archive
/
windows-server-2003
mirror of https://github.com/selfrender/Windows-Server-2003
2
0
Fork 0
Code Issues Projects Releases Wiki Activity
Leaked source code of windows server 2003
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
4 Commits
1 Branch
0 Tags
1.5 GiB
 
 
 
 
 
 
Tree: 5c6fe3db62
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '5c6fe3db62'
${ noResults }
windows-server-2003/sdktools/debuggers/imagehlp/imagechk.c

2529 lines
71 KiB
Raw Blame History

/*++
Copyright (c) 1998 Microsoft Corporation
Module Name:
imagechk.c
Abstract:
this module implements a sanity check of certain image characteristics
Author:
NT Base
Revision History:
Notes:
--*/
#ifdef __cplusplus
extern "C" {
#endif
#include <nt.h>
#include <ntrtl.h>
#include <nturtl.h>
#ifdef __cplusplus
}
#endif
//
// Calculate the size of a field in a structure of type type, without
// knowing or stating the type of the field.
//
#define RTL_FIELD_SIZE(type, field) (sizeof(((type *)0)->field))
//
// Calculate the size of a structure of type type up through and
// including a field.
//
#define RTL_SIZEOF_THROUGH_FIELD(type, field) \
(FIELD_OFFSET(type, field) + RTL_FIELD_SIZE(type, field))
#include <errno.h>
#include <direct.h>
#include <cvinfo.h>
#include <private.h>
typedef struct _SYMMODLIST{
char *ModName;
void *ModBase;
struct _SYMMODLIST *Next;
} SYMMODLIST, *PSYMMODLIST;
typedef struct List {
char Name[40];
unsigned long Attributes;
} List, *pList;
typedef struct _LogListItem {
char *LogLine;
struct _LogListItem *Next;
} LogListItem, *pLogListItem;
//
// decarations
//
VOID
FindFiles();
VOID
Imagechk(
List *rgpList,
TCHAR *szDirectory
);
VOID
ParseArgs(
int *pargc,
char **argv
);
int
__cdecl
CompFileAndDir(
const void *elem1,
const void *elem2
);
int
__cdecl
CompName(
const void *elem1,
const void *elem2
);
VOID
Usage(
VOID
);
int
_cdecl
_cwild(
VOID
);
PSYMMODLIST
MakeModList(
HANDLE
);
void
FreeModList(
PSYMMODLIST
);
BOOL
CALLBACK
SymEnumerateModulesCallback(
LPSTR,
ULONG64,
PVOID
);
void *
GetModAddrFromName(
PSYMMODLIST,
char *
);
BOOL
VerifyVersionResource(
PCHAR FileName,
BOOL fSelfRegister
);
BOOL
ValidatePdata(
PIMAGE_DOS_HEADER DosHeader
);
BOOL
ImageNeedsOleSelfRegister(
PIMAGE_DOS_HEADER DosHeader
);
NTSTATUS
MiVerifyImageHeader (
IN PIMAGE_NT_HEADERS NtHeader,
IN PIMAGE_DOS_HEADER DosHeader,
IN DWORD NtHeaderSize
);
pLogListItem
LogAppend(
char *,
pLogListItem
);
void
LogOutAndClean(
BOOL
);
void
__cdecl
LogPrintf(
const char *format,
...
);
#define X64K (64*1024)
#define MM_SIZE_OF_LARGEST_IMAGE ((ULONG)0x10000000)
#define MM_MAXIMUM_IMAGE_HEADER (2 * PageSize)
#define MM_MAXIMUM_IMAGE_SECTIONS \
((MM_MAXIMUM_IMAGE_HEADER - (4096 + sizeof(IMAGE_NT_HEADERS))) / \
sizeof(IMAGE_SECTION_HEADER))
#define MMSECTOR_SHIFT 9 //MUST BE LESS THAN OR EQUAL TO PageShift
#define MMSECTOR_MASK 0x1ff
#define MI_ROUND_TO_SIZE(LENGTH,ALIGNMENT) \
(((ULONG)LENGTH + ALIGNMENT - 1) & ~(ALIGNMENT - 1))
#define BYTES_TO_PAGES(Size) (((ULONG)(Size) >> PageShift) + \
(((ULONG)(Size) & (PageSize - 1)) != 0))
#define ArgFlag_OK 1
#define ArgFlag_CKMZ 2
#define ArgFlag_SymCK 4
#define ArgFlag_OLESelf 8
#define ArgFlag_CKBase 16
//
// file global data
//
BOOL fRecurse;
BOOL fFileOut;
BOOL fNotCurrent;
BOOL fPattern;
BOOL fSingleFile;
BOOL fPathOverride;
BOOL fSingleSlash;
BOOL fDebugMapped;
FILE* fout;
CHAR *szFileName = {"*.*"};
CHAR *pszRootDir;
CHAR *pszFileOut;
CHAR szDirectory[MAX_PATH] = {"."};
CHAR szSympath[MAX_PATH] = {0};
CHAR *szPattern;
int endpath, DirNum=1, ProcessedFiles;
ULONG PageSize;
ULONG PageShift;
PVOID HighestUserAddress;
USHORT ValidMachineIDMin;
USHORT ValidMachineIDMax;
DWORD ArgFlag;
//
// logging support
//
pLogListItem pLogList = NULL;
pLogListItem pLogListTmp = NULL;
typedef
NTSTATUS
(NTAPI *LPLDRVERIFYIMAGECHKSUM)(
IN HANDLE ImageFileHandle
);
LPLDRVERIFYIMAGECHKSUM lpOldLdrVerifyImageMatchesChecksum;
typedef
NTSTATUS
(NTAPI *LPLDRVERIFYIMAGEMATCHESCHECKSUM) (
IN HANDLE ImageFileHandle,
IN PLDR_IMPORT_MODULE_CALLBACK ImportCallbackRoutine OPTIONAL,
IN PVOID ImportCallbackParameter,
OUT PUSHORT ImageCharacteristics OPTIONAL
);
LPLDRVERIFYIMAGEMATCHESCHECKSUM lpNewLdrVerifyImageMatchesChecksum;
typedef
NTSTATUS
(NTAPI *LPNTQUERYSYSTEMINFORMATION) (
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
OUT PVOID SystemInformation,
IN ULONG SystemInformationLength,
OUT PULONG ReturnLength OPTIONAL
);
LPNTQUERYSYSTEMINFORMATION lpNtQuerySystemInformation;
OSVERSIONINFO VersionInformation;
//
// function definitions
//
VOID __cdecl
main(
int argc,
char *argv[],
char *envp[]
)
/*++
Routine Description:
program entry
Arguments:
int argc,
char *argv[]
char *envp[]
Return Value:
none
Notes:
--*/
{
TCHAR CWD[MAX_PATH];
int dirlen=0;
if (argc < 2) {
Usage();
}
ParseArgs(&argc, argv);
GetCurrentDirectory(MAX_PATH, CWD);
VersionInformation.dwOSVersionInfoSize = sizeof(VersionInformation);
if (!GetVersionEx( &VersionInformation )) {
fprintf(stderr, "Unable to detect OS version. Terminating.\n" );
exit(1);
}
if ((VersionInformation.dwPlatformId != VER_PLATFORM_WIN32_NT) ||
(VersionInformation.dwBuildNumber < 1230))
{
lpOldLdrVerifyImageMatchesChecksum = (LPLDRVERIFYIMAGECHKSUM)
GetProcAddress(GetModuleHandle(TEXT("NTDLL.DLL")), TEXT("LdrVerifyImageMatchesChecksum"));
if (lpOldLdrVerifyImageMatchesChecksum == NULL) {
fprintf(stderr, "Incorrect operating system version.\n" );
exit(1);
}
} else {
lpOldLdrVerifyImageMatchesChecksum = NULL;
if ((VersionInformation.dwPlatformId == VER_PLATFORM_WIN32_NT) &&
(VersionInformation.dwBuildNumber >= 1230))
{
lpNewLdrVerifyImageMatchesChecksum = (LPLDRVERIFYIMAGEMATCHESCHECKSUM)
GetProcAddress(GetModuleHandle(TEXT("NTDLL.DLL")), TEXT("LdrVerifyImageMatchesChecksum"));
if (lpNewLdrVerifyImageMatchesChecksum == NULL) {
fprintf(stderr, "OS is screwed up. NTDLL doesn't export LdrVerifyImageMatchesChecksum.\n" );
exit(1);
}
}
}
if (VersionInformation.dwPlatformId == VER_PLATFORM_WIN32_NT) {
SYSTEM_BASIC_INFORMATION SystemInformation;
if (VersionInformation.dwBuildNumber <= 1465) {
goto UseWin9x;
}
ValidMachineIDMin = USER_SHARED_DATA->ImageNumberLow;
ValidMachineIDMax = USER_SHARED_DATA->ImageNumberHigh;
lpNtQuerySystemInformation = (LPNTQUERYSYSTEMINFORMATION)
GetProcAddress(GetModuleHandle(TEXT("NTDLL.DLL")), TEXT("NtQuerySystemInformation"));
if (!lpNtQuerySystemInformation) {
fprintf(stderr, "Incorrect operation system version.\n");
exit(1);
}
if (!NT_SUCCESS((*lpNtQuerySystemInformation)(SystemBasicInformation,
&SystemInformation,
sizeof(SystemInformation),
NULL))) {
fprintf(stderr, "OS is screwed up. NtQuerySystemInformation failed.\n");
exit(1);
}
HighestUserAddress = (PVOID)SystemInformation.MaximumUserModeAddress;
} else {
UseWin9x:
HighestUserAddress = (PVOID) 0x7FFE0000;
#ifdef _M_IX86
ValidMachineIDMin = IMAGE_FILE_MACHINE_I386;
ValidMachineIDMax = IMAGE_FILE_MACHINE_I386;
#elif defined(_M_AMD64)
ValidMachineIDMin = IMAGE_FILE_MACHINE_AMD64;
ValidMachineIDMax = IMAGE_FILE_MACHINE_AMD64;
#elif defined(_M_IA64)
ValidMachineIDMin = IMAGE_FILE_MACHINE_IA64;
ValidMachineIDMax = IMAGE_FILE_MACHINE_IA64;
#else
#error("Unknown machine type")
#endif
}
if (fPathOverride) {
if (_chdir(szDirectory) == -1){ // cd to dir
fprintf(stderr, "Path not found: %s\n", szDirectory);
Usage();
}
}
// remove trailing '\' needed only for above chdir, not for output formatting
if (fSingleSlash) {
dirlen = strlen(szDirectory);
szDirectory[dirlen-1] = '\0';
}
FindFiles();
fprintf(stdout, "%d files processed in %d directories\n", ProcessedFiles, DirNum);
}
VOID
FindFiles()
/*++
Routine Description:
make list of files to check, then check them
Arguments:
none
Return Value:
none
Notes:
--*/
{
HANDLE fh;
TCHAR CWD[MAX_PATH];
char *q;
WIN32_FIND_DATA *pfdata;
BOOL fFilesInDir=FALSE;
BOOL fDirsFound=FALSE;
int dnCounter=0, cNumDir=0, i=0, Length=0, NameSize=0, total=0, cNumFiles=0;
pList rgpList[5000];
pfdata = (WIN32_FIND_DATA*)malloc(sizeof(WIN32_FIND_DATA));
if (!pfdata) {
fprintf(stderr, "Not enough memory.\n");
return;
}
if (!fRecurse) {
fh = FindFirstFile(szFileName, pfdata); // find only filename (pattern) if not recursive
} else {
fh = FindFirstFile("*.*", pfdata); // find all if recursive in order to determine subdirectory names
}
if (fh == INVALID_HANDLE_VALUE) {
fprintf(fout==NULL? stderr : fout , "File not found: %s\n", szFileName);
return;
}
// loop to find all files and directories in current directory
// and copy pertinent data to individual List structures.
do {
if (strcmp(pfdata->cFileName, ".") && strcmp(pfdata->cFileName, "..")) { // skip . and ..
rgpList[dnCounter] = (pList)malloc(sizeof(List)); // allocate the memory
if (!rgpList[dnCounter]) {
fprintf(stderr, "Not enough memory.\n");
return;
}
if (!(pfdata->dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY)) { // if file
fFilesInDir=TRUE;
// see if given pattern wildcard extension matches pfdata->cFileName extension
if (fPattern) {
q = strchr(pfdata->cFileName, '.'); // find first instance of "." in filename
if (q == NULL) goto blah; // "." not found
_strlwr(q); // lowercase before compare
if (strcmp(q, szPattern)) goto blah; // if pattern and name doesn't match goto
} // OK, I used a goto, get over it.
if (fSingleFile) {
_strlwr(pfdata->cFileName);
_strlwr(szFileName);
if (strcmp(pfdata->cFileName, szFileName)) goto blah;
}
// if pattern && match || no pattern
strcpy(rgpList[dnCounter]->Name, pfdata->cFileName);
_strlwr(rgpList[dnCounter]->Name); // all lowercase for strcmp in CompName
memcpy(&(rgpList[dnCounter]->Attributes), &pfdata->dwFileAttributes, 4);
dnCounter++;
cNumFiles++;
} else {
if (pfdata->dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) { // if dir
fDirsFound=TRUE;
//cNumDir++;
if (fRecurse) {
strcpy(rgpList[dnCounter]->Name, pfdata->cFileName);
_strlwr(rgpList[dnCounter]->Name); // all lowercase for strcmp in CompName
memcpy(&(rgpList[dnCounter]->Attributes), &pfdata->dwFileAttributes, 4);
cNumDir++;
dnCounter++;
}
}
}
}
blah: ;
} while (FindNextFile(fh, pfdata));
FindClose(fh); // close the file handle
// Sort Array arranging FILE entries at top
qsort( (void *)rgpList, dnCounter, sizeof(List *), CompFileAndDir);
// Sort Array alphabetizing only FILE names
qsort( (void *)rgpList, dnCounter-cNumDir, sizeof(List *), CompName);
// Sort Array alphabetizing only DIRectory names
if (fRecurse) {
qsort( (void *)&rgpList[dnCounter-cNumDir], cNumDir, sizeof(List *), CompName);
}
// Process newly sorted structures.
for (i=0; i < dnCounter; ++i) {
if (rgpList[i]->Attributes & FILE_ATTRIBUTE_DIRECTORY) { // if Dir
if (fRecurse) {
if (_chdir(rgpList[i]->Name) == -1){ // cd into subdir and check for error
fprintf(stderr, "Unable to change directory: %s\n", rgpList[i]->Name);
} else {
NameSize = strlen(rgpList[i]->Name);
strcat(szDirectory, "\\");
strcat(szDirectory, rgpList[i]->Name); //append name to directory path
total = strlen(szDirectory);
DirNum++; // directory counter
// start another iteration of FindFiles
FindFiles();
// get back to previous directory when above iteration returns
_chdir("..");
// cut off previously appended directory name - for output only
szDirectory[total-(NameSize+1)]='\0';
}
}
} else {
if (!(rgpList[i]->Attributes & FILE_ATTRIBUTE_DIRECTORY)) // check image if not dir
Imagechk(rgpList[i], szDirectory);
}
}
} // end FindFiles
VOID
Imagechk(
List *rgpList,
TCHAR *szDirectory
)
/*++
Routine Description:
check various things, including:
image type, header alignment, image size, machine type
alignment, some properties of various sections, checksum integrity
symbol / image file checksum agreement, existence of symbols, etc
Arguments:
List * rgpList,
TCHAR * szDirectory
Return Value:
none
Notes:
--*/
{
HANDLE File;
HANDLE MemMap;
PIMAGE_DOS_HEADER DosHeader;
PIMAGE_NT_HEADERS NtHeader;
NTSTATUS Status;
BY_HANDLE_FILE_INFORMATION FileInfo;
ULONG NumberOfPtes;
ULONG SectionVirtualSize = 0;
ULONG i;
PIMAGE_SECTION_HEADER SectionTableEntry;
ULONG NumberOfSubsections;
PCHAR ExtendedHeader = NULL;
ULONG_PTR PreferredImageBase;
ULONG_PTR NextVa;
ULONG ImageFileSize;
ULONG OffsetToSectionTable;
ULONG ImageAlignment;
ULONG PtesInSubsection;
ULONG StartingSector;
ULONG EndingSector;
LPSTR ImageName;
LPSTR MachineType = "Unknown";
BOOL MachineTypeMismatch;
BOOL ImageOk;
BOOL fHasPdata;
OSVERSIONINFO OSVerInfo;
ImageName = rgpList->Name;
OSVerInfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
GetVersionEx(&OSVerInfo);
LogPrintf("ImageChk: %s\\%s \n", szDirectory, ImageName);
ProcessedFiles++;
DosHeader = NULL;
ImageOk = TRUE;
File = CreateFile (ImageName,
GENERIC_READ | FILE_EXECUTE,
OSVerInfo.dwPlatformId == VER_PLATFORM_WIN32_NT ? (FILE_SHARE_READ | FILE_SHARE_DELETE) : FILE_SHARE_READ,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL);
if (File == INVALID_HANDLE_VALUE) {
LogPrintf("Error, CreateFile() %d\n", GetLastError());
ImageOk = FALSE;
goto NextImage;
}
MemMap = CreateFileMapping (File,
NULL, // default security.
PAGE_READONLY, // file protection.
0, // high-order file size.
0,
NULL);
if (!GetFileInformationByHandle(File, &FileInfo)) {
fprintf(stderr,"Error, GetFileInfo() %d\n", GetLastError());
CloseHandle(File);
ImageOk = FALSE; goto NextImage;
}
DosHeader = (PIMAGE_DOS_HEADER) MapViewOfFile(MemMap,
FILE_MAP_READ,
0, // high
0, // low
0 // whole file
);
CloseHandle(MemMap);
if (!DosHeader) {
fprintf(stderr,"Error, MapViewOfFile() %d\n", GetLastError());
ImageOk = FALSE; goto NextImage;
}
//
// Check to determine if this is an NT image (PE format) or
// a DOS image, Win-16 image, or OS/2 image. If the image is
// not NT format, return an error indicating which image it
// appears to be.
//
if (DosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
if (ArgFlag & ArgFlag_CKMZ) {
LogPrintf("MZ header not found\n");
ImageOk = FALSE;
}
goto NeImage;
}
if (((ULONG)DosHeader->e_lfanew & 3) != 0) {
//
// The image header is not aligned on a long boundary.
// Report this as an invalid protect mode image.
//
LogPrintf("Image header not on Long boundary\n");
ImageOk = FALSE;
goto NeImage;
}
if ((ULONG)DosHeader->e_lfanew > FileInfo.nFileSizeLow) {
LogPrintf("Image size bigger than size of file\n");
ImageOk = FALSE;
goto NeImage;
}
NtHeader = (PIMAGE_NT_HEADERS)((PCHAR)DosHeader + (ULONG)DosHeader->e_lfanew);
if (NtHeader->Signature != IMAGE_NT_SIGNATURE) { //if not PE image
LogPrintf("Non 32-bit image");
ImageOk = TRUE;
goto NeImage;
}
//
// Check to see if this is an NT image or a DOS or OS/2 image.
//
Status = MiVerifyImageHeader (NtHeader, DosHeader, 50000);
if (Status != STATUS_SUCCESS) {
ImageOk = FALSE; //continue checking the image but don't print "OK"
}
//
// Verify machine type.
//
fHasPdata = TRUE; // Most do
switch (NtHeader->FileHeader.Machine) {
case IMAGE_FILE_MACHINE_I386:
MachineType = "x86";
PageSize = 4096;
PageShift = 12;
fHasPdata = FALSE;
break;
case IMAGE_FILE_MACHINE_ALPHA:
MachineType = "Alpha";
PageSize = 8192;
PageShift = 13;
break;
case IMAGE_FILE_MACHINE_IA64:
MachineType = "Intel64";
PageSize = 8192;
PageShift = 13;
break;
case IMAGE_FILE_MACHINE_ALPHA64:
MachineType = "Alpha64";
PageSize = 8192;
PageShift = 13;
break;
default:
LogPrintf("Unrecognized machine type x%lx\n",
NtHeader->FileHeader.Machine);
ImageOk = FALSE;
break;
}
if ((NtHeader->FileHeader.Machine < ValidMachineIDMin) ||
(NtHeader->FileHeader.Machine > ValidMachineIDMax)) {
MachineTypeMismatch = TRUE;
} else {
MachineTypeMismatch = FALSE;
}
ImageAlignment = NtHeader->OptionalHeader.SectionAlignment;
NumberOfPtes = BYTES_TO_PAGES (NtHeader->OptionalHeader.SizeOfImage);
NextVa = NtHeader->OptionalHeader.ImageBase;
if ((NextVa & (X64K - 1)) != 0) {
//
// Image header is not aligned on a 64k boundary.
//
LogPrintf("image base not on 64k boundary %lx\n",NextVa);
ImageOk = FALSE;
goto BadPeImageSegment;
}
//BasedAddress = (PVOID)NextVa;
PtesInSubsection = MI_ROUND_TO_SIZE (
NtHeader->OptionalHeader.SizeOfHeaders,
ImageAlignment
) >> PageShift;
if (ImageAlignment >= PageSize) {
//
// Aligmment is PageSize of greater.
//
if (PtesInSubsection > NumberOfPtes) {
//
// Inconsistent image, size does not agree with header.
//
LogPrintf("Image size in header (%ld.) not consistent with sections (%ld.)\n",
NumberOfPtes, PtesInSubsection);
ImageOk = FALSE;
goto BadPeImageSegment;
}
NumberOfPtes -= PtesInSubsection;
EndingSector = NtHeader->OptionalHeader.SizeOfHeaders >> MMSECTOR_SHIFT;
for (i = 0; i < PtesInSubsection; i++) {
NextVa += PageSize;
}
}
//
// Build the next subsections.
//
NumberOfSubsections = NtHeader->FileHeader.NumberOfSections;
PreferredImageBase = NtHeader->OptionalHeader.ImageBase;
//
// At this point the object table is read in (if it was not
// already read in) and may displace the image header.
//
OffsetToSectionTable = sizeof(ULONG) +
sizeof(IMAGE_FILE_HEADER) +
NtHeader->FileHeader.SizeOfOptionalHeader;
SectionTableEntry = (PIMAGE_SECTION_HEADER)((PCHAR)NtHeader + OffsetToSectionTable);
if (ImageAlignment < PageSize) {
// The image header is no longer valid, TempPte is
// used to indicate that this image alignment is
// less than a PageSize.
//
// Loop through all sections and make sure there is no
// unitialized data.
//
while (NumberOfSubsections > 0) {
if (SectionTableEntry->Misc.VirtualSize == 0) {
SectionVirtualSize = SectionTableEntry->SizeOfRawData;
} else {
SectionVirtualSize = SectionTableEntry->Misc.VirtualSize;
}
//
// If the pointer to raw data is zero and the virtual size
// is zero, OR, the section goes past the end of file, OR
// the virtual size does not match the size of raw data, then
// return an error.
//
if (((SectionTableEntry->PointerToRawData !=
SectionTableEntry->VirtualAddress))
||
((SectionTableEntry->SizeOfRawData +
SectionTableEntry->PointerToRawData) >
FileInfo.nFileSizeLow)
||
(SectionVirtualSize > SectionTableEntry->SizeOfRawData)) {
LogPrintf("invalid BSS/Trailingzero section/file size\n");
ImageOk = FALSE;
goto NeImage;
}
SectionTableEntry += 1;
NumberOfSubsections -= 1;
}
goto PeReturnSuccess;
}
while (NumberOfSubsections > 0) {
//
// Handle case where virtual size is 0.
//
if (SectionTableEntry->Misc.VirtualSize == 0) {
SectionVirtualSize = SectionTableEntry->SizeOfRawData;
} else {
SectionVirtualSize = SectionTableEntry->Misc.VirtualSize;
}
if (!strcmp(SectionTableEntry->Name, ".debug")) {
fDebugMapped = TRUE;
}
if (SectionVirtualSize == 0) {
//
// The specified virtual address does not align
// with the next prototype PTE.
//
LogPrintf("Section virtual size is 0, NextVa for section %lx %lx\n",
SectionTableEntry->VirtualAddress, NextVa);
ImageOk = FALSE;
goto BadPeImageSegment;
}
if (NextVa !=
(PreferredImageBase + SectionTableEntry->VirtualAddress)) {
//
// The specified virtual address does not align
// with the next prototype PTE.
//
LogPrintf("Section Va not set to alignment, NextVa for section %lx %lx\n",
SectionTableEntry->VirtualAddress, NextVa);
ImageOk = FALSE;
goto BadPeImageSegment;
}
PtesInSubsection =
MI_ROUND_TO_SIZE (SectionVirtualSize, ImageAlignment) >> PageShift;
if (PtesInSubsection > NumberOfPtes) {
//
// Inconsistent image, size does not agree with object tables.
//
LogPrintf("Image size in header not consistent with sections, needs %ld. pages\n",
PtesInSubsection - NumberOfPtes);
LogPrintf("va of bad section %lx\n",SectionTableEntry->VirtualAddress);
ImageOk = FALSE;
goto BadPeImageSegment;
}
NumberOfPtes -= PtesInSubsection;
StartingSector = SectionTableEntry->PointerToRawData >> MMSECTOR_SHIFT;
EndingSector =
(SectionTableEntry->PointerToRawData +
SectionVirtualSize);
EndingSector = EndingSector >> MMSECTOR_SHIFT;
ImageFileSize = SectionTableEntry->PointerToRawData +
SectionTableEntry->SizeOfRawData;
for (i = 0; i < PtesInSubsection; i++) {
//
// Set all the prototype PTEs to refer to the control section.
