ImageInterpreter.hpp 2.2 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576
  1. #pragma once
  2. #include <stddef.h>
  3. #include <stdint.h>
  4. #include <windows.h>
  5. #include <map>
  6. class ImageInterpreter {
  7. private:
  8. PVOID _ImageBasePtr;
  9. PIMAGE_NT_HEADERS _NTHeadersPtr;
  10. PIMAGE_SECTION_HEADER _SectionHeaderTablePtr;
  11. std::map<uint64_t, size_t> _SectionNameTable;
  12. std::map<uintptr_t, size_t> _SectionMapAddressTable;
  13. std::map<uintptr_t, size_t> _RelocationAddressTable;
  14. public:
  15. ImageInterpreter();
  16. bool ParseImage(const PVOID PtrToImageBase, bool DisableRelocParsing);
  17. template<typename __Type>
  18. __Type* GetImageBase() const {
  19. return reinterpret_cast<__Type*>(_ImageBasePtr);
  20. }
  21. PIMAGE_DOS_HEADER GetImageDosHeader() const;
  22. PIMAGE_NT_HEADERS GetImageNTHeaders() const;
  23. PIMAGE_SECTION_HEADER GetSectionHeaderTable() const;
  24. PIMAGE_SECTION_HEADER GetSectionHeader(const char* SectionName) const;
  25. PIMAGE_SECTION_HEADER GetSectionHeader(uintptr_t Rva) const;
  26. template<typename __Type>
  27. __Type* GetSectionView(const char* SectionName) const {
  28. auto PtrToSectionHeader = GetSectionHeader(SectionName);
  29. if (PtrToSectionHeader == nullptr)
  30. return nullptr;
  31. return reinterpret_cast<__Type*>(
  32. reinterpret_cast<uint8_t*>(_ImageBasePtr) +
  33. PtrToSectionHeader->PointerToRawData
  34. );
  35. }
  36. template<typename __Type>
  37. __Type* GetSectionView(uintptr_t Rva) const {
  38. auto PtrToSectionHeader = GetSectionHeader(Rva);
  39. if (PtrToSectionHeader == nullptr)
  40. return nullptr;
  41. return reinterpret_cast<__Type*>(
  42. reinterpret_cast<uint8_t*>(_ImageBasePtr) +
  43. PtrToSectionHeader->PointerToRawData
  44. );
  45. }
  46. template<typename __Type>
  47. __Type* RvaToPointer(uintptr_t Rva) const {
  48. auto PtrToSectionHeader = GetSectionHeader(Rva);
  49. if (PtrToSectionHeader == nullptr)
  50. return nullptr;
  51. uint8_t* SectionViewPtr =
  52. reinterpret_cast<uint8_t*>(_ImageBasePtr) +
  53. PtrToSectionHeader->PointerToRawData;
  54. return reinterpret_cast<__Type*>(
  55. SectionViewPtr + (Rva - PtrToSectionHeader->VirtualAddress)
  56. );
  57. }
  58. bool IsRvaRangeInRelocTable(uintptr_t Rva, size_t Size) const;
  59. };