beginning work on pe file dctor...

_xeroxz
_xeroxz 3 years ago
parent 6a2661d410
commit d559b996ed

3
.gitmodules vendored

@ -1,3 +1,6 @@
[submodule "dependencies/cli-parser"]
path = dependencies/cli-parser
url = https://githacks.org/_xeroxz/cli-parser.git
[submodule "dependencies/linux-pe"]
path = dependencies/linux-pe
url = https://github.com/can1357/linux-pe.git

@ -0,0 +1 @@
Subproject commit db2b7af6e6beae1bc391ff8f8e5c97b963dc3258

@ -12,6 +12,7 @@ namespace llo::s1
/// </summary>
class dctor_base_t
{
protected:
/// <summary>
/// vector of bytes containing the raw image to be deconstructed...
/// </summary>
@ -20,7 +21,7 @@ namespace llo::s1
/// <summary>
/// symbol loader used when generating iff...
/// </summary>
llo::s1::symbol_loader_base_t* symbol_loader;
llo::s1::symbol_loader_base_t *symbol_loader;
public:
/// <summary>
@ -28,7 +29,7 @@ namespace llo::s1
/// </summary>
/// <param name="image">vector of bytes containing the raw image...</param>
explicit dctor_base_t( std::vector< std::uint8_t > &image,
llo::s1::symbol_loader_base_t* symbol_loader = nullptr )
llo::s1::symbol_loader_base_t *symbol_loader = nullptr )
: raw_img{ image }, symbol_loader{ symbol_loader }
{
}
@ -39,6 +40,6 @@ namespace llo::s1
/// </summary>
/// <param name="iff"></param>
/// <returns></returns>
virtual bool generate( lloiff_t &iff ) = 0;
virtual void generate( lloiff_t &iff ) = 0;
};
} // namespace llo::s1

@ -1,5 +1,6 @@
#pragma once
#include <llodctor/llodctor_base.hpp>
#include <linuxpe>
namespace llo::s1
{
@ -12,6 +13,6 @@ namespace llo::s1
{
}
bool generate( lloiff_t &iff ) override;
void generate( lloiff_t &iff ) override;
};
} // namespace llo::s1

@ -24,7 +24,7 @@ namespace llo
{
public:
llo::utils::hash_t< std::string > section_name;
std::vector< llo::symbol::symbol_base_t > symbols;
std::vector< std::shared_ptr< llo::symbol::symbol_base_t > > symbols;
std::vector< std::uint8_t > section_raw;
};

@ -31,7 +31,7 @@ namespace llo::symbol
{
}
virtual symbol_type_t get_type() const;
virtual std::size_t get_size() const;
virtual symbol_type_t get_type() const = 0;
virtual std::size_t get_size() const = 0;
};
} // namespace llo::symbol

@ -10,10 +10,16 @@ namespace llo::s1
class symbol_loader_base_t
{
std::string symbols_path;
public:
symbol_loader_base_t( const std::string &&path ) : symbols_path{ path }
explicit symbol_loader_base_t( std::string &&path ) : symbols_path{ path }
{
}
virtual void load( llo::lloiff_t && ) = 0;
symbol_loader_base_t( std::string &path ) : symbols_path{ path }
{
}
virtual void load( llo::lloiff_t &) = 0;
};
} // namespace llo::s1

@ -0,0 +1,5 @@
#include <llosymbol_loader/llosymbol_loader_map.hpp>
void llo::s1::symbol_loader_map_t::load( llo::lloiff_t &iff )
{
}

@ -0,0 +1,18 @@
#include <llosymbol_loader/llosymbol_loader_base.hpp>
namespace llo::s1
{
class symbol_loader_map_t : public symbol_loader_base_t
{
public:
explicit symbol_loader_map_t( std::string &&path ) : symbol_loader_base_t( path )
{
}
symbol_loader_map_t( std::string &path ) : symbol_loader_base_t( path )
{
}
void load( llo::lloiff_t &iff ) override;
};
} // namespace llo::s1

@ -1,7 +1,12 @@
#pragma once
#include <algorithm>
#include <cstdint>
#include <fstream>
#include <functional>
#include <map>
#include <memory>
#include <random>
#include <string>
#include <type_traits>
#include <variant>
@ -28,6 +33,30 @@ namespace llo::utils
return uniform_distribution( mt );
}
/// <summary>
/// reads a binary file off disk into an std::vector<std::uint8_t>...
/// </summary>
/// <param name="file">file path...</param>
/// <param name="data">vector to fill up with bytes...</param>
/// <returns>returns true if no errors happened...</returns>
inline bool open_binary_file( std::string file, std::vector< uint8_t > &data )
{
std::ifstream fstr( file, std::ios::binary );
if ( !fstr.is_open() )
return false;
fstr.unsetf( std::ios::skipws );
fstr.seekg( 0, std::ios::end );
const auto file_size = fstr.tellg();
fstr.seekg( NULL, std::ios::beg );
data.reserve( static_cast< uint32_t >( file_size ) );
data.insert( data.begin(), std::istream_iterator< uint8_t >( fstr ), std::istream_iterator< uint8_t >() );
return true;
}
/// <summary>
/// hash class, used in lloiff, symbols, sections, and much more...
/// </summary>

