Fix enumerating exports from binaries such as mfc140u.dll
@@ -343,6 +343,9 @@ PVOID PhMappedImageRvaToVa(
{
PIMAGE_SECTION_HEADER section;
+ if (Rva == 0)
+ return NULL;
+
section = PhMappedImageRvaToSection(MappedImage, Rva);
if (!section)
@@ -912,11 +915,10 @@ NTSTATUS PhGetMappedImageExports(
NULL
);
- if (
- !Exports->AddressTable ||
- !Exports->NamePointerTable ||
- !Exports->OrdinalTable
- )
+ // Note: NamePointerTable and OrdinalTable are null for binaries
+ // such as mfc140u.dll yet contain valid exports (dmex)
+
+ if (!Exports->AddressTable)
return STATUS_INVALID_PARAMETER;
__try
@@ -926,17 +928,25 @@ NTSTATUS PhGetMappedImageExports(
Exports->AddressTable,
exportDirectory->NumberOfFunctions * sizeof(ULONG)
);
+
+ if (Exports->NamePointerTable)
+ {
PhpMappedImageProbe(
MappedImage,
Exports->NamePointerTable,
exportDirectory->NumberOfNames * sizeof(ULONG)
);
+ }
+
+ if (Exports->OrdinalTable)
+ {
PhpMappedImageProbe(
MappedImage,
Exports->OrdinalTable, // ordinal list for named exports
exportDirectory->NumberOfNames * sizeof(USHORT)
);
}
+ }
__except (EXCEPTION_EXECUTE_HANDLER)
{
return GetExceptionCode();
@@ -966,6 +976,8 @@ NTSTATUS PhGetMappedImageExportEntry(
Entry->Ordinal = (USHORT)Index + (USHORT)Exports->ExportDirectory->Base;
+ if (Exports->OrdinalTable)
+ {
// look into named exports ordinal list.
for (nameIndex = 0; nameIndex < Exports->ExportDirectory->NumberOfNames; nameIndex++)
{
@@ -975,8 +987,9 @@ NTSTATUS PhGetMappedImageExportEntry(
break;
}
}
+ }
- if (exportByName)
+ if (Exports->NamePointerTable && exportByName)
{
name = PhMappedImageRvaToVa(
Exports->MappedImage,
