Skip to content

Instantly share code, notes, and snippets.

@kohnakagawa

kohnakagawa/patch_2020_2021.diff

Last active June 1, 2021 07:30
Show Gist options
  • Save kohnakagawa/4e36f1f3889441c55965de79c995f57b to your computer and use it in GitHub Desktop.
Save kohnakagawa/4e36f1f3889441c55965de79c995f57b to your computer and use it in GitHub Desktop.
Download ZIP
Raw
patch_2020_2021.diff
diff --git a/src/PE/Binary.cpp b/src/PE/Binary.cpp
index 0884c625..34e881bf 100644
--- a/src/PE/Binary.cpp
+++ b/src/PE/Binary.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -20,18 +20,33 @@
#include <numeric>
#include <limits>
-#include "LIEF/logging++.hpp"
+#include "logging.hpp"
+#include "hash_stream.hpp"
-#include "LIEF/PE/hash.hpp"
#include "LIEF/exception.hpp"
#include "LIEF/utils.hpp"
+#include "LIEF/BinaryStream/VectorStream.hpp"
+#include "LIEF/iostream.hpp"
+
+#include "LIEF/Abstract/Relocation.hpp"
+#include "LIEF/PE/hash.hpp"
+#include "LIEF/PE/Structures.hpp"
#include "LIEF/PE/Binary.hpp"
#include "LIEF/PE/Builder.hpp"
#include "LIEF/PE/utils.hpp"
#include "LIEF/PE/EnumToString.hpp"
#include "LIEF/PE/ResourceDirectory.hpp"
#include "LIEF/PE/ResourceData.hpp"
+#include "LIEF/PE/DataDirectory.hpp"
+#include "LIEF/PE/Section.hpp"
+#include "LIEF/PE/Relocation.hpp"
+#include "LIEF/PE/RelocationEntry.hpp"
+#include "LIEF/PE/ImportEntry.hpp"
+#include "LIEF/PE/ExportEntry.hpp"
+#include "LIEF/PE/ResourcesManager.hpp"
+#include "LIEF/PE/Symbol.hpp"
+#include "LIEF/PE/LoadConfigurations/LoadConfiguration.hpp"
namespace LIEF {
namespace PE {
@@ -85,7 +100,6 @@ Binary::Binary(void) :
has_rich_header_{false},
has_tls_{false},
has_imports_{false},
- has_signature_{false},
has_exports_{false},
has_resources_{false},
has_exceptions_{false},
@@ -212,10 +226,37 @@ uint64_t Binary::va_to_offset(uint64_t VA) {
return this->rva_to_offset(rva);
}
+uint64_t Binary::imagebase(void) const {
+ return this->optional_header().imagebase();
+}
+
+uint64_t Binary::offset_to_virtual_address(uint64_t offset, uint64_t slide) const {
+ const auto it_section = std::find_if(
+ std::begin(this->sections_), std::end(this->sections_),
+ [offset] (const Section* section)
+ {
+ return (offset >= section->offset() and
+ offset < (section->offset() + section->sizeof_raw_data()));
+ });
+
+ if (it_section == std::end(sections_)) {
+ if (slide > 0) {
+ return slide + offset;
+ }
+ return offset;
+ }
+ const Section* section = *it_section;
+ const uint64_t base_rva = section->virtual_address() - section->offset();
+ if (slide > 0) {
+ return slide + base_rva + offset;
+ }
+
+ return base_rva + offset;
+}
+
uint64_t Binary::rva_to_offset(uint64_t RVA) {
- auto&& it_section = std::find_if(
- std::begin(this->sections_),
- std::end(this->sections_),
+ const auto it_section = std::find_if(
+ std::begin(this->sections_), std::end(this->sections_),
[RVA] (const Section* section)
{
if (section == nullptr) {
@@ -226,10 +267,11 @@ uint64_t Binary::rva_to_offset(uint64_t RVA) {
});
if (it_section == std::end(sections_)) {
- // If not found withint a section,
+ // If not found within a section,
// we assume that rva == offset
- return static_cast<uint32_t>(RVA);
+ return RVA;
}
+ LIEF_TRACE("rva_to_offset(0x{:x}): {}", RVA, (*it_section)->name());
// rva - virtual_address + pointer_to_raw_data
uint32_t section_alignment = this->optional_header().section_alignment();
@@ -333,8 +375,8 @@ bool Binary::has_imports(void) const {
return this->has_imports_;
}
-bool Binary::has_signature(void) const {
- return this->has_signature_;
+bool Binary::has_signatures(void) const {
+ return not this->signatures_.empty();
}
bool Binary::has_exports(void) const {
@@ -346,7 +388,7 @@ bool Binary::has_resources(void) const {
}
bool Binary::has_exceptions(void) const {
- return this->has(DATA_DIRECTORY::EXPORT_TABLE);
+ return this->has(DATA_DIRECTORY::EXCEPTION_TABLE);
//return this->has_exceptions_;
}
@@ -525,7 +567,7 @@ void Binary::remove_section(const std::string& name, bool clear) {
});
if (it_section == std::end(this->sections_)) {
- LOG(ERROR) << "Unable to find section: '" << name << "'" << std::endl;
+ LIEF_ERR("Unable to find section: '{}'", name);
return;
}
@@ -541,7 +583,7 @@ void Binary::remove(const Section& section, bool clear) {
return *s == section;
});
if (it_section == std::end(this->sections_)) {
- LOG(ERROR) << "Unable to find section: '" << section.name() << "'" << std::endl;
+ LIEF_ERR("Unable to find section: '{}'", section.name());
return;
}
@@ -573,8 +615,8 @@ void Binary::remove(const Section& section, bool clear) {
void Binary::make_space_for_new_section(void) {
const uint32_t shift = align(sizeof(pe_section), this->optional_header().file_alignment());
- VLOG(VDEBUG) << "Making space for a new section header";
- VLOG(VDEBUG) << "Shifting all sections by " << std::hex << std::showbase << shift;
+ LIEF_DEBUG("Making space for a new section header");
+ LIEF_DEBUG(" -> Shifting all sections by 0x{:x}", shift);
// Shift offset of the section content by the size of
// a section header aligned on "file alignment"
@@ -621,7 +663,7 @@ Section& Binary::add_section(const Section& section, PE_SECTION_TYPES type) {
return std::max<uint64_t>(s->pointerto_raw_data() + s->sizeof_raw_data(), offset);
}), this->optional_header().file_alignment());
- VLOG(VDEBUG) << "New section offset: 0x" << std::hex << new_section_offset;
+ LIEF_DEBUG("New section offset: 0x{:x}", new_section_offset);
// Compute new section Virtual address
@@ -632,7 +674,7 @@ Section& Binary::add_section(const Section& section, PE_SECTION_TYPES type) {
return std::max<uint64_t>(s->virtual_address() + s->virtual_size(), va);
}), this->optional_header().section_alignment());
- VLOG(VDEBUG) << "New section va: 0x" << std::hex << new_section_va;
+ LIEF_DEBUG("New section VA: 0x{:x}", new_section_va);
new_section->add_type(type);
@@ -821,7 +863,7 @@ uint32_t Binary::predict_function_rva(const std::string& library, const std::str
});
if (it_import == std::end(this->imports_)) {
- LOG(ERROR) << "Unable to find library '" << library << "'";
+ LIEF_ERR("Unable to find library {}", library);
return 0;
}
@@ -837,12 +879,12 @@ uint32_t Binary::predict_function_rva(const std::string& library, const std::str
});
if (nb_functions == 0) {
- LOG(ERROR) << "Unable to find the function '" << function << "' in '" << library + "'.";
+ LIEF_ERR("Unable to find the function '{}' in '{}'", function, library);
return 0;
}
if (nb_functions > 1) {
- LOG(ERROR) << "'" << function << "' is defined " << std::to_string(nb_functions) << " in '" << library << "'.";
+ LIEF_ERR("{} is defined #{:d} times in {}", function, nb_functions, library);
return 0;
}
@@ -997,8 +1039,239 @@ const debug_entries_t& Binary::debug(void) const {
//
/////////////////////
-const Signature& Binary::signature(void) const {
- return this->signature_;
+it_const_signatures Binary::signatures(void) const {
+ return this->signatures_;
+}
+
+std::vector<uint8_t> Binary::authentihash(ALGORITHMS algo) const {
+ static const std::map<ALGORITHMS, hashstream::HASH> HMAP = {
+ {ALGORITHMS::MD5, hashstream::HASH::MD5},
+ {ALGORITHMS::SHA_1, hashstream::HASH::SHA1},
+ {ALGORITHMS::SHA_256, hashstream::HASH::SHA256},
+ {ALGORITHMS::SHA_384, hashstream::HASH::SHA384},
+ {ALGORITHMS::SHA_512, hashstream::HASH::SHA512},
+ };
+ auto it_hash = HMAP.find(algo);
+ if (it_hash == std::end(HMAP)) {
+ LIEF_WARN("Unsupported hash algorithm: {}", to_string(algo));
+ return {};
+ }
+ const size_t sizeof_ptr = this->type_ == PE_TYPE::PE32 ? sizeof(uint32_t) : sizeof(uint64_t);
+ const hashstream::HASH hash_type = it_hash->second;
+ hashstream ios(hash_type);
+ //vector_iostream ios;
+ ios // Hash dos header
+ .write(this->dos_header_.magic())
+ .write(this->dos_header_.used_bytes_in_the_last_page())
+ .write(this->dos_header_.file_size_in_pages())
+ .write(this->dos_header_.numberof_relocation())
+ .write(this->dos_header_.header_size_in_paragraphs())
+ .write(this->dos_header_.minimum_extra_paragraphs())
+ .write(this->dos_header_.maximum_extra_paragraphs())
+ .write(this->dos_header_.initial_relative_ss())
+ .write(this->dos_header_.initial_sp())
+ .write(this->dos_header_.checksum())
+ .write(this->dos_header_.initial_ip())
+ .write(this->dos_header_.initial_relative_cs())
+ .write(this->dos_header_.addressof_relocation_table())
+ .write(this->dos_header_.overlay_number())
+ .write(this->dos_header_.reserved())
+ .write(this->dos_header_.oem_id())
+ .write(this->dos_header_.oem_info())
+ .write(this->dos_header_.reserved2())
+ .write(this->dos_header_.addressof_new_exeheader())
+ .write(this->dos_stub_);
+
+ ios // Hash PE Header
+ .write(this->header_.signature())
+ .write(static_cast<uint16_t>(this->header_.machine()))
+ .write(this->header_.numberof_sections())
+ .write(this->header_.time_date_stamp())
+ .write(this->header_.pointerto_symbol_table())
+ .write(this->header_.numberof_symbols())
+ .write(this->header_.sizeof_optional_header())
+ .write(static_cast<uint16_t>(this->header_.characteristics()));
+
+ ios // Hash OptionalHeader
+ .write(static_cast<uint16_t>(this->optional_header_.magic()))
+ .write(this->optional_header_.major_linker_version())
+ .write(this->optional_header_.minor_linker_version())
+ .write(this->optional_header_.sizeof_code())
+ .write(this->optional_header_.sizeof_initialized_data())
+ .write(this->optional_header_.sizeof_uninitialized_data())
+ .write(this->optional_header_.addressof_entrypoint())
+ .write(this->optional_header_.baseof_code());
+
+ if (this->type_ == PE_TYPE::PE32) {
+ ios.write(this->optional_header_.baseof_data());
+ }
+ ios // Continuation of optional header
+ .write_sized_int(this->optional_header_.imagebase(), sizeof_ptr)
+ .write(this->optional_header_.section_alignment())
+ .write(this->optional_header_.file_alignment())
+ .write(this->optional_header_.major_operating_system_version())
+ .write(this->optional_header_.minor_operating_system_version())
+ .write(this->optional_header_.major_image_version())
+ .write(this->optional_header_.minor_image_version())
+ .write(this->optional_header_.major_subsystem_version())
+ .write(this->optional_header_.minor_subsystem_version())
+ .write(this->optional_header_.win32_version_value())
+ .write(this->optional_header_.sizeof_image())
+ .write(this->optional_header_.sizeof_headers())
+ // this->optional_header_.checksum()) is not a part of the hash
+ .write(static_cast<uint16_t>(this->optional_header_.subsystem()))
+ .write(static_cast<uint16_t>(this->optional_header_.dll_characteristics()))
+ .write_sized_int(this->optional_header_.sizeof_stack_reserve(), sizeof_ptr)
+ .write_sized_int(this->optional_header_.sizeof_stack_commit(), sizeof_ptr)
+ .write_sized_int(this->optional_header_.sizeof_heap_reserve(), sizeof_ptr)
+ .write_sized_int(this->optional_header_.sizeof_heap_commit(), sizeof_ptr)
+ .write(this->optional_header_.loader_flags())
+ .write(this->optional_header_.numberof_rva_and_size());
+
+ for (const DataDirectory* dir : this->data_directories_) {
+ if (dir->type() == DATA_DIRECTORY::CERTIFICATE_TABLE) {
+ continue;
+ }
+ ios
+ .write(dir->RVA())
+ .write(dir->size());
+ }
+
+ for (const Section* sec : this->sections_) {
+ std::array<char, 8> name = {0};
+ const std::string& sec_name = sec->fullname();
+ uint32_t name_length = std::min<uint32_t>(sec_name.size() + 1, sizeof(name));
+ std::copy(sec_name.c_str(), sec_name.c_str() + name_length, std::begin(name));
+ ios
+ .write(name)
+ .write(sec->virtual_size())
+ .write<uint32_t>(sec->virtual_address())
+ .write(sec->sizeof_raw_data())
+ .write(sec->pointerto_raw_data())
+ .write(sec->pointerto_relocation())
+ .write(sec->pointerto_line_numbers())
+ .write(sec->numberof_relocations())
+ .write(sec->numberof_line_numbers())
+ .write(static_cast<uint32_t>(sec->characteristics()));
+ }
+ //LIEF_DEBUG("Section padding at 0x{:x}", ios.tellp());
+ ios.write(this->section_offset_padding_);
+
+ std::vector<Section*> sections = this->sections_;
+
+ // Sort by file offset
+ std::sort(
+ std::begin(sections), std::end(sections),
+ [] (const Section* lhs, const Section* rhs) {
+ return lhs->pointerto_raw_data() < rhs->pointerto_raw_data();
+ });
+
+ uint64_t position = 0;
+ for (const Section* sec : sections) {
+ if (sec->sizeof_raw_data() == 0) {
+ continue;
+ }
+ const std::vector<uint8_t>& pad = sec->padding();
+ const std::vector<uint8_t>& content = sec->content();
+ LIEF_DEBUG("Authentihash: Append section {:<8}: [0x{:04x}, 0x{:04x}] + [0x{:04x}] = [0x{:04x}, 0x{:04x}]",
+ sec->name(),
+ sec->offset(), sec->offset() + content.size(), pad.size(),
+ sec->offset(), sec->offset() + content.size() + pad.size());
+ if (/* overlapping */ sec->offset() < position) {
+ // Trunc the beginning of the overlap
+ if (position <= sec->offset() + content.size()) {
+ const uint64_t start_p = position - sec->offset();
+ const uint64_t size = content.size() - start_p;
+ ios
+ .write(content.data() + start_p, size)
+ .write(pad);
+ } else {
+ LIEF_WARN("Overlapping in the padding area");
+ }
+ } else {
+ ios
+ .write(content)
+ .write(pad);
+ }
+ position = sec->offset() + content.size() + pad.size();
+ }
+ if (this->overlay_.size() > 0) {
+ const DataDirectory& cert_dir = this->data_directory(DATA_DIRECTORY::CERTIFICATE_TABLE);
+ LIEF_DEBUG("Add overlay and omit 0x{:08x} - 0x{:08x}", cert_dir.RVA(), cert_dir.RVA() + cert_dir.size());
+ if (cert_dir.RVA() > 0 and cert_dir.size() > 0 and cert_dir.RVA() >= this->overlay_offset_) {
+ const uint64_t start_cert_offset = cert_dir.RVA() - this->overlay_offset_;
+ const uint64_t end_cert_offset = start_cert_offset + cert_dir.size();
+ if (end_cert_offset <= this->overlay_.size()) {
+ LIEF_DEBUG("Add [0x{:x}, 0x{:x}]", this->overlay_offset_, this->overlay_offset_ + start_cert_offset);
+ LIEF_DEBUG("Add [0x{:x}, 0x{:x}]",
+ this->overlay_offset_ + end_cert_offset,
+ this->overlay_offset_ + this->overlay_.size() - end_cert_offset);
+ ios
+ .write(this->overlay_.data(), start_cert_offset)
+ .write(this->overlay_.data() + end_cert_offset, this->overlay_.size() - end_cert_offset);
+ } else {
+ ios.write(this->overlay());
+ }
+ } else {
+ ios.write(this->overlay());
+ }
+ }
+ // When something gets wrong with the hash:
+ // std::vector<uint8_t> out = ios.raw();
+ // std::ofstream output_file{"/tmp/hash.blob", std::ios::out | std::ios::binary | std::ios::trunc};
+ // if (output_file) {
+ // std::copy(
+ // std::begin(out),
+ // std::end(out),
+ // std::ostreambuf_iterator<char>(output_file));
+ // }
+ // std::vector<uint8_t> hash = hashstream(hash_type).write(out).raw();
+
+ std::vector<uint8_t> hash = ios.raw();
+ LIEF_DEBUG("{}", hex_dump(hash));
+ return hash;
+}
+
+Signature::VERIFICATION_FLAGS Binary::verify_signature(Signature::VERIFICATION_CHECKS checks) const {
+ if (not this->has_signatures()) {
+ return Signature::VERIFICATION_FLAGS::NO_SIGNATURE;
+ }
+
+ Signature::VERIFICATION_FLAGS flags = Signature::VERIFICATION_FLAGS::OK;
+
+ for (size_t i = 0; i < this->signatures_.size(); ++i) {
+ const Signature& sig = this->signatures_[i];
+ flags |= this->verify_signature(sig, checks);
+ if (flags != Signature::VERIFICATION_FLAGS::OK) {
+ LIEF_INFO("Verification failed for signature #{:d} (0b{:b})", i, static_cast<uintptr_t>(flags));
+ break;
+ }
+ }
+ return flags;
+}
+
+Signature::VERIFICATION_FLAGS Binary::verify_signature(const Signature& sig, Signature::VERIFICATION_CHECKS checks) const {
+ Signature::VERIFICATION_FLAGS flags = Signature::VERIFICATION_FLAGS::OK;
+ if (not is_true(checks & Signature::VERIFICATION_CHECKS::HASH_ONLY)) {
+ const Signature::VERIFICATION_FLAGS value = sig.check(checks);
+ if (value != Signature::VERIFICATION_FLAGS::OK) {
+ LIEF_INFO("Bad signature (0b{:b})", static_cast<uintptr_t>(value));
+ flags |= value;
+ }
+ }
+
+ // Check that the authentihash matches Content Info's digest
+ const std::vector<uint8_t>& authhash = this->authentihash(sig.digest_algorithm());
+ const std::vector<uint8_t>& chash = sig.content_info().digest();
+ if (authhash != chash) {
+ LIEF_INFO("Authentihash and Content info's digest does not match:\n {}\n {}",
+ hex_dump(authhash), hex_dump(chash));
+ flags |= Signature::VERIFICATION_FLAGS::BAD_DIGEST;
+ }
+ if (flags != Signature::VERIFICATION_FLAGS::OK) {
+ flags |= Signature::VERIFICATION_FLAGS::BAD_SIGNATURE;
+ }
+return flags;
}
@@ -1093,7 +1366,7 @@ void Binary::hook_function(const std::string& function, uint64_t address) {
}
}
- LOG(WARNING) << "Unable to find library associated with function '" << function << "'";
+ LIEF_WARN("Unable to find library associated with function '{}'", function);
}
@@ -1131,7 +1404,7 @@ void Binary::patch_address(uint64_t address, const std::vector<uint8_t>& patch_v
void Binary::patch_address(uint64_t address, uint64_t patch_value, size_t size, LIEF::Binary::VA_TYPES addr_type) {
if (size > sizeof(patch_value)) {
- LOG(ERROR) << "Invalid size (" << std::to_string(size) << ")";
+ LIEF_ERR("Invalid size (0x{:x})", size);
return;
}
@@ -1306,7 +1579,7 @@ LIEF::Binary::functions_t Binary::exception_functions(void) const {
for (size_t i = 0; i < nb_entries; ++i) {
if (not vs.can_read<pe_exception_entry_x64>()) {
- LOG(ERROR) << "Corrupted entry at " << std::dec << i;
+ LIEF_ERR("Corrupted entry #{:02d}", i);
break;
}
const pe_exception_entry_x64& entry = vs.read<pe_exception_entry_x64>();
@@ -1393,10 +1666,12 @@ std::ostream& Binary::print(std::ostream& os) const {
}
- if (this->has_signature()) {
- os << "Signature" << std::endl;
- os << "=========" << std::endl;
- os << this->signature() << std::endl;
+ if (this->has_signatures()) {
+ os << "Signatures" << std::endl;
+ os << "==========" << std::endl;
+ for (const Signature& sig : this->signatures_) {
+ os << sig << std::endl;
+ }
os << std::endl;
}
diff --git a/src/PE/Builder.cpp b/src/PE/Builder.cpp
index eeb9b906..894f8244 100644
--- a/src/PE/Builder.cpp
+++ b/src/PE/Builder.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -19,17 +19,26 @@
#include <iterator>
#include <numeric>
-#include "LIEF/logging++.hpp"
+#include "logging.hpp"
-#include "utf8.h"
+#include "LIEF/third-party/utfcpp/utf8.h"
#include "LIEF/exception.hpp"
#include "LIEF/PE/Builder.hpp"
-#include "Builder.tcc"
#include "LIEF/PE/ResourceData.hpp"
#include "LIEF/PE/utils.hpp"
+#include "LIEF/PE/ImportEntry.hpp"
+#include "LIEF/PE/Import.hpp"
+#include "LIEF/PE/Section.hpp"
+#include "LIEF/PE/ResourceDirectory.hpp"
+#include "LIEF/PE/DataDirectory.hpp"
+#include "LIEF/PE/Relocation.hpp"
+#include "LIEF/PE/RelocationEntry.hpp"
+#include "LIEF/PE/Symbol.hpp"
+#include "LIEF/PE/Export.hpp"
+#include "LIEF/PE/ExportEntry.hpp"
-
+#include "Builder.tcc"
namespace LIEF {
namespace PE {
@@ -98,10 +107,10 @@ void Builder::write(const std::string& filename) const {
void Builder::build(void) {
- VLOG(VDEBUG) << "Rebuilding" << std::endl;
+ LIEF_DEBUG("Build process started");
if (this->binary_->has_tls() and this->build_tls_) {
- VLOG(VDEBUG) << "[+] Rebuilding TLS" << std::endl;
+ LIEF_DEBUG("[+] TLS");
if (this->binary_->type() == PE_TYPE::PE32) {
this->build_tls<PE32>();
} else {
@@ -110,12 +119,12 @@ void Builder::build(void) {
}
if (this->binary_->has_relocations() and this->build_relocations_) {
- VLOG(VDEBUG) << "[+] Rebuilding relocations" << std::endl;
+ LIEF_DEBUG("[+] Relocations");
this->build_relocation();
}
if (this->binary_->has_resources() and this->binary_->resources_ != nullptr and this->build_resources_) {
- VLOG(VDEBUG) << "[+] Rebuilding resources" << std::endl;
+ LIEF_DEBUG("[+] Resources");
try {
this->build_resources();
} catch (not_found&) {
@@ -123,7 +132,7 @@ void Builder::build(void) {
}
if (this->binary_->has_imports() and this->build_imports_) {
- VLOG(VDEBUG) << "[+] Rebuilding Import" << std::endl;
+ LIEF_DEBUG("[+] Imports");
if (this->binary_->type() == PE_TYPE::PE32) {
this->build_import_table<PE32>();
} else {
@@ -131,7 +140,7 @@ void Builder::build(void) {
}
}
- VLOG(VDEBUG) << "[+] Rebuilding headers" << std::endl;
+ LIEF_DEBUG("[+] Headers");
*this << this->binary_->dos_header()
<< this->binary_->header()
@@ -141,27 +150,22 @@ void Builder::build(void) {
*this << directory;
}
- DataDirectory last_one;
- last_one.RVA(0);
- last_one.size(0);
-
- *this << last_one;
-
- VLOG(VDEBUG) << "[+] Rebuilding sections" << std::endl;
+ LIEF_DEBUG("[+] Sections");
for (const Section& section : this->binary_->sections()) {
- VLOG(VDEBUG) << "Building section " << section.name();
+ LIEF_DEBUG(" -> {}", section.name());
*this << section;
}
- VLOG(VDEBUG) << "[+] Rebuilding symbols" << std::endl;
+ // LIEF_DEBUG("[+] symbols");
//this->build_symbols();
- VLOG(VDEBUG) << "[+] Rebuilding string table" << std::endl;
+ // LIEF_DEBUG("[+] string table");
//this->build_string_table();
if (this->binary_->overlay().size() > 0 and this->build_overlay_) {
+ LIEF_DEBUG("[+] Overlay");
this->build_overlay();
}
@@ -234,7 +238,6 @@ void Builder::build_relocation(void) {
// Build resources
//
void Builder::build_resources(void) {
- VLOG(VDEBUG) << "Building RSRC" << std::endl;
ResourceNode& node = this->binary_->resources();
//std::cout << ResourcesManager{this->binary_->resources_} << std::endl;
@@ -380,7 +383,6 @@ void Builder::construct_resources(
}
} else {
- //VLOG(VDEBUG) << "Building Data" << std::endl;
ResourceData *rsrc_data = dynamic_cast<ResourceData*>(&node);
pe_resource_data_entry data_header;
@@ -417,7 +419,6 @@ void Builder::build_string_table(void) {
}
void Builder::build_overlay(void) {
- VLOG(VDEBUG) << "Building overlay";
const uint64_t last_section_offset = std::accumulate(
std::begin(this->binary_->sections_),
@@ -426,8 +427,8 @@ void Builder::build_overlay(void) {
return std::max<uint64_t>(section->offset() + section->size(), offset);
});
- VLOG(VDEBUG) << "Overlay offset: 0x" << std::hex << last_section_offset;
- VLOG(VDEBUG) << "Overlay size: " << std::dec << this->binary_->overlay().size();
+ LIEF_DEBUG("Overlay offset: 0x{:x}", last_section_offset);
+ LIEF_DEBUG("Overlay size: 0x{:x}", this->binary_->overlay().size());
const size_t saved_offset = this->ios_.tellp();
this->ios_.seekp(last_section_offset);
@@ -437,37 +438,37 @@ void Builder::build_overlay(void) {
Builder& Builder::operator<<(const DosHeader& dos_header) {
- pe_dos_header dosHeader;
- dosHeader.Magic = static_cast<uint16_t>(dos_header.magic());
- dosHeader.UsedBytesInTheLastPage = static_cast<uint16_t>(dos_header.used_bytes_in_the_last_page());
- dosHeader.FileSizeInPages = static_cast<uint16_t>(dos_header.file_size_in_pages());
- dosHeader.NumberOfRelocationItems = static_cast<uint16_t>(dos_header.numberof_relocation());
- dosHeader.HeaderSizeInParagraphs = static_cast<uint16_t>(dos_header.header_size_in_paragraphs());
- dosHeader.MinimumExtraParagraphs = static_cast<uint16_t>(dos_header.minimum_extra_paragraphs());
- dosHeader.MaximumExtraParagraphs = static_cast<uint16_t>(dos_header.maximum_extra_paragraphs());
- dosHeader.InitialRelativeSS = static_cast<uint16_t>(dos_header.initial_relative_ss());
- dosHeader.InitialSP = static_cast<uint16_t>(dos_header.initial_sp());
- dosHeader.Checksum = static_cast<uint16_t>(dos_header.checksum());
- dosHeader.InitialIP = static_cast<uint16_t>(dos_header.initial_ip());
- dosHeader.InitialRelativeCS = static_cast<uint16_t>(dos_header.initial_relative_cs());
- dosHeader.AddressOfRelocationTable = static_cast<uint16_t>(dos_header.addressof_relocation_table());
- dosHeader.OverlayNumber = static_cast<uint16_t>(dos_header.overlay_number());
- dosHeader.OEMid = static_cast<uint16_t>(dos_header.oem_id());
- dosHeader.OEMinfo = static_cast<uint16_t>(dos_header.oem_info());
- dosHeader.AddressOfNewExeHeader = static_cast<uint16_t>(dos_header.addressof_new_exeheader());
+ pe_dos_header raw_dos_header;
+ raw_dos_header.Magic = static_cast<uint16_t>(dos_header.magic());
+ raw_dos_header.UsedBytesInTheLastPage = static_cast<uint16_t>(dos_header.used_bytes_in_the_last_page());
+ raw_dos_header.FileSizeInPages = static_cast<uint16_t>(dos_header.file_size_in_pages());
+ raw_dos_header.NumberOfRelocationItems = static_cast<uint16_t>(dos_header.numberof_relocation());
+ raw_dos_header.HeaderSizeInParagraphs = static_cast<uint16_t>(dos_header.header_size_in_paragraphs());
+ raw_dos_header.MinimumExtraParagraphs = static_cast<uint16_t>(dos_header.minimum_extra_paragraphs());
+ raw_dos_header.MaximumExtraParagraphs = static_cast<uint16_t>(dos_header.maximum_extra_paragraphs());
+ raw_dos_header.InitialRelativeSS = static_cast<uint16_t>(dos_header.initial_relative_ss());
+ raw_dos_header.InitialSP = static_cast<uint16_t>(dos_header.initial_sp());
+ raw_dos_header.Checksum = static_cast<uint16_t>(dos_header.checksum());
+ raw_dos_header.InitialIP = static_cast<uint16_t>(dos_header.initial_ip());
+ raw_dos_header.InitialRelativeCS = static_cast<uint16_t>(dos_header.initial_relative_cs());
+ raw_dos_header.AddressOfRelocationTable = static_cast<uint16_t>(dos_header.addressof_relocation_table());
+ raw_dos_header.OverlayNumber = static_cast<uint16_t>(dos_header.overlay_number());
+ raw_dos_header.OEMid = static_cast<uint16_t>(dos_header.oem_id());
+ raw_dos_header.OEMinfo = static_cast<uint16_t>(dos_header.oem_info());
+ raw_dos_header.AddressOfNewExeHeader = static_cast<uint16_t>(dos_header.addressof_new_exeheader());
const DosHeader::reserved_t& reserved = dos_header.reserved();
const DosHeader::reserved2_t& reserved2 = dos_header.reserved2();
- std::copy(std::begin(reserved), std::end(reserved), std::begin(dosHeader.Reserved));
- std::copy(std::begin(reserved2), std::end(reserved2), std::begin(dosHeader.Reserved2));
+ std::copy(std::begin(reserved), std::end(reserved), std::begin(raw_dos_header.Reserved));
+ std::copy(std::begin(reserved2), std::end(reserved2), std::begin(raw_dos_header.Reserved2));
this->ios_.seekp(0);
- this->ios_.write(reinterpret_cast<const uint8_t*>(&dosHeader), sizeof(pe_dos_header));
+ this->ios_.write(reinterpret_cast<const uint8_t*>(&raw_dos_header), sizeof(pe_dos_header));
if (this->binary_->dos_stub().size() > 0 and this->build_dos_stub_) {
if (sizeof(pe_dos_header) + this->binary_->dos_stub().size() > dos_header.addressof_new_exeheader()) {
- LOG(WARNING) << "Inconsistent 'addressof_new_exeheader' (0x" << std::hex << dos_header.addressof_new_exeheader();
+ LIEF_WARN("Inconsistent 'addressof_new_exeheader': 0x{:x}", dos_header.addressof_new_exeheader());
}
this->ios_.write(this->binary_->dos_stub());
}
@@ -477,7 +478,6 @@ Builder& Builder::operator<<(const DosHeader& dos_header) {
Builder& Builder::operator<<(const Header& bHeader) {
- VLOG(VDEBUG) << "Building standard Header" << std::endl;
// Standard Header
pe_header header;
header.Machine = static_cast<uint16_t>(bHeader.machine());
@@ -540,20 +540,20 @@ Builder& Builder::operator<<(const Section& section) {
header.NumberOfRelocations = static_cast<uint16_t>(section.numberof_relocations());
header.NumberOfLineNumbers = static_cast<uint16_t>(section.numberof_line_numbers());
header.Characteristics = static_cast<uint32_t>(section.characteristics());
- const char* name = section.name().c_str();
- uint32_t name_length = std::min<uint32_t>(section.name().size(), sizeof(header.Name));
- std::copy(name, name + name_length, std::begin(header.Name));
+ std::array<char, 8> name = {0};
+ const std::string& sec_name = section.fullname();
+ uint32_t name_length = std::min<uint32_t>(sec_name.size() + 1, sizeof(name));
+ std::copy(sec_name.c_str(), sec_name.c_str() + name_length, std::begin(header.Name));
+
this->ios_.write(reinterpret_cast<uint8_t*>(&header), sizeof(pe_section));
size_t pad_length = 0;
if (section.content().size() > section.size()) {
- LOG(WARNING) << section.name()
- << " content size is bigger than section's header size"
- << std::endl;
+ LIEF_WARN("{} content size is bigger than section's header size", section.name());
}
else {
- pad_length = section.size() - section.content().size();
+ pad_length = section.size() - section.content().size();
}
// Pad section content with zeroes
diff --git a/src/PE/Builder.tcc b/src/PE/Builder.tcc
index ca96fd97..65d9db7d 100644
--- a/src/PE/Builder.tcc
+++ b/src/PE/Builder.tcc
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -188,7 +188,7 @@ void Builder::build_import_table(void) {
uint32_t offsetIAT = this->binary_->rva_to_offset(import_header->ImportAddressTableRVA) - original_import.pointerto_raw_data();
if (offsetTable > import_content.size() or offsetIAT > import_content.size()) {
//TODO: Better handle
- LOG(ERROR) << "Can't patch" << std::endl;
+ LIEF_ERR("Can't patch");
break;
}
uint__ *lookupTable = reinterpret_cast<uint__*>(import_content.data() + offsetTable);
diff --git a/src/PE/CMakeLists.txt b/src/PE/CMakeLists.txt
index c791ec24..68cb0fa9 100644
--- a/src/PE/CMakeLists.txt
+++ b/src/PE/CMakeLists.txt
@@ -29,13 +29,6 @@ set(LIEF_PE_SRC
"${CMAKE_CURRENT_LIST_DIR}/RelocationEntry.cpp"
"${CMAKE_CURRENT_LIST_DIR}/DataDirectory.cpp"
"${CMAKE_CURRENT_LIST_DIR}/CodeIntegrity.cpp"
- "${CMAKE_CURRENT_LIST_DIR}/signature/AuthenticatedAttributes.cpp"
- "${CMAKE_CURRENT_LIST_DIR}/signature/ContentInfo.cpp"
- "${CMAKE_CURRENT_LIST_DIR}/signature/Signature.cpp"
- "${CMAKE_CURRENT_LIST_DIR}/signature/SignerInfo.cpp"
- "${CMAKE_CURRENT_LIST_DIR}/signature/x509.cpp"
- "${CMAKE_CURRENT_LIST_DIR}/signature/OIDToString.cpp"
- "${CMAKE_CURRENT_LIST_DIR}/signature/SignatureParser.cpp"
"${CMAKE_CURRENT_LIST_DIR}/Builder.tcc"
"${CMAKE_CURRENT_LIST_DIR}/Parser.tcc"
"${CMAKE_CURRENT_LIST_DIR}/resources/ResourceVersion.cpp"
@@ -47,6 +40,8 @@ set(LIEF_PE_SRC
"${CMAKE_CURRENT_LIST_DIR}/resources/ResourceStringFileInfo.cpp"
"${CMAKE_CURRENT_LIST_DIR}/resources/LangCodeItem.cpp"
"${CMAKE_CURRENT_LIST_DIR}/resources/ResourceIcon.cpp"
+ "${CMAKE_CURRENT_LIST_DIR}/resources/ResourceStringTable.cpp"
+ "${CMAKE_CURRENT_LIST_DIR}/resources/ResourceAccelerator.cpp"
)
set(LIEF_PE_LOAD_CONFIGURATION_SRC
@@ -123,7 +118,7 @@ set(LIEF_PE_INCLUDE_FILES
"${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/ResourceNode.hpp"
"${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/ResourcesManager.hpp"
"${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/Section.hpp"
- "${CMAKE_CURRENT_BINARY_DIR}/include/LIEF/PE/Structures.hpp" # Do we want to do this since it's autogenerated?
+ #"${CMAKE_CURRENT_BINARY_DIR}/include/LIEF/PE/Structures.hpp" # Do we want to do this since it's autogenerated?
