Click here to Skip to main content
15,918,485 members
Home / Discussions / C / C++ / MFC
   

C / C++ / MFC

 
GeneralRe: Bmp to jpg convertion Pin
Anonymous8-Apr-03 1:40
Anonymous8-Apr-03 1:40 
GeneralRe: Bmp to jpg convertion Pin
Chris Losinger8-Apr-03 1:42
professionalChris Losinger8-Apr-03 1:42 
GeneralRe: Bmp to jpg convertion Pin
Dudi Avramov8-Apr-03 1:54
Dudi Avramov8-Apr-03 1:54 
GeneralRe: Bmp to jpg convertion Pin
RaajaOfSelf9-Apr-03 13:08
RaajaOfSelf9-Apr-03 13:08 
GeneralList exported function in DLL Pin
AnTri8-Apr-03 0:22
AnTri8-Apr-03 0:22 
GeneralRe: List exported function in DLL Pin
vmaltsev8-Apr-03 5:06
vmaltsev8-Apr-03 5:06 
GeneralRe: List exported function in DLL Pin
AnTri8-Apr-03 11:04
AnTri8-Apr-03 11:04 
GeneralRe: List exported function in DLL Pin
Dudi Avramov8-Apr-03 23:04
Dudi Avramov8-Apr-03 23:04 
Download from MSDN the sample PEDump in article "Peering Inside the PE: A Tour of the Win32 Portable Executable File Format".

However, the function DumpExportsSection doesn't work since it looks for
the section ".edata" which sometimes is contained in ".rdata" section.
Therefore i put some changes according to other sample.

Add the following at the beginning of EXEDump.c :

#define GetImgDirEntryRVA( pNTHdr, IDE ) \
	(pNTHdr->OptionalHeader.DataDirectory[IDE].VirtualAddress)

#define GetImgDirEntrySize( pNTHdr, IDE ) \
	(pNTHdr->OptionalHeader.DataDirectory[IDE].Size)

PIMAGE_SECTION_HEADER GetEnclosingSectionHeader(DWORD rva, PIMAGE_NT_HEADERS pNTHeader) 
{
    PIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION(pNTHeader);
    unsigned i;
    
    for ( i=0; i < pNTHeader->FileHeader.NumberOfSections; i++, section++ )
    {
		// This 3 line idiocy is because Watcom's linker actually sets the
		// Misc.VirtualSize field to 0.  (!!! - Retards....!!!)
		DWORD size = section->Misc.VirtualSize;
		if ( 0 == size )
			size = section->SizeOfRawData;
			
        // Is the RVA within this section?
        if ( (rva >= section->VirtualAddress) && 
             (rva < (section->VirtualAddress + size)))
            return section;
    }
    
    return 0;
}

LPVOID GetPtrFromRVA( DWORD rva, PIMAGE_NT_HEADERS pNTHeader, PBYTE imageBase )
{
	PIMAGE_SECTION_HEADER pSectionHdr;
	INT delta;
		
	pSectionHdr = GetEnclosingSectionHeader( rva, pNTHeader );
	if ( !pSectionHdr )
		return 0;

	delta = (INT)(pSectionHdr->VirtualAddress-pSectionHdr->PointerToRawData);
	return (PVOID) ( imageBase + rva - delta );
}



Replace the function DumpExportsSection with the new one:

void DumpExportsSection(DWORD base, PIMAGE_NT_HEADERS pNTHeader)
{
	PIMAGE_EXPORT_DIRECTORY exportDir;
	PIMAGE_SECTION_HEADER header;
	INT delta; 
	PSTR filename;
	DWORD i;
	PDWORD functions;
	PWORD ordinals;
	PSTR *name;

	DWORD exportsStartRVA, exportsEndRVA;
    
	exportsStartRVA = GetImgDirEntryRVA(pNTHeader,IMAGE_DIRECTORY_ENTRY_EXPORT);
	exportsEndRVA = exportsStartRVA +
	   				GetImgDirEntrySize(pNTHeader, IMAGE_DIRECTORY_ENTRY_EXPORT);

