@isopodlabs/binary_libs 0.1.1 → 0.1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/CompoundDocument.d.ts +129 -0
- package/dist/CompoundDocument.js +300 -0
- package/dist/arch.d.ts +26 -0
- package/dist/arch.js +96 -0
- package/dist/clr.d.ts +286 -0
- package/dist/clr.js +658 -0
- package/dist/elf.d.ts +112 -0
- package/dist/elf.js +778 -0
- package/dist/mach.d.ts +394 -0
- package/dist/mach.js +1027 -0
- package/dist/pe.d.ts +156 -0
- package/dist/pe.js +484 -0
- package/package.json +5 -1
- package/.gitmodules +0 -3
- package/.vscode/launch.json +0 -16
- package/.vscode/settings.json +0 -3
- package/.vscode/tasks.json +0 -39
- package/eslint.config.mjs +0 -32
- package/src/CompoundDocument.ts +0 -314
- package/src/arch.ts +0 -79
- package/src/clr.ts +0 -646
- package/src/elf.ts +0 -802
- package/src/mach.ts +0 -1140
- package/src/pe.ts +0 -506
- package/transform.ts +0 -369
- package/tsconfig.json +0 -27
- package/tsconfig.tsbuildinfo +0 -1
package/src/pe.ts
DELETED
|
@@ -1,506 +0,0 @@
|
|
|
1
|
-
import * as binary from '@isopodlabs/binary';
|
|
2
|
-
import * as path from 'path';
|
|
3
|
-
|
|
4
|
-
class MyDate extends Date {
|
|
5
|
-
constructor(x: number) { super(x * 1000); }
|
|
6
|
-
valueOf() { return this.getTime() / 1000; }
|
|
7
|
-
toString() { return super.toString(); }
|
|
8
|
-
}
|
|
9
|
-
|
|
10
|
-
const uint16 = binary.UINT16_LE;
|
|
11
|
-
const uint32 = binary.UINT32_LE;
|
|
12
|
-
const uint64 = binary.UINT64_LE;
|
|
13
|
-
|
|
14
|
-
const TIMEDATE = binary.as(uint32, MyDate);
|
|
15
|
-
|
|
16
|
-
//-----------------------------------------------------------------------------
|
|
17
|
-
// COFF
|
|
18
|
-
//-----------------------------------------------------------------------------
|
|
19
|
-
|
|
20
|
-
const DOS_HEADER = {
|
|
21
|
-
magic: uint16,
|
|
22
|
-
cblp: uint16,
|
|
23
|
-
cp: uint16,
|
|
24
|
-
crlc: uint16,
|
|
25
|
-
cparhdr: uint16,
|
|
26
|
-
minalloc: uint16,
|
|
27
|
-
maxalloc: binary.asHex(uint16),
|
|
28
|
-
ss: uint16,
|
|
29
|
-
sp: uint16,
|
|
30
|
-
csum: uint16,
|
|
31
|
-
ip: uint16,
|
|
32
|
-
cs: uint16,
|
|
33
|
-
lfarlc: uint16,
|
|
34
|
-
ovno: uint16,
|
|
35
|
-
};
|
|
36
|
-
|
|
37
|
-
const EXE_HEADER = {
|
|
38
|
-
res: binary.ArrayType(4, uint16),
|
|
39
|
-
oemid: uint16,
|
|
40
|
-
oeminfo: uint16,
|
|
41
|
-
res2: binary.ArrayType(10, uint16),
|
|
42
|
-
lfanew: binary.INT32_LE,
|
|
43
|
-
};
|
|
44
|
-
|
|
45
|
-
//-----------------------------------------------------------------------------
|
|
46
|
-
// PE
|
|
47
|
-
//-----------------------------------------------------------------------------
|
|
48
|
-
|
|
49
|
-
export class pe_stream extends binary.stream {
|
|
50
|
-
constructor(public pe: PE, data: Uint8Array) {
|
|
51
|
-
super(data);
|
|
52
|
-
}
|
|
53
|
-
get_rva() { return this.pe.GetDataRVA(uint32.get(this))?.data; }
|
|
54
|
-
}
|
|
55
|
-
|
|
56
|
-
const RVA_STRING = {
|
|
57
|
-
get(s: pe_stream) { return binary.utils.decodeTextTo0(s.get_rva(), 'utf8'); },
|
|
58
|
-
put(_s: pe_stream) {}
|
|
59
|
-
};
|
|
60
|
-
const RVA_ARRAY16 = {
|
|
61
|
-
get(s: pe_stream) { return binary.utils.to16(s.get_rva()); },
|
|
62
|
-
put(_s: pe_stream) {}
|
|
63
|
-
};
|
|
64
|
-
const RVA_ARRAY32 = {
|
|
65
|
-
get(s: pe_stream) { return binary.utils.to32(s.get_rva()); },
|
|
66
|
-
put(_s: pe_stream) {}
|
|
67
|
-
};
|
|
68
|
-
const RVA_ARRAY64 = {
|
|
69
|
-
get(s: pe_stream) { return binary.utils.to64(s.get_rva()); },
|
|
70
|
-
put(_s: pe_stream) {}
|
|
71
|
-
};
|
|
72
|
-
|
|
73
|
-
const FILE_HEADER = {
|
|
74
|
-
Machine: uint16,
|
|
75
|
-
NumberOfSections: uint16,
|
|
76
|
-
TimeDateStamp: uint32,
|
|
77
|
-
PointerToSymbolTable: uint32,
|
|
78
|
-
NumberOfSymbols: uint32,
|
|
79
|
-
SizeOfOptionalHeader: uint16,
|
|
80
|
-
Characteristics: uint16,
|
|
81
|
-
};
|
|
82
|
-
|
|
83
|
-
const SECTION_CHARACTERISTICS = {
|
|
84
|
-
// 0x00000000,
|
|
85
|
-
// 0x00000001,
|
|
86
|
-
// 0x00000002,
|
|
87
|
-
// 0x00000004,
|
|
88
|
-
TYPE_NO_PAD: 0x00000008,
|
|
89
|
-
// 0x00000010,
|
|
90
|
-
CNT_CODE: 0x00000020,
|
|
91
|
-
CNT_INITIALIZED_DATA: 0x00000040,
|
|
92
|
-
CNT_UNINITIALIZED_DATA: 0x00000080,
|
|
93
|
-
LNK_OTHER: 0x00000100,
|
|
94
|
-
LNK_INFO: 0x00000200,
|
|
95
|
-
// 0x00000400,
|
|
96
|
-
LNK_REMOVE: 0x00000800,
|
|
97
|
-
LNK_COMDAT: 0x00001000,
|
|
98
|
-
GPREL: 0x00008000,
|
|
99
|
-
// MEM_PURGEABLE 0x00020000,
|
|
100
|
-
MEM_16BIT: 0x00020000,
|
|
101
|
-
MEM_LOCKED: 0x00040000,
|
|
102
|
-
MEM_PRELOAD: 0x00080000,
|
|
103
|
-
ALIGN: 0x00f00000,
|
|
104
|
-
//ALIGN_1BYTES 0x00100000,
|
|
105
|
-
//ALIGN_2BYTES 0x00200000,
|
|
106
|
-
//ALIGN_4BYTES 0x00300000,
|
|
107
|
-
//ALIGN_8BYTES 0x00400000,
|
|
108
|
-
//ALIGN_16BYTES 0x00500000,
|
|
109
|
-
//ALIGN_32BYTES 0x00600000,
|
|
110
|
-
//ALIGN_64BYTES 0x00700000,
|
|
111
|
-
//ALIGN_128BYTES 0x00800000,
|
|
112
|
-
//ALIGN_256BYTES 0x00900000,
|
|
113
|
-
//ALIGN_512BYTES 0x00A00000,
|
|
114
|
-
//ALIGN_1024BYTES 0x00B00000,
|
|
115
|
-
//ALIGN_2048BYTES 0x00C00000,
|
|
116
|
-
//ALIGN_4096BYTES 0x00D00000,
|
|
117
|
-
//ALIGN_8192BYTES 0x00E00000,
|
|
118
|
-
LNK_NRELOC_OVFL: 0x01000000,
|
|
119
|
-
MEM_DISCARDABLE: 0x02000000,
|
|
120
|
-
MEM_NOT_CACHED: 0x04000000,
|
|
121
|
-
MEM_NOT_PAGED: 0x08000000,
|
|
122
|
-
MEM_SHARED: 0x10000000,
|
|
123
|
-
MEM_EXECUTE: 0x20000000,
|
|
124
|
-
MEM_READ: 0x40000000,
|
|
125
|
-
MEM_WRITE: 0x80000000,
|
|
126
|
-
} as const;
|
|
127
|
-
|
|
128
|
-
class Section extends binary.ReadClass({
|
|
129
|
-
Name: binary.StringType(8),
|
|
130
|
-
VirtualSize: uint32,
|
|
131
|
-
VirtualAddress: binary.asHex(uint32),
|
|
132
|
-
SizeOfRawData: uint32,
|
|
133
|
-
PointerToRawData: binary.asHex(uint32),
|
|
134
|
-
PointerToRelocations: binary.asHex(uint32),
|
|
135
|
-
PointerToLinenumbers: binary.asHex(uint32),
|
|
136
|
-
NumberOfRelocations: binary.INT16_LE,
|
|
137
|
-
NumberOfLinenumbers: binary.INT16_LE,
|
|
138
|
-
Characteristics: binary.asFlags(uint32, SECTION_CHARACTERISTICS)
|
|
139
|
-
}) {
|
|
140
|
-
data?: binary.MappedMemory;
|
|
141
|
-
constructor(r: binary.stream) {
|
|
142
|
-
super(r);
|
|
143
|
-
try {
|
|
144
|
-
this.data = new binary.MappedMemory(r.buffer_at(+this.PointerToRawData, this.SizeOfRawData), +this.VirtualAddress, this.flags);
|
|
145
|
-
} catch (e) {
|
|
146
|
-
console.log(e);
|
|
147
|
-
}
|
|
148
|
-
}
|
|
149
|
-
get flags() {
|
|
150
|
-
return binary.MEM.RELATIVE
|
|
151
|
-
| (this.Characteristics.MEM_READ ? binary.MEM.READ : 0)
|
|
152
|
-
| (this.Characteristics.MEM_WRITE ? binary.MEM.WRITE : 0)
|
|
153
|
-
| (this.Characteristics.MEM_EXECUTE ? binary.MEM.EXECUTE : 0);
|
|
154
|
-
}
|
|
155
|
-
}
|
|
156
|
-
|
|
157
|
-
interface DirectoryInfo {
|
|
158
|
-
read?: (pe: PE, data: binary.MappedMemory) => any;
|
|
159
|
-
}
|
|
160
|
-
|
|
161
|
-
export const DIRECTORIES : Record<string, DirectoryInfo> = {
|
|
162
|
-
EXPORT: {read: (pe, data) => ReadExports(new pe_stream(pe, data.data)) },
|
|
163
|
-
IMPORT: {read: (pe, data) => ReadImports(new pe_stream(pe, data.data)) },
|
|
164
|
-
RESOURCE: {read: (pe, data) => ReadResourceDirectory(new binary.stream(data.data), data)},
|
|
165
|
-
EXCEPTION: {}, // Exception Directory
|
|
166
|
-
SECURITY: {}, // Security Directory
|
|
167
|
-
BASERELOC: {}, // Base Relocation Table
|
|
168
|
-
DEBUG_DIR: {}, // Debug Directory
|
|
169
|
-
ARCHITECTURE: {}, // Architecture Specific Data
|
|
170
|
-
GLOBALPTR: {}, // RVA of GP
|
|
171
|
-
TLS: {},
|
|
172
|
-
LOAD_CONFIG: {}, // Load Configuration Directory
|
|
173
|
-
BOUND_IMPORT: {}, // Bound Import Directory in headers
|
|
174
|
-
IAT: {}, // Import Address Table
|
|
175
|
-
DELAY_IMPORT: {},
|
|
176
|
-
CLR_DESCRIPTOR: {},
|
|
177
|
-
};
|
|
178
|
-
|
|
179
|
-
export const DATA_DIRECTORY = {
|
|
180
|
-
VirtualAddress: uint32,
|
|
181
|
-
Size: uint32,
|
|
182
|
-
};
|
|
183
|
-
|
|
184
|
-
type Directory = binary.ReadType<typeof DATA_DIRECTORY>;
|
|
185
|
-
|
|
186
|
-
const MAGIC = {
|
|
187
|
-
NT32: 0x10b,
|
|
188
|
-
NT64: 0x20b,
|
|
189
|
-
ROM: 0x107,
|
|
190
|
-
OBJ: 0x104, // object files, eg as output
|
|
191
|
-
// DEMAND: 0x10b, // demand load format, eg normal ld output
|
|
192
|
-
TARGET: 0x101, // target shlib
|
|
193
|
-
HOST: 0x123, // host shlib
|
|
194
|
-
};
|
|
195
|
-
|
|
196
|
-
const DLLCHARACTERISTICS = {
|
|
197
|
-
DYNAMIC_BASE: 0x0040, // DLL can be relocated at load time (ASLR)
|
|
198
|
-
FORCE_INTEGRITY: 0x0080, // Code integrity checks are enforced
|
|
199
|
-
NX_COMPAT: 0x0100, // Image is NX compatible (DEP)
|
|
200
|
-
NO_ISOLATION: 0x0200, // Isolation aware, but do not isolate the image
|
|
201
|
-
NO_SEH: 0x0400, // Does not use structured exception handling
|
|
202
|
-
NO_BIND: 0x0800, // Do not bind the image
|
|
203
|
-
WDM_DRIVER: 0x2000, // Driver uses WDM model
|
|
204
|
-
TERMINAL_SERVER_AWARE: 0x8000, // Terminal Server aware
|
|
205
|
-
};
|
|
206
|
-
|
|
207
|
-
const OPTIONAL_HEADER = {
|
|
208
|
-
Magic: binary.asEnum(uint16, MAGIC),
|
|
209
|
-
MajorLinkerVersion: binary.UINT8,
|
|
210
|
-
MinorLinkerVersion: binary.UINT8,
|
|
211
|
-
SizeOfCode: uint32,
|
|
212
|
-
SizeOfInitializedData: uint32,
|
|
213
|
-
SizeOfUninitializedData: uint32,
|
|
214
|
-
AddressOfEntryPoint: binary.asHex(uint32),
|
|
215
|
-
BaseOfCode: binary.asHex(uint32),
|
|
216
|
-
};
|
|
217
|
-
|
|
218
|
-
const OPTIONAL_HEADER32 = {
|
|
219
|
-
BaseOfData: binary.asHex(uint32),
|
|
220
|
-
ImageBase: binary.asHex(uint32),
|
|
221
|
-
SectionAlignment: uint32,
|
|
222
|
-
FileAlignment: uint32,
|
|
223
|
-
MajorOperatingSystemVersion:uint16,
|
|
224
|
-
MinorOperatingSystemVersion:uint16,
|
|
225
|
-
MajorImageVersion: uint16,
|
|
226
|
-
MinorImageVersion: uint16,
|
|
227
|
-
MajorSubsystemVersion: uint16,
|
|
228
|
-
MinorSubsystemVersion: uint16,
|
|
229
|
-
Win32VersionValue: uint32,
|
|
230
|
-
SizeOfImage: uint32,
|
|
231
|
-
SizeOfHeaders: uint32,
|
|
232
|
-
CheckSum: uint32,
|
|
233
|
-
Subsystem: uint16,
|
|
234
|
-
DllCharacteristics: binary.asFlags(uint16, DLLCHARACTERISTICS),
|
|
235
|
-
SizeOfStackReserve: uint32,
|
|
236
|
-
SizeOfStackCommit: uint32,
|
|
237
|
-
SizeOfHeapReserve: uint32,
|
|
238
|
-
SizeOfHeapCommit: uint32,
|
|
239
|
-
LoaderFlags: uint32,
|
|
240
|
-
DataDirectory: binary.objectWithNames(binary.ArrayType(uint32, DATA_DIRECTORY), binary.names(Object.keys(DIRECTORIES))),
|
|
241
|
-
};
|
|
242
|
-
|
|
243
|
-
const OPTIONAL_HEADER64 = {
|
|
244
|
-
ImageBase: binary.asHex(uint64),
