ImportDirectory Class Template Reference

Class that handles import directories. More...

#include <ImportDirectory.h>

List of all members.

Public Member Functions
int	addFunction (const std::string &strFilename, const std::string &strFuncname)
	Add a function to the import directory.
int	addFunction (const std::string &strFilename, word wHint)
	Add a function to the import directory.
unsigned int	getFileIndex (const std::string &strFilename, currdir cdDir) const
	Get the ID of a file through it's name.
std::string	getFileName (dword dwFilenr, currdir cdDir) const
	Get the name of an imported file.
dword	getFirstThunk (dword dwFilenr, currdir cdDir) const
	Returns the FirstThunk value of a file.
dword	getFirstThunk (const std::string &strFilename, currdir cdDir) const
	Returns the FirstThunk value of a file.
dword	getFirstThunk (dword dwFilenr, dword dwFuncnr, currdir cdDir) const
	Returns the FirstThunk value of a function.
dword	getForwarderChain (dword dwFilenr, currdir cdDir) const
	Returns the ForwarderChain value of a file.
dword	getForwarderChain (const std::string &strFilename, currdir cdDir) const
	Returns the ForwarderChain value of a file.
word	getFunctionHint (dword dwFilenr, dword dwFuncnr, currdir cdDir) const
	Get the hint of an imported function.
unsigned int	getFunctionIndex (const std::string &strFilename, const std::string &strFuncname, currdir cdDir) const
	Get the ID of a function through it's name.
std::string	getFunctionName (dword dwFilenr, dword dwFuncnr, currdir cdDir) const
	Get the name of an imported function.
dword	getNumberOfFiles (currdir cdDir) const
	Get the number of files which are imported.
dword	getNumberOfFunctions (dword dwFilenr, currdir cdDir) const
	Get the number of fucntions which are imported by a specific file.
dword	getOriginalFirstThunk (dword dwFilenr, currdir cdDir) const
	Returns the OriginalFirstThunk value of a file.
dword	getOriginalFirstThunk (const std::string &strFilename, currdir cdDir) const
	Returns the OriginalFirstThunk value of a file.
dword	getOriginalFirstThunk (dword dwFilenr, dword dwFuncnr, currdir cdDir) const
	Returns the OriginalFirstThunk value of a function.
dword	getRvaOfName (dword dwFilenr, currdir cdDir) const
dword	getRvaOfName (const std::string &strFilename, currdir cdDir) const
dword	getTimeDateStamp (dword dwFilenr, currdir cdDir) const
	Returns the TimeDateStamp value of a file.
dword	getTimeDateStamp (const std::string &strFilename, currdir cdDir) const
	Returns the TimeDateStamp value of a file.
int	read (const std::string &strFilename, unsigned int uiOffset, unsigned int uiSize, const PeHeaderT< bits > &pehHeader)
	Read a file's import directory.
void	rebuild (std::vector< byte > &vBuffer, dword dwRva, bool fixEntries=true) const
	Rebuild the import directory.
int	removeFile (const std::string &strFilename)
	Remove a file from the import directory.
int	removeFunction (const std::string &strFilename, word wHint)
	Remove a function from the import directory.
int	removeFunction (const std::string &strFilename, const std::string &strFuncname)
	Remove a function from the import directory.
void	setFileName (dword filenr, currdir dir, const std::string &name)
void	setFirstThunk (dword dwFilenr, currdir cdDir, dword value)
void	setFirstThunk (dword dwFilenr, dword dwFuncnr, currdir cdDir, dword value)
void	setForwarderChain (dword dwFilenr, currdir cdDir, dword value)
void	setFunctionHint (dword dwFilenr, dword dwFuncnr, currdir cdDir, word value)
void	setFunctionName (dword dwFilenr, dword dwFuncnr, currdir cdDir, const std::string &functionName)
void	setOriginalFirstThunk (dword dwFilenr, currdir cdDir, dword value)
void	setOriginalFirstThunk (dword dwFilenr, dword dwFuncnr, currdir cdDir, dword value)
void	setRvaOfName (dword dwFilenr, currdir cdDir, dword value)
void	setTimeDateStamp (dword dwFilenr, currdir cdDir, dword value)
unsigned int	size () const
	Returns the size of the current import directory.
int	write (const std::string &strFilename, unsigned int uiOffset, unsigned int uiRva)
	Writes the import directory to a file.
Private Types
typedef std::vector< PELIB_IMAGE_IMPORT_DIRECTORY< bits > >::const_iterator	ConstImpDirFileIterator
typedef std::vector< PELIB_IMAGE_IMPORT_DIRECTORY< bits > >::iterator	ImpDirFileIterator
Private Member Functions
template<typename T> bool	hasFunction (std::string strFilename, T value, bool(PELIB_THUNK_DATA< bits >::*comp)(T) const) const
	Tests if a certain function is imported.
Private Attributes
std::vector< PELIB_IMAGE_IMPORT_DIRECTORY< bits > >	m_vNewiid
	Stores information about imported DLLs which will be added.
std::vector< PELIB_IMAGE_IMPORT_DIRECTORY< bits > >	m_vOldiid
	Stores information about already imported DLLs.

