PStack  2.0
Stack trace printer for MSVC and GCC binaries
List of all members
psystem::dll_export_view Class Reference

Exposes a DLL's symbol export table. More...

#include <dll_export_view.hpp>

Construction / Destruction

 dll_export_view (uint8_t const *base_address, uint8_t const *load_address, integral_address_t va_offset, uint16_t const *idx_with_name, uint32_t const *export_rva, uint32_t const *export_name_rva, uint32_t number_of_functions, uint32_t number_of_names) noexcept
 Construct a view of DLL export information. More...
 

Public Interface

dll_export_iterator begin () const
 Acquire an iterator to the first exported symbol in the view. More...
 
dll_export_iterator end () const
 Acquire an iterator just past the final exported symbol in the view. More...
 
psystem::address_t get_symbol_base_address () const
 The address at which this DLL expects to be loaded. More...
 

Member Data

uint8_t const * m_base_address
 All addresses are offsets from the module base address, given here.
 
uint8_t const * m_load_address
 The address at which this DLL expects to be loaded. More...
 
integral_address_t m_va_offset
 All Relative Virtual Addresses (RVA) must be offset by this value to be treated as a valid pointer.
 
uint16_t const * m_idx_with_name
 The beginning of an array of DLL export ordinals. More...
 
uint32_t const * m_export_rva
 The beginning of an array of DLL export symbols' RVAs.
 
uint32_t const * m_export_name_rva
 The beginning of an array of DLL export symbol names' RVAs. More...
 
uint32_t m_number_of_functions
 The total number of exported functions in the DLL. More...
 
uint32_t m_number_of_names
 The total number of named exported functions in the DLL. More...
 

Detailed Description

Exposes a DLL's symbol export table.

This class exposes the DLL export table's exported symbols. This is a "view" in that is it backed by a memory-mapped file. All data extracted from the members is actually read from the module, and not stored here.

Author
Matt Bisson
Date
8 February, 2015
Since
PSystem 2.0
Version
PSystem 2.0

Constructor & Destructor Documentation

psystem::dll_export_view::dll_export_view ( uint8_t const *  base_address,
uint8_t const *  load_address,
integral_address_t  va_offset,
uint16_t const *  idx_with_name,
uint32_t const *  export_rva,
uint32_t const *  export_name_rva,
uint32_t  number_of_functions,
uint32_t  number_of_names 
)
noexcept

Construct a view of DLL export information.

Parameters
[in]base_addressAll addresses are offsets from the module base address, given here.
[in]load_addressThe address at which the DLL would be loaded into memory.
[in]va_offsetAll Relative Virtual Addresses (RVA) must be offset by this value to be treated as a valid pointer.
[in]idx_with_nameThe beginning of an array of DLL export ordinals.
[in]export_rvaThe beginning of an array of DLL export symbols' RVAs.
[in]export_name_rvaThe beginning of an array of DLL export symbol names' RVAs. Once the RVA is adjusted, the value can be dereferenced as a character array.
[in]number_of_functionsThe total number of exported functions in the DLL.
[in]number_of_namesThe total number of named exported functions in the DLL. This value is less than or equal to number_of_functions.
Todo:
Might be nicer if only something with a memory-mapped file could create an instance.
Todo:
A lot of this should be psystem::address_t types instead of *

Member Function Documentation

dll_export_iterator psystem::dll_export_view::begin ( ) const

Acquire an iterator to the first exported symbol in the view.

Returns
An iterator representing the first visible DLL export.
dll_export_iterator psystem::dll_export_view::end ( ) const

Acquire an iterator just past the final exported symbol in the view.

Returns
An iterator representing the end of the visible DLL exports.
psystem::address_t psystem::dll_export_view::get_symbol_base_address ( ) const

The address at which this DLL expects to be loaded.

This would be added to a DLL export address to produce an address in memory where the executable code for that export resides. In practice, this is only a "preferred" load address, and the OS may rebase the DLL if there are two modules that wish to use the same address space. Note that Windows system DLLs coordinate amongst themselves (at compile time) to avoid rebasing.

Returns
The preferred load address for the DLL.

Member Data Documentation

uint32_t const* psystem::dll_export_view::m_export_name_rva
private

The beginning of an array of DLL export symbol names' RVAs.

Once the RVA is adjusted, the value can be dereferenced as a character array.

uint16_t const* psystem::dll_export_view::m_idx_with_name
private

The beginning of an array of DLL export ordinals.

The ordinal may be used as an index into the m_export_name_rva list.

uint8_t const* psystem::dll_export_view::m_load_address
private

The address at which this DLL expects to be loaded.

This would be added to a DLL export address to produce an address in memory where the executable code for that export resides.

uint32_t psystem::dll_export_view::m_number_of_functions
private

The total number of exported functions in the DLL.

It is the count of elements in m_export_rva.

uint32_t psystem::dll_export_view::m_number_of_names
private

The total number of named exported functions in the DLL.

This value is less than or equal to number_of_functions. It is the count of elements in m_export_name_rva and m_idx_with_name.

The documentation for this class was generated from the following files: