hoshimin / formatpe Goto Github PK

View Code? Open in Web Editor NEW

212.0 8.0 43.0 83 KB

A bunch of parsers for PE and PDB formats in C++

License: MIT License

C++ 98.09% CMake 1.91%

cpp header-only modern-cpp pdb pdb-files pdb-parser pdb-structure pe pe-analyzer pe-applications

formatpe's Introduction

♟️ formatPE²

A bunch of PE and PDB parsers written in C++

💾 Pe:

This header-only library provides a convinient way to represent a PE-file as an enumerable object.

The library supports enumeration of:

Sections
Imports
Exports
Relocations
Exceptions
Bound- and delayed-imports
TLS-callbacks
Debug directory with support for CodeView PDB information

Features:

Zero-alloc
Support for both x32 and x64 files regardless of the bitness of your process
Support for raw PE files from disk and for loaded images in memory
Kernelmode support
Extremely fast and lightweight
Only one header file
Simplicity in usage
Support for C++14 and above
Provides additional information and access to raw PE structures if you need more!

Usage:

Just include the Pe/Pe.hpp to your project!
For the complete example of usage look at the PeTests.cpp.

#include <Windows.h>
#include <cstdio>

#include <Pe/Pe.hpp>

int main()
{
    const auto hNtdll = GetModuleHandleW(L"ntdll.dll");

    //
    // Usage:
    //   Pe::Pe[32|64|Native]::fromFile(fileContent)
    //   Pe::Pe[32|64|Native]::fromModule(hModule)
    //
    // Pe::PeNative is an alias for Pe::Pe32 or Pe::Pe64
    // depending on the current process bitness.
    //

    const auto pe = Pe::PeNative::fromModule(hNtdll);

    // Iterating over exports:
    printf("Exports:\n");
    for (const auto& exp : pe.exports())
    {
        switch (exp.type())
        {
        case Pe::ExportType::exact:
        {
            printf("  %s at %p\n", exp.name(), exp.address());
            break;
        }
        case Pe::ExportType::forwarder:
        {
            printf("  Forwarder: %s\n", exp.forwarder());
            break;
        }
        }
    }

    // Find an exported function by name:
    const auto fn = pe.exports().find("NtCreateSection");
    const void* const addr = fn.address();

    return 0;
}

🗜️ Pdb:

This library provides a typed and convinient way to download and parse PDB files using the DbgHelp library.
It distinguishes raw information from DbgHelp by tags and classifies it by predefined types.
In other words, you always know which type you deal with - so, you can't parse a struct as a function or something like that.

It supports:

Downloading PDBs without symsrv.dll
Works with the dbghelp.dll supplied with the system in C:\Windows\System32\dbghelp.dll
Does not require distribution of dbghelp.dll and symsrv.dll next to the application
Base types (int, uint, int64, uint64, int128, uint128, float, double)
User-defined types (UDT)
Structs
Classes and their parent classes
Unions
Interfaces
Pointers
Arrays
Function types, exact functions and their arguments
Enums
Bitfields
Constants
Static and dynamic members of classes and structs
Support for C++14 and above

Usage:

Include the Pdb/Pdb.cpp and the Pdb/Pdb.h to your project and (optionally) SymLoader.cpp and SymLoader.h if you want to download PDBs manually.

Important!

You must have dbghelp.dll and symsrv.dll in the folder of your application
if you plan to download symbols automatically using the symbol path like:
srv*C:\Symbols*http://msdl.microsoft.com/download/symbols

You can find these libraries in the folder of your SDK, for example:
C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000\\[x32|x64]\

But there is a way to download PDBs manually using the SymLoader class.
In this case you don't need to distribute dbghelp.dll and symsrv.dll with the library.

For the complete example of usage look at the PeTests.cpp.

#include <Pdb/Pdb.hpp>
#include <Pdb/SymLoader.h> // To download PDBs manually

int main()
{
    const std::wstring exePath = L"C:\\Windows\\System32\\ntoskrnl.exe";
    try
    {
        // Create the provider first: it initializes the DbgHelp engine:
        Pdb::Prov prov;

        // Obtain the PDB info associated with the binary:
        const auto pdbInfo = prov.getPdbInfo(exePath.c_str());

        // Use this PDB info to build a link to the file on a symbol server:
        const auto url = std::wstring(Pdb::Prov::k_microsoftSymbolServerSecure)
            + L"/" + pdbInfo.pdbUrl();

        // Select the destination where to place downloaded PDB,
        // the path will be created with all subfolders:
        const std::wstring symFolder = L"C:\\Symbols\\";

        // You can get more control over downloading:
        // derivate from the Pdb::WinInetFileDownloader or from its superclass
        // and override onStart, onReceive, onCancel, onError or onFinish -
        // and you can get HTTP codes and data size.
        Pdb::WinInetFileDownloader downloader((symFolder + pdbInfo.pdbPath()).c_str());
        const bool downloadStatus = Pdb::SymLoader::download(url.c_str(), downloader);
        if (!downloadStatus)
        {
            printf("Unable to download the PDB");
            return;
        }

        // The file was downloaded, set the search path to it for the dbghelp.dll:
        prov.setSymPath(symFolder.c_str());

        // Or you can skip all previous steps if you have
        // both dbghelp.dll and symsrv.dll in the folder of your app.
        // In this case dbghelp.dll will download symbols automatically.

        // Now we can load the image and parse its data:
        const Pdb::Mod mod(exePath.c_str());

        // Let's dump _EPROCESS with all its fields:
        const auto sym = mod.find(L"_EPROCESS").cast<Pdb::SymTypeStruct>();
        for (const auto child : sym.children())
        {
            if (child.equals<Pdb::SymDynamicMember>())
            {
                const auto field = child.cast<Pdb::SymDynamicMember>();
                const auto name = field.name();
                const auto type = field.type();
                const auto bitfield = field.bitfield();
                printf("[%u:%u], %u %ws %ws\n",
                    bitfield.present, bitfield.pos,
                    field.offset(),
                    type.name().c_str(),
                    name.c_str()
                );
            }
        }
    }
    catch (const Pdb::BadCast& e)
    {
        printf("%ws\n", e.reason().c_str());
    }
    catch (const Pdb::NotInitialized& e)
    {
        printf("%ws\n", e.reason().c_str());
    }
    catch (const Pdb::DbgHelpFailure& e)
    {
        printf("%ws Error: 0x%X\n", e.reason().c_str(), e.error());
    }
    catch (const Pdb::SymNotFound& e)
    {
        printf("%ws\n", e.reason().c_str());
    }

    return 0;
}

🏗️ Build with CMake:

# Link formatPE as dependency:
add_subdirectory("./formatPE/")  # As subfolder
target_link_libraries("TargetName" PRIVATE 
    formatPE::Pe
    formatPE::Pdb
    formatPE::SymLoader
)

Or:

# Use an absolute path:
set(formatPE_DIR "/path/to/the/formatPE/directory/with/the/CMakeLists.txt/")

find_package(formatPE REQUIRED) 

target_link_libraries("TargetName" PRIVATE 
    formatPE::Pe
    formatPE::Pdb
    formatPE::SymLoader
)

formatpe's People

Contributors

Stargazers

Watchers

formatpe's Issues

Pdb::Sym::cast: Invalid type cast.