@ -11,6 +11,7 @@
</ProjectConfiguration>
</ItemGroup>
<ItemGroup>
<ClInclude Include="dependencies\cli-parser\cli-parser.hpp" />
<ClInclude Include="dependencies\fcml\include\fcml_assembler.h" />
<ClInclude Include="dependencies\fcml\include\fcml_assembler.hpp" />
<ClInclude Include="dependencies\fcml\include\fcml_choosers.h" />
@ -47,9 +48,41 @@
<ClInclude Include="dependencies\fcml\include\fcml_symbols.h" />
<ClInclude Include="dependencies\fcml\include\fcml_symbols.hpp" />
<ClInclude Include="dependencies\fcml\include\fcml_types.h" />
<ClInclude Include="dependencies\linux-pe\includes\coff\archive.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\coff\auxiliaries\aux_file_name.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\coff\auxiliaries\aux_function.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\coff\auxiliaries\aux_function_delimiter.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\coff\auxiliaries\aux_section.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\coff\auxiliaries\aux_weak_external.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\coff\file_header.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\coff\image.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\coff\import_library.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\coff\line_number.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\coff\reloc.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\coff\section_header.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\coff\string.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\coff\symbol.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\coff\uleb128.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\img_common.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\nt\data_directories.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_debug.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_delay_load.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_exceptions.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_export.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_iat.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_import.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_load_config.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_relocs.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_resource.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_security.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_tls.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\nt\image.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\nt\nt_headers.hpp" />
<ClInclude Include="dependencies\linux-pe\includes\nt\optional_header.hpp" />
<ClInclude Include="include\llodctor\llodctor_base.hpp" />
<ClInclude Include="include\llodctor\llodctor_bin.hpp" />
<ClInclude Include="include\llodctor\llodctor_elf.hpp" />
<ClInclude Include="include\llodctor\llodctor_lib.hpp" />
<ClInclude Include="include\llodctor\llodctor_pe.hpp" />
<ClInclude Include="include\llodisposition\llodisposition_types.hpp" />
<ClInclude Include="include\lloiff.hpp" />
@ -66,11 +99,13 @@
</ItemGroup>
<ItemGroup>
<None Include=".clang-format" />
<None Include="dependencies\linux-pe\includes\linuxpe" />
</ItemGroup>
<ItemGroup>
<ClCompile Include="dependencies\fcml\include\fcml_gas_mnemonics.cpp" />
<ClCompile Include="dependencies\fcml\include\fcml_intel_mnemonics.cpp" />
<ClCompile Include="dependencies\fcml\include\fcml_registers.cpp" />
<ClCompile Include="include\llosymbol_loader\llosymbol_loader_map.cpp" />
<ClCompile Include="src\llodctor_pe.cpp" />
<ClCompile Include="src\main.cpp" />
</ItemGroup>
@ -109,11 +144,11 @@
<PropertyGroup Label="UserMacros" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<LinkIncremental>true</LinkIncremental>
<IncludePath>$(ProjectDir)include;$(IncludePath);$(ProjectDir)include;$(ProjectDir)dependencies\fcml\include\</IncludePath>
<IncludePath>$(ProjectDir)include;$(IncludePath);$(ProjectDir)include;$(ProjectDir)dependencies\fcml\include\;$(ProjectDir)dependencies\cli-parser\;$(ProjectDir)dependencies\linux-pe\includes;$(ProjectDir)dependencies\xtils\</IncludePath>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<LinkIncremental>false</LinkIncremental>
<IncludePath>$(VC_IncludePath);$(WindowsSDK_IncludePath);;$(ProjectDir)include;$(ProjectDir)dependencies\fcml\include\</IncludePath>
<IncludePath>$(VC_IncludePath);$(WindowsSDK_IncludePath);;$(ProjectDir)include;$(ProjectDir)dependencies\fcml\include\;$(ProjectDir)dependencies\cli-parser\;$(ProjectDir)dependencies\linux-pe\includes;$(ProjectDir)dependencies\xtils\</IncludePath>
</PropertyGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<ClCompile>
@ -137,7 +172,7 @@
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<LanguageStandard>stdcpp17</LanguageStandard>
<LanguageStandard>stdcpplatest</LanguageStandard>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>