"${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/Symbol.hpp"
"${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/TLS.hpp"
"${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/type_traits.hpp"
@@ -144,18 +139,6 @@ set(LIEF_PE_LOAD_CONFIGURATION_INCLUDE
"${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/LoadConfigurations/LoadConfigurationV7.hpp"
)
-set(LIEF_PE_SIG_INCLUDE_FILES
- "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/AuthenticatedAttributes.hpp"
- "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/ContentInfo.hpp"
- "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/OIDToString.hpp"
- "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/Signature.hpp"
- "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/SignatureParser.hpp"
- "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/SignerInfo.hpp"
- "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/types.hpp"
- "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/x509.hpp"
- "${CMAKE_CURRENT_SOURCE_DIR}/src/PE/signature/pkcs7.h"
-)
-
set(LIEF_PE_RESOURCES_INCLUDE_FILES
"${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/resources/ResourceVersion.hpp"
"${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/resources/ResourceDialog.hpp"
@@ -197,7 +180,6 @@ list(APPEND LIEF_PE_INCLUDE_FILES ${LIEF_PE_HASH_HDR})
source_group("Source Files\\PE" FILES ${LIEF_PE_SRC})
source_group("Source Files\\PE\\Load Configure" FILES ${LIEF_PE_LOAD_CONFIGURATION_SRC})
source_group("Header Files\\PE" FILES ${LIEF_PE_INCLUDE_FILES})
-source_group("Header Files\\PE\\signature" FILES ${LIEF_PE_SIG_INCLUDE_FILES})
source_group("Header Files\\PE\\resources" FILES ${LIEF_PE_RESOURCES_INCLUDE_FILES})
source_group("Header Files\\PE\\Load Configuration" FILES ${LIEF_PE_LOAD_CONFIGURATION_INCLUDE})
source_group("Header Files\\PE\\utils\\Ordinals Lookup Tables" FILES ${LIEF_PE_UTILS_INCLUDE_FILES})
@@ -213,3 +195,5 @@ if (LIEF_PE)
${LIEF_PE_LOAD_CONFIGURATION_INCLUDE}
)
endif()
+
+include("${CMAKE_CURRENT_LIST_DIR}/signature/CMakeLists.txt")
diff --git a/src/PE/CodeIntegrity.cpp b/src/PE/CodeIntegrity.cpp
index 1d9ef381..0391d262 100644
--- a/src/PE/CodeIntegrity.cpp
+++ b/src/PE/CodeIntegrity.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@
#include "LIEF/PE/hash.hpp"
+#include "LIEF/PE/Structures.hpp"
#include "LIEF/PE/EnumToString.hpp"
#include "LIEF/PE/CodeIntegrity.hpp"
diff --git a/src/PE/CodeView.cpp b/src/PE/CodeView.cpp
index b9eaacac..17a01b0f 100644
--- a/src/PE/CodeView.cpp
+++ b/src/PE/CodeView.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/CodeViewPDB.cpp b/src/PE/CodeViewPDB.cpp
index 8f01192a..daa38748 100644
--- a/src/PE/CodeViewPDB.cpp
+++ b/src/PE/CodeViewPDB.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/DataDirectory.cpp b/src/PE/DataDirectory.cpp
index da2b5859..90546d80 100644
--- a/src/PE/DataDirectory.cpp
+++ b/src/PE/DataDirectory.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -19,6 +19,8 @@
#include "LIEF/PE/hash.hpp"
#include "LIEF/exception.hpp"
+#include "LIEF/PE/Structures.hpp"
+#include "LIEF/PE/Section.hpp"
#include "LIEF/PE/DataDirectory.hpp"
#include "LIEF/PE/EnumToString.hpp"
diff --git a/src/PE/Debug.cpp b/src/PE/Debug.cpp
index cd03bdde..be1980b3 100644
--- a/src/PE/Debug.cpp
+++ b/src/PE/Debug.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,8 +17,11 @@
#include "LIEF/PE/hash.hpp"
+#include "LIEF/PE/Structures.hpp"
#include "LIEF/PE/EnumToString.hpp"
#include "LIEF/PE/Debug.hpp"
+#include "LIEF/PE/CodeView.hpp"
+#include "LIEF/PE/Pogo.hpp"
namespace LIEF {
namespace PE {
diff --git a/src/PE/DosHeader.cpp b/src/PE/DosHeader.cpp
index 156af0ae..a0384302 100644
--- a/src/PE/DosHeader.cpp
+++ b/src/PE/DosHeader.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@
#include "LIEF/PE/hash.hpp"
#include "LIEF/PE/DosHeader.hpp"
+#include "LIEF/PE/Structures.hpp"
namespace LIEF {
namespace PE {
diff --git a/src/PE/EnumToString.cpp b/src/PE/EnumToString.cpp
index dac82818..33a08d1d 100644
--- a/src/PE/EnumToString.cpp
+++ b/src/PE/EnumToString.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -380,8 +380,8 @@ const char* to_string(RELOCATIONS_BASE_TYPES e) {
{ RELOCATIONS_BASE_TYPES::IMAGE_REL_BASED_THUMB_MOV32, "REL | ARM_MOV32T | THUMB_MOV32 | RISCV_LOW12I" },
{ RELOCATIONS_BASE_TYPES::IMAGE_REL_BASED_RISCV_LOW12I, "REL | ARM_MOV32T | THUMB_MOV32 | RISCV_LOW12I" },
{ RELOCATIONS_BASE_TYPES::IMAGE_REL_BASED_RISCV_LOW12S, "RISCV_LOW12S" },
- { RELOCATIONS_BASE_TYPES::IMAGE_REL_BASED_MIPS_JMPADDR16, "MIPS_JMPADDR16 | IA64_DIR64" },
- { RELOCATIONS_BASE_TYPES::IMAGE_REL_BASED_IA64_IMM64, "MIPS_JMPADDR16 | IA64_DIR64" },
+ { RELOCATIONS_BASE_TYPES::IMAGE_REL_BASED_MIPS_JMPADDR16, "MIPS_JMPADDR16 | IA64_IMM64" },
+ { RELOCATIONS_BASE_TYPES::IMAGE_REL_BASED_IA64_IMM64, "MIPS_JMPADDR16 | IA64_IMM64" },
{ RELOCATIONS_BASE_TYPES::IMAGE_REL_BASED_DIR64, "DIR64" },
{ RELOCATIONS_BASE_TYPES::IMAGE_REL_BASED_HIGH3ADJ, "HIGH3ADJ" },
};
@@ -1104,25 +1104,17 @@ const char* to_string(WIN_VERSION e) {
const char* to_string(GUARD_CF_FLAGS e) {
- CONST_MAP(GUARD_CF_FLAGS, const char*, 7) enumStrings {
- { GUARD_CF_FLAGS::GCF_NONE, "NONE" },
- { GUARD_CF_FLAGS::GCF_INSTRUMENTED, "INSTRUMENTED" },
- { GUARD_CF_FLAGS::GCF_W_INSTRUMENTED, "W_INSTRUMENTED" },
- { GUARD_CF_FLAGS::GCF_FUNCTION_TABLE_PRESENT, "FUNCTION_TABLE_PRESENT" },
- { GUARD_CF_FLAGS::GCF_EXPORT_SUPPRESSION_INFO_PRESENT, "EXPORT_SUPPRESSION_INFO_PRESENT" },
- { GUARD_CF_FLAGS::GCF_ENABLE_EXPORT_SUPPRESSION, "ENABLE_EXPORT_SUPPRESSION" },
- { GUARD_CF_FLAGS::GCF_LONGJUMP_TABLE_PRESENT, "LONGJUMP_TABLE_PRESENT" },
- };
- auto it = enumStrings.find(e);
- return it == enumStrings.end() ? "Out of range" : it->second;
-}
-
-
-const char* to_string(GUARD_RF_FLAGS e) {
- CONST_MAP(GUARD_RF_FLAGS, const char*, 3) enumStrings {
- { GUARD_RF_FLAGS::GRF_INSTRUMENTED, "INSTRUMENTED" },
- { GUARD_RF_FLAGS::GRF_ENABLE, "ENABLE" },
- { GUARD_RF_FLAGS::GRF_STRICT, "STRICT" },
+ CONST_MAP(GUARD_CF_FLAGS, const char*, 10) enumStrings {
+ { GUARD_CF_FLAGS::GCF_NONE, "GCF_NONE" },
+ { GUARD_CF_FLAGS::GCF_INSTRUMENTED, "GCF_INSTRUMENTED" },
+ { GUARD_CF_FLAGS::GCF_W_INSTRUMENTED, "GCF_W_INSTRUMENTED" },
+ { GUARD_CF_FLAGS::GCF_FUNCTION_TABLE_PRESENT, "GCF_FUNCTION_TABLE_PRESENT" },
+ { GUARD_CF_FLAGS::GCF_EXPORT_SUPPRESSION_INFO_PRESENT, "GCF_EXPORT_SUPPRESSION_INFO_PRESENT" },
+ { GUARD_CF_FLAGS::GCF_ENABLE_EXPORT_SUPPRESSION, "GCF_ENABLE_EXPORT_SUPPRESSION" },
+ { GUARD_CF_FLAGS::GCF_LONGJUMP_TABLE_PRESENT, "GCF_LONGJUMP_TABLE_PRESENT" },
+ { GUARD_CF_FLAGS::GRF_INSTRUMENTED, "GRF_INSTRUMENTED" },
+ { GUARD_CF_FLAGS::GRF_ENABLE, "GRF_ENABLE" },
+ { GUARD_CF_FLAGS::GRF_STRICT, "GRF_STRICT" },
};
auto it = enumStrings.find(e);
return it == enumStrings.end() ? "Out of range" : it->second;
@@ -1151,6 +1143,248 @@ const char* to_string(POGO_SIGNATURES e) {
return it == enumStrings.end() ? to_string(POGO_SIGNATURES::POGO_UNKNOWN) : it->second;
}
+const char* to_string(ACCELERATOR_FLAGS e) {
+ CONST_MAP(ACCELERATOR_FLAGS, const char*, 6) enumStrings {
+ { ACCELERATOR_FLAGS::FVIRTKEY, "FVIRTKEY" },
+ { ACCELERATOR_FLAGS::FNOINVERT, "FNOINVERT" },
+ { ACCELERATOR_FLAGS::FSHIFT, "FSHIFT" },
+ { ACCELERATOR_FLAGS::FCONTROL, "FCONTROL" },
+ { ACCELERATOR_FLAGS::FALT, "FALT" },
+ { ACCELERATOR_FLAGS::END, "END" },
+ };
+ auto it = enumStrings.find(e);
+ return it == enumStrings.end() ? "Out of range" : it->second;
+}
+
+const char* to_string(ACCELERATOR_VK_CODES e) {
+ CONST_MAP(ACCELERATOR_VK_CODES, const char*, 174) enumStrings {
+ { ACCELERATOR_VK_CODES::VK_LBUTTON, "VK_LBUTTON" },
+ { ACCELERATOR_VK_CODES::VK_RBUTTON, "VK_RBUTTON" },
+ { ACCELERATOR_VK_CODES::VK_CANCEL, "VK_CANCEL" },
+ { ACCELERATOR_VK_CODES::VK_MBUTTON, "VK_MBUTTON" },
+ { ACCELERATOR_VK_CODES::VK_XBUTTON1, "VK_XBUTTON1" },
+ { ACCELERATOR_VK_CODES::VK_XBUTTON2, "VK_XBUTTON2" },
+ { ACCELERATOR_VK_CODES::VK_BACK, "VK_BACK" },
+ { ACCELERATOR_VK_CODES::VK_TAB, "VK_TAB" },
+ { ACCELERATOR_VK_CODES::VK_CLEAR, "VK_CLEAR" },
+ { ACCELERATOR_VK_CODES::VK_RETURN, "VK_RETURN" },
+ { ACCELERATOR_VK_CODES::VK_SHIFT, "VK_SHIFT" },
+ { ACCELERATOR_VK_CODES::VK_CONTROL, "VK_CONTROL" },
+ { ACCELERATOR_VK_CODES::VK_MENU, "VK_MENU" },
+ { ACCELERATOR_VK_CODES::VK_PAUSE, "VK_PAUSE" },
+ { ACCELERATOR_VK_CODES::VK_CAPITAL, "VK_CAPITAL" },
+ { ACCELERATOR_VK_CODES::VK_KANA, "VK_KANA" },
+ { ACCELERATOR_VK_CODES::VK_HANGUEL, "VK_HANGUEL" },
+ { ACCELERATOR_VK_CODES::VK_HANGUL, "VK_HANGUL" },
+ { ACCELERATOR_VK_CODES::VK_IME_ON, "VK_IME_ON" },
+ { ACCELERATOR_VK_CODES::VK_JUNJA, "VK_JUNJA" },
+ { ACCELERATOR_VK_CODES::VK_FINAL, "VK_FINAL" },
+ { ACCELERATOR_VK_CODES::VK_HANJA, "VK_HANJA" },
+ { ACCELERATOR_VK_CODES::VK_KANJI, "VK_KANJI" },
+ { ACCELERATOR_VK_CODES::VK_IME_OFF, "VK_IME_OFF" },
+ { ACCELERATOR_VK_CODES::VK_ESCAPE, "VK_ESCAPE" },
+ { ACCELERATOR_VK_CODES::VK_CONVERT, "VK_CONVERT" },
+ { ACCELERATOR_VK_CODES::VK_NONCONVERT, "VK_NONCONVERT" },
+ { ACCELERATOR_VK_CODES::VK_ACCEPT, "VK_ACCEPT" },
+ { ACCELERATOR_VK_CODES::VK_MODECHANGE, "VK_MODECHANGE" },
+ { ACCELERATOR_VK_CODES::VK_SPACE, "VK_SPACE" },
+ { ACCELERATOR_VK_CODES::VK_PRIOR, "VK_PRIOR" },
+ { ACCELERATOR_VK_CODES::VK_NEXT, "VK_NEXT" },
+ { ACCELERATOR_VK_CODES::VK_END, "VK_END" },
+ { ACCELERATOR_VK_CODES::VK_HOME, "VK_HOME" },
+ { ACCELERATOR_VK_CODES::VK_LEFT, "VK_LEFT" },
+ { ACCELERATOR_VK_CODES::VK_UP, "VK_UP" },
+ { ACCELERATOR_VK_CODES::VK_RIGHT, "VK_RIGHT" },
+ { ACCELERATOR_VK_CODES::VK_DOWN, "VK_DOWN" },
+ { ACCELERATOR_VK_CODES::VK_SELECT, "VK_SELECT" },
+ { ACCELERATOR_VK_CODES::VK_PRINT, "VK_PRINT" },
+ { ACCELERATOR_VK_CODES::VK_EXECUTE, "VK_EXECUTE" },
+ { ACCELERATOR_VK_CODES::VK_SNAPSHOT, "VK_SNAPSHOT" },
+ { ACCELERATOR_VK_CODES::VK_INSERT, "VK_INSERT" },
+ { ACCELERATOR_VK_CODES::VK_DELETE, "VK_DELETE" },
+ { ACCELERATOR_VK_CODES::VK_HELP, "VK_HELP" },
+ { ACCELERATOR_VK_CODES::VK_0, "VK_0" },
+ { ACCELERATOR_VK_CODES::VK_1, "VK_1" },
+ { ACCELERATOR_VK_CODES::VK_2, "VK_2" },
+ { ACCELERATOR_VK_CODES::VK_3, "VK_3" },
+ { ACCELERATOR_VK_CODES::VK_4, "VK_4" },
+ { ACCELERATOR_VK_CODES::VK_5, "VK_5" },
+ { ACCELERATOR_VK_CODES::VK_6, "VK_6" },
+ { ACCELERATOR_VK_CODES::VK_7, "VK_7" },
+ { ACCELERATOR_VK_CODES::VK_8, "VK_8" },
+ { ACCELERATOR_VK_CODES::VK_9, "VK_9" },
+ { ACCELERATOR_VK_CODES::VK_A, "VK_A" },
+ { ACCELERATOR_VK_CODES::VK_B, "VK_B" },
+ { ACCELERATOR_VK_CODES::VK_C, "VK_C" },
+ { ACCELERATOR_VK_CODES::VK_D, "VK_D" },
+ { ACCELERATOR_VK_CODES::VK_E, "VK_E" },
+ { ACCELERATOR_VK_CODES::VK_F, "VK_F" },
+ { ACCELERATOR_VK_CODES::VK_G, "VK_G" },
+ { ACCELERATOR_VK_CODES::VK_H, "VK_H" },
+ { ACCELERATOR_VK_CODES::VK_I, "VK_I" },
+ { ACCELERATOR_VK_CODES::VK_J, "VK_J" },
+ { ACCELERATOR_VK_CODES::VK_K, "VK_K" },
+ { ACCELERATOR_VK_CODES::VK_L, "VK_L" },
+ { ACCELERATOR_VK_CODES::VK_M, "VK_M" },
+ { ACCELERATOR_VK_CODES::VK_N, "VK_N" },
+ { ACCELERATOR_VK_CODES::VK_O, "VK_O" },
+ { ACCELERATOR_VK_CODES::VK_P, "VK_P" },
+ { ACCELERATOR_VK_CODES::VK_Q, "VK_Q" },
+ { ACCELERATOR_VK_CODES::VK_R, "VK_R" },
+ { ACCELERATOR_VK_CODES::VK_S, "VK_S" },
+ { ACCELERATOR_VK_CODES::VK_T, "VK_T" },
+ { ACCELERATOR_VK_CODES::VK_U, "VK_U" },
+ { ACCELERATOR_VK_CODES::VK_V, "VK_V" },
+ { ACCELERATOR_VK_CODES::VK_W, "VK_W" },
+ { ACCELERATOR_VK_CODES::VK_X, "VK_X" },
+ { ACCELERATOR_VK_CODES::VK_Y, "VK_Y" },
+ { ACCELERATOR_VK_CODES::VK_Z, "VK_Z" },
+ { ACCELERATOR_VK_CODES::VK_LWIN, "VK_LWIN" },
+ { ACCELERATOR_VK_CODES::VK_RWIN, "VK_RWIN" },
+ { ACCELERATOR_VK_CODES::VK_APPS, "VK_APPS" },
+ { ACCELERATOR_VK_CODES::VK_SLEEP, "VK_SLEEP" },
+ { ACCELERATOR_VK_CODES::VK_NUMPAD0, "VK_NUMPAD0" },
+ { ACCELERATOR_VK_CODES::VK_NUMPAD1, "VK_NUMPAD1" },
+ { ACCELERATOR_VK_CODES::VK_NUMPAD2, "VK_NUMPAD2" },
+ { ACCELERATOR_VK_CODES::VK_NUMPAD3, "VK_NUMPAD3" },
+ { ACCELERATOR_VK_CODES::VK_NUMPAD4, "VK_NUMPAD4" },
+ { ACCELERATOR_VK_CODES::VK_NUMPAD5, "VK_NUMPAD5" },
+ { ACCELERATOR_VK_CODES::VK_NUMPAD6, "VK_NUMPAD6" },
+ { ACCELERATOR_VK_CODES::VK_NUMPAD7, "VK_NUMPAD7" },
+ { ACCELERATOR_VK_CODES::VK_NUMPAD8, "VK_NUMPAD8" },
+ { ACCELERATOR_VK_CODES::VK_NUMPAD9, "VK_NUMPAD9" },
+ { ACCELERATOR_VK_CODES::VK_MULTIPLY, "VK_MULTIPLY" },
+ { ACCELERATOR_VK_CODES::VK_ADD, "VK_ADD" },
+ { ACCELERATOR_VK_CODES::VK_SEPARATOR, "VK_SEPARATOR" },
+ { ACCELERATOR_VK_CODES::VK_SUBTRACT, "VK_SUBTRACT" },
+ { ACCELERATOR_VK_CODES::VK_DECIMAL, "VK_DECIMAL" },
+ { ACCELERATOR_VK_CODES::VK_DIVIDE, "VK_DIVIDE" },
+ { ACCELERATOR_VK_CODES::VK_F1, "VK_F1" },
+ { ACCELERATOR_VK_CODES::VK_F2, "VK_F2" },
+ { ACCELERATOR_VK_CODES::VK_F3, "VK_F3" },
+ { ACCELERATOR_VK_CODES::VK_F4, "VK_F4" },
+ { ACCELERATOR_VK_CODES::VK_F5, "VK_F5" },
+ { ACCELERATOR_VK_CODES::VK_F6, "VK_F6" },
+ { ACCELERATOR_VK_CODES::VK_F7, "VK_F7" },
+ { ACCELERATOR_VK_CODES::VK_F8, "VK_F8" },
+ { ACCELERATOR_VK_CODES::VK_F9, "VK_F9" },
+ { ACCELERATOR_VK_CODES::VK_F10, "VK_F10" },
+ { ACCELERATOR_VK_CODES::VK_F11, "VK_F11" },
+ { ACCELERATOR_VK_CODES::VK_F12, "VK_F12" },
+ { ACCELERATOR_VK_CODES::VK_F13, "VK_F13" },
+ { ACCELERATOR_VK_CODES::VK_F14, "VK_F14" },
+ { ACCELERATOR_VK_CODES::VK_F15, "VK_F15" },
+ { ACCELERATOR_VK_CODES::VK_F16, "VK_F16" },
+ { ACCELERATOR_VK_CODES::VK_F17, "VK_F17" },
+ { ACCELERATOR_VK_CODES::VK_F18, "VK_F18" },
+ { ACCELERATOR_VK_CODES::VK_F19, "VK_F19" },
+ { ACCELERATOR_VK_CODES::VK_F20, "VK_F20" },
+ { ACCELERATOR_VK_CODES::VK_F21, "VK_F21" },
+ { ACCELERATOR_VK_CODES::VK_F22, "VK_F22" },
+ { ACCELERATOR_VK_CODES::VK_F23, "VK_F23" },
+ { ACCELERATOR_VK_CODES::VK_F24, "VK_F24" },
+ { ACCELERATOR_VK_CODES::VK_NUMLOCK, "VK_NUMLOCK" },
+ { ACCELERATOR_VK_CODES::VK_SCROLL, "VK_SCROLL" },
+ { ACCELERATOR_VK_CODES::VK_LSHIFT, "VK_LSHIFT" },
+ { ACCELERATOR_VK_CODES::VK_RSHIFT, "VK_RSHIFT" },
+ { ACCELERATOR_VK_CODES::VK_LCONTROL, "VK_LCONTROL" },
+ { ACCELERATOR_VK_CODES::VK_RCONTROL, "VK_RCONTROL" },
+ { ACCELERATOR_VK_CODES::VK_LMENU, "VK_LMENU" },
+ { ACCELERATOR_VK_CODES::VK_RMENU, "VK_RMENU" },
+ { ACCELERATOR_VK_CODES::VK_BROWSER_BACK, "VK_BROWSER_BACK" },
+ { ACCELERATOR_VK_CODES::VK_BROWSER_FORWARD, "VK_BROWSER_FORWARD" },
+ { ACCELERATOR_VK_CODES::VK_BROWSER_REFRESH, "VK_BROWSER_REFRESH" },
+ { ACCELERATOR_VK_CODES::VK_BROWSER_STOP, "VK_BROWSER_STOP" },
+ { ACCELERATOR_VK_CODES::VK_BROWSER_SEARCH, "VK_BROWSER_SEARCH" },
+ { ACCELERATOR_VK_CODES::VK_BROWSER_FAVORITES, "VK_BROWSER_FAVORITES" },
+ { ACCELERATOR_VK_CODES::VK_BROWSER_HOME, "VK_BROWSER_HOME" },
+ { ACCELERATOR_VK_CODES::VK_VOLUME_MUTE, "VK_VOLUME_MUTE" },
+ { ACCELERATOR_VK_CODES::VK_VOLUME_DOWN, "VK_VOLUME_DOWN" },
+ { ACCELERATOR_VK_CODES::VK_VOLUME_UP, "VK_VOLUME_UP" },
+ { ACCELERATOR_VK_CODES::VK_MEDIA_NEXT_TRACK, "VK_MEDIA_NEXT_TRACK" },
+ { ACCELERATOR_VK_CODES::VK_MEDIA_PREV_TRACK, "VK_MEDIA_PREV_TRACK" },
+ { ACCELERATOR_VK_CODES::VK_MEDIA_STOP, "VK_MEDIA_STOP" },
+ { ACCELERATOR_VK_CODES::VK_MEDIA_PLAY_PAUSE, "VK_MEDIA_PLAY_PAUSE" },
+ { ACCELERATOR_VK_CODES::VK_LAUNCH_MAIL, "VK_LAUNCH_MAIL" },
+ { ACCELERATOR_VK_CODES::VK_LAUNCH_MEDIA_SELECT, "VK_LAUNCH_MEDIA_SELECT" },
+ { ACCELERATOR_VK_CODES::VK_LAUNCH_APP1, "VK_LAUNCH_APP1" },
+ { ACCELERATOR_VK_CODES::VK_LAUNCH_APP2, "VK_LAUNCH_APP2" },
+ { ACCELERATOR_VK_CODES::VK_OEM_1, "VK_OEM_1" },
+ { ACCELERATOR_VK_CODES::VK_OEM_PLUS, "VK_OEM_PLUS" },
+ { ACCELERATOR_VK_CODES::VK_OEM_COMMA, "VK_OEM_COMMA" },
+ { ACCELERATOR_VK_CODES::VK_OEM_MINUS, "VK_OEM_MINUS" },
+ { ACCELERATOR_VK_CODES::VK_OEM_PERIOD, "VK_OEM_PERIOD" },
+ { ACCELERATOR_VK_CODES::VK_OEM_2, "VK_OEM_2" },
+ { ACCELERATOR_VK_CODES::VK_OEM_4, "VK_OEM_4" },
+ { ACCELERATOR_VK_CODES::VK_OEM_5, "VK_OEM_5" },
+ { ACCELERATOR_VK_CODES::VK_OEM_6, "VK_OEM_6" },
+ { ACCELERATOR_VK_CODES::VK_OEM_7, "VK_OEM_7" },
+ { ACCELERATOR_VK_CODES::VK_OEM_8, "VK_OEM_8" },
+ { ACCELERATOR_VK_CODES::VK_OEM_102, "VK_OEM_102" },
+ { ACCELERATOR_VK_CODES::VK_PROCESSKEY, "VK_PROCESSKEY" },
+ { ACCELERATOR_VK_CODES::VK_PACKET, "VK_PACKET" },
+ { ACCELERATOR_VK_CODES::VK_ATTN, "VK_ATTN" },
+ { ACCELERATOR_VK_CODES::VK_CRSEL, "VK_CRSEL" },
+ { ACCELERATOR_VK_CODES::VK_EXSEL, "VK_EXSEL" },
+ { ACCELERATOR_VK_CODES::VK_EREOF, "VK_EREOF" },
+ { ACCELERATOR_VK_CODES::VK_PLAY, "VK_PLAY" },
+ { ACCELERATOR_VK_CODES::VK_ZOOM, "VK_ZOOM" },
+ { ACCELERATOR_VK_CODES::VK_NONAME, "VK_NONAME" },
+ { ACCELERATOR_VK_CODES::VK_PA1, "VK_PA1" },
+ { ACCELERATOR_VK_CODES::VK_OEM_CLEAR, "VK_OEM_CLEAR" },
+ };
+ auto it = enumStrings.find(e);
+ return it != enumStrings.end() ? it->second : "Undefined or reserved";
+}
+
+const char* to_string(ALGORITHMS e) {
+ CONST_MAP(ALGORITHMS, const char*, 20) enumStrings {
+ { ALGORITHMS::UNKNOWN, "UNKNOWN" },
+ { ALGORITHMS::SHA_512, "SHA_512" },
+ { ALGORITHMS::SHA_384, "SHA_384" },
+ { ALGORITHMS::SHA_256, "SHA_256" },
+ { ALGORITHMS::SHA_1, "SHA_1" },
+
+ { ALGORITHMS::MD5, "MD5" },
+ { ALGORITHMS::MD4, "MD4" },
+ { ALGORITHMS::MD2, "MD2" },
+
+ { ALGORITHMS::RSA, "RSA" },
+ { ALGORITHMS::EC, "EC" },
+
+ { ALGORITHMS::MD5_RSA, "MD5_RSA" },
+ { ALGORITHMS::SHA1_DSA, "SHA1_DSA" },
+ { ALGORITHMS::SHA1_RSA, "SHA1_RSA" },
+ { ALGORITHMS::SHA_256_RSA, "SHA_256_RSA" },
+ { ALGORITHMS::SHA_384_RSA, "SHA_384_RSA" },
+ { ALGORITHMS::SHA_512_RSA, "SHA_512_RSA" },
+ { ALGORITHMS::SHA1_ECDSA, "SHA1_ECDSA" },
+ { ALGORITHMS::SHA_256_ECDSA, "SHA_256_ECDSA" },
+ { ALGORITHMS::SHA_384_ECDSA, "SHA_384_ECDSA" },
+ { ALGORITHMS::SHA_512_ECDSA, "SHA_512_ECDSA" },
+ };
+ auto it = enumStrings.find(e);
+ return it == enumStrings.end() ? "UNKNOWN" : it->second;
+}
+
+
+const char* to_string(SIG_ATTRIBUTE_TYPES e) {
+ CONST_MAP(SIG_ATTRIBUTE_TYPES, const char*, 11) enumStrings {
+ { SIG_ATTRIBUTE_TYPES::UNKNOWN, "UNKNOWN" },
+ { SIG_ATTRIBUTE_TYPES::CONTENT_TYPE, "CONTENT_TYPE" },
+ { SIG_ATTRIBUTE_TYPES::GENERIC_TYPE, "GENERIC_TYPE" },
+ { SIG_ATTRIBUTE_TYPES::SPC_SP_OPUS_INFO, "SPC_SP_OPUS_INFO" },
+ { SIG_ATTRIBUTE_TYPES::MS_COUNTER_SIGN, "MS_COUNTER_SIGN" },
+ { SIG_ATTRIBUTE_TYPES::MS_SPC_NESTED_SIGN, "MS_SPC_NESTED_SIGN" },
+ { SIG_ATTRIBUTE_TYPES::MS_SPC_STATEMENT_TYPE, "MS_SPC_STATEMENT_TYPE" },
+ { SIG_ATTRIBUTE_TYPES::PKCS9_AT_SEQUENCE_NUMBER, "PKCS9_AT_SEQUENCE_NUMBER" },
+ { SIG_ATTRIBUTE_TYPES::PKCS9_COUNTER_SIGNATURE, "PKCS9_COUNTER_SIGNATURE" },
+ { SIG_ATTRIBUTE_TYPES::PKCS9_MESSAGE_DIGEST, "PKCS9_MESSAGE_DIGEST" },
+ { SIG_ATTRIBUTE_TYPES::PKCS9_SIGNING_TIME, "PKCS9_SIGNING_TIME" },
+ };
+ auto it = enumStrings.find(e);
+ return it == enumStrings.end() ? "UNKNOWN" : it->second;
+}
} // namespace PE
} // namespace LIEF
diff --git a/src/PE/Export.cpp b/src/PE/Export.cpp
index b601bd32..cb4e6a24 100644
--- a/src/PE/Export.cpp
+++ b/src/PE/Export.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,7 +17,9 @@
#include "LIEF/PE/hash.hpp"
+#include "LIEF/PE/Structures.hpp"
#include "LIEF/PE/Export.hpp"
+#include "LIEF/PE/ExportEntry.hpp"
namespace LIEF {
namespace PE {
diff --git a/src/PE/ExportEntry.cpp b/src/PE/ExportEntry.cpp
index 8b21f486..8a42b233 100644
--- a/src/PE/ExportEntry.cpp
+++ b/src/PE/ExportEntry.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/Header.cpp b/src/PE/Header.cpp
index 705409b4..c3ed5c5f 100644
--- a/src/PE/Header.cpp
+++ b/src/PE/Header.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -21,6 +21,7 @@
#include "LIEF/PE/EnumToString.hpp"
#include "LIEF/PE/Header.hpp"
+#include "LIEF/PE/Structures.hpp"
namespace LIEF {
namespace PE {
diff --git a/src/PE/Import.cpp b/src/PE/Import.cpp
index db7c3357..f6ff1fa0 100644
--- a/src/PE/Import.cpp
+++ b/src/PE/Import.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -19,6 +19,8 @@
#include "LIEF/PE/hash.hpp"
#include "LIEF/exception.hpp"
+#include "LIEF/PE/Structures.hpp"
+#include "LIEF/PE/ImportEntry.hpp"
#include "LIEF/PE/Import.hpp"
namespace LIEF {
diff --git a/src/PE/ImportEntry.cpp b/src/PE/ImportEntry.cpp
index fdb80f21..66eb67a2 100644
--- a/src/PE/ImportEntry.cpp
+++ b/src/PE/ImportEntry.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/LoadConfigurations/LoadConfiguration.cpp b/src/PE/LoadConfigurations/LoadConfiguration.cpp
index b9028002..8c17b68c 100644
--- a/src/PE/LoadConfigurations/LoadConfiguration.cpp
+++ b/src/PE/LoadConfigurations/LoadConfiguration.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@
#include "LIEF/PE/hash.hpp"
#include "LIEF/exception.hpp"
+#include "LIEF/PE/Structures.hpp"
#include "LIEF/PE/LoadConfigurations.hpp"
#include "LIEF/PE/EnumToString.hpp"
diff --git a/src/PE/LoadConfigurations/LoadConfiguration.tcc b/src/PE/LoadConfigurations/LoadConfiguration.tcc
index ced90c8c..aa45ea67 100644
--- a/src/PE/LoadConfigurations/LoadConfiguration.tcc
+++ b/src/PE/LoadConfigurations/LoadConfiguration.tcc
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/LoadConfigurations/LoadConfigurationV0.cpp b/src/PE/LoadConfigurations/LoadConfigurationV0.cpp
index be03284c..d308e108 100644
--- a/src/PE/LoadConfigurations/LoadConfigurationV0.cpp
+++ b/src/PE/LoadConfigurations/LoadConfigurationV0.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/LoadConfigurations/LoadConfigurationV0.tcc b/src/PE/LoadConfigurations/LoadConfigurationV0.tcc
index 2b8d4c0e..12c2f19a 100644
--- a/src/PE/LoadConfigurations/LoadConfigurationV0.tcc
+++ b/src/PE/LoadConfigurations/LoadConfigurationV0.tcc
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/LoadConfigurations/LoadConfigurationV1.cpp b/src/PE/LoadConfigurations/LoadConfigurationV1.cpp
index a2f58aed..26260f39 100644
--- a/src/PE/LoadConfigurations/LoadConfigurationV1.cpp
+++ b/src/PE/LoadConfigurations/LoadConfigurationV1.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/LoadConfigurations/LoadConfigurationV1.tcc b/src/PE/LoadConfigurations/LoadConfigurationV1.tcc
index 42482984..d2e7556c 100644
--- a/src/PE/LoadConfigurations/LoadConfigurationV1.tcc
+++ b/src/PE/LoadConfigurations/LoadConfigurationV1.tcc
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/LoadConfigurations/LoadConfigurationV2.cpp b/src/PE/LoadConfigurations/LoadConfigurationV2.cpp
index 4bce9072..3c4cae97 100644
--- a/src/PE/LoadConfigurations/LoadConfigurationV2.cpp
+++ b/src/PE/LoadConfigurations/LoadConfigurationV2.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/LoadConfigurations/LoadConfigurationV2.tcc b/src/PE/LoadConfigurations/LoadConfigurationV2.tcc
index 216ab621..3d923fbc 100644
--- a/src/PE/LoadConfigurations/LoadConfigurationV2.tcc
+++ b/src/PE/LoadConfigurations/LoadConfigurationV2.tcc
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/LoadConfigurations/LoadConfigurationV3.cpp b/src/PE/LoadConfigurations/LoadConfigurationV3.cpp
index 39cddd8e..cfac428e 100644
--- a/src/PE/LoadConfigurations/LoadConfigurationV3.cpp
+++ b/src/PE/LoadConfigurations/LoadConfigurationV3.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/LoadConfigurations/LoadConfigurationV3.tcc b/src/PE/LoadConfigurations/LoadConfigurationV3.tcc
index 986a4261..cdb7449c 100644
--- a/src/PE/LoadConfigurations/LoadConfigurationV3.tcc
+++ b/src/PE/LoadConfigurations/LoadConfigurationV3.tcc
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/LoadConfigurations/LoadConfigurationV4.cpp b/src/PE/LoadConfigurations/LoadConfigurationV4.cpp
index 60180791..62f119f8 100644
--- a/src/PE/LoadConfigurations/LoadConfigurationV4.cpp
+++ b/src/PE/LoadConfigurations/LoadConfigurationV4.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/LoadConfigurations/LoadConfigurationV4.tcc b/src/PE/LoadConfigurations/LoadConfigurationV4.tcc
index cae19710..4c6846d9 100644
--- a/src/PE/LoadConfigurations/LoadConfigurationV4.tcc
+++ b/src/PE/LoadConfigurations/LoadConfigurationV4.tcc
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/LoadConfigurations/LoadConfigurationV5.cpp b/src/PE/LoadConfigurations/LoadConfigurationV5.cpp
index aea416f1..4885389f 100644
--- a/src/PE/LoadConfigurations/LoadConfigurationV5.cpp
+++ b/src/PE/LoadConfigurations/LoadConfigurationV5.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/LoadConfigurations/LoadConfigurationV5.tcc b/src/PE/LoadConfigurations/LoadConfigurationV5.tcc
index 4c71ce5a..344993ab 100644
--- a/src/PE/LoadConfigurations/LoadConfigurationV5.tcc
+++ b/src/PE/LoadConfigurations/LoadConfigurationV5.tcc
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/LoadConfigurations/LoadConfigurationV6.cpp b/src/PE/LoadConfigurations/LoadConfigurationV6.cpp
index 2694e47a..8d24f530 100644
--- a/src/PE/LoadConfigurations/LoadConfigurationV6.cpp
+++ b/src/PE/LoadConfigurations/LoadConfigurationV6.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/LoadConfigurations/LoadConfigurationV6.tcc b/src/PE/LoadConfigurations/LoadConfigurationV6.tcc
index 581213b2..c22e2ff1 100644
--- a/src/PE/LoadConfigurations/LoadConfigurationV6.tcc
+++ b/src/PE/LoadConfigurations/LoadConfigurationV6.tcc
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/LoadConfigurations/LoadConfigurationV7.cpp b/src/PE/LoadConfigurations/LoadConfigurationV7.cpp
index a821a70b..b05c1565 100644
--- a/src/PE/LoadConfigurations/LoadConfigurationV7.cpp
+++ b/src/PE/LoadConfigurations/LoadConfigurationV7.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/LoadConfigurations/LoadConfigurationV7.tcc b/src/PE/LoadConfigurations/LoadConfigurationV7.tcc
index 1084e589..a81f7691 100644
--- a/src/PE/LoadConfigurations/LoadConfigurationV7.tcc
+++ b/src/PE/LoadConfigurations/LoadConfigurationV7.tcc
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/LoadConfigurations/LoadConfigurations.tcc b/src/PE/LoadConfigurations/LoadConfigurations.tcc
index 104c3929..97af171d 100644
--- a/src/PE/LoadConfigurations/LoadConfigurations.tcc
+++ b/src/PE/LoadConfigurations/LoadConfigurations.tcc
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/OptionalHeader.cpp b/src/PE/OptionalHeader.cpp