Hello, how do you convert the function?
mod.find(L"NtOpenProcess").castPdb::SymFunc();
mod.find(L"NtOpenProcess").castPdb::SymFuncArg();
Both are Pdb::Sym::cast: Invalid type cast.

about the function return

When function error, why use the throw Exception the way?
why not return result Let's us to decide ,
when i not register the Exception Handler , my program will close ,not printf anything about the debug info

Big-endian support

Hello
I'm trying to use this library to parse windows dll/exe/sys files on Big-endian linux system
But unfortunately, it does not support reversed byte order now

Bug in the Union ImportAddressTableEntry

Modify：
union ImportAddressTableEntry {
unsigned long long raw;
ImgThunkData thunk;
struct {
Rva hintNameRva : 31;
} name;
struct {
unsigned long long ord : 16;
} ordinal;
struct {
unsigned long long reserved : 63;
unsigned long long importByOrdinal : 1;
};
}

32-bit process parsing missing exported functions

For example ntopenprocess

void getExportFunction() {
    const HMODULE hModule = GetModuleHandleW(L"ntdll.dll");
    const auto    pe      = Pe::PeNative::fromModule(hModule);
    const auto exports = pe.exports();
    printf("Exports count %u (0x%X):\n", exports.count(), exports.count());
    for (const auto& exp : exports) {
        switch (exp.type()) {
            case Pe::ExportType::exact: {
                printf("[%u]  %s at %p\n", exp.ordinal(), exp.name(), exp.address());
                break;
            }
            case Pe::ExportType::forwarder: {
                printf("[%u] Forwarder: %s\n", exp.ordinal(), exp.forwarder());
                break;
            }
        }

        if (exp.hasName()) {
            const auto byName = exports.find(exp.name());
            assert(byName.type() == exp.type());
            assert(byName.ordinal() == exp.ordinal());
            switch (byName.type()) {
                case Pe::ExportType::exact: {
                    assert(byName.address() == exp.address());
                    break;
                }
                case Pe::ExportType::forwarder: {
                    assert(byName.forwarder() == exp.forwarder());
                    break;
                }
            }

            const auto byOrdinal = exports.find(exp.ordinal());
            assert(byName.address() == byOrdinal.address());
            assert(byName.ordinal() == byOrdinal.ordinal());
            assert(byName.type() == byOrdinal.type());
        } else {
            const auto t = exp.type();
            t;
            const auto byOrdinal = exports.find(exp.ordinal());
            if (exp.type() == Pe::ExportType::exact) {
                assert(byOrdinal.address() == exp.address());
            }
            assert(byOrdinal.ordinal() == exp.ordinal());
            assert(byOrdinal.type() == exp.type());
        }
    }
}

Bug in const typename GenericTypes::FnImageTlsCallback* callbacks() const noexcept {}

This fnc ignore use the rva；
Modify：
const typename GenericTypes::FnImageTlsCallback* callbacks() const noexcept {
return valid() ? (m_pe.byRva(m_directory->AddressOfCallBacks))
: nullptr;
//return valid() ? reinterpret_cast<typename GenericTypes::FnImageTlsCallback*>(m_directory->AddressOfCallBacks)
// : nullptr;
}
？

