Implimented xex timestamp logging & ldr_data field. Allows custom plugins to access a modules timedatestamp via LDR_DATA_TABLE_ENTRY.

This commit is contained in:
Byrom90 2023-08-07 21:49:41 +01:00 committed by Radosław Gliński
parent 44fc8f9412
commit f743cf1e65
3 changed files with 39 additions and 1 deletions

View File

@ -524,7 +524,32 @@ void UserModule::Dump() {
}
} break;
case XEX_HEADER_CHECKSUM_TIMESTAMP: {
sb.Append(" XEX_HEADER_CHECKSUM_TIMESTAMP (TODO):\n");
// TODO(Byrom): Relocate parts of this to somewhere more suitable
// (if possible) to leave only the log printing portion.
auto opt_checksum_timedatestamp =
reinterpret_cast<const xex2_opt_checksum_timedatestamp*>(
opt_header_ptr);
// Store the checksum & timedatestamp just in case we need them later.
mod_checksum_ = opt_checksum_timedatestamp->checksum;
time_date_stamp_ = opt_checksum_timedatestamp->timedatestamp;
// Update the ldr data with the timedatestamp only.
// The checksum field is being used to store the kernel object handle
// (xmodule.cc XModule::XModule)
auto ldr_data =
memory()->TranslateVirtual<X_LDR_DATA_TABLE_ENTRY*>(hmodule_ptr_);
ldr_data->time_date_stamp = time_date_stamp_;
time_t time = (time_t)opt_checksum_timedatestamp->timedatestamp;
struct tm* timeinfo = localtime(&time);
sb.AppendFormat(" XEX_HEADER_CHECKSUM_TIMESTAMP:\n");
sb.AppendFormat(
" Checksum : {:08X}\n",
static_cast<uint32_t>(opt_checksum_timedatestamp->checksum));
sb.AppendFormat(
" Time Stamp: {:08X} - {}",
static_cast<uint32_t>(opt_checksum_timedatestamp->timedatestamp),
asctime(timeinfo));
} break;
case XEX_HEADER_ORIGINAL_PE_NAME: {
auto opt_pe_name =

View File

@ -69,6 +69,9 @@ class UserModule : public XModule {
uint32_t stack_size() const { return stack_size_; }
uint32_t workspace_size() const { return workspace_size_; }
uint32_t mod_checksum() const { return mod_checksum_; }
uint32_t time_date_stamp() const { return time_date_stamp_; }
X_STATUS LoadFromFile(const std::string_view path);
X_STATUS LoadFromMemory(const void* addr, const size_t length);
X_STATUS LoadContinue();
@ -115,6 +118,9 @@ class UserModule : public XModule {
uint32_t entry_point_ = 0;
uint32_t stack_size_ = 0;
uint32_t workspace_size_ = 384*1024;
uint32_t mod_checksum_ = 0;
uint32_t time_date_stamp_ = 0;
};
} // namespace kernel

View File

@ -390,6 +390,13 @@ struct xex2_opt_bound_path {
char path[1];
};
// Also known as XEX_VITAL_STATS
struct xex2_opt_checksum_timedatestamp {
xe::be<uint32_t> checksum; // 0x0 sz:0x4
xe::be<uint32_t> timedatestamp; // 0x4 sz:0x4
}; // size 8
static_assert_size(xex2_opt_checksum_timedatestamp, 0x8);
struct xex2_opt_static_library {
char name[8]; // 0x0
xe::be<uint16_t> version_major; // 0x8