hoshimin / formatpe Goto Github PK
View Code? Open in Web Editor NEWA bunch of parsers for PE and PDB formats in C++
License: MIT License
formatpe's People
Contributors
Stargazers
Watchers
Forkers
crackercat ltears fengjixuchui qazxsw1597532018 kycgni keybode taodaqiao hugmyndakassi longloo piaoyunsoft clayne twostars killvxk k3v1n1990s wbaby shaovoon nicelnicel doytsujin tzf-omkey yang-zhiyuan supertanglang hanhanname 0x738a yuaom backuphouse zaronz kernullist cvlabsio shonker ttkko peiga lainswork tendolee lizhuowu archar123 sarvex gavz y11en webstorage119 darkersquirrel yamanekazuma tahatavakolitformatpe's Issues
Enable Parallel download
Downloading multiple files at the same time
Bug in const typename GenericTypes::FnImageTlsCallback* callbacks() const noexcept {}
This fnc ignore use the rva；
Modify：
const typename GenericTypes::FnImageTlsCallback* callbacks() const noexcept {
return valid() ? (m_pe.byRva(m_directory->AddressOfCallBacks))
: nullptr;
//return valid() ? reinterpret_cast<typename GenericTypes::FnImageTlsCallback*>(m_directory->AddressOfCallBacks)
// : nullptr;
}
？
Big-endian support
Hello
I'm trying to use this library to parse windows dll/exe/sys files on Big-endian linux system
But unfortunately, it does not support reversed byte order now
A lot of errors when compiling for ANSI support
Pe/Pe.hpp:2052:13: warning: multi-character character constant [-Wmultichar]
pdb70 = 'SDSR', // RSDS
^~~~~~
Pe/Pe.hpp:2053:13: warning: multi-character character constant [-Wmultichar]
pdb20 = '01BN', // NB10
^~~~~~
In file included from main.cpp:40:0:
Pe/Pe.hpp:47:69: warning: 'nodiscard' attribute directive ignored [-Wattributes]
[[nodiscard]] constexpr T&& forward(remove_reference_t<T>& arg) noexcept
^~~~~~~~
Pe/Pe.hpp:53:70: warning: 'nodiscard' attribute directive ignored [-Wattributes]
[[nodiscard]] constexpr T&& forward(remove_reference_t<T>&& arg) noexcept
^~~~~~~~
Pe/Pe.hpp: In member function 'Pe::RelocType Pe::Reloc::type() const':
Pe/Pe.hpp:119:14: error: 'IMAGE_REL_BASED_DIR64' was not declared in this scope
case IMAGE_REL_BASED_DIR64 : return RelocType::dir64;
^~~~~~~~~~~~~~~~~~~~~
Pe/Pe.hpp: At global scope:
Pe/Pe.hpp:274:31: error: 'IMAGE_DELAYLOAD_DESCRIPTOR' was not declared in this scope
using DirDelayedImports = Dir<IMAGE_DELAYLOAD_DESCRIPTOR, IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT>;
^~~~~~~~~~~~~~~~~~~~~~~~~~
Pe/Pe.hpp:274:93: error: template argument 1 is invalid
using DirDelayedImports = Dir<IMAGE_DELAYLOAD_DESCRIPTOR, IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT>;
^
Pe/Pe.hpp:316:34: error: unable to find numeric literal operator 'operator""ui16'
static constexpr auto k_mz = 0x5A4Dui16; // MZ
^~~~~~~~~~
Pe/Pe.hpp:317:34: error: unable to find numeric literal operator 'operator""ui32'
static constexpr auto k_pe = 0x00004550ui32; // "PE\0\0"
^~~~~~~~~~~~~~
In file included from main.cpp:40:0:
Pe/Pe.hpp:512:14: error: expected nested-name-specifier
typename DirectoryDescriptor<DirType> directory() const noexcept