A lot of errors when compiling for ANSI support

Pe/Pe.hpp:2052:13: warning: multi-character character constant [-Wmultichar]
     pdb70 = 'SDSR', // RSDS
             ^~~~~~
Pe/Pe.hpp:2053:13: warning: multi-character character constant [-Wmultichar]
     pdb20 = '01BN', // NB10
             ^~~~~~
In file included from main.cpp:40:0:
Pe/Pe.hpp:47:69: warning: 'nodiscard' attribute directive ignored [-Wattributes]
     [[nodiscard]] constexpr T&& forward(remove_reference_t<T>& arg) noexcept
                                                                     ^~~~~~~~
Pe/Pe.hpp:53:70: warning: 'nodiscard' attribute directive ignored [-Wattributes]
     [[nodiscard]] constexpr T&& forward(remove_reference_t<T>&& arg) noexcept
                                                                      ^~~~~~~~
Pe/Pe.hpp: In member function 'Pe::RelocType Pe::Reloc::type() const':
Pe/Pe.hpp:119:14: error: 'IMAGE_REL_BASED_DIR64' was not declared in this scope
         case IMAGE_REL_BASED_DIR64    : return RelocType::dir64;
              ^~~~~~~~~~~~~~~~~~~~~
Pe/Pe.hpp: At global scope:
Pe/Pe.hpp:274:31: error: 'IMAGE_DELAYLOAD_DESCRIPTOR' was not declared in this scope
 using DirDelayedImports = Dir<IMAGE_DELAYLOAD_DESCRIPTOR, IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT>;
                               ^~~~~~~~~~~~~~~~~~~~~~~~~~
Pe/Pe.hpp:274:93: error: template argument 1 is invalid
 using DirDelayedImports = Dir<IMAGE_DELAYLOAD_DESCRIPTOR, IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT>;
                                                                                             ^
Pe/Pe.hpp:316:34: error: unable to find numeric literal operator 'operator""ui16'
     static constexpr auto k_mz = 0x5A4Dui16; // MZ
                                  ^~~~~~~~~~
Pe/Pe.hpp:317:34: error: unable to find numeric literal operator 'operator""ui32'
     static constexpr auto k_pe = 0x00004550ui32; // "PE\0\0"
                                  ^~~~~~~~~~~~~~
In file included from main.cpp:40:0:
Pe/Pe.hpp:512:14: error: expected nested-name-specifier
     typename DirectoryDescriptor<DirType> directory() const noexcept
              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
Pe/Pe.hpp:512:43: error: invalid declarator before 'directory'
     typename DirectoryDescriptor<DirType> directory() const noexcept
                                           ^~~~~~~~~
Pe/Pe.hpp: In member function 'const ImgImportByName* Pe::Imports<<anonymous> >::FunctionEntry::name() const':
Pe/Pe.hpp:803:75: error: expected '(' before '>' token
             return m_lib.pe().byRva<typename GenericTypes::ImgImportByName>(rva);
                                                                           ^
Pe/Pe.hpp: In member function 'const char* Pe::Imports<<anonymous> >::ModuleEntry::libName() const':
Pe/Pe.hpp:875:31: error: expected primary-expression before 'char'
             return m_pe.byRva<char>(m_descriptor->Name);
                               ^~~~
Pe/Pe.hpp:875:31: error: expected ';' before 'char'
Pe/Pe.hpp:875:35: error: expected unqualified-id before '>' token
             return m_pe.byRva<char>(m_descriptor->Name);
                                   ^
Pe/Pe.hpp: In member function 'const typename Pe::Types<arch>::ImportAddressTableEntry* Pe::Imports<<anonymous> >::ModuleEntry::importAddressTable() const':
Pe/Pe.hpp:881:76: error: expected '(' before '>' token
             return m_pe.byRva<typename Types<arch>::ImportAddressTableEntry>(m_descriptor->FirstThunk);
                                                                            ^
Pe/Pe.hpp: In member function 'const typename Pe::Types<arch>::ImportLookupTableEntry* Pe::Imports<<anonymous> >::ModuleEntry::importLookupTable() const':
Pe/Pe.hpp:887:75: error: expected '(' before '>' token
