[59404] | 1 | /* $Id: VBoxCheckImports.cpp 98103 2023-01-17 14:15:46Z vboxsync $ */
|
---|
| 2 | /** @file
|
---|
| 3 | * IPRT - Checks that a windows image only imports from a given set of DLLs.
|
---|
| 4 | */
|
---|
| 5 |
|
---|
| 6 | /*
|
---|
[98103] | 7 | * Copyright (C) 2012-2023 Oracle and/or its affiliates.
|
---|
[59404] | 8 | *
|
---|
[96407] | 9 | * This file is part of VirtualBox base platform packages, as
|
---|
| 10 | * available from https://www.virtualbox.org.
|
---|
| 11 | *
|
---|
| 12 | * This program is free software; you can redistribute it and/or
|
---|
| 13 | * modify it under the terms of the GNU General Public License
|
---|
| 14 | * as published by the Free Software Foundation, in version 3 of the
|
---|
| 15 | * License.
|
---|
| 16 | *
|
---|
| 17 | * This program is distributed in the hope that it will be useful, but
|
---|
| 18 | * WITHOUT ANY WARRANTY; without even the implied warranty of
|
---|
| 19 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
---|
| 20 | * General Public License for more details.
|
---|
| 21 | *
|
---|
| 22 | * You should have received a copy of the GNU General Public License
|
---|
| 23 | * along with this program; if not, see <https://www.gnu.org/licenses>.
|
---|
| 24 | *
|
---|
| 25 | * SPDX-License-Identifier: GPL-3.0-only
|
---|
[59404] | 26 | */
|
---|
| 27 |
|
---|
| 28 |
|
---|
| 29 | /*********************************************************************************************************************************
|
---|
| 30 | * Header Files *
|
---|
| 31 | *********************************************************************************************************************************/
|
---|
| 32 | #include <iprt/formats/mz.h>
|
---|
| 33 | #include <iprt/formats/pecoff.h>
|
---|
| 34 | #include <stdio.h>
|
---|
| 35 | #include <stdlib.h>
|
---|
| 36 | #include <string.h>
|
---|
| 37 |
|
---|
| 38 |
|
---|
| 39 | /*********************************************************************************************************************************
|
---|
| 40 | * Structures and Typedefs *
|
---|
| 41 | *********************************************************************************************************************************/
|
---|
| 42 | typedef struct
|
---|
| 43 | {
|
---|
| 44 | const char *pszImage;
|
---|
| 45 | FILE *pFile;
|
---|
| 46 | bool f32Bit;
|
---|
| 47 | union
|
---|
| 48 | {
|
---|
| 49 | IMAGE_NT_HEADERS32 Nt32;
|
---|
| 50 | IMAGE_NT_HEADERS64 Nt64;
|
---|
| 51 | } Hdrs;
|
---|
| 52 |
|
---|
| 53 | uint32_t cSections;
|
---|
| 54 | PIMAGE_SECTION_HEADER paSections;
|
---|
| 55 | } MYIMAGE;
|
---|
| 56 |
|
---|
| 57 |
|
---|
| 58 | static bool Failed(MYIMAGE *pThis, const char *pszFmt, ...)
|
---|
| 59 | {
|
---|
| 60 | va_list va;
|
---|
| 61 | fprintf(stderr, "error '%s': ", pThis->pszImage);
|
---|
| 62 | va_start(va, pszFmt);
|
---|
| 63 | vfprintf(stderr, pszFmt, va);
|
---|
| 64 | va_end(va);
|
---|
| 65 | fprintf(stderr, "\n");
|
---|
| 66 | return false;
|
---|
| 67 | }
|
---|
| 68 |
|
---|
| 69 |
|
---|
| 70 | static bool ReadPeHeaders(MYIMAGE *pThis)
|
---|
| 71 | {
|
---|
| 72 | /*
|
---|
| 73 | * MZ header.
|
---|
| 74 | */
|
---|
| 75 | IMAGE_DOS_HEADER MzHdr;
|
---|
| 76 | if (fread(&MzHdr, sizeof(MzHdr), 1, pThis->pFile) != 1)
|
---|
| 77 | return Failed(pThis, "Reading DOS header");
|
---|
| 78 |
|
---|
| 79 | if (MzHdr.e_magic != IMAGE_DOS_SIGNATURE)
|
---|
| 80 | return Failed(pThis, "No MZ magic (found %#x)", MzHdr.e_magic);
|
---|
| 81 |
|
---|
| 82 | if (fseek(pThis->pFile, MzHdr.e_lfanew, SEEK_SET) != 0)
|
---|
| 83 | return Failed(pThis, "Seeking to %#lx", (unsigned long)MzHdr.e_lfanew);
|
---|
| 84 |
|
---|
| 85 | /*
|
---|
| 86 | * NT signature + file header.
|
---|
| 87 | */
|
---|
| 88 | if (fread(&pThis->Hdrs.Nt32, offsetof(IMAGE_NT_HEADERS32, OptionalHeader), 1, pThis->pFile) != 1)
|
---|
| 89 | return Failed(pThis, "Reading NT file header");
|
---|
| 90 |
|
---|
| 91 | if (pThis->Hdrs.Nt32.Signature != IMAGE_NT_SIGNATURE)
|
---|
| 92 | return Failed(pThis, "No PE magic (found %#x)", pThis->Hdrs.Nt32.Signature);
|
---|
| 93 |
|
---|
| 94 | if (pThis->Hdrs.Nt32.FileHeader.SizeOfOptionalHeader == sizeof(pThis->Hdrs.Nt32.OptionalHeader))
|
---|
| 95 | pThis->f32Bit = true;
|
---|
| 96 | else if (pThis->Hdrs.Nt32.FileHeader.SizeOfOptionalHeader == sizeof(pThis->Hdrs.Nt64.OptionalHeader))
|
---|
| 97 | pThis->f32Bit = false;
|
---|
| 98 | else
|
---|
| 99 | return Failed(pThis, "Unsupported SizeOfOptionalHeaders value: %#x",
|
---|
| 100 | pThis->Hdrs.Nt32.FileHeader.SizeOfOptionalHeader);
|
---|
| 101 |
|
---|
| 102 | /*
|
---|
| 103 | * NT optional header.
|
---|
| 104 | */
|
---|
| 105 | if (fread(&pThis->Hdrs.Nt32.OptionalHeader, pThis->Hdrs.Nt32.FileHeader.SizeOfOptionalHeader, 1, pThis->pFile) != 1)
|
---|
| 106 | return Failed(pThis, "Reading NT optional header");
|
---|
| 107 |
|
---|
| 108 | if ( pThis->Hdrs.Nt32.OptionalHeader.Magic
|
---|
| 109 | != (pThis->f32Bit ? IMAGE_NT_OPTIONAL_HDR32_MAGIC : IMAGE_NT_OPTIONAL_HDR64_MAGIC) )
|
---|
| 110 | return Failed(pThis, "Bad optional header magic: %#x", pThis->Hdrs.Nt32.OptionalHeader.Magic);
|
---|
| 111 |
|
---|
| 112 | uint32_t NumberOfRvaAndSizes = pThis->f32Bit
|
---|
| 113 | ? pThis->Hdrs.Nt32.OptionalHeader.NumberOfRvaAndSizes
|
---|
| 114 | : pThis->Hdrs.Nt64.OptionalHeader.NumberOfRvaAndSizes;
|
---|
| 115 | if (NumberOfRvaAndSizes != IMAGE_NUMBEROF_DIRECTORY_ENTRIES)
|
---|
| 116 | return Failed(pThis, "Unsupported NumberOfRvaAndSizes value: %#x", NumberOfRvaAndSizes);
|
---|
| 117 |
|
---|
| 118 | /*
|
---|
| 119 | * Read the section table.
|
---|
| 120 | */
|
---|
| 121 | pThis->cSections = pThis->Hdrs.Nt32.FileHeader.NumberOfSections;
|
---|
| 122 | if (!pThis->cSections)
|
---|
| 123 | return Failed(pThis, "No sections in image!");
|
---|
| 124 | pThis->paSections = (PIMAGE_SECTION_HEADER)calloc(sizeof(pThis->paSections[0]), pThis->cSections);
|
---|
| 125 | if (!pThis->paSections)
|
---|
| 126 | return Failed(pThis, "Out of memory!");
|
---|
| 127 | if (fread(pThis->paSections, sizeof(pThis->paSections[0]), pThis->cSections, pThis->pFile) != pThis->cSections)
|
---|
| 128 | return Failed(pThis, "Reading NT section headers");
|
---|
| 129 |
|
---|
| 130 |
|
---|
| 131 | return true;
|
---|
| 132 | }
|
---|
| 133 |
|
---|
| 134 |
|
---|
| 135 | static bool ReadAtRva(MYIMAGE *pThis, uint32_t uRva, void *pvBuf, size_t cbToRead)
|
---|
| 136 | {
|
---|
| 137 | unsigned const uRvaOrg = uRva;
|
---|
| 138 | size_t const cbToReadOrg = cbToRead;
|
---|
| 139 |
|
---|
| 140 | /*
|
---|
| 141 | * Header section.
|
---|
| 142 | */
|
---|
| 143 | int iSh = -1;
|
---|
| 144 | uint32_t uSectRva = 0;
|
---|
| 145 | uint32_t offSectRaw = 0;
|
---|
| 146 | uint32_t cbSectRaw = pThis->f32Bit
|
---|
| 147 | ? pThis->Hdrs.Nt32.OptionalHeader.SizeOfHeaders
|
---|
| 148 | : pThis->Hdrs.Nt64.OptionalHeader.SizeOfHeaders;
|
---|
| 149 | uint32_t cbSectMax = pThis->paSections[0].VirtualAddress;
|
---|
| 150 |
|
---|
| 151 | for (;;)
|
---|
| 152 | {
|
---|
| 153 | /* Read if we've got a match. */
|
---|
| 154 | uint32_t off = uRva - uSectRva;
|
---|
| 155 | if (off < cbSectMax)
|
---|
| 156 | {
|
---|
| 157 | uint32_t cbThis = cbSectMax - off;
|
---|
| 158 | if (cbThis > cbToRead)
|
---|
| 159 | cbThis = (uint32_t)cbToRead;
|
---|
| 160 |
|
---|
| 161 | memset(pvBuf, 0, cbThis);
|
---|
| 162 |
|
---|
| 163 | if (off < cbSectRaw)
|
---|
| 164 | {
|
---|
| 165 | if (fseek(pThis->pFile, offSectRaw + off, SEEK_SET) != 0)
|
---|
| 166 | return Failed(pThis, "Seeking to %#x", offSectRaw + off);
|
---|
| 167 | if (fread(pvBuf, RT_MIN(cbThis, cbSectRaw - off), 1, pThis->pFile) != 1)
|
---|
| 168 | return Failed(pThis, "Reading %u bytes at %#x", RT_MIN(cbThis, cbSectRaw - off), offSectRaw + off);
|
---|
| 169 | }
|
---|
| 170 |
|
---|
| 171 | cbToRead -= cbThis;
|
---|
| 172 | if (!cbToRead)
|
---|
| 173 | return true;
|
---|
[84404] | 174 | uRva += cbThis;
|
---|
[59404] | 175 | pvBuf = (uint8_t *)pvBuf + cbThis;
|
---|
| 176 | }
|
---|
| 177 |
|
---|
| 178 | /* next section */
|
---|
| 179 | iSh++;
|
---|
| 180 | if ((unsigned)iSh >= pThis->cSections)
|
---|
| 181 | return Failed(pThis, "RVA %#x LB %u is outside the image", uRvaOrg, cbToReadOrg);
|
---|
| 182 | uSectRva = pThis->paSections[iSh].VirtualAddress;
|
---|
| 183 | offSectRaw = pThis->paSections[iSh].PointerToRawData;
|
---|
| 184 | cbSectRaw = pThis->paSections[iSh].SizeOfRawData;
|
---|
| 185 | if ((unsigned)iSh + 1 < pThis->cSections)
|
---|
| 186 | cbSectMax = pThis->paSections[iSh + 1].VirtualAddress - uSectRva;
|
---|
| 187 | else
|
---|
| 188 | cbSectMax = pThis->paSections[iSh].Misc.VirtualSize;
|
---|
| 189 | }
|
---|
| 190 | }
|
---|
| 191 |
|
---|
| 192 |
|
---|
| 193 | static bool ReadStringAtRva(MYIMAGE *pThis, uint32_t uRva, char *pszBuf, size_t cbMax)
|
---|
| 194 | {
|
---|
| 195 | uint32_t const uRvaOrg = uRva;
|
---|
| 196 |
|
---|
| 197 | /*
|
---|
| 198 | * Try read the whole string at once.
|
---|
| 199 | */
|
---|
| 200 | uint32_t cbImage = pThis->f32Bit
|
---|
| 201 | ? pThis->Hdrs.Nt32.OptionalHeader.SizeOfImage
|
---|
| 202 | : pThis->Hdrs.Nt64.OptionalHeader.SizeOfImage;
|
---|
| 203 | uint32_t cbThis = uRva < cbImage ? cbImage - uRva : 1;
|
---|
| 204 | if (cbThis > cbMax)
|
---|
| 205 | cbThis = (uint32_t)cbMax;
|
---|
| 206 | if (!ReadAtRva(pThis, uRva, pszBuf, cbThis))
|
---|
| 207 | return false;
|
---|
| 208 | if (memchr(pszBuf, 0, cbThis) != NULL)
|
---|
| 209 | return true;
|
---|
| 210 |
|
---|
| 211 | /*
|
---|
| 212 | * Read more, byte-by-byte.
|
---|
| 213 | */
|
---|
| 214 | for (;;)
|
---|
| 215 | {
|
---|
| 216 | cbMax -= cbThis;
|
---|
| 217 | if (!cbMax)
|
---|
| 218 | return Failed(pThis, "String to long at %#x", uRvaOrg);
|
---|
| 219 | pszBuf += cbThis;
|
---|
| 220 | uRva += cbThis;
|
---|
| 221 |
|
---|
| 222 | cbThis = 1;
|
---|
| 223 | if (!ReadAtRva(pThis, uRva, pszBuf, cbThis))
|
---|
| 224 | return false;
|
---|
| 225 | if (!*pszBuf)
|
---|
| 226 | return true;
|
---|
| 227 | }
|
---|
| 228 | }
|
---|
| 229 |
|
---|
| 230 |
|
---|
| 231 | static void *ReadAtRvaAlloc(MYIMAGE *pThis, uint32_t uRva, size_t cbToRead)
|
---|
| 232 | {
|
---|
| 233 | void *pvBuf = malloc(cbToRead);
|
---|
| 234 | if (pvBuf)
|
---|
| 235 | {
|
---|
| 236 | if (ReadAtRva(pThis, uRva, pvBuf, cbToRead))
|
---|
| 237 | return pvBuf;
|
---|
| 238 | free(pvBuf);
|
---|
| 239 | }
|
---|
| 240 | else
|
---|
| 241 | Failed(pThis, "Out of memory!");
|
---|
| 242 | return NULL;
|
---|
| 243 | }
|
---|
| 244 |
|
---|
| 245 |
|
---|
| 246 | static bool ParseAndCheckImports(MYIMAGE *pThis, const char **papszAllowed, unsigned cAllowed)
|
---|
| 247 | {
|
---|
| 248 | /*
|
---|
| 249 | * Do we have an import directory? If so, read it.
|
---|
| 250 | */
|
---|
| 251 | IMAGE_DATA_DIRECTORY ImpDir = pThis->f32Bit
|
---|
| 252 | ? pThis->Hdrs.Nt32.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]
|
---|
| 253 | : pThis->Hdrs.Nt64.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
|
---|
| 254 | if (ImpDir.Size == 0)
|
---|
| 255 | return true;
|
---|
| 256 |
|
---|
| 257 | uint32_t cImps = ImpDir.Size / sizeof(IMAGE_IMPORT_DESCRIPTOR);
|
---|
| 258 | if (cImps * sizeof(IMAGE_IMPORT_DESCRIPTOR) != ImpDir.Size)
|
---|
| 259 | return Failed(pThis, "Import directory size is not a multiple of IMAGE_IMPORT_DESCRIPTOR: %#x", ImpDir.Size);
|
---|
| 260 |
|
---|
| 261 | PIMAGE_IMPORT_DESCRIPTOR paImps = (PIMAGE_IMPORT_DESCRIPTOR)ReadAtRvaAlloc(pThis, ImpDir.VirtualAddress, ImpDir.Size);
|
---|
| 262 | if (!paImps)
|
---|
| 263 | return false;
|
---|
| 264 |
|
---|
| 265 | /* There is usually an empty entry at the end. */
|
---|
| 266 | if ( paImps[cImps - 1].Name == 0
|
---|
| 267 | || paImps[cImps - 1].FirstThunk == 0)
|
---|
| 268 | cImps--;
|
---|
| 269 |
|
---|
| 270 | /*
|
---|
| 271 | * Do the processing.
|
---|
| 272 | */
|
---|
| 273 | bool fRc = true;
|
---|
| 274 | for (uint32_t i = 0; i < cImps; i++)
|
---|
| 275 | {
|
---|
| 276 | /* Read the import name string. */
|
---|
| 277 | char szName[128];
|
---|
| 278 | if (!ReadStringAtRva(pThis, paImps[i].Name, szName, sizeof(szName)))
|
---|
| 279 | {
|
---|
| 280 | fRc = false;
|
---|
| 281 | break;
|
---|
| 282 | }
|
---|
| 283 |
|
---|
| 284 | /* Check it against the list of allowed DLLs. */
|
---|
| 285 | bool fFound = false;
|
---|
| 286 | unsigned j = cAllowed;
|
---|
| 287 | while (j-- > 0)
|
---|
| 288 | if (stricmp(papszAllowed[j], szName) == 0)
|
---|
| 289 | {
|
---|
| 290 | fFound = true;
|
---|
| 291 | break;
|
---|
| 292 | }
|
---|
| 293 | if (!fFound)
|
---|
| 294 | fRc = Failed(pThis, "Illegal import: '%s'", szName);
|
---|
| 295 | }
|
---|
| 296 |
|
---|
| 297 | free(paImps);
|
---|
| 298 | return fRc;
|
---|
| 299 | }
|
---|
| 300 |
|
---|
| 301 |
|
---|
| 302 | static int usage(const char *argv0)
|
---|
| 303 | {
|
---|
[60047] | 304 | printf("usage: %s --image <image> [allowed-dll [..]]\n", argv0);
|
---|
[59404] | 305 | return RTEXITCODE_SUCCESS;
|
---|
| 306 | }
|
---|
| 307 |
|
---|
| 308 |
|
---|
| 309 | int main(int argc, char **argv)
|
---|
| 310 | {
|
---|
| 311 | /*
|
---|
| 312 | * Parse arguments.