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
Pe/Pe.hpp:512:43: error: invalid declarator before 'directory'
typename DirectoryDescriptor<DirType> directory() const noexcept
^~~~~~~~~
Pe/Pe.hpp: In member function 'const ImgImportByName* Pe::Imports<<anonymous> >::FunctionEntry::name() const':
Pe/Pe.hpp:803:75: error: expected '(' before '>' token
return m_lib.pe().byRva<typename GenericTypes::ImgImportByName>(rva);
^
Pe/Pe.hpp: In member function 'const char* Pe::Imports<<anonymous> >::ModuleEntry::libName() const':
Pe/Pe.hpp:875:31: error: expected primary-expression before 'char'
return m_pe.byRva<char>(m_descriptor->Name);
^~~~
Pe/Pe.hpp:875:31: error: expected ';' before 'char'
Pe/Pe.hpp:875:35: error: expected unqualified-id before '>' token
return m_pe.byRva<char>(m_descriptor->Name);
^
Pe/Pe.hpp: In member function 'const typename Pe::Types<arch>::ImportAddressTableEntry* Pe::Imports<<anonymous> >::ModuleEntry::importAddressTable() const':
Pe/Pe.hpp:881:76: error: expected '(' before '>' token
return m_pe.byRva<typename Types<arch>::ImportAddressTableEntry>(m_descriptor->FirstThunk);
^
Pe/Pe.hpp: In member function 'const typename Pe::Types<arch>::ImportLookupTableEntry* Pe::Imports<<anonymous> >::ModuleEntry::importLookupTable() const':
Pe/Pe.hpp:887:75: error: expected '(' before '>' token
return m_pe.byRva<typename Types<arch>::ImportLookupTableEntry>(m_descriptor->OriginalFirstThunk);
^
Pe/Pe.hpp: In member function 'Pe::DirectoryDescriptor<Pe::Dir<_IMAGE_IMPORT_DESCRIPTOR, 1u> > Pe::Imports<<anonymous> >::descriptor() const':
Pe/Pe.hpp:940:41: error: expected primary-expression before '>' token
return m_pe.directory<DirImports>();
^
Pe/Pe.hpp:940:43: error: expected primary-expression before ')' token
return m_pe.directory<DirImports>();
^
Pe/Pe.hpp: At global scope:
Pe/Pe.hpp:1063:24: error: 'DirDelayedImports' has not been declared
const typename DirDelayedImports::Type* m_descriptor;
^~~~~~~~~~~~~~~~~
Pe/Pe.hpp:1066:56: error: 'DirDelayedImports' has not been declared
ModuleEntry(const Pe<arch>& pe, const typename DirDelayedImports::Type* const descriptor) noexcept
^~~~~~~~~~~~~~~~~
Pe/Pe.hpp:1077:24: error: 'DirDelayedImports' has not been declared
const typename DirDelayedImports::Type* descriptor() const noexcept
^~~~~~~~~~~~~~~~~
Pe/Pe.hpp:1146:25: error: 'DirDelayedImports' was not declared in this scope
DirectoryDescriptor<DirDelayedImports> descriptor() const noexcept
^~~~~~~~~~~~~~~~~
Pe/Pe.hpp:1146:42: error: template argument 1 is invalid
DirectoryDescriptor<DirDelayedImports> descriptor() const noexcept
^
Pe/Pe.hpp: In member function 'const ImgImportByName* Pe::DelayedImports<<anonymous> >::FunctionEntry::name() const':
Pe/Pe.hpp:1022:75: error: expected '(' before '>' token
return m_lib.pe().byRva<typename GenericTypes::ImgImportByName>(rva);
^
Pe/Pe.hpp: In member function 'bool Pe::DelayedImports<<anonymous> >::ModuleEntry::valid() const':
Pe/Pe.hpp:1084:50: error: request for member 'DllNameRVA' in '((const Pe::DelayedImports<<anonymous> >::ModuleEntry*)this)->Pe::DelayedImports<<anonymous> >::ModuleEntry::m_descriptor->', which is of non-class type 'const int'
return m_descriptor && m_descriptor->DllNameRVA;
^~~~~~~~~~
Pe/Pe.hpp: In member function 'const char* Pe::DelayedImports<<anonymous> >::ModuleEntry::moduleName() const':
Pe/Pe.hpp:1089:31: error: expected primary-expression before 'char'
return m_pe.byRva<char>(m_descriptor->DllNameRVA);
^~~~
Pe/Pe.hpp:1089:31: error: expected ';' before 'char'
Pe/Pe.hpp:1089:35: error: expected unqualified-id before '>' token
return m_pe.byRva<char>(m_descriptor->DllNameRVA);
^
Pe/Pe.hpp: In member function 'const typename Pe::Types<arch>::ImportAddressTableEntry* Pe::DelayedImports<<anonymous> >::ModuleEntry::importAddressTable() const':
Pe/Pe.hpp:1095:76: error: expected '(' before '>' token
return m_pe.byRva<typename Types<arch>::ImportAddressTableEntry>(m_descriptor->ImportAddressTableRVA);
^
Pe/Pe.hpp:1095:92: error: request for member 'ImportAddressTableRVA' in '((const Pe::DelayedImports<<anonymous> >::ModuleEntry*)this)->Pe::DelayedImports<<anonymous> >::ModuleEntry::m_descriptor->', which is of non-class type 'const int'
return m_pe.byRva<typename Types<arch>::ImportAddressTableEntry>(m_descriptor->ImportAddressTableRVA);
^~~~~~~~~~~~~~~~~~~~~
Pe/Pe.hpp: In member function 'const typename Pe::Types<arch>::ImportNameTableEntry* Pe::DelayedImports<<anonymous> >::ModuleEntry::importNameTable() const':
Pe/Pe.hpp:1101:73: error: expected '(' before '>' token
return m_pe.byRva<typename Types<arch>::ImportNameTableEntry>(m_descriptor->ImportNameTableRVA);
^
Pe/Pe.hpp:1101:89: error: request for member 'ImportNameTableRVA' in '((const Pe::DelayedImports<<anonymous> >::ModuleEntry*)this)->Pe::DelayedImports<<anonymous> >::ModuleEntry::m_descriptor->', which is of non-class type 'const int'
return m_pe.byRva<typename Types<arch>::ImportNameTableEntry>(m_descriptor->ImportNameTableRVA);
^~~~~~~~~~~~~~~~~~
Pe/Pe.hpp: In member function 'int Pe::DelayedImports<<anonymous> >::descriptor() const':
Pe/Pe.hpp:1148:31: error: 'DirDelayedImports' was not declared in this scope
return m_pe.directory<DirDelayedImports>();
^~~~~~~~~~~~~~~~~
Pe/Pe.hpp:1148:50: error: expected primary-expression before ')' token
return m_pe.directory<DirDelayedImports>();
^
Pe/Pe.hpp: In member function 'Pe::DirectoryDescriptor<Pe::Dir<_IMAGE_BOUND_IMPORT_DESCRIPTOR, 11u> > Pe::BoundImports<<anonymous> >::descriptor() const':
Pe/Pe.hpp:1345:46: error: expected primary-expression before '>' token
return m_pe.directory<DirBoundImports>();
^
Pe/Pe.hpp:1345:48: error: expected primary-expression before ')' token
return m_pe.directory<DirBoundImports>();
^
Pe/Pe.hpp: In member function 'const char* Pe::Exports<<anonymous> >::FunctionEntry::name() const':
Pe/Pe.hpp:1419:40: error: expected primary-expression before 'char'
? m_exports.pe().byRva<char>(*m_name)
^~~~
Pe/Pe.hpp:1419:40: error: expected ':' before 'char'
Pe/Pe.hpp:1419:40: error: expected primary-expression before 'char'
Pe/Pe.hpp:1419:40: error: expected ';' before 'char'