|
|
245
|
-
SectionAlignment: uint32,
|
|
246
|
-
FileAlignment: uint32,
|
|
247
|
-
MajorOperatingSystemVersion:uint16,
|
|
248
|
-
MinorOperatingSystemVersion:uint16,
|
|
249
|
-
MajorImageVersion: uint16,
|
|
250
|
-
MinorImageVersion: uint16,
|
|
251
|
-
MajorSubsystemVersion: uint16,
|
|
252
|
-
MinorSubsystemVersion: uint16,
|
|
253
|
-
Win32VersionValue: uint32,
|
|
254
|
-
SizeOfImage: uint32,
|
|
255
|
-
SizeOfHeaders: uint32,
|
|
256
|
-
CheckSum: uint32,
|
|
257
|
-
Subsystem: uint16,
|
|
258
|
-
DllCharacteristics: binary.asFlags(uint16, DLLCHARACTERISTICS),
|
|
259
|
-
SizeOfStackReserve: uint64,
|
|
260
|
-
SizeOfStackCommit: uint64,
|
|
261
|
-
SizeOfHeapReserve: uint64,
|
|
262
|
-
SizeOfHeapCommit: uint64,
|
|
263
|
-
LoaderFlags: uint32,
|
|
264
|
-
DataDirectory: binary.objectWithNames(binary.ArrayType(uint32, DATA_DIRECTORY), binary.names(Object.keys(DIRECTORIES))),
|
|
265
|
-
};
|
|
266
|
-
|
|
267
|
-
export class PE {
|
|
268
|
-
header: binary.ReadType<typeof DOS_HEADER> & binary.ReadType<typeof EXE_HEADER>;
|
|
269
|
-
opt?: binary.ReadType<typeof OPTIONAL_HEADER> & (binary.ReadType<typeof OPTIONAL_HEADER32> | binary.ReadType<typeof OPTIONAL_HEADER64>);
|
|
270
|
-
sections: Section[];
|
|
271
|
-
|
|
272
|
-
static check(data: Uint8Array): boolean {
|
|
273
|
-
return uint16.get(new binary.stream(data)) === binary.utils.stringCode("MZ");
|
|
274
|
-
}
|
|
275
|
-
|
|
276
|
-
constructor(private data: Uint8Array) {
|
|
277
|
-
const file = new binary.stream(data);
|
|
278
|
-
this.header = binary.read(file, {...DOS_HEADER, ...EXE_HEADER});
|
|
279
|
-
|
|
280
|
-
file.seek(this.header.lfanew);
|
|
281
|
-
if (uint32.get(file) == binary.utils.stringCode("PE\0\0")) {
|
|
282
|
-
const h = binary.read(file, FILE_HEADER);
|
|
283
|
-
|
|
284
|
-
if (h.SizeOfOptionalHeader) {
|
|
285
|
-
const opt = new binary.stream(file.read_buffer(h.SizeOfOptionalHeader));
|
|
286
|
-
const opt1 = binary.read(opt, OPTIONAL_HEADER);
|
|
287
|
-
if (opt1.Magic == 'NT32')
|
|
288
|
-
this.opt = binary.read_more(opt, OPTIONAL_HEADER32, opt1);
|
|
289
|
-
else if (opt1.Magic == 'NT64')
|
|
290
|
-
this.opt = binary.read_more(opt, OPTIONAL_HEADER64, opt1);
|
|
291
|
-
}
|
|
292
|
-
|
|
293
|
-
this.sections = Array.from({length: h.NumberOfSections}, () => new Section(file));
|
|
294
|
-
} else {
|
|
295
|
-
this.sections = [];
|
|
296
|
-
}
|
|
297
|
-
}
|
|
298
|
-
|
|
299
|
-
get directories() {
|
|
300
|
-
return this.opt?.DataDirectory;
|
|
301
|
-
}
|
|
302
|
-
|
|
303
|
-
FindSectionRVA(rva: number) {
|
|
304
|
-
for (const i of this.sections) {
|
|
