Skip to content

Commit 50ff6eb

Browse files
committed
- added section about exported functions
- added cross-references
1 parent 39c4c17 commit 50ff6eb

File tree

1 file changed

+45
-9
lines changed

1 file changed

+45
-9
lines changed

doc/readme.txt

Lines changed: 45 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,8 @@ about symbols, etc::
109109
WORD Characteristics;
110110
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
111111

112+
.. _OptionalHeader:
113+
112114
The `OptionalHeader` contains informations about the *logical* format of the library,
113115
including required OS version, memory requirements and entry points::
114116

@@ -155,6 +157,8 @@ including required OS version, memory requirements and entry points::
155157
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
156158
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;
157159

160+
.. _DataDirectory:
161+
158162
The `DataDirectory` contains 16 (`IMAGE_NUMBEROF_DIRECTORY_ENTRIES`) entries
159163
defining the logical components of the library:
160164

@@ -200,7 +204,7 @@ the exports entry is required.
200204
Section header
201205
---------------
202206

203-
The section header is stored after the `OptionalHeader` structure in the PE
207+
The section header is stored after the OptionalHeader_ structure in the PE
204208
header. Microsoft provides the macro `IMAGE_FIRST_SECTION` to get the start
205209
address based on the PE header.
206210

@@ -273,7 +277,7 @@ All memory required for the library must be reserved / allocated using
273277
This is required to restrict access to the memory, like blocking write access
274278
to the code or constant data.
275279

276-
The `OptionalHeader` structure defines the size of the required memory block
280+
The OptionalHeader_ structure defines the size of the required memory block
277281
for the library. It must be reserved at the address specified by `ImageBase`
278282
if possible::
279283

@@ -302,7 +306,7 @@ Before copying the data, the memory block must get committed::
302306

303307
Sections without data in the file (like data sections for the used variables)
304308
have a `SizeOfRawData` of `0`, so you can use the `SizeOfInitializedData`
305-
or `SizeOfUninitializedData` of the `OptionalHeader`. Which one must get
309+
or `SizeOfUninitializedData` of the OptionalHeader_. Which one must get
306310
choosen depending on the bit flags `IMAGE_SCN_CNT_INITIALIZED_DATA` and
307311
`IMAGE_SCN_CNT_UNINITIALIZED_DATA` that may be set in the section`s
308312
characteristics.
@@ -312,13 +316,14 @@ Base relocation
312316
----------------
313317

314318
All memory addresses in the code / data sections of a library are stored relative
315-
to the address defined by `ImageBase` in the `OptionalHeader`. If the library
319+
to the address defined by `ImageBase` in the OptionalHeader_. If the library
316320
can't be imported to this memory address, the references must get adjusted
317321
=> *relocated*. The file format helps for this by storing informations about
318322
all these references in the base relocation table, which can be found in the
319-
directory entry 5 of the `DataDirectory` in the `OptionalHeader`.
323+
directory entry 5 of the DataDirectory_ in the OptionalHeader_.
320324

321325
This table consists of a series of this structure
326+
322327
::
323328

324329
typedef struct _IMAGE_BASE_RELOCATION {
@@ -342,7 +347,7 @@ IMAGE_REL_BASED_HIGHLOW
342347
Resolve imports
343348
----------------
344349

345-
The directory entry 0 of the `DataDirectory` in the `OptionalHeader` specifies
350+
The directory entry 1 of the DataDirectory_ in the OptionalHeader_ specifies
346351
a list of libraries to import symbols from. Each entry in this list is defined
347352
as follows::
348353

@@ -452,7 +457,32 @@ Afterwards we can use the exported functions as with any normal library.
452457
Exported functions
453458
===================
454459

455-
TODO
460+
If you want to access the functions that are exported by the library, you need to find the entry
461+
point to a symbol, i.e. the name of the function to call.
462+
463+
The directory entry 0 of the DataDirectory_ in the OptionalHeader_ contains informations about
464+
the exported functions. It's defined as follows::
465+
466+
typedef struct _IMAGE_EXPORT_DIRECTORY {
467+
DWORD Characteristics;
468+
DWORD TimeDateStamp;
469+
WORD MajorVersion;
470+
WORD MinorVersion;
471+
DWORD Name;
472+
DWORD Base;
473+
DWORD NumberOfFunctions;
474+
DWORD NumberOfNames;
475+
DWORD AddressOfFunctions; // RVA from base of image
476+
DWORD AddressOfNames; // RVA from base of image
477+
DWORD AddressOfNameOrdinals; // RVA from base of image
478+
} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;
479+
480+
First thing to do, is to map the name of the function to the ordinal number of the exported
481+
symbol. Therefore, just walk the arrays defined by `AddressOfNames` and `AddressOfNameOrdinals`
482+
parallel until you found the required name.
483+
484+
Now you can use the ordinal number to read the address by evaluating the n-th element of the
485+
`AddressOfFunctions` array.
456486

457487

458488
Freeing the library
@@ -478,17 +508,23 @@ The interface is very similar to the standard methods for loading of libraries::
478508

479509
typedef void *HMEMORYMODULE;
480510

481-
HMEMORYMODULE MemoryLoadLibrary(const void *, const size_t);
511+
HMEMORYMODULE MemoryLoadLibrary(const void *);
482512
FARPROC MemoryGetProcAddress(HMEMORYMODULE, const char *);
483513
void MemoryFreeLibrary(HMEMORYMODULE);
484514

485515

486516
Downloads
487517
----------
488518

489-
Currently, MemoryModule is only available from my SVN server at
519+
The latest development release can always be grabbed from my development SVN-Server at
490520
https://leviathan.joachim-bauch.de/cgi-bin/viewcvs.cgi/MemoryModule/trunk/?root=misc
491521

522+
Please note that it's located in my room so it doesn't run 24/7 and is often offline during
523+
nights or on weekends. If you encounter problems connecting, please try again some other
524+
time of day.
525+
526+
All released versions can be downloaded from the list below.
527+
492528

493529
Known issues
494530
-------------

0 commit comments

Comments
 (0)