Pe/Pe.hpp:1419:44: error: expected unqualified-id before '>' token
? m_exports.pe().byRva<char>(*m_name)
^
Pe/Pe.hpp: In member function 'const void* Pe::Exports<<anonymous> >::FunctionEntry::address() const':
Pe/Pe.hpp:1435:41: error: expected primary-expression before 'void'
return m_exports.pe().byRva<void>(exportAddressTableEntry()->address);
^~~~
Pe/Pe.hpp:1435:41: error: expected ';' before 'void'
Pe/Pe.hpp:1435:45: error: expected unqualified-id before '>' token
return m_exports.pe().byRva<void>(exportAddressTableEntry()->address);
^
Pe/Pe.hpp: In member function 'const char* Pe::Exports<<anonymous> >::FunctionEntry::forwarder() const':
Pe/Pe.hpp:1445:41: error: expected primary-expression before 'char'
return m_exports.pe().byRva<char>(exportAddressTableEntry()->forwarderString);
^~~~
Pe/Pe.hpp:1445:41: error: expected ';' before 'char'
Pe/Pe.hpp:1445:45: error: expected unqualified-id before '>' token
return m_exports.pe().byRva<char>(exportAddressTableEntry()->forwarderString);
^
Pe/Pe.hpp: In constructor 'Pe::Exports<<anonymous> >::Exports(const Pe::Pe<arch>&)':
Pe/Pe.hpp:1538:72: error: expected '(' before '>' token
, m_descriptor(m_directory ? pe.byRva<typename DirExports::Type>(m_directory->VirtualAddress) : nullptr)
^
Pe/Pe.hpp:1541:15: error: expected primary-expression before '{' token
{
^
Pe/Pe.hpp:1541:15: error: expected ':' before '{' token
Pe/Pe.hpp:1541:15: error: expected primary-expression before '{' token
Pe/Pe.hpp: In member function 'const char* Pe::Exports<<anonymous> >::moduleName() const':
Pe/Pe.hpp:1595:27: error: expected primary-expression before 'char'
return m_pe.byRva<char>(rva);
^~~~
Pe/Pe.hpp:1595:27: error: expected ';' before 'char'
Pe/Pe.hpp:1595:31: error: expected unqualified-id before '>' token
return m_pe.byRva<char>(rva);
^
Pe/Pe.hpp: In lambda function:
Pe/Pe.hpp:1627:31: error: expected primary-expression before 'char'
return m_pe.byRva<char>(rva);
^~~~
Pe/Pe.hpp:1627:31: error: expected ';' before 'char'
Pe/Pe.hpp:1627:35: error: expected unqualified-id before '>' token
return m_pe.byRva<char>(rva);
^
Pe/Pe.hpp: In member function 'Pe::Exports<<anonymous> >::Export Pe::Exports<<anonymous> >::find(const char*) const':
Pe/Pe.hpp:1662:26: error: expected primary-expression before '(' token
return Export(m_pe.byRva<void>(exportEntry.address), unbiasedOrdinal + ordinalBase(), ExportType::exact);
^
Pe/Pe.hpp:1662:38: error: expected primary-expression before 'void'
return Export(m_pe.byRva<void>(exportEntry.address), unbiasedOrdinal + ordinalBase(), ExportType::exact);
^~~~
Pe/Pe.hpp:1662:38: error: expected ')' before 'void'
Pe/Pe.hpp:1666:26: error: expected primary-expression before '(' token
return Export(m_pe.byRva<void>(exportEntry.forwarderString), unbiasedOrdinal + ordinalBase(), ExportType::forwarder);
^
Pe/Pe.hpp:1666:38: error: expected primary-expression before 'void'
return Export(m_pe.byRva<void>(exportEntry.forwarderString), unbiasedOrdinal + ordinalBase(), ExportType::forwarder);
^~~~
Pe/Pe.hpp:1666:38: error: expected ')' before 'void'