@ -27,6 +27,21 @@
<Filter Include="Header Files\llodisposition">
<UniqueIdentifier>{3c4da18e-ebe9-4cf0-8edc-025d26da4d13}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\linux-pe">
<UniqueIdentifier>{6d02947c-bc11-46d5-a571-5ed1ec5c54cb}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\linux-pe\nt">
<UniqueIdentifier>{199f9012-40e3-45c4-963e-11da136be320}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\linux-pe\coff">
<UniqueIdentifier>{a3e87fb9-6f1a-4d3e-87e5-1869fdae603b}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\linux-pe\nt\directories">
<UniqueIdentifier>{6d7474df-553d-4b37-8424-fa35c45ae9ca}</UniqueIdentifier>
</Filter>
<Filter Include="Header Files\linux-pe\coff\auxiliaries">
<UniqueIdentifier>{98d78f45-088b-441d-b20f-f4b2e7cec972}</UniqueIdentifier>
</Filter>
</ItemGroup>
<ItemGroup>
<ClInclude Include="include\lloiff.hpp">
@ -185,11 +200,113 @@
<ClInclude Include="include\llodisposition\llodisposition_types.hpp">
<Filter>Header Files\llodisposition</Filter>
</ClInclude>
<ClInclude Include="include\llodctor\llodctor_lib.hpp">
<Filter>Header Files\llodctor</Filter>
</ClInclude>
<ClInclude Include="dependencies\cli-parser\cli-parser.hpp">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\img_common.hpp">
<Filter>Header Files\linux-pe</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\nt\data_directories.hpp">
<Filter>Header Files\linux-pe\nt</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\nt\image.hpp">
<Filter>Header Files\linux-pe\nt</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\nt\nt_headers.hpp">
<Filter>Header Files\linux-pe\nt</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\nt\optional_header.hpp">
<Filter>Header Files\linux-pe\nt</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_debug.hpp">
<Filter>Header Files\linux-pe\nt\directories</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_delay_load.hpp">
<Filter>Header Files\linux-pe\nt\directories</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_exceptions.hpp">
<Filter>Header Files\linux-pe\nt\directories</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_export.hpp">
<Filter>Header Files\linux-pe\nt\directories</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_iat.hpp">
<Filter>Header Files\linux-pe\nt\directories</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_import.hpp">
<Filter>Header Files\linux-pe\nt\directories</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_load_config.hpp">
<Filter>Header Files\linux-pe\nt\directories</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_relocs.hpp">
<Filter>Header Files\linux-pe\nt\directories</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_resource.hpp">
<Filter>Header Files\linux-pe\nt\directories</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_security.hpp">
<Filter>Header Files\linux-pe\nt\directories</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\nt\directories\dir_tls.hpp">
<Filter>Header Files\linux-pe\nt\directories</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\coff\archive.hpp">
<Filter>Header Files\linux-pe\coff</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\coff\file_header.hpp">
<Filter>Header Files\linux-pe\coff</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\coff\image.hpp">
<Filter>Header Files\linux-pe\coff</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\coff\import_library.hpp">
<Filter>Header Files\linux-pe\coff</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\coff\line_number.hpp">
<Filter>Header Files\linux-pe\coff</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\coff\reloc.hpp">
<Filter>Header Files\linux-pe\coff</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\coff\section_header.hpp">
<Filter>Header Files\linux-pe\coff</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\coff\string.hpp">
<Filter>Header Files\linux-pe\coff</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\coff\symbol.hpp">
<Filter>Header Files\linux-pe\coff</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\coff\uleb128.hpp">
<Filter>Header Files\linux-pe\coff</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\coff\auxiliaries\aux_file_name.hpp">
<Filter>Header Files\linux-pe\coff\auxiliaries</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\coff\auxiliaries\aux_function.hpp">
<Filter>Header Files\linux-pe\coff\auxiliaries</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\coff\auxiliaries\aux_function_delimiter.hpp">
<Filter>Header Files\linux-pe\coff\auxiliaries</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\coff\auxiliaries\aux_section.hpp">
<Filter>Header Files\linux-pe\coff\auxiliaries</Filter>
</ClInclude>
<ClInclude Include="dependencies\linux-pe\includes\coff\auxiliaries\aux_weak_external.hpp">
<Filter>Header Files\linux-pe\coff\auxiliaries</Filter>
</ClInclude>
</ItemGroup>
<ItemGroup>
<None Include=".clang-format">
<Filter>Resource Files</Filter>
</None>
<None Include="dependencies\linux-pe\includes\linuxpe">
<Filter>Header Files\linux-pe</Filter>
</None>
</ItemGroup>
<ItemGroup>
<ClCompile Include="src\llodctor_pe.cpp">
@ -207,5 +324,8 @@
<ClCompile Include="dependencies\fcml\include\fcml_registers.cpp">
<Filter>Header Files\fcml</Filter>
</ClCompile>
<ClCompile Include="include\llosymbol_loader\llosymbol_loader_map.cpp">
<Filter>Source Files</Filter>
</ClCompile>
</ItemGroup>
</Project>

