hasherezade/pe-sieve
1
0
Fork 0
mirror of https://github.com/hasherezade/pe-sieve.git synced 2026-10-12 02:15:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

[REFACT] Cleaned up types to avoid MinGW warning

Browse Source
This commit is contained in:
hasherezade
2025-02-21 02:23:43 +01:00
parent b75bfce5ab
commit 1b38bf78cb
6 changed files with 35 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libpeconv
+1 -1
Submodule libpeconv updated: 1222db3a3c...d8b02e0394
postprocessors/pe_buffer.h
+2 -2
View File
@@ -59,8 +59,8 @@ namespace pesieve {
// Dumps the PE into a file with a given name.
bool dumpPeToFile(IN std::string dumpFileName,
IN OUT peconv::t_pe_dump_mode &dumpMode,
IN OPTIONAL const peconv::ExportsMapper* exportsMap = NULL,
OUT OPTIONAL peconv::ImpsNotCovered *notCovered = NULL
IN OPTIONAL const peconv::ExportsMapper* exportsMap = nullptr,
OUT OPTIONAL peconv::ImpsNotCovered *notCovered = nullptr
);
bool dumpToFile(IN std::string dumpFileName);
scanners/module_data.cpp
+5 -4
View File
@@ -343,11 +343,11 @@ bool pesieve::RemoteModuleData::loadHeader()
ULONGLONG pesieve::RemoteModuleData::getRemoteSectionVa(const size_t section_num)
{
if (!this->isInitialized()) return NULL;
if (!this->isInitialized()) return 0;
PIMAGE_SECTION_HEADER section_hdr = peconv::get_section_hdr(headerBuffer, peconv::MAX_HEADER_SIZE, section_num);
if ((section_hdr == NULL) || section_hdr->SizeOfRawData == 0) {
return NULL;
if (!section_hdr || (section_hdr->SizeOfRawData == 0)) {
return 0;
}
return (ULONGLONG) modBaseAddr + section_hdr->VirtualAddress;
}
@@ -378,7 +378,7 @@ bool pesieve::RemoteModuleData::isSectionExecutable(const size_t section_number,
//for special cases when the section is not set executable in headers, but in reality is executable...
//get the section header from the module:
ULONGLONG start_va = getRemoteSectionVa(section_number);
if (start_va == NULL) {
if (!start_va) {
return false;
}
MEMORY_BASIC_INFORMATION page_info = { 0 };
@@ -431,3 +431,4 @@ size_t pesieve::RemoteModuleData::calcImgSize()
return ArtefactScanner::calcImgSize(this->processHandle, this->modBaseAddr, this->headerBuffer, peconv::MAX_HEADER_SIZE);
}
scanners/patch_analyzer.cpp
+19 -20
View File
@@ -10,38 +10,37 @@ ULONGLONG pesieve::PatchAnalyzer::getJmpDestAddr(ULONGLONG currVA, int instrLen,
return addr;
}
size_t pesieve::PatchAnalyzer::parseShortJmp(PatchList::Patch &patch, PBYTE patch_ptr, ULONGLONG patch_va)
size_t pesieve::PatchAnalyzer::parseShortJmp(PatchList::Patch &patch, BYTE* patch_ptr, ULONGLONG patch_va)
{
const size_t instr_size = 2;
if (!peconv::validate_ptr(this->patchedCode, this->codeSize, patch_ptr, instr_size)) {
return 0;
}
BYTE *lval = (BYTE*)((ULONGLONG)patch_ptr + 1);
BYTE *lval = reinterpret_cast<BYTE*>((ULONG_PTR)patch_ptr + 1);
ULONGLONG addr = getJmpDestAddr<BYTE>(patch_va, instr_size, (*lval));
patch.setHookTarget(addr);
return instr_size;
}
size_t pesieve::PatchAnalyzer::parseJmp(PatchList::Patch &patch, PBYTE patch_ptr, ULONGLONG patch_va)
size_t pesieve::PatchAnalyzer::parseJmp(PatchList::Patch &patch, BYTE* patch_ptr, ULONGLONG patch_va)
{
const size_t instr_size = 5;
if (!peconv::validate_ptr(this->patchedCode, this->codeSize, patch_ptr, instr_size)) {
return 0;
}
DWORD *lval = (DWORD*)((ULONGLONG) patch_ptr + 1);
DWORD *lval = reinterpret_cast<DWORD*>((ULONG_PTR) patch_ptr + 1);
ULONGLONG addr = getJmpDestAddr<DWORD>(patch_va, instr_size, (*lval));
patch.setHookTarget(addr);
return instr_size;
}
size_t pesieve::PatchAnalyzer::parseJmpViaAddr(PatchList::Patch &patch, PBYTE patch_ptr, ULONGLONG patch_va)
size_t pesieve::PatchAnalyzer::parseJmpViaAddr(PatchList::Patch &patch, BYTE* patch_ptr, ULONGLONG patch_va)
{
const size_t instr_size = 6;
ULONGLONG addr = NULL;
DWORD *lval = (DWORD*)((ULONGLONG)patch_ptr + 2);
DWORD *lval = reinterpret_cast<DWORD*>((ULONG_PTR)patch_ptr + 2);
if (!isModule64bit) { //32bit
patch.setHookTarget(*lval, false);
}
@@ -52,14 +51,14 @@ size_t pesieve::PatchAnalyzer::parseJmpViaAddr(PatchList::Patch &patch, PBYTE pa
return instr_size;
}
size_t pesieve::PatchAnalyzer::parseMovJmp(PatchList::Patch &patch, PBYTE patch_ptr, bool is_long)
