| 750 | } |
| 751 | |
| 752 | PE_STATUS peParseImportTable( PE *pe, uint32_t dwOptions /* = PE_IMPORT_OPT_DEFAULT */ ) |
| 753 | { |
| 754 | PE_STATUS status = PE_SUCCESS; |
| 755 | |
| 756 | if( PE_IS_PARSED( pe, IMPORTS ) == FALSE ) |
| 757 | { |
| 758 | uint32_t dwImportRVA = PE_HEADERS_OPT_FIELD( pe, DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress ), |
| 759 | dwImportSize = PE_HEADERS_OPT_FIELD( pe, DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size ); |
| 760 | |
| 761 | if( dwImportRVA != 0 && dwImportSize != 0 ) |
| 762 | { |
| 763 | PE_ADDRESS_FROM_VA |
| 764 | ( |
| 765 | pe, |
| 766 | pe->ImportTable.Address, |
| 767 | pe->qwBaseAddress + dwImportRVA |
| 768 | ); |
| 769 | |
| 770 | if( PE_IS_VALID_ADDRESS( pe->ImportTable.Address ) ) |
| 771 | { |
| 772 | pe->ImportTable.Address.Size = (uint64_t)dwImportSize; |
| 773 | |
| 774 | PIMAGE_IMPORT_DESCRIPTOR pDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)pe->ImportTable.Address.Data, |
| 775 | pImport = NULL; |
| 776 | uint32_t dwImportCount = 0, |
| 777 | dwThunkRVA; |
| 778 | // dwThunkRaw, |
| 779 | // dwRealThunkRaw; |
| 780 | |
| 781 | uint64_t qwRealThunkRaw, |
| 782 | qwThunkRaw; |
| 783 | |
| 784 | ll_init( &pe->ImportTable.Modules ); |
| 785 | |
| 786 | pe->ImportTable.ByName = HT_CREATE_BY_ISTRING(); |
| 787 | |
| 788 | for( pImport = pDescriptor, dwImportCount = 0; dwImportCount <= 96; ++pImport, ++dwImportCount ) |
| 789 | { |
| 790 | if( peIsValidImportDescriptor( pImport ) == false ) |
| 791 | { |
| 792 | break; |
| 793 | } |
| 794 | |
| 795 | dwThunkRVA = (uint32_t)( pe->qwBaseAddress + pImport->FirstThunk ); |
| 796 | qwThunkRaw = peRawOffsetByVA( pe, dwThunkRVA ); |
| 797 | |
| 798 | if( qwThunkRaw == PE_INVALID_OFFSET ) |
| 799 | continue; |
| 800 | |
| 801 | char *pszDllName = (char *)PE_GET_POINTER( pe, pImport->Name ), |
| 802 | *pszSymbolName = NULL; |
| 803 | |
| 804 | if( IsBadReadPtr( pszDllName, 1 ) ) |
| 805 | continue; |
| 806 | |
| 807 | PE_IMPORT_MODULE *pModule = (PE_IMPORT_MODULE *)ht_get( pe->ImportTable.ByName, (void *)pszDllName ); |
| 808 | |
| 809 | if( pModule == NULL ) |
no test coverage detected