@@ -109,6 +109,8 @@ about symbols, etc::
109
109
WORD Characteristics;
110
110
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
111
111
112
+ .. _OptionalHeader:
113
+
112
114
The `OptionalHeader` contains informations about the *logical* format of the library,
113
115
including required OS version, memory requirements and entry points::
114
116
@@ -155,6 +157,8 @@ including required OS version, memory requirements and entry points::
155
157
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
156
158
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;
157
159
160
+ .. _DataDirectory:
161
+
158
162
The `DataDirectory` contains 16 (`IMAGE_NUMBEROF_DIRECTORY_ENTRIES`) entries
159
163
defining the logical components of the library:
160
164
@@ -200,7 +204,7 @@ the exports entry is required.
200
204
Section header
201
205
---------------
202
206
203
- The section header is stored after the `OptionalHeader` structure in the PE
207
+ The section header is stored after the OptionalHeader_ structure in the PE
204
208
header. Microsoft provides the macro `IMAGE_FIRST_SECTION` to get the start
205
209
address based on the PE header.
206
210
@@ -273,7 +277,7 @@ All memory required for the library must be reserved / allocated using
273
277
This is required to restrict access to the memory, like blocking write access
274
278
to the code or constant data.
275
279
276
- The `OptionalHeader` structure defines the size of the required memory block
280
+ The OptionalHeader_ structure defines the size of the required memory block
277
281
for the library. It must be reserved at the address specified by `ImageBase`
278
282
if possible::
279
283
@@ -302,7 +306,7 @@ Before copying the data, the memory block must get committed::
302
306
303
307
Sections without data in the file (like data sections for the used variables)
304
308
have a `SizeOfRawData` of `0`, so you can use the `SizeOfInitializedData`
305
- or `SizeOfUninitializedData` of the `OptionalHeader` . Which one must get
309
+ or `SizeOfUninitializedData` of the OptionalHeader_ . Which one must get
306
310
choosen depending on the bit flags `IMAGE_SCN_CNT_INITIALIZED_DATA` and
307
311
`IMAGE_SCN_CNT_UNINITIALIZED_DATA` that may be set in the section`s
308
312
characteristics.
@@ -312,13 +316,14 @@ Base relocation
312
316
----------------
313
317
314
318
All memory addresses in the code / data sections of a library are stored relative
315
- to the address defined by `ImageBase` in the `OptionalHeader` . If the library
319
+ to the address defined by `ImageBase` in the OptionalHeader_ . If the library
316
320
can't be imported to this memory address, the references must get adjusted
317
321
=> *relocated*. The file format helps for this by storing informations about
318
322
all these references in the base relocation table, which can be found in the
319
- directory entry 5 of the `DataDirectory` in the `OptionalHeader` .
323
+ directory entry 5 of the DataDirectory_ in the OptionalHeader_ .
320
324
321
325
This table consists of a series of this structure
326
+
322
327
::
323
328
324
329
typedef struct _IMAGE_BASE_RELOCATION {
@@ -342,7 +347,7 @@ IMAGE_REL_BASED_HIGHLOW
342
347
Resolve imports
343
348
----------------
344
349
345
- The directory entry 0 of the `DataDirectory` in the `OptionalHeader` specifies
350
+ The directory entry 1 of the DataDirectory_ in the OptionalHeader_ specifies
346
351
a list of libraries to import symbols from. Each entry in this list is defined
347
352
as follows::
348
353
@@ -452,7 +457,32 @@ Afterwards we can use the exported functions as with any normal library.
452
457
Exported functions
453
458
===================
454
459
455
- TODO
460
+ If you want to access the functions that are exported by the library, you need to find the entry
461
+ point to a symbol, i.e. the name of the function to call.
462
+
463
+ The directory entry 0 of the DataDirectory_ in the OptionalHeader_ contains informations about
464
+ the exported functions. It's defined as follows::
465
+
466
+ typedef struct _IMAGE_EXPORT_DIRECTORY {
467
+ DWORD Characteristics;
468
+ DWORD TimeDateStamp;
469
+ WORD MajorVersion;
470
+ WORD MinorVersion;
471
+ DWORD Name;
472
+ DWORD Base;
473
+ DWORD NumberOfFunctions;
474
+ DWORD NumberOfNames;
475
+ DWORD AddressOfFunctions; // RVA from base of image
476
+ DWORD AddressOfNames; // RVA from base of image
477
+ DWORD AddressOfNameOrdinals; // RVA from base of image
478
+ } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;
479
+
480
+ First thing to do, is to map the name of the function to the ordinal number of the exported
481
+ symbol. Therefore, just walk the arrays defined by `AddressOfNames` and `AddressOfNameOrdinals`
482
+ parallel until you found the required name.
483
+
484
+ Now you can use the ordinal number to read the address by evaluating the n-th element of the
485
+ `AddressOfFunctions` array.
456
486
457
487
458
488
Freeing the library
@@ -478,17 +508,23 @@ The interface is very similar to the standard methods for loading of libraries::
478
508
479
509
typedef void *HMEMORYMODULE;
480
510
481
- HMEMORYMODULE MemoryLoadLibrary(const void *, const size_t );
511
+ HMEMORYMODULE MemoryLoadLibrary(const void *);
482
512
FARPROC MemoryGetProcAddress(HMEMORYMODULE, const char *);
483
513
void MemoryFreeLibrary(HMEMORYMODULE);
484
514
485
515
486
516
Downloads
487
517
----------
488
518
489
- Currently, MemoryModule is only available from my SVN server at
519
+ The latest development release can always be grabbed from my development SVN-Server at
490
520
https://leviathan.joachim-bauch.de/cgi-bin/viewcvs.cgi/MemoryModule/trunk/?root=misc
491
521
522
+ Please note that it's located in my room so it doesn't run 24/7 and is often offline during
523
+ nights or on weekends. If you encounter problems connecting, please try again some other
524
+ time of day.
525
+
526
+ All released versions can be downloaded from the list below.
527
+
492
528
493
529
Known issues
494
530
-------------
0 commit comments