//
NextVa += PageSize;
}
SectionTableEntry += 1;
NumberOfSubsections -= 1;
}
//
// If the file size is not as big as the image claimed to be,
// return an error.
//
if (ImageFileSize > FileInfo.nFileSizeLow) {
//
// Invalid image size.
//
LogPrintf("invalid image size - file size %lx - image size %lx\n",
FileInfo.nFileSizeLow, ImageFileSize);
ImageOk = FALSE;
goto BadPeImageSegment;
}
{
// Validate the debug information (as much as we can).
PVOID ImageBase;
ULONG DebugDirectorySize, NumberOfDebugDirectories;
PIMAGE_DEBUG_DIRECTORY DebugDirectory;
ImageBase = (PVOID) DosHeader;
DebugDirectory = (PIMAGE_DEBUG_DIRECTORY)
ImageDirectoryEntryToData(
ImageBase,
FALSE,
IMAGE_DIRECTORY_ENTRY_DEBUG,
&DebugDirectorySize );
if (!DebugDirectoryIsUseful(DebugDirectory, DebugDirectorySize)) {
// Not useful. Are they valid? (both s/b zero)
if (DebugDirectory || DebugDirectorySize) {
LogPrintf("Debug directory values [%x, %x] are invalid\n",
DebugDirectory,
DebugDirectorySize);
ImageOk = FALSE;
}
goto DebugDirsDone;
}
NumberOfDebugDirectories = DebugDirectorySize / sizeof( IMAGE_DEBUG_DIRECTORY );
for (i=0; i < NumberOfDebugDirectories; i++) {
if (DebugDirectory->PointerToRawData > FileInfo.nFileSizeLow) {
LogPrintf("Invalid debug directory entry[%d] - File Offset %x is beyond the end of the file\n",
i,
DebugDirectory->PointerToRawData
);
ImageOk = FALSE;
goto BadPeImageSegment;
}
if ((DebugDirectory->PointerToRawData + DebugDirectory->SizeOfData) > FileInfo.nFileSizeLow) {
LogPrintf("Invalid debug directory entry[%d] - File Offset (%X) + Size (%X) is beyond the end of the file (filesize: %X)\n",
i,
DebugDirectory->PointerToRawData,
DebugDirectory->SizeOfData,
FileInfo.nFileSizeLow
);
ImageOk = FALSE;
goto BadPeImageSegment;
}
#if 0
if (DebugDirectory->AddressOfRawData != 0) {
if (DebugDirectory->AddressOfRawData > ImageFileSize){
LogPrintf("Invalid debug directory entry[%d] - VA (%X) is beyond the end of the image VA (%X)\n",
i,
DebugDirectory->AddressOfRawData,
ImageFileSize);
ImageOk = FALSE;
goto BadPeImageSegment;
}
if ((DebugDirectory->AddressOfRawData + DebugDirectory->SizeOfData )> ImageFileSize){
LogPrintf("Invalid debug directory entry[%d] - VA (%X) + size (%X) is beyond the end of the image VA (%X)\n",
i,
DebugDirectory->AddressOfRawData,
DebugDirectory->SizeOfData,
ImageFileSize);
ImageOk = FALSE;
goto BadPeImageSegment;
}
}
#endif
if (DebugDirectory->Type <= 0x7fffffff) {
switch (DebugDirectory->Type) {
case IMAGE_DEBUG_TYPE_MISC:
{
PIMAGE_DEBUG_MISC pDebugMisc;
// MISC should point to an IMAGE_DEBUG_MISC structure
pDebugMisc = (PIMAGE_DEBUG_MISC)((PCHAR)ImageBase + DebugDirectory->PointerToRawData);
if (pDebugMisc->DataType != IMAGE_DEBUG_MISC_EXENAME) {
LogPrintf("MISC Debug has an invalid DataType\n");
ImageOk = FALSE;
goto BadPeImageSegment;
}
if (pDebugMisc->Length != DebugDirectory->SizeOfData) {
LogPrintf("MISC Debug has an invalid size.\n");
ImageOk = FALSE;
goto BadPeImageSegment;
}
if (!pDebugMisc->Unicode) {
i= 0;
while (i < pDebugMisc->Length - sizeof(IMAGE_DEBUG_MISC)) {
if (!isprint(pDebugMisc->Data[i]) &&
(pDebugMisc->Data[i] != '\0') )
{
LogPrintf("MISC Debug has unprintable characters... Possibly corrupt\n");
ImageOk = FALSE;
goto BadPeImageSegment;
}
i++;
}
// The data must be a null terminated string.
if (strlen(pDebugMisc->Data) > (pDebugMisc->Length - sizeof(IMAGE_DEBUG_MISC))) {
LogPrintf("MISC Debug has invalid data... Possibly corrupt\n");
ImageOk = FALSE;
goto BadPeImageSegment;
}
}
}
break;
case IMAGE_DEBUG_TYPE_CODEVIEW:
// CV will point to either a NB09 or an NB10 signature. Make sure it does.
{
OMFSignature * CVDebug;
CVDebug = (OMFSignature *)((PCHAR)ImageBase + DebugDirectory->PointerToRawData);
if (((*(PULONG)(CVDebug->Signature)) != '90BN') &&
((*(PULONG)(CVDebug->Signature)) != '01BN') &&
((*(PULONG)(CVDebug->Signature)) != 'SDSR'))
{
LogPrintf("CV Debug has an invalid signature\n");
ImageOk = FALSE;
goto BadPeImageSegment;
}
}
break;
case IMAGE_DEBUG_TYPE_COFF:
case IMAGE_DEBUG_TYPE_FPO:
case IMAGE_DEBUG_TYPE_EXCEPTION:
case IMAGE_DEBUG_TYPE_FIXUP:
case IMAGE_DEBUG_TYPE_OMAP_TO_SRC:
case IMAGE_DEBUG_TYPE_OMAP_FROM_SRC:
// Not much we can do about these now.
break;
default:
LogPrintf("Invalid debug directory type: %d\n", DebugDirectory->Type);
ImageOk = FALSE;
goto BadPeImageSegment;
break;
}
}
}
}
DebugDirsDone:
//
// The total number of PTEs was decremented as sections were built,
// make sure that there are less than 64ks worth at this point.
//
if (NumberOfPtes >= (ImageAlignment >> PageShift)) {
//
// Inconsistent image, size does not agree with object tables.
//
LogPrintf("invalid image - PTEs left %lx\n",
NumberOfPtes);
ImageOk = FALSE;
goto BadPeImageSegment;
}
// Verify LoadConfig data (if available)
{
PIMAGE_LOAD_CONFIG_DIRECTORY LoadConfigDirectory;
ULONG LoadConfigDirectorySize;
LoadConfigDirectory = (PIMAGE_LOAD_CONFIG_DIRECTORY)
ImageDirectoryEntryToData(
(PVOID) DosHeader,
FALSE,
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG,
&LoadConfigDirectorySize );
if (LoadConfigDirectory) {
if (!LoadConfigDirectorySize) {
// LOAD_CONFIG directory size in the image header is not set (s/b 0x40 on X86)
LogPrintf("LoadConfig pointer set, but size is not\n");
ImageOk = FALSE;
goto BadPeImageSegment;
}
if (LoadConfigDirectory->Size) {
// Version 2 load config - check the SEH fields.
if (LoadConfigDirectory->Size == RTL_SIZEOF_THROUGH_FIELD(IMAGE_LOAD_CONFIG_DIRECTORY, SEHandlerTable)) {
// SEH Handler table is on, but count isn't. Bad.
LogPrintf("LoadConfig pointer set, but size is not\n");
ImageOk = FALSE;
goto BadPeImageSegment;
}
if (LoadConfigDirectory->Size >= RTL_SIZEOF_THROUGH_FIELD(IMAGE_LOAD_CONFIG_DIRECTORY, SEHandlerCount)) {
// Have both a count and table - check them
if (LoadConfigDirectory->SEHandlerTable) {
// Table exists.
if (!LoadConfigDirectory->SEHandlerCount) {
LogPrintf("Loadconfig structure invalid - SEH table pointer exists, but count is zero\n");
ImageOk = FALSE;
goto BadPeImageSegment;
}
if (LoadConfigDirectory->SEHandlerTable < NtHeader->OptionalHeader.ImageBase ||
(LoadConfigDirectory->SEHandlerTable > (NtHeader->OptionalHeader.ImageBase + NtHeader->OptionalHeader.SizeOfImage))){
// SEH handler table isn't within the image bounds
LogPrintf("Loadconfig structure invalid - SEH table pointer exists, but count is zero\n");
ImageOk = FALSE;
goto BadPeImageSegment;
}
if (NtHeader->OptionalHeader.DllCharacteristics & IMAGE_DLLCHARACTERISTICS_NO_SEH) {
LogPrintf("Image is marked as NO_SEH, yet SEH pointer is non-null\n");
ImageOk = FALSE;
goto BadPeImageSegment;
}
}
if (LoadConfigDirectory->SEHandlerCount) {
// Count is non-zero
if (!LoadConfigDirectory->SEHandlerTable) {
LogPrintf("Loadconfig structure invalid - SEH count is non-zero but table pointer is null\n");
ImageOk = FALSE;
goto BadPeImageSegment;
}
if (NtHeader->OptionalHeader.DllCharacteristics & IMAGE_DLLCHARACTERISTICS_NO_SEH) {
LogPrintf("Image is marked as NO_SEH, yet SEH count is non-zero\n");
ImageOk = FALSE;
goto BadPeImageSegment;
}
}
}
}
}
}
//
// check checksum.
