procedure DestroyExportTreeNode(Node: PExportTreeNode); begin if Assigned(Node) then begin DestroyExportTreeNode(Node^.Next); DestroyExportTreeNode(Node^.Down); FreeMem(Node); end; end;
constructor TExportTree.Create; begin inherited Create; Root := nil; end;
destructor TExportTree.Destroy; begin DestroyExportTreeNode(Root); inherited Destroy; end;
procedure TExportTree.Dump; var Ident: Integer;
procedure DumpNode(Node: PExportTreeNode); var SubNode: PExportTreeNode; IdentCounter, IdentOld: Integer; begin for IdentCounter := 1 to Ident do Write(' '); Write(Node^.TheChar); IdentOld := Ident; SubNode := Node^.Next; while Assigned(SubNode) do begin Write(SubNode.TheChar); if not Assigned(SubNode^.Next) then break; Inc(Ident); SubNode := SubNode^.Next; end; Writeln; Inc(Ident); while Assigned(SubNode) and (SubNode <> Node) do begin if Assigned(SubNode^.Down) then DumpNode(SubNode^.Down); SubNode := SubNode^.Prevoius; Dec(Ident); end; Ident := IdentOld; if Assigned(Node^.Down) then DumpNode(Node^.Down); end;
begin Ident := 0; DumpNode(Root); end;
function TExportTree.Add(FunctionName: string; Link: TExportTreeLink): Boolean; var StringLength, Position, PositionCounter: Integer; NewNode, LastNode, Node: PExportTreeNode; StringChar, NodeChar: Char; begin Result := False; StringLength := Length(FunctionName); if StringLength > 0 then begin LastNode := nil; Node := Root; for Position := 1 to StringLength do begin StringChar := FunctionName[Position]; if Assigned(Node) then begin NodeChar := Node^.TheChar; if NodeChar = StringChar then begin LastNode := Node; Node := Node^.Next; end else begin while (NodeChar < StringChar) and Assigned(Node^.Down) do begin Node := Node^.Down; NodeChar := Node^.TheChar; end;
if NodeChar = StringChar then begin LastNode := Node; Node := Node^.Next; end else begin NewNode := CreateExportTreeNode(StringChar); if NodeChar < StringChar then begin NewNode^.Down := Node^.Down; NewNode^.Up := Node; if Assigned(NewNode^.Down) then begin NewNode^.Down^.Up := NewNode; end; NewNode^.Prevoius := Node^.Prevoius; Node^.Down := NewNode; end else if NodeChar > StringChar then begin NewNode^.Down := Node; NewNode^.Up := Node^.Up; if Assigned(NewNode^.Up) then begin NewNode^.Up^.Down := NewNode; end; NewNode^.Prevoius := Node^.Prevoius; if not Assigned(NewNode^.Up) then begin if Assigned(NewNode^.Prevoius) then begin NewNode^.Prevoius^.Next := NewNode; end else begin Root := NewNode; end; end; Node^.Up := NewNode; end; LastNode := NewNode; Node := LastNode^.Next; end; end; end else begin for PositionCounter := Position to StringLength do begin NewNode := CreateExportTreeNode(functionName[PositionCounter]); if Assigned(LastNode) then begin NewNode^.Prevoius := LastNode; LastNode^.Next := NewNode; LastNode := LastNode^.Next; end else begin if not Assigned(Root) then begin Root := NewNode; LastNode := Root; end; end; end; break; end; end;
if Assigned(LastNode) then begin if not LastNode^.LinkExist then begin LastNode^.Link := Link; LastNode^.LinkExist := True; Result := True; end; end; end; end;
function TExportTree.Delete(FunctionName: string): Boolean; var StringLength, Position: Integer; Node: PExportTreeNode; StringChar, NodeChar: Char; begin Result := False; StringLength := Length(FunctionName); if StringLength > 0 then begin Node := Root; for Position := 1 to StringLength do begin StringChar := FunctionName[Position]; if Assigned(Node) then begin NodeChar := Node^.TheChar; while (NodeChar <> StringChar) and Assigned(Node^.Down) do begin Node := Node^.Down; NodeChar := Node^.TheChar; end; if NodeChar = StringChar then begin if (Position = StringLength) and Node^.LinkExist then begin Node^.LinkExist := False; Result := True; break; end; Node := Node^.Next; end; end else begin break; end; end; end; end;
function TExportTree.Find(FunctionName: string; var Link: TExportTreeLink): Boolean; var StringLength, Position: Integer; Node: PExportTreeNode; StringChar, NodeChar: Char; begin Result := False; StringLength := Length(FunctionName); if StringLength > 0 then begin Node := Root; for Position := 1 to StringLength do begin StringChar := FunctionName[Position]; if Assigned(Node) then begin NodeChar := Node^.TheChar; while (NodeChar <> StringChar) and Assigned(Node^.Down) do begin Node := Node^.Down; NodeChar := Node^.TheChar; end; if NodeChar = StringChar then begin if (Position = StringLength) and Node^.LinkExist then begin Link := Node^.Link; Result := True; break; end; Node := Node^.Next; end; end else begin break; end; end; end; end;
constructor TDLLLoader.Create; begin inherited Create;
destructor TDLLLoader.Destroy; begin if @DLLProc <> nil then Unload; if Assigned(ExportTree) then ExportTree.Destroy;
inherited Destroy; end;
function TDLLLoader.FindExternalLibrary(LibraryName: string): Integer; var I: Integer; begin Result := -1;
for I := 0 to Length(ExternalLibraryArray) - 1 do begin if ExternalLibraryArray[I].LibraryName = LibraryName then begin Result := I; exit; end; end; end;
function TDLLLoader.LoadExternalLibrary(LibraryName: string): Integer; begin Result := FindExternalLibrary(LibraryName);
if Result < 0 then begin Result := Length(ExternalLibraryArray); SetLength(ExternalLibraryArray, Length(ExternalLibraryArray) + 1); ExternalLibraryArray[RESULT].LibraryName := LibraryName; ExternalLibraryArray[RESULT].LibraryHandle := LoadLibrary(PChar(LibraryName)); end; end;
function TDLLLoader.GetExternalLibraryHandle(LibraryName: string): LongWord; var I: Integer; begin Result := 0; for I := 0 to Length(ExternalLibraryArray) - 1 do begin if ExternalLibraryArray[I].LibraryName = LibraryName then begin Result := ExternalLibraryArray[I].LibraryHandle; exit; end; end; end;
function TDLLLoader.Load(Stream: TStream): Boolean; var ImagedoSHeader: TImagedoSHeader; ImageNTHeaders: TImageNTHeaders; OldProtect: LongWord;
function ConvertPointer(RVA: LongWord): Pointer; var I: Integer; begin Result := nil; for I := 0 to Length(Sections) - 1 do begin if (RVA < (Sections[I].RVA + Sections[I].Size)) and (RVA >= Sections[I].RVA) then begin Result := Pointer(LongWord((RVA - LongWord(Sections[I].RVA)) + LongWord(Sections[I].Base))); exit; end; end; end;
function ReadImageHeaders: Boolean; begin Result := False; if Stream.Size > 0 then begin FillChar(ImageNTHeaders, SizeOf(TImageNTHeaders), #0); if Stream.Read(ImagedoSHeader, SizeOf(TImagedoSHeader)) <> SizeOf(TImagedoSHeader) then exit; if ImagedoSHeader.Signature <> $5A4D then exit; if Stream.Seek(ImagedoSHeader.LFAOffset, soFromBeginning) <> LongInt(ImagedoSHeader.LFAOffset) then exit; if Stream.Read(ImageNTHeaders.Signature, SizeOf(LongWord)) <> SizeOf(LongWord) then exit; if ImageNTHeaders.Signature <> $00004550 then exit; if Stream.Read(ImageNTHeaders.FileHeader, SizeOf(TImageFileHeader)) <> SizeOf(TImageFileHeader) then exit; if ImageNTHeaders.FileHeader.Machine <> $14C then exit; if Stream.Read(ImageNTHeaders.OptionalHeader, ImageNTHeaders.FileHeader.SizeOfOptionalHeader) <> ImageNTHeaders.FileHeader.SizeOfOptionalHeader then exit;
Result := True; end; end;
function InitializeImage: Boolean; var SectionBase: Pointer; OldPosition: Integer; begin Result := False; if ImageNTHeaders.FileHeader.NumberOfSections > 0 then begin ImageBase := VirtualAlloc(nil, ImageNTHeaders.OptionalHeader.SizeOfImage, MEM_RESERVE, PAGE_NOACCESS); ImageBaseDelta := LongWord(ImageBase) - ImageNTHeaders.OptionalHeader.ImageBase; SectionBase := VirtualAlloc(ImageBase, ImageNTHeaders.OptionalHeader.SizeOfHeaders, MEM_COMMIT, PAGE_READWRITE); OldPosition := Stream.Position; Stream.Seek(0, soFromBeginning); Stream.Read(SectionBase^, ImageNTHeaders.OptionalHeader.SizeOfHeaders); VirtualProtect(SectionBase, ImageNTHeaders.OptionalHeader.SizeOfHeaders, PAGE_REAdoNLY, OldProtect); Stream.Seek(OldPosition, soFromBeginning);
Result := True; end; end;
function ReadSections: Boolean; var I: Integer; Section: TImageSectionHeader; SectionHeaders: PImageSectionHeaders; begin Result := False;
if ImageNTHeaders.FileHeader.NumberOfSections > 0 then begin GetMem(SectionHeaders, ImageNTHeaders.FileHeader.NumberOfSections * SizeOf (TImageSectionHeader)); if Stream.Read(SectionHeaders^, (ImageNTHeaders.FileHeader.NumberOfSections * SizeOf (TImageSectionHeader))) <> (ImageNTHeaders.FileHeader.NumberOfSections * SizeOf (TImageSectionHeader)) then exit; SetLength(Sections, ImageNTHeaders.FileHeader.NumberOfSections); for I := 0 to ImageNTHeaders.FileHeader.NumberOfSections - 1 do begin Section := SectionHeaders^[I]; Sections[I].RVA := Section.VirtualAddress; Sections[I].Size := Section.SizeOfRawData; if Sections[I].Size < Section.Misc.VirtualSize then begin Sections[I].Size := Section.Misc.VirtualSize; end; Sections[I].Characteristics := Section.Characteristics; Sections[I].Base := VirtualAlloc (Pointer(LongWord(Sections[I].RVA + LongWord(ImageBase))), Sections[I].Size, MEM_COMMIT, PAGE_READWRITE); FillChar(Sections[I].Base^, Sections[I].Size, #0); if Section.PointerToRawData <> 0 then begin Stream.Seek(Section.PointerToRawData, soFromBeginning); if Stream.Read(Sections[I].Base^, Section.SizeOfRawData) <> LongInt (Section.SizeOfRawData) then exit; end; end; FreeMem(SectionHeaders);
Result := True; end; end;
function ProcessRelocations: Boolean; var Relocations: PChar; Position: LongWord; BaseRelocation: PImageBaseRelocation; Base: Pointer; NumberOfRelocations: LongWord; Relocation: PWordArray; RelocationCounter: LongInt; RelocationPointer: Pointer; RelocationType: LongWord; begin if ImageNTHeaders.OptionalHeader.DataDirectory [IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress <> 0 then begin Result := False; Relocations := ConvertPointer(ImageNTHeaders.OptionalHeader.DataDirectory [IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress); Position := 0; while Assigned(Relocations) and (Position < ImageNTHeaders.OptionalHeader.DataDirectory [IMAGE_DIRECTORY_ENTRY_BASERELOC].Size) do begin BaseRelocation := PImageBaseRelocation(Relocations); Base := ConvertPointer(BaseRelocation^.VirtualAddress); if not Assigned(Base) then exit; NumberOfRelocations := (BaseRelocation^.SizeOfBlock - SizeOf (TImageBaseRelocation)) div SizeOf(WORD); Relocation := Pointer(LongWord(LongWord(BaseRelocation) + SizeOf (TImageBaseRelocation))); for RelocationCounter := 0 to NumberOfRelocations - 1 do begin RelocationPointer := Pointer (LongWord(LongWord(Base) + (Relocation^[RelocationCounter] and $FFF))); RelocationType := Relocation^[RelocationCounter] shr 12; case RelocationType of IMAGE_REL_BASED_ABSOLUTE: begin end; IMAGE_REL_BASED_HIGH: begin PWORD(RelocationPointer)^ := (LongWord(((LongWord(PWORD(RelocationPointer)^ + LongWord (ImageBase) - ImageNTHeaders.OptionalHeader.ImageBase)))) shr 16) and $FFFF; end; IMAGE_REL_BASED_LOW: begin PWORD(RelocationPointer)^ := LongWord (((LongWord(PWORD(RelocationPointer)^ + LongWord(ImageBase) - ImageNTHeaders.OptionalHeader.ImageBase)))) and $FFFF; end; IMAGE_REL_BASED_HIGHLOW: begin PPointer(RelocationPointer)^ := Pointer ((LongWord(LongWord(PPointer(RelocationPointer)^) + LongWord (ImageBase) - ImageNTHeaders.OptionalHeader.ImageBase)) ); end; IMAGE_REL_BASED_HIGHADJ: begin // ??? end; IMAGE_REL_BASED_MIPS_JMPADDR: begin // Only for MIPS CPUs ;) end; end; end; Relocations := Pointer (LongWord(LongWord(Relocations) + BaseRelocation^.SizeOfBlock)); Inc(Position, BaseRelocation^.SizeOfBlock); end; end;
Result := True; end;
function ProcessImports: Boolean; var ImportDescriptor: PImageImportDescriptor; ThunkData: PLongWord; Name: PChar; DLLImport: PDLLImport; DLLfunctionImport: PDLLfunctionImport; functionPointer: Pointer; begin if ImageNTHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT] .VirtualAddress <> 0 then begin ImportDescriptor := ConvertPointer (ImageNTHeaders.OptionalHeader.DataDirectory [IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress); if Assigned(ImportDescriptor) then begin SetLength(ImportArray, 0); while ImportDescriptor^.Name <> 0 do begin Name := ConvertPointer(ImportDescriptor^.Name); SetLength(ImportArray, Length(ImportArray) + 1); LoadExternalLibrary(Name); DLLImport := @ImportArray[Length(ImportArray) - 1]; DLLImport^.LibraryName := Name; DLLImport^.LibraryHandle := GetExternalLibraryHandle(Name); DLLImport^.Entries := nil; if ImportDescriptor^.TimeDateStamp = 0 then begin ThunkData := ConvertPointer(ImportDescriptor^.FirstThunk); end else begin ThunkData := ConvertPointer(ImportDescriptor^.OriginalFirstThunk); end; while ThunkData^ <> 0 do begin SetLength(DLLImport^.Entries, Length(DLLImport^.Entries) + 1); DLLfunctionImport := @DLLImport^.Entries[Length(DLLImport^.Entries) - 1]; if (ThunkData^ and IMAGE_ORDINAL_FLAG32) <> 0 then begin DLLfunctionImport^.NameOrID := niID; DLLfunctionImport^.ID := ThunkData^ and IMAGE_ORDINAL_MASK32; DLLfunctionImport^.Name := ''; functionPointer := GetProcAddress(DLLImport^.LibraryHandle, PChar(ThunkData^ and IMAGE_ORDINAL_MASK32)); end else begin Name := ConvertPointer(LongWord(ThunkData^) + IMPORTED_NAME_OFFSET); DLLfunctionImport^.NameOrID := niName; DLLfunctionImport^.ID := 0; DLLfunctionImport^.Name := Name; functionPointer := GetProcAddress(DLLImport^.LibraryHandle, Name); end; PPointer(ThunkData)^ := functionPointer; Inc(ThunkData); end; Inc(ImportDescriptor); end; end; end;
Result := True; end;
function ProtectSections: Boolean; var I: Integer; Characteristics: LongWord; Flags: LongWord; begin Result := False; if ImageNTHeaders.FileHeader.NumberOfSections > 0 then begin for I := 0 to ImageNTHeaders.FileHeader.NumberOfSections - 1 do begin Characteristics := Sections[I].Characteristics; Flags := 0; if (Characteristics and IMAGE_SCN_MEM_EXECUTE) <> 0 then begin if (Characteristics and IMAGE_SCN_MEM_READ) <> 0 then begin if (Characteristics and IMAGE_SCN_MEM_WRITE) <> 0 then begin Flags := Flags or PAGE_EXECUTE_READWRITE; end else begin Flags := Flags or PAGE_EXECUTE_READ; end; end else if (Characteristics and IMAGE_SCN_MEM_WRITE) <> 0 then begin Flags := Flags or PAGE_EXECUTE_WRITECOPY; end else begin Flags := Flags or PAGE_EXECUTE; end; end else if (Characteristics and IMAGE_SCN_MEM_READ) <> 0 then begin if (Characteristics and IMAGE_SCN_MEM_WRITE) <> 0 then begin Flags := Flags or PAGE_READWRITE; end else begin Flags := Flags or PAGE_REAdoNLY; end; end else if (Characteristics and IMAGE_SCN_MEM_WRITE) <> 0 then begin Flags := Flags or PAGE_WRITECOPY; end else begin Flags := Flags or PAGE_NOACCESS; end; if (Characteristics and IMAGE_SCN_MEM_NOT_CACHED) <> 0 then begin Flags := Flags or PAGE_NOCACHE; end; VirtualProtect(Sections[I].Base, Sections[I].Size, Flags, OldProtect); end;
Result := True; end; end;
function InitializeLibrary: Boolean; begin Result := False; @DLLProc := ConvertPointer (ImageNTHeaders.OptionalHeader.AddressOfEntryPoint); if DLLProc(Cardinal(ImageBase), DLL_PROCESS_ATTACH, nil) then begin Result := True; end; end;
function ParseStringToNumber(AString: string): LongWord; var CharCounter: Integer; begin Result := 0; for CharCounter := 0 to Length(AString) - 1 do begin if AString[CharCounter] IN ['0' .. '9'] then begin Result := (RESULT * 10) + Byte (Byte(AString[CharCounter]) - Byte('0')); end else begin exit; end; end; end;
begin if ImageNTHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT] .VirtualAddress <> 0 then begin ExportTree := TExportTree.Create; ExportDirectory := ConvertPointer (ImageNTHeaders.OptionalHeader.DataDirectory [IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress); if Assigned(ExportDirectory) then begin ExportDirectorySize := ImageNTHeaders.OptionalHeader.DataDirectory [IMAGE_DIRECTORY_ENTRY_EXPORT].Size; SetLength(ExportArray, ExportDirectory^.NumberOfNames); for I := 0 to ExportDirectory^.NumberOfNames - 1 do begin functionNamePointer := ConvertPointer (LongWord(ExportDirectory^.AddressOfNames)); functionNamePointer := ConvertPointer (PLongWordArray(functionNamePointer)^[I]); functionName := functionNamePointer; functionIndexPointer := ConvertPointer (LongWord(ExportDirectory^.AddressOfNameOrdinals)); functionIndex := PWordArray(functionIndexPointer)^[I]; functionPointer := ConvertPointer (LongWord(ExportDirectory^.AddressOffunctions)); functionPointer := ConvertPointer(PLongWordArray(functionPointer) ^[functionIndex]); ExportArray[I].Name := functionName; ExportArray[I].Index := functionIndex; if (LongWord(ExportDirectory) < LongWord(functionPointer)) AND (LongWord(functionPointer) < (LongWord(ExportDirectory) + ExportDirectorySize)) then begin ForwarderCharPointer := functionPointer; ForwarderString := ForwarderCharPointer; while ForwarderCharPointer^ <> '.' do Inc(ForwarderCharPointer); ForwarderLibrary := COPY(ForwarderString, 1, POS('.', ForwarderString) - 1); LoadExternalLibrary(ForwarderLibrary); ForwarderLibraryHandle := GetExternalLibraryHandle (ForwarderLibrary); if ForwarderCharPointer^ = '#' then begin Inc(ForwarderCharPointer); ForwarderString := ForwarderCharPointer; ForwarderCharPointer := ConvertPointer (ParseStringToNumber(ForwarderString)); ForwarderString := ForwarderCharPointer; end else begin ForwarderString := ForwarderCharPointer; ExportArray[I].functionPointer := GetProcAddress (ForwarderLibraryHandle, PChar(ForwarderString)); end; end else begin ExportArray[I].functionPointer := functionPointer; end; ExportTree.Add(ExportArray[I].Name, ExportArray[I].functionPointer); end end; end; Result := True; end;
begin Result := False; if Assigned(Stream) then begin Stream.Seek(0, soFromBeginning); if Stream.Size > 0 then begin if ReadImageHeaders then begin if InitializeImage then begin if ReadSections then begin if ProcessRelocations then begin if ProcessImports then begin if ProtectSections then begin if InitializeLibrary then begin if ProcessExports then begin Result := True; end; end; end; end; end; end; end; end; end; end; end;
function TDLLLoader.Unload: Boolean; var I, J: Integer; begin Result := False; if @DLLProc <> nil then begin DLLProc(LongWord(ImageBase), DLL_PROCESS_DETACH, nil); end; for I := 0 to Length(Sections) - 1 do begin if Assigned(Sections[I].Base) then begin VirtualFree(Sections[I].Base, 0, MEM_RELEASE); end; end; SetLength(Sections, 0); for I := 0 to Length(ExternalLibraryArray) - 1 do begin ExternalLibraryArray[I].LibraryName := ''; FreeLibrary(ExternalLibraryArray[I].LibraryHandle); end; SetLength(ExternalLibraryArray, 0); for I := 0 to Length(ImportArray) - 1 do begin for J := 0 to Length(ImportArray[I].Entries) - 1 do begin ImportArray[I].Entries[J].Name := ''; end; SetLength(ImportArray[I].Entries, 0); end; SetLength(ImportArray, 0); for I := 0 to Length(ExportArray) - 1 do ExportArray[I].Name := ''; SetLength(ExportArray, 0); VirtualFree(ImageBase, 0, MEM_RELEASE); if Assigned(ExportTree) then begin ExportTree.Destroy; ExportTree := nil; end; end;
function TDLLLoader.FindExport(FunctionName: string): Pointer; var I: Integer; begin Result := nil; if Assigned(ExportTree) then begin ExportTree.Find(FunctionName, Result); end else begin for I := 0 to Length(ExportArray) - 1 do begin if ExportArray[I].Name = FunctionName then begin Result := ExportArray[I].functionPointer; exit; end; end; end; end;
function TDLLLoader.FindExportPerIndex(FunctionIndex: Integer): Pointer; var I: Integer; begin Result := nil; for I := 0 to Length(ExportArray) - 1 do begin if ExportArray[I].Index = FunctionIndex then begin Result := ExportArray[I].FunctionPointer; exit; end; end; end;
function TDLLLoader.GetExportList: TStringList; var I: Integer; begin Result := TStringList.Create; for I := 0 to Length(ExportArray) - 1 do Result.Add(ExportArray[I].Name); Result.Sort; end;
TExportTree=CLASS PRIVATE Root:PExportTreeNode; PUBLIC CONSTRUCTOR Create; DESTRUCTOR Destroy; OVERRIDE; PROCEDURE Dump; FUNCTION Add(FunctionName:STRING;Link:TExportTreeLink):BOOLEAN; FUNCTION Delete(FunctionName:STRING):BOOLEAN; FUNCTION Find(FunctionName:STRING;VAR Link:TExportTreeLink):BOOLEAN; END;