index 0e58f977..c422ca26 100644
--- a/src/PE/OptionalHeader.cpp
+++ b/src/PE/OptionalHeader.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -13,21 +13,16 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-#include <stdexcept>
-#include <iomanip>
-#include <functional>
-#include <algorithm>
#include <numeric>
-#include <iterator>
-#include <string>
+#include <iomanip>
-#include "LIEF/PE/hash.hpp"
#include "LIEF/utils.hpp"
#include "LIEF/exception.hpp"
+#include "LIEF/PE/hash.hpp"
+#include "LIEF/PE/Structures.hpp"
#include "LIEF/PE/OptionalHeader.hpp"
#include "LIEF/PE/EnumToString.hpp"
-#include "LIEF/PE/utils.hpp"
namespace LIEF {
diff --git a/src/PE/Parser.cpp b/src/PE/Parser.cpp
index dab8c1a2..82a855f5 100644
--- a/src/PE/Parser.cpp
+++ b/src/PE/Parser.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -23,28 +23,39 @@
#include <mbedtls/oid.h>
#include <mbedtls/x509_crt.h>
-#include "LIEF/logging++.hpp"
+#include "filesystem/filesystem.h"
+
+#include "logging.hpp"
#include "LIEF/exception.hpp"
#include "LIEF/BinaryStream/VectorStream.hpp"
-
+#include "LIEF/Abstract/Relocation.hpp"
#include "LIEF/PE/signature/Signature.hpp"
#include "LIEF/PE/signature/SignatureParser.hpp"
#include "LIEF/PE/signature/OIDToString.hpp"
-
-
#include "LIEF/PE/CodeViewPDB.hpp"
-
#include "LIEF/PE/Parser.hpp"
-#include "Parser.tcc"
-
#include "LIEF/PE/utils.hpp"
-
-#include "filesystem/filesystem.h"
+#include "LIEF/PE/Section.hpp"
+#include "LIEF/PE/Binary.hpp"
+#include "LIEF/PE/DataDirectory.hpp"
+#include "LIEF/PE/ResourceData.hpp"
+#include "LIEF/PE/ResourceDirectory.hpp"
+#include "LIEF/PE/ResourceNode.hpp"
+#include "LIEF/PE/Export.hpp"
+#include "LIEF/PE/ExportEntry.hpp"
+#include "LIEF/PE/Pogo.hpp"
+#include "LIEF/PE/PogoEntry.hpp"
+#include "LIEF/PE/Relocation.hpp"
+#include "LIEF/PE/RelocationEntry.hpp"
+#include "LIEF/PE/Symbol.hpp"
+#include "LIEF/PE/Import.hpp"
+#include "LIEF/PE/ImportEntry.hpp"
+#include "LIEF/PE/EnumToString.hpp"
#include "signature/pkcs7.h"
-
+#include "Parser.tcc"
// Issue with VS2017
#if defined(IMAGE_FILE_MACHINE_UNKNOWN)
@@ -82,8 +93,13 @@ Parser::Parser(const std::vector<uint8_t>& data, const std::string& name) :
void Parser::init(const std::string& name) {
-
- this->type_ = get_type(this->stream_->content());
+ stream_->setpos(0);
+ auto type = get_type_from_stream(*stream_);
+ if (not type) {
+ LIEF_ERR("Can't determine PE type.");
+ return;
+ }
+ this->type_ = type.value();
this->binary_ = new Binary{};
this->binary_->name(name);
this->binary_->type_ = this->type_;
@@ -104,11 +120,11 @@ void Parser::parse_dos_stub(void) {
}
const uint64_t sizeof_dos_stub = dos_header.addressof_new_exeheader() - sizeof(pe_dos_header);
- VLOG(VDEBUG) << "Size of dos stub: " << std::hex << sizeof_dos_stub;
+ LIEF_DEBUG("DOS stub: @0x{:x}:0x{:x}", sizeof(pe_dos_header), sizeof_dos_stub);
const uint8_t* ptr_to_dos_stub = this->stream_->peek_array<uint8_t>(sizeof(pe_dos_header), sizeof_dos_stub, /* check */false);
if (ptr_to_dos_stub == nullptr) {
- LOG(ERROR) << "Dost stub corrupted!";
+ LIEF_ERR("DOS stub is corrupted!");
} else {
this->binary_->dos_stub_ = {ptr_to_dos_stub, ptr_to_dos_stub + sizeof_dos_stub};
}
@@ -116,23 +132,19 @@ void Parser::parse_dos_stub(void) {
void Parser::parse_rich_header(void) {
- VLOG(VDEBUG) << "Parsing Rich Header";
+ LIEF_DEBUG("Parsing rich header");
const std::vector<uint8_t>& dos_stub = this->binary_->dos_stub();
VectorStream stream{dos_stub};
- auto&& it_rich = std::search(
- std::begin(dos_stub),
- std::end(dos_stub),
- std::begin(Rich_Magic),
- std::end(Rich_Magic));
+ auto it_rich = std::search(std::begin(dos_stub), std::end(dos_stub),
+ std::begin(Rich_Magic), std::end(Rich_Magic));
if (it_rich == std::end(dos_stub)) {
- VLOG(VDEBUG) << "Rich header not found";
+ LIEF_DEBUG("Rich header not found!");
return;
}
-
const uint64_t end_offset_rich_header = std::distance(std::begin(dos_stub), it_rich);
- VLOG(VDEBUG) << "Offset to rich header: " << std::hex << end_offset_rich_header;
+ LIEF_DEBUG("Offset to rich header: 0x{:x}", end_offset_rich_header);
if (not stream.can_read<uint32_t>(end_offset_rich_header + sizeof(Rich_Magic))) {
return;
@@ -140,8 +152,7 @@ void Parser::parse_rich_header(void) {
const uint32_t xor_key = stream.peek<uint32_t>(end_offset_rich_header + sizeof(Rich_Magic));
this->binary_->rich_header().key(xor_key);
- VLOG(VDEBUG) << "XOR Key: " << std::hex << xor_key;
-
+ LIEF_DEBUG("XOR key: 0x{:x}", xor_key);
uint64_t curent_offset = end_offset_rich_header - sizeof(Rich_Magic);
@@ -166,6 +177,10 @@ void Parser::parse_rich_header(void) {
value = stream.peek<uint32_t>(curent_offset) ^ xor_key;
curent_offset -= sizeof(uint32_t);
+ if (value == 0 and count == 0) { // Skip padding entry
+ continue;
+ }
+
if (value == DanS_Magic_number or count == DanS_Magic_number) {
break;
}
@@ -173,16 +188,13 @@ void Parser::parse_rich_header(void) {
uint16_t build_number = value & 0xFFFF;
uint16_t id = (value >> 16) & 0xFFFF;
- VLOG(VDEBUG) << "ID: " << std::hex << id << " "
- << "Build Number: " << std::hex << build_number << " "
- << "Count: " << std::dec << count;
+ LIEF_DEBUG("ID: 0x{:04x}", id);
+ LIEF_DEBUG("Build Number: 0x{:04x}", build_number);
+ LIEF_DEBUG("Count: 0x{:d}", count);
this->binary_->rich_header().add_entry(id, build_number, count);
}
- VLOG(VDEBUG) << this->binary_->rich_header();
-
-
this->binary_->has_rich_header_ = true;
}
@@ -196,8 +208,7 @@ void Parser::parse_rich_header(void) {
// TODO: Check offset etc
void Parser::parse_sections(void) {
- VLOG(VDEBUG) << "[+] Parsing sections";
-
+ LIEF_DEBUG("Parsing sections");
const uint32_t sections_offset =
this->binary_->dos_header().addressof_new_exeheader() +
sizeof(pe_header) +
@@ -208,7 +219,7 @@ void Parser::parse_sections(void) {
const uint32_t numberof_sections = this->binary_->header().numberof_sections();
const pe_section* sections = this->stream_->peek_array<pe_section>(sections_offset, numberof_sections, /* check */false);
if (sections == nullptr) {
- LOG(ERROR) << "Sections corrupted!";
+ LIEF_ERR("Section headers corrupted!");
return;
}
@@ -217,7 +228,9 @@ void Parser::parse_sections(void) {
uint32_t size_to_read = 0;
uint32_t offset = sections[i].PointerToRawData;
- first_section_offset = std::min(first_section_offset, offset);
+ if (offset > 0) {
+ first_section_offset = std::min(first_section_offset, offset);
+ }
if (sections[i].VirtualSize > 0) {
size_to_read = std::min(sections[i].VirtualSize, sections[i].SizeOfRawData); // According to Corkami
@@ -232,23 +245,47 @@ void Parser::parse_sections(void) {
if (size_to_read > Parser::MAX_DATA_SIZE) {
- LOG(WARNING) << "Section '" << section->name() << "' data is too large!";
+ LIEF_WARN("Data of section section '{}' is too large (0x{:x})", section->name(), size_to_read);
} else {
const uint8_t* ptr_to_rawdata = this->stream_->peek_array<uint8_t>(offset, size_to_read, /* check */false);
if (ptr_to_rawdata == nullptr) {
- LOG(ERROR) << "Section #" << std::dec << i << " corrupted!";
+ LIEF_ERR("Section #{:d} ({}) is corrupted", i, section->name());
} else {
section->content_ = {
ptr_to_rawdata,
ptr_to_rawdata + size_to_read
};
}
+ const uint64_t padding_size = section->size() - size_to_read;
+
+ // Treat content between two sections (that is not wrapped in a section) as 'padding'
+ uint64_t hole_size = 0;
+ if (i < numberof_sections - 1) {
+ const pe_section& next_section = sections[i + 1];
+ const uint64_t sec_offset = next_section.PointerToRawData;
+ if (offset + size_to_read + padding_size < sec_offset) {
+ hole_size = sec_offset - (offset + size_to_read + padding_size);
+ }
+ }
+ const uint8_t* ptr_to_padding = this->stream_->peek_array<uint8_t>(offset + size_to_read,
+ padding_size + hole_size,
+ /* check */false);
+ if (ptr_to_padding != nullptr) {
+ section->padding_ = {ptr_to_padding, ptr_to_padding + padding_size + hole_size};
+ }
}
this->binary_->sections_.push_back(section.release());
}
+
const uint32_t last_section_header_offset = sections_offset + numberof_sections * sizeof(pe_section);
+ const size_t padding_size = first_section_offset - last_section_header_offset;
+ const uint8_t* padding_ptr = this->stream_->peek_array<uint8_t>(last_section_header_offset, padding_size,
+ /* check */ false);
+ if (padding_ptr != nullptr) {
+ this->binary_->section_offset_padding_ = {padding_ptr, padding_ptr + padding_size};
+ }
this->binary_->available_sections_space_ = (first_section_offset - last_section_header_offset) / sizeof(pe_section) - 1;
- VLOG(VDEBUG) << "Number of sections that could be added: " << std::dec << this->binary_->available_sections_space_;
+ LIEF_DEBUG("Number of sections that could be added: #{:d}", this->binary_->available_sections_space_);
}
@@ -256,8 +293,7 @@ void Parser::parse_sections(void) {
// parse relocations
//
void Parser::parse_relocations(void) {
- VLOG(VDEBUG) << "[+] Parsing relocations";
-
+ LIEF_DEBUG("== Parsing relocations ==");
const uint32_t offset = this->binary_->rva_to_offset(
this->binary_->data_directory(DATA_DIRECTORY::BASE_RELOCATION_TABLE).RVA());
@@ -276,10 +312,10 @@ void Parser::parse_relocations(void) {
std::unique_ptr<Relocation> relocation{new Relocation{&relocation_headers}};
if (relocation_headers.BlockSize < sizeof(pe_base_relocation_block)) {
- LOG(ERROR) << "Relocation corrupted: BlockSize is too small";
+ LIEF_ERR("Relocation corrupted: BlockSize is too small");
break;
} else if (relocation_headers.BlockSize > this->binary_->optional_header().sizeof_image()) {
- LOG(ERROR) << "Relocation corrupted: BlockSize is out of bound the binary's virtual size";
+ LIEF_ERR("Relocation corrupted: BlockSize is out of bound the binary's virtual size");
break;
}
@@ -311,13 +347,13 @@ void Parser::parse_relocations(void) {
// parse ressources
//
void Parser::parse_resources(void) {
- VLOG(VDEBUG) << "[+] Parsing resources";
+ LIEF_DEBUG("== Parsing resources ==");
const uint32_t resources_rva = this->binary_->data_directory(DATA_DIRECTORY::RESOURCE_TABLE).RVA();
- VLOG(VDEBUG) << "Resources RVA: 0x" << std::hex << resources_rva;
+ LIEF_DEBUG("Resources RVA: 0x{:04x}", resources_rva);
const uint32_t offset = this->binary_->rva_to_offset(resources_rva);
- VLOG(VDEBUG) << "Resources Offset: 0x" << std::hex << offset;
+ LIEF_DEBUG("Resources Offset: 0x{:04x}", offset);
if (not this->stream_->can_read<pe_resource_directory_table>(offset)) {
return;
@@ -411,7 +447,7 @@ ResourceNode* Parser::parse_resource_node(
directory->childs_.push_back(node.release());
} else {
- LOG(WARNING) << "The leaf is corrupted";
+ LIEF_WARN("The leaf is corrupted");
break;
}
} else { // We are on a directory
@@ -420,7 +456,7 @@ ResourceNode* Parser::parse_resource_node(
if (this->stream_->can_read<pe_resource_directory_table>(offset)) {
const pe_resource_directory_table& nextDirectoryTable = this->stream_->peek<pe_resource_directory_table>(offset);
if (this->resource_visited_.count(offset) > 0) {
- LOG(WARNING) << "Infinite loop detected on resources";
+ LIEF_WARN("Infinite loop detected on resources");
break;
}
this->resource_visited_.insert(offset);
@@ -432,7 +468,7 @@ ResourceNode* Parser::parse_resource_node(
directory->childs_.push_back(node.release());
}
} else { // Corrupted
- LOG(WARNING) << "The directory is corrupted";
+ LIEF_WARN("The directory is corrupted");
break;
}
}
@@ -446,7 +482,7 @@ ResourceNode* Parser::parse_resource_node(
// parse string table
//
void Parser::parse_string_table(void) {
- VLOG(VDEBUG) << "[+] Parsing string table";
+ LIEF_DEBUG("== Parsing string table ==");
uint32_t string_table_offset =
this->binary_->header().pointerto_symbol_table() +
this->binary_->header().numberof_symbols() * STRUCT_SIZES::Symbol16Size;
@@ -470,7 +506,7 @@ void Parser::parse_string_table(void) {
// parse Symbols
//
void Parser::parse_symbols(void) {
- VLOG(VDEBUG) << "[+] Parsing symbols";
+ LIEF_DEBUG("== Parsing symbols ==");
uint32_t symbol_table_offset = this->binary_->header().pointerto_symbol_table();
uint32_t nb_symbols = this->binary_->header().numberof_symbols();
uint32_t current_offset = symbol_table_offset;
@@ -486,10 +522,9 @@ void Parser::parse_symbols(void) {
Symbol symbol{&raw_symbol};
const auto stream_max_size = this->stream_->size();
- std::string name;
if ((raw_symbol.Name.Name.Zeroes & 0xffff) != 0) {
std::string shortname{raw_symbol.Name.ShortName, sizeof(raw_symbol.Name.ShortName)};
- name = shortname.c_str();
+ symbol.name_ = shortname.c_str();
} else {
uint64_t offset_name =
this->binary_->header().pointerto_symbol_table() +
@@ -510,14 +545,14 @@ void Parser::parse_symbols(void) {
// * Section Number: > 0
if (symbol.storage_class() == SYMBOL_STORAGE_CLASS::IMAGE_SYM_CLASS_EXTERNAL and
symbol.type() == 0x20 and symbol.section_number() > 0) {
- VLOG(VDEBUG) << "Format1";
+ LIEF_DEBUG("Format1");
}
// Auxiliary Format 2: .bf and .ef Symbols
// * Storage class : FUNCTION
if (symbol.storage_class() == SYMBOL_STORAGE_CLASS::IMAGE_SYM_CLASS_FUNCTION) {
- VLOG(VDEBUG) << "Function";
+ LIEF_DEBUG("Function");
}
// Auxiliary Format 3: Weak Externals
@@ -526,21 +561,21 @@ void Parser::parse_symbols(void) {
// * Value : 0
if (symbol.storage_class() == SYMBOL_STORAGE_CLASS::IMAGE_SYM_CLASS_EXTERNAL and
symbol.value() == 0 and static_cast<SYMBOL_SECTION_NUMBER>(symbol.section_number()) == SYMBOL_SECTION_NUMBER::IMAGE_SYM_UNDEFINED) {
- VLOG(VDEBUG) << "Format 3";
+ LIEF_DEBUG("Format 3");
}
// Auxiliary Format 4: Files
// * Storage class : FILE
// * Name **SHOULD** be: .file
if (symbol.storage_class() == SYMBOL_STORAGE_CLASS::IMAGE_SYM_CLASS_FILE) {
- VLOG(VDEBUG) << "Format 4";
+ LIEF_DEBUG("Format 4");
//std::cout << reinterpret_cast<char*>(
}
// Auxiliary Format 5: Section Definitions
// * Storage class : STATIC
if (symbol.storage_class() == SYMBOL_STORAGE_CLASS::IMAGE_SYM_CLASS_STATIC) {
- VLOG(VDEBUG) << "Format 5";
+ LIEF_DEBUG("Format 5");
}
current_offset += STRUCT_SIZES::Symbol16Size;
@@ -560,7 +595,7 @@ void Parser::parse_symbols(void) {
//
void Parser::parse_debug(void) {
- VLOG(VDEBUG) << "[+] Parsing Debug";
+ LIEF_DEBUG("== Parsing Debug ==");
this->binary_->has_debug_ = true;
@@ -601,7 +636,7 @@ void Parser::parse_debug(void) {
}
void Parser::parse_debug_code_view(Debug& debug_info) {
- VLOG(VDEBUG) << "Parsing Debug Code View";
+ LIEF_DEBUG("Parsing Debug Code View");
//Debug& debug_info = this->binary_->debug();
const uint32_t debug_off = debug_info.pointerto_rawdata();
@@ -632,7 +667,7 @@ void Parser::parse_debug_code_view(Debug& debug_info) {
default:
{
- LOG(WARNING) << to_string(signature) << " is not implemented yet!";
+ LIEF_WARN("{} is not implemented yet!");
}
}
@@ -640,7 +675,7 @@ void Parser::parse_debug_code_view(Debug& debug_info) {
}
void Parser::parse_debug_pogo(Debug& debug_info) {
- VLOG(VDEBUG) << "Parsing Debug POGO";
+ LIEF_DEBUG("== Parsing Debug POGO ==");
const uint32_t debug_size = debug_info.sizeof_data();
const uint32_t debug_off = debug_info.pointerto_rawdata();
@@ -681,7 +716,7 @@ void Parser::parse_debug_pogo(Debug& debug_info) {
default:
{
- LOG(WARNING) << "PGO '" << to_string(signature) << "' is not implemented yet!";
+ LIEF_WARN("PGO: {} is not implemented yet!", to_string(signature));
}
}
}
@@ -690,7 +725,7 @@ void Parser::parse_debug_pogo(Debug& debug_info) {
// Parse Export
//
void Parser::parse_exports(void) {
- VLOG(VDEBUG) << "[+] Parsing exports";
+ LIEF_DEBUG("== Parsing exports ==");
static constexpr uint32_t NB_ENTRIES_LIMIT = 0x1000000;
static constexpr size_t MAX_EXPORT_NAME_SIZE = 300;
@@ -700,6 +735,7 @@ void Parser::parse_exports(void) {
std::pair<uint32_t, uint32_t> range = {exports_rva, exports_rva + exports_size};
if (not this->stream_->can_read<pe_export_directory_table>(exports_offset)) {
+ LIEF_WARN("Can't read export table at 0x{:x}", exports_offset);
return;
}
@@ -709,7 +745,13 @@ void Parser::parse_exports(void) {
Export export_object = &export_directory_table;
uint32_t name_offset = this->binary_->rva_to_offset(export_directory_table.NameRVA);
- export_object.name_ = this->stream_->peek_string_at(name_offset);
+ const std::string name = this->stream_->peek_string_at(name_offset, Parser::MAX_DLL_NAME_SIZE);
+ if (Parser::is_valid_dll_name(name)) {
+ export_object.name_ = std::move(name);
+ LIEF_DEBUG("Export name {}@0x{:x}", export_object.name_, name_offset);
+ } else {
+ LIEF_INFO("DLL name seems corrupted");
+ }
// Parse Ordinal name table
uint32_t ordinal_table_offset = this->binary_->rva_to_offset(export_directory_table.OrdinalTableRVA);
@@ -717,13 +759,14 @@ void Parser::parse_exports(void) {
const uint16_t *ordinal_table = this->stream_->peek_array<uint16_t>(ordinal_table_offset, nbof_name_ptr, /* check */false);
if (nbof_name_ptr > NB_ENTRIES_LIMIT) {
- LOG(ERROR) << "Too many name pointer entries (" << std::dec << nbof_name_ptr << ")";
+ LIEF_ERR("Too many name pointer entries: #{:d} (limit: {:d})",
+ nbof_name_ptr, NB_ENTRIES_LIMIT);
return;
}
// Parse Ordinal name table
if (ordinal_table == nullptr) {
- LOG(ERROR) << "Ordinal table corrupted";
+ LIEF_ERR("Ordinal table corrupted");
return;
}
@@ -733,19 +776,19 @@ void Parser::parse_exports(void) {
const uint32_t nbof_addr_entries = export_directory_table.AddressTableEntries;
if (nbof_addr_entries > NB_ENTRIES_LIMIT) {
- LOG(ERROR) << "Too many address entries (" << std::dec << nbof_addr_entries << ")";
+ LIEF_ERR("Too many name address entries: #{:d}", nbof_addr_entries);
return;
}
const uint32_t *address_table = this->stream_->peek_array<uint32_t>(address_table_offset, nbof_addr_entries, /* check */false);
if (address_table == nullptr) {
- LOG(ERROR) << "Address table corrupted";
+ LIEF_ERR("Address table corrupted");
return;
}
if (nbof_addr_entries < nbof_name_ptr) {
- LOG(ERROR) << "More exported names than addresses";
+ LIEF_ERR("More exported names than addresses");
return;
}
@@ -754,7 +797,7 @@ void Parser::parse_exports(void) {
const uint32_t *name_table = this->stream_->peek_array<uint32_t>(name_table_offset, nbof_name_ptr, /* check */false);
if (name_table == nullptr) {
- LOG(ERROR) << "Name table corrupted!";
+ LIEF_ERR("Name table corrupted!");
return;
}
@@ -796,7 +839,7 @@ void Parser::parse_exports(void) {
for (size_t i = 0; i < nbof_name_ptr; ++i) {
if (ordinal_table[i] >= export_object.entries_.size()) {
- LOG(ERROR) << "Export ordinal is outside the address table";
+ LIEF_ERR("Export ordinal is outside the address table");
break;
}
@@ -851,29 +894,51 @@ void Parser::parse_exports(void) {
}
void Parser::parse_signature(void) {
- VLOG(VDEBUG) << "[+] Parsing signature";
+ LIEF_DEBUG("== Parsing signature ==");
+ static constexpr size_t SIZEOF_HEADER = 8;
/*** /!\ In this data directory, RVA is used as an **OFFSET** /!\ ****/
/*********************************************************************/
const uint32_t signature_offset = this->binary_->data_directory(DATA_DIRECTORY::CERTIFICATE_TABLE).RVA();
const uint32_t signature_size = this->binary_->data_directory(DATA_DIRECTORY::CERTIFICATE_TABLE).size();
- VLOG(VDEBUG) << "Signature Offset: 0x" << std::hex << signature_offset;
- VLOG(VDEBUG) << "Signature Size: 0x" << std::hex << signature_size;
+ const uint64_t end_p = signature_offset + signature_size;
+ LIEF_DEBUG("Signature Offset: 0x{:04x}", signature_offset);
+ LIEF_DEBUG("Signature Size: 0x{:04x}", signature_size);
+
+ this->stream_->setpos(signature_offset);
+ while (this->stream_->pos() < end_p) {
+ const uint64_t current_p = this->stream_->pos();
+ auto length = this->stream_->read<uint32_t>();
+ if (length <= SIZEOF_HEADER) {
+ LIEF_WARN("The signature seems corrupted!");
+ break;
+ }
+ auto revision = this->stream_->read<uint16_t>();
+ auto certificate_type = this->stream_->read<uint16_t>();
+ LIEF_DEBUG("Signature {}r0x{:x} (0x{:x} bytes)", certificate_type, revision, length);
+ const uint8_t* data_ptr = this->stream_->read_array<uint8_t>(length - SIZEOF_HEADER, /* check */false);
+ if (data_ptr == nullptr) {
+ LIEF_INFO("Can't read 0x{:x} bytes", length);
+ break;
+ }
+ std::vector<uint8_t> raw_signature = {data_ptr, data_ptr + length - SIZEOF_HEADER};
+ auto sign = SignatureParser::parse(std::move(raw_signature));
- const uint8_t* signature_ptr = this->stream_->peek_array<uint8_t>(signature_offset, signature_size, /* check */false);
- if (signature_ptr == nullptr) {
- return;
+ if (sign) {
+ this->binary_->signatures_.push_back(std::move(sign.value()));
+ } else {
+ LIEF_INFO("Unable to parse the signature");
+ }
+ this->stream_->align(8);
+ if (this->stream_->pos() <= current_p) {
+ break;
+ }
}
- std::vector<uint8_t> raw_signature = {signature_ptr, signature_ptr + signature_size};
-
- //TODO: Deal with header (+8)
- this->binary_->signature_ = SignatureParser::parse(raw_signature);
- this->binary_->has_signature_ = true;
}
void Parser::parse_overlay(void) {
- VLOG(VDEBUG) << "Parsing Overlay";
+ LIEF_DEBUG("== Parsing Overlay ==");
const uint64_t last_section_offset = std::accumulate(
std::begin(this->binary_->sections_),
std::end(this->binary_->sections_), 0,
@@ -881,12 +946,12 @@ void Parser::parse_overlay(void) {
return std::max<uint64_t>(section->offset() + section->size(), offset);
});
- VLOG(VDEBUG) << "Overlay offset: 0x" << std::hex << last_section_offset;
+ LIEF_DEBUG("Overlay offset: 0x{:x}", last_section_offset);
if (last_section_offset < this->stream_->size()) {
const uint64_t overlay_size = this->stream_->size() - last_section_offset;
- VLOG(VDEBUG) << "Overlay size: " << std::dec << overlay_size;
+ LIEF_DEBUG("Overlay size: 0x{:x}", overlay_size);
const uint8_t* ptr_to_overlay = this->stream_->peek_array<uint8_t>(last_section_offset, overlay_size, /* check */false);
if (ptr_to_overlay != nullptr) {
@@ -894,6 +959,7 @@ void Parser::parse_overlay(void) {
ptr_to_overlay,
ptr_to_overlay + overlay_size
};
+ this->binary_->overlay_offset_ = last_section_offset;
}
} else {
this->binary_->overlay_ = {};
@@ -934,10 +1000,7 @@ bool Parser::is_valid_dll_name(const std::string& name) {
//! @brief Minimum size for a DLL's name
static constexpr unsigned MIN_DLL_NAME_SIZE = 4;
- // According to https://stackoverflow.com/a/265782/87207
- static constexpr unsigned MAX_DLL_NAME_SIZE = 255;
-
- if (name.size() < MIN_DLL_NAME_SIZE or name.size() > MAX_DLL_NAME_SIZE) {
+ if (name.size() < MIN_DLL_NAME_SIZE or name.size() > Parser::MAX_DLL_NAME_SIZE) {
return false;
}
diff --git a/src/PE/Parser.tcc b/src/PE/Parser.tcc
index b731f7be..f24cee1d 100644
--- a/src/PE/Parser.tcc
+++ b/src/PE/Parser.tcc
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -13,7 +13,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-#include "LIEF/logging++.hpp"
+#include "logging.hpp"
#include "LIEF/PE/LoadConfigurations.hpp"
#include "LoadConfigurations/LoadConfigurations.tcc"
@@ -28,31 +28,31 @@ void Parser::parse(void) {
return;
}
- VLOG(VDEBUG) << "[+] Retreive Dos stub";
+ LIEF_DEBUG("[+] Processing DOS stub & Rich header");
this->parse_dos_stub();
-
this->parse_rich_header();
- VLOG(VDEBUG) << "[+] Decomposing Sections";
+ LIEF_DEBUG("[+] Processing sections");
try {
this->parse_sections();
} catch (const corrupted& e) {
- LOG(WARNING) << e.what();
+ LIEF_WARN("{}", e.what());
}
- VLOG(VDEBUG) << "[+] Decomposing Data directories";
+ LIEF_DEBUG("[+] Processing data directories");
+
try {
this->parse_data_directories<PE_T>();
} catch (const exception& e) {
- LOG(WARNING) << e.what();
+ LIEF_WARN("{}", e.what());
}
try {
this->parse_symbols();
} catch (const corrupted& e) {
- LOG(WARNING) << e.what();
+ LIEF_WARN("{}", e.what());
}
this->parse_overlay();
@@ -66,7 +66,7 @@ bool Parser::parse_headers(void) {
if (this->stream_->can_read<pe_dos_header>(0)) {
this->binary_->dos_header_ = &this->stream_->peek<pe_dos_header>(0);
} else {
- LOG(FATAL) << "Dos Header corrupted";
+ LIEF_ERR("DOS Header corrupted");
return false;
}
@@ -76,7 +76,7 @@ bool Parser::parse_headers(void) {
if (this->stream_->can_read<pe_header>(pe32_header_off)) {
this->binary_->header_ = &this->stream_->peek<pe_header>(pe32_header_off);
} else {
- LOG(FATAL) << "PE32 Header corrupted";
+ LIEF_ERR("PE32 Header corrupted");
return false;
}
@@ -85,7 +85,7 @@ bool Parser::parse_headers(void) {
if (this->stream_->can_read<pe_optional_header>(optional_header_off)) {
this->binary_->optional_header_ = &this->stream_->peek<pe_optional_header>(optional_header_off);
} else {
- LOG(FATAL) << "Optional header corrupted";
+ LIEF_ERR("Optional header corrupted");
return false;
}
@@ -95,9 +95,6 @@ bool Parser::parse_headers(void) {
template<typename PE_T>
void Parser::parse_data_directories(void) {
using pe_optional_header = typename PE_T::pe_optional_header;
-
- VLOG(VDEBUG) << "[+] Parsing data directories";
-
const uint32_t directories_offset =
this->binary_->dos_header().addressof_new_exeheader() +
sizeof(pe_header) +
@@ -106,25 +103,28 @@ void Parser::parse_data_directories(void) {
const pe_data_directory* data_directory = this->stream_->peek_array<pe_data_directory>(directories_offset, nbof_datadir, /* check */false);
if (data_directory == nullptr) {
- LOG(ERROR) << "Data Directories corrupted!";
+ LIEF_ERR("Data Directories corrupted!");
return;
}
this->binary_->data_directories_.reserve(nbof_datadir);
- for (size_t i = 0; i < nbof_datadir; ++i) {
+ // WARNING: The PE specifications require that the data directory table ends with a null entry (RVA / Size,
+ // set to 0).
+ // Nevertheless it seems that this requirement is not enforced by the PE loader.
+ // The binary bc203f2b6a928f1457e9ca99456747bcb7adbbfff789d1c47e9479aac11598af contains a non-null final
+ // data directory (watermarking?)