---

Detailed Description

template<int bits>
class PeLib::ImportDirectory< bits >

Class that handles import directories.

This class can read import directories from existing PE files or start completely from scratch. Modifying import directories and writing them to files is also possible. It's worthy to note that many functions require an extra parameter of type currdir because the structure of import directories make it necessary that the OLDDIR import directory must be preserved. That's why some functions (like adding and removing) imported functions only exist for the new import directory, not for the one which is already written to the file.

Todo:

Adding functions by ordinal doesn't work yet (rebuild needs to be changed).

Somehow store the rvas of the chunks in the file.

---

Member Function Documentation

int addFunction (  const std::string &  strFilename, const std::string &  strFuncname )

Add a function to the import directory. Add a function to the Import Directory. Parameters: strFilename  Name of the file which will be imported strFuncname  Name of the function which will be imported.

int addFunction (  const std::string &  strFilename, word  wHint )

Add a function to the import directory. Add another import (by Ordinal) to the current file. Note that the import table is not automatically updated. The new imported functions will be added when you recalculate the import table as it's necessary to specify the address the import table will have in the file. Parameters: strFilename  The name of a DLL. wHint  The ordinal of the function in the DLL.

unsigned int getFileIndex (  const std::string &  strFilename, currdir  cdDir )  const

Get the ID of a file through it's name. Searches through the import directory and returns the number of the import directory entry which belongs to the given filename. Parameters: strFilename  Name of the imported file. cdDir  Flag to decide if the OLDDIR or new import directory is used. Returns: The ID of an imported file.

std::string getFileName (  dword  dwFilenr, currdir  cdDir )  const

Get the name of an imported file. Get the name of an imported file. Parameters: dwFilenr  Identifies which file should be checked. cdDir  Flag to decide if the OLDDIR or new import directory is used. Returns: Name of an imported file.

dword getFirstThunk (  dword  dwFilenr, currdir  cdDir )  const

Returns the FirstThunk value of a file. Parameters: strFilename  Name of the imported file. cdDir  Flag to decide if the OLDDIR or new import directory is used. Returns: FirstThunk value of an imported file.

dword getFirstThunk (  const std::string &  strFilename, currdir  cdDir )  const

Returns the FirstThunk value of a file. Parameters: strFilename  Name of the imported file. cdDir  Flag to decide if the OLDDIR or new import directory is used. Returns: FirstThunk value of an imported file.

dword getFirstThunk (  dword  dwFilenr, dword  dwFuncnr, currdir  cdDir )  const

Returns the FirstThunk value of a function. Parameters: dwFilenr  ID of the imported file. dwFuncnr  ID of the imported function. cdDir  Flag to decide if the OLDDIR or new import directory is used. Returns: FirstThunk value of an imported function.

dword getForwarderChain (  dword  dwFilenr, currdir  cdDir )  const

Returns the ForwarderChain value of a file. Parameters: strFilename  Name of the imported file. cdDir  Flag to decide if the OLDDIR or new import directory is used. Returns: ForwarderChain value of an imported file.

dword getForwarderChain (  const std::string &  strFilename, currdir  cdDir )  const

Returns the ForwarderChain value of a file. Parameters: strFilename  Name of the imported file. cdDir  Flag to decide if the OLDDIR or new import directory is used. Returns: ForwarderChain value of an imported file.

word getFunctionHint (  dword  dwFilenr, dword  dwFuncnr, currdir  cdDir )  const

Get the hint of an imported function. Get the hint of an imported function. Parameters: dwFilenr  Identifies which file should be checked. dwFuncnr  Identifies which function should be checked. cdDir  Flag to decide if the OLDDIR or new import directory is used. Returns: Hint of an imported function.

unsigned int getFunctionIndex (  const std::string &  strFilename, const std::string &  strFuncname, currdir  cdDir )  const

Get the ID of a function through it's name. Searches through an imported file for a specific function. Parameters: strFilename  Name of the imported file. strFuncname  Name of the imported function. cdDir  Flag to decide if the OLDDIR or new import directory is used. Returns: ID of the imported function.