             return m_pe.byRva<typename Types<arch>::ImportLookupTableEntry>(m_descriptor->OriginalFirstThunk);
                                                                           ^
Pe/Pe.hpp: In member function 'Pe::DirectoryDescriptor<Pe::Dir<_IMAGE_IMPORT_DESCRIPTOR, 1u> > Pe::Imports<<anonymous> >::descriptor() const':
Pe/Pe.hpp:940:41: error: expected primary-expression before '>' token
         return m_pe.directory<DirImports>();
                                         ^
Pe/Pe.hpp:940:43: error: expected primary-expression before ')' token
         return m_pe.directory<DirImports>();
                                           ^
Pe/Pe.hpp: At global scope:
Pe/Pe.hpp:1063:24: error: 'DirDelayedImports' has not been declared
         const typename DirDelayedImports::Type* m_descriptor;
                        ^~~~~~~~~~~~~~~~~
Pe/Pe.hpp:1066:56: error: 'DirDelayedImports' has not been declared
         ModuleEntry(const Pe<arch>& pe, const typename DirDelayedImports::Type* const descriptor) noexcept
                                                        ^~~~~~~~~~~~~~~~~
Pe/Pe.hpp:1077:24: error: 'DirDelayedImports' has not been declared
         const typename DirDelayedImports::Type* descriptor() const noexcept
                        ^~~~~~~~~~~~~~~~~
Pe/Pe.hpp:1146:25: error: 'DirDelayedImports' was not declared in this scope
     DirectoryDescriptor<DirDelayedImports> descriptor() const noexcept
                         ^~~~~~~~~~~~~~~~~
Pe/Pe.hpp:1146:42: error: template argument 1 is invalid
     DirectoryDescriptor<DirDelayedImports> descriptor() const noexcept
                                          ^
Pe/Pe.hpp: In member function 'const ImgImportByName* Pe::DelayedImports<<anonymous> >::FunctionEntry::name() const':
Pe/Pe.hpp:1022:75: error: expected '(' before '>' token
             return m_lib.pe().byRva<typename GenericTypes::ImgImportByName>(rva);
                                                                           ^
Pe/Pe.hpp: In member function 'bool Pe::DelayedImports<<anonymous> >::ModuleEntry::valid() const':
Pe/Pe.hpp:1084:50: error: request for member 'DllNameRVA' in '((const Pe::DelayedImports<<anonymous> >::ModuleEntry*)this)->Pe::DelayedImports<<anonymous> >::ModuleEntry::m_descriptor->', which is of non-class type 'const int'
             return m_descriptor && m_descriptor->DllNameRVA;
                                                  ^~~~~~~~~~
Pe/Pe.hpp: In member function 'const char* Pe::DelayedImports<<anonymous> >::ModuleEntry::moduleName() const':
Pe/Pe.hpp:1089:31: error: expected primary-expression before 'char'
             return m_pe.byRva<char>(m_descriptor->DllNameRVA);
                               ^~~~
Pe/Pe.hpp:1089:31: error: expected ';' before 'char'
Pe/Pe.hpp:1089:35: error: expected unqualified-id before '>' token
             return m_pe.byRva<char>(m_descriptor->DllNameRVA);
                                   ^
Pe/Pe.hpp: In member function 'const typename Pe::Types<arch>::ImportAddressTableEntry* Pe::DelayedImports<<anonymous> >::ModuleEntry::importAddressTable() const':
Pe/Pe.hpp:1095:76: error: expected '(' before '>' token
             return m_pe.byRva<typename Types<arch>::ImportAddressTableEntry>(m_descriptor->ImportAddressTableRVA);
                                                                            ^
Pe/Pe.hpp:1095:92: error: request for member 'ImportAddressTableRVA' in '((const Pe::DelayedImports<<anonymous> >::ModuleEntry*)this)->Pe::DelayedImports<<anonymous> >::ModuleEntry::m_descriptor->', which is of non-class type 'const int'
             return m_pe.byRva<typename Types<arch>::ImportAddressTableEntry>(m_descriptor->ImportAddressTableRVA);
                                                                                            ^~~~~~~~~~~~~~~~~~~~~