@ -1,6 +1,16 @@
#include <llodctor/llodctor_pe.hpp>
bool llo::s1::dctor_pe_t::generate( lloiff_t &iff )
void llo::s1::dctor_pe_t::generate( lloiff_t &iff )
{
return false;
auto dos_header = reinterpret_cast< win::dos_header_t * >( raw_img.data() );
auto sections = dos_header->get_nt_headers()->get_sections();
auto section_count = dos_header->get_nt_headers()->file_header.num_sections;
for ( auto idx = 0u; idx < section_count; ++idx, ++sections )
{
}
if ( symbol_loader )
symbol_loader->load( iff );
}

@ -1,36 +1,86 @@
#define NOMINMAX
#define _CRT_SECURE_NO_WARNINGS
#include <cli-parser.hpp>
#include <filesystem>
#include <llodctor/llodctor_pe.hpp>
#include <lloiff.hpp>
#include <llosymbol_loader/llosymbol_loader_base.hpp>
#include <llosymbol_loader/llosymbol_loader_map.hpp>
int __cdecl main( int argc, const char *argv[] )
{
// read the file path in from cli...
std::string file_name = "test.exe";
argparse::argument_parser_t cli_parser( "llo stage-one", "llo stage one demo" );
cli_parser.add_argument()
.names( { "-i", "--input" } )
.description( "input file, must be a supported file format..." )
.required( true );
// open the image from disk...
std::vector< std::uint8_t > image;
cli_parser.add_argument()
.names( { "-s", "--symbols" } )
.description( "path to symbols file, must be a supported file format... pdb, map, etc..." );
llo::lloiff_t iff( file_name );
llo::s1::dctor_pe_t pe_dctor( image );
cli_parser.enable_help();
auto err = cli_parser.parse( argc, argv );
if ( err )
{
std::cout << err << std::endl;
cli_parser.print_help();
return -1;
}
std::printf( "> iff name = %s, hash = 0x%p\n", iff.get_name().get_data().c_str(), iff.get_name().get_hash() );
auto file_name{ cli_parser.get< std::string >( "input" ) };
if ( !pe_dctor.generate( iff ) )
if ( !std::filesystem::exists( file_name ) )
{
std::printf( "> failed to generate iff...\n" );
std::printf( "[!] input file does not exist...\n" );
return -1;
}
const auto &iff_sections = iff.get_sections();
for ( auto &section : iff_sections )
std::vector< std::uint8_t > image;
if ( !llo::utils::open_binary_file( file_name, image ) )
{
std::printf( "> section name = %s, section uq hash = 0x%p\n", section.section_name.get_data().c_str(),
section.section_name.get_unique_hash() );
std::printf( "[!] failed to read file off disk...\n" );
return -1;
}
for ( auto &symbol : section.symbols )
std::shared_ptr< llo::s1::symbol_loader_base_t > symbol_loader = nullptr;
if ( cli_parser.exists( "symbols" ) )
{
std::filesystem::path symbols_file{ cli_parser.get< std::string >( "symbols" ) };
if ( symbols_file.extension().compare( ".map" ) )
{
symbol_loader = std::make_shared< llo::s1::symbol_loader_map_t >( symbols_file.string() );
}
else if ( symbols_file.extension().compare( ".pdb" ) )
{
std::printf( "> symbol type = %d, symbol size = 0x%x\n", symbol.get_type(), symbol.get_size() );
// TODO:
// symbol_loader = std::make_shared< llo::s1::symbol_loader_pdb_t >( symbols_file );
}
}
std::shared_ptr< llo::s1::dctor_base_t > file_dctor = nullptr;
std::filesystem::path file_path{ file_name };
if ( file_path.extension().compare( ".exe" ) || file_path.extension().compare( ".dll" ) ||
file_path.extension().compare( ".sys" ) )
{
file_dctor = std::make_shared< llo::s1::dctor_pe_t >( image, symbol_loader.get() );
}
else if ( file_path.extension().compare( ".o" ) )
{
// TODO: elf file format...
return -1;
}
else
{
std::printf( "[!] unknown file extension: %s\n", file_path.extension().c_str() );
return -1;
}
llo::lloiff_t iff( file_name );
file_dctor->generate( iff );
std::printf( "> number of sections = %d\n", iff.get_sections().size() );
}
Loading…
Cancel
Save