//
PeReturnSuccess:
if (NtHeader->OptionalHeader.CheckSum == 0) {
LogPrintf("(checksum is zero)\n");
} else {
__try {
if (lpOldLdrVerifyImageMatchesChecksum == NULL) {
if (lpNewLdrVerifyImageMatchesChecksum == NULL) {
Status = STATUS_SUCCESS;
LogPrintf("Unable to validate checksum\n");
} else {
Status = (*lpNewLdrVerifyImageMatchesChecksum)(File, NULL, NULL, NULL);
}
} else {
Status = (*lpOldLdrVerifyImageMatchesChecksum)(File);
}
if (NT_ERROR(Status)) {
DWORD HeaderSum, CheckSum;
MapFileAndCheckSum(ImageName, &HeaderSum, &CheckSum);
LogPrintf("checksum mismatch\tis: %x\ts/b: %x\n", NtHeader->OptionalHeader.CheckSum, CheckSum);
ImageOk = FALSE;
}
} __except (EXCEPTION_EXECUTE_HANDLER) {
ImageOk = FALSE;
LogPrintf("checksum mismatch\n");
LogPrintf("LdrVerifyImageMatchesCheckSum AV'd\n");
}
}
if (fHasPdata && ImageOk) {
ImageOk = ValidatePdata(DosHeader);
}
if (ImageOk) {
ImageOk = VerifyVersionResource(ImageName, ImageNeedsOleSelfRegister(DosHeader));
}
//
// sanity test for symbols
// basically : if this does not work, debugging probably will not either
// these high-level debugging api's will also call a pdb validation routine
//
if(ArgFlag & ArgFlag_SymCK)
{
HANDLE hProcess = 0;
char Target[MAX_PATH] = {0};
char drive[_MAX_DRIVE];
char dir[_MAX_DIR];
char fname[_MAX_FNAME];
char ext[_MAX_EXT];
IMAGEHLP_MODULE64 ModuleInfo = {0};
PSYMMODLIST ModList = 0;
void *vpAddr;
PLOADED_IMAGE pLImage = NULL;
DWORD64 symLMflag;
strcpy(Target, szDirectory);
strcat(Target, "\\");
strcat(Target, ImageName);
//
// set up for debugging
//
hProcess = GetCurrentProcess();
if(!SymInitialize(hProcess, szSympath, FALSE))
{
LogPrintf("ERROR:SymInitialize failed!\n");
hProcess = 0;
goto symckend;
}
//
// attempt to use symbols
//
_splitpath(Target, drive, dir, fname, ext );
symLMflag = SymLoadModule64(hProcess, NULL, Target, fname, 0, 0);
if(!symLMflag)
{
LogPrintf("ERROR:SymLoadModule failed! last error:0x%x\n", GetLastError());
goto symckend;
}
//
// identify module type
// find module, symgetmoduleinfo, check dbg type
//
ModuleInfo.SizeOfStruct = sizeof(ModuleInfo);
ModList = MakeModList(hProcess);
vpAddr = GetModAddrFromName(ModList, fname);
if(!SymGetModuleInfo64(hProcess, (DWORD64)vpAddr, &ModuleInfo))
{
LogPrintf("ERROR:SymGetModuleInfo failed! last error:0x%x\n", GetLastError());
goto symckend;
}
if(ModuleInfo.SymType != SymPdb)
{
LogPrintf("WARNING: No pdb info for file!\n");
switch(ModuleInfo.SymType){
case SymNone:
LogPrintf("symtype: SymNone\n");
break;
case SymCoff:
LogPrintf("symtype: SymCoff\n");
break;
case SymCv:
LogPrintf("symtype: SymCv\n");
break;
case SymPdb:
LogPrintf("symtype: SymPdb\n");
break;
case SymExport:
LogPrintf("symtype: SymExport\n");
break;
case SymDeferred:
LogPrintf("symtype: SymDeferred\n");
break;
case SymSym:
LogPrintf("symtype: SymSym\n");
break;
}
}
//
// get image, symbol checksum, compare
//
pLImage = ImageLoad(Target, NULL);
{
CHAR szDbgPath[_MAX_PATH];
HANDLE DbgFileHandle;
DbgFileHandle = FindDebugInfoFile(Target, szSympath, szDbgPath);
if (DbgFileHandle != INVALID_HANDLE_VALUE) {
IMAGE_SEPARATE_DEBUG_HEADER DbgHeader;
DWORD BytesRead;
BOOL ReadSuccess;
SetFilePointer(DbgFileHandle, 0, 0, FILE_BEGIN);
ReadSuccess = ReadFile(DbgFileHandle, &DbgHeader, sizeof(DbgHeader), &BytesRead, NULL);
if (ReadSuccess && (BytesRead == sizeof(DbgHeader))) {
// Got enough to check if it's a valid dbg file.
if(((PIMAGE_NT_HEADERS)pLImage->FileHeader)->OptionalHeader.CheckSum != DbgHeader.CheckSum) {
LogPrintf("ERROR! image / debug file checksum not equal\n");
ImageOk = FALSE;
}
}
CloseHandle(DbgFileHandle);
}
}
//
// cleanup
//
symckend:
if(ModList)
{
FreeModList(ModList);
}
if(pLImage)
{
ImageUnload(pLImage);
}
if(symLMflag)
{
SymUnloadModule64(hProcess, (DWORD)symLMflag);
}
if(hProcess)
{
SymCleanup(hProcess);
}
}
NextImage:
BadPeImageSegment:
NeImage:
if ( ImageOk && (ArgFlag & ArgFlag_OK)) {
if (MachineTypeMismatch) {
LogPrintf(" OK [%s]\n", MachineType);
} else {
LogPrintf(" OK\n");
}
}
//
// print out results
//
if (ImageOk)
{
LogOutAndClean((ArgFlag & ArgFlag_OK) ? TRUE : FALSE);
} else {
LogOutAndClean(TRUE);
}
if ( File != INVALID_HANDLE_VALUE ) {
CloseHandle(File);
}
if ( DosHeader ) {
UnmapViewOfFile(DosHeader);
}
}
NTSTATUS
MiVerifyImageHeader (
IN PIMAGE_NT_HEADERS NtHeader,
IN PIMAGE_DOS_HEADER DosHeader,
IN ULONG NtHeaderSize
)
/*++
Routine Description:
Checks image header for consistency.
Arguments:
IN PIMAGE_NT_HEADERS NtHeader
IN PIMAGE_DOS_HEADER DosHeader
IN ULONG NtHeaderSize
Return Value:
Returns the status value.
TBS
--*/
{
if ((NtHeader->FileHeader.Machine == 0) &&
(NtHeader->FileHeader.SizeOfOptionalHeader == 0)) {
//
// This is a bogus DOS app which has a 32-bit portion
// mascarading as a PE image.
//
LogPrintf("Image machine type and size of optional header bad\n");
return STATUS_INVALID_IMAGE_PROTECT;
}
if (!(NtHeader->FileHeader.Characteristics & IMAGE_FILE_EXECUTABLE_IMAGE)) {
LogPrintf("Characteristics not image file executable\n");
return STATUS_INVALID_IMAGE_FORMAT;
}
#ifdef i386
//
// Make sure the image header is aligned on a Long word boundary.
//
if (((ULONG)NtHeader & 3) != 0) {
LogPrintf("NtHeader is not aligned on longword boundary\n");
return STATUS_INVALID_IMAGE_FORMAT;
}
#endif
// Non-driver code must have file alignment set to a multiple of 512
if (((NtHeader->OptionalHeader.FileAlignment & 511) != 0) &&
(NtHeader->OptionalHeader.FileAlignment !=
NtHeader->OptionalHeader.SectionAlignment)) {
LogPrintf("file alignment is not multiple of 512 and power of 2\n");
return STATUS_INVALID_IMAGE_FORMAT;
}
//
// File aligment must be power of 2.