Pe/Pe.hpp: In member function 'Pe::Exports<<anonymous> >::Export Pe::Exports<<anonymous> >::find(unsigned int) const':
Pe/Pe.hpp:1686:26: error: expected primary-expression before '(' token
return Export(m_pe.byRva<void>(exportEntry.address), unbiasedOrdinal + ordinalBase(), ExportType::exact);
^
Pe/Pe.hpp:1686:38: error: expected primary-expression before 'void'
return Export(m_pe.byRva<void>(exportEntry.address), unbiasedOrdinal + ordinalBase(), ExportType::exact);
^~~~
Pe/Pe.hpp:1686:38: error: expected ')' before 'void'
Pe/Pe.hpp:1690:26: error: expected primary-expression before '(' token
return Export(m_pe.byRva<void>(exportEntry.forwarderString), unbiasedOrdinal + ordinalBase(), ExportType::forwarder);
^
Pe/Pe.hpp:1690:38: error: expected primary-expression before 'void'
return Export(m_pe.byRva<void>(exportEntry.forwarderString), unbiasedOrdinal + ordinalBase(), ExportType::forwarder);
^~~~
Pe/Pe.hpp:1690:38: error: expected ')' before 'void'
Pe/Pe.hpp: In member function 'const void* Pe::Relocs<<anonymous> >::PageEntry::page() const':
Pe/Pe.hpp:1774:40: error: expected primary-expression before 'void'
return m_relocs.pe().byRva<void>(m_entry->VirtualAddress);
^~~~
Pe/Pe.hpp:1774:40: error: expected ';' before 'void'
Pe/Pe.hpp:1774:44: error: expected unqualified-id before '>' token
return m_relocs.pe().byRva<void>(m_entry->VirtualAddress);
^
Pe/Pe.hpp: In constructor 'Pe::Relocs<<anonymous> >::Relocs(const Pe::Pe<arch>&)':
Pe/Pe.hpp:1823:46: error: expected primary-expression before '>' token
, m_descriptor(pe.directory<DirRelocs>())
^
Pe/Pe.hpp:1823:48: error: expected primary-expression before ')' token
, m_descriptor(pe.directory<DirRelocs>())
^
Pe/Pe.hpp: In constructor 'Pe::Exceptions<<anonymous> >::Exceptions(const Pe::Pe<arch>&)':
Pe/Pe.hpp:1899:50: error: expected primary-expression before '>' token
: m_descriptor(pe.directory<DirExceptions>())
^
Pe/Pe.hpp:1899:52: error: expected primary-expression before ')' token
: m_descriptor(pe.directory<DirExceptions>())
^
Pe/Pe.hpp: In member function 'void (__attribute__((__stdcall__)) * Pe::Tls<<anonymous> >::CallbackEntry::callback() const)(PVOID, DWORD, PVOID)':
Pe/Pe.hpp:1946:92: error: expected primary-expression before 'void'
return static_cast<typename GenericTypes::FnImageTlsCallback>(m_tls.pe().byRva<void>(rva));
^~~~
Pe/Pe.hpp:1946:92: error: expected ')' before 'void'
Pe/Pe.hpp:1946:92: error: expected ';' before 'void'
Pe/Pe.hpp:1946:96: error: expected unqualified-id before '>' token
return static_cast<typename GenericTypes::FnImageTlsCallback>(m_tls.pe().byRva<void>(rva));
^
Pe/Pe.hpp: In constructor 'Pe::Tls<<anonymous> >::Tls(const Pe::Pe<arch>&)':
Pe/Pe.hpp:1975:47: error: expected primary-expression before '>' token
, m_directory(pe.directory<DirTls<arch>>())
^~
Pe/Pe.hpp:1975:50: error: expected primary-expression before ')' token
, m_directory(pe.directory<DirTls<arch>>())
^
Pe/Pe.hpp: In member function 'void (__attribute__((__stdcall__)) * const* Pe::Tls<<anonymous> >::callbacks() const)(PVOID, DWORD, PVOID)':