TDLLLoader=CLASS PRIVATE ImageBase:POINTER; ImageBaseDelta:INTEGER; DLLProc:TDLLEntryProc; ExternalLibraryArray:TExternalLibrarys; ImportArray:TImports; ExportArray:TExports; Sections:TSections; ExportTree:TExportTree; FUNCTION FindExternalLibrary(LibraryName:STRING):INTEGER; FUNCTION LoadExternalLibrary(LibraryName:STRING):INTEGER; FUNCTION GetExternalLibraryHandle(LibraryName:STRING):HINST; PUBLIC CONSTRUCTOR Create; DESTRUCTOR Destroy; OVERRIDE; FUNCTION Load(Stream:TStream):BOOLEAN; FUNCTION Unload:BOOLEAN; FUNCTION FindExport(FunctionName:STRING):POINTER; FUNCTION FindExportPerIndex(FunctionIndex:INTEGER):POINTER; FUNCTION GetExportList:TStringList; END;
IMPLEMENTATION
FUNCTION StrToInt(S:STRING):INTEGER; VAR C:INTEGER; BEGIN VAL(S,RESULT,C); END;
FUNCTION CreateExportTreeNode(AChar:CHAR):PExportTreeNode; BEGIN GETMEM(RESULT,SIZEOF(TExportTreeNode)); RESULT^.TheChar:=AChar; RESULT^.Link:=NIL; RESULT^.LinkExist:=FALSE; RESULT^.Prevoius:=NIL; RESULT^.Next:=NIL; RESULT^.Up:=NIL; RESULT^.Down:=NIL; END;
PROCEDURE DestroyExportTreeNode(Node:PExportTreeNode); BEGIN IF ASSIGNED(Node) THEN BEGIN DestroyExportTreeNode(Node^.Next); DestroyExportTreeNode(Node^.Down); FREEMEM(Node); END; END;
CONSTRUCTOR TExportTree.Create; BEGIN INHERITED Create; Root:=NIL; END;
DESTRUCTOR TExportTree.Destroy; BEGIN DestroyExportTreeNode(Root); INHERITED Destroy; END;
PROCEDURE TExportTree.Dump; VAR Ident:INTEGER; PROCEDURE DumpNode(Node:PExportTreeNode); VAR SubNode:PExportTreeNode; IdentCounter,IdentOld:INTEGER; BEGIN FOR IdentCounter:=1 TO Ident DO WRITE(' '); WRITE(Node^.TheChar); IdentOld:=Ident; SubNode:=Node^.Next; WHILE ASSIGNED(SubNode) DO BEGIN WRITE(SubNode.TheChar); IF NOT ASSIGNED(SubNode^.Next) THEN BREAK; INC(Ident); SubNode:=SubNode^.Next; END; WRITELN; INC(Ident); WHILE ASSIGNED(SubNode) AND (SubNode<>Node) DO BEGIN IF ASSIGNED(SubNode^.Down) THEN DumpNode(SubNode^.Down); SubNode:=SubNode^.Prevoius; DEC(Ident); END; Ident:=IdentOld; IF ASSIGNED(Node^.Down) THEN DumpNode(Node^.Down); END; BEGIN Ident:=0; DumpNode(Root); END;
FUNCTION TExportTree.Add(FunctionName:STRING;Link:TExportTreeLink):BOOLEAN; VAR StringLength,Position,PositionCounter:INTEGER; NewNode,LastNode,Node:PExportTreeNode; StringChar,NodeChar:CHAR; BEGIN RESULT:=FALSE; StringLength:=LENGTH(FunctionName); IF StringLength>0 THEN BEGIN LastNode:=NIL; Node:=Root; FOR Position:=1 TO StringLength DO BEGIN StringChar:=FunctionName[Position]; IF ASSIGNED(Node) THEN BEGIN NodeChar:=Node^.TheChar; IF NodeChar=StringChar THEN BEGIN LastNode:=Node; Node:=Node^.Next; END ELSE BEGIN WHILE (NodeChar<StringChar) AND ASSIGNED(Node^.Down) DO BEGIN Node:=Node^.Down; NodeChar:=Node^.TheChar; END; IF NodeChar=StringChar THEN BEGIN LastNode:=Node; Node:=Node^.Next; END ELSE BEGIN NewNode:=CreateExportTreeNode(StringChar); IF NodeChar<StringChar THEN BEGIN NewNode^.Down:=Node^.Down; NewNode^.Up:=Node; IF ASSIGNED(NewNode^.Down) THEN BEGIN NewNode^.Down^.Up:=NewNode; END; NewNode^.Prevoius:=Node^.Prevoius; Node^.Down:=NewNode; END ELSE IF NodeChar>StringChar THEN BEGIN NewNode^.Down:=Node; NewNode^.Up:=Node^.Up; IF ASSIGNED(NewNode^.Up) THEN BEGIN NewNode^.Up^.Down:=NewNode; END; NewNode^.Prevoius:=Node^.Prevoius; IF NOT ASSIGNED(NewNode^.Up) THEN BEGIN IF ASSIGNED(NewNode^.Prevoius) THEN BEGIN NewNode^.Prevoius^.Next:=NewNode; END ELSE BEGIN Root:=NewNode; END; END; Node^.Up:=NewNode; END; LastNode:=NewNode; Node:=LastNode^.Next; END; END; END ELSE BEGIN FOR PositionCounter:=Position TO StringLength DO BEGIN NewNode:=CreateExportTreeNode(FunctionName[PositionCounter]); IF ASSIGNED(LastNode) THEN BEGIN NewNode^.Prevoius:=LastNode; LastNode^.Next:=NewNode; LastNode:=LastNode^.Next; END ELSE BEGIN IF NOT ASSIGNED(Root) THEN BEGIN Root:=NewNode; LastNode:=Root; END; END; END; BREAK; END; END; IF ASSIGNED(LastNode) THEN BEGIN IF NOT LastNode^.LinkExist THEN BEGIN LastNode^.Link:=Link; LastNode^.LinkExist:=TRUE; RESULT:=TRUE; END; END; END; END;
FUNCTION TExportTree.Delete(FunctionName:STRING):BOOLEAN; VAR StringLength,Position:INTEGER; Node:PExportTreeNode; StringChar,NodeChar:CHAR; BEGIN RESULT:=FALSE; StringLength:=LENGTH(FunctionName); IF StringLength>0 THEN BEGIN Node:=Root; FOR Position:=1 TO StringLength DO BEGIN StringChar:=FunctionName[Position]; IF ASSIGNED(Node) THEN BEGIN NodeChar:=Node^.TheChar; WHILE (NodeChar<>StringChar) AND ASSIGNED(Node^.Down) DO BEGIN Node:=Node^.Down; NodeChar:=Node^.TheChar; END; IF NodeChar=StringChar THEN BEGIN IF (Position=StringLength) AND Node^.LinkExist THEN BEGIN Node^.LinkExist:=FALSE; RESULT:=TRUE; BREAK; END; Node:=Node^.Next; END; END ELSE BEGIN BREAK; END; END; END; END;