Pe/Pe.hpp: In member function 'const typename Pe::Types<arch>::ImportNameTableEntry* Pe::DelayedImports<<anonymous> >::ModuleEntry::importNameTable() const':
Pe/Pe.hpp:1101:73: error: expected '(' before '>' token
             return m_pe.byRva<typename Types<arch>::ImportNameTableEntry>(m_descriptor->ImportNameTableRVA);
                                                                         ^
Pe/Pe.hpp:1101:89: error: request for member 'ImportNameTableRVA' in '((const Pe::DelayedImports<<anonymous> >::ModuleEntry*)this)->Pe::DelayedImports<<anonymous> >::ModuleEntry::m_descriptor->', which is of non-class type 'const int'
             return m_pe.byRva<typename Types<arch>::ImportNameTableEntry>(m_descriptor->ImportNameTableRVA);
                                                                                         ^~~~~~~~~~~~~~~~~~
Pe/Pe.hpp: In member function 'int Pe::DelayedImports<<anonymous> >::descriptor() const':
Pe/Pe.hpp:1148:31: error: 'DirDelayedImports' was not declared in this scope
         return m_pe.directory<DirDelayedImports>();
                               ^~~~~~~~~~~~~~~~~
Pe/Pe.hpp:1148:50: error: expected primary-expression before ')' token
         return m_pe.directory<DirDelayedImports>();
                                                  ^
Pe/Pe.hpp: In member function 'Pe::DirectoryDescriptor<Pe::Dir<_IMAGE_BOUND_IMPORT_DESCRIPTOR, 11u> > Pe::BoundImports<<anonymous> >::descriptor() const':
Pe/Pe.hpp:1345:46: error: expected primary-expression before '>' token
         return m_pe.directory<DirBoundImports>();
                                              ^
Pe/Pe.hpp:1345:48: error: expected primary-expression before ')' token
         return m_pe.directory<DirBoundImports>();
                                                ^
Pe/Pe.hpp: In member function 'const char* Pe::Exports<<anonymous> >::FunctionEntry::name() const':
Pe/Pe.hpp:1419:40: error: expected primary-expression before 'char'
                 ? m_exports.pe().byRva<char>(*m_name)
                                        ^~~~
Pe/Pe.hpp:1419:40: error: expected ':' before 'char'
Pe/Pe.hpp:1419:40: error: expected primary-expression before 'char'
Pe/Pe.hpp:1419:40: error: expected ';' before 'char'
Pe/Pe.hpp:1419:44: error: expected unqualified-id before '>' token
                 ? m_exports.pe().byRva<char>(*m_name)
                                            ^
Pe/Pe.hpp: In member function 'const void* Pe::Exports<<anonymous> >::FunctionEntry::address() const':
Pe/Pe.hpp:1435:41: error: expected primary-expression before 'void'
             return m_exports.pe().byRva<void>(exportAddressTableEntry()->address);
                                         ^~~~
Pe/Pe.hpp:1435:41: error: expected ';' before 'void'
Pe/Pe.hpp:1435:45: error: expected unqualified-id before '>' token
             return m_exports.pe().byRva<void>(exportAddressTableEntry()->address);
                                             ^
Pe/Pe.hpp: In member function 'const char* Pe::Exports<<anonymous> >::FunctionEntry::forwarder() const':
Pe/Pe.hpp:1445:41: error: expected primary-expression before 'char'
             return m_exports.pe().byRva<char>(exportAddressTableEntry()->forwarderString);
                                         ^~~~
Pe/Pe.hpp:1445:41: error: expected ';' before 'char'
Pe/Pe.hpp:1445:45: error: expected unqualified-id before '>' token
             return m_exports.pe().byRva<char>(exportAddressTableEntry()->forwarderString);
                                             ^
Pe/Pe.hpp: In constructor 'Pe::Exports<<anonymous> >::Exports(const Pe::Pe<arch>&)':
Pe/Pe.hpp:1538:72: error: expected '(' before '>' token
         , m_descriptor(m_directory ? pe.byRva<typename DirExports::Type>(m_directory->VirtualAddress) : nullptr)
                                                                        ^