//
if ((((NtHeader->OptionalHeader.FileAlignment << 1) - 1) &
NtHeader->OptionalHeader.FileAlignment) !=
NtHeader->OptionalHeader.FileAlignment) {
LogPrintf("file alignment not power of 2\n");
return STATUS_INVALID_IMAGE_FORMAT;
}
if (NtHeader->OptionalHeader.SectionAlignment < NtHeader->OptionalHeader.FileAlignment) {
LogPrintf("SectionAlignment < FileAlignment\n");
return STATUS_INVALID_IMAGE_FORMAT;
}
if (NtHeader->OptionalHeader.SizeOfImage > MM_SIZE_OF_LARGEST_IMAGE) {
LogPrintf("Image too big %lx\n",NtHeader->OptionalHeader.SizeOfImage);
return STATUS_INVALID_IMAGE_FORMAT;
}
if (NtHeader->FileHeader.NumberOfSections > MM_MAXIMUM_IMAGE_SECTIONS) {
LogPrintf("Too many image sections %ld.\n",
NtHeader->FileHeader.NumberOfSections);
return STATUS_INVALID_IMAGE_FORMAT;
}
if (ArgFlag & ArgFlag_CKBase) {
if ((PVOID)NtHeader->OptionalHeader.ImageBase >= HighestUserAddress) {
LogPrintf("Image base (%lx) is invalid on this machine\n",
NtHeader->OptionalHeader.ImageBase);
return STATUS_SUCCESS;
}
}
return STATUS_SUCCESS;
}
VOID
ParseArgs(
int *pargc,
char **argv
)
/*++
Routine Description:
parse arguments to this program
Arguments:
int *pargc
char **argv
Return Value:
none
Notes:
command line args:
(original)
case '?': call usage and exit
case 'b': check whether base address of image is in user space for this machine
case 's': /s <sympath> check symbols
case 'p': PE Errors only
case 'r': recurse subdirectories
(new)
case 'v': verbose - output "OK"
case 'o': output "OleSelfRegister not set"
--*/
{
CHAR cswitch, c, *p;
CHAR sztmp[MAX_PATH];
int argnum = 1, i=0, len=0, count=0;
BOOL fslashfound = FALSE;
//
// set default flags here
//
ArgFlag |= ArgFlag_CKBase;
while ( argnum < *pargc ) {
_strlwr(argv[argnum]);
cswitch = *(argv[argnum]);
if (cswitch == '/' || cswitch == '-') {
c = *(argv[argnum]+1);
switch (c) {
case 'o':
ArgFlag |= ArgFlag_OLESelf;
break;
case 'v':
ArgFlag |= ArgFlag_OK | ArgFlag_CKMZ | ArgFlag_OLESelf;
break;
case '?':
Usage();
break;
case 'b':
ArgFlag ^= ArgFlag_CKBase;
break;
case 's':
if (argv[argnum+1]) {
strcpy(szSympath, (argv[argnum+1]));
ArgFlag |= ArgFlag_SymCK;
argnum++;
}
break;
case 'p':
ArgFlag |= ArgFlag_CKMZ;
break;
case 'r':
fRecurse = TRUE;
if (argv[argnum+1]) {
fPathOverride=TRUE;
strcpy(szDirectory, (argv[argnum+1]));
if (!(strcmp(szDirectory, "\\"))) { // if just '\'
fSingleSlash=TRUE;
}
//LogPrintf("dir %s\n", szDirectory);
argnum++;
}
break;
default:
fprintf(stderr, "Invalid argument.\n");
Usage();
}
} else {
// Check for path\filename or wildcards
// Search for '\' in string
strcpy(sztmp, (argv[argnum]));
len = strlen(sztmp);
for (i=0; i < len; i++) {
if (sztmp[i]=='\\') {
count++;
endpath=i; // mark last '\' char found
fslashfound=TRUE; // found backslash, so must be a path\filename combination
}
}
if (fslashfound && !fRecurse) { // if backslash found and not a recursive operation
// seperate the directory and filename into two strings
fPathOverride=TRUE;
strcpy(szDirectory, sztmp);
if (!(strcmp(szDirectory, "\\"))) {
Usage();
}
szFileName = _strdup(&(sztmp[endpath+1]));
if (count == 1) { //&& szDirectory[1] == ':') { // if only one '\' char and drive letter indicated
fSingleSlash=TRUE;
szDirectory[endpath+1]='\0'; // keep trailing '\' in order to chdir properly
} else {
szDirectory[endpath]='\0';
}
if (szFileName[0] == '*' && szFileName[1] == '.' && szFileName[2] != '*') {
_strlwr(szFileName);
szPattern = strchr(szFileName, '.'); //search for '.'
fPattern = TRUE;
}
} else { // no backslash found, assume filename without preceeding path
szFileName = _strdup(argv[argnum]);
if (!szFileName) {
// drastic error, just bail
szFileName = "";
return;
}
//
// filename or wildcard
//
if ( (*(argv[argnum]) == '*') && (*(argv[argnum]+1) == '.') && (*(argv[argnum]+2) != '*') ){
// *.xxx
_strlwr(szFileName);
szPattern = strchr(szFileName, '.'); //search for '.'
fPattern = TRUE;
} else if ( (*(argv[argnum]) == '*') && (*(argv[argnum]+1) == '.') && (*(argv[argnum]+2) == '*') ) {
// *.*
} else {
// probably a single filename
_strlwr(szFileName);
fSingleFile = TRUE;
}
if (fRecurse && strchr(szFileName, '\\') ) { // don't want path\filename when recursing
Usage();
}
}
//fprintf(stdout, "dir %s\nfile %s\n", szDirectory, szFileName);
}
++argnum;
}
if (szFileName[0] == '\0') {
Usage();
}
} // parseargs
int
__cdecl
CompFileAndDir(
const void *elem1,
const void *elem2
)
/*++
Routine Description:
Purpose: a comparision routine passed to QSort. It compares elem1 and elem2
based upon their attribute, i.e., is it a file or directory.
Arguments:
const void *elem1,
const void *elem2
Return Value:
result of comparison function
Notes:
--*/
{
pList p1, p2;
// qsort passes a void universal pointer. Use a typecast (List**)
// so the compiler recognizes the data as a List structure.
// Typecast pointer-to-pointer-to-List and dereference ONCE
// leaving a pList. I don't dereference the remaining pointer
// in the p1 and p2 definitions to avoid copying the structure.
