pefile.h

#ifndef _PEFILE_H_
#define _PEFILE_H_

// Includes
#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>
#include <string.h>
#include <tchar.h>
#include <cmath>

// Ignore
#pragma warning(disable:4311) // warning C4311: 'Typumwandlung': Zeigerverkürzung von XXX * zu XXX
#pragma warning(disable:4312) // warning C4312: 'Typumwandlung': Konvertierung von XXX in größeren Typ XXX
#pragma warning(disable:4996) // Verkürzung/Verlust
#pragma warning(disable:4244) // Verkürzung/Verlust

// Defines - Konstanten
#define PASTE_IN_CODECAVE   0x0001
#define ADD_SECTION         0x0002
#define CREATE_CAVE         0x0004

#define UPDATE_HEADERPOINTER            0x00000001
#define UPDATE_SECIONHEADERPOINTER      0x00000002
#define UPDATE_SECTIONHEADERCAVESIZE    0x00000004
#define UPDATE_EP_INFOS                 0x00000008
#define UPDATE_RELOCBLOCKINFOS          0x00000010
#define UPDATE_CODECAVEPOINTER          0x00000020
#define UPDATE_IMPORTINFOS              0x00000040
#define UPDATE_ALL                      UPDATE_HEADERPOINTER | UPDATE_SECIONHEADERPOINTER | UPDATE_SECTIONHEADERCAVESIZE | UPDATE_EP_INFOS | UPDATE_RELOCBLOCKINFOS | UPDATE_CODECAVEPOINTER | UPDATE_IMPORTINFOS

// Defines - Pointerarithmetik
#define Align(number, alignment) ((int) ceil((double) (number) / (alignment)) * (alignment))
#define BytesBetween(addr1, addr2) (((BYTE *) (addr1) <= (BYTE *) (addr2)) ? ((int) ((BYTE *) (addr2) - (BYTE *) (addr1))) : ((int) ((BYTE *) (addr1) - (BYTE *) (addr2))))
#define SectionHeaderFitBetween(addr1, addr2) ((int )floor((double) BytesBetween(addr1, addr2) / sizeof(IMAGE_SECTION_HEADER)))
#define Min(num1, num2) ((num1 <= num2) ? (num1) : (num2))
#define Max(num1, num2) ((num1 >= num2) ? (num1) : (num2))

// Defines - RawOffset Interpretationen
#define ReadBYTE(RawOffset) (*((BYTE *) &this->pbRawData[RawOffset]))
#define ReadWORD(RawOffset) (*((WORD *) &this->pbRawData[RawOffset]))
#define ReadDWORD(RawOffset) (*((DWORD *) &this->pbRawData[RawOffset]))
#define WriteBYTE(RawOffset, BYTEValue) (*((BYTE *) &this->pbRawData[RawOffset]) = (BYTEValue))
#define WriteWORD(RawOffset, WORDValue) (*((WORD *) &this->pbRawData[RawOffset]) = (WORDValue))
#define WriteDWORD(RawOffset, DWORDValue) (*((DWORD *) &this->pbRawData[RawOffset]) = (DWORDValue))

#define InInterval(RowOffset, SizeElem, Interval) ((Interval.roLowBoundary) <= (RowOffset) && ((RowOffset) + (SizeElem)) <= (Interval.roHighBoundary))

// Typedef - Strukturen
typedef struct _CODE_CAVE {
    DWORD   RawOffset;
    DWORD   dwCaveSize;
} CODE_CAVE;

typedef struct _RELOC_INTERVAL {
    DWORD   roLowBoundary;
    DWORD   roHighBoundary;
    DWORD   dwDelta;
} RELOC_INTERVAL;

// Funktionen
void fireError(const char *, ...);
void fireDebug(const char *, ...);


// PEFile - Klasse
class PEFile {
    private:
        // Interne Variablen
        char                    *szFilename;
        BYTE                    *pbRawData;
        DWORD                   dwFileSize;
        IMAGE_DOS_HEADER        *pImageDOSHeader;
        IMAGE_NT_HEADERS        *pImageNTHeaders;
        DWORD                   dwNumberOfSections;
        IMAGE_SECTION_HEADER    **ppSectionHeader;
        DWORD                   dwNumberOfSectionHeaderFitInCave;
        DWORD                   roOEP;
        DWORD                   dwSectionOfOEP;
        CODE_CAVE               *CaveArr;
        DWORD                   dwNumCodeCaves;
        DWORD                   roIBR;
        DWORD                   dwNumRelocBlocks;
        DWORD                   dwFreeBytesAfterRelocs;
        DWORD                   dwNumImportDescriptors;
        DWORD                   roImportDir;
        DWORD                   roOFT;
        DWORD                   roIAT;
        DWORD                   dwNumImportByName;
        DWORD                   dwNumImportByOrdinal;
        DWORD                   *dwNumImportsModule;

        DWORD roNthSectionHeader(__in DWORD);
        void gatherInformations(__in DWORD);

    public:
        // Konstruktoren/Destruktor
        PEFile(void);
        PEFile(__in const char *);
        ~PEFile();

        // Caves
        CODE_CAVE *findCodeCaves(__in DWORD *);
        CODE_CAVE *findNullPatterns(__in DWORD, __out DWORD *);
        CODE_CAVE *findNullPatternsInSection(__in DWORD, __in DWORD, __out DWORD *);
        bool createCodecave(__in DWORD, __in DWORD);

        // Relocations
        bool switchSections(__in DWORD, __in DWORD);
        bool switchSectionHeader(__in DWORD, __in DWORD);
        bool shuffleSections();
        bool writeAllRelocations(__in DWORD);
        bool writeRelocationsForRawOffsetInterval(__in RELOC_INTERVAL);
        bool addRelocation(__in DWORD, __in BYTE);

        // Injections
        int addSection(__in const char *, __in DWORD, __in DWORD);
        int insertCode(__in const char *, __in BYTE *, __in DWORD, __in DWORD);
        bool writePEFile(__in const char *);

        // Konverter
        DWORD getSectionIdByName(__in const char *);
        DWORD getSectionIdByRVA(__in DWORD);
        DWORD getSectionIdByRawOffset(__in DWORD);
        DWORD getRawOffsetOfSectionEnd(__in DWORD);
        DWORD getRawOffsetByRVA(__in DWORD);
        DWORD getRVAByRawOffset(__in DWORD);


        bool deleteSectionById(DWORD);

        // Get'ter
        IMAGE_NT_HEADERS *getNTHeaders();
        DWORD getEntryPointRawOffset();
        BYTE *getPointerToDataByRO(__in DWORD);
        IMAGE_SECTION_HEADER *getSectionHeaderById(__in DWORD);
        IMAGE_SECTION_HEADER *getSectionHeaderByRO(__in DWORD);
        IMAGE_SECTION_HEADER *getSectionHeaderByName(__in const char *);
        DWORD getNumberOfSections();
        DWORD getFileSize();
        CODE_CAVE *getSecEndCCByName(__in const char *);


        // Set'ter
        void setFileSize(DWORD dwFileSize);
};

#endif