mirror of
https://github.com/Detanup01/gbe_fork.git
synced 2024-11-23 11:15:34 +08:00
sloppy code is problematic! (at least verify PE signature)
This commit is contained in:
parent
6cc937d4b4
commit
018d4aa2c1
@ -1,3 +1,9 @@
|
|||||||
|
## 2024/2/13
|
||||||
|
|
||||||
|
* cold client loader: validate the PE signature before attempting to detect arch
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
## 2024/2/10
|
## 2024/2/10
|
||||||
|
|
||||||
* a hacky fix for the overlay on directx12, currently very slow when loading images
|
* a hacky fix for the overlay on directx12, currently very slow when loading images
|
||||||
|
@ -24,19 +24,23 @@ PIMAGE_NT_HEADERS pe_helpers::get_nt_header(HMODULE hModule)
|
|||||||
{
|
{
|
||||||
// https://dev.to/wireless90/validating-the-pe-signature-my-av-flagged-me-windows-pe-internals-2m5o/
|
// https://dev.to/wireless90/validating-the-pe-signature-my-av-flagged-me-windows-pe-internals-2m5o/
|
||||||
PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)(char*)hModule;
|
PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)(char*)hModule;
|
||||||
|
if (dosHeader->e_magic != 0x5A4D) { // "MZ"
|
||||||
|
return nullptr;
|
||||||
|
}
|
||||||
LONG newExeHeaderOffset = dosHeader->e_lfanew;
|
LONG newExeHeaderOffset = dosHeader->e_lfanew;
|
||||||
|
|
||||||
return (PIMAGE_NT_HEADERS)((char*)hModule + newExeHeaderOffset);
|
return (PIMAGE_NT_HEADERS)((char*)hModule + newExeHeaderOffset);
|
||||||
}
|
}
|
||||||
|
|
||||||
PIMAGE_FILE_HEADER pe_helpers::get_file_header(HMODULE hModule)
|
PIMAGE_FILE_HEADER pe_helpers::get_file_header(HMODULE hModule)
|
||||||
{
|
{
|
||||||
return &get_nt_header(hModule)->FileHeader;
|
auto nt_header = get_nt_header(hModule);
|
||||||
|
return nt_header ? &nt_header->FileHeader : nullptr;
|
||||||
}
|
}
|
||||||
|
|
||||||
PIMAGE_OPTIONAL_HEADER pe_helpers::get_optional_header(HMODULE hModule)
|
PIMAGE_OPTIONAL_HEADER pe_helpers::get_optional_header(HMODULE hModule)
|
||||||
{
|
{
|
||||||
return &get_nt_header(hModule)->OptionalHeader;
|
auto nt_header = get_nt_header(hModule);
|
||||||
|
return nt_header ? &nt_header->OptionalHeader : nullptr;
|
||||||
}
|
}
|
||||||
|
|
||||||
uint8_t* pe_helpers::search_memory(uint8_t *mem, size_t size, const std::string &search_patt)
|
uint8_t* pe_helpers::search_memory(uint8_t *mem, size_t size, const std::string &search_patt)
|
||||||
@ -234,12 +238,14 @@ std::string pe_helpers::get_err_string(DWORD code)
|
|||||||
|
|
||||||
bool pe_helpers::is_module_64(HMODULE hModule)
|
bool pe_helpers::is_module_64(HMODULE hModule)
|
||||||
{
|
{
|
||||||
return (get_file_header(hModule)->Machine == IMAGE_FILE_MACHINE_AMD64);
|
auto file_header = get_file_header(hModule);
|
||||||
|
return file_header ? (file_header->Machine == IMAGE_FILE_MACHINE_AMD64) : false;
|
||||||
}
|
}
|
||||||
|
|
||||||
bool pe_helpers::is_module_32(HMODULE hModule)
|
bool pe_helpers::is_module_32(HMODULE hModule)
|
||||||
{
|
{
|
||||||
return (get_file_header(hModule)->Machine == IMAGE_FILE_MACHINE_I386);
|
auto file_header = get_file_header(hModule);
|
||||||
|
return file_header ? (file_header->Machine == IMAGE_FILE_MACHINE_I386) : false;
|
||||||
}
|
}
|
||||||
|
|
||||||
pe_helpers::SectionHeadersResult pe_helpers::get_section_headers(HMODULE hModule)
|
pe_helpers::SectionHeadersResult pe_helpers::get_section_headers(HMODULE hModule)
|
||||||
|
@ -58,8 +58,7 @@ std::wstring get_ini_value(LPCWSTR section, LPCWSTR key, LPCWSTR default_val = N
|
|||||||
|
|
||||||
static std::vector<uint8_t> get_pe_header(const std::wstring &filepath)
|
static std::vector<uint8_t> get_pe_header(const std::wstring &filepath)
|
||||||
{
|
{
|
||||||
try
|
try {
|
||||||
{
|
|
||||||
std::ifstream file(filepath, std::ios::binary);
|
std::ifstream file(filepath, std::ios::binary);
|
||||||
if (!file.is_open()) throw;
|
if (!file.is_open()) throw;
|
||||||
|
|
||||||
@ -71,9 +70,8 @@ static std::vector<uint8_t> get_pe_header(const std::wstring &filepath)
|
|||||||
file.close();
|
file.close();
|
||||||
|
|
||||||
return data;
|
return data;
|
||||||
}
|
} catch(const std::exception& e) {
|
||||||
catch(const std::exception& e)
|
dbg_log::write(std::string("Error reading PE header: ") + e.what());
|
||||||
{
|
|
||||||
return std::vector<uint8_t>();
|
return std::vector<uint8_t>();
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user