std::string getFunctionName (  dword  dwFilenr, dword  dwFuncnr, currdir  cdDir )  const

Get the name of an imported function. Get the name of an imported function. Parameters: dwFilenr  Identifies which file should be checked. dwFuncnr  Identifies which function should be checked. cdDir  Flag to decide if the OLDDIR or new import directory is used. Returns: Name of an imported function. Todo: Marked line is unsafe (function should be rewritten).

dword getNumberOfFiles (  currdir  cdDir  )  const

Get the number of files which are imported. Get the number of files which are currently being imported. Parameters: cdDir  Flag to decide if the OLDDIR or new import directory is used. Returns: Number of files which are currently being imported.

dword getNumberOfFunctions (  dword  dwFilenr, currdir  cdDir )  const

Get the number of fucntions which are imported by a specific file. Get the number of functions which are currently being imported from a specific file. Parameters: dwFilenr  Identifies which file should be checked. cdDir  Flag to decide if the OLDDIR or new import directory is used. Returns: Number of functions which are currently being imported from a specific file.

dword getOriginalFirstThunk (  dword  dwFilenr, currdir  cdDir )  const

Returns the OriginalFirstThunk value of a file. Parameters: strFilename  Name of the imported file. cdDir  Flag to decide if the OLDDIR or new import directory is used. Returns: OriginalFirstThunk value of an imported file.

dword getOriginalFirstThunk (  const std::string &  strFilename, currdir  cdDir )  const

Returns the OriginalFirstThunk value of a file. Parameters: strFilename  Name of the imported file. cdDir  Flag to decide if the OLDDIR or new import directory is used. Returns: OriginalFirstThunk value of an imported file.

dword getOriginalFirstThunk (  dword  dwFilenr, dword  dwFuncnr, currdir  cdDir )  const

Returns the OriginalFirstThunk value of a function. Parameters: dwFilenr  ID of the imported file. dwFuncnr  ID of the imported function. cdDir  Flag to decide if the OLDDIR or new import directory is used. Returns: OriginalFirstThunk value of an imported function.

dword getTimeDateStamp (  dword  dwFilenr, currdir  cdDir )  const

Returns the TimeDateStamp value of a file. Parameters: strFilename  Name of the imported file. cdDir  Flag to decide if the OLDDIR or new import directory is used. Returns: TimeDateStamp value of an imported file.

dword getTimeDateStamp (  const std::string &  strFilename, currdir  cdDir )  const

Returns the TimeDateStamp value of a file. Parameters: strFilename  Name of the imported file. cdDir  Flag to decide if the OLDDIR or new import directory is used. Returns: TimeDateStamp value of an imported file.

int read (  const std::string &  strFilename, unsigned int  uiOffset, unsigned int  uiSize, const PeHeaderT< bits > &  pehHeader )

Read a file's import directory. Read an import directory from a file. Todo: Check if streams failed. Parameters: strFilename  Name of the file which will be read. uiOffset  Offset of the import directory (see #PeLib::PeHeader::getIDImportRVA). uiSize  Size of the import directory (see #PeLib::PeHeader::getIDImportSize). pehHeader  A valid PE header. Here is the call graph for this function:

void rebuild (  std::vector< byte > &  vBuffer, dword  dwRva, bool  fixEntries = true )  const

Rebuild the import directory. Rebuilds the import directory. Parameters: vBuffer  Buffer the rebuilt import directory will be written to. dwRva  The RVA of the ImportDirectory in the file. Todo: uiSizeoffuncnames is not used.

int removeFile (  const std::string &  strFilename  )

Remove a file from the import directory. Removes a specific file and all functions of it from the import directory. Parameters: strFilename  Name of the file which will be removed.

int removeFunction (  const std::string &  strFilename, word  wHint )

Remove a function from the import directory. Removes a specific function from the import directory. Parameters: strFilename  Name of the file which exports the function. wHint  The hint of the function.

int removeFunction (  const std::string &  strFilename, const std::string &  strFuncname )

Remove a function from the import directory. Removes a specific function from the import directory. Parameters: strFilename  Name of the file which exports the function. strFuncname  Name of the imported function.

unsigned int size (   )  const

Returns the size of the current import directory. Returns the size of the import directory. Returns: Size of the import directory.

int write (  const std::string &  strFilename, unsigned int  uiOffset, unsigned int  uiRva )

Writes the import directory to a file. Writes the current import directory to a file. Parameters: strFilename  Name of the file. uiOffset  File Offset of the new import directory. uiRva  RVA which belongs to that file offset.

---

The documentation for this class was generated from the following file:

• ImportDirectory.h

---