	
	// Get the IMAGE_SECTION_HEADER that contains the exports.  This is
	// usually the .edata section, but doesn't have to be.
	header = GetEnclosingSectionHeader( exportsStartRVA, pNTHeader );
	if ( !header )
		return;

	delta = (INT)(header->VirtualAddress - header->PointerToRawData);
	exportDir = (PIMAGE_EXPORT_DIRECTORY)GetPtrFromRVA(exportsStartRVA, pNTHeader, base);

	/*
	header = GetSectionHeader(".edata", pNTHeader);
	if ( !header )
		return;
	exportDir = MakePtr(PIMAGE_EXPORT_DIRECTORY, base,
						 header->PointerToRawData);
	delta = (INT)(header->VirtualAddress - header->PointerToRawData);
	*/

	filename = (PSTR)(exportDir->Name - delta + base);
		
 	printf("exports table:\n\n");
	printf("  Name:            %s\n", filename);
	printf("  Characteristics: %08X\n", exportDir->Characteristics);
	printf("  TimeDateStamp:   %08X\n", exportDir->TimeDateStamp);
	printf("  Version:         %u.%02u\n", exportDir->MajorVersion,
			exportDir->MajorVersion);
	printf("  Ordinal base:    %08X\n", exportDir->Base);
	printf("  # of functions:  %08X\n", exportDir->NumberOfFunctions);
	printf("  # of Names:      %08X\n", exportDir->NumberOfNames);
	
	functions = (PDWORD)((DWORD)exportDir->AddressOfFunctions - delta + base);
	ordinals = (PWORD)((DWORD)exportDir->AddressOfNameOrdinals - delta + base);
	name = (PSTR *)((DWORD)exportDir->AddressOfNames - delta + base);

	printf("\n  Entry Pt  Ordn  Name\n");
	for ( i=0; i < exportDir->NumberOfNames; i++ )
	{
		printf("  %08X  %4u  %s\n", *functions,
				*ordinals + exportDir->Base,
				(*name - delta + base));
		name++;			// Bump each pointer to the next array element
		ordinals++;
		functions++;
	}
}



Anyway, if you want me to email you the full sample then send me your
e-mail.

Dudi
GeneralCListView Pin
rosen7-Apr-03 23:59
rosen7-Apr-03 23:59 
GeneralRe: CListView Pin
jhwurmbach8-Apr-03 0:16
jhwurmbach8-Apr-03 0:16 
Generalcontext mneu question Pin
Jump_Around7-Apr-03 23:50
Jump_Around7-Apr-03 23:50 
GeneralRe: context mneu question Pin
Brian Shifrin8-Apr-03 1:15
Brian Shifrin8-Apr-03 1:15 
GeneralRe: context mneu question Pin
Cedric Moonen8-Apr-03 1:19
Cedric Moonen8-Apr-03 1:19 
QuestionUnzipping? Pin
Brian Delahunty7-Apr-03 23:09
Brian Delahunty7-Apr-03 23:09 
AnswerRe: Unzipping? Pin
jhwurmbach7-Apr-03 23:27
jhwurmbach7-Apr-03 23:27 
GeneralScrollWindow Pin
jeremysay7-Apr-03 23:04
jeremysay7-Apr-03 23:04 
GeneralRe: ScrollWindow Pin
Brian Shifrin8-Apr-03 1:20
Brian Shifrin8-Apr-03 1:20 
GeneralRe: ScrollWindow Pin
jeremysay8-Apr-03 2:06
jeremysay8-Apr-03 2:06 
GeneralRe: ScrollWindow Pin
Brian Shifrin8-Apr-03 13:48
Brian Shifrin8-Apr-03 13:48 
GeneralRe: ScrollWindow Pin
jeremysay9-Apr-03 3:21
jeremysay9-Apr-03 3:21 
GeneralHook problem Pin
_Theo_7-Apr-03 22:24
_Theo_7-Apr-03 22:24 
GeneralBitmap buttons Pin
yashraj7-Apr-03 22:19
yashraj7-Apr-03 22:19 
GeneralRe: Bitmap buttons Pin
Mahesh Varma8-Apr-03 0:41
Mahesh Varma8-Apr-03 0:41 
GeneralRe: Bitmap buttons Pin
yashraj12-Apr-03 0:14
yashraj12-Apr-03 0:14 
GeneralChanging dialog style Pin
Chopper7-Apr-03 22:17
Chopper7-Apr-03 22:17 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.