+ for (size_t i = 0; i < (nbof_datadir + 1); ++i) {
std::unique_ptr<DataDirectory> directory{new DataDirectory{&data_directory[i], static_cast<DATA_DIRECTORY>(i)}};
-
- VLOG(VDEBUG) << "Processing directory: " << to_string(static_cast<DATA_DIRECTORY>(i));
- VLOG(VDEBUG) << "- RVA: 0x" << std::hex << data_directory[i].RelativeVirtualAddress;
- VLOG(VDEBUG) << "- Size: 0x" << std::hex << data_directory[i].Size;
+ LIEF_DEBUG("Processing directory #{:d} ()", i, to_string(static_cast<DATA_DIRECTORY>(i)));
+ LIEF_DEBUG(" - RVA: 0x{:04x}", data_directory[i].RelativeVirtualAddress);
+ LIEF_DEBUG(" - Size: 0x{:04x}", data_directory[i].Size);
if (directory->RVA() > 0) {
// Data directory is not always associated with section
const uint64_t offset = this->binary_->rva_to_offset(directory->RVA());
try {
directory->section_ = &(this->binary_->section_from_offset(offset));
} catch (const LIEF::not_found&) {
- LOG(WARNING) << "Unable to find the section associated with "
- << to_string(static_cast<DATA_DIRECTORY>(i));
+ LIEF_WARN("Unable to find the section associated with {}", to_string(static_cast<DATA_DIRECTORY>(i)));
}
}
this->binary_->data_directories_.push_back(directory.release());
@@ -133,7 +133,7 @@ void Parser::parse_data_directories(void) {
try {
// Import Table
if (this->binary_->data_directory(DATA_DIRECTORY::IMPORT_TABLE).RVA() > 0) {
- VLOG(VDEBUG) << "[+] Decomposing Import Table";
+ LIEF_DEBUG("Processing Import Table");
const uint32_t import_rva = this->binary_->data_directory(DATA_DIRECTORY::IMPORT_TABLE).RVA();
const uint64_t offset = this->binary_->rva_to_offset(import_rva);
@@ -141,22 +141,22 @@ void Parser::parse_data_directories(void) {
Section& section = this->binary_->section_from_offset(offset);
section.add_type(PE_SECTION_TYPES::IMPORT);
} catch (const not_found&) {
- LOG(WARNING) << "Unable to find the section associated with Import Table";
+ LIEF_WARN("Unable to find the section associated with Import Table");
}
this->parse_import_table<PE_T>();
}
} catch (const exception& e) {
- LOG(WARNING) << e.what();
+ LIEF_WARN("{}", e.what());
}
// Exports
if (this->binary_->data_directory(DATA_DIRECTORY::EXPORT_TABLE).RVA() > 0) {
- VLOG(VDEBUG) << "[+] Decomposing Exports";
+ LIEF_DEBUG("[+] Processing Exports");
try {
this->parse_exports();
} catch (const exception& e) {
- LOG(WARNING) << e.what();
+ LIEF_WARN("{}", e.what());
}
}
@@ -165,14 +165,14 @@ void Parser::parse_data_directories(void) {
try {
this->parse_signature();
} catch (const exception& e) {
- LOG(WARNING) << e.what();
+ LIEF_WARN("{}", e.what());
}
}
// TLS
if (this->binary_->data_directory(DATA_DIRECTORY::TLS_TABLE).RVA() > 0) {
- VLOG(VDEBUG) << "[+] Decomposing TLS";
+ LIEF_DEBUG("[+] Decomposing TLS");
const uint32_t tls_rva = this->binary_->data_directory(DATA_DIRECTORY::TLS_TABLE).RVA();
const uint64_t offset = this->binary_->rva_to_offset(tls_rva);
@@ -181,9 +181,9 @@ void Parser::parse_data_directories(void) {
section.add_type(PE_SECTION_TYPES::TLS);
this->parse_tls<PE_T>();
} catch (const not_found&) {
- LOG(WARNING) << "Unable to find the section associated with TLS";
+ LIEF_WARN("Unable to find the section associated with TLS");
} catch (const exception& e) {
- LOG(WARNING) << e.what();
+ LIEF_WARN("{}", e.what());
}
}
@@ -197,9 +197,9 @@ void Parser::parse_data_directories(void) {
section.add_type(PE_SECTION_TYPES::LOAD_CONFIG);
this->parse_load_config<PE_T>();
} catch (const not_found&) {
- LOG(WARNING) << "Unable to find the section associated with Load Config";
+ LIEF_WARN("Unable to find the section associated with Load Config");
} catch (const exception& e) {
- LOG(WARNING) << e.what();
+ LIEF_WARN("{}", e.what());
}
}
@@ -207,7 +207,7 @@ void Parser::parse_data_directories(void) {
// Relocations
if (this->binary_->data_directory(DATA_DIRECTORY::BASE_RELOCATION_TABLE).RVA() > 0) {
- VLOG(VDEBUG) << "[+] Decomposing relocations";
+ LIEF_DEBUG("[+] Decomposing relocations");
const uint32_t relocation_rva = this->binary_->data_directory(DATA_DIRECTORY::BASE_RELOCATION_TABLE).RVA();
const uint64_t offset = this->binary_->rva_to_offset(relocation_rva);
try {
@@ -215,9 +215,9 @@ void Parser::parse_data_directories(void) {
section.add_type(PE_SECTION_TYPES::RELOCATION);
this->parse_relocations();
} catch (const not_found&) {
- LOG(WARNING) << "Unable to find the section associated with relocations";
+ LIEF_WARN("Unable to find the section associated with relocations");
} catch (const exception& e) {
- LOG(WARNING) << e.what();
+ LIEF_WARN("{}", e.what());
}
}
@@ -225,7 +225,7 @@ void Parser::parse_data_directories(void) {
// Debug
if (this->binary_->data_directory(DATA_DIRECTORY::DEBUG).RVA() > 0) {
- VLOG(VDEBUG) << "[+] Decomposing debug";
+ LIEF_DEBUG("[+] Decomposing debug");
const uint32_t rva = this->binary_->data_directory(DATA_DIRECTORY::DEBUG).RVA();
const uint64_t offset = this->binary_->rva_to_offset(rva);
try {
@@ -233,9 +233,9 @@ void Parser::parse_data_directories(void) {
section.add_type(PE_SECTION_TYPES::DEBUG);
this->parse_debug();
} catch (const not_found&) {
- LOG(WARNING) << "Unable to find the section associated with debug";
+ LIEF_WARN("Unable to find the section associated with debug");
} catch (const exception& e) {
- LOG(WARNING) << e.what();
+ LIEF_WARN("{}", e.what());
}
}
@@ -243,7 +243,7 @@ void Parser::parse_data_directories(void) {
// Resources
if (this->binary_->data_directory(DATA_DIRECTORY::RESOURCE_TABLE).RVA() > 0) {
- VLOG(VDEBUG) << "[+] Decomposing resources";
+ LIEF_DEBUG("[+] Decomposing resources");
const uint32_t resources_rva = this->binary_->data_directory(DATA_DIRECTORY::RESOURCE_TABLE).RVA();
const uint64_t offset = this->binary_->rva_to_offset(resources_rva);
try {
@@ -251,9 +251,9 @@ void Parser::parse_data_directories(void) {
section.add_type(PE_SECTION_TYPES::RESOURCE);
this->parse_resources();
} catch (const not_found&) {
- LOG(WARNING) << "Unable to find the section associated with resources";
+ LIEF_WARN("Unable to find the section associated with resources");
} catch (const exception& e) {
- LOG(WARNING) << e.what();
+ LIEF_WARN("{}", e.what());
}
}
@@ -281,7 +281,7 @@ void Parser::parse_import_table(void) {
import.type_ = this->type_;
if (import.name_RVA_ == 0) {
- LOG(WARNING) << "Name's RVA is null";
+ LIEF_DEBUG("Name's RVA is null");
break;
}
@@ -372,7 +372,7 @@ void Parser::parse_tls(void) {
using pe_tls = typename PE_T::pe_tls;
using uint__ = typename PE_T::uint;
- VLOG(VDEBUG) << "[+] Parsing TLS";
+ LIEF_DEBUG("[+] Parsing TLS");
const uint32_t tls_rva = this->binary_->data_directory(DATA_DIRECTORY::TLS_TABLE).RVA();
const uint64_t offset = this->binary_->rva_to_offset(tls_rva);
@@ -391,8 +391,6 @@ void Parser::parse_tls(void) {
if (tls_header.RawDataStartVA >= imagebase and tls_header.RawDataEndVA > tls_header.RawDataStartVA) {
- CHECK(tls_header.RawDataStartVA >= imagebase);
- CHECK(tls_header.RawDataEndVA >= imagebase);
const uint64_t start_data_rva = tls_header.RawDataStartVA - imagebase;
const uint64_t stop_data_rva = tls_header.RawDataEndVA - imagebase;
@@ -402,11 +400,11 @@ void Parser::parse_tls(void) {
const size_t size_to_read = end_template_offset - start_template_offset;
if (size_to_read > Parser::MAX_DATA_SIZE) {
- LOG(WARNING) << "TLS's template is too large!";
+ LIEF_DEBUG("TLS's template is too large!");
} else {
const uint8_t* template_ptr = this->stream_->peek_array<uint8_t>(start_template_offset, size_to_read, /* check */false);
if (template_ptr == nullptr) {
- LOG(WARNING) << "TLS's template corrupted";
+ LIEF_WARN("TLS's template corrupted");
} else {
tls.data_template({
template_ptr,
@@ -435,7 +433,7 @@ void Parser::parse_tls(void) {
Section& section = this->binary_->section_from_offset(offset);
tls.section_ = &section;
} catch (const not_found&) {
- LOG(WARNING) << "No section associated with TLS";
+ LIEF_WARN("No section associated with TLS");
}
this->binary_->has_tls_ = true;
@@ -454,7 +452,7 @@ void Parser::parse_load_config(void) {
using load_configuration_v6_t = typename PE_T::load_configuration_v6_t;
using load_configuration_v7_t = typename PE_T::load_configuration_v7_t;
- VLOG(VDEBUG) << "[+] Parsing Load Config";
+ LIEF_DEBUG("[+] Parsing Load Config");
const uint32_t directory_size = this->binary_->data_directory(DATA_DIRECTORY::LOAD_CONFIG_TABLE).size();
@@ -467,8 +465,8 @@ void Parser::parse_load_config(void) {
const uint32_t size_from_header = this->stream_->peek<uint32_t>(offset);
if (directory_size != size_from_header) {
- LOG(WARNING) << "The size of directory '" << to_string(DATA_DIRECTORY::LOAD_CONFIG_TABLE)
- << "' is different from the size in the load configuration header";
+ LIEF_DEBUG("The size of directory '{}' is different from the size in the load configuration header",
+ to_string(DATA_DIRECTORY::LOAD_CONFIG_TABLE));
}
const uint32_t size = std::min<uint32_t>(directory_size, size_from_header);
@@ -480,7 +478,7 @@ void Parser::parse_load_config(void) {
}
}
- VLOG(VDEBUG) << "Version found: " << std::dec << to_string(version_found) << "(Size: 0x" << std::hex << size << ")";
+ LIEF_DEBUG("Version found: {} (size: 0x{:x})", to_string(version_found), size);;
std::unique_ptr<LoadConfiguration> ld_conf;
switch (version_found) {
diff --git a/src/PE/Pogo.cpp b/src/PE/Pogo.cpp
index 6f287699..093a7616 100644
--- a/src/PE/Pogo.cpp
+++ b/src/PE/Pogo.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -21,6 +21,7 @@
#include "LIEF/PE/EnumToString.hpp"
#include "LIEF/PE/Pogo.hpp"
+#include "LIEF/PE/PogoEntry.hpp"
namespace LIEF {
namespace PE {
@@ -35,8 +36,8 @@ Pogo::Pogo(void) :
Pogo::Pogo(POGO_SIGNATURES signature, const std::vector<PogoEntry>& entries) :
- signature_{signature},
- entries_{entries}
+ signature_{signature},
+ entries_{entries}
{}
Pogo* Pogo::clone(void) const {
diff --git a/src/PE/PogoEntry.cpp b/src/PE/PogoEntry.cpp
index 83c96d7e..36bfb811 100644
--- a/src/PE/PogoEntry.cpp
+++ b/src/PE/PogoEntry.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@
#include "LIEF/PE/hash.hpp"
#include "LIEF/PE/EnumToString.hpp"
-#include "LIEF/PE/Pogo.hpp"
+#include "LIEF/PE/PogoEntry.hpp"
namespace LIEF {
namespace PE {
diff --git a/src/PE/Relocation.cpp b/src/PE/Relocation.cpp
index 869592f5..6ae6a655 100644
--- a/src/PE/Relocation.cpp
+++ b/src/PE/Relocation.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,7 +17,9 @@
#include "LIEF/PE/hash.hpp"
+#include "LIEF/PE/Structures.hpp"
#include "LIEF/PE/Relocation.hpp"
+#include "LIEF/PE/RelocationEntry.hpp"
namespace LIEF {
namespace PE {
diff --git a/src/PE/RelocationEntry.cpp b/src/PE/RelocationEntry.cpp
index 0f3be727..466c06e4 100644
--- a/src/PE/RelocationEntry.cpp
+++ b/src/PE/RelocationEntry.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -15,7 +15,7 @@
*/
#include <iomanip>
-#include "LIEF/logging++.hpp"
+#include "logging.hpp"
#include "LIEF/PE/hash.hpp"
@@ -111,7 +111,7 @@ uint64_t RelocationEntry::address(void) const {
}
void RelocationEntry::address(uint64_t /*address*/) {
- LOG(WARNING) << "Setting address of a PE relocation is not implemented!";
+ LIEF_WARN("Setting address of a PE relocation is not implemented!");
}
size_t RelocationEntry::size(void) const {
@@ -145,7 +145,7 @@ size_t RelocationEntry::size(void) const {
return 0;
}
void RelocationEntry::size(size_t /*size*/) {
- LOG(WARNING) << "Setting size of a PE relocation is not implemented!";
+ LIEF_WARN("Setting size of a PE relocation is not implemented!");
}
diff --git a/src/PE/ResourceData.cpp b/src/PE/ResourceData.cpp
index 5fde9411..c9d68653 100644
--- a/src/PE/ResourceData.cpp
+++ b/src/PE/ResourceData.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/ResourceDirectory.cpp b/src/PE/ResourceDirectory.cpp
index 6ea02e89..1c34d047 100644
--- a/src/PE/ResourceDirectory.cpp
+++ b/src/PE/ResourceDirectory.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,6 +17,7 @@
#include "LIEF/PE/hash.hpp"
+#include "LIEF/PE/Structures.hpp"
#include "LIEF/PE/ResourceDirectory.hpp"
namespace LIEF {
diff --git a/src/PE/ResourceNode.cpp b/src/PE/ResourceNode.cpp
index c3b7b0c9..45ec784b 100644
--- a/src/PE/ResourceNode.cpp
+++ b/src/PE/ResourceNode.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -18,7 +18,6 @@
#include "LIEF/PE/hash.hpp"
-#include "LIEF/PE/utils.hpp"
#include "LIEF/utils.hpp"
#include "LIEF/PE/ResourceNode.hpp"
diff --git a/src/PE/ResourcesManager.cpp b/src/PE/ResourcesManager.cpp
index fb16f86d..33b05964 100644
--- a/src/PE/ResourcesManager.cpp
+++ b/src/PE/ResourcesManager.cpp
@@ -1,5 +1,6 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
+ * Copyright 2017 - 2021 K. Nakagawa
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,9 +18,7 @@
#include <iomanip>
#include <numeric>
-#include "rang.hpp"
-
-#include "LIEF/logging++.hpp"
+#include "logging.hpp"
#include "LIEF/exception.hpp"
#include "LIEF/PE/hash.hpp"
@@ -32,8 +31,11 @@
#include "LIEF/PE/ResourcesManager.hpp"
#include "LIEF/PE/ResourceData.hpp"
+#include "LIEF/PE/ResourceDirectory.hpp"
#include "LIEF/PE/resources/LangCodeItem.hpp"
+#include "LIEF/PE/resources/ResourceStringTable.hpp"
+#include "LIEF/PE/resources/ResourceAccelerator.hpp"
namespace LIEF {
namespace PE {
@@ -57,7 +59,7 @@ RESOURCE_SUBLANGS ResourcesManager::sublang_from_id(size_t id) {
}
RESOURCE_SUBLANGS ResourcesManager::sub_lang(RESOURCE_LANGS lang, size_t index) {
- // From https://msdn.microsoft.com/en-us/library/windows/desktop/dd318693(v=vs.85).aspx
+ // From https://docs.microsoft.com/en-us/windows/win32/intl/language-identifier-constants-and-strings
static const std::map<std::pair<RESOURCE_LANGS, size_t>, RESOURCE_SUBLANGS> sublangs_map = {
{ {RESOURCE_LANGS::LANG_ARABIC, 0x5}, RESOURCE_SUBLANGS::SUBLANG_ARABIC_ALGERIA },
@@ -351,7 +353,6 @@ std::string ResourcesManager::manifest(void) const {
}
it_childs childs_l2 = childs_l1[0].childs();
-
if (childs_l2.size() < 1) {
throw not_found("Manifest corrupted");
}
@@ -429,11 +430,11 @@ ResourceVersion ResourcesManager::version(void) const {
stream.setpos(0);
// Size of the current "struct"
const uint16_t length = stream.read<uint16_t>();
- VLOG(VDEBUG) << "Lenght of the struct: 0x" << std::hex << length;
+ LIEF_DEBUG("Lenght of the struct: 0x{:x}", length);
// Size of the fixed file info struct
const uint16_t value_length = stream.read<uint16_t>();
- VLOG(VDEBUG) << "Size of the 'FixedFileInfo' struct" << std::hex << value_length;
+ LIEF_DEBUG("Size of the 'FixedFileInfo' struct 0x{:x}", value_length);
// Type of the data in the version resource
// 1: Text data
@@ -441,14 +442,14 @@ ResourceVersion ResourcesManager::version(void) const {
const uint16_t type = stream.read<uint16_t>();
version.type_ = type;
if (type != 0 and type != 1) {
- LOG(WARNING) << "\"type\" of the resource version should be equal to 0 or 1 (" << std::dec << type << ")";
+ LIEF_WARN("\"type\" of the resource version should be equal to 0 or 1 ({:d})", type);
}
// Magic key: VS_VERSION_INFO
std::u16string key = stream.read_u16string();
if (u16tou8(key, true) != "VS_VERSION_INFO") {
- LOG(WARNING) << "\"key\" of the resource version should be equal to 'VS_VERSION_INFO' (" << u16tou8(key) << ")";
+ LIEF_WARN("\"key\" of the resource version should be equal to 'VS_VERSION_INFO' ({})", u16tou8(key));
}
version.key_ = key;
@@ -458,27 +459,27 @@ ResourceVersion ResourcesManager::version(void) const {
if (value_length == sizeof(pe_resource_fixed_file_info)) {
const pe_resource_fixed_file_info* fixed_file_info_header = &stream.peek<pe_resource_fixed_file_info>();
if (fixed_file_info_header->signature != 0xFEEF04BD) {
- LOG(WARNING) << "Bad magic value for the Fixed file info structure";
+ LIEF_WARN("Bad magic value for the Fixed file info structure");
} else {
version.fixed_file_info_ = ResourceFixedFileInfo{fixed_file_info_header};
version.has_fixed_file_info_ = true;
}
} else {
- LOG(WARNING) << "The 'value' member contains an unknown structure";
+ LIEF_WARN("The 'value' member contains an unknown structure");
}
stream.increment_pos(value_length * sizeof(uint8_t));
}
stream.align(sizeof(uint32_t));
if (!stream.can_read<uint16_t>()) {
- VLOG(VDEBUG) << "There is no entry";
+ LIEF_DEBUG("There is no entry");
return version;
}
{ // First entry
- VLOG(VDEBUG) << "Parsing first entry";
+ LIEF_DEBUG("Parsing first entry");
const uint16_t struct_file_info_length = stream.peek<uint16_t>();
- VLOG(VDEBUG) << "Length: " << std::hex << struct_file_info_length;
+ LIEF_DEBUG("Length: 0x{:x}", struct_file_info_length);
const size_t start = stream.pos();
@@ -486,19 +487,19 @@ ResourceVersion ResourcesManager::version(void) const {
stream.increment_pos(sizeof(uint16_t));
const uint16_t struct_length = stream.read<uint16_t>();
- VLOG(VDEBUG) << "Lenght of the struct: 0x" << std::hex << struct_length;
+ LIEF_DEBUG("Lenght of the struct: 0x{:x}", struct_length);
const uint16_t type = stream.read<uint16_t>();
- VLOG(VDEBUG) << "Type of the struct: " << std::dec << type;
+ LIEF_DEBUG("Type of the struct: {:d}", type);
std::u16string key = stream.read_u16string();
- VLOG(VDEBUG) << "First entry (key) " << u16tou8(key);
+ LIEF_DEBUG("First entry (key) {}", u16tou8(key));
if (u16tou8(key, true) == "StringFileInfo") {
try {
version.string_file_info_ = this->get_string_file_info(stream, type, key, start, struct_file_info_length);
version.has_string_file_info_ = true;
} catch (const LIEF::exception& e) {
- LOG(ERROR) << e.what();
+ LIEF_ERR("{}", e.what());
}
}
@@ -507,7 +508,7 @@ ResourceVersion ResourcesManager::version(void) const {
version.var_file_info_ = this->get_var_file_info(stream, type, key, start, struct_file_info_length);
version.has_var_file_info_ = true;
} catch (const LIEF::exception& e) {
- LOG(ERROR) << e.what();
+ LIEF_ERR("{}", e.what());
}
}
}
@@ -516,9 +517,9 @@ ResourceVersion ResourcesManager::version(void) const {
{ // Second entry
- VLOG(VDEBUG) << "Parsing second entry";
+ LIEF_DEBUG("Parsing second entry");
const uint16_t struct_file_info_length = stream.peek<uint16_t>();
- VLOG(VDEBUG) << "Length: " << std::hex << struct_file_info_length;
+ LIEF_DEBUG("Length: 0x{:x}", struct_file_info_length);
const size_t start = stream.pos();
@@ -526,21 +527,21 @@ ResourceVersion ResourcesManager::version(void) const {
stream.increment_pos(sizeof(uint16_t));
const uint16_t struct_length = stream.read<uint16_t>();
- VLOG(VDEBUG) << "Lenght of the struct: 0x" << std::hex << struct_length;
+ LIEF_DEBUG("Lenght of the struct: 0x{:x}", struct_length);
const uint16_t type = stream.read<uint16_t>();
- VLOG(VDEBUG) << "Type of the struct: " << std::dec << type;
+ LIEF_DEBUG("Type of the struct: {:d}", type);
std::u16string key = stream.read_u16string();
stream.align(sizeof(uint32_t));
- VLOG(VDEBUG) << "Second entry (key) " << u16tou8(key);
+ LIEF_DEBUG("Second entry (key) {}", u16tou8(key));
if (u16tou8(key, true) == "StringFileInfo") {
try {
version.string_file_info_ = this->get_string_file_info(stream, type, key, start, struct_file_info_length);
version.has_string_file_info_ = true;
} catch (const LIEF::exception& e) {
- LOG(ERROR) << e.what();
+ LIEF_ERR("{}", e.what());
}
}
@@ -549,7 +550,7 @@ ResourceVersion ResourcesManager::version(void) const {
version.var_file_info_ = this->get_var_file_info(stream, type, key, start, struct_file_info_length);
version.has_var_file_info_ = true;
} catch (const LIEF::exception& e) {
- LOG(ERROR) << e.what();
+ LIEF_ERR("{}", e.what());
}
}
}
@@ -560,7 +561,7 @@ ResourceVersion ResourcesManager::version(void) const {
ResourceStringFileInfo ResourcesManager::get_string_file_info(const VectorStream& stream, uint16_t type, std::u16string key, size_t start, size_t struct_length) const {
- VLOG(VDEBUG) << "Getting StringFileInfo object";
+ LIEF_DEBUG("Getting StringFileInfo object");
// String File Info
// ================
@@ -572,7 +573,7 @@ ResourceStringFileInfo ResourcesManager::get_string_file_info(const VectorStream
// Parse 'StringTable' childs
// ==========================
- VLOG(VDEBUG) << "Parsing 'StringTable' struct";
+ LIEF_DEBUG("Parsing 'StringTable' struct");
const size_t end_string_stable = start + struct_length * sizeof(uint8_t);
while (stream.pos() < end_string_stable) {
@@ -585,32 +586,37 @@ ResourceStringFileInfo ResourcesManager::get_string_file_info(const VectorStream
const uint16_t stringtable_value_length = stream.read<uint16_t>();
- VLOG(VDEBUG) << "Value length: " << std::dec << stringtable_value_length << " (should be 0)";
+ LIEF_DEBUG("Value length: {:d} (should be 0)", stringtable_value_length);
const uint16_t stringtable_type = stream.read<uint16_t>();
- VLOG(VDEBUG) << "Type: " << std::dec << stringtable_type;
+ LIEF_DEBUG("Type: {:d}", stringtable_type);
// 1: Text data
// 0: Binary data
if (type != 0 and type != 1) {
- LOG(WARNING) << "\"type\" of the StringTable should be equal to 0 or 1 (" << std::dec << type << ")";
+ LIEF_WARN("\"type\" of the StringTable should be equal to 0 or 1 ({:d})", type);
}
lang_code_item.type_ = type;
std::u16string key = stream.read_u16string();
lang_code_item.key_ = key;
- VLOG(VDEBUG) << "ID: " << u16tou8(key);
+ LIEF_DEBUG("ID: {}", u16tou8(key));
std::string key_str = u16tou8(key);
if (key.length() != 8) {
- LOG(ERROR) << "Corrupted key (" << u16tou8(key) << key_str << ")";
+ LIEF_ERR("Corrupted key ({} {})", u16tou8(key), key_str);
} else {
- uint64_t lang_id = std::stoul(u16tou8(key.substr(0, 4)), 0, 16);
- uint64_t code_page = std::stoul(u16tou8(key.substr(4, 8)), 0, 16);
- VLOG(VDEBUG) << "Lang ID: " << std::dec << lang_id;
- VLOG(VDEBUG) << "Code page: " << std::hex << code_page;
+ try {
+ uint64_t lang_id = std::stoul(u16tou8(key.substr(0, 4)), 0, 16);
+ uint64_t code_page = std::stoul(u16tou8(key.substr(4, 8)), 0, 16);
+ LIEF_DEBUG("Lang ID: {:d}", lang_id);
+ LIEF_DEBUG("Code page: 0x{:x}", code_page);
+ } catch (const std::invalid_argument& e) {
+ LIEF_WARN("Cannot convert to integer");
+ LIEF_WARN("This PE file has Invalid Lang ID or Code page");
+ }
}
stream.align(sizeof(uint32_t));
@@ -621,24 +627,24 @@ ResourceStringFileInfo ResourcesManager::get_string_file_info(const VectorStream
const size_t string_offset = stream.pos();
const uint16_t string_length = stream.read<uint16_t>();
- VLOG(VDEBUG) << "Length of the 'string' struct: 0x" << std::hex << string_length;
+ LIEF_DEBUG("Length of the 'string' struct: 0x{:x}", string_length);
const uint16_t string_value_length = stream.read<uint16_t>();
- VLOG(VDEBUG) << "Size of the 'value' member: 0x" << std::hex << string_value_length;
+ LIEF_DEBUG("Size of the 'value' member: 0x{:x}", string_value_length);
const uint16_t string_type = stream.read<uint16_t>();
- VLOG(VDEBUG) << "Type of the 'string' struct: " << std::dec << string_type;
+ LIEF_DEBUG("Type of the 'string' struct: {:d}", string_type);
std::u16string key = stream.read_u16string();
- VLOG(VDEBUG) << "Key: " << u16tou8(key);
+ LIEF_DEBUG("Key: {}", u16tou8(key));
stream.align(sizeof(uint32_t));
std::u16string value;
if (string_value_length > 0 && stream.pos() < string_offset + string_length) {
value = stream.read_u16string();
- VLOG(VDEBUG) << "Value: " << u16tou8(value);
+ LIEF_DEBUG("Value: {}", u16tou8(value));
} else {
- VLOG(VDEBUG) << "Value: (empty)";
+ LIEF_DEBUG("Value: (empty)");
}
const size_t expected_end = string_offset + string_length;
@@ -657,7 +663,7 @@ ResourceStringFileInfo ResourcesManager::get_string_file_info(const VectorStream
ResourceVarFileInfo ResourcesManager::get_var_file_info(const VectorStream& stream, uint16_t type, std::u16string key, size_t start, size_t struct_length) const {
- VLOG(VDEBUG) << "Getting VarFileInfo object";
+ LIEF_DEBUG("Getting VarFileInfo object");
// Var file info
// =============
ResourceVarFileInfo var_file_info;
@@ -667,33 +673,33 @@ ResourceVarFileInfo ResourcesManager::get_var_file_info(const VectorStream& stre
// Parse 'Var' childs
// ==================
- VLOG(VDEBUG) << "Parsing 'Var' childs";
+ LIEF_DEBUG("Parsing 'Var' childs");
const size_t end_var_file_info = start + struct_length * sizeof(uint8_t);
while (stream.pos() < end_var_file_info) {
const uint16_t var_length = stream.read<uint16_t>();
- VLOG(VDEBUG) << "Size of the 'Var' struct: 0x" << std::hex << var_length;
+ LIEF_DEBUG("Size of the 'Var' struct: 0x{:d}", var_length);
const uint16_t var_value_length = stream.read<uint16_t>();
- VLOG(VDEBUG) << "Size of the 'Value' member: 0x" << std::hex << var_value_length;
+ LIEF_DEBUG("Size of the 'Value' member: 0x{:x}", var_value_length);
const uint16_t var_type = stream.read<uint16_t>();
- VLOG(VDEBUG) << "Type: " << std::dec << var_type;
+ LIEF_DEBUG("Type: {:d}", var_type);
std::u16string key = stream.read_u16string();
if (u16tou8(key) != "Translation") {
- LOG(WARNING) << "\"key\" of the var key should be equal to 'Translation' (" << u16tou8(key) << ")";
+ LIEF_WARN("\"key\" of the var key should be equal to 'Translation' ({})", u16tou8(key));
}
stream.align(sizeof(uint32_t));
const size_t nb_items = var_value_length / sizeof(uint32_t);
const uint32_t *value_array = stream.read_array<uint32_t>(nb_items, /* check */false);
if (value_array == nullptr) {
- LOG(ERROR) << "Unable to read items";
+ LIEF_ERR("Unable to read items");
return var_file_info;
}
for (size_t i = 0; i < nb_items; ++i) {
- VLOG(VDEBUG) << "item[" << std::dec << i << "] = " << std::hex << value_array[i];
+ LIEF_DEBUG("item[{:02d} = 0x{:x}", i, value_array[i]);
var_file_info.translations_.push_back(value_array[i]);
}
}
@@ -766,20 +772,20 @@ std::vector<ResourceIcon> ResourcesManager::icons(void) const {
for (const ResourceNode& grp_icon_lvl3 : grp_icon_lvl2.childs()) {
const ResourceData* icon_group_node = dynamic_cast<const ResourceData*>(&grp_icon_lvl3);
if (!icon_group_node) {
- LOG(ERROR) << "Group icon node is null";
+ LIEF_WARN("Group icon node is null");
continue;
}
const std::vector<uint8_t>& icon_group_content = icon_group_node->content();
if (icon_group_content.empty()) {
- LOG(ERROR) << "Group icon is empty";
+ LIEF_WARN("Group icon is empty");
continue;
}
const pe_resource_icon_dir* group_icon_header = reinterpret_cast<const pe_resource_icon_dir*>(icon_group_content.data());
- VLOG(VDEBUG) << "Number of icons: " << std::dec << static_cast<uint32_t>(group_icon_header->count);
- VLOG(VDEBUG) << "Type: " << std::dec << static_cast<uint32_t>(group_icon_header->type);
+ LIEF_DEBUG("Number of icons: {:d}", static_cast<uint32_t>(group_icon_header->count));
+ LIEF_DEBUG("Type: {:d}", static_cast<uint32_t>(group_icon_header->type));
// Some checks
if (group_icon_header->type != 1) {
@@ -812,12 +818,12 @@ std::vector<ResourceIcon> ResourcesManager::icons(void) const {
});
if (it_icon_dir == std::end(sub_nodes_icons)) {
- LOG(ERROR) << "Unable to find the icon associated with id: " << std::to_string(id);
+ LIEF_WARN("Unable to find the icon associated with id: {:d}", id);
continue;
}
it_childs icons_childs = it_icon_dir->childs();
if (icons_childs.size() < 1) {
- LOG(ERROR) << "Resources nodes loooks corrupted";
+ LIEF_WARN("Resources nodes loooks corrupted");
continue;
}
const std::vector<uint8_t>& pixels = dynamic_cast<const ResourceData*>(&icons_childs[0])->content();
@@ -955,7 +961,7 @@ void ResourcesManager::change_icon(const ResourceIcon& original, const ResourceI
i * sizeof(pe_resource_icon_group));
if (icon_header->ID == original.id()) {
- VLOG(VDEBUG) << "Group found: " << std::dec << i << "-nth";
+ LIEF_DEBUG("Group found: {:d}-nth", i);
group = icon_header;
icon_header->width = newone.width();
icon_header->height = newone.height();
@@ -991,9 +997,8 @@ void ResourcesManager::change_icon(const ResourceIcon& original, const ResourceI
// Dialogs
// See:
-// * https://msdn.microsoft.com/en-us/library/ms645398.aspx
-// * https://msdn.microsoft.com/en-us/library/ms645389.aspx
-// * https://blogs.msdn.microsoft.com/oldnewthing/20110330-00/?p=11093
+// * https://docs.microsoft.com/en-us/windows/win32/dlgbox/dlgtemplateex
+// * https://docs.microsoft.com/en-us/windows/win32/dlgbox/dlgitemtemplateex
// TODO:
// * Menu as ordinal
// * Windows class as ordinal
@@ -1011,7 +1016,7 @@ std::vector<ResourceDialog> ResourcesManager::dialogs(void) const {
const ResourceDirectory* dialog = dynamic_cast<const ResourceDirectory*>(&nodes[i]);
if (!dialog) {
- LOG(WARNING) << "Dialog is empty. Skipping";
+ LIEF_WARN("Dialog is empty. Skipping");
continue;
}
it_const_childs langs = dialog->childs();
@@ -1019,7 +1024,7 @@ std::vector<ResourceDialog> ResourcesManager::dialogs(void) const {
for (size_t j = 0; j < langs.size(); ++j) {
const ResourceData* data_node = dynamic_cast<const ResourceData*>(&langs[j]);
if (!data_node) {
- LOG(WARNING) << "Dialog is empty. Skipping";
+ LIEF_WARN("Dialog is empty. Skipping");
continue;
}
const std::vector<uint8_t>& content = data_node->content();
@@ -1027,14 +1032,14 @@ std::vector<ResourceDialog> ResourcesManager::dialogs(void) const {
stream.setpos(0);
if (content.size() < std::min(sizeof(pe_dialog_template_ext), sizeof(pe_dialog_template))) {
- LOG(WARNING) << "Dialog is corrupted!";
+ LIEF_WARN("Dialog is corrupted!");
return {};
}
if (content[2] == 0xFF and content[3] == 0xFF) {
if (content.size() < sizeof(pe_dialog_template_ext)) {
- LOG(WARNING) << "Dialog is corrupted!";
+ LIEF_WARN("Dialog is corrupted!");
return {};
}
@@ -1050,20 +1055,20 @@ std::vector<ResourceDialog> ResourcesManager::dialogs(void) const {
switch(menu_hint) {
case 0x0000:
{
- VLOG(VDEBUG) << "Dialog has not menu";
+ LIEF_DEBUG("Dialog has not menu");
break;
}
case 0xFFFF:
{
const uint16_t menu_ordinal = stream.read<uint16_t>();
- VLOG(VDEBUG) << "Menu uses ordinal number " << std::dec << menu_ordinal;
+ LIEF_DEBUG("Menu uses ordinal number {:d}", menu_ordinal);
break;
}
default:
{
- VLOG(VDEBUG) << "Menu uses unicode string";
+ LIEF_DEBUG("Menu uses unicode string");
std::u16string menu_name = stream.read_u16string();
}
}
@@ -1078,20 +1083,20 @@ std::vector<ResourceDialog> ResourcesManager::dialogs(void) const {
switch(window_class_hint) {
case 0x0000:
{
- VLOG(VDEBUG) << "Windows class uses predefined dialog box";
+ LIEF_DEBUG("Windows class uses predefined dialog box");
break;
}
case 0xFFFF:
{
const uint16_t windows_class_ordinal = stream.read<uint16_t>();
- VLOG(VDEBUG) << "Windows class uses ordinal number " << std::dec << windows_class_ordinal;
+ LIEF_DEBUG("Windows class uses ordinal number {:d}", windows_class_ordinal);
break;
}
default:
{
- VLOG(VDEBUG) << "Windows class uses unicode string";
+ LIEF_DEBUG("Windows class uses unicode string");
std::u16string window_class_name = stream.read_u16string();
}
}
@@ -1099,7 +1104,7 @@ std::vector<ResourceDialog> ResourcesManager::dialogs(void) const {
// Title
// =====
stream.align(sizeof(uint16_t));
- VLOG(VDEBUG) << "Title offset: " << std::hex << stream.pos();
+ LIEF_DEBUG("Title offset: 0x{:x}", stream.pos());
new_dialog.title_ = stream.read_u16string();
// 2nd part
@@ -1121,20 +1126,20 @@ std::vector<ResourceDialog> ResourcesManager::dialogs(void) const {
new_dialog.typeface_ = stream.read_u16string();
}
- VLOG(VDEBUG) << "Offset to the items: 0x" << std::hex << stream.pos();
- VLOG(VDEBUG) << std::endl << std::endl << "####### Items #######" << std::endl;
+ LIEF_DEBUG("Offset to the items: 0x{:x}", stream.pos());
+ LIEF_DEBUG("\n\n####### Items #######\n");
// Items
// =====
for (size_t i = 0; i < header->nbof_items; ++i) {
stream.align(sizeof(uint32_t));
- VLOG(VDEBUG) << "item[" << std::dec << i << "] offset: " << std::hex << stream.pos();
+ LIEF_DEBUG("item[{:02d}] offset: 0x{:x}", i, stream.pos());
ResourceDialogItem dialog_item;
if (new_dialog.is_extended()) {
const pe_dialog_item_template_ext* item_header = &stream.read<pe_dialog_item_template_ext>();
dialog_item = item_header;
- VLOG(VDEBUG) << "Item ID: " << std::dec << item_header->id;
+ LIEF_DEBUG("Item ID: {:d}", item_header->id);
} else {
const pe_dialog_item_template* item_header = &stream.read<pe_dialog_item_template>();
new_dialog.items_.emplace_back(item_header);
@@ -1149,11 +1154,11 @@ std::vector<ResourceDialog> ResourcesManager::dialogs(void) const {
if (window_class_hint == 0xFFFF) {
stream.increment_pos(sizeof(uint16_t));
const uint16_t windows_class_ordinal = stream.read<uint16_t>();
- VLOG(VDEBUG) << "Windows class uses ordinal number " << std::dec << windows_class_ordinal;
+ LIEF_DEBUG("Windows class uses ordinal number {:d}", windows_class_ordinal);
} else {
- VLOG(VDEBUG) << "Windows class uses unicode string";
+ LIEF_DEBUG("Windows class uses unicode string");
std::u16string window_class_name = stream.read_u16string();
- VLOG(VDEBUG) << "[DEBUG] " << u16tou8(window_class_name);
+ LIEF_DEBUG("{}", u16tou8(window_class_name));
}
// Title
@@ -1163,17 +1168,17 @@ std::vector<ResourceDialog> ResourcesManager::dialogs(void) const {
if (title_hint == 0xFFFF) {
stream.increment_pos(sizeof(uint16_t));
const uint16_t title_ordinal = stream.read<uint16_t>();
- VLOG(VDEBUG) << "Title uses ordinal number " << std::dec << title_ordinal;
+ LIEF_DEBUG("Title uses ordinal number {:d}", title_ordinal);
} else {
std::u16string title_name = stream.read_u16string();
- VLOG(VDEBUG) << "Title uses unicode string: \"" << u16tou8(title_name) << "\"";
+ LIEF_DEBUG("Title uses unicode string: '{}'", u16tou8(title_name));
dialog_item.title_ = title_name;
}
// Extra count
// -----------
const uint16_t extra_count = stream.read<uint16_t>();
- VLOG(VDEBUG) << "Extra count: " << std::hex << extra_count << std::endl;
+ LIEF_DEBUG("Extra count: 0x{:x}", extra_count);
dialog_item.extra_count_ = extra_count;
stream.increment_pos(extra_count * sizeof(uint8_t));
new_dialog.items_.push_back(std::move(dialog_item));
@@ -1191,12 +1196,153 @@ bool ResourcesManager::has_dialogs(void) const {
return this->has_type(RESOURCE_TYPES::DIALOG);
}
+// String table entry
+std::vector<ResourceStringTable> ResourcesManager::string_table(void) const {
+ it_childs nodes = this->resources_->childs();
+ auto&& it_string_table = std::find_if(
+ std::begin(nodes),
+ std::end(nodes),
+ [] (const ResourceNode& node) {
+ return static_cast<RESOURCE_TYPES>(node.id()) == RESOURCE_TYPES::STRING;
+ }
+ );
+
+ if (it_string_table == std::end(nodes)) {
+ throw not_found(std::string("Missing '") + to_string(RESOURCE_TYPES::STRING) + "' entry");
+ }
+
+ std::vector<ResourceStringTable> string_table;
+ for (const ResourceNode& child_l1 : it_string_table->childs()) {
+
+ for (const ResourceNode& child_l2 : child_l1.childs()) {
+ const ResourceData* string_table_node = dynamic_cast<const ResourceData*>(&child_l2);
+ if (!string_table_node) {
+ LIEF_ERR("String table node is null");
+ continue;
+ }
+
+ const std::vector<uint8_t>& content = string_table_node->content();
+ if (content.empty()) {
+ LIEF_ERR("String table content is empty");
+ continue;
+ }
+
+ const auto content_size = content.size();
+ VectorStream stream{content};
+ stream.setpos(0);
+ LIEF_DEBUG("Will parse content whoose size is {}", content_size);
+ while (stream.pos() < content_size) {
+ if (not stream.can_read<int16_t>()) break;
+
+ const auto len = stream.read<uint16_t>();
+ if (len > 0 && ((len * 2) < content_size)) {
+ const auto name = stream.read_u16string(len);
+ string_table.emplace_back(ResourceStringTable(len, name));
+ }
+ }
+ }
+
+ }
+
+ return string_table;
+}
+
+bool ResourcesManager::has_string_table(void) const {
+ return this->has_type(RESOURCE_TYPES::STRING);
+}
+
+std::vector<std::string> ResourcesManager::html(void) const {
+ it_childs nodes = this->resources_->childs();
+ auto&& it_html = std::find_if(
+ std::begin(nodes),
+ std::end(nodes),
+ [] (const ResourceNode& node) {
+ return static_cast<RESOURCE_TYPES>(node.id()) == RESOURCE_TYPES::HTML;
+ }
+ );
+
+ if (it_html == std::end(nodes)) {
+ throw not_found(std::string("Missing '") + to_string(RESOURCE_TYPES::HTML) + "' entry");
+ }
+
+ std::vector<std::string> html;
+ for (const ResourceNode& child_l1 : it_html->childs()) {
+ for (const ResourceNode& child_l2 : child_l1.childs()) {
+ const ResourceData* html_node = dynamic_cast<const ResourceData*>(&child_l2);
+ if (!html_node) {
+ LIEF_ERR("html node is null");
+ continue;
+ }
+
+ const std::vector<uint8_t>& content = html_node->content();
+ if (content.empty()) {
+ LIEF_ERR("html content is empty");
+ continue;
+ }
+
+ html.push_back(std::string{std::begin(content), std::end(content)});
+ }
+ }
+
+ return html;
+}
+
+bool ResourcesManager::has_html(void) const {
+ return this->has_type(RESOURCE_TYPES::HTML);
+}
+
+bool ResourcesManager::has_accelerator(void) const {
+ return this->has_type(RESOURCE_TYPES::ACCELERATOR);
+}
+
+std::vector<ResourceAccelerator> ResourcesManager::accelerator(void) const {
+ it_childs nodes = this->resources_->childs();
+ auto&& it_accelerator = std::find_if(
+ std::begin(nodes),
+ std::end(nodes),
+ [] (const ResourceNode& node) {
+ return static_cast<RESOURCE_TYPES>(node.id()) == RESOURCE_TYPES::ACCELERATOR;
+ }
+ );
+
+ if (it_accelerator == std::end(nodes)) {
+ throw not_found(std::string("Missing '") + to_string(RESOURCE_TYPES::ACCELERATOR) + "' entry");
+ }
+
+ std::vector<ResourceAccelerator> accelerator;
+ for (const ResourceNode& child_l1 : it_accelerator->childs()) {
+ for (const ResourceNode& child_l2 : child_l1.childs()) {
+ const ResourceData* accelerator_node = dynamic_cast<const ResourceData*>(&child_l2);
+ if (!accelerator_node) {
+ LIEF_ERR("Accelerator");
+ continue;
+ }
+
+ const std::vector<uint8_t>& content = accelerator_node->content();
+ if (content.empty()) {
+ LIEF_ERR("Accelerator content is empty");
+ continue;
+ }
+
+ VectorStream stream{content};
+ while (stream.can_read<pe_resource_acceltableentry>()) {
+ accelerator.emplace_back(
+ ResourceAccelerator(&stream.read<const pe_resource_acceltableentry>()));
+ }
+ if ((accelerator.back().flags() & int16_t(ACCELERATOR_FLAGS::END)) != int16_t(ACCELERATOR_FLAGS::END)) {
+ LIEF_ERR("Accelerator resource may be corrupted");
+ }
+ }
+ }
+
+ return accelerator;
+}
+
// Prints
// ======
std::string ResourcesManager::print(uint32_t depth) const {
std::ostringstream oss;
- oss << rang::control::forceColor;
uint32_t current_depth = 0;
this->print_tree(*this->resources_, oss, current_depth, depth);
return oss.str();
@@ -1216,21 +1362,16 @@ void ResourcesManager::print_tree(
output << std::string(2 * (current_depth + 1), ' ');
output << "[";
if (child_node.is_directory()) {
- output << rang::fg::cyan;
output << "Directory";
} else {
- output << rang::fg::yellow;
output << "Data";
}
- output << rang::style::reset;
output << "] ";
if (child_node.has_name()) {
- output << rang::bg::blue;
output << u16tou8(child_node.name());
- output << rang::style::reset;
} else {
output << "ID: " << std::setw(2) << std::setfill('0') << std::dec << child_node.id();
if (current_depth == 0) {
@@ -1320,7 +1461,7 @@ std::ostream& operator<<(std::ostream& os, const ResourcesManager& rsrc) {
try {
os << rsrc.version();
} catch (const exception& e) {
- LOG(WARNING) << e.what();
+ LIEF_WARN("{}", e.what());
}
os << std::endl;
}
@@ -1333,7 +1474,7 @@ std::ostream& operator<<(std::ostream& os, const ResourcesManager& rsrc) {
os << icons[i] << std::endl;
}
} catch (const exception& e) {
- LOG(WARNING) << e.what();
+ LIEF_WARN("{}", e.what());
}
}
@@ -1346,7 +1487,7 @@ std::ostream& operator<<(std::ostream& os, const ResourcesManager& rsrc) {
os << dialogs[i] << std::endl;
}
} catch (const exception& e) {
- LOG(WARNING) << e.what();
+ LIEF_WARN("{}", e.what());
}
}
diff --git a/src/PE/RichEntry.cpp b/src/PE/RichEntry.cpp
index ec5cd583..c5cc797c 100644
--- a/src/PE/RichEntry.cpp
+++ b/src/PE/RichEntry.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/RichHeader.cpp b/src/PE/RichHeader.cpp
index 14d3199d..158d085d 100644
--- a/src/PE/RichHeader.cpp
+++ b/src/PE/RichHeader.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/Section.cpp b/src/PE/Section.cpp
index a4883cb8..a1164241 100644
--- a/src/PE/Section.cpp
+++ b/src/PE/Section.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -13,11 +13,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-#include <stdexcept>
-#include <string.h>
#include <iomanip>
-#include <functional>
-#include <algorithm>
#include <numeric>
#include <iterator>
@@ -26,6 +22,7 @@
#include "LIEF/Abstract/Section.hpp"
+#include "LIEF/PE/Structures.hpp"
#include "LIEF/PE/Section.hpp"
#include "LIEF/PE/EnumToString.hpp"
@@ -34,36 +31,25 @@ namespace PE {
Section::~Section(void) = default;
-Section::Section(void) :
- LIEF::Section{},
- virtualSize_{0},
- content_{},
- pointerToRelocations_{0},
- pointerToLineNumbers_{0},
- numberOfRelocations_{0},
- numberOfLineNumbers_{0},
- characteristics_{0},
- types_{PE_SECTION_TYPES::UNKNOWN}
-{}
+Section::Section(void) = default;
Section& Section::operator=(const Section&) = default;
Section::Section(const Section&) = default;
Section::Section(const pe_section* header) :
- virtualSize_{header->VirtualSize},
- pointerToRelocations_{header->PointerToRelocations},
- pointerToLineNumbers_{header->PointerToLineNumbers},
- numberOfRelocations_{header->NumberOfRelocations},
- numberOfLineNumbers_{header->NumberOfLineNumbers},
+ virtual_size_{header->VirtualSize},
+ pointer_to_relocations_{header->PointerToRelocations},
+ pointer_to_linenumbers_{header->PointerToLineNumbers},
+ number_of_relocations_{header->NumberOfRelocations},
+ number_of_linenumbers_{header->NumberOfLineNumbers},
characteristics_{header->Characteristics},
types_{PE_SECTION_TYPES::UNKNOWN}
{
- this->name_ = std::string(header->Name, sizeof(header->Name)).c_str();
+ this->name_ = std::string(header->Name, sizeof(header->Name));
this->virtual_address_ = header->VirtualAddress;
this->size_ = header->SizeOfRawData;
this->offset_ = header->PointerToRawData;
-
}
Section::Section(const std::vector<uint8_t>& data, const std::string& name, uint32_t characteristics) :
@@ -83,7 +69,7 @@ Section::Section(const std::string& name) :
uint32_t Section::virtual_size(void) const {
- return this->virtualSize_;
+ return this->virtual_size_;
}
@@ -106,20 +92,20 @@ uint32_t Section::pointerto_raw_data(void) const {
uint32_t Section::pointerto_relocation(void) const {
- return this->pointerToRelocations_;
+ return this->pointer_to_relocations_;
}
uint32_t Section::pointerto_line_numbers(void) const {
- return this->pointerToLineNumbers_;
+ return this->pointer_to_linenumbers_;
}
uint16_t Section::numberof_relocations(void) const {
- return this->numberOfRelocations_;
+ return this->number_of_relocations_;
}
uint16_t Section::numberof_line_numbers(void) const {
- return this->numberOfLineNumbers_;
+ return this->number_of_linenumbers_;
}
uint32_t Section::characteristics(void) const {
@@ -167,7 +153,7 @@ void Section::content(const std::vector<uint8_t>& data) {
void Section::virtual_size(uint32_t virtualSize) {
- this->virtualSize_ = virtualSize;
+ this->virtual_size_ = virtualSize;
}
@@ -177,22 +163,22 @@ void Section::pointerto_raw_data(uint32_t pointerToRawData) {
void Section::pointerto_relocation(uint32_t pointerToRelocation) {
- this->pointerToRelocations_ = pointerToRelocation;
+ this->pointer_to_relocations_ = pointerToRelocation;
}
void Section::pointerto_line_numbers(uint32_t pointerToLineNumbers) {
- this->pointerToLineNumbers_ = pointerToLineNumbers;
+ this->pointer_to_linenumbers_ = pointerToLineNumbers;
}
void Section::numberof_relocations(uint16_t numberOfRelocations) {
- this->numberOfRelocations_ = numberOfRelocations;
+ this->number_of_relocations_ = numberOfRelocations;
}
void Section::numberof_line_numbers(uint16_t numberOfLineNumbers) {
- this->numberOfLineNumbers_ = numberOfLineNumbers;
+ this->number_of_linenumbers_ = numberOfLineNumbers;
}
void Section::sizeof_raw_data(uint32_t sizeOfRawData) {
diff --git a/src/PE/Symbol.cpp b/src/PE/Symbol.cpp
index 18601487..0d0fc3d6 100644
--- a/src/PE/Symbol.cpp
+++ b/src/PE/Symbol.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -21,6 +21,7 @@
#include "LIEF/exception.hpp"
#include "LIEF/PE/Symbol.hpp"
+#include "LIEF/PE/Section.hpp"
#include "LIEF/PE/EnumToString.hpp"
namespace LIEF {
diff --git a/src/PE/TLS.cpp b/src/PE/TLS.cpp
index 222794de..387c2b8a 100644
--- a/src/PE/TLS.cpp
+++ b/src/PE/TLS.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -15,10 +15,12 @@
*/
#include <iomanip>
-#include "LIEF/PE/hash.hpp"
#include "LIEF/exception.hpp"
+#include "LIEF/PE/hash.hpp"
+#include "LIEF/PE/Structures.hpp"
#include "LIEF/PE/TLS.hpp"
+#include "LIEF/PE/Section.hpp"
namespace LIEF {
namespace PE {
diff --git a/src/PE/hash.cpp b/src/PE/hash.cpp
index d81b7b39..d6a5329a 100644
--- a/src/PE/hash.cpp
+++ b/src/PE/hash.cpp
@@ -1,5 +1,6 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
+ * Copyright 2017 - 2021 K. Nakagawa
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -340,7 +341,7 @@ void Hash::visit(const LangCodeItem& resource_lci) {
this->process(resource_lci.type());
this->process(resource_lci.key());
- for (const std::pair<std::u16string, std::u16string>& p : resource_lci.items()) {
+ for (const std::pair<const std::u16string, std::u16string>& p : resource_lci.items()) {
this->process(p.first);
this->process(p.second);
}
@@ -423,18 +424,27 @@ void Hash::visit(const ResourceDialogItem& dialog_item) {
}
}
-void Hash::visit(const Signature& signature) {
+void Hash::visit(const ResourceStringTable& string_table) {
+ this->process(string_table.length());
+ this->process(string_table.name());
+}
+void Hash::visit(const ResourceAccelerator& accelerator) {
+ this->process(accelerator.flags());
+ this->process(accelerator.ansi());
+ this->process(accelerator.id());
+ this->process(accelerator.padding());
+}
+
+void Hash::visit(const Signature& signature) {
this->process(signature.version());
this->process(signature.digest_algorithm());
this->process(signature.content_info());
this->process(std::begin(signature.certificates()), std::end(signature.certificates()));
- this->process(signature.signer_info());
- this->process(signature.original_signature());
+ this->process(std::begin(signature.signers()), std::end(signature.signers()));
}
void Hash::visit(const x509& x509) {
-
this->process(x509.subject());
this->process(x509.issuer());
this->process(x509.valid_to());
@@ -447,19 +457,64 @@ void Hash::visit(const x509& x509) {
void Hash::visit(const SignerInfo& signerinfo) {
this->process(signerinfo.version());
- //this->process(signerinfo.issuer());
+ this->process(signerinfo.serial_number());
+ this->process(signerinfo.issuer());
+ this->process(signerinfo.encryption_algorithm());
this->process(signerinfo.digest_algorithm());
- this->process(signerinfo.authenticated_attributes());
- this->process(signerinfo.signature_algorithm());
this->process(signerinfo.encrypted_digest());
+ this->process(std::begin(signerinfo.authenticated_attributes()), std::end(signerinfo.authenticated_attributes()));
+ this->process(std::begin(signerinfo.unauthenticated_attributes()), std::end(signerinfo.unauthenticated_attributes()));
+}
+
+void Hash::visit(const Attribute& attr) {
+ this->process(attr.type());
+}
+
+void Hash::visit(const ContentInfo& info) {
+ this->process(info.content_type());
+ this->process(info.digest_algorithm());
+ this->process(info.digest());
+ this->process(info.file());
}
-void Hash::visit(const AuthenticatedAttributes& auth) {
- this->process(auth.content_type());
- this->process(auth.message_digest());
- this->process(u16tou8(auth.program_name()));
- this->process(auth.more_info());
+void Hash::visit(const ContentType& attr) {
+ this->visit(*attr.as<Attribute>());
+ this->process(attr.oid());
+}
+void Hash::visit(const GenericType& attr) {
+ this->visit(*attr.as<Attribute>());
+ this->process(attr.raw_content());
+ this->process(attr.oid());
+}
+void Hash::visit(const MsSpcNestedSignature& attr) {
+ this->visit(*attr.as<Attribute>());
+ this->process(attr.sig());
+}
+void Hash::visit(const MsSpcStatementType& attr) {
+ this->visit(*attr.as<Attribute>());
+ this->process(attr.oid());
+}
+void Hash::visit(const PKCS9AtSequenceNumber& attr) {
+ this->visit(*attr.as<Attribute>());
+ this->process(attr.number());
+}
+void Hash::visit(const PKCS9CounterSignature& attr) {
+ this->visit(*attr.as<Attribute>());
+ this->process(attr.signer());
+}
+void Hash::visit(const PKCS9MessageDigest& attr) {
+ this->visit(*attr.as<Attribute>());
+ this->process(attr.digest());
+}
+void Hash::visit(const PKCS9SigningTime& attr) {
+ this->visit(*attr.as<Attribute>());
+ this->process(attr.time());
+}
+void Hash::visit(const SpcSpOpusInfo& attr) {
+ this->visit(*attr.as<Attribute>());
+ this->process(attr.program_name());
+ this->process(attr.more_info());
}
void Hash::visit(const CodeIntegrity& code_integrity) {
diff --git a/src/PE/json.cpp b/src/PE/json.cpp
index 49ee0d38..76c46f33 100644
--- a/src/PE/json.cpp
+++ b/src/PE/json.cpp
@@ -1,5 +1,6 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
+ * Copyright 2017 - 2021 K. Nakagawa
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -14,12 +15,15 @@
* limitations under the License.
*/
-#include "LIEF/logging++.hpp"
+#include "logging.hpp"
-#include "LIEF/PE/json.hpp"
#include "LIEF/hash.hpp"
+
+#include "LIEF/PE/json.hpp"
#include "LIEF/PE.hpp"
+#include "Object.tcc"
+
namespace LIEF {
namespace PE {
@@ -163,11 +167,25 @@ void JsonVisitor::visit(const Binary& binary) {
}
- // Signature
- if (binary.has_signature()) {
+ // Signatures
+ std::vector<json> sigs;
+ if (binary.has_signatures()) {
+ for (const Signature& sig : binary.signatures()) {
+ JsonVisitor visitor;
+ visitor(sig);
+ sigs.push_back(std::move(visitor.get()));
+ }
+ this->node_["signatures"] = sigs;
+ }
+
+ std::vector<json> symbols;
+ for (const Symbol& symbol : binary.symbols()) {
JsonVisitor visitor;
- visitor(binary.signature());
- this->node_["signature"] = visitor.get();
+ visitor(symbol);
+ symbols.emplace_back(visitor.get());
+ }
+ if (!symbols.empty()) {
+ this->node_["symbols"] = symbols;
}
// Load Configuration
@@ -372,7 +390,7 @@ void JsonVisitor::visit(const Symbol& symbol) {
this->node_["value"] = symbol.value();
this->node_["size"] = symbol.size();
- this->node_["name"] = symbol.name();
+ this->node_["name"] = escape_non_ascii(symbol.name());
this->node_["section_number"] = symbol.section_number();
this->node_["type"] = symbol.type();
@@ -512,7 +530,19 @@ void JsonVisitor::visit(const ResourcesManager& resources_manager) {
try {
this->node_["manifest"] = escape_non_ascii(resources_manager.manifest()) ;
} catch (const LIEF::exception& e) {
- LOG(WARNING) << e.what();
+ LIEF_WARN("{}", e.what());
+ }
+ }
+
+ if (resources_manager.has_html()) {
+ try {
+ std::vector<std::string> escaped_strs;
+ for (const auto& elem : resources_manager.html()) {
+ escaped_strs.emplace_back(escape_non_ascii(elem));
+ }
+ this->node_["html"] = escaped_strs;
+ } catch (const LIEF::exception& e) {
+ LIEF_WARN("{}", e.what());
}
}
@@ -522,7 +552,7 @@ void JsonVisitor::visit(const ResourcesManager& resources_manager) {
version_visitor(resources_manager.version());
this->node_["version"] = version_visitor.get();
} catch (const LIEF::exception& e) {
- LOG(WARNING) << e.what();
+ LIEF_WARN("{}", e.what());
}
}
@@ -536,7 +566,7 @@ void JsonVisitor::visit(const ResourcesManager& resources_manager) {
}
this->node_["icons"] = icons;
} catch (const LIEF::exception& e) {
- LOG(WARNING) << e.what();
+ LIEF_WARN("{}", e.what());
}
}
@@ -550,7 +580,35 @@ void JsonVisitor::visit(const ResourcesManager& resources_manager) {
}
this->node_["dialogs"] = dialogs;
} catch (const LIEF::exception& e) {
- LOG(WARNING) << e.what();
+ LIEF_WARN("{}", e.what());
+ }
+ }
+
+ if (resources_manager.has_string_table()) {
+ std::vector<json> string_table_json;
+ try {
+ for (const ResourceStringTable& string_table : resources_manager.string_table()) {
+ JsonVisitor string_table_visitor;
+ string_table_visitor(string_table);
+ string_table_json.emplace_back(string_table_visitor.get());
+ }
+ this->node_["string_table"] = string_table_json;
+ } catch (const LIEF::exception& e) {
+ LIEF_WARN("{}", e.what());
+ }
+ }
+
+ if (resources_manager.has_accelerator()) {
+ std::vector<json> accelerator_json;
+ try {
+ for (const ResourceAccelerator& acc : resources_manager.accelerator()) {
+ JsonVisitor accelerator_visitor;
+ accelerator_visitor(acc);
+ accelerator_json.emplace_back(accelerator_visitor.get());
+ }
+ this->node_["accelerator"] = accelerator_json;
+ } catch (const LIEF::exception& e) {
+ LIEF_WARN("{}", e.what());
}
}
}
@@ -693,25 +751,46 @@ void JsonVisitor::visit(const ResourceDialogItem& dialog_item) {
}
+void JsonVisitor::visit(const ResourceStringTable& string_table) {
+ this->node_["length"] = string_table.length();
+ this->node_["name"] = u16tou8(string_table.name());
+}
+
+void JsonVisitor::visit(const ResourceAccelerator& acc) {
+ std::vector<json> flags;
+ for (const ACCELERATOR_FLAGS c : acc.flags_list()) {
+ flags.emplace_back(to_string(c));
+ }
+ this->node_["flags"] = flags;
+ this->node_["ansi"] = acc.ansi_str();
+ this->node_["id"] = acc.id();
+ this->node_["padding"] = acc.padding();
+}
+
void JsonVisitor::visit(const Signature& signature) {
JsonVisitor content_info_visitor;
content_info_visitor(signature.content_info());
- JsonVisitor signer_info_visitor;
- signer_info_visitor(signature.signer_info());
+ std::vector<json> jsigners;
+ for (const SignerInfo& signer : signature.signers()) {
+ JsonVisitor visitor;
+ visitor(signer);
+ jsigners.emplace_back(std::move(visitor.get()));
+ }
std::vector<json> crts;
for (const x509& crt : signature.certificates()) {
JsonVisitor crt_visitor;
crt_visitor(crt);
- crts.emplace_back(crt_visitor.get());
+ crts.emplace_back(std::move(crt_visitor.get()));
}
- this->node_["version"] = signature.version();
- this->node_["content_info"] = content_info_visitor.get();
- this->node_["signer_info"] = signer_info_visitor.get();
- this->node_["certificates"] = crts;
+ this->node_["digest_algorithm"] = to_string(signature.digest_algorithm());
+ this->node_["version"] = signature.version();
+ this->node_["content_info"] = content_info_visitor.get();
+ this->node_["signer_info"] = jsigners;
+ this->node_["certificates"] = crts;
}
void JsonVisitor::visit(const x509& x509) {
@@ -725,27 +804,89 @@ void JsonVisitor::visit(const x509& x509) {
}
void JsonVisitor::visit(const SignerInfo& signerinfo) {
- JsonVisitor authenticated_attributes_visitor;
- authenticated_attributes_visitor(signerinfo.authenticated_attributes());
+ std::vector<json> auth_attrs;
+ for (const Attribute& attr : signerinfo.authenticated_attributes()) {
+ JsonVisitor visitor;
+ visitor(attr);
+ auth_attrs.emplace_back(std::move(visitor.get()));
+ }
- this->node_["version"] = signerinfo.version();
- this->node_["digest_algorithm"] = signerinfo.digest_algorithm();
- this->node_["signature_algorithm"] = signerinfo.signature_algorithm();
- this->node_["authenticated_attributes"] = authenticated_attributes_visitor.get();
- this->node_["issuer"] = std::get<0>(signerinfo.issuer());
+ std::vector<json> unauth_attrs;
+ for (const Attribute& attr : signerinfo.unauthenticated_attributes()) {
+ JsonVisitor visitor;
+ visitor(attr);
+ auth_attrs.emplace_back(std::move(visitor.get()));
+ }
+
+ this->node_["version"] = signerinfo.version();
+ this->node_["digest_algorithm"] = to_string(signerinfo.digest_algorithm());
+ this->node_["encryption_algorithm"] = to_string(signerinfo.encryption_algorithm());
+ this->node_["encrypted_digest"] = signerinfo.encrypted_digest();
+ this->node_["issuer"] = signerinfo.issuer();
+ this->node_["serial_number"] = signerinfo.serial_number();
+ this->node_["authenticated_attributes"] = auth_attrs;
+ this->node_["unauthenticated_attributes"] = unauth_attrs;
}
void JsonVisitor::visit(const ContentInfo& contentinfo) {
this->node_["content_type"] = contentinfo.content_type();
- this->node_["type"] = contentinfo.type();
- this->node_["digest_algorithm"] = contentinfo.digest_algorithm();
+ this->node_["digest_algorithm"] = to_string(contentinfo.digest_algorithm());
+ this->node_["digest"] = contentinfo.digest();
+ this->node_["file"] = contentinfo.file();
+}
+
+void JsonVisitor::visit(const Attribute& auth) {
+ this->node_["type"] = to_string(auth.type());
+}
+
+void JsonVisitor::visit(const ContentType& attr) {
+ this->visit(*attr.as<Attribute>());
+ this->node_["oid"] = attr.oid();
+}
+
+void JsonVisitor::visit(const GenericType& attr) {
+ this->visit(*attr.as<Attribute>());
+ this->node_["oid"] = attr.oid();
+}
+
+void JsonVisitor::visit(const MsSpcNestedSignature& attr) {
+ this->visit(*attr.as<Attribute>());
+ JsonVisitor visitor;
+ visitor(attr.sig());
+ this->node_["signature"] = std::move(visitor.get());
+}
+
+void JsonVisitor::visit(const MsSpcStatementType& attr) {
+ this->visit(*attr.as<Attribute>());
+ this->node_["oid"] = attr.oid();
+}
+
+void JsonVisitor::visit(const PKCS9AtSequenceNumber& attr) {
+ this->visit(*attr.as<Attribute>());
+ this->node_["number"] = attr.number();
+}
+void JsonVisitor::visit(const PKCS9CounterSignature& attr) {
+ this->visit(*attr.as<Attribute>());
+
+ JsonVisitor visitor;
+ visitor(attr.signer());
+ this->node_["signer"] = std::move(visitor.get());
+}
+
+void JsonVisitor::visit(const PKCS9MessageDigest& attr) {
+ this->visit(*attr.as<Attribute>());
+ this->node_["digest"] = attr.digest();
+}
+
+void JsonVisitor::visit(const PKCS9SigningTime& attr) {
+ this->visit(*attr.as<Attribute>());
+ this->node_["time"] = attr.time();
}
-void JsonVisitor::visit(const AuthenticatedAttributes& auth) {
- this->node_["content_type"] = auth.content_type();
- this->node_["program_name"] = u16tou8(auth.program_name());
- this->node_["url"] = auth.more_info();
- this->node_["message_digest"] = auth.message_digest();
+void JsonVisitor::visit(const SpcSpOpusInfo& attr) {
+ this->visit(*attr.as<Attribute>());
+ this->node_["more_info"] = attr.more_info();
+ this->node_["program_name"] = attr.program_name();
}
void JsonVisitor::visit(const CodeIntegrity& code_integrity) {
diff --git a/src/PE/resources/LangCodeItem.cpp b/src/PE/resources/LangCodeItem.cpp
index ec9f7434..70e5d69c 100644
--- a/src/PE/resources/LangCodeItem.cpp
+++ b/src/PE/resources/LangCodeItem.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -20,10 +20,10 @@
#include "LIEF/PE/hash.hpp"
#include "LIEF/utils.hpp"
-#include "LIEF/PE/utils.hpp"
#include "LIEF/PE/EnumToString.hpp"
#include "LIEF/PE/resources/LangCodeItem.hpp"
+#include "LIEF/PE/ResourcesManager.hpp"
namespace LIEF {
namespace PE {
@@ -78,12 +78,12 @@ RESOURCE_SUBLANGS LangCodeItem::sublang(void) const {
}
-const std::map<std::u16string, std::u16string>& LangCodeItem::items(void) const {
+const LangCodeItem::items_t& LangCodeItem::items(void) const {
return this->items_;
}
-std::map<std::u16string, std::u16string>& LangCodeItem::items(void) {
- return const_cast<std::map<std::u16string, std::u16string>&>(static_cast<const LangCodeItem*>(this)->items());
+LangCodeItem::items_t& LangCodeItem::items(void) {
+ return const_cast<LangCodeItem::items_t&>(static_cast<const LangCodeItem*>(this)->items());
}
@@ -145,7 +145,7 @@ void LangCodeItem::sublang(RESOURCE_SUBLANGS lang) {
}
-void LangCodeItem::items(const std::map<std::u16string, std::u16string>& items) {
+void LangCodeItem::items(const LangCodeItem::items_t& items) {
this->items_ = items;
}
@@ -176,7 +176,7 @@ std::ostream& operator<<(std::ostream& os, const LangCodeItem& item) {
<< " - "
<< std::hex << to_string(item.code_page()) << ")" << std::endl;
os << std::setw(8) << std::setfill(' ') << "Items: " << std::endl;
- for (const std::pair<std::u16string, std::u16string>& p : item.items()) {
+ for (const LangCodeItem::items_t::value_type& p : item.items()) {
os << " " << "'" << u16tou8(p.first) << "': '" << u16tou8(p.second) << "'" << std::endl;
}
return os;
diff --git a/src/PE/resources/ResourceAccelerator.cpp b/src/PE/resources/ResourceAccelerator.cpp
new file mode 100644
index 00000000..745e0596
--- /dev/null
+++ b/src/PE/resources/ResourceAccelerator.cpp
@@ -0,0 +1,105 @@
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
+ * Copyright 2017 - 2021 K. Nakagawa
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "LIEF/exception.hpp"
+#include "LIEF/PE/hash.hpp"
+#include "LIEF/PE/EnumToString.hpp"
+
+#include "LIEF/PE/resources/ResourceAccelerator.hpp"
+
+namespace LIEF {
+namespace PE {
+
+ResourceAccelerator::ResourceAccelerator(const ResourceAccelerator&) = default;
+ResourceAccelerator& ResourceAccelerator::operator=(const ResourceAccelerator&) = default;
+ResourceAccelerator::~ResourceAccelerator(void) = default;
+
+ResourceAccelerator::ResourceAccelerator(void) :
+ flags_{0},
+ ansi_{0},
+ id_{0},
+ padding_{0} {}
+
+ResourceAccelerator::ResourceAccelerator(const pe_resource_acceltableentry* entry) :
+ flags_{entry->fFlags},
+ ansi_{entry->wAnsi},
+ id_{static_cast<uint16_t>(entry->wId)},
+ padding_{entry->padding} {}
+
+void ResourceAccelerator::accept(Visitor& visitor) const {
+ visitor.visit(*this);
+}
+
+bool ResourceAccelerator::operator==(const ResourceAccelerator& rhs) const {
+ const auto hash_lhs = Hash::hash(*this);
+ const auto hash_rhs = Hash::hash(rhs);
+ return hash_lhs == hash_rhs;
+}
+
+bool ResourceAccelerator::operator!=(const ResourceAccelerator& rhs) const {
+ return not (*this == rhs);
+}
+
+std::ostream& operator<<(std::ostream& os, const ResourceAccelerator& acc) {
+ os << "flags: ";
+ for (const ACCELERATOR_FLAGS c : acc.flags_list()) {
+ os << to_string(c) << " ";
+ }
+ os << std::endl;
+ os << "ansi: " << acc.ansi_str() << std::endl;
+ os << std::hex << "id: " << acc.id() << std::endl;
+ os << std::hex << "padding: " << acc.padding() << std::endl;
+ return os;
+}
+
+std::string ResourceAccelerator::ansi_str(void) const {
+ return to_string(static_cast<ACCELERATOR_VK_CODES>(ansi_));
+}
+
+std::set<ACCELERATOR_FLAGS> ResourceAccelerator::flags_list(void) const {
+ std::set<ACCELERATOR_FLAGS> flags_set;
+
+ const auto flags_tmp = flags_;
+ std::copy_if(
+ std::cbegin(accelerator_array),
+ std::cend(accelerator_array),
+ std::inserter(flags_set, std::begin(flags_set)),
+ [flags_tmp](ACCELERATOR_FLAGS c) {
+ return (static_cast<uint16_t>(flags_tmp) & static_cast<uint16_t>(c)) > 0;
+ }
+ );
+ return flags_set;
+}
+
+int16_t ResourceAccelerator::flags(void) const {
+ return this->flags_;
+}
+
+int16_t ResourceAccelerator::ansi(void) const {
+ return this->ansi_;
+}
+
+uint16_t ResourceAccelerator::id(void) const {
+ return this->id_;
+}
+
+int16_t ResourceAccelerator::padding(void) const {
+ return this->padding_;
+}
+
+}
+}
diff --git a/src/PE/resources/ResourceDialog.cpp b/src/PE/resources/ResourceDialog.cpp
index e3efbf21..1df07cf5 100644
--- a/src/PE/resources/ResourceDialog.cpp
+++ b/src/PE/resources/ResourceDialog.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -24,7 +24,6 @@
#include "LIEF/PE/hash.hpp"
#include "LIEF/utils.hpp"
-#include "LIEF/PE/utils.hpp"
#include "LIEF/PE/EnumToString.hpp"
#include "LIEF/PE/resources/ResourceDialog.hpp"
diff --git a/src/PE/resources/ResourceDialogItem.cpp b/src/PE/resources/ResourceDialogItem.cpp
index 6b6da86f..0793df91 100644
--- a/src/PE/resources/ResourceDialogItem.cpp
+++ b/src/PE/resources/ResourceDialogItem.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -24,7 +24,6 @@
#include "LIEF/PE/hash.hpp"
-#include "LIEF/PE/utils.hpp"
#include "LIEF/utils.hpp"
#include "LIEF/PE/EnumToString.hpp"
diff --git a/src/PE/resources/ResourceFixedFileInfo.cpp b/src/PE/resources/ResourceFixedFileInfo.cpp
index 04c06f19..37430d14 100644
--- a/src/PE/resources/ResourceFixedFileInfo.cpp
+++ b/src/PE/resources/ResourceFixedFileInfo.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/resources/ResourceIcon.cpp b/src/PE/resources/ResourceIcon.cpp
index 72e1f529..37963ba7 100644
--- a/src/PE/resources/ResourceIcon.cpp
+++ b/src/PE/resources/ResourceIcon.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/resources/ResourceStringFileInfo.cpp b/src/PE/resources/ResourceStringFileInfo.cpp
index d5add80d..43ed058a 100644
--- a/src/PE/resources/ResourceStringFileInfo.cpp
+++ b/src/PE/resources/ResourceStringFileInfo.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -18,7 +18,6 @@
#include "LIEF/PE/hash.hpp"
#include "LIEF/utils.hpp"
-#include "LIEF/PE/utils.hpp"
#include "LIEF/PE/resources/ResourceStringFileInfo.hpp"
diff --git a/src/PE/resources/ResourceStringTable.cpp b/src/PE/resources/ResourceStringTable.cpp
new file mode 100644
index 00000000..e159f765
--- /dev/null
+++ b/src/PE/resources/ResourceStringTable.cpp
@@ -0,0 +1,70 @@
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
+ * Copyright 2017 - 2021 K. Nakagawa
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "LIEF/utils.hpp"
+
+#include "LIEF/PE/hash.hpp"
+#include "LIEF/PE/EnumToString.hpp"
+
+#include "LIEF/PE/resources/ResourceStringTable.hpp"
+
+namespace LIEF {
+namespace PE {
+
+ResourceStringTable::ResourceStringTable(const ResourceStringTable&) = default;
+ResourceStringTable& ResourceStringTable::operator=(const ResourceStringTable&) = default;
+ResourceStringTable::~ResourceStringTable(void) = default;
+
+ResourceStringTable::ResourceStringTable(void) :
+ name_{},
+ length_{0}
+{}
+
+ResourceStringTable::ResourceStringTable(int16_t length, const std::u16string& name) :
+ name_{name},
+ length_{length}
+{}
+
+int16_t ResourceStringTable::length(void) const {
+ return this->length_;
+}
+
+const std::u16string& ResourceStringTable::name(void) const {
+ return this->name_;
+}
+
+void ResourceStringTable::accept(Visitor& visitor) const {
+ visitor.visit(*this);
+}
+
+bool ResourceStringTable::operator==(const ResourceStringTable& rhs) const {
+ return Hash::hash(*this) == Hash::hash(rhs);
+}
+
+bool ResourceStringTable::operator!=(const ResourceStringTable& rhs) const {
+ return not (*this == rhs);
+}
+
+
+std::ostream& operator<<(std::ostream& os, const ResourceStringTable& string_table) {
+ os << std::dec << "Length: " << string_table.length() << std::endl;
+ os << "Name: \"" << u16tou8(string_table.name()) << "\"" << std::endl;
+ return os;
+}
+
+}
+}
diff --git a/src/PE/resources/ResourceVarFileInfo.cpp b/src/PE/resources/ResourceVarFileInfo.cpp
index 60554aad..578d5dbb 100644
--- a/src/PE/resources/ResourceVarFileInfo.cpp
+++ b/src/PE/resources/ResourceVarFileInfo.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -20,9 +20,9 @@
#include "LIEF/PE/hash.hpp"
#include "LIEF/utils.hpp"
-#include "LIEF/PE/utils.hpp"
#include "LIEF/PE/EnumToString.hpp"
+#include "LIEF/PE/ResourcesManager.hpp"
#include "LIEF/PE/resources/ResourceVarFileInfo.hpp"
namespace LIEF {
diff --git a/src/PE/resources/ResourceVersion.cpp b/src/PE/resources/ResourceVersion.cpp
index 3de80cba..e5ccd5f6 100644
--- a/src/PE/resources/ResourceVersion.cpp
+++ b/src/PE/resources/ResourceVersion.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,11 +17,8 @@
#include <iomanip>
#include "LIEF/exception.hpp"
-
#include "LIEF/PE/hash.hpp"
-
#include "LIEF/utils.hpp"
-#include "LIEF/PE/utils.hpp"
#include "LIEF/PE/resources/ResourceVersion.hpp"
diff --git a/src/PE/signature/Attribute.cpp b/src/PE/signature/Attribute.cpp
new file mode 100644
index 00000000..406453f7
--- /dev/null
+++ b/src/PE/signature/Attribute.cpp
@@ -0,0 +1,54 @@
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <iomanip>
+
+#include "LIEF/utils.hpp"
+#include "LIEF/PE/signature/Attribute.hpp"
+
+namespace LIEF {
+namespace PE {
+
+Attribute::Attribute(void) = default;
+
+Attribute::Attribute(SIG_ATTRIBUTE_TYPES type) :
+ type_{type}
+{}
+
+Attribute::Attribute(const Attribute& other) :
+ Object{other},
+ type_{other.type_}
+{}
+
+Attribute& Attribute::operator=(const Attribute& other) {
+ if (this != &other) {
+ this->type_ = other.type_;
+ }
+ return *this;
+}
+
+Attribute::~Attribute(void) = default;
+
+void Attribute::accept(Visitor& visitor) const {
+ visitor.visit(*this);
+}
+
+std::ostream& operator<<(std::ostream& os, const Attribute& attribute) {
+ os << attribute.print();
+ return os;
+}
+
+}
+}
diff --git a/src/PE/signature/AuthenticatedAttributes.cpp b/src/PE/signature/AuthenticatedAttributes.cpp
deleted file mode 100644
index 05e30228..00000000
--- a/src/PE/signature/AuthenticatedAttributes.cpp
+++ /dev/null
@@ -1,78 +0,0 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#include <iomanip>
-
-#include "LIEF/utils.hpp"
-#include "LIEF/PE/utils.hpp"
-#include "LIEF/PE/signature/AuthenticatedAttributes.hpp"
-
-namespace LIEF {
-namespace PE {
-
-AuthenticatedAttributes::AuthenticatedAttributes(void) = default;
-AuthenticatedAttributes::AuthenticatedAttributes(const AuthenticatedAttributes&) = default;
-AuthenticatedAttributes& AuthenticatedAttributes::operator=(const AuthenticatedAttributes&) = default;
-AuthenticatedAttributes::~AuthenticatedAttributes(void) = default;
-
-
-const oid_t& AuthenticatedAttributes::content_type(void) const {
- return this->content_type_;
-}
-
-const std::vector<uint8_t>& AuthenticatedAttributes::message_digest(void) const {
- return this->message_digest_;
-}
-
-const std::u16string& AuthenticatedAttributes::program_name(void) const {
- return this->program_name_;
-}
-
-const std::string& AuthenticatedAttributes::more_info(void) const {
- return this->more_info_;
-}
-
-const std::vector<uint8_t>& AuthenticatedAttributes::raw(void) const {
- return this->raw_;
-}
-
-void AuthenticatedAttributes::accept(Visitor& visitor) const {
- visitor.visit(*this);
-}
-
-std::ostream& operator<<(std::ostream& os, const AuthenticatedAttributes& authenticated_attributes) {
- constexpr uint8_t wsize = 30;
- std::string content_type = authenticated_attributes.content_type();
- if (content_type.empty()) {
- content_type = "N/A";
- }
- std::string program_name = u16tou8(authenticated_attributes.program_name());
- if (program_name.empty()) {
- program_name = "N/A";
- }
- std::string url = authenticated_attributes.more_info();
- if (url.empty()) {
- url = "N/A";
- }
- os << std::hex << std::left;
- os << std::setw(wsize) << std::setfill(' ') << "Content type: " << content_type << std::endl;
- os << std::setw(wsize) << std::setfill(' ') << "Program name: " << program_name << std::endl;
- os << std::setw(wsize) << std::setfill(' ') << "URL : " << url << std::endl;
-
- return os;
-}
-
-}
-}
diff --git a/src/PE/signature/CMakeLists.txt b/src/PE/signature/CMakeLists.txt
new file mode 100644
index 00000000..0a36d201
--- /dev/null
+++ b/src/PE/signature/CMakeLists.txt
@@ -0,0 +1,36 @@
+set(LIEF_PE_SIGNATURE_SRC
+ "${CMAKE_CURRENT_LIST_DIR}/Attribute.cpp"
+ "${CMAKE_CURRENT_LIST_DIR}/ContentInfo.cpp"
+ "${CMAKE_CURRENT_LIST_DIR}/Signature.cpp"
+ "${CMAKE_CURRENT_LIST_DIR}/SignerInfo.cpp"
+ "${CMAKE_CURRENT_LIST_DIR}/x509.cpp"
+ "${CMAKE_CURRENT_LIST_DIR}/OIDToString.cpp"
+ "${CMAKE_CURRENT_LIST_DIR}/SignatureParser.cpp"
+ "${CMAKE_CURRENT_LIST_DIR}/RsaInfo.cpp"
+)
+
+
+set(LIEF_PE_SIGNATURE_INCLUDES
+ "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/Attribute.hpp"
+ "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/ContentInfo.hpp"
+ "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/OIDToString.hpp"
+ "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/Signature.hpp"
+ "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/SignatureParser.hpp"
+ "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/SignerInfo.hpp"
+ "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/types.hpp"
+ "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/x509.hpp"
+ "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/RsaInfo.hpp"
+ "${CMAKE_CURRENT_SOURCE_DIR}/src/PE/signature/pkcs7.h"
+)
+
+source_group("Header Files\\PE\\signature" FILES ${LIEF_PE_SIGNATURE_SRC})
+source_group("Header Files\\PE\\signature" FILES ${LIEF_PE_SIGNATURE_INCLUDES})
+
+if (LIEF_PE)
+ target_sources(LIB_LIEF PRIVATE
+ ${LIEF_PE_SIGNATURE_SRC}
+ ${LIEF_PE_SIGNATURE_INCLUDES}
+ )
+endif()
+
+include("${CMAKE_CURRENT_LIST_DIR}/attributes/CMakeLists.txt")
diff --git a/src/PE/signature/ContentInfo.cpp b/src/PE/signature/ContentInfo.cpp
index 35fb9399..2c27909e 100644
--- a/src/PE/signature/ContentInfo.cpp
+++ b/src/PE/signature/ContentInfo.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,6 +17,8 @@
#include "LIEF/PE/signature/OIDToString.hpp"
#include "LIEF/PE/signature/ContentInfo.hpp"
+#include "LIEF/PE/EnumToString.hpp"
+#include "LIEF/utils.hpp"
namespace LIEF {
namespace PE {
@@ -26,27 +28,6 @@ ContentInfo::ContentInfo(const ContentInfo&) = default;
ContentInfo& ContentInfo::operator=(const ContentInfo&) = default;
ContentInfo::~ContentInfo(void) = default;
-const oid_t& ContentInfo::content_type(void) const {
- return this->content_type_;
-}
-
-const oid_t& ContentInfo::type(void) const {
- return this->type_;
-}
-
-
-const oid_t& ContentInfo::digest_algorithm(void) const {
- return this->digest_algorithm_;
-}
-
-
-const std::vector<uint8_t>& ContentInfo::digest(void) const {
- return this->digest_;
-}
-
-const std::vector<uint8_t>& ContentInfo::raw(void) const {
- return this->raw_;
-}
void ContentInfo::accept(Visitor& visitor) const {
visitor.visit(*this);
@@ -54,12 +35,8 @@ void ContentInfo::accept(Visitor& visitor) const {
std::ostream& operator<<(std::ostream& os, const ContentInfo& content_info) {
- constexpr uint8_t wsize = 30;
-
- os << std::hex << std::left;
- os << std::setw(wsize) << std::setfill(' ') << "Content Type: " << oid_to_string(content_info.content_type()) << std::endl;
- os << std::setw(wsize) << std::setfill(' ') << "Type: " << oid_to_string(content_info.type()) << std::endl;
- os << std::setw(wsize) << std::setfill(' ') << "Digest Algorithm: " << oid_to_string(content_info.digest_algorithm()) << std::endl;
+ os << "Authentihash: " << hex_dump(content_info.digest())
+ << "(" << to_string(content_info.digest_algorithm()) << ")\n";
return os;
}
diff --git a/src/PE/signature/OIDToString.cpp b/src/PE/signature/OIDToString.cpp
index 9a3749f7..1ae1f4d2 100644
--- a/src/PE/signature/OIDToString.cpp
+++ b/src/PE/signature/OIDToString.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -499,7 +499,7 @@ const char* oid_to_string(const oid_t& oid) {
{ "1.2.840.10040.2.3", "REJECT" },
{ "1.2.840.10040.2.4", "PICKUP_TOKEN" },
{ "1.2.840.10040.3", "ATTRIBUTE" },
- { "1.2.840.10040.3.1", "COUNTERSIGNATURE" },
+ { "1.2.840.10040.3.1", "COUNTER_SIGNATURE" },
{ "1.2.840.10040.3.2", "ATTRIBUTE_CERT" },
{ "1.2.840.10040.4", "ALGORITHM" },
{ "1.2.840.10040.4.1", "DSA" },
@@ -616,7 +616,7 @@ const char* oid_to_string(const oid_t& oid) {
{ "1.2.840.113549.1.9.3", "CONTENT_TYPE" },
{ "1.2.840.113549.1.9.4", "MESSAGE_DIGEST" },
{ "1.2.840.113549.1.9.5", "SIGNING_TIME" },
- { "1.2.840.113549.1.9.6", "COUNTERSIGNATURE" },
+ { "1.2.840.113549.1.9.6", "COUNTER_SIGNATURE" },
{ "1.2.840.113549.1.9.7", "CHALLENGE_PASSWORD" },
{ "1.2.840.113549.1.9.8", "UNSTRUCTURED_ADDRESS" },
{ "1.2.840.113549.1.9.9", "EXTENDED_CERTIFICATE_ATTRIBUTES" },
@@ -976,7 +976,7 @@ const char* oid_to_string(const oid_t& oid) {
{ "1.2.840.113635.100.6.1.1", "APPLE_CERTIFICATE_EXTENSION_APPLE_SIGNING" },
{ "1.2.840.113635.100.6.1.2", "APPLE_CERTIFICATE_EXTENSION_ADC_DEVELOPER_SIGNING" },
{ "1.2.840.113635.100.6.1.3", "APPLE_CERTIFICATE_EXTENSION_ADC_APPLE_SIGNING" },
- { "1.3.6.1.4.1.311.2.1.4", "SPC_INDIRECT_DATA_CONTEXT" },
+ { "1.3.6.1.4.1.311.2.1.4", "SPC_INDIRECT_DATA_CONTENT" },
{ "1.3.6.1.4.1.311.2.1.10", "SPC_AGENCY_INFO" },
{ "1.3.6.1.4.1.311.2.1.11", "SPC_STATEMENT_TYPE" },
{ "1.3.6.1.4.1.311.2.1.12", "SPC_SP_OPUS_INFO" },
@@ -2241,10 +2241,11 @@ const char* oid_to_string(const oid_t& oid) {
{ "2.16.840.1.114404.1.1.2.4.1", "TRUST_WAVE_EV_POLICY" },
{ "1.3.6.1.4.1.40869.1.1.22.3", "TWCA_EV_POLICY" },
{ "2.16.840.1.113733.1.7.23.6", "VERI_SIGN_EV_POLICY" },
- { "2.16.840.1.114171.500.9", "WELLS_FARGO_EV_POLICY" }
+ { "2.16.840.1.114171.500.9", "WELLS_FARGO_EV_POLICY" },
+ { "1.3.6.1.4.1.311.3.3.1", "MS_COUNTER_SIGN" }
};
auto it = oid_to_str.find(oid);
- return it == oid_to_str.end() ? "Out of range" : it->second;
+ return it == oid_to_str.end() ? oid.c_str() : it->second;
}
}
diff --git a/src/PE/signature/RsaInfo.cpp b/src/PE/signature/RsaInfo.cpp
new file mode 100644
index 00000000..d5942097
--- /dev/null
+++ b/src/PE/signature/RsaInfo.cpp
@@ -0,0 +1,145 @@
+/* Copyright 2021 R. Thomas
+ * Copyright 2021 Quarkslab
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "LIEF/PE/signature/RsaInfo.hpp"
+
+#include <algorithm>
+#include <fstream>
+
+#include <mbedtls/x509.h>
+#include <mbedtls/asn1.h>
+#include <mbedtls/oid.h>
+#include <mbedtls/rsa.h>
+#include <mbedtls/pk.h>
+
+
+namespace LIEF {
+namespace PE {
+
+RsaInfo::RsaInfo(void) = default;
+
+RsaInfo::RsaInfo(const RsaInfo::rsa_ctx_handle ctx) {
+ const mbedtls_rsa_context* pctx = reinterpret_cast<const mbedtls_rsa_context*>(ctx);
+ mbedtls_rsa_context* local_ctx = new mbedtls_rsa_context{};
+ mbedtls_rsa_init(local_ctx, pctx->padding, pctx->hash_id);
+ mbedtls_rsa_copy(local_ctx, pctx);
+ mbedtls_rsa_complete(local_ctx);
+ this->ctx_ = reinterpret_cast<RsaInfo::rsa_ctx_handle>(local_ctx);
+}
+
+RsaInfo::RsaInfo(const RsaInfo& other)
+{
+ if (other.ctx_ != nullptr) {
+ const mbedtls_rsa_context* octx = reinterpret_cast<const mbedtls_rsa_context*>(other.ctx_);
+ mbedtls_rsa_context* local_ctx = new mbedtls_rsa_context{};
+ mbedtls_rsa_init(local_ctx, octx->padding, octx->hash_id);
+ mbedtls_rsa_copy(local_ctx, octx);
+ mbedtls_rsa_complete(local_ctx);
+ this->ctx_ = reinterpret_cast<RsaInfo::rsa_ctx_handle>(local_ctx);
+ }
+}
+
+
+RsaInfo::RsaInfo(RsaInfo&& other) :
+ ctx_{std::move(other.ctx_)}
+{}
+
+RsaInfo& RsaInfo::operator=(RsaInfo other) {
+ this->swap(other);
+ return *this;
+}
+
+void RsaInfo::swap(RsaInfo& other) {
+ std::swap(this->ctx_, other.ctx_);
+}
+
+RsaInfo::operator bool() const {
+ return this->ctx_ != nullptr;
+}
+
+bool RsaInfo::has_public_key(void) const {
+ mbedtls_rsa_context* lctx = reinterpret_cast<mbedtls_rsa_context*>(this->ctx_);
+ return mbedtls_rsa_check_pubkey(lctx) == 0;
+}
+
+bool RsaInfo::has_private_key(void) const {
+ mbedtls_rsa_context* lctx = reinterpret_cast<mbedtls_rsa_context*>(this->ctx_);
+ return mbedtls_rsa_check_privkey(lctx) == 0;
+}
+
+
+RsaInfo::bignum_wrapper_t RsaInfo::N(void) const {
+ mbedtls_rsa_context* lctx = reinterpret_cast<mbedtls_rsa_context*>(this->ctx_);
+ bignum_wrapper_t N(mbedtls_mpi_bitlen(&lctx->N));
+ mbedtls_mpi_write_binary(&lctx->N, N.data(), N.size());
+ return N;
+}
+
+RsaInfo::bignum_wrapper_t RsaInfo::E(void) const {
+ mbedtls_rsa_context* lctx = reinterpret_cast<mbedtls_rsa_context*>(this->ctx_);
+ bignum_wrapper_t E(mbedtls_mpi_bitlen(&lctx->E));
+ mbedtls_mpi_write_binary(&lctx->E, E.data(), E.size());
+ return E;
+}
+
+RsaInfo::bignum_wrapper_t RsaInfo::D(void) const {
+ mbedtls_rsa_context* lctx = reinterpret_cast<mbedtls_rsa_context*>(this->ctx_);
+ bignum_wrapper_t D(mbedtls_mpi_bitlen(&lctx->D));
+ mbedtls_mpi_write_binary(&lctx->D, D.data(), D.size());
+ return D;
+}
+
+RsaInfo::bignum_wrapper_t RsaInfo::P(void) const {
+ mbedtls_rsa_context* lctx = reinterpret_cast<mbedtls_rsa_context*>(this->ctx_);
+ bignum_wrapper_t P(mbedtls_mpi_bitlen(&lctx->P));
+ mbedtls_mpi_write_binary(&lctx->P, P.data(), P.size());
+ return P;
+}
+
+RsaInfo::bignum_wrapper_t RsaInfo::Q(void) const {
+ mbedtls_rsa_context* lctx = reinterpret_cast<mbedtls_rsa_context*>(this->ctx_);
+ bignum_wrapper_t Q(mbedtls_mpi_bitlen(&lctx->Q));
+ mbedtls_mpi_write_binary(&lctx->Q, Q.data(), Q.size());
+ return Q;
+}
+
+size_t RsaInfo::key_size(void) const {
+ mbedtls_rsa_context* lctx = reinterpret_cast<mbedtls_rsa_context*>(this->ctx_);
+ return mbedtls_rsa_get_len(lctx) * 8;
+}
+
+
+RsaInfo::~RsaInfo(void) {
+ if (this->ctx_ != nullptr) {
+ mbedtls_rsa_context* lctx = reinterpret_cast<mbedtls_rsa_context*>(this->ctx_);
+ mbedtls_rsa_free(lctx);
+ delete lctx;
+ }
+}
+
+
+std::ostream& operator<<(std::ostream& os, const RsaInfo& info) {
+ if (not info) {
+ os << "<Empty>";
+ } else {
+ // TODO
+ }
+
+ return os;
+}
+
+}
+}
diff --git a/src/PE/signature/Signature.cpp b/src/PE/signature/Signature.cpp
index 726b4c8c..a8783724 100644
--- a/src/PE/signature/Signature.cpp
+++ b/src/PE/signature/Signature.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -14,68 +14,612 @@
* limitations under the License.