|
---|
| 313 | */
|
---|
| 314 | const char *pszImage = NULL;
|
---|
| 315 | const char **papszAllowed = (const char **)calloc(argc, sizeof(const char *));
|
---|
| 316 | unsigned cAllowed = 0;
|
---|
| 317 |
|
---|
| 318 | for (int i = 1; i < argc; i++)
|
---|
| 319 | {
|
---|
| 320 | const char *psz = argv[i];
|
---|
| 321 | if (*psz == '-')
|
---|
| 322 | {
|
---|
| 323 | if (!strcmp(psz, "--image") || !strcmp(psz, "-i"))
|
---|
| 324 | {
|
---|
| 325 | if (++i >= argc)
|
---|
| 326 | {
|
---|
| 327 | fprintf(stderr, "syntax error: File name expected after '%s'.\n", psz);
|
---|
| 328 | return RTEXITCODE_SYNTAX;
|
---|
| 329 | }
|
---|
| 330 | pszImage = argv[i];
|
---|
| 331 | }
|
---|
| 332 | else if ( !strcmp(psz, "--help")
|
---|
| 333 | || !strcmp(psz, "-help")
|
---|
| 334 | || !strcmp(psz, "-h")
|
---|
| 335 | || !strcmp(psz, "-?") )
|
---|
| 336 | return usage(argv[0]);
|
---|
| 337 | else if ( !strcmp(psz, "--version")
|
---|
| 338 | || !strcmp(psz, "-V"))
|
---|
| 339 | {
|
---|
| 340 | printf("$Revision: 98103 $\n");
|
---|
| 341 | return RTEXITCODE_SUCCESS;
|
---|
| 342 | }
|
---|
| 343 | else
|
---|
| 344 | {
|
---|
| 345 | fprintf(stderr, "syntax error: Unknown option '%s'.\n", psz);
|
---|
| 346 | return RTEXITCODE_SYNTAX;
|
---|
| 347 | }
|
---|
| 348 | }
|
---|
| 349 | else
|
---|
| 350 | papszAllowed[cAllowed++] = argv[i];
|
---|
| 351 | }
|
---|
| 352 |
|
---|
| 353 | if (!pszImage)
|
---|
| 354 | {
|
---|
| 355 | fprintf(stderr, "syntax error: No input file specified.\n");
|
---|
| 356 | return RTEXITCODE_SYNTAX;
|
---|
| 357 | }
|
---|
| 358 |
|
---|
| 359 | /*
|
---|
| 360 | * Open the image and process headers.
|
---|
| 361 | */
|
---|
| 362 | RTEXITCODE rcExit = RTEXITCODE_FAILURE;
|
---|
| 363 | MYIMAGE MyImage;
|
---|
| 364 | memset(&MyImage, 0, sizeof(MyImage));
|
---|
| 365 | MyImage.pszImage = pszImage;
|
---|
| 366 | MyImage.pFile = fopen(pszImage, "rb");
|
---|
| 367 | if (MyImage.pFile)
|
---|
| 368 | {
|
---|
| 369 | if ( ReadPeHeaders(&MyImage)
|
---|
| 370 | && ParseAndCheckImports(&MyImage, papszAllowed, cAllowed))
|
---|
| 371 | rcExit = RTEXITCODE_SUCCESS;
|
---|
| 372 |
|
---|
| 373 | fclose(MyImage.pFile);
|
---|
| 374 | free(MyImage.paSections);
|
---|
| 375 | }
|
---|
| 376 | else
|
---|
| 377 | Failed(&MyImage, "Failed to open image for binary reading.");
|
---|
| 378 |
|
---|
| 379 | return rcExit;
|
---|
| 380 | }
|
---|
| 381 |
|
---|