size_t pesieve::PatchAnalyzer::parseMovJmp(PatchList::Patch &patch, BYTE* patch_ptr, bool is_long)
{
size_t mov_instr_len = is_long ? 9 : 5;
if (!peconv::validate_ptr(this->patchedCode, this->codeSize, patch_ptr, mov_instr_len + 2)) {
return 0;
}
PBYTE jmp_ptr = patch_ptr + mov_instr_len; // next instruction
BYTE* jmp_ptr = patch_ptr + mov_instr_len; // next instruction
if (is64Modifier(*patch_ptr)) {
patch_ptr++;
jmp_ptr++;
@@ -87,22 +86,22 @@ size_t pesieve::PatchAnalyzer::parseMovJmp(PatchList::Patch &patch, PBYTE patch_
#ifdef _DEBUG
std::cerr << "It is not MOV->JMP" << std::hex << (DWORD)jmp_ptr[0] << std::endl;
#endif
return NULL;
return 0;
}
//TODO: take into account also modifiers
if (reg_id1 != reg_id0) {
#ifdef _DEBUG
std::cerr << "MOV->JMP : reg mismatch" << std::endl;
#endif
return NULL;
return 0;
}
size_t patch_size = mov_instr_len;
ULONGLONG addr = NULL;
ULONGLONG addr = 0;
if (!is_long) { //32bit
DWORD *lval = (DWORD*)((ULONGLONG) patch_ptr + 1);
DWORD *lval = reinterpret_cast<DWORD*>((ULONG_PTR) patch_ptr + 1);
addr = *lval;
} else { //64bit
ULONGLONG *lval = (ULONGLONG*)((ULONGLONG) patch_ptr + 1);
ULONGLONG *lval = reinterpret_cast<ULONGLONG*>((ULONG_PTR) patch_ptr + 1);
addr = *lval;
}
patch_size += 2; //add jump reg size
@@ -113,18 +112,18 @@ size_t pesieve::PatchAnalyzer::parseMovJmp(PatchList::Patch &patch, PBYTE patch_
return patch_size;
}
size_t pesieve::PatchAnalyzer::parsePushRet(PatchList::Patch &patch, PBYTE patch_ptr)
size_t pesieve::PatchAnalyzer::parsePushRet(PatchList::Patch &patch, BYTE* patch_ptr)
{
size_t instr_size = 5;
if (!peconv::validate_ptr(this->patchedCode, this->codeSize, patch_ptr, instr_size + 1)) {
return 0;
}
PBYTE ret_ptr = patch_ptr + instr_size; // next instruction
BYTE* ret_ptr = reinterpret_cast<BYTE*>((ULONG_PTR) patch_ptr + instr_size); // next instruction
if (ret_ptr[0] != 0xC3) {
return NULL; // this is not push->ret
return 0; // this is not push->ret
}
instr_size++;
DWORD *lval = (DWORD*)((ULONGLONG) patch_ptr + 1);
DWORD *lval = reinterpret_cast<DWORD*>((ULONG_PTR) patch_ptr + 1);
patch.setHookTarget(*lval);
return instr_size;
}
@@ -147,7 +146,7 @@ bool pesieve::PatchAnalyzer::isLongModifier(BYTE op)
return false;
}
size_t pesieve::PatchAnalyzer::_analyzeHook(PatchList::Patch &patch, PBYTE patch_ptr, ULONGLONG patch_va)
size_t pesieve::PatchAnalyzer::_analyzeHook(PatchList::Patch &patch, BYTE* patch_ptr, ULONGLONG patch_va)
{
BYTE op = patch_ptr[0];
if (op == OP_JMP || op == OP_CALL_DWORD) {
scanners/patch_analyzer.h
+7 -6
View File
@@ -2,6 +2,7 @@
#include "module_data.h"
#include "patch_list.h"
#include <set>
namespace pesieve {
@@ -30,14 +31,14 @@ namespace pesieve {
size_t analyzeOther(PatchList::Patch& patch);
protected:
size_t _analyzeHook(PatchList::Patch &patch, PBYTE patch_ptr, ULONGLONG patch_va);
size_t _analyzeHook(PatchList::Patch &patch, BYTE* patch_ptr, ULONGLONG patch_va);
size_t _analyzeRelocated(PatchList::Patch &patch, BYTE* patch_ptr);
size_t parseJmpViaAddr(PatchList::Patch &patch, PBYTE patch_ptr, ULONGLONG patch_va);
size_t parseShortJmp(PatchList::Patch &patch, PBYTE patch_ptr, ULONGLONG patch_va);
size_t parseJmp(PatchList::Patch &patch, PBYTE patch_ptr, ULONGLONG patch_va);
size_t parseMovJmp(PatchList::Patch &patch, PBYTE patch_ptr, bool is_long);
size_t parsePushRet(PatchList::Patch &patch, PBYTE patch_ptr);
size_t parseJmpViaAddr(PatchList::Patch &patch, BYTE* patch_ptr, ULONGLONG patch_va);
size_t parseShortJmp(PatchList::Patch &patch, BYTE* patch_ptr, ULONGLONG patch_va);
size_t parseJmp(PatchList::Patch &patch, BYTE* patch_ptr, ULONGLONG patch_va);
size_t parseMovJmp(PatchList::Patch &patch, BYTE* patch_ptr, bool is_long);
size_t parsePushRet(PatchList::Patch &patch, BYTE* patch_ptr);
template <typename DELTA_T>
ULONGLONG getJmpDestAddr(ULONGLONG currVA, int instrLen, DELTA_T lVal);
utils/path_converter.cpp
+1 -1
View File
@@ -61,7 +61,7 @@ namespace pesieve {
FILE_OPEN,
FILE_NON_DIRECTORY_FILE,
NULL,
NULL
0
);
if (status != STATUS_SUCCESS) {
std::wcerr << "Cannot open file: " << filePath << ". Error: " << std::hex << status << std::endl;