《Peering Inside the PE: A Tour of the Win32 Portable Executable File Format》阅读笔记二

Common Sections

The .text section is where all general-purpose code emitted by the compiler or assembler ends up. Since PE files run in 32-bit mode and aren’t restricted to 16-bit segments, there’s no reason to break the code from separate source files into separate sections. Instead, the linker concatenates all the .text sections from the various OBJs into one big .text section in the EXE. If you use Borland C++ the compiler emits its code to a segment named CODE. PE files produced with Borland C++ have a section named CODE rather than one called .text.

In a PE file, when you call a function in another module (for example, GetMessage in USER32.DLL), the CALL instruction emitted by the compiler doesn’t transfer control directly to the function in the DLL . Instead, the call instruction transfers control to a

instruction that’s also in the .text section. The JMP instruction indirects through a DWORD variable in the .idata section.This .idata section DWORD contains the real address of the operating system function entry point.After thinking about this for a while, I came to understand why DLL calls are implemented this way. By funneling all calls to a given DLL function through one location, the loader doesn’t need to patch every instruction that calls a DLL.All the PE loader has to do is put the correct address of the target function into the DWORD in the .idata section. No call instructions need to be patched.This is in marked contrast to NE files, where each segment contains a list of fixups that need to be applied to the segment. If the segment calls a given DLL function 20 times, the loader must write the address of that function 20 times into the segment.The downside to the PE method is that you can’t initialize a variable with the true address of a DLL function. For example, you would think that something like

would put the address of GetMessage into the variable pfnGetMessage. In 16-bit Windows, this works, while in Win32 it doesn’t.In Win32, the variable pfnGetMessage will end up holding the address of the JMP DWORD PTR [XXXXXXXX] thunk that I mentioned earlier.

If you wanted to call through the function pointer, things would work as you’d expect. However, if you want to read the bytes at the beginning of GetMessage, you’re out of luck (unless you do additional work to follow the .idata “pointer” yourself).

这里开始讨论import library。

There is an important difference in how Borland PE files link to other modules. As I mentioned in the .text description, all calls to OBJs go through a JMP DWORD PTR [XXXXXXXX] thunk. Under the Microsoft system, this thunk comes to the EXE from the .text section of an import library. Because the library manager (LIB32) creates the import library (and the thunk) when you link the external DLL, the linker doesn’t have to “know” how to generate these thunks itself. The import library is really just some more code and data to link into the PE file.

The import libraries that the Borland linker uses are really just a list of function names along with the name of the DLL they’re in. TLINK32 is therefore responsible for determining which fixups are to external DLLs, and generating an appropriate JMP DWORD PTR [XXXXXXXX] thunk for it. TLINK32 stores the thunks that it creates in a section named .icode.

Just as .text is the default section for code, the .data section is where your initialized data goes. This data consists of global and static variables that are initialized at compile time. It also includes string literals. The linker combines all the .data sections from the OBJ and LIB files into one .data section in the EXE. Local variables are located on a thread’s stack, and take no room in the .data or .bss sections.

The .bss section is where any uninitialized static and global variables are stored. The linker combines all the .bss sections in the OBJ and LIB files into one .bss section in the EXE. In the section table, the RawDataOffset field for the .bss section is set to 0, indicating that this section doesn’t take up any space in the file. TLINK doesn’t emit this section. Instead it extends the virtual size of the DATA section.

.CRT is another initialized data section utilized by the Microsoft C/C++ run-time libraries (hence the name).

The .rsrc section contains all the resources for the module.

The .idata section contains information about functions (and data) that the module imports from other DLLs.

The .edata section is a list of the functions and data that the PE file exports for other modules.Windows, there’s seldom a reason to export anything from an EXE file, so you usually only see .edata sections in DLLs.

The .reloc section holds a table of base relocations. A base relocation is an adjustment to an instruction or initialized variable value that’s needed if the loader couldn’t load the file where the linker assumed it would. If the loader is able to load the image at the linker’s preferred base address, the loader completely ignores the relocation information in this section.