p1 = (*(List**)elem1);
p2 = (*(List**)elem2);
if ( (p1->Attributes & FILE_ATTRIBUTE_DIRECTORY) && (p2->Attributes & FILE_ATTRIBUTE_DIRECTORY))
return 0;
//both dirs
if (!(p1->Attributes & FILE_ATTRIBUTE_DIRECTORY) && !(p2->Attributes & FILE_ATTRIBUTE_DIRECTORY))
return 0;
//both files
if ( (p1->Attributes & FILE_ATTRIBUTE_DIRECTORY) && !(p2->Attributes & FILE_ATTRIBUTE_DIRECTORY))
return 1;
// elem1 is dir and elem2 is file
if (!(p1->Attributes & FILE_ATTRIBUTE_DIRECTORY) && (p2->Attributes & FILE_ATTRIBUTE_DIRECTORY))
return -1;
// elem1 is file and elem2 is dir
return 0; // if none of the above
}
int
__cdecl
CompName(
const void *elem1,
const void *elem2
)
/*++
Routine Description:
another compare routine passed to QSort that compares the two Name strings
Arguments:
const void *elem1,
const void *elem2
Return Value:
result of comparison function
Notes:
this uses a noignore-case strcmp
--*/
{
return strcmp( (*(List**)elem1)->Name, (*(List**)elem2)->Name );
}
VOID
Usage(
VOID
)
/*++
Routine Description:
Arguments:
Return Value:
Notes:
--*/
{
fputs("Usage: imagechk [/?] displays this message\n"
" [/r dir] recurse from directory dir\n"
" [/b] don't check image base address\n"
" [/v] verbose - output everything\n"
" [/o] output \"OleSelfRegister not set\" warning\n"
" [/p] output \"MZ header not found\"\n"
" [/s <sympath>] check pdb symbols\n"
" [filename] file to check\n"
" Accepts wildcard extensions such as *.exe\n"
" imagechk /r . \"*.exe\" check all *.exe recursing on current directory\n"
" imagechk /r \\ \"*.exe\" check all *.exe recursing from root of current drive\n"
" imagechk \"*.exe\" check all *.exe in current directory\n"
" imagechk c:\\bar.exe check c:\\bar.exe only\n",
stderr);
exit(1);
}
int
__cdecl
_cwild()
/*++
Routine Description:
Arguments:
Return Value:
Notes:
--*/
{
return(0);
}
typedef DWORD (WINAPI *PFNGVS)(LPSTR, LPDWORD);
typedef BOOL (WINAPI *PFNGVI)(LPTSTR, DWORD, DWORD, LPVOID);
typedef BOOL (WINAPI *PFNVQV)(const LPVOID, LPTSTR, LPVOID *, PUINT);
BOOL
VerifyVersionResource(
PCHAR FileName,
BOOL fSelfRegister
)
/*++
Routine Description:
validate the version resource in a file
Arguments:
PCHAR FileName
BOOL fSelfRegister
Return Value:
TRUE if: no version.dll found
FALSE if: version resource missing
Notes:
--*/
{
static HINSTANCE hVersion = NULL;
static PFNGVS pfnGetFileVersionInfoSize = NULL;
static PFNGVI pfnGetFileVersionInfo = NULL;
static PFNVQV pfnVerQueryValue = NULL;
DWORD dwSize;
DWORD lpInfoSize;
LPVOID lpData = NULL, lpInfo;
BOOL rc = FALSE;
DWORD dwDefLang = 0x00000409;
DWORD *pdwTranslation, uLen;
CHAR buf[60];
CHAR szVersionDll[_MAX_PATH];
if (GetSystemDirectory(szVersionDll, sizeof(szVersionDll))) {
strcat(szVersionDll, "\\version.dll");
} else {
strcpy(szVersionDll, "version.dll");
}
if (!hVersion) {
hVersion = LoadLibraryA(szVersionDll);
if (hVersion == NULL) {
return TRUE;
}
pfnGetFileVersionInfoSize = (PFNGVS) GetProcAddress(hVersion, "GetFileVersionInfoSizeA");
pfnGetFileVersionInfo = (PFNGVI) GetProcAddress(hVersion, "GetFileVersionInfoA");
pfnVerQueryValue = (PFNVQV) GetProcAddress(hVersion, "VerQueryValueA");
}
if (!pfnGetFileVersionInfoSize || !pfnGetFileVersionInfo || !pfnVerQueryValue) {
rc = TRUE;
goto cleanup;
}
if ((dwSize = (*pfnGetFileVersionInfoSize)(FileName, &dwSize)) == 0){
LogPrintf("No version resource detected\n");
goto cleanup;
}
if (!fSelfRegister) {
// All we need to do is see if the version resource exists. Ole Self Register not necessary.
rc = TRUE;
goto cleanup;
}
if ((lpData = malloc(dwSize)) == NULL) {
LogPrintf("Out of memory\n");
goto cleanup;
}
if (!(*pfnGetFileVersionInfo)(FileName, 0, dwSize, lpData)) {
LogPrintf("Unable to read version info\n - %d", GetLastError());
goto cleanup;
}
if(!pfnVerQueryValue(lpData, "\\VarFileInfo\\Translation", &pdwTranslation, &uLen)) {
pdwTranslation = &dwDefLang;
uLen = sizeof(DWORD);
}
sprintf(buf, "\\StringFileInfo\\%04x%04x\\OleSelfRegister", LOWORD(*pdwTranslation), HIWORD(*pdwTranslation));
if (!pfnVerQueryValue(lpData, buf, &lpInfo, &lpInfoSize) && (ArgFlag & ArgFlag_OLESelf )) {
LogPrintf("OleSelfRegister not set\n");
} else {
rc = TRUE;
}
cleanup:
if (lpData) {
free(lpData);
}
// No need to free the hVersion
return(rc);
}
BOOL
ValidatePdata(
PIMAGE_DOS_HEADER DosHeader
)
/*++
Routine Description:
validates the PIMAGE_RUNTIME_FUNCTION_ENTRY in the executable
Arguments:
PIMAGE_DOS_HEADER DosHeader
Return Value:
TRUE if:
FALSE if: no exception data
exception table size incorrect
exception table corrupt
Notes:
--*/
{
// The machine type indicates this image should have pdata (an exception table).
// Ensure it looks reasonable.
// Todo: Add a range check for exception handler and data
PIMAGE_RUNTIME_FUNCTION_ENTRY ExceptionTable;
DWORD ExceptionTableSize, i;
DWORD_PTR LastEnd;
BOOL fRc;
PIMAGE_NT_HEADERS NtHeader = (PIMAGE_NT_HEADERS)((PCHAR)DosHeader + (ULONG)DosHeader->e_lfanew);
ULONG_PTR ImageBase = NtHeader->OptionalHeader.ImageBase;
DWORD PDataStart = NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION].VirtualAddress;
DWORD PDataSize = NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION].Size;
ExceptionTable = (PIMAGE_RUNTIME_FUNCTION_ENTRY)
ImageDirectoryEntryToData(
DosHeader,
FALSE,
IMAGE_DIRECTORY_ENTRY_EXCEPTION,
&ExceptionTableSize );
if (!ExceptionTable ||
(ExceptionTable && (ExceptionTableSize == 0)))
{
// No Exception table.
return(TRUE);
}
if (ExceptionTableSize % sizeof(IMAGE_RUNTIME_FUNCTION_ENTRY)) {
// The size isn't an even multiple.
LogPrintf("exception table size is not correct\n");
return(FALSE);
}
LastEnd = 0;
fRc = TRUE;
for (i=0; i < (ExceptionTableSize / sizeof(IMAGE_RUNTIME_FUNCTION_ENTRY)); i++) {
if (!ExceptionTable[i].BeginAddress) {
if (fRc != FALSE) {
LogPrintf("exception table is corrupt.\n");
}
LogPrintf("PDATA Entry[%d]: zero value for BeginAddress\n",
i);
fRc = FALSE;
}
if (!ExceptionTable[i].EndAddress) {
if (fRc != FALSE) {
LogPrintf("exception table is corrupt.\n");
}
LogPrintf("PDATA Entry[%d]: zero value for EndAddress\n",
i);
fRc = FALSE;
}
#if defined(_IA64_)
if (!ExceptionTable[i].UnwindInfoAddress) {
if (fRc != FALSE) {
LogPrintf("exception table is corrupt.\n");
}
LogPrintf("PDATA Entry[%d]: zero value for UnwindInfoAddress\n",
i);
fRc = FALSE;
}
#elif defined(_ALPHA_) || defined(_AXP64_)
if (!ExceptionTable[i].PrologEndAddress) {
if (fRc != FALSE) {
LogPrintf("exception table is corrupt.\n");
}
LogPrintf("PDATA Entry[%d]: zero value for PrologEndAddress\n",
i);
fRc = FALSE;
}
#endif // defined(_IA64_)
if (ExceptionTable[i].BeginAddress < LastEnd) {
if (fRc != FALSE) {
LogPrintf("exception table is corrupt.\n");
}
LogPrintf("PDATA Entry[%d]: the begin address [%8.8x] is out of sequence. Prior end was [%8.8x]\n",
i,
ExceptionTable[i].BeginAddress,
LastEnd);
fRc = FALSE;
}
if (ExceptionTable[i].EndAddress < ExceptionTable[i].BeginAddress) {
if (fRc != FALSE) {
LogPrintf("exception table is corrupt.\n");
}
LogPrintf("PDATA Entry[%d]: the end address [%8.8x] is before the begin address[%8.8X]\n",
i,
ExceptionTable[i].EndAddress,
ExceptionTable[i].BeginAddress);
fRc = FALSE;
}
#if defined(_ALPHA_) || defined(_AXP64_)
if (!((ExceptionTable[i].PrologEndAddress >= ExceptionTable[i].BeginAddress) &&
(ExceptionTable[i].PrologEndAddress <= ExceptionTable[i].EndAddress)))
{
if (NtHeader->FileHeader.Machine == IMAGE_FILE_MACHINE_ALPHA) {
// Change this test. On Alpha, the PrologEndAddress is allowed to be
// outside the Function Start/End range. If this is true, the PrologEnd
// - ImageBase - pdata section VA s/b divisible by sizeof IMAGE_RUNTIME_FUNCTION_ENTRY
// AND within the bounds of the PdataSize. It's supposed to be an index into the
// pdata data that descibes the real scoping function.
