Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add ExportedSymbol::IsForwarder #437

Closed
Washi1337 opened this issue Jun 2, 2023 · 0 comments · Fixed by #440
Closed

Add ExportedSymbol::IsForwarder #437

Washi1337 opened this issue Jun 2, 2023 · 0 comments · Fixed by #440
Labels
enhancement pe Issues related to AsmResolver.PE
Milestone

Comments

@Washi1337
Copy link
Owner

Problem Description

As per PE Format specification, symbols defined in the Export Data directory can be forwarders to exported symbols defined in other, external modules. In such a case, the exported reference (as exposed by the ExportedSymbol::Address property) points to a name within the export directory itself, as opposed to some code or data somewhere else in the PE.

Currently there is no way to easily distinguish between normal exports and forwarder exports, nor is there a way for the builder to define new forwarder exports.

Proposal

Add string? ForwardedSymbolName and bool IsForwarder properties to ExportedSymbol.

Alternatives

Users could implement a read-only version of the IsForwarder property themselves by testing whether Address falls within the VA and Size of the export data directory exposed by the optional header. This, however, assumes that this information is available, which is not necessarily the case for PEs that are constructed from scratch.

Besides, the current PE builder does not support creating forwarder exports, so saving them is impossible right now without some heavy customization of the existing PE builders themselves.

Additional Context

Exports are often forwarded in many Windows DLLs. For example, kernel32.dll defines many exports that are forwarded to ntdll.dll or kernelbase.dll.

@Washi1337 Washi1337 added enhancement pe Issues related to AsmResolver.PE labels Jun 2, 2023
@Washi1337 Washi1337 added this to the 5.4.0 milestone Jun 2, 2023
@Washi1337 Washi1337 linked a pull request Jun 9, 2023 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement pe Issues related to AsmResolver.PE
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant