peconv::ExportsMapper Class Reference

#include <exports_mapper.h>

Public Member Functions
size_t	add_to_lookup (std::string moduleName, HMODULE modulePtr, ULONGLONG moduleBase)
size_t	add_to_lookup (std::string moduleName, HMODULE modulePtr)
const std::set< ExportedFunc > *	find_exports_by_va (ULONGLONG va) const
std::string	get_dll_path (std::string short_name) const
std::string	get_dll_fullname (std::string short_name) const
const ExportedFunc *	find_export_by_va (ULONGLONG va) const
void	print_va_to_func (std::stringstream &stream) const
void	print_func_to_va (std::stringstream &stream) const

Protected Member Functions
void	associateVaAndFunc (ULONGLONG va, const ExportedFunc &func)

Protected Attributes
std::map< ULONGLONG, std::set< ExportedFunc > >	va_to_func
std::map< ExportedFunc, std::set< ExportedFunc > >	forwarders_lookup
std::map< ExportedFunc, ULONGLONG >	func_to_va
std::map< std::string, std::string >	dll_shortname_to_path

Detailed Description

Definition at line 22 of file exports_mapper.h.

Member Function Documentation

add_to_lookup() [1/2]

size_t peconv::ExportsMapper::add_to_lookup ( std::string  moduleName, HMODULE  modulePtr  )

inline

Appends the given DLL to the lookup table of exported functions. Returns the number of functions exported from this DLL (not forwarded). Assumes that the module was relocated to the same address as is the address of the given buffer (modulePtr). (A wrapper for the case if we are adding a DLL that was loaded within the current process.)

Parameters

moduleName	: name of the DLL
modulePtr	: buffer containing the DLL in a Virtual format.

Definition at line 41 of file exports_mapper.h.

Here is the call graph for this function:

add_to_lookup() [2/2]

size_t ExportsMapper::add_to_lookup	(	std::string	moduleName,
		HMODULE	modulePtr,
		ULONGLONG	moduleBase
	)

Appends the given DLL to the lookup table of exported functions. Returns the number of functions exported from this DLL (not forwarded).

Parameters

moduleName	: name of the DLL
modulePtr	: buffer containing the DLL in a Virtual format
moduleBase	: a base address to which the given DLL was relocated

Definition at line 199 of file exports_mapper.cpp.

Here is the call graph for this function:

associateVaAndFunc()

void peconv::ExportsMapper::associateVaAndFunc ( ULONGLONG  va, const ExportedFunc &  func  )

inlineprotected

Add a function and a VA into a mutual mapping.

Definition at line 113 of file exports_mapper.h.

find_export_by_va()

const ExportedFunc * peconv::ExportsMapper::find_export_by_va ( ULONGLONG  va ) const

inline

Find an Exported Function that can be mapped to the given VA,

Definition at line 85 of file exports_mapper.h.

Here is the call graph for this function:

find_exports_by_va()

const std::set< ExportedFunc > * peconv::ExportsMapper::find_exports_by_va ( ULONGLONG  va ) const

inline

Find the set of Exported Functions that can be mapped to the given VA. Includes forwarders, and function aliases.

Definition at line 49 of file exports_mapper.h.

get_dll_fullname()

std::string peconv::ExportsMapper::get_dll_fullname ( std::string  short_name ) const

inline

Retrieve the full name of the DLL (including the extension) using its short name (without the extension).

Definition at line 74 of file exports_mapper.h.

Here is the call graph for this function:

get_dll_path()

std::string peconv::ExportsMapper::get_dll_path ( std::string  short_name ) const

inline

Retrieve the full path of the DLL with the given short name.

Definition at line 62 of file exports_mapper.h.

print_func_to_va()

void ExportsMapper::print_func_to_va

(

std::stringstream &

stream

)

const

Definition at line 25 of file exports_mapper.cpp.

print_va_to_func()

void ExportsMapper::print_va_to_func

(

std::stringstream &

stream

)

const

Definition at line 8 of file exports_mapper.cpp.

Member Data Documentation

dll_shortname_to_path

std::map<std::string, std::string> peconv::ExportsMapper::dll_shortname_to_path

protected

A map associating DLL shortname with the full path to the DLL.

Definition at line 137 of file exports_mapper.h.

forwarders_lookup

std::map<ExportedFunc, std::set<ExportedFunc> > peconv::ExportsMapper::forwarders_lookup

protected

A map associating an exported functions with its forwarders.

Definition at line 127 of file exports_mapper.h.

func_to_va

std::map<ExportedFunc, ULONGLONG> peconv::ExportsMapper::func_to_va

protected

A map associating an exported functions with its VA.

Definition at line 132 of file exports_mapper.h.

va_to_func

std::map<ULONGLONG, std::set<ExportedFunc> > peconv::ExportsMapper::va_to_func

protected

A map associating VA of the function with the related exports.

Definition at line 122 of file exports_mapper.h.

---

The documentation for this class was generated from the following files:

• libpeconv/include/peconv/exports_mapper.h
• libpeconv/src/exports_mapper.cpp