FUNCTION TExportTree.Find(FunctionName:STRING;VAR Link:TExportTreeLink):BOOLEAN; VAR StringLength,Position:INTEGER; Node:PExportTreeNode; StringChar,NodeChar:CHAR; BEGIN RESULT:=FALSE; StringLength:=LENGTH(FunctionName); IF StringLength>0 THEN BEGIN Node:=Root; FOR Position:=1 TO StringLength DO BEGIN StringChar:=FunctionName[Position]; IF ASSIGNED(Node) THEN BEGIN NodeChar:=Node^.TheChar; WHILE (NodeChar<>StringChar) AND ASSIGNED(Node^.Down) DO BEGIN Node:=Node^.Down; NodeChar:=Node^.TheChar; END; IF NodeChar=StringChar THEN BEGIN IF (Position=StringLength) AND Node^.LinkExist THEN BEGIN Link:=Node^.Link; RESULT:=TRUE; BREAK; END; Node:=Node^.Next; END; END ELSE BEGIN BREAK; END; END; END; END;
DESTRUCTOR TDLLLoader.Destroy; BEGIN IF @DLLProc<>NIL THEN Unload; IF ASSIGNED(ExportTree) THEN ExportTree.Destroy; INHERITED Destroy; END;
FUNCTION TDLLLoader.FindExternalLibrary(LibraryName:STRING):INTEGER; VAR I:INTEGER; BEGIN RESULT:=-1; FOR I:=0 TO LENGTH(ExternalLibraryArray)-1 DO BEGIN IF ExternalLibraryArray[I].LibraryName=LibraryName THEN BEGIN RESULT:=I; EXIT; END; END; END;
FUNCTION TDLLLoader.LoadExternalLibrary(LibraryName:STRING):INTEGER; BEGIN RESULT:=FindExternalLibrary(LibraryName); IF RESULT<0 THEN BEGIN RESULT:=LENGTH(ExternalLibraryArray); SETLENGTH(ExternalLibraryArray,LENGTH(ExternalLibraryArray)+1); ExternalLibraryArray[RESULT].LibraryName:=LibraryName; ExternalLibraryArray[RESULT].LibraryHandle:=LoadLibrary(PCHAR(LibraryName)); END; END;
FUNCTION TDLLLoader.GetExternalLibraryHandle(LibraryName:STRING):LONGWORD; VAR I:INTEGER; BEGIN RESULT:=0; FOR I:=0 TO LENGTH(ExternalLibraryArray)-1 DO BEGIN IF ExternalLibraryArray[I].LibraryName=LibraryName THEN BEGIN RESULT:=ExternalLibraryArray[I].LibraryHandle; EXIT; END; END; END;
FUNCTION TDLLLoader.Load(Stream:TStream):BOOLEAN; VAR ImageDOSHeader:TImageDOSHeader; ImageNTHeaders:TImageNTHeaders; OldProtect:LONGWORD; FUNCTION ConvertPointer(RVA:LONGWORD):POINTER; VAR I:INTEGER; BEGIN RESULT:=NIL; FOR I:=0 TO LENGTH(Sections)-1 DO BEGIN IF (RVA<(Sections[I].RVA+Sections[I].Size)) AND (RVA>=Sections[I].RVA) THEN BEGIN RESULT:=POINTER(LONGWORD((RVA-LONGWORD(Sections[I].RVA))+LONGWORD(Sections[I].Base))); EXIT; END; END; END; FUNCTION ReadImageHeaders:BOOLEAN; BEGIN RESULT:=FALSE; IF Stream.Size>0 THEN BEGIN FILLCHAR(ImageNTHeaders,SIZEOF(TImageNTHeaders),#0); IF Stream.Read(ImageDOSHeader,SIZEOF(TImageDOSHeader))<>SIZEOF(TImageDOSHeader) THEN EXIT; IF ImageDOSHeader.Signature<>$5A4D THEN EXIT; IF Stream.Seek(ImageDOSHeader.LFAOffset, soFromBeginning)<>LONGINT(ImageDOSHeader.LFAOffset) THEN EXIT; IF Stream.Read(ImageNTHeaders.Signature,SIZEOF(LONGWORD))<>SIZEOF(LONGWORD) THEN EXIT; IF ImageNTHeaders.Signature<>$00004550 THEN EXIT; IF Stream.Read(ImageNTHeaders.FileHeader,SIZEOF(TImageFileHeader))<>SIZEOF(TImageFileHeader) THEN EXIT; IF ImageNTHeaders.FileHeader.Machine<>$14C THEN EXIT; IF Stream.Read(ImageNTHeaders.OptionalHeader,ImageNTHeaders.FileHeader.SizeOfOptionalHeader)<>ImageNTHeaders.FileHeader.SizeOfOptionalHeader THEN EXIT; RESULT:=TRUE; END; END; FUNCTION InitializeImage:BOOLEAN; VAR SectionBase:POINTER; OldPosition:INTEGER; BEGIN RESULT:=FALSE; IF ImageNTHeaders.FileHeader.NumberOfSections>0 THEN BEGIN ImageBase:=VirtualAlloc(NIL,ImageNTHeaders.OptionalHeader.SizeOfImage,MEM_RESERVE,PAGE_NOACCESS); ImageBaseDelta:=LONGWORD(ImageBase)-ImageNTHeaders.OptionalHeader.ImageBase; SectionBase:=VirtualAlloc(ImageBase,ImageNTHeaders.OptionalHeader.SizeOfHeaders,MEM_COMMIT,PAGE_READWRITE); OldPosition:=Stream.Position; Stream.Seek(0, soFromBeginning); Stream.Read(SectionBase^,ImageNTHeaders.OptionalHeader.SizeOfHeaders); VirtualProtect(SectionBase,ImageNTHeaders.OptionalHeader.SizeOfHeaders,PAGE_READONLY,OldProtect); Stream.Seek(OldPosition, soFromBeginning); RESULT:=TRUE; END; END; FUNCTION ReadSections:BOOLEAN; VAR I:INTEGER; Section:TImageSectionHeader; SectionHeaders:PImageSectionHeaders; BEGIN RESULT:=FALSE; IF ImageNTHeaders.FileHeader.NumberOfSections>0 THEN BEGIN GETMEM(SectionHeaders,ImageNTHeaders.FileHeader.NumberOfSections*SIZEOF(TImageSectionHeader)); IF Stream.Read(SectionHeaders^,(ImageNTHeaders.FileHeader.NumberOfSections*SIZEOF(TImageSectionHeader)))<>(ImageNTHeaders.FileHeader.NumberOfSections*SIZEOF(TImageSectionHeader)) THEN EXIT; SETLENGTH(Sections,ImageNTHeaders.FileHeader.NumberOfSections); FOR I:=0 TO ImageNTHeaders.FileHeader.NumberOfSections-1 DO BEGIN Section:=SectionHeaders^[I]; Sections[I].RVA:=Section.VirtualAddress; Sections[I].Size:=Section.SizeOfRawData; IF Sections[I].Size<Section.Misc.VirtualSize THEN BEGIN Sections[I].Size:=Section.Misc.VirtualSize; END; Sections[I].Characteristics:=Section.Characteristics; Sections[I].Base:=VirtualAlloc(POINTER(LONGWORD(Sections[I].RVA+LONGWORD(ImageBase))),Sections[I].Size,MEM_COMMIT,PAGE_READWRITE); FILLCHAR(Sections[I].Base^,Sections[I].Size,#0); IF Section.PointerToRawData<>0 THEN BEGIN Stream.Seek(Section.PointerToRawData, soFromBeginning); IF Stream.Read(Sections[I].Base^,Section.SizeOfRawData)<>LONGINT(Section.SizeOfRawData) THEN EXIT; END; END; FREEMEM(SectionHeaders); RESULT:=TRUE; END; END; FUNCTION ProcessRelocations:BOOLEAN; VAR Relocations:PCHAR; Position:LONGWORD; BaseRelocation:PImageBaseRelocation; Base:POINTER; NumberOfRelocations:LONGWORD; Relocation:PWordArray; RelocationCounter:LONGINT; RelocationPointer:POINTER; RelocationType:LONGWORD; BEGIN