305
|
-
if (rva >= +i.VirtualAddress && rva < +i.VirtualAddress + i.SizeOfRawData)
|
|
306
|
-
return i;
|
|
307
|
-
}
|
|
308
|
-
}
|
|
309
|
-
|
|
310
|
-
FindSectionRaw(addr: number) {
|
|
311
|
-
for (const i of this.sections) {
|
|
312
|
-
if (addr >= +i.PointerToRawData && addr < +i.PointerToRawData + i.SizeOfRawData)
|
|
313
|
-
return i;
|
|
314
|
-
}
|
|
315
|
-
}
|
|
316
|
-
|
|
317
|
-
GetDataRVA(rva: number, size?: number) {
|
|
318
|
-
const sect = this.FindSectionRVA(rva);
|
|
319
|
-
if (sect && sect.data)
|
|
320
|
-
return sect.data.at(rva, size);
|
|
321
|
-
}
|
|
322
|
-
GetDataRaw(addr: number, size: number) {
|
|
323
|
-
const sect = this.FindSectionRaw(addr);
|
|
324
|
-
if (sect && sect.data) {
|
|
325
|
-
const offset = addr - +sect.PointerToRawData;
|
|
326
|
-
return sect.data.data.subarray(offset, offset + size);
|
|
327
|
-
}
|
|
328
|
-
}
|
|
329
|
-
GetDataDir(dir: Directory) {
|
|
330
|
-
if (dir.Size)
|
|
331
|
-
return this.GetDataRVA(dir.VirtualAddress, dir.Size);
|
|
332
|
-
}
|
|
333
|
-
|
|
334
|
-
ReadDirectory(name: string) {
|
|
335
|
-
const dir = this.opt?.DataDirectory[name];
|
|
336
|
-
if (dir?.Size) {
|
|
337
|
-
const data = this.GetDataDir(dir);
|
|
338
|
-
const info = DIRECTORIES[name];
|
|
339
|
-
if (data && info?.read)
|
|
340
|
-
return info.read(this, data);
|
|
341
|
-
return data;
|
|
342
|
-
}
|
|
343
|
-
}
|
|
344
|
-
}
|
|
345
|
-
|
|
346
|
-
|
|
347
|
-
//-----------------------------------------------------------------------------
|
|
348
|
-
// exports
|
|
349
|
-
//-----------------------------------------------------------------------------
|
|
350
|
-
|
|
351
|
-
const EXPORT_DIRECTORY = {
|
|
352
|
-
ExportFlags: uint32, // Reserved, must be 0.
|
|
353
|
-
TimeDateStamp: TIMEDATE, // The time and date that the export data was created.
|
|
354
|
-
MajorVersion: binary.asHex(uint16), // The major version number. The major and minor version numbers can be set by the user.
|
|
355
|
-
MinorVersion: binary.asHex(uint16), // The minor version number.
|
|
356
|
-
DLLName: RVA_STRING, // The address of the ASCII string that contains the name of the DLL. This address is relative to the image base.
|
|
357
|
-
OrdinalBase: uint32, // The starting ordinal number for exports in this image. This field specifies the starting ordinal number for the export address table. It is usually set to 1.
|
|
358
|
-
NumberEntries: uint32, // The number of entries in the export address table.
|
|
359
|
-
NumberNames: uint32, // The number of entries in the name pointer table. This is also the number of entries in the ordinal table.