Pe/Pe.hpp:1541:15: error: expected primary-expression before '{' token
               {
               ^
Pe/Pe.hpp:1541:15: error: expected ':' before '{' token
Pe/Pe.hpp:1541:15: error: expected primary-expression before '{' token
Pe/Pe.hpp: In member function 'const char* Pe::Exports<<anonymous> >::moduleName() const':
Pe/Pe.hpp:1595:27: error: expected primary-expression before 'char'
         return m_pe.byRva<char>(rva);
                           ^~~~
Pe/Pe.hpp:1595:27: error: expected ';' before 'char'
Pe/Pe.hpp:1595:31: error: expected unqualified-id before '>' token
         return m_pe.byRva<char>(rva);
                               ^
Pe/Pe.hpp: In lambda function:
Pe/Pe.hpp:1627:31: error: expected primary-expression before 'char'
             return m_pe.byRva<char>(rva);
                               ^~~~
Pe/Pe.hpp:1627:31: error: expected ';' before 'char'
Pe/Pe.hpp:1627:35: error: expected unqualified-id before '>' token
             return m_pe.byRva<char>(rva);
                                   ^
Pe/Pe.hpp: In member function 'Pe::Exports<<anonymous> >::Export Pe::Exports<<anonymous> >::find(const char*) const':
Pe/Pe.hpp:1662:26: error: expected primary-expression before '(' token
             return Export(m_pe.byRva<void>(exportEntry.address), unbiasedOrdinal + ordinalBase(), ExportType::exact);
                          ^
Pe/Pe.hpp:1662:38: error: expected primary-expression before 'void'
             return Export(m_pe.byRva<void>(exportEntry.address), unbiasedOrdinal + ordinalBase(), ExportType::exact);
                                      ^~~~
Pe/Pe.hpp:1662:38: error: expected ')' before 'void'
Pe/Pe.hpp:1666:26: error: expected primary-expression before '(' token
             return Export(m_pe.byRva<void>(exportEntry.forwarderString), unbiasedOrdinal + ordinalBase(), ExportType::forwarder);
                          ^
Pe/Pe.hpp:1666:38: error: expected primary-expression before 'void'
             return Export(m_pe.byRva<void>(exportEntry.forwarderString), unbiasedOrdinal + ordinalBase(), ExportType::forwarder);
                                      ^~~~
Pe/Pe.hpp:1666:38: error: expected ')' before 'void'
Pe/Pe.hpp: In member function 'Pe::Exports<<anonymous> >::Export Pe::Exports<<anonymous> >::find(unsigned int) const':
Pe/Pe.hpp:1686:26: error: expected primary-expression before '(' token
             return Export(m_pe.byRva<void>(exportEntry.address), unbiasedOrdinal + ordinalBase(), ExportType::exact);
                          ^
Pe/Pe.hpp:1686:38: error: expected primary-expression before 'void'
             return Export(m_pe.byRva<void>(exportEntry.address), unbiasedOrdinal + ordinalBase(), ExportType::exact);
                                      ^~~~
Pe/Pe.hpp:1686:38: error: expected ')' before 'void'
Pe/Pe.hpp:1690:26: error: expected primary-expression before '(' token
             return Export(m_pe.byRva<void>(exportEntry.forwarderString), unbiasedOrdinal + ordinalBase(), ExportType::forwarder);
                          ^
Pe/Pe.hpp:1690:38: error: expected primary-expression before 'void'
             return Export(m_pe.byRva<void>(exportEntry.forwarderString), unbiasedOrdinal + ordinalBase(), ExportType::forwarder);
                                      ^~~~
Pe/Pe.hpp:1690:38: error: expected ')' before 'void'
Pe/Pe.hpp: In member function 'const void* Pe::Relocs<<anonymous> >::PageEntry::page() const':
Pe/Pe.hpp:1774:40: error: expected primary-expression before 'void'
             return m_relocs.pe().byRva<void>(m_entry->VirtualAddress);
                                        ^~~~
Pe/Pe.hpp:1774:40: error: expected ';' before 'void'
Pe/Pe.hpp:1774:44: error: expected unqualified-id before '>' token
             return m_relocs.pe().byRva<void>(m_entry->VirtualAddress);
                                            ^