*/
#include <iomanip>
+#include <fstream>
+
+#include "logging.hpp"
+
+#include "LIEF/utils.hpp"
#include "LIEF/PE/signature/Signature.hpp"
#include "LIEF/PE/signature/OIDToString.hpp"
+#include "LIEF/PE/EnumToString.hpp"
+
+#include "LIEF/PE/signature/Attribute.hpp"
+#include "LIEF/PE/signature/attributes.hpp"
+
+#include <mbedtls/asn1write.h>
+
+#include <mbedtls/sha512.h>
+#include <mbedtls/sha256.h>
+#include <mbedtls/sha1.h>
+
+#include <mbedtls/md2.h>
+#include <mbedtls/md4.h>
+#include <mbedtls/md5.h>
+
+#include "mbedtls/x509_crt.h"
+#include "mbedtls/x509.h"
+
+#include "frozen.hpp"
namespace LIEF {
namespace PE {
-Signature::Signature(void) = default; // TODO
+inline std::string time_to_string(const x509::date_t& date) {
+ return fmt::format("{:d}/{:02d}/{:02d} - {:02d}:{:02d}:{:02d}",
+ date[0], date[1], date[2],
+ date[3], date[4], date[5]);
+}
+
+std::string Signature::flag_to_string(Signature::VERIFICATION_FLAGS flag) {
+ CONST_MAP(VERIFICATION_FLAGS, const char*, 13) enumStrings {
+ { Signature::VERIFICATION_FLAGS::OK, "OK"},
+ { Signature::VERIFICATION_FLAGS::INVALID_SIGNER, "INVALID_SIGNER"},
+ { Signature::VERIFICATION_FLAGS::UNSUPPORTED_ALGORITHM, "UNSUPPORTED_ALGORITHM"},
+ { Signature::VERIFICATION_FLAGS::INCONSISTENT_DIGEST_ALGORITHM, "INCONSISTENT_DIGEST_ALGORITHM"},
+ { Signature::VERIFICATION_FLAGS::CERT_NOT_FOUND, "CERT_NOT_FOUND"},
+ { Signature::VERIFICATION_FLAGS::CORRUPTED_CONTENT_INFO, "CORRUPTED_CONTENT_INFO"},
+ { Signature::VERIFICATION_FLAGS::CORRUPTED_AUTH_DATA, "CORRUPTED_AUTH_DATA"},
+ { Signature::VERIFICATION_FLAGS::MISSING_PKCS9_MESSAGE_DIGEST, "MISSING_PKCS9_MESSAGE_DIGEST"},
+ { Signature::VERIFICATION_FLAGS::BAD_DIGEST, "BAD_DIGEST"},
+ { Signature::VERIFICATION_FLAGS::BAD_SIGNATURE, "BAD_SIGNATURE"},
+ { Signature::VERIFICATION_FLAGS::NO_SIGNATURE, "NO_SIGNATURE"},
+ { Signature::VERIFICATION_FLAGS::CERT_EXPIRED, "CERT_EXPIRED"},
+ { Signature::VERIFICATION_FLAGS::CERT_FUTURE, "CERT_FUTURE"},
+ };
+ auto it = enumStrings.find(flag);
+ return it == enumStrings.end() ? "UNDEFINED" : it->second;
+}
+
+Signature::VERIFICATION_FLAGS verify_ts_counter_signature(const SignerInfo& signer,
+ const PKCS9CounterSignature& cs, Signature::VERIFICATION_CHECKS checks) {
+ LIEF_DEBUG("PKCS #9 Counter signature found");
+ Signature::VERIFICATION_FLAGS flags = Signature::VERIFICATION_FLAGS::OK;
+ const SignerInfo& cs_signer = cs.signer();
+ if (cs_signer.cert() == nullptr) {
+ LIEF_WARN("Can't find x509 certificate associated with Counter Signature's signer");
+ return flags | Signature::VERIFICATION_FLAGS::CERT_NOT_FOUND;
+ }
+ const x509& cs_cert = *cs_signer.cert();
+ const SignerInfo::encrypted_digest_t& cs_enc_digest = cs_signer.encrypted_digest();
+
+ std::vector<uint8_t> cs_auth_data = cs_signer.raw_auth_data();
+ // According to the RFC:
+ //
+ // "[...] The Attributes value's tag is SET OF, and the DER encoding of
+ // the SET OF tag, rather than of the IMPLICIT [0] tag [...]"
+ cs_auth_data[0] = /* SET OF */ 0x31;
+ const ALGORITHMS cs_digest_algo = cs_signer.digest_algorithm();
+ const std::vector<uint8_t>& cs_hash = Signature::hash(cs_auth_data, cs_digest_algo);
+ LIEF_DEBUG("Signed data digest: {}", hex_dump(cs_hash));
+ bool check_sig = cs_cert.check_signature(cs_hash, cs_enc_digest, cs_digest_algo);
+
+ if (not check_sig) {
+ LIEF_WARN("Authenticated signature (counter signature) mismatch");
+ //return flags | VERIFICATION_FLAGS::BAD_SIGNATURE;
+ }
+
+
+ /* According to Microsoft documentation:
+ * The Authenticode timestamp SignerInfo structure contains the following authenticated attributes values:
+ * 1. ContentType (1.2.840.113549.1.9.3) is set to PKCS #7 Data (1.2.840.113549.1.7.1).
+ * 2. Signing Time (1.2.840.113549.1.9.5) is set to the UTC time of timestamp generation time.
+ * 3. Message Digest (1.2.840.113549.1.9.4) is set to the hash value of the
+ * SignerInfo structure's encryptedDigest value. The hash algorithm that
+ * is used to calculate the hash value is the same as that specified in the
+ * SignerInfo structure’s digestAlgorithm value of the timestamp.
+ */
+
+ // Verify 1.
+ const auto* content_type_data = reinterpret_cast<const ContentType*>(cs_signer.get_auth_attribute(SIG_ATTRIBUTE_TYPES::CONTENT_TYPE));
+ if (content_type_data == nullptr) {
+ LIEF_WARN("Missing ContentType in authenticated attributes in the counter signature's signer");
+ return flags | Signature::VERIFICATION_FLAGS::INVALID_SIGNER;
+ }
+
+ if (content_type_data->oid() != /* PKCS #7 Data */ "1.2.840.113549.1.7.1") {
+ LIEF_WARN("Bad OID for ContentType in authenticated attributes in the counter signature's signer ({})",
+ content_type_data->oid());
+ return flags | Signature::VERIFICATION_FLAGS::INVALID_SIGNER;
+ }
+
+ // Verify 3.
+ const auto* message_dg = reinterpret_cast<const PKCS9MessageDigest*>(cs_signer.get_auth_attribute(SIG_ATTRIBUTE_TYPES::PKCS9_MESSAGE_DIGEST));
+ if (message_dg == nullptr) {
+ LIEF_WARN("Missing MessageDigest in authenticated attributes in the counter signature's signer");
+ return flags | Signature::VERIFICATION_FLAGS::INVALID_SIGNER;
+ }
+ const std::vector<uint8_t>& dg_value = message_dg->digest();
+ const std::vector<uint8_t> dg_cs_hash = Signature::hash(signer.encrypted_digest(), cs_digest_algo);
+ if (dg_value != dg_cs_hash) {
+ LIEF_WARN("MessageDigest mismatch with Hash(signer ED)");
+ return flags | Signature::VERIFICATION_FLAGS::INVALID_SIGNER;
+ }
+
+ /*
+ * Verify that signing's time is valid within the signer's certificate
+ * validity window.
+ */
+ const auto* signing_time = reinterpret_cast<const PKCS9SigningTime*>(cs_signer.get_auth_attribute(SIG_ATTRIBUTE_TYPES::PKCS9_SIGNING_TIME));
+ if (signing_time != nullptr and not is_true(checks & Signature::VERIFICATION_CHECKS::SKIP_CERT_TIME)) {
+ LIEF_DEBUG("PKCS #9 signing time found");
+ PKCS9SigningTime::time_t time = signing_time->time();
+ if (not x509::check_time(time, cs_cert.valid_to())) {
+ LIEF_WARN("Signing time: {} is above the certificate validity: {}",
+ time_to_string(time), time_to_string(cs_cert.valid_to()));
+ return flags | Signature::VERIFICATION_FLAGS::CERT_EXPIRED;
+ }
+
+ if (not x509::check_time(cs_cert.valid_from(), time)) {
+ LIEF_WARN("Signing time: {} is below the certificate validity: {}",
+ time_to_string(time), time_to_string(cs_cert.valid_to()));
+ return flags | Signature::VERIFICATION_FLAGS::CERT_FUTURE;
+ }
+ }
+ return flags;
+}
+
+
+Signature::Signature(void) = default;
Signature::Signature(const Signature&) = default;
Signature& Signature::operator=(const Signature&) = default;
Signature::~Signature(void) = default;
+
+std::vector<uint8_t> Signature::hash(const std::vector<uint8_t>& input, ALGORITHMS algo) {
+ switch (algo) {
+
+ case ALGORITHMS::SHA_512:
+ {
+ std::vector<uint8_t> out(64);
+ int ret = mbedtls_sha512_ret(input.data(), input.size(), out.data(), /* is384 */ false);
+ if (ret != 0) {
+ LIEF_ERR("Hashing {} bytes with SHA-512 failed! (ret: 0x{:x})", input.size(), ret);
+ return {};
+ }
+ return out;
+ }
+
+ case ALGORITHMS::SHA_384:
+ {
+ std::vector<uint8_t> out(64);
+ int ret = mbedtls_sha512_ret(input.data(), input.size(), out.data(), /* is384 */ true);
+ if (ret != 0) {
+ LIEF_ERR("Hashing {} bytes with SHA-384 failed! (ret: 0x{:x})", input.size(), ret);
+ return {};
+ }
+ return out;
+ }
+
+ case ALGORITHMS::SHA_256:
+ {
+ std::vector<uint8_t> out(32);
+ int ret = mbedtls_sha256_ret(input.data(), input.size(), out.data(), /* is224 */ false);
+ if (ret != 0) {
+ LIEF_ERR("Hashing {} bytes with SHA-256 failed! (ret: 0x{:x})", input.size(), ret);
+ return {};
+ }
+ return out;
+ }
+
+ case ALGORITHMS::SHA_1:
+ {
+ std::vector<uint8_t> out(20);
+ int ret = mbedtls_sha1_ret(input.data(), input.size(), out.data());
+ if (ret != 0) {
+ LIEF_ERR("Hashing {} bytes with SHA-1 failed! (ret: 0x{:x})", input.size(), ret);
+ return {};
+ }
+ return out;
+ }
+
+ case ALGORITHMS::MD5:
+ {
+ std::vector<uint8_t> out(16);
+ int ret = mbedtls_md5_ret(input.data(), input.size(), out.data());
+ if (ret != 0) {
+ LIEF_ERR("Hashing {} bytes with MD5 failed! (ret: 0x{:x})", input.size(), ret);
+ return {};
+ }
+ return out;
+ }
+
+ case ALGORITHMS::MD4:
+ {
+ std::vector<uint8_t> out(16);
+ int ret = mbedtls_md4_ret(input.data(), input.size(), out.data());
+ if (ret != 0) {
+ LIEF_ERR("Hashing {} bytes with MD4 failed! (ret: 0x{:x})", input.size(), ret);
+ return {};
+ }
+ return out;
+ }
+
+ case ALGORITHMS::MD2:
+ {
+ std::vector<uint8_t> out(16);
+ int ret = mbedtls_md2_ret(input.data(), input.size(), out.data());
+ if (ret != 0) {
+ LIEF_ERR("Hashing {} bytes with MD2 failed! (ret: 0x{:x})", input.size(), ret);
+ return {};
+ }
+ return out;
+ }
+
+ default:
+ {
+ LIEF_ERR("Unsupported hash algorithm {}", to_string(algo));
+ }
+ }
+ return {};
+}
+
uint32_t Signature::version(void) const {
return this->version_;
}
-const oid_t& Signature::digest_algorithm(void) const {
- return this->digest_algorithm_;
-}
const ContentInfo& Signature::content_info(void) const {
return this->content_info_;
}
it_const_crt Signature::certificates(void) const {
- return {this->certificates_};
+ return this->certificates_;
+}
+
+it_const_signers_t Signature::signers(void) const {
+ return this->signers_;
}
-const SignerInfo& Signature::signer_info(void) const {
- return this->signer_info_;
+Signature::VERIFICATION_FLAGS Signature::check(VERIFICATION_CHECKS checks) const {
+ // According to the Authenticode documentation,
+ // *SignerInfos contains one SignerInfo structure*
+ const size_t nb_signers = this->signers_.size();
+ VERIFICATION_FLAGS flags = VERIFICATION_FLAGS::OK;
+ if (nb_signers == 0) {
+ LIEF_WARN("No signer associated with the signature");
+ return flags | VERIFICATION_FLAGS::INVALID_SIGNER;
+ }
+
+ if (nb_signers > 1) {
+ LIEF_WARN("More than ONE signer ({:d} signers)", nb_signers);
+ return flags | VERIFICATION_FLAGS::INVALID_SIGNER;
+ }
+ const SignerInfo& signer = this->signers_.back();
+
+ // Check that Signature.digest_algorithm matches:
+ // - SignerInfo.digest_algorithm
+ // - ContentInfo.digest_algorithm
+
+ if (this->digest_algorithm_ == ALGORITHMS::UNKNOWN) {
+ LIEF_WARN("Unsupported digest algorithm");
+ return flags | VERIFICATION_FLAGS::UNSUPPORTED_ALGORITHM;
+ }
+
+ if (this->digest_algorithm_ != this->content_info_.digest_algorithm()) {
+ LIEF_WARN("Digest algorithm is different from ContentInfo");
+ return flags | VERIFICATION_FLAGS::INCONSISTENT_DIGEST_ALGORITHM;
+ }
+
+ if (this->digest_algorithm_ != signer.digest_algorithm()) {
+ LIEF_WARN("Digest algorithm is different from Signer");
+ return flags | VERIFICATION_FLAGS::INCONSISTENT_DIGEST_ALGORITHM;
+ }
+
+ const ALGORITHMS digest_algo = this->content_info().digest_algorithm();
+
+ if (signer.cert() == nullptr) {
+ LIEF_WARN("Can't find certificate whose the issuer is {}", signer.issuer());
+ return flags | VERIFICATION_FLAGS::CERT_NOT_FOUND;
+ }
+ const x509& cert = *signer.cert();
+ const SignerInfo::encrypted_digest_t& enc_digest = signer.encrypted_digest();
+
+ /*
+ * Check the following condition:
+ * "The signing certificate must contain either the extended key usage (EKU)
+ * value for code signing, or the entire certificate chain must contain no
+ * EKUs. The following is the EKU value for code signing"
+ */
+ //TODO(romain)
+
+ /*
+ * Verify certificate validity
+ */
+
+ if (this->content_info_start_ == 0 or this->content_info_end_ == 0) {
+ return flags | VERIFICATION_FLAGS::CORRUPTED_CONTENT_INFO;
+ }
+
+ std::vector<uint8_t> raw_content_info = {
+ std::begin(this->original_raw_signature_) + this->content_info_start_,
+ std::begin(this->original_raw_signature_) + this->content_info_end_
+ };
+
+ const std::vector<uint8_t> content_info_hash = Signature::hash(std::move(raw_content_info), digest_algo);
+
+
+ // Copy authenticated attributes
+ it_const_attributes_t auth_attrs = signer.authenticated_attributes();
+ if (auth_attrs.size() > 0) {
+
+ std::vector<uint8_t> auth_data = signer.raw_auth_data_;
+ // According to the RFC:
+ //
+ // "[...] The Attributes value's tag is SET OF, and the DER encoding of
+ // the SET OF tag, rather than of the IMPLICIT [0] tag [...]"
+ auth_data[0] = /* SET OF */ 0x31;
+
+ const std::vector<uint8_t> auth_attr_hash = Signature::hash(auth_data, digest_algo);
+ LIEF_DEBUG("Authenticated attribute digest: {}", hex_dump(auth_attr_hash));
+ bool check_sig = cert.check_signature(auth_attr_hash, enc_digest, digest_algo);
+
+ if (not check_sig) {
+ LIEF_WARN("Authenticated signature mismatch");
+ return flags | VERIFICATION_FLAGS::BAD_SIGNATURE;
+ }
+
+ // Check that content_info_hash matches pkcs9-message-digest
+ auto it_pkcs9_digest = std::find_if(std::begin(auth_attrs), std::end(auth_attrs),
+ [] (const Attribute& attr) {
+ return attr.type() == SIG_ATTRIBUTE_TYPES::PKCS9_MESSAGE_DIGEST;
+ });
+
+ if (it_pkcs9_digest == std::end(auth_attrs)) {
+ LIEF_WARN("Can't find the authenticated attribute: 'pkcs9-message-digest'");
+ return flags | VERIFICATION_FLAGS::MISSING_PKCS9_MESSAGE_DIGEST;
+ }
+
+ const auto& digest_attr = reinterpret_cast<const PKCS9MessageDigest&>(*it_pkcs9_digest);
+ LIEF_DEBUG("pkcs9-message-digest:\n {}\n {}", hex_dump(digest_attr.digest()), hex_dump(content_info_hash));
+ if (digest_attr.digest() != content_info_hash) {
+ return flags | VERIFICATION_FLAGS::BAD_DIGEST;
+ }
+ } else {
+ /*
+ * If there is no authenticated attributes, then the encrypted digested should match ENC(content_info_hash)
+ */
+ if (not cert.check_signature(content_info_hash, enc_digest, digest_algo)) {
+ return flags | VERIFICATION_FLAGS::BAD_SIGNATURE;
+ }
+ }
+
+ /*
+ * CounterSignature Checks
+ */
+ const auto* counter = reinterpret_cast<const PKCS9CounterSignature*>(signer.get_unauth_attribute(SIG_ATTRIBUTE_TYPES::PKCS9_COUNTER_SIGNATURE));
+ bool has_ms_counter_sig = false;
+ for (const Attribute& attr : signer.unauthenticated_attributes()) {
+ if (attr.type() == SIG_ATTRIBUTE_TYPES::GENERIC_TYPE) {
+ if (reinterpret_cast<const GenericType&>(attr).oid() == /* Ms-CounterSign */ "1.3.6.1.4.1.311.3.3.1") {
+ has_ms_counter_sig = true;
+ break;
+ }
+ }
+ }
+ bool timeless_signature = false;
+ if (counter != nullptr) {
+ VERIFICATION_FLAGS cs_flags = verify_ts_counter_signature(signer, *counter, checks);
+ if (cs_flags == VERIFICATION_FLAGS::OK) {
+ timeless_signature = true;
+ }
+ } else if (not timeless_signature and has_ms_counter_sig) {
+ timeless_signature = true;
+ }
+ bool should_check_cert_time = not timeless_signature or is_true(checks & VERIFICATION_CHECKS::LIFETIME_SIGNING);
+ if (is_true(checks & VERIFICATION_CHECKS::SKIP_CERT_TIME)) {
+ should_check_cert_time = false;
+ }
+ if (should_check_cert_time) {
+ /*
+ * Verify certificate validities
+ */
+ if (x509::time_is_past(cert.valid_to())) {
+ return flags | VERIFICATION_FLAGS::CERT_EXPIRED;
+ }
+
+ if (x509::time_is_future(cert.valid_from())) {
+ return flags | VERIFICATION_FLAGS::CERT_FUTURE;
+ }
+
+ }
+ return flags;
}
-const std::vector<uint8_t>& Signature::original_signature(void) const {
+
+const std::vector<uint8_t>& Signature::raw_der(void) const {
return this->original_raw_signature_;
}
+
+const x509* Signature::find_crt(const std::vector<uint8_t>& serialno) const {
+ auto it_cert = std::find_if(std::begin(this->certificates_), std::end(this->certificates_),
+ [&serialno] (const x509& cert) {
+ return cert.serial_number() == serialno;
+ });
+ if (it_cert == std::end(this->certificates_)) {
+ return nullptr;
+ }
+ return &(*it_cert);
+}
+
+
+const x509* Signature::find_crt_subject(const std::string& subject) const {
+ auto it_cert = std::find_if(std::begin(this->certificates_), std::end(this->certificates_),
+ [&subject] (const x509& cert) {
+ return cert.subject() == subject;
+ });
+ if (it_cert == std::end(this->certificates_)) {
+ return nullptr;
+ }
+ return &(*it_cert);
+}
+
+const x509* Signature::find_crt_subject(const std::string& subject, const std::vector<uint8_t>& serialno) const {
+ auto it_cert = std::find_if(std::begin(this->certificates_), std::end(this->certificates_),
+ [&subject, &serialno] (const x509& cert) {
+ return cert.subject() == subject and cert.serial_number() == serialno;
+ });
+ if (it_cert == std::end(this->certificates_)) {
+ return nullptr;
+ }
+ return &(*it_cert);
+}
+
+const x509* Signature::find_crt_issuer(const std::string& issuer) const {
+ auto it_cert = std::find_if(std::begin(this->certificates_), std::end(this->certificates_),
+ [&issuer] (const x509& cert) {
+ return cert.issuer() == issuer;
+ });
+ if (it_cert == std::end(this->certificates_)) {
+ return nullptr;
+ }
+ return &(*it_cert);
+}
+
+const x509* Signature::find_crt_issuer(const std::string& issuer, const std::vector<uint8_t>& serialno) const {
+ auto it_cert = std::find_if(std::begin(this->certificates_), std::end(this->certificates_),
+ [&issuer, &serialno] (const x509& cert) {
+ return cert.issuer() == issuer and cert.serial_number() == serialno;
+ });
+ if (it_cert == std::end(this->certificates_)) {
+ return nullptr;
+ }
+ return &(*it_cert);
+}
+
void Signature::accept(Visitor& visitor) const {
visitor.visit(*this);
}
-std::ostream& operator<<(std::ostream& os, const Signature& signature) {
- constexpr uint8_t wsize = 30;
- os << std::hex << std::left;
- os << std::setw(wsize) << std::setfill(' ') << "Version: " << signature.version() << std::endl;
- os << std::setw(wsize) << std::setfill(' ') << "Digest Algorithm: " << oid_to_string(signature.digest_algorithm()) << std::endl;
+inline void print_attr(it_const_attributes_t& attrs, std::ostream& os) {
+ for (const Attribute& attr : attrs) {
+ std::string suffix;
+ switch (attr.type()) {
+ case SIG_ATTRIBUTE_TYPES::CONTENT_TYPE:
+ {
+ const auto& ct = reinterpret_cast<const ContentType&>(attr);
+ suffix = ct.oid() + " (" + oid_to_string(ct.oid()) + ")";
+ break;
+ }
- os << "Content Info" << std::endl;
- os << "============" << std::endl;
- os << signature.content_info() << std::endl << std::endl;
+ case SIG_ATTRIBUTE_TYPES::MS_SPC_STATEMENT_TYPE:
+ {
+ const auto& ct = reinterpret_cast<const MsSpcStatementType&>(attr);
+ suffix = ct.oid() + " (" + oid_to_string(ct.oid()) + ")";
+ break;
+ }
+ case SIG_ATTRIBUTE_TYPES::SPC_SP_OPUS_INFO:
+ {
+ const auto& ct = reinterpret_cast<const SpcSpOpusInfo&>(attr);
+ if (not ct.program_name().empty()) {
+ suffix = ct.program_name();
+ }
+ if (not ct.more_info().empty()) {
+ if (not suffix.empty()) {
+ suffix += " - ";
+ }
+ suffix += ct.more_info();
+ }
+ break;
+ }
+
+ case SIG_ATTRIBUTE_TYPES::PKCS9_MESSAGE_DIGEST:
+ {
+ const auto& ct = reinterpret_cast<const PKCS9MessageDigest&>(attr);
+ suffix = hex_dump(ct.digest()).substr(0, 41) + "...";
+ break;
+ }
+
+ case SIG_ATTRIBUTE_TYPES::MS_SPC_NESTED_SIGN:
+ {
+ const auto& nested_attr = reinterpret_cast<const MsSpcNestedSignature&>(attr);
+ const Signature& ct = nested_attr.sig();
+ auto signers = ct.signers();
+ auto crts = ct.certificates();
+ if (signers.size() > 0) {
+ suffix = signers[0].issuer();
+ } else if (crts.size() > 0) {
+ suffix = crts[0].issuer();
+ }
+ break;
+ }
+
+ case SIG_ATTRIBUTE_TYPES::GENERIC_TYPE:
+ {
+ const auto& ct = reinterpret_cast<const GenericType&>(attr);
+ suffix = ct.oid();
+ break;
+ }
+
+ case SIG_ATTRIBUTE_TYPES::PKCS9_AT_SEQUENCE_NUMBER:
+ {
+ const auto& ct = reinterpret_cast<const PKCS9AtSequenceNumber&>(attr);
+ suffix = std::to_string(ct.number());
+ break;
+ }
+
+ case SIG_ATTRIBUTE_TYPES::PKCS9_COUNTER_SIGNATURE:
+ {
+ const auto& ct = reinterpret_cast<const PKCS9CounterSignature&>(attr);
+ const SignerInfo& signer = ct.signer();
+ suffix = signer.issuer();
+ break;
+ }
+
+ case SIG_ATTRIBUTE_TYPES::PKCS9_SIGNING_TIME:
+ {
+ const auto& ct = reinterpret_cast<const PKCS9SigningTime&>(attr);
+ const PKCS9SigningTime::time_t time = ct.time();
+ suffix = fmt::format("{}/{}/{} - {}:{}:{}",
+ time[0], time[1], time[2], time[3], time[4], time[5]);
+ break;
+ }
+
+ default:
+ {
+ }
+ }
+ os << fmt::format(" {}: {}\n", to_string(attr.type()), suffix);
- os << "Certificates" << std::endl;
- os << "============" << std::endl;
- for (const x509& crt : signature.certificates()) {
- os << crt << std::endl;;
}
- os << std::endl;
+}
- os << "Signer Info" << std::endl;
- os << "===========" << std::endl;
- os << signature.signer_info() << std::endl << std::endl;
+std::ostream& operator<<(std::ostream& os, const Signature& signature) {
+ const ContentInfo& cinfo = signature.content_info();
+ os << fmt::format("Version: {:d}\n", signature.version());
+ os << fmt::format("Digest Algorithm: {}\n", to_string(signature.digest_algorithm()));
+ os << fmt::format("Content Info Digest: {}\n", hex_dump(cinfo.digest()));
+ if (not cinfo.file().empty()) {
+ os << fmt::format("Content Info File: {}\n", cinfo.file());
+ }
+ it_const_crt certs = signature.certificates();
+ os << fmt::format("#{:d} certificate(s):\n", certs.size());
+ for (const x509& crt : certs) {
+ os << fmt::format(" - {}\n", crt.issuer()); // TODO(romain): RSA-2048, ...
+ }
+ it_const_signers_t signers = signature.signers();
+ os << fmt::format("#{:d} signer(s):\n", signers.size());
+ for (const SignerInfo& signer : signers) {
+ os << fmt::format("Issuer: {}\n", signer.issuer());
+ os << fmt::format("Digest: {}\n", to_string(signer.digest_algorithm()));
+ os << fmt::format("Encryption: {}\n", to_string(signer.encryption_algorithm()));
+ os << fmt::format("Encrypted DG: {} ...\n", hex_dump(signer.encrypted_digest()).substr(0, 41));
+ it_const_attributes_t auth_attr = signer.authenticated_attributes();
+ if (auth_attr.size() > 0) {
+ os << fmt::format("#{:d} authenticated attributes:\n", auth_attr.size());
+ print_attr(auth_attr, os);
+ }
+
+ it_const_attributes_t unauth_attr = signer.unauthenticated_attributes();
+ if (unauth_attr.size() > 0) {
+ os << fmt::format("#{:d} un-authenticated attributes:\n", unauth_attr.size());
+ print_attr(unauth_attr, os);
+ }
+
+ }
return os;
}
diff --git a/src/PE/signature/SignatureParser.cpp b/src/PE/signature/SignatureParser.cpp
index 63da0fa9..b9e4b0ac 100644
--- a/src/PE/signature/SignatureParser.cpp
+++ b/src/PE/signature/SignatureParser.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -14,726 +14,1121 @@
* limitations under the License.
*/
+#include <cstring>
+#include <fstream>
+
#include <mbedtls/platform.h>
#include <mbedtls/oid.h>
#include <mbedtls/x509_crt.h>
-#include "utf8.h"
#include "LIEF/utils.hpp"
-
-#include "LIEF/logging++.hpp"
-
-#include "pkcs7.h"
-
-#include <cstring>
-
#include "LIEF/exception.hpp"
+#include "LIEF/BinaryStream/VectorStream.hpp"
+
#include "LIEF/PE/utils.hpp"
#include "LIEF/PE/signature/SignatureParser.hpp"
#include "LIEF/PE/signature/Signature.hpp"
+
+#include "LIEF/PE/signature/Attribute.hpp"
+#include "LIEF/PE/signature/attributes/ContentType.hpp"
+#include "LIEF/PE/signature/attributes/GenericType.hpp"
+#include "LIEF/PE/signature/attributes/SpcSpOpusInfo.hpp"
+#include "LIEF/PE/signature/attributes/PKCS9CounterSignature.hpp"
+#include "LIEF/PE/signature/attributes/PKCS9MessageDigest.hpp"
+#include "LIEF/PE/signature/attributes/PKCS9AtSequenceNumber.hpp"
+#include "LIEF/PE/signature/attributes/PKCS9SigningTime.hpp"
+#include "LIEF/PE/signature/attributes/MsSpcNestedSignature.hpp"
+#include "LIEF/PE/signature/attributes/MsSpcStatementType.hpp"
+
#include "LIEF/PE/signature/OIDToString.hpp"
+#include "LIEF/third-party/utfcpp/utf8.h"
+#include "logging.hpp"
+#include "pkcs7.h"
+
namespace LIEF {
namespace PE {
+inline uint8_t stream_get_tag(VectorStream& stream) {
+ if (stream.can_read<uint8_t>()) {
+ return stream.peek<uint8_t>();
+ }
+ return 0;
+}
+
SignatureParser::~SignatureParser(void) = default;
SignatureParser::SignatureParser(void) = default;
-SignatureParser::SignatureParser(const std::vector<uint8_t>& data) :
- signature_{},
- p_{nullptr},
- end_{nullptr},
- signature_ptr_{nullptr},
- stream_{std::unique_ptr<VectorStream>(new VectorStream{data})}
-{
-
- const uint8_t* sig = this->stream_->peek_array<uint8_t>(8, this->stream_->size() - 8, /* check */false);
- if (sig != nullptr) {
- this->signature_ptr_ = sig;
- this->end_ = this->signature_ptr_ + this->stream_->size() - 8;
- this->p_ = const_cast<uint8_t*>(this->signature_ptr_);
- try {
- this->parse_signature();
- } catch (const std::exception& e) {
- VLOG(VDEBUG) << e.what();
- }
+SignatureParser::SignatureParser(std::vector<uint8_t> data) :
+ stream_{std::unique_ptr<VectorStream>(new VectorStream{std::move(data)})}
+{}
+
+result<Signature> SignatureParser::parse(const std::string& path) {
+ std::ifstream binary(path, std::ios::in | std::ios::binary);
+ if (not binary) {
+ LIEF_ERR("Can't open {}", path);
+ return make_error_code(lief_errors::file_error);
}
+ binary.unsetf(std::ios::skipws);
+ binary.seekg(0, std::ios::end);
+ const auto size = static_cast<uint64_t>(binary.tellg());
+ binary.seekg(0, std::ios::beg);
+ std::vector<uint8_t> raw_blob(size, 0);
+ binary.read(reinterpret_cast<char*>(raw_blob.data()), size);
+ return SignatureParser::parse(std::move(raw_blob));
}
-
-Signature SignatureParser::parse(const std::vector<uint8_t>& data) {
- SignatureParser parser{data};
- return parser.signature_;
+result<Signature> SignatureParser::parse(std::vector<uint8_t> data, bool skip_header) {
+ if (data.size() < 10) {
+ return make_error_code(lief_errors::read_error);
+ }
+ std::vector<uint8_t> sig_data = skip_header ?
