New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
PE file: Forwarded exports #307
Comments
Thanks @neitsa, I was not aware of this feature on PE files. I would consider the second solution in which we could extend the struct forward_information_t {
std::string library;
std::string function;
};
class LIEF_API ExportEntry : public Object {
...
bool is_forwarded() const;
forward_information_t forward_information() const;
...
}; It can also be a good idea to export the function RVA. |
Yes! It looks great Romain. I think your example + the function RVA should be enough. Thanks a lot! |
Work in progress branch: https://github.com/lief-project/LIEF/tree/issue/307 |
romainthomas
pushed a commit
that referenced
this issue
Jul 13, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Is your feature request related to a problem? Please describe.
Unless I'm mistaken, as of LIEF
0.10.0-9dd9ded
when parsing exported functions from a PE shared library, there's no (easy) way to know - when an export is forwarded - to which DLL the export function is forwarded to and what its name in the forwarded DLL.[edit] This export forwarding mechanism is explained in the PE specification here and is called "Forwarder RVA".
As of now the
address
member is just 0.Example with
kernel32
from windows 10.The same goes for the
exported_functions
member.Let's take the same example with
AcquireSRWLockExclusive
.The function RVA is 0x92c6f:
Given the export table start and size:
We can see that the exported function RVA (0x92c6f) is within the bounds of the export table.
The RVA translated to an offset gives 0x9186f, at which we find the forwarder string (namely
NTDLL.RtlAcquireSRWLockExclusive
:Describe the solution you'd like
lief.Function
indicating if the export is actually forwarded (external) or not (this flag exist inlief.PE.ExportEntry
but it's tricky becauseexported_functions
is a list oflief.Function
and not ofPE.ExportEntry
). If the export is forwarded, the name of the DLL and the forwaded function name.Describe alternatives you've considered
Parsing everything manually as demonstrated above. It's a bit tedious.
Additional context
I can give you a hand on implementing this if you want to talk about it👍
The text was updated successfully, but these errors were encountered: