Simplify code and remove uncessary comments

This commit is contained in:
ahm3dgg
2026-01-09 13:35:38 +02:00
parent f41e7bf881
commit 58d6a10837
5 changed files with 12 additions and 19 deletions

View File

@@ -659,7 +659,6 @@ namespace winpe
return std::make_error_code(std::errc::executable_format_error);
}
// Helper function to parse PE headers and extract image information
template <typename T>
inline bool parse_pe_headers(const std::vector<std::byte>& file_data, pe_image_basic_info& info)
{
@@ -674,18 +673,15 @@ namespace winpe
return false;
}
// First check if we can read up to the optional header magic
if (file_data.size() < dos_header->e_lfanew + sizeof(uint32_t) + sizeof(PEFileHeader_t) + sizeof(uint16_t))
{
return false;
}
// Read the magic number from the optional header
const auto* magic_ptr =
reinterpret_cast<const uint16_t*>(file_data.data() + dos_header->e_lfanew + sizeof(uint32_t) + sizeof(PEFileHeader_t));
const uint16_t magic = *magic_ptr;
// Check if the magic matches the expected type
constexpr uint16_t expected_magic = (sizeof(T) == sizeof(uint32_t))
? static_cast<uint16_t>(PEOptionalHeader_t<std::uint32_t>::k_Magic)
: static_cast<uint16_t>(PEOptionalHeader_t<std::uint64_t>::k_Magic);
@@ -695,7 +691,6 @@ namespace winpe
return false;
}
// Now check the full NT headers size
if (file_data.size() < dos_header->e_lfanew + sizeof(PENTHeaders_t<T>))
{
return false;
@@ -710,7 +705,6 @@ namespace winpe
const auto& file_header = nt_headers->FileHeader;
const auto& optional_header = nt_headers->OptionalHeader;
// Extract information from headers
info.machine = static_cast<uint16_t>(file_header.Machine);
info.image_characteristics = file_header.Characteristics;
@@ -726,10 +720,8 @@ namespace winpe
info.loader_flags = optional_header.LoaderFlags;
info.checksum = optional_header.CheckSum;
// Check if image contains code
info.has_code = (optional_header.SizeOfCode > 0) || (optional_header.AddressOfEntryPoint != 0);
// Also check section characteristics for code sections
const auto sections_offset = dos_header->e_lfanew + sizeof(uint32_t) + sizeof(PEFileHeader_t) + file_header.SizeOfOptionalHeader;
if (file_data.size() >= sections_offset + sizeof(IMAGE_SECTION_HEADER) * file_header.NumberOfSections)
{

View File

@@ -53,7 +53,7 @@ constexpr uint64_t page_align_up(const uint64_t value, const uint64_t page_size
return align_up(value, page_size);
}
constexpr uint64_t rva_to_raw(uint64_t va_base, uint64_t raw_base, uint64_t rva)
constexpr uint64_t rva_to_file_offset(uint64_t va_base, uint64_t raw_base, uint64_t rva)
{
return rva - (va_base - raw_base);
}

View File

@@ -221,7 +221,7 @@ mapped_module* module_manager::map_module_core(const pe_detection_result& detect
mapped_module mod = mapper();
mod.is_static = is_static;
if (!mod.path.empty() && mod.path.filename() != "win32u.dll")
if (!mod.path.empty())
{
this->module_load_count[mod.path]++;
}
@@ -465,6 +465,13 @@ std::optional<uint64_t> module_manager::get_module_load_count_by_path(const wind
mapped_module* module_manager::map_module(const windows_path& file, const logger& logger, const bool is_static, bool allow_duplicate)
{
auto local_file = this->file_sys_->translate(file);
if (local_file.filename() == "win32u.dll")
{
return this->map_local_module(this->file_sys_->translate(file), logger, is_static, false);
}
return this->map_local_module(this->file_sys_->translate(file), logger, is_static, allow_duplicate);
}

View File

@@ -318,7 +318,7 @@ namespace
auto import_directory_rbase = section_with_import_descs.PointerToRawData;
uint64_t import_directory_raw =
rva_to_raw(import_directory_vbase, import_directory_rbase, import_directory_entry.VirtualAddress);
rva_to_file_offset(import_directory_vbase, import_directory_rbase, import_directory_entry.VirtualAddress);
auto import_descriptors = buffer.as<IMAGE_IMPORT_DESCRIPTOR>(static_cast<size_t>(import_directory_raw));
for (size_t import_desc_index = 0;; import_desc_index++)
{
@@ -328,8 +328,8 @@ namespace
break;
}
auto known_dll_dep_name =
buffer.as_string(static_cast<size_t>(rva_to_raw(import_directory_vbase, import_directory_rbase, descriptor.Name)));
auto known_dll_dep_name = buffer.as_string(
static_cast<size_t>(rva_to_file_offset(import_directory_vbase, import_directory_rbase, descriptor.Name)));
utils::string::to_lower_inplace(known_dll_dep_name);
auto known_dll_dep_name_16 = u8_to_u16(known_dll_dep_name);

View File

@@ -120,12 +120,6 @@ namespace syscalls
utils::string::to_lower_inplace(filename);
// Workaround for win32u.dll
if (is_known_dll && filename.starts_with(u"win32u.dll"))
{
return STATUS_OBJECT_NAME_NOT_FOUND;
}
if (attributes.RootDirectory == KNOWN_DLLS_DIRECTORY || filename.starts_with(u"\\knowndlls\\"))
{
auto& knowndlls_sections = c.win_emu.process.knowndlls64_sections;