+ std::vector<uint8_t>{std::begin(data) + 8, std::end(data)} :
+ /* else */
+ std::move(data);
+
+ SignatureParser parser{std::move(sig_data)};
+ auto sig = parser.parse_signature();
+ if (not sig) {
+ LIEF_ERR("Error while parsing the signature");
+ return sig.error();
+ }
+ return std::move(sig.value());
}
-size_t SignatureParser::current_offset(void) const {
- return (reinterpret_cast<size_t>(this->p_) - reinterpret_cast<size_t>(this->signature_ptr_));
+size_t SignatureParser::current_offset() const {
+ return this->stream_->pos();
}
-void SignatureParser::parse_header(void) {
- mbedtls_asn1_buf buf;
- int ret = 0;
- size_t tag;
- char oid_str[256] = { 0 };
-
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
- MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
- throw corrupted("Signature corrupted");
+result<Signature> SignatureParser::parse_signature() {
+ Signature signature;
+ signature.original_raw_signature_ = this->stream_->content();
+ auto tag = this->stream_->asn1_read_tag(MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
+ if (not tag) {
+ LIEF_INFO("Wrong tag: 0x{:x} (pos: {:d})",
+ stream_get_tag(*this->stream_), this->stream_->pos());
+ return tag.error();
}
- buf.tag = *this->p_;
-
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &buf.len, MBEDTLS_ASN1_OID)) != 0) {
- throw corrupted("Error while reading tag");
+ auto oid = this->stream_->asn1_read_oid();
+ if (not oid) {
+ LIEF_INFO("Can't read OID value (pos: {})", this->stream_->pos());
+ return oid.error();
}
+ std::string& oid_str = oid.value();
- buf.p = this->p_;
- mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &buf);
- VLOG(VDEBUG) << "OID (signedData): " << oid_str;
- this->p_ += buf.len;
-
- if (MBEDTLS_OID_CMP(MBEDTLS_OID_PKCS7_SIGNED_DATA, &buf) != 0) {
- throw corrupted("Wrong OID: " + std::string(oid_str) + " (expect PKCS7_SIGNED_DATA)");
+ if (oid_str != /* pkcs7-signedData */ "1.2.840.113549.1.7.2") {
+ LIEF_INFO("Expecting OID pkcs7-signed-data at {:d} but got {}",
+ this->stream_->pos(), oid_to_string(oid_str));
+ return make_error_code(lief_errors::read_error);
}
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
- MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
- throw corrupted("Signature corrupted");
+ tag = this->stream_->asn1_read_tag(MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 0);
+ if (not tag) {
+ LIEF_INFO("Wrong tag: 0x{:x} (pos: {:d})",
+ stream_get_tag(*this->stream_), this->stream_->pos());
+ return tag.error();
+ }
+ tag = this->stream_->asn1_read_tag(MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
+ if (not tag) {
+ LIEF_INFO("Wrong tag: 0x{:x} (pos: {:d})",
+ stream_get_tag(*this->stream_), this->stream_->pos());
+ return tag.error();
}
-
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
- MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
- throw corrupted("Signature corrupted");
+ /*
+ * Defined in https://tools.ietf.org/html/rfc2315
+ * SignedData ::= SEQUENCE {
+ * version Version,
+ * digestAlgorithms DigestAlgorithmIdentifiers,
+ * contentInfo ContentInfo,
+ * certificates
+ * [0] IMPLICIT ExtendedCertificatesAndCertificates OPTIONAL,
+ * crls
+ * [1] IMPLICIT CertificateRevocationLists OPTIONAL,
+ * signerInfos SignerInfos
+ * }
+ *
+ * Version ::= INTEGER
+ * DigestAlgorithmIdentifiers ::= SET OF DigestAlgorithmIdentifier
+ * SignerInfos ::= SET OF SignerInfo
+ *
+ *
+ * SignerInfo ::= SEQUENCE {
+ * version Version,
+ * issuerAndSerialNumber IssuerAndSerialNumber,
+ * digestAlgorithm DigestAlgorithmIdentifier,
+ * authenticatedAttributes
+ * [0] IMPLICIT Attributes OPTIONAL,
+ * digestEncryptionAlgorithm
+ * DigestEncryptionAlgorithmIdentifier,
+ * encryptedDigest EncryptedDigest,
+ * unauthenticatedAttributes
+ * [1] IMPLICIT Attributes OPTIONAL
+ * }
+ *
+ */
+
+ // ==============================================================================
+ // Version
+ //
+ // Version ::= INTEGER
+ // ==============================================================================
+ auto version = this->stream_->asn1_read_int();
+ if (not version) {
+ LIEF_INFO("Can't parse version (pos: {:d})", this->stream_->pos());
+ return tag.error();
+ }
+ const int32_t version_val = version.value();
+ LIEF_DEBUG("pkcs7-signed-data.version: {:d}", version_val);
+ if (version_val != 1) {
+ LIEF_INFO("pkcs7-signed-data.version is not 1 ({:d})", version_val);
+ return make_error_code(lief_errors::not_supported);
+ }
+ signature.version_ = version_val;
+
+ // ==============================================================================
+ // Digest Algorithms
+ //
+ // DigestAlgorithmIdentifiers ::= SET OF DigestAlgorithmIdentifier
+ // ==============================================================================
+ tag = this->stream_->asn1_read_tag(MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SET);
+ if (not tag) {
+ LIEF_INFO("Wrong tag: 0x{:x} (pos: {:d})",
+ stream_get_tag(*this->stream_), this->stream_->pos());
+ return tag.error();
+ }
+ const uintptr_t end_set = this->stream_->pos() + tag.value();
+ std::vector<oid_t> algorithms;
+ while (this->stream_->pos() < end_set) {
+ const size_t current_p = this->stream_->pos();
+ auto alg = this->stream_->asn1_read_alg();
+ if (not alg) {
+ LIEF_INFO("Can't parse signed data digest algorithm (pos: {:d})", this->stream_->pos());
+ break;
+ }
+ if (this->stream_->pos() == current_p) break;
+ LIEF_DEBUG("pkcs7-signed-data.digest-algorithms: {}", oid_to_string(alg.value()));
+ algorithms.push_back(std::move(alg.value()));
+ }
+ if (algorithms.size() == 0) {
+ LIEF_INFO("pkcs7-signed-data.digest-algorithms no algorithms found");
+ return make_error_code(lief_errors::read_error);
}
+ else if (algorithms.size() > 1) {
+ LIEF_INFO("pkcs7-signed-data.digest-algorithms {:d} algorithms found. Expecting only 1", algorithms.size());
+ return make_error_code(lief_errors::read_error);
+ }
+ else {
+ ALGORITHMS algo = algo_from_oid(algorithms.back());
+ if (algo == ALGORITHMS::UNKNOWN) {
+ LIEF_WARN("LIEF does not handle algorithm {}", algorithms.back());
+ } else {
+ signature.digest_algorithm_ = algo;
+ }
-}
+ }
+ // Content Info
+ // =========================================================
+ tag = this->stream_->asn1_read_tag(MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
+ if (not tag) {
+ LIEF_INFO("Wrong tag: 0x{:x} can't parse content info (pos: {:d})",
+ stream_get_tag(*this->stream_), this->stream_->pos());
+ return tag.error();
+ }
-int32_t SignatureParser::get_signed_data_version(void) {
- VLOG(VDEBUG) << "Parse signed data - version";
- int ret = 0;
+ /* Content Info */ {
+ std::vector<uint8_t> raw_content_info =
+ {this->stream_->p(), this->stream_->p() + tag.value()};
+ VectorStream content_info_stream{std::move(raw_content_info)};
- int32_t version;
- if ((ret = mbedtls_asn1_get_int(&(this->p_), this->end_, &version)) != 0) {
- throw corrupted("Signature corrupted");
+ range_t range = {0, 0};
+ auto content_info = this->parse_content_info(content_info_stream, range);
+ if (not content_info) {
+ LIEF_INFO("Fail to parse pkcs7-signed-data.content-info");
+ } else {
+ signature.content_info_ = std::move(content_info.value());
+ signature.content_info_start_ = this->stream_->pos() + range.start;
+ signature.content_info_end_ = this->stream_->pos() + range.end;
+ LIEF_DEBUG("ContentInfo range: {:d} -> {:d}",
+ signature.content_info_start_, signature.content_info_end_);
+ }
+ this->stream_->increment_pos(raw_content_info.size());
}
- VLOG(VDEBUG) << "Version: " << std::dec << version;
- LOG_IF(version != 1, WARNING) << "Version should be equal to 1 (" << std::dec << version << ")";
- return version;
-}
+ // X509 Certificates (optional)
+ // =========================================================
+ tag = this->stream_->asn1_read_tag(/* certificates */
+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_CONTEXT_SPECIFIC);
+ if (tag) {
+ LIEF_DEBUG("Parse pkcs7-signed-data.certificates offset: {:d}", this->stream_->pos());
+ std::vector<uint8_t> raw_content =
+ {this->stream_->p(), this->stream_->p() + tag.value()};
-std::string SignatureParser::get_signed_data_digest_algorithms(void) {
- VLOG(VDEBUG) << "Parse signed data - digest algorithm";
- int ret = 0;
- size_t tag;
- char oid_str[256] = { 0 };
+ VectorStream certificate_stream{std::move(raw_content)};
+ this->stream_->increment_pos(raw_content.size());
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
- MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SET)) != 0) {
- throw corrupted("Signature corrupted");
+ auto certificates = this->parse_certificates(certificate_stream);
+ if (not certificates) {
+ LIEF_INFO("Fail to parse pkcs7-signed-data.certificates");
+ } else {
+ // Makes chain
+ std::vector<x509> certs = certificates.value();
+ signature.certificates_ = std::move(certs);
+ }
}
- mbedtls_asn1_buf alg_oid;
-
- if ((ret = mbedtls_asn1_get_alg_null(&(this->p_), this->end_, &alg_oid)) != 0) {
- throw corrupted("Signature corrupted");
+ // CRLS (optional)
+ // =========================================================
+ tag = this->stream_->asn1_read_tag(/* certificates */
+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_CONTEXT_SPECIFIC | 1);
+ if (tag) {
+ LIEF_DEBUG("Parse pkcs7-signed-data.crls offset: {:d}", this->stream_->pos());
+ std::vector<uint8_t> raw_content =
+ {this->stream_->p(), this->stream_->p() + tag.value()};
+ // TODO(romain): Process crls certificates
+ this->stream_->increment_pos(raw_content.size());
}
- mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &alg_oid);
+ // SignerInfos
+ // =========================================================
+ tag = this->stream_->asn1_read_tag(MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SET);
+ if (tag) {
+ LIEF_DEBUG("Parse pkcs7-signed-data.signer-infos offset: {:d}", this->stream_->pos());
+ std::vector<uint8_t> raw_content =
+ {this->stream_->p(), this->stream_->p() + tag.value()};
+ VectorStream stream{std::move(raw_content)};
+ this->stream_->increment_pos(raw_content.size());
+ auto signer_info = this->parse_signer_infos(stream);
+ if (not signer_info) {
+ LIEF_INFO("Fail to parse pkcs7-signed-data.signer-infos");
+ } else {
+ signature.signers_ = std::move(signer_info.value());
+ }
+ }
- VLOG(VDEBUG) << "digestAlgorithms: " << oid_str;
- return oid_str;
+ // Tied signer info with x509 certificates
+ for (SignerInfo& signer : signature.signers_) {
+ const x509* crt = signature.find_crt_issuer(signer.issuer(), signer.serial_number());
+ if (crt != nullptr) {
+ signer.cert_ = std::unique_ptr<x509>(new x509{*crt});
+ } else {
+ LIEF_INFO("Can't find x509 certificate associated with signer '{}'", signer.issuer());
+ }
+ const auto* cs = reinterpret_cast<const PKCS9CounterSignature*>(signer.get_attribute(SIG_ATTRIBUTE_TYPES::PKCS9_COUNTER_SIGNATURE));
+ if (cs != nullptr) {
+ SignerInfo& cs_signer = const_cast<PKCS9CounterSignature*>(cs)->signer_;
+ const x509* crt = signature.find_crt_issuer(cs_signer.issuer(), cs_signer.serial_number());
+ if (crt != nullptr) {
+ cs_signer.cert_ = std::unique_ptr<x509>(new x509{*crt});
+ } else {
+ LIEF_INFO("Can't find x509 certificate associated with signer '{}'", signer.issuer());
+ }
+ }
+ }
+ return signature;
}
+result<ContentInfo> SignatureParser::parse_content_info(VectorStream& stream, range_t& range) {
+ // ==============================================================================
+ // ContentInfo
+ // ContentInfo ::= SEQUENCE {
+ // contentType ContentType,
+ // content
+ // [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL
+ // }
+ // ContentType ::= OBJECT IDENTIFIER
+ // ==============================================================================
+ ContentInfo content_info;
-ContentInfo SignatureParser::parse_content_info(void) {
- VLOG(VDEBUG) << "Parse signed data - content info";
-
- mbedtls_asn1_buf content_type_oid;
- mbedtls_asn1_buf alg_oid;
- int ret = 0;
- size_t tag;
- char oid_str[256] = { 0 };
-
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
- MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
- throw corrupted("Signature corrupted");
+ // First, process contentType which must match SPC_INDIRECT_DATA_CONTEXT
+ {
+ auto content_type = stream.asn1_read_oid();
+ if (not content_type) {
+ LIEF_INFO("Can't parse content-info.content-type (pos: {:d})", stream.pos());
+ return content_type.error();
+ }
+ const std::string& ctype_str = content_type.value();
+ LIEF_DEBUG("content-info.content-type: {}", oid_to_string(ctype_str));
+ if (ctype_str != /* SPC_INDIRECT_DATA_CONTEXT */ "1.3.6.1.4.1.311.2.1.4") {
+ LIEF_WARN("Expecting OID SPC_INDIRECT_DATA_CONTEXT at {:d} but got {}",
+ stream.pos(), oid_to_string(ctype_str));
+ return make_error_code(lief_errors::read_error);
+ }
+ content_info.content_type_ = ctype_str;
}
- ContentInfo content_info;
- content_info.content_type_ = this->get_content_info_type();
- // content - SpcIndirectDataContent
- // |_ SpcAttributeTypeAndOptionalValue
- // |_ DigestInfo
- // ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- VLOG(VDEBUG) << "Parsing SpcIndirectDataContent (offset: "
- << std::dec << this->current_offset()
- << ")";
+ // ==============================================================================
+ // Then process SpcIndirectDataContent, which has this structure:
+ //
+ // SpcIndirectDataContent ::= SEQUENCE {
+ // data SpcAttributeTypeAndOptionalValue,
+ // messageDigest DigestInfo
+ // }
+ //
+ // SpcAttributeTypeAndOptionalValue ::= SEQUENCE {
+ // type ObjectID, // Should be SPC_PE_IMAGE_DATA
+ // value [0] EXPLICIT ANY OPTIONAL
+ // }
+ //
+ // DigestInfo ::= SEQUENCE {
+ // digestAlgorithm AlgorithmIdentifier,
+ // digest OCTETSTRING
+ // }
+ //
+ // AlgorithmIdentifier ::= SEQUENCE {
+ // algorithm ObjectID,
+ // parameters [0] EXPLICIT ANY OPTIONAL
+ // }
+ // ==============================================================================
+ auto tag = stream.asn1_read_tag(/* [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL */
+ MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED);
+ if (not tag) {
+ LIEF_INFO("Wrong tag: 0x{:x} (pos: {:d})",
+ stream_get_tag(stream), stream.pos());
+ return tag.error();
+ }
+ range.end = stream.size();
+
+ tag = stream.asn1_read_tag(/* SpcIndirectDataContent */
+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
+ if (not tag) {
+ LIEF_INFO("Wrong tag: 0x{:x} (pos: {:d})",
+ stream_get_tag(stream), stream.pos());
+ return tag.error();
+ }
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
- MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
- throw corrupted("Signature corrupted");
+ range.start = stream.pos();
+ tag = stream.asn1_read_tag(/* SpcAttributeTypeAndOptionalValue */
+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
+ if (not tag) {
+ LIEF_INFO("Wrong tag: 0x{:x} (pos: {:d})",
+ stream_get_tag(stream), stream.pos());
+ return tag.error();
}
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
- MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
- throw corrupted("Signature corrupted");
+ // SpcAttributeTypeAndOptionalValue.type
+ auto spc_attr_type = stream.asn1_read_oid();
+ if (not spc_attr_type) {
+ LIEF_INFO("Can't parse spc-attribute-type-and-optional-value.type (pos: {:d})", stream.pos());
+ return spc_attr_type.error();
+ }
+ const std::string& spc_attr_type_str = spc_attr_type.value();
+ LIEF_DEBUG("spc-attribute-type-and-optional-value.type: {}", oid_to_string(spc_attr_type_str));
+ if (spc_attr_type_str != /* SPC_PE_IMAGE_DATA */ "1.3.6.1.4.1.311.2.1.15") {
+ LIEF_WARN("Expecting OID SPC_PE_IMAGE_DATA at {:d} but got {}",
+ stream.pos(), oid_to_string(spc_attr_type_str));
+ return make_error_code(lief_errors::read_error);
}
- // Save off raw now so that it covers everything else in the ContentInfo
- content_info.raw_ = {this->p_, this->p_ + tag};
- // SpcAttributeTypeAndOptionalValue
- // |_ SPC_PE_IMAGE_DATAOBJ
- // |_ SpcPeImageData
- // ++++++++++++++++++++++++++++++++
- VLOG(VDEBUG) << "Parsing SpcAttributeTypeAndOptionalValue (offset: "
- << std::dec << this->current_offset()
- << ")";
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
- MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
- throw corrupted("Signature corrupted");
- }
+ tag = stream.asn1_read_tag(/* SpcPeImageData ::= SEQUENCE */
+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
- content_type_oid.tag = *this->p_;
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &content_type_oid.len, MBEDTLS_ASN1_OID)) != 0) {
- throw corrupted("Signature corrupted");
+ if (not tag) {
+ LIEF_INFO("Wrong tag: 0x{:x} (pos: {:d})",
+ stream_get_tag(stream), stream.pos());
+ return tag.error();
}
- content_type_oid.p = this->p_;
- std::memset(oid_str, 0, sizeof(oid_str));
- mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &content_type_oid);
- VLOG(VDEBUG) << "SpcAttributeTypeAndOptionalValue->type " << oid_str;
- content_info.type_ = oid_str;
- this->p_ += content_type_oid.len;
+ /* SpcPeImageData */ {
+ const size_t length = tag.value();
+ std::vector<uint8_t> raw = {stream.p(), stream.p() + length};
+ VectorStream spc_data_stream{std::move(raw)};
+ stream.increment_pos(spc_data_stream.size());
- // SpcPeImageData
- // |_ SpcPeImageFlags
- // |_ SpcLink
- // ++++++++++++++
- VLOG(VDEBUG) << "Parsing SpcPeImageData (offset: "
- << std::dec << this->current_offset()
- << ")";
-
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
- MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
- throw corrupted("Signature corrupted");
+ auto spc_data = this->parse_spc_pe_image_data(spc_data_stream);
+ if (not spc_data) {
+ LIEF_INFO("Can't parse SpcPeImageData");
+ } else {
+ const SpcPeImageData& spc_data_value = spc_data.value();
+ content_info.file_ = spc_data_value.file;
+ content_info.flags_ = spc_data_value.flags;
+ }
}
- // SpcPeImageFlags
- // ^^^^^^^^^^^^^^^
- VLOG(VDEBUG) << "Parsing SpcPeImageFlags (offset: "
- << std::dec << this->current_offset()
- << ")";
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag, MBEDTLS_ASN1_BIT_STRING)) != 0) {
- throw corrupted("Signature corrupted");
- }
- this->p_ += tag; // skip
+ // ================================================
+ // DigestInfo ::= SEQUENCE
+ // ================================================
+ tag = stream.asn1_read_tag(/* DigestInfo */
+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
- // SpcLink
- // ^^^^^^^
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
- MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
- throw corrupted("Signature corrupted");
+ if (not tag) {
+ LIEF_INFO("Wrong tag 0x{:x} for DigestInfo ::= SEQUENCE (pos: {:d})",
+ stream_get_tag(stream), stream.pos());
+ return tag.error();
}
- this->p_ += tag; // skip
- // DigestInfo
- // ++++++++++
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
- MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
- throw corrupted("Signature corrupted");
+ auto alg_identifier = stream.asn1_read_alg();
+ if (not alg_identifier) {
+ LIEF_INFO("Can't parse SignedData.contentInfo.messageDigest.digestAlgorithm (pos: {:d})",
+ stream.pos());
+ return alg_identifier.error();
}
- if ((ret = mbedtls_asn1_get_alg_null(&(this->p_), this->end_, &alg_oid)) != 0) {
- throw corrupted("Signature corrupted");
+ LIEF_DEBUG("spc-indirect-data-content.digest-algorithm {}", oid_to_string(alg_identifier.value()));
+ ALGORITHMS algo = algo_from_oid(alg_identifier.value());
+ if (algo == ALGORITHMS::UNKNOWN) {
+ LIEF_WARN("LIEF does not handle {}", alg_identifier.value());
+ } else {
+ content_info.digest_algorithm_ = algo;
}
- std::memset(oid_str, 0, sizeof(oid_str));
- mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &alg_oid);
- VLOG(VDEBUG) << "DigestInfo->digestAlgorithm: " << oid_str;
-
- content_info.digest_algorithm_ = oid_str;
-
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag, MBEDTLS_ASN1_OCTET_STRING)) != 0) {
- throw corrupted("Signature corrupted");
+ // From the documentation:
+ // The value must match the digestAlgorithm value specified
+ // in SignerInfo and the parent PKCS #7 digestAlgorithms fields.
+ auto digest = stream.asn1_read_octet_string();
+ if (not digest) {
+ LIEF_INFO("Can't parse SignedData.contentInfo.messageDigest.digest (pos: {:d})",
+ stream.pos());
+ return digest.error();
}
- content_info.digest_ = {this->p_, this->p_ + tag};
-
- //TODO: Read hash
- this->p_ += tag;
-
+ content_info.digest_ = std::move(digest.value());
+ LIEF_DEBUG("spc-indirect-data-content.digest: {}", hex_dump(content_info.digest_));
return content_info;
}
+result<SignatureParser::x509_certificates_t> SignatureParser::parse_certificates(VectorStream& stream) {
+ x509_certificates_t certificates;
+ const uint64_t cert_end_p = stream.size();
+ while (stream.pos() < cert_end_p) {
+ auto cert = stream.asn1_read_cert();
+ if (not cert) {
+ LIEF_INFO("Can't parse X509 cert pkcs7-signed-data.certificates (pos: {:d})",
+ stream.pos());
+ return cert.error();
+ //break;
+ }
+ std::unique_ptr<mbedtls_x509_crt> cert_p = std::move(cert.value());
-std::string SignatureParser::get_content_info_type(void) {
- VLOG(VDEBUG) << "Parse signed data - content info - content type";
-
- mbedtls_asn1_buf content_type_oid;
- int ret = 0;
- char oid_str[256] = { 0 };
-
- content_type_oid.tag = *this->p_;
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &content_type_oid.len, MBEDTLS_ASN1_OID)) != 0) {
- throw corrupted("Signature corrupted");
- }
-
- content_type_oid.p = this->p_;
-
- mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &content_type_oid);
-
- if (MBEDTLS_OID_CMP(MBEDTLS_SPC_INDIRECT_DATA_OBJID, &content_type_oid) != 0) {
- throw corrupted(std::string(oid_str) + " is not SPC_INDIRECT_DATA_OBJID");
+ if /* constexpr */(lief_logging_debug) {
+ char buffer[1024];
+ std::memset(buffer, 0, sizeof(buffer));
+ mbedtls_x509_crt_info(buffer, sizeof(buffer), "", cert_p.get());
+ LIEF_DEBUG("\n{}\n", buffer);
+ }
+ certificates.emplace_back(cert_p.release());
}
- VLOG(VDEBUG) << "contentType: " << oid_str << " (" << oid_to_string(oid_str) << ")";
- this->p_ += content_type_oid.len;
-
- return {oid_str};
+ return certificates;
}
-void SignatureParser::parse_certificates(void) {
- VLOG(VDEBUG) << "Parsing Certificates (offset: "
- << std::dec << this->current_offset()
- << ")";
-
- int ret = 0;
- size_t tag;
- char buffer[1024];
+result<SignatureParser::signer_infos_t> SignatureParser::parse_signer_infos(VectorStream& stream) {
+ const uintptr_t end_set = stream.size();
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
- MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
- throw corrupted("Signature corrupted");
- }
+ signer_infos_t infos;
- uint8_t* cert_end = this->p_ + tag;
- while (this->p_ < cert_end) {
- std::memset(buffer, 0, sizeof(buffer));
+ while (stream.pos() < end_set) {
+ SignerInfo signer;
+ const size_t current_p = stream.pos();
- std::unique_ptr<mbedtls_x509_crt> ca{new mbedtls_x509_crt{}};
- mbedtls_x509_crt_init(ca.get());
- mbedtls_x509_crt_parse_der(ca.get(), this->p_, this->end_ - this->p_);
- if (ca->raw.len <= 0) {
+ auto tag = stream.asn1_read_tag(/* SignerInfo */
+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
+ if (not tag) {
+ LIEF_INFO("Wrong tag: 0x{:x} for pkcs7-signed-data.signer-infos SEQUENCE (pos: {:d})",
+ stream_get_tag(stream), stream.pos());
break;
}
- mbedtls_x509_crt_info(buffer, sizeof(buffer), "", ca.get());
- VLOG(VDEBUG) << std::endl << buffer << std::endl;
-
- this->signature_.certificates_.emplace_back(ca.get());
- this->p_ += ca->raw.len;
- ca.release();
- }
-
- // If one of the certificates failed to parse for some reason, skip past
- // the certificate section so that we have a chance of parsing the rest
- // of the signature.
- if (this->p_ < cert_end) {
- this->p_ = cert_end;
- }
-}
+ // =======================================================
+ // version Version
+ // =======================================================
+ auto version = stream.asn1_read_int();
+ if (not version) {
+ LIEF_INFO("Can't parse pkcs7-signed-data.signer-info.version (pos: {:d})", stream.pos());
+ break;
+ }
-AuthenticatedAttributes SignatureParser::get_authenticated_attributes(void) {
- VLOG(VDEBUG) << "Parsing authenticatedAttributes (offset: "
- << std::dec << this->current_offset()
- << ")";
+ int32_t version_val = version.value();
+ LIEF_DEBUG("pkcs7-signed-data.signer-info.version: {}", version_val);
+ if (version_val != 1) {
+ LIEF_DEBUG("pkcs7-signed-data.signer-info.version: Bad version ({:d})", version_val);
+ break;
+ }
+ signer.version_ = version_val;
+
+ // =======================================================
+ // IssuerAndSerialNumber ::= SEQUENCE {
+ // issuer Name,
+ // serialNumber CertificateSerialNumber
+ // }
+ //
+ // For Name see: https://github.com/ARMmbed/mbedtls/blob/9e4d4387f07326fff227a40f76c25e5181b1b1e2/library/x509_crt.c#L1180
+ // =======================================================
+ tag = stream.asn1_read_tag(/* Name */
+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
+ if (not tag) {
+ LIEF_INFO("Wrong tag: 0x{:x} for \
+ pkcs7-signed-data.signer-infos.issuer-and-serial-number.issuer (pos: {:d})",
+ stream_get_tag(stream), stream.pos());
+ break;
+ }
+ auto issuer = stream.x509_read_names();
+ if (not issuer) {
+ LIEF_INFO("Can't parse pkcs7-signed-data.signer-infos.issuer-and-serial-number.issuer (pos: {:d})",
+ stream.pos());
+ break;
+ }
- int ret = 0;
- size_t tag;
- char oid_str[256] = { 0 };
- mbedtls_asn1_buf content_type_oid;
+ LIEF_DEBUG("pkcs7-signed-data.signer-infos.issuer-and-serial-number.issuer: {} (pos: {:d})",
+ issuer.value(), stream.pos());
+ signer.issuer_ = std::move(issuer.value());
- AuthenticatedAttributes authenticated_attributes;
+ auto sn = stream.x509_read_serial();
+ if (not sn) {
+ LIEF_INFO("Can't parse pkcs7-signed-data.signer-infos.issuer-and-serial-number.serial-number (pos: {:d})",
+ stream.pos());
+ break;
+ }
- uint8_t *p_start = this->p_;
+ LIEF_DEBUG("pkcs7-signed-data.signer-infos.issuer-and-serial-number.serial-number {}",
+ hex_dump(sn.value()));
+ signer.serialno_ = std::move(sn.value());
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
- MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
- throw corrupted("Authenticated attributes corrupted");
- }
+ // =======================================================
+ // Digest Encryption Algorithm
+ // =======================================================
+ {
+ auto digest_alg = stream.asn1_read_alg();
- authenticated_attributes.raw_ = {p_start, p_start + (this->p_ - p_start) + tag};
+ if (not digest_alg) {
+ LIEF_INFO("Can't parse pkcs7-signed-data.signer-infos.digest-algorithm (pos: {:d})", stream.pos());
+ break;
+ }
+ LIEF_DEBUG("pkcs7-signed-data.signer-infos.digest-algorithm: {}", oid_to_string(digest_alg.value()));
- uint8_t* p_end = this->p_ + tag;
- while(this->p_ < p_end) {
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
- MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
- throw corrupted("Authenticated attributes corrupted");
+ ALGORITHMS dg_algo = algo_from_oid(digest_alg.value());
+ if (dg_algo == ALGORITHMS::UNKNOWN) {
+ LIEF_WARN("LIEF does not handle algorithm {}", digest_alg.value());
+ } else {
+ signer.digest_algorithm_ = dg_algo;
+ }
}
- content_type_oid.tag = *this->p_;
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &content_type_oid.len, MBEDTLS_ASN1_OID)) != 0) {
- throw corrupted("Authenticated attributes corrupted");
+ // =======================================================
+ // Authenticated Attributes
+ // =======================================================
+ {
+ const uint64_t auth_attr_start = stream.pos();
+ tag = stream.asn1_read_tag(/* authenticatedAttributes [0] IMPLICIT Attributes OPTIONAL */
+ MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED);
+ if (tag) {
+ const uint64_t auth_attr_end = stream.pos() + tag.value();
+ std::vector<uint8_t> raw_authenticated_attributes =
+ {stream.p(), stream.p() + tag.value()};
+ VectorStream auth_stream(std::move(raw_authenticated_attributes));
+ stream.increment_pos(auth_stream.size());
+ auto authenticated_attributes = this->parse_attributes(auth_stream);
+ if (not authenticated_attributes) {
+ LIEF_INFO("Fail to parse pkcs7-signed-data.signer-infos.authenticated-attributes");
+ } else {
+ signer.raw_auth_data_ = {stream.start() + auth_attr_start, stream.start() + auth_attr_end};
+ signer.authenticated_attributes_ = std::move(authenticated_attributes.value());
+ }
+ }
}
- content_type_oid.p = this->p_;
-
- std::memset(oid_str, 0, sizeof(oid_str));
- mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &content_type_oid);
- this->p_ += content_type_oid.len;
+ // =======================================================
+ // Digest Encryption Algorithm
+ // =======================================================
+ {
+ auto digest_enc_alg = stream.asn1_read_alg();
+ if (not digest_enc_alg) {
+ LIEF_INFO("Can't parse pkcs7-signed-data.signer-infos.digest-encryption-algorithm (pos: {:d})",
+ stream.pos());
+ return digest_enc_alg.error();
+ }
+ LIEF_DEBUG("pkcs7-signed-data.signer-infos.digest-encryption-algorithm: {}",
+ oid_to_string(digest_enc_alg.value()));
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
- MBEDTLS_ASN1_SET | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
- throw corrupted("Authenticated attributes corrupted");
+ ALGORITHMS dg_enc_algo = algo_from_oid(digest_enc_alg.value());
+ if (dg_enc_algo == ALGORITHMS::UNKNOWN) {
+ LIEF_WARN("LIEF does not handle algorithm {}", digest_enc_alg.value());
+ } else {
+ signer.digest_enc_algorithm_ = dg_enc_algo;
+ }
}
- if (std::string(oid_str) == "1.2.840.113549.1.9.3") {
- // contentType
- // |_ OID (PKCS #9 Message Digest)
- // |_ SET -> OID
- // ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- VLOG(VDEBUG) << "Parsing contentType (offset: "
- << std::dec << this->current_offset()
- << ")";
- content_type_oid.tag = *this->p_;
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &content_type_oid.len, MBEDTLS_ASN1_OID)) != 0) {
- throw corrupted("Authenticated attributes corrupted");
- }
- content_type_oid.p = this->p_;
-
- std::memset(oid_str, 0, sizeof(oid_str));
- mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &content_type_oid);
- authenticated_attributes.content_type_ = oid_str;
- this->p_ += content_type_oid.len;
- continue;
-
- } else if (std::string(oid_str) == "1.2.840.113549.1.9.4") {
- // messageDigest (Octet string)
- // |_ OID (PKCS #9 Message Digest)
- // |_ SET -> OCTET STING
- // ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- VLOG(VDEBUG) << "Parsing messageDigest (offset: "
- << std::dec << this->current_offset()
- << ")";
- VLOG(VDEBUG) << oid_str << " (" << oid_to_string(oid_str) << ")"; // 1.2.840.113549.1.9.4
-
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag, MBEDTLS_ASN1_OCTET_STRING)) != 0) {
- throw corrupted("Signature corrupted: Can't read 'ASN1_OCTET_STRING'");
- }
- authenticated_attributes.message_digest_ = {this->p_, this->p_ + tag};
- this->p_ += tag;
- continue;
-
- } else if (std::string(oid_str) == "1.3.6.1.4.1.311.2.1.12") {
- // SpcSpOpusInfo
- // |_ programName (utf16)
- // |_ moreInfo
- // ~~~~~~~~~~~~~~~~~~~~~~
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
- MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
- throw corrupted("Authenticated attributes corrupted");
+ // =======================================================
+ // Encrypted Digest
+ // =======================================================
+ {
+ auto enc_digest = stream.asn1_read_octet_string();
+ if (not enc_digest) {
+ LIEF_INFO("Can't parse pkcs7-signed-data.signer-infos.encrypted-digest (pos: {:d})",
+ stream.pos());
+ return enc_digest.error();
}
+ LIEF_DEBUG("pkcs7-signed-data.signer-infos.encrypted-digest: {}", hex_dump(enc_digest.value()).substr(0, 10));
+ signer.encrypted_digest_ = enc_digest.value();
+ }
- if (tag == 0) {
- VLOG(VDEBUG) << "No program name or more info specified ";
- authenticated_attributes.program_name_ = u"";
- authenticated_attributes.more_info_ = "";
- continue;
+ // =======================================================
+ // Unauthenticated Attributes
+ // =======================================================
+ {
+ tag = stream.asn1_read_tag(/* unauthenticatedAttributes [1] IMPLICIT Attributes OPTIONAL */
+ MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 1);
+ if (tag) {
+ std::vector<uint8_t> raw_unauthenticated_attributes =
+ {stream.p(), stream.p() + tag.value()};
+ VectorStream unauth_stream(std::move(raw_unauthenticated_attributes));
+ stream.increment_pos(unauth_stream.size());
+ auto unauthenticated_attributes = this->parse_attributes(unauth_stream);
+ if (not unauthenticated_attributes) {
+ LIEF_INFO("Fail to parse pkcs7-signed-data.signer-infos.unauthenticated-attributes");
+ } else {
+ signer.unauthenticated_attributes_ = std::move(unauthenticated_attributes.value());
+ }
}
+ }
+ infos.push_back(std::move(signer));
- uint8_t *seq_end = this->p_ + tag;
-
- if (*this->p_ == (MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED)) {
- this->p_ += 1;
- if ((ret = mbedtls_asn1_get_len(&(this->p_), this->end_, &tag)) != 0) {
- VLOG(VDEBUG) << "Unexpected format for SpcSpOpusInfo [0] block ";
- throw corrupted("Authenticated attributes corrupted");
- }
+ if (stream.pos() <= current_p) {
+ break;
+ }
+ }
+ return infos;
+}
- // Two cases to handle here:
- // SpcString ::= CHOICE {
- // unicode [0] IMPLICIT BMPSTRING,
- // ascii [1] IMPLICIT IA5STRING
- // }
-
- if (*this->p_ == (MBEDTLS_ASN1_CONTEXT_SPECIFIC) ||
- *this->p_ == (MBEDTLS_ASN1_CONTEXT_SPECIFIC | 1)) {
- this->p_ += 1;
- if ((ret = mbedtls_asn1_get_len(&(this->p_), this->end_, &tag)) != 0) {
- VLOG(VDEBUG) << "Unexpected format for SpcString block ";
- throw corrupted("Authenticated attributes corrupted");
- }
-
- VLOG(VDEBUG) << "Offset: " << std::dec << this->current_offset();
- VLOG(VDEBUG) << "Size: " << std::dec << tag;
-
- // u8 -> u16 due to endiness
- std::string u8progname{reinterpret_cast<char*>(this->p_), tag};
- std::u16string progname;
- try {
- utf8::unchecked::utf8to16(std::begin(u8progname), std::end(u8progname), std::back_inserter(progname));
- } catch (const utf8::exception&) {
- LOG(WARNING) << "utf8 error when parsing progname";
- }
-
- authenticated_attributes.program_name_ = progname;
- VLOG(VDEBUG) << "ProgName " << u16tou8(progname);
- this->p_ += tag;
- } else {
- VLOG(VDEBUG) << "Unexpected format for SpcString block ";
- throw corrupted("Authenticated attributes corrupted");
- }
-
- if (this->p_ >= seq_end) {
- VLOG(VDEBUG) << "No more info specified ";
- authenticated_attributes.more_info_ = "";
- continue;
- }
+result<SignatureParser::attributes_t> SignatureParser::parse_attributes(VectorStream& stream) {
+ // Attributes ::= SET OF Attribute
+ //
+ // Attribute ::= SEQUENCE
