Method parse_imports

src/load.cpp:256–307

Parse the imported symbols.

// Parse the imported symbols.
BOOL cobf::parse_imports(PIMAGE_IMPORT_DESCRIPTOR p_imports, size_t imports_size)
{
    // Filling up the imported modules array.
    while (imports_size >= sizeof(IMAGE_IMPORT_DESCRIPTOR) && p_imports->Name)
    {
        // Getting the thunk array offset.
        DWORD dll_name = p_imports->Name;
        DWORD orig_th = p_imports->OriginalFirstThunk;
        DWORD first_th = p_imports->FirstThunk;
        PSIZE_T p_orig_th, p_first_th;
        PCHAR p_dll_name; size_t sym_idx = 0;
       
        // Convert the pointers.
        if ((orig_th && !this->rva_to_ptr(orig_th, (PVOID*)&p_orig_th))
            || !this->rva_to_ptr(first_th, (PVOID*)&p_first_th)
            || !this->rva_to_ptr(dll_name, (PVOID*)&p_dll_name))
        {
            // Cannot get the thunks or the name.
            return FALSE;
        };

        // Get the dll name.
        this->pe_mods.push_back({ p_dll_name });
        auto& dll_mod = this->pe_mods.back();
        transform(dll_mod.dll_name.begin(), dll_mod.dll_name.end(), 
            dll_mod.dll_name.begin(), ::toupper);

        // Loop the imports.
        PSIZE_T p_thunk = orig_th ? p_orig_th : p_first_th;
        while (*p_thunk)
        {
            // Needed attributes.
            DWORD fth_rva = first_th + (DWORD)sym_idx * sizeof(size_t);
            DWORD oth_off = (DWORD)((PBYTE)p_thunk - this->pe_rawf.data());

            // Try to insert it.
            if (!this->insert_import(this->pe_mods.back(), dll_name, *p_thunk, fth_rva, oth_off)) 
                return FALSE;

            // Calculate the next one.
            p_thunk++;
            sym_idx++;
        };

        // Move to the next module.
        imports_size -= sizeof(IMAGE_IMPORT_DESCRIPTOR);
        p_imports++;
    };

    // Done.
    return TRUE;
};

// Insert a parsed import.
BOOL cobf::insert_import(cmod& dll_mod, DWORD dll_off, size_t th_sym, DWORD fth_rva, DWORD oth_off)