|
|
360
|
-
FunctionTable: RVA_ARRAY32, // RVA of functions
|
|
361
|
-
NameTable: RVA_ARRAY32, // RVA of names
|
|
362
|
-
OrdinalTable: RVA_ARRAY16, // RVA from base of image
|
|
363
|
-
};
|
|
364
|
-
|
|
365
|
-
interface ExportEntry {
|
|
366
|
-
ordinal: number;
|
|
367
|
-
name: string;
|
|
368
|
-
address: number;
|
|
369
|
-
}
|
|
370
|
-
|
|
371
|
-
export function ReadExports(file: pe_stream) {
|
|
372
|
-
const dir = binary.read(file, EXPORT_DIRECTORY);
|
|
373
|
-
const addresses = dir.FunctionTable!;
|
|
374
|
-
const names = dir.NameTable;
|
|
375
|
-
const ordinals = dir.OrdinalTable;
|
|
376
|
-
|
|
377
|
-
const result: ExportEntry[] = [];
|
|
378
|
-
for (let i = 0; i < dir.NumberEntries; i++) {
|
|
379
|
-
const sect = file.pe.FindSectionRVA(addresses[i]);
|
|
380
|
-
if (sect) {
|
|
381
|
-
const ordinal = (ordinals && i < dir.NumberNames ? ordinals[i] : i) + dir.OrdinalBase;
|
|
382
|
-
const name = names && i < dir.NumberNames ? binary.utils.decodeTextTo0(file.pe.GetDataRVA(names[i])?.data, 'utf8') : '';
|
|
383
|
-
result.push({ordinal, name, address: addresses[i]});
|
|
384
|
-
}
|
|
385
|
-
}
|
|
386
|
-
const sorted = result.sort((a, b)=> a.address - b.address);
|
|
387
|
-
return sorted.map((v, i) => {
|
|
388
|
-
let j = i;
|
|
389
|
-
while (++j < sorted.length && sorted[j].address == v.address);
|
|
390
|
-
return [v.ordinal, v.name, file.pe.GetDataRVA(v.address, j < sorted.length ? sorted[j].address - v.address : undefined)];
|
|
391
|
-
});
|
|
392
|
-
}
|
|
393
|
-
|
|
394
|
-
//-----------------------------------------------------------------------------
|
|
395
|
-
// imports
|
|
396
|
-
//-----------------------------------------------------------------------------
|
|
397
|
-
|
|
398
|
-
export class DLLImports extends Array {}
|
|
399
|
-
|
|
400
|
-
const RVA_ITA64 = {
|
|
401
|
-
get(s: pe_stream) {
|
|
402
|
-
const r = binary.utils.to64(s.get_rva());
|
|
403
|
-
if (r) {
|
|
404
|
-
const result = Array.from(r.subarray(0, r.indexOf(0n)), i =>
|
|
405
|
-
i >> 63n
|
|
406
|
-
? `ordinal_${i - (1n << 63n)}`
|
|
407
|
-
: binary.utils.decodeTextTo0(s.pe.GetDataRVA(Number(i))?.data.subarray(2), 'utf8')
|
|
408
|
-
);
|
|
409
|
-
Object.setPrototypeOf(result, DLLImports.prototype);
|
|
410
|
-
return result;
|
|
411
|
-
}
|
|
412
|
-
},
|
|
413
|
-
put(_s: pe_stream) {}
|
|
414
|
-
};
|
|
415
|
-
|
|
416
|
-
const IMPORT_DESCRIPTOR = {
|
|
417
|
-
Characteristics: uint32, // 0 for terminating null import descriptor
|
|
418
|
-
TimeDateStamp: TIMEDATE, // 0 if not bound, -1 if bound, and real date\time stamp in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND) // O.W. date/time stamp of DLL bound to (Old BIND)
|
|
419
|
-
ForwarderChain: uint32, // -1 if no forwarders
|
|
420
|
-
DllName: RVA_STRING,//uint32,
|
|
421
|
-
FirstThunk: RVA_ITA64,//uint32, // RVA to IAT (if bound this IAT has actual addresses)
|
|
422
|
-
};
|
|
423
|
-
|
|
424
|
-