LONG PrologAddress;
PrologAddress = (LONG) (ExceptionTable[i].PrologEndAddress - ImageBase - PDataStart);
if (PrologAddress % sizeof(IMAGE_RUNTIME_FUNCTION_ENTRY)) {
if (fRc != FALSE) {
LogPrintf("exception table is corrupt.\n");
}
LogPrintf("PDATA Entry[%d]: the secondary prolog end address[%8.8x] does not evenly index into the exception table.\n",
i,
ExceptionTable[i].PrologEndAddress,
ExceptionTable[i].BeginAddress,
ExceptionTable[i].EndAddress
);
fRc = FALSE;
} else {
if ((PrologAddress < 0) || (PrologAddress > (LONG)(PDataStart - sizeof(IMAGE_RUNTIME_FUNCTION_ENTRY)))) {
if (fRc != FALSE) {
LogPrintf("exception table is corrupt.\n");
}
LogPrintf("PDATA Entry[%d]: the secondary prolog end address[%8.8x] does not index into the exception table.\n",
i,
ExceptionTable[i].PrologEndAddress,
ExceptionTable[i].BeginAddress,
ExceptionTable[i].EndAddress
);
fRc = FALSE;
}
}
} else {
if (fRc != FALSE) {
LogPrintf("exception table is corrupt.\n");
}
LogPrintf("PDATA Entry[%d]: the prolog end address[%8.8x] is not within the bounds of the frame [%8.8X] - [%8.8X]\n",
i,
ExceptionTable[i].PrologEndAddress,
ExceptionTable[i].BeginAddress,
ExceptionTable[i].EndAddress
);
fRc = FALSE;
}
}
#endif // !defined(_IA64_)
LastEnd = ExceptionTable[i].EndAddress;
}
return(fRc);
}
BOOL
ImageNeedsOleSelfRegister(
PIMAGE_DOS_HEADER DosHeader
)
/*++
Routine Description:
Arguments:
PIMAGE_DOS_HEADER DosHeader
Return Value:
TRUE if DllRegisterServer or DllUnRegisterServer is exported
--*/
{
PIMAGE_EXPORT_DIRECTORY ExportDirectory;
PIMAGE_NT_HEADERS NtHeader;
PIMAGE_SECTION_HEADER SectionHeader;
DWORD ExportDirectorySize, i;
USHORT x;
PCHAR rvaDelta;
PULONG NameTable;
ExportDirectory = (PIMAGE_EXPORT_DIRECTORY)
ImageDirectoryEntryToData(
DosHeader,
FALSE,
IMAGE_DIRECTORY_ENTRY_EXPORT,
&ExportDirectorySize );
if (!ExportDirectory ||
!ExportDirectorySize ||
!ExportDirectory->NumberOfNames)
{
// No exports (no directory, no size, or no names).
return(FALSE);
}
// Walk the section headers and find the va/raw offsets.
NtHeader = (PIMAGE_NT_HEADERS)((PCHAR)DosHeader + (ULONG)DosHeader->e_lfanew);
SectionHeader = IMAGE_FIRST_SECTION(NtHeader);
for (x = 0; x < NtHeader->FileHeader.NumberOfSections; x++) {
if (((ULONG)((PCHAR)ExportDirectory - (PCHAR)DosHeader) >= SectionHeader->PointerToRawData) &&
((ULONG)((PCHAR)ExportDirectory - (PCHAR)DosHeader) <
(SectionHeader->PointerToRawData + SectionHeader->SizeOfRawData))) {
break;
} else {
SectionHeader++;
}
}
if (x == NtHeader->FileHeader.NumberOfSections) {
// We didn't find the section that contained the export table. Assume it's not there.
return(FALSE);
}
rvaDelta = (PCHAR)DosHeader + SectionHeader->PointerToRawData - SectionHeader->VirtualAddress;
NameTable = (PULONG)(rvaDelta + ExportDirectory->AddressOfNames);
for (i = 0; i < ExportDirectory->NumberOfNames; i++) {
if (!strcmp("DllRegisterServer", rvaDelta + NameTable[i]) ||
!strcmp("DllUnRegisterServer", rvaDelta + NameTable[i]))
{
return(TRUE);
}
}
return(FALSE);
}
//
// support routines for symbol checker - could all
// be done without this using lower-level internal api's
//
PSYMMODLIST
MakeModList(
HANDLE hProcess
)
/*++
Routine Description:
build a list of loaded symbol modules and addresses
Arguments:
HANDLE hProcess
Return Value:
PSYMMODLIST
Notes:
--*/
{
PSYMMODLIST ModList;
ModList = (PSYMMODLIST)calloc(1, sizeof(SYMMODLIST));
SymEnumerateModules64(hProcess, SymEnumerateModulesCallback, ModList);
return(ModList);
}
BOOL
CALLBACK
SymEnumerateModulesCallback(
LPSTR ModuleName,
ULONG64 BaseOfDll,
PVOID UserContext
)
/*++
Routine Description:
callback routine for SymEnumerateModules
in this case, UserContext is a pointer to a head of a _SYMMODLIST struct
that will have a new item appended
We are avoiding global state for these lists so we can use several at once,
they will be short, so we will find the end each time we want to add
runs slower, simpler to maintain
Arguments:
LPSTR ModuleName
ULONG64 BaseOfDll
PVOID UserContext
Return Value:
TRUE
Notes:
--*/
{
PSYMMODLIST pSymModList;
//
// find end of list, key on pSymModList->ModBase
//
pSymModList = (PSYMMODLIST)UserContext;
while (pSymModList->ModBase)
{
pSymModList = pSymModList->Next;
}
//
// append entry
//
pSymModList->ModName = malloc(strlen(ModuleName) + 1);
if (!pSymModList->ModName)
return FALSE;
strcpy(pSymModList->ModName, ModuleName);
pSymModList->ModBase = (void *)BaseOfDll;
pSymModList->Next = (PSYMMODLIST)calloc(1, sizeof(SYMMODLIST));
return(TRUE);
}
void *
GetModAddrFromName(
PSYMMODLIST ModList,
char *ModName
)
/*++
Routine Description:
gets module address from a SYMMODLIST given module base name
Arguments:
PSYMMODLIST ModList
char * ModName
Return Value:
module address
--*/
{
while (ModList->Next != 0)
{
if (strcmp(ModList->ModName, ModName) == 0)
{
break;
}
ModList = ModList->Next;
}
return(ModList->ModBase);
}
void
FreeModList(
PSYMMODLIST ModList
)
/*++
Routine Description:
free a list of loaded symbol modules and addresses
Arguments:
PSYMMODLIST ModList
Return Value:
none
--*/
{
PSYMMODLIST ModListNext;
while (ModList)
{
if(ModList->ModName)
{
free(ModList->ModName);
}
ModListNext = ModList->Next;
free(ModList);
ModList = ModListNext;
}
}
pLogListItem LogAppend(
char *logitem,
pLogListItem plog
)
/*++
Routine Description:
add a log line to the linked list of log lines
Arguments:
char * logitem - a formatted line of text to be logged
pLogListItem plog - pointer to LogListItem
Return Value:
a pointer to the LogListItem allocated
the first call to this function should save this pointer and use
it for the head of the list, and it should be used when calling
LogOutAndClean() to print the list and free all the memory
you can call this with plog == head of list, or == to last item
if plog == 0, this means that the item being allocated is the head
of the list.
If plog == head of list, search for end of list
if plog == last item allocated, then the search is much faster
--*/
{
pLogListItem ptemp;
ptemp = plog;
if(plog)
{
while(ptemp->Next)
{
ptemp = ptemp->Next;
}
}
if(!ptemp)
{
ptemp = (pLogListItem)calloc(sizeof(LogListItem), 1);
if (!ptemp)
return NULL;
} else {
ptemp->Next = (pLogListItem)calloc(sizeof(LogListItem), 1);
if (!ptemp->Next)
return NULL;
ptemp = ptemp->Next;
}
ptemp->LogLine = (char *)malloc(strlen(logitem) + 1);
if (!ptemp->LogLine)
return NULL;
strcpy(ptemp->LogLine, logitem);
return (ptemp);
}
void LogOutAndClean(
BOOL print
)
/*++
Routine Description:
output the log output, and free all the items in the list
Arguments:
none
Return Value:
none
--*/
{
pLogListItem ptemp;
pLogListItem plog = pLogList;
while(plog)
{
ptemp = plog;
if(print)
{
fputs(plog->LogLine, stderr);
}
plog = plog->Next;
free(ptemp->LogLine);
free(ptemp);
}
if(print)
{
fprintf(stderr, "\n");
}
pLogListTmp = pLogList = NULL;
}
void
__cdecl
LogPrintf(
const char *format,
...
)
/*++
Routine Description:
logging wrapper for fprintf
Arguments:
none
Return Value:
none
--*/
{
va_list arglist;
char LogStr[1024];
va_start(arglist, format);
vsprintf(LogStr, format, arglist);
if(pLogList == NULL)
{
//
// initialize log
//
pLogListTmp = pLogList = LogAppend(LogStr, NULL);
} else {
//
// append to log
//
pLogListTmp = LogAppend(LogStr, pLogListTmp);
}
}