From 5188bc5581eca43e6a6889dda844e2d8926cd6cd Mon Sep 17 00:00:00 2001 From: unspeaker Date: Fri, 21 Feb 2025 22:32:27 +0200 Subject: [PATCH] count imports --- crates/vestal/src/main.rs | 29 ++++++++++++++--------------- 1 file changed, 14 insertions(+), 15 deletions(-) diff --git a/crates/vestal/src/main.rs b/crates/vestal/src/main.rs index e78e285..9abd4a0 100644 --- a/crates/vestal/src/main.rs +++ b/crates/vestal/src/main.rs @@ -81,7 +81,7 @@ impl Dll { &mut calls_by_target, false )?; - let imports = Self::imports(&pe); + let (modules_count, methods_count) = Self::imports(&pe)?; let dll = Arc::new(Self { name: name.clone(), path: path.clone(), @@ -92,6 +92,8 @@ impl Dll { calls_by_source, calls_by_target, }); + println!(" (deps-modules {modules_count})"); + println!(" (deps-methods {methods_count})"); println!(" (call-sites {calls})"); for (call, sites) in dll.calls_by_target.iter() { println!(" (0x{call:08x}\n {:?})", sites.iter() @@ -103,27 +105,23 @@ impl Dll { } fn imports (pe: &VecPE) -> Usually<(usize, usize)> { let directory = ImportDirectory::parse(pe)?; + let mut total = 0; for descriptor in directory.descriptors { - let dep = descriptor.get_name(pe)?.as_str()?; + let dep = descriptor.get_name(pe)?.as_str()?.to_lowercase(); let imp = descriptor.get_imports(pe)?; let iat = descriptor.get_first_thunk(pe)?; let ilt = descriptor.get_original_first_thunk(pe)?; let lut = descriptor.get_lookup_thunks(pe)?; let mut imports = Vec::new(); + let unwrap_thunk = |thunk: &Thunk, name|match thunk { + Thunk::Thunk32(t) => panic!("32 bit {name}"), + Thunk::Thunk64(t) => t.0 + }; for (index, (import, thunk, orig, lookup)) in izip!( imp, - iat.iter().map(|thunk|format!("0x{:08x}", match thunk { - Thunk::Thunk32(t) => panic!("32 bit thunk"), - Thunk::Thunk64(t) => t.0 - })), - ilt.iter().map(|thunk|format!("0x{:08x}", match thunk { - Thunk::Thunk32(t) => panic!("32 bit original thunk"), - Thunk::Thunk64(t) => t.0 - })), - lut.iter().map(|thunk|format!("0x{:08x}", match thunk { - Thunk::Thunk32(t) => panic!("32 bit original thunk"), - Thunk::Thunk64(t) => t.0 - })), + iat.iter().map(|thunk|format!("0x{:08x}", unwrap_thunk(thunk, "IAT thunk"))), + ilt.iter().map(|thunk|format!("0x{:08x}", unwrap_thunk(thunk, "ILT (orig) thunk"))), + lut.iter().map(|thunk|format!("0x{:08x}", unwrap_thunk(thunk, "lookup thunk"))), ).enumerate() { let call_via = descriptor.first_thunk.0 + index as u32 * 8; let name = match import { @@ -140,6 +138,7 @@ impl Dll { }; println!(" ({index:5} 0x{call_via:08x} {dep:>20} {name}"); imports.push((thunk, orig, import)); + total += 1; //if let Some(existing) = self.addr_to_import.get(&call_via) { //panic!("addr space overlap at 0x{call_via:x}: {}::{} vs {}::{}", //existing.0, @@ -150,7 +149,7 @@ impl Dll { //self.addr_to_import.insert(call_via, (dep.to_string(), name)); } } - Ok((0, 0)) + Ok((0, total)) } fn calls ( name: &Arc,