IF ImageNTHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress<>0 THEN BEGIN RESULT:=FALSE; Relocations:=ConvertPointer(ImageNTHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress); Position:=0; WHILE ASSIGNED(Relocations) AND (Position<ImageNTHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size) DO BEGIN BaseRelocation:=PImageBaseRelocation(Relocations); Base:=ConvertPointer(BaseRelocation^.VirtualAddress); IF NOT ASSIGNED(Base) THEN EXIT; NumberOfRelocations:=(BaseRelocation^.SizeOfBlock-SIZEOF(TImageBaseRelocation)) DIV SIZEOF(WORD); Relocation:=POINTER(LONGWORD(LONGWORD(BaseRelocation)+SIZEOF(TImageBaseRelocation))); FOR RelocationCounter:=0 TO NumberOfRelocations-1 DO BEGIN RelocationPointer:=POINTER(LONGWORD(LONGWORD(Base)+(Relocation^[RelocationCounter] AND $FFF))); RelocationType:=Relocation^[RelocationCounter] SHR 12; CASE RelocationType OF IMAGE_REL_BASED_ABSOLUTE:BEGIN END; IMAGE_REL_BASED_HIGH:BEGIN PWORD(RelocationPointer)^:=(LONGWORD(((LONGWORD(PWORD(RelocationPointer)^+LONGWORD(ImageBase)-ImageNTHeaders.OptionalHeader.ImageBase)))) SHR 16) AND $FFFF; END; IMAGE_REL_BASED_LOW:BEGIN PWORD(RelocationPointer)^:=LONGWORD(((LONGWORD(PWORD(RelocationPointer)^+LONGWORD(ImageBase)-ImageNTHeaders.OptionalHeader.ImageBase)))) AND $FFFF; END; IMAGE_REL_BASED_HIGHLOW:BEGIN PPOINTER(RelocationPointer)^:=POINTER((LONGWORD(LONGWORD(PPOINTER(RelocationPointer)^)+LONGWORD(ImageBase)-ImageNTHeaders.OptionalHeader.ImageBase))); END; IMAGE_REL_BASED_HIGHADJ:BEGIN // ??? END; IMAGE_REL_BASED_MIPS_JMPADDR:BEGIN // Only for MIPS CPUs ;) END; END; END; Relocations:=POINTER(LONGWORD(LONGWORD(Relocations)+BaseRelocation^.SizeOfBlock)); INC(Position,BaseRelocation^.SizeOfBlock); END; END; RESULT:=TRUE; END; FUNCTION ProcessImports:BOOLEAN; VAR ImportDescriptor:PImageImportDescriptor; ThunkData:PLONGWORD; Name:PCHAR; DLLImport:PDLLImport; DLLFunctionImport:PDLLFunctionImport; FunctionPointer:POINTER; BEGIN IF ImageNTHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress<>0 THEN BEGIN ImportDescriptor:=ConvertPointer(ImageNTHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress); IF ASSIGNED(ImportDescriptor) THEN BEGIN SETLENGTH(ImportArray,0); WHILE ImportDescriptor^.Name<>0 DO BEGIN Name:=ConvertPointer(ImportDescriptor^.Name); SETLENGTH(ImportArray,LENGTH(ImportArray)+1); LoadExternalLibrary(Name); DLLImport:=@ImportArray[LENGTH(ImportArray)-1]; DLLImport^.LibraryName:=Name; DLLImport^.LibraryHandle:=GetExternalLibraryHandle(Name); DLLImport^.Entries:=NIL; IF ImportDescriptor^.TimeDateStamp=0 THEN BEGIN ThunkData:=ConvertPointer(ImportDescriptor^.FirstThunk); END ELSE BEGIN ThunkData:=ConvertPointer(ImportDescriptor^.OriginalFirstThunk); END; WHILE ThunkData^<>0 DO BEGIN SETLENGTH(DLLImport^.Entries,LENGTH(DLLImport^.Entries)+1); DLLFunctionImport:=@DLLImport^.Entries[LENGTH(DLLImport^.Entries)-1]; IF (ThunkData^ AND IMAGE_ORDINAL_FLAG32)<>0 THEN BEGIN DLLFunctionImport^.NameOrID:=niID; DLLFunctionImport^.ID:=ThunkData^ AND IMAGE_ORDINAL_MASK32; DLLFunctionImport^.Name:=''; FunctionPointer:=GetProcAddress(DLLImport^.LibraryHandle,PCHAR(ThunkData^ AND IMAGE_ORDINAL_MASK32)); END ELSE BEGIN Name:=ConvertPointer(LONGWORD(ThunkData^)+IMPORTED_NAME_OFFSET); DLLFunctionImport^.NameOrID:=niName; DLLFunctionImport^.ID:=0; DLLFunctionImport^.Name:=Name; FunctionPointer:=GetProcAddress(DLLImport^.LibraryHandle,Name); END; PPOINTER(Thunkdata)^:=FunctionPointer; INC(ThunkData); END; INC(ImportDescriptor); END; END; END; RESULT:=TRUE; END; FUNCTION ProtectSections:BOOLEAN; VAR I:INTEGER; Characteristics:LONGWORD; Flags:LONGWORD; BEGIN RESULT:=FALSE; IF ImageNTHeaders.FileHeader.NumberOfSections>0 THEN BEGIN FOR I:=0 TO ImageNTHeaders.FileHeader.NumberOfSections-1 DO BEGIN Characteristics:=Sections[I].Characteristics; Flags:=0; IF (Characteristics AND IMAGE_SCN_MEM_EXECUTE)<>0 THEN BEGIN IF (Characteristics AND IMAGE_SCN_MEM_READ)<>0 THEN BEGIN IF (Characteristics AND IMAGE_SCN_MEM_WRITE)<>0 THEN BEGIN Flags:=Flags OR PAGE_EXECUTE_READWRITE; END ELSE BEGIN Flags:=Flags OR PAGE_EXECUTE_READ; END; END ELSE IF (Characteristics AND IMAGE_SCN_MEM_WRITE)<>0 THEN BEGIN Flags:=Flags OR PAGE_EXECUTE_WRITECOPY; END ELSE BEGIN Flags:=Flags OR PAGE_EXECUTE; END; END ELSE IF (Characteristics AND IMAGE_SCN_MEM_READ)<>0 THEN BEGIN IF (Characteristics AND IMAGE_SCN_MEM_WRITE)<>0 THEN BEGIN Flags:=Flags OR PAGE_READWRITE; END ELSE BEGIN Flags:=Flags OR PAGE_READONLY; END; END ELSE IF (Characteristics AND IMAGE_SCN_MEM_WRITE)<>0 THEN BEGIN Flags:=Flags OR PAGE_WRITECOPY; END ELSE BEGIN Flags:=Flags OR PAGE_NOACCESS; END; IF (Characteristics AND IMAGE_SCN_MEM_NOT_CACHED)<>0 THEN BEGIN Flags:=Flags OR PAGE_NOCACHE; END; VirtualProtect(Sections[I].Base,Sections[I].Size,Flags,OldProtect); END; RESULT:=TRUE; END; END; FUNCTION InitializeLibrary:BOOLEAN; BEGIN