From 386f5b1cbc6d0c3f40f6439ca8cd55f9d65d257d Mon Sep 17 00:00:00 2001 From: momo5502 Date: Sat, 9 Aug 2025 17:20:22 +0200 Subject: [PATCH] Add missing types --- src/common/platform/win_pefile.hpp | 41 +++++++++++++++++++ .../module/module_mapping.cpp | 12 +++--- 2 files changed, 47 insertions(+), 6 deletions(-) diff --git a/src/common/platform/win_pefile.hpp b/src/common/platform/win_pefile.hpp index d73222af..b154a8b5 100644 --- a/src/common/platform/win_pefile.hpp +++ b/src/common/platform/win_pefile.hpp @@ -283,6 +283,47 @@ typedef struct _IMAGE_BASE_RELOCATION // WORD TypeOffset[1]; } IMAGE_BASE_RELOCATION, *PIMAGE_BASE_RELOCATION; +#define IMAGE_ORDINAL_FLAG64 0x8000000000000000 +#define IMAGE_ORDINAL_FLAG32 0x80000000 +#define IMAGE_ORDINAL64(Ordinal) (Ordinal & 0xffff) +#define IMAGE_ORDINAL32(Ordinal) (Ordinal & 0xffff) +#define IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0) +#define IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0) + +typedef struct _IMAGE_IMPORT_BY_NAME +{ + WORD Hint; + CHAR Name[1]; +} IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME; + +typedef struct _IMAGE_IMPORT_DESCRIPTOR +{ + union + { + DWORD Characteristics; // 0 for terminating null import descriptor + DWORD OriginalFirstThunk; // RVA to original unbound IAT (PIMAGE_THUNK_DATA) + } DUMMYUNIONNAME; + DWORD TimeDateStamp; // 0 if not bound, + // -1 if bound, and real date\time stamp + // in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND) + // O.W. date/time stamp of DLL bound to (Old BIND) + + DWORD ForwarderChain; // -1 if no forwarders + DWORD Name; + DWORD FirstThunk; // RVA to IAT (if bound this IAT has actual addresses) +} IMAGE_IMPORT_DESCRIPTOR; + +typedef struct _IMAGE_THUNK_DATA64 +{ + union + { + ULONGLONG ForwarderString; // PBYTE + ULONGLONG Function; // PDWORD + ULONGLONG Ordinal; + ULONGLONG AddressOfData; // PIMAGE_IMPORT_BY_NAME + } u1; +} IMAGE_THUNK_DATA64; + #endif template diff --git a/src/windows-emulator/module/module_mapping.cpp b/src/windows-emulator/module/module_mapping.cpp index 942b0cd9..bfedf783 100644 --- a/src/windows-emulator/module/module_mapping.cpp +++ b/src/windows-emulator/module/module_mapping.cpp @@ -51,11 +51,11 @@ namespace const auto module_name = buffer.as_string(descriptor.Name); auto& imports = binary.imports[module_name]; - auto original_thunk_data = buffer.as(descriptor.FirstThunk); + auto original_thunk_data = buffer.as(descriptor.FirstThunk); if (descriptor.OriginalFirstThunk) { - original_thunk_data = buffer.as(descriptor.OriginalFirstThunk); + original_thunk_data = buffer.as(descriptor.OriginalFirstThunk); } for (size_t j = 0;; ++j) @@ -68,12 +68,12 @@ namespace imported_symbol sym{}; - const auto thunk_rva = descriptor.FirstThunk // - + sizeof(IMAGE_THUNK_DATA) * j // - + offsetof(IMAGE_THUNK_DATA, u1.Function); + const auto thunk_rva = descriptor.FirstThunk // + + sizeof(IMAGE_THUNK_DATA64) * j // + + offsetof(IMAGE_THUNK_DATA64, u1.Function); sym.address = thunk_rva + binary.image_base; - if (IMAGE_SNAP_BY_ORDINAL(original_thunk.u1.Ordinal)) + if (IMAGE_SNAP_BY_ORDINAL64(original_thunk.u1.Ordinal)) { sym.name = "#" + std::to_string(original_thunk.u1.Ordinal); }