@isopodlabs/binary_libs 0.1.1 → 0.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/src/pe.ts DELETED
@@ -1,506 +0,0 @@
1
- import * as binary from '@isopodlabs/binary';
2
- import * as path from 'path';
3
-
4
- class MyDate extends Date {
5
- constructor(x: number) { super(x * 1000); }
6
- valueOf() { return this.getTime() / 1000; }
7
- toString() { return super.toString(); }
8
- }
9
-
10
- const uint16 = binary.UINT16_LE;
11
- const uint32 = binary.UINT32_LE;
12
- const uint64 = binary.UINT64_LE;
13
-
14
- const TIMEDATE = binary.as(uint32, MyDate);
15
-
16
- //-----------------------------------------------------------------------------
17
- // COFF
18
- //-----------------------------------------------------------------------------
19
-
20
- const DOS_HEADER = {
21
- magic: uint16,
22
- cblp: uint16,
23
- cp: uint16,
24
- crlc: uint16,
25
- cparhdr: uint16,
26
- minalloc: uint16,
27
- maxalloc: binary.asHex(uint16),
28
- ss: uint16,
29
- sp: uint16,
30
- csum: uint16,
31
- ip: uint16,
32
- cs: uint16,
33
- lfarlc: uint16,
34
- ovno: uint16,
35
- };
36
-
37
- const EXE_HEADER = {
38
- res: binary.ArrayType(4, uint16),
39
- oemid: uint16,
40
- oeminfo: uint16,
41
- res2: binary.ArrayType(10, uint16),
42
- lfanew: binary.INT32_LE,
43
- };
44
-
45
- //-----------------------------------------------------------------------------
46
- // PE
47
- //-----------------------------------------------------------------------------
48
-
49
- export class pe_stream extends binary.stream {
50
- constructor(public pe: PE, data: Uint8Array) {
51
- super(data);
52
- }
53
- get_rva() { return this.pe.GetDataRVA(uint32.get(this))?.data; }
54
- }
55
-
56
- const RVA_STRING = {
57
- get(s: pe_stream) { return binary.utils.decodeTextTo0(s.get_rva(), 'utf8'); },
58
- put(_s: pe_stream) {}
59
- };
60
- const RVA_ARRAY16 = {
61
- get(s: pe_stream) { return binary.utils.to16(s.get_rva()); },
62
- put(_s: pe_stream) {}
63
- };
64
- const RVA_ARRAY32 = {
65
- get(s: pe_stream) { return binary.utils.to32(s.get_rva()); },
66
- put(_s: pe_stream) {}
67
- };
68
- const RVA_ARRAY64 = {
69
- get(s: pe_stream) { return binary.utils.to64(s.get_rva()); },
70
- put(_s: pe_stream) {}
71
- };
72
-
73
- const FILE_HEADER = {
74
- Machine: uint16,
75
- NumberOfSections: uint16,
76
- TimeDateStamp: uint32,
77
- PointerToSymbolTable: uint32,
78
- NumberOfSymbols: uint32,
79
- SizeOfOptionalHeader: uint16,
80
- Characteristics: uint16,
81
- };
82
-
83
- const SECTION_CHARACTERISTICS = {
84
- // 0x00000000,
85
- // 0x00000001,
86
- // 0x00000002,
87
- // 0x00000004,
88
- TYPE_NO_PAD: 0x00000008,
89
- // 0x00000010,
90
- CNT_CODE: 0x00000020,
91
- CNT_INITIALIZED_DATA: 0x00000040,
92
- CNT_UNINITIALIZED_DATA: 0x00000080,
93
- LNK_OTHER: 0x00000100,
94
- LNK_INFO: 0x00000200,
95
- // 0x00000400,
96
- LNK_REMOVE: 0x00000800,
97
- LNK_COMDAT: 0x00001000,
98
- GPREL: 0x00008000,
99
- // MEM_PURGEABLE 0x00020000,
100
- MEM_16BIT: 0x00020000,
101
- MEM_LOCKED: 0x00040000,
102
- MEM_PRELOAD: 0x00080000,
103
- ALIGN: 0x00f00000,
104
- //ALIGN_1BYTES 0x00100000,
105
- //ALIGN_2BYTES 0x00200000,
106
- //ALIGN_4BYTES 0x00300000,
107
- //ALIGN_8BYTES 0x00400000,
108
- //ALIGN_16BYTES 0x00500000,
109
- //ALIGN_32BYTES 0x00600000,
110
- //ALIGN_64BYTES 0x00700000,
111
- //ALIGN_128BYTES 0x00800000,
112
- //ALIGN_256BYTES 0x00900000,
113
- //ALIGN_512BYTES 0x00A00000,
114
- //ALIGN_1024BYTES 0x00B00000,
115
- //ALIGN_2048BYTES 0x00C00000,
116
- //ALIGN_4096BYTES 0x00D00000,
117
- //ALIGN_8192BYTES 0x00E00000,
118