Pe/Pe.hpp:2005:72: error: expected '(' before '>' token
return m_pe.byRva<typename GenericTypes::FnImageTlsCallback>(static_cast<Rva>(m_directory.ptr->AddressOfCallBacks - m_pe.imageBase()));
^
Pe/Pe.hpp: In constructor 'Pe::Debug<<anonymous> >::Debug(const Pe::Pe<arch>&)':
Pe/Pe.hpp:2124:45: error: expected primary-expression before '>' token
, m_descriptor(pe.directory<DirDebug>())
^
Pe/Pe.hpp:2124:47: error: expected primary-expression before ')' token
, m_descriptor(pe.directory<DirDebug>())
^
Pe/Pe.hpp: In member function 'const Pe::CodeView::DebugInfo* Pe::Debug<<anonymous> >::findPdbDebugInfo() const':
Pe/Pe.hpp:2167:72: error: expected primary-expression before '>' token
const auto* const codeView = m_pe.byRva<CodeView::DebugInfo>(entry.debugEntry()->PointerToRawData);
^
I'm targeting for ANSI support.
Bug in the Union ImportAddressTableEntry
Modify：
union ImportAddressTableEntry {
unsigned long long raw;
ImgThunkData thunk;
struct {
Rva hintNameRva : 31;
} name;
struct {
unsigned long long ord : 16;
} ordinal;
struct {
unsigned long long reserved : 63;
unsigned long long importByOrdinal : 1;
};
}
32-bit process parsing missing exported functions
For example ntopenprocess
void getExportFunction() {
const HMODULE hModule = GetModuleHandleW(L"ntdll.dll");
const auto pe = Pe::PeNative::fromModule(hModule);
const auto exports = pe.exports();
printf("Exports count %u (0x%X):\n", exports.count(), exports.count());
for (const auto& exp : exports) {
switch (exp.type()) {
case Pe::ExportType::exact: {
printf("[%u] %s at %p\n", exp.ordinal(), exp.name(), exp.address());
break;
}
case Pe::ExportType::forwarder: {
printf("[%u] Forwarder: %s\n", exp.ordinal(), exp.forwarder());
break;
}
}
if (exp.hasName()) {
const auto byName = exports.find(exp.name());
assert(byName.type() == exp.type());
assert(byName.ordinal() == exp.ordinal());
switch (byName.type()) {
case Pe::ExportType::exact: {
assert(byName.address() == exp.address());
break;
}
case Pe::ExportType::forwarder: {
assert(byName.forwarder() == exp.forwarder());
break;
}
}
const auto byOrdinal = exports.find(exp.ordinal());
assert(byName.address() == byOrdinal.address());
assert(byName.ordinal() == byOrdinal.ordinal());
assert(byName.type() == byOrdinal.type());
} else {
const auto t = exp.type();
t;
const auto byOrdinal = exports.find(exp.ordinal());
if (exp.type() == Pe::ExportType::exact) {
assert(byOrdinal.address() == exp.address());
}
assert(byOrdinal.ordinal() == exp.ordinal());
assert(byOrdinal.type() == exp.type());
}
}
}Pdb::Sym::cast: Invalid type cast.
Hello, how do you convert the function?
mod.find(L"NtOpenProcess").castPdb::SymFunc();
mod.find(L"NtOpenProcess").castPdb::SymFuncArg();
Both are Pdb::Sym::cast: Invalid type cast.
about the function return
When function error, why use the throw Exception the way?
why not return result Let's us to decide ,
when i not register the Exception Handler , my program will close ,not printf anything about the debug info
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.