• R/O
  • SSH
  • HTTPS

pefrm-units: Commit


Commit MetaInfo

Revision61 (tree)
Time2019-09-29 00:32:09
Authorquiret

Log Message

- fixed a tiny bug for x64 injection
- added setting of entry-point section to executable
- added setting to mark all injected DLL sections executable

Change Summary

Incremental Difference

--- pefrmdllembed/src/main.cpp (revision 60)
+++ pefrmdllembed/src/main.cpp (revision 61)
@@ -508,7 +508,7 @@
508508 }
509509
510510 template <typename sectResolver_t>
511-static inline std::uint32_t ResolvePESectionRVA( const PEFile::PESectionDataReference& srcRef, const sectResolver_t& resolver )
511+static inline std::uint32_t ResolvePESectionRVA( const PEFile::PESectionDataReference& srcRef, const sectResolver_t& resolver, PEFile::PESection **targetSectOut = nullptr )
512512 {
513513 PEFile::PESection *srcSect = srcRef.GetSection();
514514
@@ -519,6 +519,11 @@
519519
520520 PEFile::PESection *targetSect = resolver( srcSect );
521521
522+ if ( targetSectOut != nullptr )
523+ {
524+ *targetSectOut = targetSect;
525+ }
526+
522527 return ( targetSect->ResolveRVA( srcRef.GetSectionOffset() ) );
523528 }
524529
@@ -568,7 +573,11 @@
568573 return;
569574 }
570575
571- inline int EmbedModuleIntoExecutable( PEFile& moduleImage, bool requiresRelocations, const char *moduleImageName, bool injectMatchingImports, bool doTakeoverExports, bool doIgnoreResources, std::uint32_t archPointerSize )
576+ inline int EmbedModuleIntoExecutable(
577+ PEFile& moduleImage, bool requiresRelocations, const char *moduleImageName,
578+ bool injectMatchingImports, bool doTakeoverExports, bool doIgnoreResources, bool doFixEntrypointExecutable, bool markAllSectionsExecutable,
579+ std::uint32_t archPointerSize
580+ )
572581 {
573582 PEFile& exeImage = this->embedImage;
574583
@@ -654,6 +663,11 @@
654663 newSect.shortName = theSect->shortName;
655664 newSect.chars = theSect->chars;
656665
666+ if ( markAllSectionsExecutable )
667+ {
668+ newSect.chars.sect_mem_execute = true;
669+ }
670+
657671 size_t sectDataSize = (size_t)theSect->stream.Size();
658672
659673 theSect->stream.Seek( 0 );
@@ -837,7 +851,7 @@
837851 PEStructures::IMAGE_DATA_DIRECTORY dataDirs[ PEL_IMAGE_NUMBEROF_DIRECTORY_ENTRIES ];
838852 memset( dataDirs, 0, sizeof(dataDirs) );
839853
840- // TOOD: fill them out as necessary.
854+ // TODO: fill them out as necessary.
841855
842856 // Write the data dirs.
843857 pedataSect.stream.WriteStruct( dataDirs );
@@ -1587,12 +1601,15 @@
15871601
15881602 if ( modEntryPointRef.GetSection() != nullptr )
15891603 {
1604+ PEFile::PESection *targetModEntryPointSect;
1605+
15901606 // Call into the DLL entry point with the default parameters.
1591- std::uint32_t rvaToDLLEntryPoint = ResolvePESectionRVA( modEntryPointRef, resolveSectionLink );
1607+ std::uint32_t rvaToDLLEntryPoint = ResolvePESectionRVA( modEntryPointRef, resolveSectionLink, &targetModEntryPointSect );
15921608 {
15931609 std::uint32_t paramReserved = 0;
15941610 std::uint32_t paramReason = 1; // DLL_PROCESS_ATTACH
15951611
1612+ // Call the DLL entry point.
15961613 if ( genCodeArch == asmjit::ArchInfo::kTypeX86 )
15971614 {
15981615 x86_asm.push( paramReserved );
@@ -1602,14 +1619,10 @@
16021619 }
16031620 else if ( genCodeArch == asmjit::ArchInfo::kTypeX64 )
16041621 {
1605- // Call the DLL entry point.
16061622 x86_asm.mov( asmjit::x86::rcx, dllInstanceHandle );
16071623 x86_asm.mov( asmjit::x86::rdx, paramReason );
16081624 x86_asm.mov( asmjit::x86::r8, paramReserved );
16091625 x86_asm.call( rvaToDLLEntryPoint );
1610-
1611- // Since the next is a call that will never return, actually adjust the stack.
1612- x86_asm.sub( asmjit::x86::rsp, 8 );
16131626 }
16141627 else
16151628 {
@@ -1617,6 +1630,18 @@
16171630
16181631 return -12;
16191632 }
1633+
1634+ // If the section of the entry point is not marked executable, then we probably want to fix this here.
1635+ // This is a strange thing inside of the Win32 PE loader.
1636+ if ( doFixEntrypointExecutable )
1637+ {
1638+ if ( targetModEntryPointSect->chars.sect_mem_execute == false )
1639+ {
1640+ std::cout << "fixing module entry point section to executable" << std::endl;
1641+
1642+ targetModEntryPointSect->chars.sect_mem_execute = true;
1643+ }
1644+ }
16201645 }
16211646 }
16221647 else
@@ -1669,6 +1694,8 @@
16691694 bool doFixEntryPoint = false;
16701695 bool doInjectMatchingImports = false;
16711696 bool doTakeoverExports = true;
1697+ bool doFixEntrypointExecutable = true;
1698+ bool markAllSectionsExecutable = false;
16721699 bool doPrintHelp = false;
16731700 bool doIgnoreResources = false;
16741701
@@ -1704,6 +1731,14 @@
17041731 {
17051732 doIgnoreResources = true;
17061733 }
1734+ else if ( opt == "noentryexecfix" || opt == "noeexecfix" )
1735+ {
1736+ doFixEntrypointExecutable = false;
1737+ }
1738+ else if ( opt == "marksectexec" )
1739+ {
1740+ markAllSectionsExecutable = true;
1741+ }
17071742 else
17081743 {
17091744 std::cout << "unknown cmdline option: " << opt << std::endl;
@@ -1728,6 +1763,8 @@
17281763 std::cout << "-injimp: hooks executable imports with input DLL exports" << std::endl;
17291764 std::cout << "-noexp: does not take over DLL exports into executable" << std::endl;
17301765 std::cout << "-nores: leaves out resources from the DLL" << std::endl;
1766+ std::cout << "-noentryexecfix: prevents making sections of entry points executable if not already" << std::endl;
1767+ std::cout << "-marksectexec: marks all injected sections executable" << std::endl;
17311768 std::cout << "-help: prints this help text" << std::endl;
17321769
17331770 return 0;
@@ -2072,7 +2109,11 @@
20722109 const char *moduleFileName = FetchFileName( inputModImageName );
20732110
20742111 // Perform the embedding.
2075- int statusEmbed = asmEnv.EmbedModuleIntoExecutable( moduleImage, requiresRelocations, moduleFileName, doInjectMatchingImports, doTakeoverExports, doIgnoreResources, archPointerSize );
2112+ int statusEmbed = asmEnv.EmbedModuleIntoExecutable(
2113+ moduleImage, requiresRelocations, moduleFileName,
2114+ doInjectMatchingImports, doTakeoverExports, doIgnoreResources, doFixEntrypointExecutable, markAllSectionsExecutable,
2115+ archPointerSize
2116+ );
20762117
20772118 if ( statusEmbed != 0 )
20782119 {
Show on old repository browser