- LNK_NRELOC_OVFL: 0x01000000,
119
- MEM_DISCARDABLE: 0x02000000,
120
- MEM_NOT_CACHED: 0x04000000,
121
- MEM_NOT_PAGED: 0x08000000,
122
- MEM_SHARED: 0x10000000,
123
- MEM_EXECUTE: 0x20000000,
124
- MEM_READ: 0x40000000,
125
- MEM_WRITE: 0x80000000,
126
- } as const;
127
-
128
- class Section extends binary.ReadClass({
129
- Name: binary.StringType(8),
130
- VirtualSize: uint32,
131
- VirtualAddress: binary.asHex(uint32),
132
- SizeOfRawData: uint32,
133
- PointerToRawData: binary.asHex(uint32),
134
- PointerToRelocations: binary.asHex(uint32),
135
- PointerToLinenumbers: binary.asHex(uint32),
136
- NumberOfRelocations: binary.INT16_LE,
137
- NumberOfLinenumbers: binary.INT16_LE,
138
- Characteristics: binary.asFlags(uint32, SECTION_CHARACTERISTICS)
139
- }) {
140
- data?: binary.MappedMemory;
141
- constructor(r: binary.stream) {
142
- super(r);
143
- try {
144
- this.data = new binary.MappedMemory(r.buffer_at(+this.PointerToRawData, this.SizeOfRawData), +this.VirtualAddress, this.flags);
145
- } catch (e) {
146
- console.log(e);
147
- }
148
- }
149
- get flags() {
150
- return binary.MEM.RELATIVE
151
- | (this.Characteristics.MEM_READ ? binary.MEM.READ : 0)
152
- | (this.Characteristics.MEM_WRITE ? binary.MEM.WRITE : 0)
153
- | (this.Characteristics.MEM_EXECUTE ? binary.MEM.EXECUTE : 0);
154
- }
155
- }
156
-
157
- interface DirectoryInfo {
158
- read?: (pe: PE, data: binary.MappedMemory) => any;
159
- }
160
-
161
- export const DIRECTORIES : Record<string, DirectoryInfo> = {
162
- EXPORT: {read: (pe, data) => ReadExports(new pe_stream(pe, data.data)) },
163
- IMPORT: {read: (pe, data) => ReadImports(new pe_stream(pe, data.data)) },
164
- RESOURCE: {read: (pe, data) => ReadResourceDirectory(new binary.stream(data.data), data)},
165
- EXCEPTION: {}, // Exception Directory
166
- SECURITY: {}, // Security Directory
167
- BASERELOC: {}, // Base Relocation Table
168
- DEBUG_DIR: {}, // Debug Directory
169
- ARCHITECTURE: {}, // Architecture Specific Data
170
- GLOBALPTR: {}, // RVA of GP
171
- TLS: {},
172
- LOAD_CONFIG: {}, // Load Configuration Directory
173
- BOUND_IMPORT: {}, // Bound Import Directory in headers
174
- IAT: {}, // Import Address Table
175
- DELAY_IMPORT: {},
176
- CLR_DESCRIPTOR: {},
177
- };
178
-
179
- export const DATA_DIRECTORY = {
180
- VirtualAddress: uint32,
181
- Size: uint32,
182
- };
183
-
184
- type Directory = binary.ReadType<typeof DATA_DIRECTORY>;
185
-
186
- const MAGIC = {
187
- NT32: 0x10b,
188
- NT64: 0x20b,
189
- ROM: 0x107,
190
- OBJ: 0x104, // object files, eg as output
191
- // DEMAND: 0x10b, // demand load format, eg normal ld output
192
- TARGET: 0x101, // target shlib
193
- HOST: 0x123, // host shlib
194
- };
195
-
196
- const DLLCHARACTERISTICS = {
197
- DYNAMIC_BASE: 0x0040, // DLL can be relocated at load time (ASLR)
198
- FORCE_INTEGRITY: 0x0080, // Code integrity checks are enforced
199
- NX_COMPAT: 0x0100, // Image is NX compatible (DEP)
200
- NO_ISOLATION: 0x0200, // Isolation aware, but do not isolate the image
201
- NO_SEH: 0x0400, // Does not use structured exception handling
202
- NO_BIND: 0x0800, // Do not bind the image
203
- WDM_DRIVER: 0x2000, // Driver uses WDM model
204
- TERMINAL_SERVER_AWARE: 0x8000, // Terminal Server aware
205
- };
206
-
207
- const OPTIONAL_HEADER = {
208
- Magic: binary.asEnum(uint16, MAGIC),
209
- MajorLinkerVersion: binary.UINT8,
210
- MinorLinkerVersion: binary.UINT8,
211
- SizeOfCode: uint32,
212
- SizeOfInitializedData: uint32,
213
- SizeOfUninitializedData: uint32,
214
- AddressOfEntryPoint: binary.asHex(uint32),
215
- BaseOfCode: binary.asHex(uint32),
216
- };
217
-
218
- const OPTIONAL_HEADER32 = {
219
- BaseOfData: binary.asHex(uint32),
220
- ImageBase: binary.asHex(uint32),
221
- SectionAlignment: uint32,
222
- FileAlignment: uint32,
223
- MajorOperatingSystemVersion:uint16,
224
- MinorOperatingSystemVersion:uint16,
225
- MajorImageVersion: uint16,
226
- MinorImageVersion: uint16,
227
- MajorSubsystemVersion: uint16,
228
- MinorSubsystemVersion: uint16,
229
- Win32VersionValue: uint32,
230
- SizeOfImage: uint32,
231
- SizeOfHeaders: uint32,
232
- CheckSum: uint32,
233
- Subsystem: uint16,
234
- DllCharacteristics: binary.asFlags(uint16, DLLCHARACTERISTICS),
235
- SizeOfStackReserve: uint32,
236
- SizeOfStackCommit: uint32,
237
- SizeOfHeapReserve: uint32,
238
- SizeOfHeapCommit: uint32,
239
- LoaderFlags: uint32,
240
- DataDirectory: binary.objectWithNames(binary.ArrayType(uint32, DATA_DIRECTORY), binary.names(Object.keys(DIRECTORIES))),
241
- };
242
-
243
- const OPTIONAL_HEADER64 = {
244
- ImageBase: binary.asHex(uint64),
245
- SectionAlignment: uint32,
246
- FileAlignment: uint32,
247
- MajorOperatingSystemVersion:uint16,
248
- MinorOperatingSystemVersion:uint16,
249
- MajorImageVersion: uint16,
250
- MinorImageVersion: uint16,
251
- MajorSubsystemVersion: uint16,
252
- MinorSubsystemVersion: uint16,
253
- Win32VersionValue: uint32,
254
- SizeOfImage: uint32,
255
- SizeOfHeaders: uint32,
256
- CheckSum: uint32,
257
- Subsystem: uint16,
258
- DllCharacteristics: binary.asFlags(uint16, DLLCHARACTERISTICS),
259
- SizeOfStackReserve: uint64,
260
- SizeOfStackCommit: uint64,
261
- SizeOfHeapReserve: uint64,
262
- SizeOfHeapCommit: uint64,
263
- LoaderFlags: uint32,
264
- DataDirectory: binary.objectWithNames(binary.ArrayType(uint32, DATA_DIRECTORY), binary.names(Object.keys(DIRECTORIES))),
265
- };
266
-
267
- export class PE {
268
- header: binary.ReadType<typeof DOS_HEADER> & binary.ReadType<typeof EXE_HEADER>;
269
- opt?: binary.ReadType<typeof OPTIONAL_HEADER> & (binary.ReadType<typeof OPTIONAL_HEADER32> | binary.ReadType<typeof OPTIONAL_HEADER64>);
270
- sections: Section[];
271
-
272
- static check(data: Uint8Array): boolean {
273
- return uint16.get(new binary.stream(data)) === binary.utils.stringCode("MZ");
274
- }
275
-
276
- constructor(private data: Uint8Array) {
277
- const file = new binary.stream(data);
278
- this.header = binary.read(file, {...DOS_HEADER, ...EXE_HEADER});
279
-
280
- file.seek(this.header.lfanew);
281
- if (uint32.get(file) == binary.utils.stringCode("PE\0\0")) {
282
- const h = binary.read(file, FILE_HEADER);
283
-
284
- if (h.SizeOfOptionalHeader) {
285
- const opt = new binary.stream(file.read_buffer(h.SizeOfOptionalHeader));
286
- const opt1 = binary.read(opt, OPTIONAL_HEADER);
287
- if (opt1.Magic == 'NT32')
288
- this.opt = binary.read_more(opt, OPTIONAL_HEADER32, opt1);
289
- else if (opt1.Magic == 'NT64')
290
- this.opt = binary.read_more(opt, OPTIONAL_HEADER64, opt1);
291
- }
292
-
293
- this.sections = Array.from({length: h.NumberOfSections}, () => new Section(file));
294
- } else {
295
- this.sections = [];
296
- }
297
- }
298
-
299
- get directories() {
300
- return this.opt?.DataDirectory;
301
- }
302
-
303
- FindSectionRVA(rva: number) {
304
- for (const i of this.sections) {
305
- if (rva >= +i.VirtualAddress && rva < +i.VirtualAddress + i.SizeOfRawData)
306
- return i;
307
- }
308
- }
309
-
310
- FindSectionRaw(addr: number) {
311
- for (const i of this.sections) {
312