RESULT:=FALSE; @DLLProc:=ConvertPointer(ImageNTHeaders.OptionalHeader.AddressOfEntryPoint); IF DLLProc(CARDINAL(ImageBase),DLL_PROCESS_ATTACH,NIL) THEN BEGIN RESULT:=TRUE; END; END; FUNCTION ProcessExports:BOOLEAN; VAR I:INTEGER; ExportDirectory:PImageExportDirectory; ExportDirectorySize:LONGWORD; FunctionNamePointer:POINTER; FunctionName:PCHAR; FunctionIndexPointer:POINTER; FunctionIndex:LONGWORD; FunctionPointer:POINTER; ForwarderCharPointer:PCHAR; ForwarderString:STRING; ForwarderLibrary:STRING; ForwarderLibraryHandle:HINST; FUNCTION ParseStringToNumber(AString:STRING):LONGWORD; VAR CharCounter:INTEGER; BEGIN RESULT:=0; FOR CharCounter:=0 TO LENGTH(AString)-1 DO BEGIN IF AString[CharCounter] IN ['0'..'9'] THEN BEGIN RESULT:=(RESULT*10)+BYTE(BYTE(AString[CharCounter])-BYTE('0')); END ELSE BEGIN EXIT; END; END; END; BEGIN IF ImageNTHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress<>0 THEN BEGIN ExportTree:=TExportTree.Create; ExportDirectory:=ConvertPointer(ImageNTHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress); IF ASSIGNED(ExportDirectory) THEN BEGIN ExportDirectorySize:=ImageNTHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size; SETLENGTH(ExportArray,ExportDirectory^.NumberOfNames); FOR I:=0 TO ExportDirectory^.NumberOfNames-1 DO BEGIN FunctionNamePointer:=ConvertPointer(LONGWORD(ExportDirectory^.AddressOfNames)); FunctionNamePointer:=ConvertPointer(PLongWordArray(FunctionNamePointer)^[I]); FunctionName:=FunctionNamePointer; FunctionIndexPointer:=ConvertPointer(LONGWORD(ExportDirectory^.AddressOfNameOrdinals)); FunctionIndex:=PWordArray(FunctionIndexPointer)^[I]; FunctionPointer:=ConvertPointer(LONGWORD(ExportDirectory^.AddressOfFunctions)); FunctionPointer:=ConvertPointer(PLongWordArray(FunctionPointer)^[FunctionIndex]); ExportArray[I].Name:=FunctionName; ExportArray[I].Index:=FunctionIndex; IF (LONGWORD(ExportDirectory)<LONGWORD(FunctionPointer)) AND (LONGWORD(FunctionPointer)<(LONGWORD(ExportDirectory)+ExportDirectorySize)) THEN BEGIN ForwarderCharPointer:=FunctionPointer; ForwarderString:=ForwarderCharPointer; WHILE ForwarderCharPointer^<>'.' DO INC(ForwarderCharPointer); ForwarderLibrary:=COPY(ForwarderString,1,POS('.',ForwarderString)-1); LoadExternalLibrary(ForwarderLibrary); ForwarderLibraryHandle:=GetExternalLibraryHandle(ForwarderLibrary); IF ForwarderCharPointer^='#' THEN BEGIN INC(ForwarderCharPointer); ForwarderString:=ForwarderCharPointer; ForwarderCharPointer:=ConvertPointer(ParseStringToNumber(ForwarderString)); ForwarderString:=ForwarderCharPointer; END ELSE BEGIN ForwarderString:=ForwarderCharPointer; ExportArray[I].FunctionPointer:=GetProcAddress(ForwarderLibraryHandle,PCHAR(ForwarderString)); END; END ELSE BEGIN ExportArray[I].FunctionPointer:=FunctionPointer; END; ExportTree.Add(ExportArray[I].Name,ExportArray[I].FunctionPointer); END END; END; RESULT:=TRUE; END; BEGIN RESULT:=FALSE; IF ASSIGNED(Stream) THEN BEGIN Stream.Seek(0, soFromBeginning); IF Stream.Size>0 THEN BEGIN IF ReadImageHeaders THEN BEGIN IF InitializeImage THEN BEGIN IF ReadSections THEN BEGIN IF ProcessRelocations THEN BEGIN IF ProcessImports THEN BEGIN IF ProtectSections THEN BEGIN IF InitializeLibrary THEN BEGIN IF ProcessExports THEN BEGIN RESULT:=TRUE; END; END; END; END; END; END; END; END; END; END; END;
FUNCTION TDLLLoader.Unload:BOOLEAN; VAR I,J:INTEGER; BEGIN RESULT:=FALSE; IF @DLLProc<>NIL THEN BEGIN DLLProc(LONGWORD(ImageBase),DLL_PROCESS_DETACH,NIL); END; FOR I:=0 TO LENGTH(Sections)-1 DO BEGIN IF ASSIGNED(Sections[I].Base) THEN BEGIN VirtualFree(Sections[I].Base,0,MEM_RELEASE); END; END; SETLENGTH(Sections,0); FOR I:=0 TO LENGTH(ExternalLibraryArray)-1 DO BEGIN ExternalLibraryArray[I].LibraryName:=''; FreeLibrary(ExternalLibraryArray[I].LibraryHandle); END; SETLENGTH(ExternalLibraryArray,0); FOR I:=0 TO LENGTH(ImportArray)-1 DO BEGIN FOR J:=0 TO LENGTH(ImportArray[I].Entries)-1 DO BEGIN ImportArray[I].Entries[J].Name:=''; END; SETLENGTH(ImportArray[I].Entries,0); END; SETLENGTH(ImportArray,0); FOR I:=0 TO LENGTH(ExportArray)-1 DO ExportArray[I].Name:=''; SETLENGTH(ExportArray,0); VirtualFree(ImageBase,0,MEM_RELEASE); IF ASSIGNED(ExportTree) THEN BEGIN ExportTree.Destroy; ExportTree:=NIL; END; END;
FUNCTION TDLLLoader.FindExport(FunctionName:STRING):POINTER; VAR I:INTEGER; BEGIN RESULT:=NIL; IF ASSIGNED(ExportTree) THEN BEGIN ExportTree.Find(FunctionName,RESULT); END ELSE BEGIN FOR I:=0 TO LENGTH(ExportArray)-1 DO BEGIN IF ExportArray[I].Name=FunctionName THEN BEGIN RESULT:=ExportArray[I].FunctionPointer; EXIT; END; END; END; END;
FUNCTION TDLLLoader.FindExportPerIndex(FunctionIndex:INTEGER):POINTER; VAR I:INTEGER; BEGIN RESULT:=NIL; FOR I:=0 TO LENGTH(ExportArray)-1 DO BEGIN IF ExportArray[I].Index=FunctionIndex THEN BEGIN RESULT:=ExportArray[I].FunctionPointer; EXIT; END; END; END;
FUNCTION TDLLLoader.GetExportList:TStringList; VAR I:INTEGER; BEGIN RESULT:=TStringList.Create; FOR I:=0 TO LENGTH(ExportArray)-1 DO RESULT.Add(ExportArray[I].Name); RESULT.Sort; END;