It’s important to note that the JMP and CALL instructions that the compiler generates use offsets relative to the instruction, rather than actual offsets in the 32-bit flat segment. If the image needs to be loaded somewhere other than where the linker assumed for a base address, these instructions don’t need to change, since they use relative addressing. As a result, there are not as many relocations as you might think. Relocations are usually only needed for instructions that use a 32-bit offset to some data. For example, let’s say you had the following global variable declarations:

对于relocation的理解：

If the linker assumed an image base of 0x10000, the address of the variable i will end up containing something like 0x12004. At the memory used to hold the pointer “ptr”, the linker will have written out 0x12004, since that’s the address of the variable i. If the loader for whatever reason decided to load the file at a base address of 0x70000, the address of i would be 0x72004. The .reloc section is a list of places in the image where the difference between the linker assumed load address and the actual load address needs to be factored in.

.tls section.

……

PE File Imports

Earlier, I described how function calls to outside DLLs don’t call the DLL directly. Instead, the CALL instruction goes to a JMP DWORD PTR [XXXXXXXX] instruction somewhere in the executable’s .text section (or .icode section if you’re using Borland C++). The address that the JMP instruction looks up and transfers control to is the real target address. The PE file’s .idata section contains the information necessary for the loader to determine the addresses of the target functions and patch them into the executable image.

The .idata section (or import table, as I prefer to call it) begins with an array of IMAGE_IMPORT_DESCRIPTORs. There is one IMAGE_IMPORT_DESCRIPTOR for each DLL that the PE file implicitly links to. There’s no field indicating the number of structures in this array. Instead, the last element of the array is indicated by an IMAGE_IMPORT_DESCRIPTOR that has fields filled with NULLs.

IMAGE_IMPORT_DESCRIPTOR Format

DWORD Characteristics: At one time, this may have been a set of flags. However, Microsoft changed its meaning and never bothered to update WINNT.H. This field is really an offset (an RVA) to an array of pointers. Each of these pointers points to an IMAGE_IMPORT_BY_NAME structure.

DWORD TimeDateStamp: The time/date stamp indicating when the file was built.
DWORD ForwarderChain: This field relates to forwarding. Forwarding involves one DLL sending on references to one of its functions to another DLL. For example, in Windows NT, NTDLL.DLL appears to forward some of its exported functions to KERNEL32.DLL. An application may think it’s calling a function in NTDLL.DLL, but it actually ends up calling into KERNEL32.DLL. This field contains an index into FirstThunk array (described momentarily). The function indexed by this field will be forwarded to another DLL. Unfortunately, the format of how a function is forwarded isn’t documented, and examples of forwarded functions are hard to find.

DWORD Name: This is an RVA to a NULL-terminated ASCII string containing the imported DLL’s name. Common examples are “KERNEL32.DLL” and “USER32.DLL”.
PIMAGE_THUNK_DATA FirstThunk: This field is an offset (an RVA) to an IMAGE_THUNK_DATA union.In almost every case, the union is interpreted as a pointer to an IMAGE_IMPORT_BY_NAME structure. If the field isn’t one of these pointers, then it’s supposedly treated as an export ordinal value for the DLL that’s being imported. It’s not clear from the documentation if you really can import a function by ordinal rather than by name.

这里挂两张导入表图解：

There is one IMAGE_IMPORT_BY_NAME structure for each function that the PE file imports. An IMAGE_IMPORT_BY_NAME structure is very simple, and looks like this:

The important parts of an IMAGE_IMPORT_DESCRIPTOR are the imported DLL name and the two arrays of IMAGE_IMPORT_BY_NAME pointers. In the EXE file, the two arrays (pointed to by the Characteristics and FirstThunk fields) run parallel to each other, and are terminated by a NULL pointer entry at the end of each array. The pointers in both arrays point to an IMAGE_IMPORT_BY_NAME structure.

