
| goto invalid_parameter; |
| ret = DigestFunction( DigestHandle, map + offset, size ); |
| if( !ret ) |
| goto end; |
| |
| section_headers = (IMAGE_SECTION_HEADER *)(map + offset); |
| IMAGEHLP_ReportCodeSections( section_headers, num_sections, |
| map, fileSize, DigestFunction, DigestHandle ); |
| IMAGEHLP_ReportSection( section_headers, num_sections, ".data", |
| map, fileSize, DigestFunction, DigestHandle ); |
| IMAGEHLP_ReportSection( section_headers, num_sections, ".rdata", |
| map, fileSize, DigestFunction, DigestHandle ); |
| IMAGEHLP_ReportImportSection( section_headers, num_sections, |
| map, fileSize, DigestLevel, DigestFunction, DigestHandle ); |
| if( DigestLevel & CERT_PE_IMAGE_DIGEST_DEBUG_INFO ) |
| IMAGEHLP_ReportSection( section_headers, num_sections, ".debug", |
| map, fileSize, DigestFunction, DigestHandle ); |
| if( DigestLevel & CERT_PE_IMAGE_DIGEST_RESOURCES ) |
| IMAGEHLP_ReportSection( section_headers, num_sections, ".rsrc", |
| map, fileSize, DigestFunction, DigestHandle ); |
| |
| end: |
| if( map ) |
| UnmapViewOfFile( map ); |
| if( hMap != INVALID_HANDLE_VALUE ) |
| CloseHandle( hMap ); |
| if( error ) |
| SetLastError(error); |
| return ret; |
| |
| invalid_parameter: |
| error = ERROR_INVALID_PARAMETER; |
| goto end; |
| } |
| |
| /*********************************************************************** |
| * ImageRemoveCertificate (IMAGEHLP.@) |
| */ |
| BOOL WINAPI ImageRemoveCertificate(HANDLE FileHandle, DWORD Index) |
| { |
| DWORD size = 0, count = 0, sd_VirtualAddr = 0, offset = 0; |
| DWORD data_size = 0, cert_size = 0, cert_size_padded = 0, ret = 0; |
| LPVOID cert_data; |
| BOOL r; |
| |
| TRACE("(%p, %d)\n", FileHandle, Index); |
| |
| r = ImageEnumerateCertificates(FileHandle, CERT_SECTION_TYPE_ANY, &count, NULL, 0); |
| |
| if ((!r) || (count == 0)) |
| return FALSE; |
| |
| if ((!IMAGEHLP_GetSecurityDirOffset(FileHandle, &sd_VirtualAddr, &size)) || |
| (!IMAGEHLP_GetCertificateOffset(FileHandle, Index, &offset, &cert_size))) |
| return FALSE; |
| |
| /* Ignore any padding we have, too */ |
| if (cert_size % 8) |
| cert_size_padded = cert_size + (8 - (cert_size % 8)); |
| else |
| cert_size_padded = cert_size; |
| |
| data_size = size - (offset - sd_VirtualAddr) - cert_size_padded; |
| |
| if (data_size == 0) |
| { |
| ret = SetFilePointer(FileHandle, sd_VirtualAddr, NULL, FILE_BEGIN); |
| |
| if (ret == INVALID_SET_FILE_POINTER) |
| return FALSE; |
| } |
| else |
| { |
| cert_data = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, data_size); |
| |
| if (!cert_data) |
| return FALSE; |
| |
| ret = SetFilePointer(FileHandle, offset + cert_size_padded, NULL, FILE_BEGIN); |
| |
| if (ret == INVALID_SET_FILE_POINTER) |
| goto error; |
| |
| /* Read any subsequent certificates */ |
| r = ReadFile(FileHandle, cert_data, data_size, &count, NULL); |
| |
| if ((!r) || (count != data_size)) |
| goto error; |
| |
| SetFilePointer(FileHandle, offset, NULL, FILE_BEGIN); |
| |
| /* Write them one index back */ |
| r = WriteFile(FileHandle, cert_data, data_size, &count, NULL); |
| |
| if ((!r) || (count != data_size)) |
| goto error; |
| |
| HeapFree(GetProcessHeap(), 0, cert_data); |
| } |
| |
| /* If security directory is at end of file, trim the file */ |
| if (GetFileSize(FileHandle, NULL) == sd_VirtualAddr + size) |
| SetEndOfFile(FileHandle); |
| |
| if (count == 1) |
| r = IMAGEHLP_SetSecurityDirOffset(FileHandle, 0, 0); |
| else |
| r = IMAGEHLP_SetSecurityDirOffset(FileHandle, sd_VirtualAddr, size - cert_size_padded); |
| |
| if (!r) |
| return FALSE; |
| |
| if (!IMAGEHLP_RecalculateChecksum(FileHandle)) |
| return FALSE; |
| |
| return TRUE; |
| |
| error: |
| HeapFree(GetProcessHeap(), 0, cert_data); |
| return FALSE; |
| } |