Pe/Pe.hpp: In constructor 'Pe::Relocs<<anonymous> >::Relocs(const Pe::Pe<arch>&)':
Pe/Pe.hpp:1823:46: error: expected primary-expression before '>' token
         , m_descriptor(pe.directory<DirRelocs>())
                                              ^
Pe/Pe.hpp:1823:48: error: expected primary-expression before ')' token
         , m_descriptor(pe.directory<DirRelocs>())
                                                ^
Pe/Pe.hpp: In constructor 'Pe::Exceptions<<anonymous> >::Exceptions(const Pe::Pe<arch>&)':
Pe/Pe.hpp:1899:50: error: expected primary-expression before '>' token
         : m_descriptor(pe.directory<DirExceptions>())
                                                  ^
Pe/Pe.hpp:1899:52: error: expected primary-expression before ')' token
         : m_descriptor(pe.directory<DirExceptions>())
                                                    ^
Pe/Pe.hpp: In member function 'void (__attribute__((__stdcall__)) * Pe::Tls<<anonymous> >::CallbackEntry::callback() const)(PVOID, DWORD, PVOID)':
Pe/Pe.hpp:1946:92: error: expected primary-expression before 'void'
             return static_cast<typename GenericTypes::FnImageTlsCallback>(m_tls.pe().byRva<void>(rva));
                                                                                            ^~~~
Pe/Pe.hpp:1946:92: error: expected ')' before 'void'
Pe/Pe.hpp:1946:92: error: expected ';' before 'void'
Pe/Pe.hpp:1946:96: error: expected unqualified-id before '>' token
             return static_cast<typename GenericTypes::FnImageTlsCallback>(m_tls.pe().byRva<void>(rva));
                                                                                                ^
Pe/Pe.hpp: In constructor 'Pe::Tls<<anonymous> >::Tls(const Pe::Pe<arch>&)':
Pe/Pe.hpp:1975:47: error: expected primary-expression before '>' token
         , m_directory(pe.directory<DirTls<arch>>())
                                               ^~
Pe/Pe.hpp:1975:50: error: expected primary-expression before ')' token
         , m_directory(pe.directory<DirTls<arch>>())
                                                  ^
Pe/Pe.hpp: In member function 'void (__attribute__((__stdcall__)) * const* Pe::Tls<<anonymous> >::callbacks() const)(PVOID, DWORD, PVOID)':
Pe/Pe.hpp:2005:72: error: expected '(' before '>' token
             return m_pe.byRva<typename GenericTypes::FnImageTlsCallback>(static_cast<Rva>(m_directory.ptr->AddressOfCallBacks - m_pe.imageBase()));
                                                                        ^
Pe/Pe.hpp: In constructor 'Pe::Debug<<anonymous> >::Debug(const Pe::Pe<arch>&)':
Pe/Pe.hpp:2124:45: error: expected primary-expression before '>' token
         , m_descriptor(pe.directory<DirDebug>())
                                             ^
Pe/Pe.hpp:2124:47: error: expected primary-expression before ')' token
         , m_descriptor(pe.directory<DirDebug>())
                                               ^
Pe/Pe.hpp: In member function 'const Pe::CodeView::DebugInfo* Pe::Debug<<anonymous> >::findPdbDebugInfo() const':
Pe/Pe.hpp:2167:72: error: expected primary-expression before '>' token
             const auto* const codeView = m_pe.byRva<CodeView::DebugInfo>(entry.debugEntry()->PointerToRawData);
                                                                        ^

I'm targeting for ANSI support.

Enable Parallel download

Downloading multiple files at the same time

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.

hoshimin / formatpe Goto Github PK

formatpe's Introduction

♟️ formatPE²

A bunch of PE and PDB parsers written in C++

💾 Pe:

The library supports enumeration of:

Features:

Usage:

🗜️ Pdb:

It supports:

Usage:

Important!

🏗️ Build with CMake:

formatpe's People

Contributors

Stargazers

Watchers

Forkers

formatpe's Issues

Recommend Projects

Recommend Topics

Recommend Org