export function ReadImports(file: pe_stream) {
|
|
425
|
-
const result: [string, any][] = [];
|
|
426
|
-
while (file.remaining()) {
|
|
427
|
-
const r = binary.read(file, IMPORT_DESCRIPTOR);
|
|
428
|
-
if (!r.Characteristics)
|
|
429
|
-
break;
|
|
430
|
-
result.push([r.DllName, r.FirstThunk]);
|
|
431
|
-
}
|
|
432
|
-
return result;
|
|
433
|
-
}
|
|
434
|
-
|
|
435
|
-
//-----------------------------------------------------------------------------
|
|
436
|
-
// resources
|
|
437
|
-
//-----------------------------------------------------------------------------
|
|
438
|
-
|
|
439
|
-
class RESOURCE_DATA_ENTRY extends binary.ReadClass({
|
|
440
|
-
OffsetToData: uint32,
|
|
441
|
-
Size: uint32,
|
|
442
|
-
CodePage: uint32,
|
|
443
|
-
Reserved: uint32,
|
|
444
|
-
}) {
|
|
445
|
-
data: Uint8Array;
|
|
446
|
-
constructor(file: binary.stream, data: binary.MappedMemory) {
|
|
447
|
-
super(file);
|
|
448
|
-
this.data = data.slice(this.OffsetToData, this.OffsetToData + this.Size).data;
|
|
449
|
-
}
|
|
450
|
-
}
|
|
451
|
-
|
|
452
|
-
const RESOURCE_DIRECTORY = {
|
|
453
|
-
Characteristics: uint32,
|
|
454
|
-
TimeDateStamp: uint32,
|
|
455
|
-
MajorVersion: uint16,
|
|
456
|
-
MinorVersion: uint16,
|
|
457
|
-
NumberOfNamedEntries: uint16,
|
|
458
|
-
NumberOfIdEntries: uint16,
|
|
459
|
-
entries: binary.ArrayType(obj=> obj.NumberOfNamedEntries + obj.NumberOfIdEntries, {
|
|
460
|
-
u0: uint32,
|
|
461
|
-
u1: uint32,
|
|
462
|
-
})
|
|
463
|
-
};
|
|
464
|
-
|
|
465
|
-
const IRT = {
|
|
466
|
-
0: 'NONE',
|
|
467
|
-
1: 'CURSOR',
|
|
468
|
-
2: 'BITMAP',
|
|
469
|
-
3: 'ICON',
|
|
470
|
-
4: 'MENU',
|
|
471
|
-
5: 'DIALOG',
|
|
472
|
-
6: 'STRING',
|
|
473
|
-
7: 'FONTDIR',
|
|
474
|
-
8: 'FONT',
|
|
475
|
-
9: 'ACCELERATOR',
|
|
476
|
-
10: 'RCDATA',
|
|
477
|
-
11: 'MESSAGETABLE',
|
|
478
|
-
12: 'GROUP_CURSOR',
|
|
479
|
-
14: 'GROUP_ICON',
|
|
480
|
-
16: 'VERSION',
|
|
481
|
-
17: 'DLGINCLUDE',
|
|
482
|
-
19: 'PLUGPLAY',
|
|
483
|
-
20: 'VXD',
|
|
484
|
-
21: 'ANICURSOR',
|
|
485
|
-
22: 'ANIICON',
|
|
486
|
-
23: 'HTML',
|
|
487
|
-
24: 'MANIFEST',
|
|
488
|
-
241:'TOOLBAR',
|
|
489
|
-
} as const;
|
|
490
|
-
|
|
491
|
-
export function ReadResourceDirectory(file: binary.stream, data: binary.MappedMemory, type = 0) {
|
|
492
|
-
const dir = binary.read(file, RESOURCE_DIRECTORY);
|
|
493
|
-
const id_type = binary.StringType(uint16, 'utf16le');
|
|
494
|
-
const topbit = 0x80000000;
|
|
495
|
-
const result : Record<string, any> = {};
|
|
496
|
-
|
|
497
|
-
for (const i of dir.entries) {
|
|
498
|
-
const id = i.u0 & topbit ? id_type.get(file.seek(i.u0 & ~topbit)) : !type ? IRT[i.u0 as keyof typeof IRT] : i.u0;
|
|
499
|
-
|
|
500
|
-
file.seek(i.u1 & ~topbit);
|
|
501
|
-
result[id] = i.u1 & topbit
|
|
502
|
-
? ReadResourceDirectory(file, data, type || i.u0)
|
|
503
|
-
: new RESOURCE_DATA_ENTRY(file, data);
|
|
504
|
-
}
|
|
505
|
-
return result;
|
|
506
|
-
}
|