Use HMODULE instead of handles for xex modules

This commit is contained in:
Dr. Chat
2015-06-27 22:00:58 -05:00
parent 1289e7ad22
commit 7372dd4d8d
5 changed files with 126 additions and 41 deletions

View File

@@ -19,6 +19,42 @@
namespace xe {
namespace kernel {
// http://www.nirsoft.net/kernel_struct/vista/LDR_DATA_TABLE_ENTRY.html
// HMODULE points to this struct!
struct X_LDR_DATA_TABLE_ENTRY {
X_LIST_ENTRY in_load_order_links; // 0x0
X_LIST_ENTRY in_memory_order_links; // 0x8
X_LIST_ENTRY in_initialization_order_links; // 0x10
xe::be<uint32_t> dll_base; // 0x18
xe::be<uint32_t> image_base; // 0x1C
xe::be<uint32_t> image_size; // 0x20
X_UNICODE_STRING full_dll_name; // 0x24
X_UNICODE_STRING base_dll_name; // 0x2C
xe::be<uint32_t> flags; // 0x34
xe::be<uint32_t> full_image_size; // 0x38
xe::be<uint32_t> entry_point; // 0x3C
xe::be<uint16_t> load_count; // 0x40
xe::be<uint16_t> module_index; // 0x42
xe::be<uint32_t> dll_base_original; // 0x44
xe::be<uint32_t> checksum; // 0x48 hijacked to hold kernel handle
xe::be<uint32_t> load_flags; // 0x4C
xe::be<uint32_t> time_date_stamp; // 0x50
xe::be<uint32_t> loaded_imports; // 0x54
xe::be<uint32_t> xex_header_base; // 0x58
union {
X_ANSI_STRING load_file_name; // 0x5C
struct {
xe::be<uint32_t> closure_root; // 0x5C
xe::be<uint32_t> traversal_parent; // 0x60
};
};
};
class XModule : public XObject {
public:
enum class ModuleType {
@@ -37,12 +73,16 @@ class XModule : public XObject {
bool Matches(const std::string& name) const;
xe::cpu::Module* processor_module() const { return processor_module_; }
uint32_t hmodule_ptr() const { return hmodule_ptr_; }
virtual uint32_t GetProcAddressByOrdinal(uint16_t ordinal) = 0;
virtual uint32_t GetProcAddressByName(const char* name) = 0;
virtual X_STATUS GetSection(const char* name, uint32_t* out_section_data,
uint32_t* out_section_size);
static object_ref<XModule> GetFromHModule(KernelState* kernel_state, void* hmodule);
static uint32_t GetHandleFromHModule(void* hmodule);
protected:
void OnLoad();
@@ -51,6 +91,8 @@ class XModule : public XObject {
std::string path_;
xe::cpu::Module* processor_module_;
uint32_t hmodule_ptr_; // This points to LDR_DATA_TABLE_ENTRY.
};
} // namespace kernel