- if (addr >= +i.PointerToRawData && addr < +i.PointerToRawData + i.SizeOfRawData)
313
- return i;
314
- }
315
- }
316
-
317
- GetDataRVA(rva: number, size?: number) {
318
- const sect = this.FindSectionRVA(rva);
319
- if (sect && sect.data)
320
- return sect.data.at(rva, size);
321
- }
322
- GetDataRaw(addr: number, size: number) {
323
- const sect = this.FindSectionRaw(addr);
324
- if (sect && sect.data) {
325
- const offset = addr - +sect.PointerToRawData;
326
- return sect.data.data.subarray(offset, offset + size);
327
- }
328
- }
329
- GetDataDir(dir: Directory) {
330
- if (dir.Size)
331
- return this.GetDataRVA(dir.VirtualAddress, dir.Size);
332
- }
333
-
334
- ReadDirectory(name: string) {
335
- const dir = this.opt?.DataDirectory[name];
336
- if (dir?.Size) {
337
- const data = this.GetDataDir(dir);
338
- const info = DIRECTORIES[name];
339
- if (data && info?.read)
340
- return info.read(this, data);
341
- return data;
342
- }
343
- }
344
- }
345
-
346
-
347
- //-----------------------------------------------------------------------------
348
- // exports
349
- //-----------------------------------------------------------------------------
350
-
351
- const EXPORT_DIRECTORY = {
352
- ExportFlags: uint32, // Reserved, must be 0.
353
- TimeDateStamp: TIMEDATE, // The time and date that the export data was created.
354
- MajorVersion: binary.asHex(uint16), // The major version number. The major and minor version numbers can be set by the user.
355
- MinorVersion: binary.asHex(uint16), // The minor version number.
356
- DLLName: RVA_STRING, // The address of the ASCII string that contains the name of the DLL. This address is relative to the image base.
357
- OrdinalBase: uint32, // The starting ordinal number for exports in this image. This field specifies the starting ordinal number for the export address table. It is usually set to 1.
358
- NumberEntries: uint32, // The number of entries in the export address table.
359
- NumberNames: uint32, // The number of entries in the name pointer table. This is also the number of entries in the ordinal table.
360
- FunctionTable: RVA_ARRAY32, // RVA of functions
361
- NameTable: RVA_ARRAY32, // RVA of names
362
- OrdinalTable: RVA_ARRAY16, // RVA from base of image
363
- };
364
-
365
- interface ExportEntry {
366
- ordinal: number;
367
- name: string;
368
- address: number;
369
- }
370
-
371
- export function ReadExports(file: pe_stream) {
372
- const dir = binary.read(file, EXPORT_DIRECTORY);
373
- const addresses = dir.FunctionTable!;
374
- const names = dir.NameTable;
375
- const ordinals = dir.OrdinalTable;
376
-
377
- const result: ExportEntry[] = [];
378
- for (let i = 0; i < dir.NumberEntries; i++) {
379
- const sect = file.pe.FindSectionRVA(addresses[i]);
380
- if (sect) {
381
- const ordinal = (ordinals && i < dir.NumberNames ? ordinals[i] : i) + dir.OrdinalBase;
382
- const name = names && i < dir.NumberNames ? binary.utils.decodeTextTo0(file.pe.GetDataRVA(names[i])?.data, 'utf8') : '';
383
- result.push({ordinal, name, address: addresses[i]});
384
- }
385
- }
386
- const sorted = result.sort((a, b)=> a.address - b.address);
387
- return sorted.map((v, i) => {
388
- let j = i;
389
- while (++j < sorted.length && sorted[j].address == v.address);
390
- return [v.ordinal, v.name, file.pe.GetDataRVA(v.address, j < sorted.length ? sorted[j].address - v.address : undefined)];
391
- });
392
- }
393
-
394
- //-----------------------------------------------------------------------------
395
- // imports
396
- //-----------------------------------------------------------------------------
397
-
398
- export class DLLImports extends Array {}
399
-
400
- const RVA_ITA64 = {
401
- get(s: pe_stream) {
402
- const r = binary.utils.to64(s.get_rva());
403
- if (r) {
404
- const result = Array.from(r.subarray(0, r.indexOf(0n)), i =>
405
- i >> 63n
406
- ? `ordinal_${i - (1n << 63n)}`
407
- : binary.utils.decodeTextTo0(s.pe.GetDataRVA(Number(i))?.data.subarray(2), 'utf8')
408
- );
409
- Object.setPrototypeOf(result, DLLImports.prototype);
410
- return result;
411
- }
412
- },
413
- put(_s: pe_stream) {}
414
- };
415
-
416
- const IMPORT_DESCRIPTOR = {
417
- Characteristics: uint32, // 0 for terminating null import descriptor
418
- TimeDateStamp: TIMEDATE, // 0 if not bound, -1 if bound, and real date\time stamp in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND) // O.W. date/time stamp of DLL bound to (Old BIND)
419
- ForwarderChain: uint32, // -1 if no forwarders
420
- DllName: RVA_STRING,//uint32,
421
- FirstThunk: RVA_ITA64,//uint32, // RVA to IAT (if bound this IAT has actual addresses)
422
- };
423
-
424
- export function ReadImports(file: pe_stream) {
425
- const result: [string, any][] = [];
426
- while (file.remaining()) {
427
- const r = binary.read(file, IMPORT_DESCRIPTOR);
428
- if (!r.Characteristics)
429
- break;
430
- result.push([r.DllName, r.FirstThunk]);
431
- }
432
- return result;
433
- }
434
-
435
- //-----------------------------------------------------------------------------
436
- // resources
437
- //-----------------------------------------------------------------------------
438
-
439
- class RESOURCE_DATA_ENTRY extends binary.ReadClass({
440
- OffsetToData: uint32,
441
- Size: uint32,
442
- CodePage: uint32,
443
- Reserved: uint32,
444
- }) {
445
- data: Uint8Array;
446
- constructor(file: binary.stream, data: binary.MappedMemory) {
447
- super(file);
448
- this.data = data.slice(this.OffsetToData, this.OffsetToData + this.Size).data;
449
- }
450
- }
451
-
452
- const RESOURCE_DIRECTORY = {
453
- Characteristics: uint32,
454
- TimeDateStamp: uint32,
455
- MajorVersion: uint16,
456
- MinorVersion: uint16,
457
- NumberOfNamedEntries: uint16,
458
- NumberOfIdEntries: uint16,
459
- entries: binary.ArrayType(obj=> obj.NumberOfNamedEntries + obj.NumberOfIdEntries, {
460
- u0: uint32,
461
- u1: uint32,
462
- })
463
- };
464
-
465
- const IRT = {
466
- 0: 'NONE',
467
- 1: 'CURSOR',
468
- 2: 'BITMAP',
469
- 3: 'ICON',
470
- 4: 'MENU',
471
- 5: 'DIALOG',
472
- 6: 'STRING',
473
- 7: 'FONTDIR',
474
- 8: 'FONT',
475
- 9: 'ACCELERATOR',
476
- 10: 'RCDATA',
477
- 11: 'MESSAGETABLE',
478
- 12: 'GROUP_CURSOR',
479
- 14: 'GROUP_ICON',
480
- 16: 'VERSION',
481
- 17: 'DLGINCLUDE',
482
- 19: 'PLUGPLAY',
483
- 20: 'VXD',
484
- 21: 'ANICURSOR',
485
- 22: 'ANIICON',
486
- 23: 'HTML',
487
- 24: 'MANIFEST',
488
- 241:'TOOLBAR',
489
- } as const;
490
-
491
- export function ReadResourceDirectory(file: binary.stream, data: binary.MappedMemory, type = 0) {
492
- const dir = binary.read(file, RESOURCE_DIRECTORY);
493
- const id_type = binary.StringType(uint16, 'utf16le');
494
- const topbit = 0x80000000;
495
- const result : Record<string, any> = {};
496
-
497
- for (const i of dir.entries) {
498
- const id = i.u0 & topbit ? id_type.get(file.seek(i.u0 & ~topbit)) : !type ? IRT[i.u0 as keyof typeof IRT] : i.u0;
499
-
500
- file.seek(i.u1 & ~topbit);
501
- result[id] = i.u1 & topbit
502
- ? ReadResourceDirectory(file, data, type || i.u0)
503
- : new RESOURCE_DATA_ENTRY(file, data);
504
- }
505
- return result;
506
- }