Why are there two parallel arrays of pointers to the IMAGE_IMPORT_BY_NAME structures? The first array (the one pointed at by the Characteristics field) is left alone, and never modified. It’s sometimes called the hint-name table. The second array (pointed at by the FirstThunk field) is overwritten by the PE loader.The loader iterates through each pointer in the array and finds the address of the function that each IMAGE_IMPORT_BY_NAME structure refers to. The loader then overwrites the pointer to IMAGE_IMPORT_BY_NAME with the found function’s address. The [XXXXXXXX] portion of the JMP DWORD PTR [XXXXXXXX] thunk refers to one of the entries in the FirstThunk array.Since the array of pointers that’s overwritten by the loader eventually holds the addresses of all the imported functions, it’s called the Import Address Table.

Since the import address table is in a writeable section, it’s relatively easy to intercept calls that an EXE or DLL makes to another DLL.

PE File Exports

At the start of an .edata section is an IMAGE_EXPORT_DIRECTORY structure.

DWORD Characteristics: This field appears to be unused and is always set to 0.
DWORD TimeDateStamp: The time/date stamp indicating when this file was created.
WORD MajorVersion
WORD MinorVersion: These fields appear to be unused and are set to 0.
DWORD Name: The RVA of an ASCIIZ string with the name of this DLL.
DWORD Base: The starting ordinal number for exported functions. For example, if the file exports functions with ordinal values of 10, 11, and 12, this field contains 10. To obtain the exported ordinal for a function, you need to add this value to the appropriate element of the AddressOfNameOrdinals array.

DWORD NumberOfFunctions: The number of elements in the AddressOfFunctions array. This value is also the number of functions exported by this module. Theoretically, this value could be different than the NumberOfNames field (next), but actually they’re always the same.
DWORD NumberOfNames: The number of elements in the AddressOfNames array. This value seems always to be identical to the NumberOfFunctions field, and so is the number of exported functions.

PDWORD *AddressOfFunctions: This field is an RVA and points to an array of function addresses. The function addresses are the entry points (RVAs) for each exported function in this module.
PDWORD *AddressOfNames: This field is an RVA and points to an array of string pointers. The strings are the names of the exported functions in this module.
PWORD *AddressOfNameOrdinals: This field is an RVA and points to an array of WORDs. The WORDs are the export ordinals of all the exported functions in this module. However, don’t forget to add in the starting ordinal number specified in the Base field.

PE File Base Relocations

When the linker creates an EXE file, it makes an assumption about where the file will be mapped into memory. Based on this, the linker puts the real addresses of code and data items into the executable file. If for whatever reason the executable ends up being loaded somewhere else in the virtual address space, the addresses the linker plugged into the image are wrong. The information stored in the .reloc section allows the PE loader to fix these addresses in the loaded image so that they’re correct again. On the other hand, if the loader was able to load the file at the base address assumed by the linker, the .reloc section data isn’t needed and is ignored. The entries in the .reloc section are called base relocations since their use depends on the base address of the loaded image.Let’s look at an example to see how base relocations work. An executable file is linked assuming a base address of 0x10000. At offset 0x2134 within the image is a pointer containing the address of a string. The string starts at physical address 0x14002, so the pointer contains the value 0x14002. You then load the file, but the loader decides that it needs to map the image starting at physical address 0x60000. The difference between the linker-assumed base load address and the actual load address is called the delta. In this case, the delta is 0x50000. Since the entire image is 0x50000 bytes higher in memory, so is the string (now at address 0x64002). The pointer to the string is now incorrect. The executable file contains a base relocation for the memory location where the pointer to the string resides. To resolve a base relocation, the loader adds the delta value to the original value at the base relocation address. In this case, the loader would add 0x50000 to the original pointer value (0x14002), and store the result (0x64002) back into the pointer’s memory. Since the string really is at 0x64002, everything is fine with the world.

IMAGE_BASE_RELOCATION Format

DWORD VirtualAddress: This field contains the starting RVA for this chunk of relocations. The offset of each relocation that follows is added to this value to form the actual RVA where the relocation needs to be applied.
DWORD SizeOfBlock: The size of this structure plus all the WORD relocations that follow. To determine the number of relocations in this block, subtract the size of an IMAGE_BASE_RELOCATION (8 bytes) from the value of this field, and then divide by 2 (the size of a WORD).

Common Sections

PE File Imports

PE File Exports

PE File Base Relocations

个人收藏笔记记录

开通VIP