+ // {
+ // type EncodedObjectID,
+ // values AttributeSetValue
+ // }
+ attributes_t attributes;
+ const uint64_t end_pos = stream.size();
+ while (stream.pos() < end_pos) {
+ auto tag = stream.asn1_read_tag(/* Attribute ::= SEQUENCE */
+ MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED);
+ if (not tag) {
+ LIEF_INFO("Can't parse attribute (pos: {:d})", stream.pos());
+ break;
+ }
- } else {
- VLOG(VDEBUG) << "No program name specified ";
- authenticated_attributes.program_name_ = u"";
+ auto oid = stream.asn1_read_oid();
+ if (not oid) {
+ LIEF_INFO("Can't parse attribute.type (pos: {:d})", stream.pos());
+ break;
+ }
+ tag = stream.asn1_read_tag(/* AttributeSetValue */
+ MBEDTLS_ASN1_SET | MBEDTLS_ASN1_CONSTRUCTED);
+ if (not tag) {
+ LIEF_DEBUG("attribute.values: Unable to get set for {}", oid.value());
+ break;
+ }
+ const size_t value_set_size = tag.value();
+ LIEF_DEBUG("attribute.values: {} ({:d} bytes)", oid_to_string(oid.value()), value_set_size);
+
+ std::vector<uint8_t> raw = {stream.p(), stream.p() + value_set_size};
+ VectorStream value_stream(std::move(raw));
+
+ while (value_stream.pos() < value_stream.size()) {
+ const uint64_t current_p = value_stream.pos();
+ const std::string& oid_str = oid.value();
+
+ if (oid_str == /* contentType */ "1.2.840.113549.1.9.3") {
+ auto res = this->parse_content_type(value_stream);
+ if (not res or res.value() == nullptr) {
+ LIEF_INFO("Can't parse content-type attribute");
+ } else {
+ attributes.push_back(std::move(res.value()));
+ }
}
- // moreInfo
- // ++++++++
- if (*this->p_ == (MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_BOOLEAN)) {
- this->p_ += 1;
- if ((ret = mbedtls_asn1_get_len(&(this->p_), this->end_, &tag)) != 0) {
- VLOG(VDEBUG) << "Unexpected format for SpcSpOpusInfo [1] block ";
- throw corrupted("Authenticated attributes corrupted");
- }
-
- uint8_t p_val = *this->p_;
-
- this->p_ += 1;
- if ((ret = mbedtls_asn1_get_len(&(this->p_), this->end_, &tag)) != 0) {
- VLOG(VDEBUG) << "Unexpected format for SpcLink block ";
- throw corrupted("Authenticated attributes corrupted");
+ else if (oid_str == /* SpcSpOpusInfo */ "1.3.6.1.4.1.311.2.1.12") {
+ auto res = this->parse_spc_sp_opus_info(value_stream);
+ if (not res) {
+ LIEF_INFO("Can't parse spc-sp-opus-info attribute");
+ } else {
+ SpcSpOpusInfo info = std::move(res.value());
+ attributes.emplace_back(new PE::SpcSpOpusInfo{std::move(info.program_name), std::move(info.more_info)});
+ }
+ }
+ // TODO(romain): Parse the internal DER of Ms-CounterSign
+ // else if (oid_str == /* Ms-CounterSign */ "1.3.6.1.4.1.311.3.3.1") {
+ // auto res = this->parse_ms_counter_sign(value_stream);
+ // if (not res) {
+ // LIEF_INFO("Can't parse ms-counter-sign attribute");
+ // }
+ // }
+
+ else if (oid_str == /* pkcs9-CounterSignature */ "1.2.840.113549.1.9.6") {
+ auto res = this->parse_pkcs9_counter_sign(value_stream);
+ if (not res) {
+ LIEF_INFO("Can't parse pkcs9-counter-sign attribute");
+ } else {
+ const std::vector<SignerInfo>& signers = res.value();
+ if (signers.size() == 0) {
+ LIEF_INFO("Can't parse signer info associated with the pkcs9-counter-sign");
+ } else if (signers.size() > 1) {
+ LIEF_INFO("More than one signer info associated with the pkcs9-counter-sign");
+ } else {
+ attributes.emplace_back(new PKCS9CounterSignature(std::move(signers.back())));
}
+ }
+ }
- // Three cases to handle here:
- // SpcLink ::= CHOICE {
- // url [0] IMPLICIT IA5STRING,
- // moniker [1] IMPLICIT SpcSerializedObject,
- // file [2] EXPLICIT SpcString
- // }
+ else if (oid_str == /* Ms-SpcNestedSignature */ "1.3.6.1.4.1.311.2.4.1") {
+ auto res = this->parse_ms_spc_nested_signature(value_stream);
+ if (not res) {
+ LIEF_INFO("Can't parse ms-spc-nested-signature attribute");
+ } else {
+ attributes.emplace_back(new MsSpcNestedSignature(std::move(res.value())));
+ }
+ }
- if (p_val == (MBEDTLS_ASN1_CONTEXT_SPECIFIC)) {
+ else if (oid_str == /* pkcs9-MessageDigest */ "1.2.840.113549.1.9.4") {
+ auto res = this->parse_pkcs9_message_digest(value_stream);
+ if (not res) {
+ LIEF_INFO("Can't parse pkcs9-message-digest attribute");
+ } else {
+ attributes.emplace_back(new PKCS9MessageDigest(std::move(res.value())));
+ }
+ }
- std::string more_info{reinterpret_cast<char*>(this->p_), tag}; // moreInfo
- authenticated_attributes.more_info_ = more_info;
- VLOG(VDEBUG) << more_info;
- this->p_ += tag;
+ else if (oid_str == /* Ms-SpcStatementType */ "1.3.6.1.4.1.311.2.1.11") {
+ auto res = this->parse_ms_spc_statement_type(value_stream);
+ if (not res) {
+ LIEF_INFO("Can't parse ms-spc-statement-type attribute");
+ } else {
+ attributes.emplace_back(new MsSpcStatementType(std::move(res.value())));
+ }
+ }
- } else if (p_val == (MBEDTLS_ASN1_CONTEXT_SPECIFIC | 1)) {
- VLOG(VDEBUG) << "Parsing MoreInfo 'moniker' option not currently supported ";
- authenticated_attributes.more_info_ = "";
+ else if (oid_str == /* pkcs9-at-SequenceNumber */ "1.2.840.113549.1.9.25.4") {
+ auto res = this->parse_pkcs9_at_sequence_number(value_stream);
+ if (not res) {
+ LIEF_INFO("Can't parse ms-spc-statement-type attribute");
+ } else {
+ attributes.emplace_back(new PKCS9AtSequenceNumber(res.value()));
+ }
+ }
- } else if (p_val == (MBEDTLS_ASN1_CONTEXT_SPECIFIC | 2)) {
- VLOG(VDEBUG) << "Parsing MoreInfo 'file' option not currently supported ";
- authenticated_attributes.more_info_ = "";
+ else if (oid_str == /* pkcs9-signing-time */ "1.2.840.113549.1.9.5") {
+ auto res = this->parse_pkcs9_signing_time(value_stream);
+ if (not res) {
+ LIEF_INFO("Can't parse ms-spc-statement-type attribute");
+ } else {
+ attributes.emplace_back(new PKCS9SigningTime(std::move(res.value())));
+ }
+ }
- } else {
- VLOG(VDEBUG) << "Unexpected format for SpcLink block ";
- throw corrupted("Authenticated attributes corrupted");
- }
- continue;
+ else {
+ LIEF_INFO("Unknown OID: {}", oid_str);
+ attributes.emplace_back(new GenericType{oid_str, value_stream.content()});
+ break;
}
- } else {
- VLOG(VDEBUG) << "Skipping OID " << oid_str;
- this->p_ += tag;
- continue;
+ if (current_p >= value_stream.pos()) {
+ LIEF_INFO("End-loop detected!");
+ break;
+ }
}
+ stream.increment_pos(value_set_size);
}
-
- return authenticated_attributes;
+ return attributes;
}
-
-SignerInfo SignatureParser::get_signer_info(void) {
- int ret = 0;
- size_t tag;
- char oid_str[256] = { 0 };
- mbedtls_asn1_buf alg_oid;
-
- SignerInfo signer_info;
- int32_t version;
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
- MBEDTLS_ASN1_SET | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
- throw corrupted("Signer info corrupted");
+result<std::unique_ptr<Attribute>> SignatureParser::parse_content_type(VectorStream& stream) {
+ /*
+ *
+ * ContentType ::= OBJECT IDENTIFIER
+ * Content type as defined in https://tools.ietf.org/html/rfc2315#section-6.8
+ */
+
+ auto oid = stream.asn1_read_oid();
+ if (not oid) {
+ LIEF_INFO("Can't parse content-type.oid (pos: {:d})", stream.pos());
+ return oid.error();
}
+ const std::string& oid_str = oid.value();
+ LIEF_DEBUG("content-type.oid: {}", oid_to_string(oid_str));
+ LIEF_DEBUG("content-type remaining bytes: {}", stream.size() - stream.pos());
+ return std::unique_ptr<Attribute>{new ContentType{oid_str}};
+}
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
- MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
- throw corrupted("Signer info corrupted");
+result<SignatureParser::SpcSpOpusInfo> SignatureParser::parse_spc_sp_opus_info(VectorStream& stream) {
+ // SpcSpOpusInfo ::= SEQUENCE {
+ // programName [0] EXPLICIT SpcString OPTIONAL,
+ // moreInfo [1] EXPLICIT SpcLink OPTIONAL
+ // }
+ LIEF_DEBUG("Parse spc-sp-opus-info");
+ SpcSpOpusInfo info;
+ auto tag = stream.asn1_read_tag(/* SpcSpOpusInfo ::= SEQUENCE */
+ MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED);
+ if (not tag) {
+ LIEF_INFO("Wrong tag for spc-sp-opus-info SEQUENCE : 0x{:x} (pos: {:d})",
+ stream_get_tag(stream), this->stream_->pos());
+ return tag.error();
}
- if ((ret = mbedtls_asn1_get_int(&(this->p_), this->end_, &version)) != 0) {
- throw corrupted("Signer info corrupted");
+ tag = stream.asn1_read_tag(/* programName [0] EXPLICIT SpcString OPTIONAL */
+ MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED);
+ if (tag) {
+ std::vector<uint8_t> raw = {stream.p(), stream.p() + tag.value()};
+ VectorStream spc_string_stream(std::move(raw));
+ auto program_name = this->parse_spc_string(spc_string_stream);
+ if (not program_name) {
+ LIEF_INFO("Fail to parse spc-sp-opus-info.program-name");
+ } else {
+ info.program_name = program_name.value();
+ }
+ stream.increment_pos(spc_string_stream.size());
}
+ tag = stream.asn1_read_tag(/* moreInfo [1] EXPLICIT SpcLink OPTIONAL */
+ MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 1);
+ if (tag) {
+ std::vector<uint8_t> raw = {stream.p(), stream.p() + tag.value()};
+ VectorStream spc_link_stream(std::move(raw));
+ auto more_info = this->parse_spc_link(spc_link_stream);
+ if (not more_info) {
+ LIEF_INFO("Fail to parse spc-sp-opus-info.more-info");
+ } else {
+ info.more_info = more_info.value();
+ }
+ stream.increment_pos(spc_link_stream.size());
+ }
+ return info;
+}
- VLOG(VDEBUG) << "Version: " << std::dec << version;
- LOG_IF(version != 1, WARNING) << "SignerInfo's version should be equal to 1 (" << std::dec << version << ")";
- signer_info.version_ = version;
-
- // issuerAndSerialNumber
- // ---------------------
- VLOG(VDEBUG) << "Parsing issuerAndSerialNumber (offset: "
- << std::dec << this->current_offset()
- << ")";
+result<void> SignatureParser::parse_ms_counter_sign(VectorStream& stream) {
+ LIEF_DEBUG("Parsing Ms-CounterSign ({} bytes)", stream.size());
+ LIEF_DEBUG("TODO: Ms-CounterSign");
+ stream.increment_pos(stream.size());
+ return {};
+}
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
- MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
- throw corrupted("Signer info corrupted");
+result<SignatureParser::signer_infos_t> SignatureParser::parse_pkcs9_counter_sign(VectorStream& stream) {
+ //
+ // counterSignature ATTRIBUTE ::= {
+ // WITH SYNTAX SignerInfo
+ // ID pkcs-9-at-counterSignature
+ // }
+ LIEF_DEBUG("Parsing pkcs9-CounterSign ({} bytes)", stream.size());
+ auto counter_sig = this->parse_signer_infos(stream);
+ if (not counter_sig) {
+ LIEF_INFO("Fail to parse pkcs9-counter-signature");
+ return counter_sig.error();
}
+ LIEF_DEBUG("pkcs9-counter-signature remaining bytes: {}", stream.size() - stream.pos());
+ return counter_sig.value();
+}
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag,
- MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
- throw corrupted("Signer info corrupted");
+result<Signature> SignatureParser::parse_ms_spc_nested_signature(VectorStream& stream) {
+ // SET of pkcs7-signed data
+ LIEF_DEBUG("Parsing Ms-SpcNestedSignature ({} bytes)", stream.size());
+ auto sign = SignatureParser::parse(stream.content(), /* skip header */ false);
+ if (not sign) {
+ LIEF_INFO("Ms-SpcNestedSignature finished with errors");
+ return sign.error();
}
+ LIEF_DEBUG("ms-spc-nested-signature remaining bytes: {}", stream.size() - stream.pos());
+ return sign.value();
+}
- // Name
- // ~~~~
- mbedtls_x509_name name;
- char buffer[1024];
-
- uint8_t* p_end = this->p_ + tag;
-
- std::memset(&name, 0, sizeof(name));
- if ((ret = mbedtls_x509_get_name(&(this->p_), p_end, &name)) != 0) {
- throw corrupted("Signer info corrupted");
+result<std::vector<uint8_t>> SignatureParser::parse_pkcs9_message_digest(VectorStream& stream) {
+ auto digest = stream.asn1_read_octet_string();
+ if (not digest) {
+ LIEF_INFO("Can't process OCTET STREAM for attribute.pkcs9-message-digest (pos: {})",
+ stream.pos());
+ return digest.error();
}
+ const std::vector<uint8_t>& raw_digest = digest.value();
+ LIEF_DEBUG("attribute.pkcs9-message-digest {}", hex_dump(raw_digest));
+ LIEF_DEBUG("pkcs9-message-digest remaining bytes: {}", stream.size() - stream.pos());
+ return raw_digest;
+}
- mbedtls_x509_dn_gets(buffer, sizeof(buffer), &name);
-
- std::string issuer_name {buffer};
-
- VLOG(VDEBUG) << "Issuer: " << issuer_name;
-
- mbedtls_x509_name *name_cur;
-
- name_cur = name.next;
- while( name_cur != NULL )
- {
- mbedtls_x509_name *name_prv = name_cur;
- name_cur = name_cur->next;
- mbedtls_free( name_prv );
+result<oid_t> SignatureParser::parse_ms_spc_statement_type(VectorStream& stream) {
+ // SpcStatementType ::= SEQUENCE of OBJECT IDENTIFIER
+ LIEF_DEBUG("Parsing Ms-SpcStatementType ({} bytes)", stream.size());
+ auto tag = stream.asn1_read_tag(MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
+ if (not tag) {
+ LIEF_INFO("Wrong tag for ms-spc-statement-type: 0x{:x} (pos: {:d})",
+ stream_get_tag(stream), this->stream_->pos());
+ return tag.error();
}
- // CertificateSerialNumber (issuer SN)
- // ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- mbedtls_x509_buf serial;
- if ((ret = mbedtls_x509_get_serial(&(this->p_), this->end_, &serial)) != 0) {
- throw corrupted("Signer info corrupted");
+ auto oid = stream.asn1_read_oid();
+ if (not oid) {
+ LIEF_INFO("Can't parse ms-spc-statement-type.oid (pos: {:d})", stream.pos());
+ return oid.error();
}
- std::vector<uint8_t> certificate_sn = {serial.p, serial.p + serial.len};
-
- signer_info.issuer_ = {issuer_name, certificate_sn};
+ const oid_t& oid_str = oid.value();
+ LIEF_DEBUG("ms-spc-statement-type.oid: {}", oid_to_string(oid_str));
+ LIEF_DEBUG("ms-spc-statement-type remaining bytes: {}", stream.size() - stream.pos());
+ return oid_str;
+}
- // digestAlgorithm
- // ---------------
- VLOG(VDEBUG) << "Parsing digestAlgorithm (offset: "
- << std::dec << this->current_offset()
- << ")";
- if ((ret = mbedtls_asn1_get_alg_null(&(this->p_), this->end_, &alg_oid)) != 0) {
- throw corrupted("Signer info corrupted");
+result<int32_t> SignatureParser::parse_pkcs9_at_sequence_number(VectorStream& stream) {
+ LIEF_DEBUG("Parsing pkcs9-at-SequenceNumber ({} bytes)", stream.size());
+ auto value = stream.asn1_read_int();
+ if (not value) {
+ LIEF_INFO("pkcs9-at-sequence-number: Can't parse integer");
+ return value.error();
}
+ LIEF_DEBUG("pkcs9-at-sequence-number.int: {}", value.value());
+ LIEF_DEBUG("pkcs9-at-sequence-number remaining bytes: {}", stream.size() - stream.pos());
+ return value.value();
+}
- std::memset(oid_str, 0, sizeof(oid_str));
- mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &alg_oid);
- VLOG(VDEBUG) << "signerInfo->digestAlgorithm " << oid_str;
-
- signer_info.digest_algorithm_ = oid_str;
- // authenticatedAttributes (IMPLICIT OPTIONAL)
- // |_ contentType
- // |_ messageDigest
- // |_ SpcSpOpusInfo
- // -----------------------
+result<std::string> SignatureParser::parse_spc_string(VectorStream& stream) {
+ // SpcString ::= CHOICE {
+ // unicode [0] IMPLICIT BMPSTRING,
+ // ascii [1] IMPLICIT IA5STRING
+ // }
+ LIEF_DEBUG("Parse SpcString ({} bytes)", stream.size());
+ auto choice = stream.asn1_read_tag(MBEDTLS_ASN1_CONTEXT_SPECIFIC | 0);
+ if (choice) {
+ LIEF_DEBUG("SpcString: Unicode choice");
+ const size_t length = choice.value();
+ LIEF_DEBUG("spc-string.program-name length: {} (pos: {})", length, stream.pos());
+
+ if (not stream.can_read<char16_t>(length / sizeof(char16_t))) {
+ LIEF_INFO("Can't read spc-string.program-name");
+ return make_error_code(lief_errors::read_error);
+ }
+ stream.set_endian_swap(true);
+ std::u16string progname = stream.read_u16string(length / sizeof(char16_t));
+ stream.set_endian_swap(false);
- try {
- signer_info.authenticated_attributes_ = this->get_authenticated_attributes();
- }
- catch (const corrupted& c) {
- LOG(ERROR) << c.what();
+ try {
+ return u16tou8(progname);
+ } catch (const utf8::exception&) {
+ LIEF_INFO("Error while converting utf-8 spc-string.program-name to utf16");
+ return make_error_code(lief_errors::conversion_error);
+ }
}
-
- // digestEncryptionAlgorithm
- // -------------------------
- if ((ret = mbedtls_asn1_get_alg_null(&(this->p_), this->end_, &alg_oid)) != 0) {
- throw corrupted("Signer info corrupted");
+ else if ((choice = stream.asn1_read_tag(MBEDTLS_ASN1_CONTEXT_SPECIFIC | 1))) {
+ LIEF_DEBUG("SpcString: ASCII choice");
+ const size_t length = choice.value();
+ const char* str = stream.read_array<char>(length);
+ if (str == nullptr) {
+ LIEF_INFO("Can't read spc-string.program-name");
+ return make_error_code(lief_errors::read_error);
+ }
+ std::string u8progname{str, str + length};
+ LIEF_DEBUG("spc-string.program-name: {}", u8progname);
+ return u8progname;
}
- std::memset(oid_str, 0, sizeof(oid_str));
- mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &alg_oid);
- signer_info.signature_algorithm_ = oid_str;
-
- VLOG(VDEBUG) << "digestEncryptionAlgorithm: " << oid_str;
-
- // encryptedDigest
- // ---------------
- if ((ret = mbedtls_asn1_get_tag(&(this->p_), this->end_, &tag, MBEDTLS_ASN1_OCTET_STRING)) != 0) {
- throw corrupted("Signer info corrupted");
+ else {
+ LIEF_INFO("Can't select choice for SpcString (pos: {})", stream.pos());
+ return make_error_code(lief_errors::read_error);
}
- signer_info.encrypted_digest_ = {this->p_, this->p_ + tag};
- this->p_ += tag;
-
- //TODO:
- // unauthenticatedAttributes
- return signer_info;
-
+ return {};
}
-void SignatureParser::parse_signature(void) {
- this->parse_header();
-
- // Version
- // =======
- int32_t version = this->get_signed_data_version();
- this->signature_.version_ = static_cast<uint32_t>(version);
-
- // Algo (digestAlgorithms)
- // =======================
- try {
- this->signature_.digest_algorithm_ = this->get_signed_data_digest_algorithms();
+result<std::string> SignatureParser::parse_spc_link(VectorStream& stream) {
+ // SpcLink ::= CHOICE {
+ // url [0] IMPLICIT IA5STRING,
+ // moniker [1] IMPLICIT SpcSerializedObject,
+ // file [2] EXPLICIT SpcString
+ // }
+ LIEF_DEBUG("Parse SpcLink ({} bytes)", stream.size());
+ auto choice = stream.asn1_read_tag(/* url */ MBEDTLS_ASN1_CONTEXT_SPECIFIC | 0);
+ if (choice) {
+ const size_t length = choice.value();
+ const char* str = stream.read_array<char>(length);
+ if (str == nullptr) {
+ LIEF_INFO("Can't read spc-link.url");
+ return make_error_code(lief_errors::read_error);
+ }
+ std::string url{str, str + length};
+ LIEF_DEBUG("spc-link.url: {}", url);
+ return url;
}
- catch (const corrupted& c) {
- LOG(ERROR) << c.what();
+ else if ((choice = stream.asn1_read_tag(/* moniker */ MBEDTLS_ASN1_CONTEXT_SPECIFIC | 1))) {
+ LIEF_INFO("Parsing spc-link.moniker is not supported");
+ return make_error_code(lief_errors::not_supported);
}
-
- // contentInfo
- // |_ contentType
- // |_ content (SpcIndirectDataContent)
- // ===================================
- try {
- this->signature_.content_info_ = this->parse_content_info();
+ else if ((choice = stream.asn1_read_tag(/* file */ MBEDTLS_ASN1_CONTEXT_SPECIFIC | 2))) {
+ LIEF_INFO("Parsing spc-link.file is not supported");
+ return make_error_code(lief_errors::not_supported);
}
- catch (const corrupted& c) {
- LOG(ERROR) << c.what();
+ else {
+ LIEF_INFO("Corrupted choice for spc-link (choice: 0x{:x})", stream_get_tag(stream));
+ return make_error_code(lief_errors::corrupted);
}
+ return {};
+}
- // Certificates
- // ============
- try {
- this->parse_certificates();
- }
- catch (const corrupted& c) {
- LOG(ERROR) << c.what();
+
+result<SignatureParser::time_t> SignatureParser::parse_pkcs9_signing_time(VectorStream& stream) {
+ // See: https://tools.ietf.org/html/rfc2985#page-20
+ // UTCTIME :171116220536Z
+ auto tm = stream.x509_read_time();
+ if (not tm) {
+ LIEF_INFO("Can't read pkcs9-signing-time (pos: {})", stream.pos());
+ return tm.error();
}
+ std::unique_ptr<mbedtls_x509_time> time = std::move(tm.value());
+ LIEF_DEBUG("pkcs9-signing-time {}/{}/{}", time->day, time->mon, time->year);
+ return SignatureParser::time_t{time->year, time->mon, time->day, time->hour, time->min, time->sec};
+}
- // signerInfo
- // ==========
- try {
- this->signature_.signer_info_ = this->get_signer_info();
- }
- catch (const corrupted& c) {
- LOG(ERROR) << c.what();
- }
- VLOG(VDEBUG) << "Signature: " << std::endl << this->signature_;
+result<SignatureParser::SpcPeImageData> SignatureParser::parse_spc_pe_image_data(VectorStream& stream) {
+ // SpcPeImageData ::= SEQUENCE {
+ // flags SpcPeImageFlags DEFAULT { includeResources },
+ // file SpcLink
+ // }
+ //
+ // SpcPeImageFlags ::= BIT STRING {
+ // includeResources (0),
+ // includeDebugInfo (1),
+ // includeImportAddressTable (2)
+ // }
+ //
+ // SpcLink ::= CHOICE {
+ // url [0] IMPLICIT IA5STRING,
+ // moniker [1] IMPLICIT SpcSerializedObject,
+ // file [2] EXPLICIT SpcString
+ // }
+ //
+ // SpcString ::= CHOICE {
+ // unicode [0] IMPLICIT BMPSTRING,
+ // ascii [1] IMPLICIT IA5STRING
+ // }
+ //LIEF_DEBUG("Parse SpcPeImageData ({} bytes)", stream.size());
+ //auto tag = stream.asn1_read_tag(MBEDTLS_ASN1_BIT_STRING);
+ //if (not tag) {
+ // LIEF_INFO("Wrong tag for spc-pe-image-data.flags \
+ // Expecting BIT-STRING but got 0x{:x} (off: {:d})", stream.peek<uint8_t>(), stream.pos());
+ // return tag.error();
+ //}
+ //LIEF_DEBUG("Length: {}", tag.value());
+ //uint8_t flag = stream.read<uint8_t>();
+ //LIEF_DEBUG("flag: {:b}", flag);
+
+ //tag = stream.asn1_read_tag(MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_CONTEXT_SPECIFIC);
+ //if (not tag) {
+ // LIEF_INFO("Wrong tag for spc-pe-image-data.flags \
+ // Expecting BIT-STRING but got 0x{:x} (off: {:d})", stream.peek<uint8_t>(), stream.pos());
+ // return tag.error();
+ //}
+ ////LIEF_INFO("spc-pe-image-data.flags length: {:d}", flags.value().size());
+ //auto file = this->parse_spc_link(stream);
+ //if (not file) {
+ // LIEF_INFO("Can't parse spc-pe-image-data.file (pos: {})", stream.pos());
+ // return file.error();
+ //}
+
+ return {};
}
diff --git a/src/PE/signature/SignerInfo.cpp b/src/PE/signature/SignerInfo.cpp
index 00088357..69501302 100644
--- a/src/PE/signature/SignerInfo.cpp
+++ b/src/PE/signature/SignerInfo.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -18,80 +18,150 @@
#include <numeric>
#include <sstream>
+#include <spdlog/fmt/fmt.h>
+
+#include "LIEF/PE/signature/x509.hpp"
#include "LIEF/PE/signature/OIDToString.hpp"
#include "LIEF/PE/signature/SignerInfo.hpp"
+#include "LIEF/PE/signature/Attribute.hpp"
+
+#include "LIEF/PE/EnumToString.hpp"
namespace LIEF {
namespace PE {
SignerInfo::SignerInfo(void) = default;
-SignerInfo::SignerInfo(const SignerInfo&) = default;
-SignerInfo& SignerInfo::operator=(const SignerInfo&) = default;
SignerInfo::~SignerInfo(void) = default;
-
-uint32_t SignerInfo::version(void) const {
- return this->version_;
+SignerInfo::SignerInfo(SignerInfo&&) = default;
+SignerInfo& SignerInfo::operator=(SignerInfo&&) = default;
+
+SignerInfo::SignerInfo(const SignerInfo& other) :
+ Object::Object(other),
+ version_{other.version_},
+ issuer_{other.issuer_},
+ serialno_{other.serialno_},
+ digest_algorithm_{other.digest_algorithm_},
+ digest_enc_algorithm_{other.digest_enc_algorithm_},
+ encrypted_digest_{other.encrypted_digest_},
+ raw_auth_data_{other.raw_auth_data_}
+{
+ for (const std::unique_ptr<Attribute>& attr : other.authenticated_attributes_) {
+ this->authenticated_attributes_.push_back(attr->clone());
+ }
+
+ for (const std::unique_ptr<Attribute>& attr : other.unauthenticated_attributes_) {
+ this->unauthenticated_attributes_.push_back(attr->clone());
+ }
+
+ if (other.cert_ != nullptr) {
+ this->cert_ = std::unique_ptr<x509>(new x509{*other.cert_});
+ }
}
+SignerInfo& SignerInfo::operator=(SignerInfo other) {
+ this->swap(other);
+ return *this;
+}
-const issuer_t& SignerInfo::issuer(void) const {
- return this->issuer_;
+void SignerInfo::swap(SignerInfo& other) {
+ std::swap(this->version_, other.version_);
+ std::swap(this->issuer_, other.issuer_);
+ std::swap(this->serialno_, other.serialno_);
+ std::swap(this->digest_algorithm_, other.digest_algorithm_);
+ std::swap(this->digest_enc_algorithm_, other.digest_enc_algorithm_);
+ std::swap(this->encrypted_digest_, other.encrypted_digest_);
+ std::swap(this->raw_auth_data_, other.raw_auth_data_);
+ std::swap(this->authenticated_attributes_, other.authenticated_attributes_);
+ std::swap(this->unauthenticated_attributes_, other.unauthenticated_attributes_);
+ std::swap(this->cert_, other.cert_);
}
-const oid_t& SignerInfo::digest_algorithm(void) const {
+uint32_t SignerInfo::version(void) const {
+ return this->version_;
+}
+
+ALGORITHMS SignerInfo::digest_algorithm(void) const {
return this->digest_algorithm_;
}
+ALGORITHMS SignerInfo::encryption_algorithm(void) const {
+ return this->digest_enc_algorithm_;
+}
-const AuthenticatedAttributes& SignerInfo::authenticated_attributes(void) const {
- return this->authenticated_attributes_;
+const SignerInfo::encrypted_digest_t& SignerInfo::encrypted_digest(void) const {
+ return this->encrypted_digest_;
}
+it_const_attributes_t SignerInfo::authenticated_attributes() const {
+ std::vector<Attribute*> attrs(this->authenticated_attributes_.size(), nullptr);
+ for (size_t i = 0; i < this->authenticated_attributes_.size(); ++i) {
+ attrs[i] = this->authenticated_attributes_[i].get();
+ }
+ return attrs;
+}
-const oid_t& SignerInfo::signature_algorithm(void) const {
- return this->signature_algorithm_;
+it_const_attributes_t SignerInfo::unauthenticated_attributes() const {
+ std::vector<Attribute*> attrs(this->unauthenticated_attributes_.size(), nullptr);
+ for (size_t i = 0; i < this->unauthenticated_attributes_.size(); ++i) {
+ attrs[i] = this->unauthenticated_attributes_[i].get();
+ }
+ return attrs;
}
-const std::vector<uint8_t>& SignerInfo::encrypted_digest(void) const {
- return this->encrypted_digest_;
-}
+const Attribute* SignerInfo::get_attribute(PE::SIG_ATTRIBUTE_TYPES type) const {
+ const Attribute* attr = this->get_auth_attribute(type);
+ if (attr != nullptr) {
+ return attr;
+ }
-void SignerInfo::accept(Visitor& visitor) const {
- visitor.visit(*this);
-}
+ attr = this->get_unauth_attribute(type);
+ if (attr != nullptr) {
+ return attr;
+ }
-std::ostream& operator<<(std::ostream& os, const SignerInfo& signer_info) {
+ // ... not found -> return nullptr
+ return nullptr;
+}
- constexpr uint8_t wsize = 30;
- const issuer_t& issuer = signer_info.issuer();
- std::string issuer_str = std::get<0>(issuer);
-
- const std::vector<uint8_t>& sn = std::get<1>(issuer);;
- std::string sn_str = std::accumulate(
- std::begin(sn),
- std::end(sn),
- std::string(""),
- [] (std::string lhs, uint8_t x) {
- std::stringstream ss;
- ss << std::setw(2) << std::setfill('0') << std::hex << static_cast<uint32_t>(x);
- return lhs.empty() ? ss.str() : lhs + ":" + ss.str();
+const Attribute* SignerInfo::get_auth_attribute(PE::SIG_ATTRIBUTE_TYPES type) const {
+ auto it_auth = std::find_if(std::begin(this->authenticated_attributes_), std::end(this->authenticated_attributes_),
+ [type] (const std::unique_ptr<Attribute>& attr) {
+ return attr->type() == type;
});
+ if (it_auth != std::end(this->authenticated_attributes_)) {
+ return it_auth->get();
+ }
+ return nullptr;
+}
+const Attribute* SignerInfo::get_unauth_attribute(PE::SIG_ATTRIBUTE_TYPES type) const {
+ auto it_uauth = std::find_if(std::begin(this->unauthenticated_attributes_), std::end(this->unauthenticated_attributes_),
+ [type] (const std::unique_ptr<Attribute>& attr) {
+ return attr->type() == type;
+ });
+ if (it_uauth != std::end(this->unauthenticated_attributes_)) {
+ return it_uauth->get();
+ }
+ return nullptr;
+}
- os << std::hex << std::left;
- os << std::setw(wsize) << std::setfill(' ') << "Version: " << signer_info.version() << std::endl;
- os << std::setw(wsize) << std::setfill(' ') << "Serial Number: " << sn_str << std::endl;
- os << std::setw(wsize) << std::setfill(' ') << "Issuer DN: " << issuer_str << std::endl;
- os << std::setw(wsize) << std::setfill(' ') << "Digest Algorithm: " << oid_to_string(signer_info.digest_algorithm()) << std::endl;
- os << std::setw(wsize) << std::setfill(' ') << "Signature algorithm: " << oid_to_string(signer_info.signature_algorithm()) << std::endl;
+void SignerInfo::accept(Visitor& visitor) const {
+ visitor.visit(*this);
+}
- os << signer_info.authenticated_attributes() << std::endl;
+std::ostream& operator<<(std::ostream& os, const SignerInfo& signer_info) {
+ os << fmt::format("{}/{} - {} - {:d} auth attr - {:d} unauth attr",
+ to_string(signer_info.digest_algorithm()),
+ to_string(signer_info.encryption_algorithm()),
+ signer_info.issuer(),
+ signer_info.authenticated_attributes().size(),
+ signer_info.unauthenticated_attributes().size());
return os;
}
diff --git a/src/PE/signature/attributes/CMakeLists.txt b/src/PE/signature/attributes/CMakeLists.txt
new file mode 100644
index 00000000..b218104f
--- /dev/null
+++ b/src/PE/signature/attributes/CMakeLists.txt
@@ -0,0 +1,42 @@
+set(LIEF_PE_SIGNATURE_ATTRIBUTES_SRC
+ "${CMAKE_CURRENT_LIST_DIR}/GenericType.cpp"
+ "${CMAKE_CURRENT_LIST_DIR}/ContentType.cpp"
+
+ "${CMAKE_CURRENT_LIST_DIR}/SpcSpOpusInfo.cpp"
+
+ "${CMAKE_CURRENT_LIST_DIR}/MsCounterSign.cpp"
+ "${CMAKE_CURRENT_LIST_DIR}/MsSpcNestedSignature.cpp"
+ "${CMAKE_CURRENT_LIST_DIR}/MsSpcStatementType.cpp"
+
+ "${CMAKE_CURRENT_LIST_DIR}/PKCS9AtSequenceNumber.cpp"
+ "${CMAKE_CURRENT_LIST_DIR}/PKCS9CounterSignature.cpp"
+ "${CMAKE_CURRENT_LIST_DIR}/PKCS9MessageDigest.cpp"
+ "${CMAKE_CURRENT_LIST_DIR}/PKCS9SigningTime.cpp"
+)
+
+set(LIEF_PE_SIGNATURE_ATTRIBUTES_INCLUDES
+ "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/attributes/GenericType.hpp"
+ "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/attributes/ContentType.hpp"
+
+ "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/attributes/SpcSpOpusInfo.hpp"
+
+ "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/attributes/MsCounterSign.hpp"
+ "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/attributes/MsSpcNestedSignature.hpp"
+ "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/attributes/MsSpcStatementType.hpp"
+
+ "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/attributes/PKCS9AtSequenceNumber.hpp"
+ "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/attributes/PKCS9CounterSignature.hpp"
+ "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/attributes/PKCS9MessageDigest.hpp"
+ "${CMAKE_CURRENT_SOURCE_DIR}/include/LIEF/PE/signature/attributes/PKCS9SigningTime.hpp"
+)
+
+source_group("Header Files\\PE\\signature\\attributes" FILES ${LIEF_PE_SIGNATURE_ATTRIBUTES_SRC})
+source_group("Header Files\\PE\\signature\\attributes" FILES ${LIEF_PE_SIGNATURE_ATTRIBUTES_INCLUDES})
+
+if (LIEF_PE)
+ target_sources(LIB_LIEF PRIVATE
+ ${LIEF_PE_SIGNATURE_ATTRIBUTES_SRC}
+ ${LIEF_PE_SIGNATURE_ATTRIBUTES_INCLUDES}
+ )
+endif()
+
diff --git a/src/PE/signature/attributes/ContentType.cpp b/src/PE/signature/attributes/ContentType.cpp
new file mode 100644
index 00000000..c0ff3dbb
--- /dev/null
+++ b/src/PE/signature/attributes/ContentType.cpp
@@ -0,0 +1,51 @@
+/* Copyright 2021 R. Thomas
+ * Copyright 2021 Quarkslab
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "LIEF/PE/signature/attributes/ContentType.hpp"
+#include "LIEF/PE/signature/OIDToString.hpp"
+
+namespace LIEF {
+namespace PE {
+
+ContentType::ContentType() :
+ Attribute(SIG_ATTRIBUTE_TYPES::CONTENT_TYPE)
+{}
+
+ContentType::ContentType(const ContentType&) = default;
+ContentType& ContentType::operator=(const ContentType&) = default;
+
+std::unique_ptr<Attribute> ContentType::clone(void) const {
+ return std::unique_ptr<Attribute>(new ContentType{*this});
+}
+
+ContentType::ContentType(oid_t oid) :
+ Attribute(SIG_ATTRIBUTE_TYPES::CONTENT_TYPE),
+ oid_{std::move(oid)}
+{}
+
+void ContentType::accept(Visitor& visitor) const {
+ visitor.visit(*this);
+}
+
+std::string ContentType::print() const {
+ return this->oid() + " (" + oid_to_string(this->oid()) + ")";
+}
+
+
+ContentType::~ContentType() = default;
+
+
+}
+}
diff --git a/src/PE/signature/attributes/GenericType.cpp b/src/PE/signature/attributes/GenericType.cpp
new file mode 100644
index 00000000..001d5efc
--- /dev/null
+++ b/src/PE/signature/attributes/GenericType.cpp
@@ -0,0 +1,49 @@
+/* Copyright 2021 R. Thomas
+ * Copyright 2021 Quarkslab
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "LIEF/PE/signature/attributes/GenericType.hpp"
+namespace LIEF {
+namespace PE {
+
+GenericType::GenericType() :
+ Attribute(SIG_ATTRIBUTE_TYPES::GENERIC_TYPE)
+{}
+
+GenericType::GenericType(const GenericType&) = default;
+GenericType& GenericType::operator=(const GenericType&) = default;
+
+std::unique_ptr<Attribute> GenericType::clone(void) const {
+ return std::unique_ptr<Attribute>(new GenericType{*this});
+}
+
+GenericType::GenericType(oid_t oid, std::vector<uint8_t> raw) :
+ Attribute(SIG_ATTRIBUTE_TYPES::GENERIC_TYPE),
+ oid_{std::move(oid)},
+ raw_{std::move(raw)}
+{}
+
+void GenericType::accept(Visitor& visitor) const {
+ visitor.visit(*this);
+}
+
+std::string GenericType::print() const {
+ return this->oid() + " (" + std::to_string(this->raw_content().size()) + " bytes)";
+}
+
+
+GenericType::~GenericType() = default;
+
+}
+}
diff --git a/src/PE/signature/attributes/MsCounterSign.cpp b/src/PE/signature/attributes/MsCounterSign.cpp
new file mode 100644
index 00000000..e69de29b
diff --git a/src/PE/signature/attributes/MsSpcNestedSignature.cpp b/src/PE/signature/attributes/MsSpcNestedSignature.cpp
new file mode 100644
index 00000000..d6e42ad8
--- /dev/null
+++ b/src/PE/signature/attributes/MsSpcNestedSignature.cpp
@@ -0,0 +1,55 @@
+/* Copyright 2021 R. Thomas
+ * Copyright 2021 Quarkslab
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <sstream>
+
+#include "LIEF/PE/signature/attributes/MsSpcNestedSignature.hpp"
+
+namespace LIEF {
+namespace PE {
+
+MsSpcNestedSignature::MsSpcNestedSignature() :
+ Attribute(SIG_ATTRIBUTE_TYPES::MS_SPC_NESTED_SIGN)
+{}
+
+MsSpcNestedSignature::MsSpcNestedSignature(const MsSpcNestedSignature&) = default;
+MsSpcNestedSignature& MsSpcNestedSignature::operator=(const MsSpcNestedSignature&) = default;
+
+MsSpcNestedSignature::MsSpcNestedSignature(Signature sig) :
+ Attribute(SIG_ATTRIBUTE_TYPES::MS_SPC_NESTED_SIGN),
+ sig_{std::move(sig)}
+{}
+
+std::unique_ptr<Attribute> MsSpcNestedSignature::clone(void) const {
+ return std::unique_ptr<Attribute>(new MsSpcNestedSignature{*this});
+}
+
+
+void MsSpcNestedSignature::accept(Visitor& visitor) const {
+ visitor.visit(*this);
+}
+
+std::string MsSpcNestedSignature::print() const {
+ std::ostringstream oss;
+ oss << "Nested signature:\n";
+ oss << this->sig();
+ return oss.str();
+}
+
+
+MsSpcNestedSignature::~MsSpcNestedSignature() = default;
+
+}
+}
diff --git a/src/PE/signature/attributes/MsSpcStatementType.cpp b/src/PE/signature/attributes/MsSpcStatementType.cpp
new file mode 100644
index 00000000..c91e15af
--- /dev/null
+++ b/src/PE/signature/attributes/MsSpcStatementType.cpp
@@ -0,0 +1,49 @@
+/* Copyright 2021 R. Thomas
+ * Copyright 2021 Quarkslab
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "LIEF/PE/signature/attributes/MsSpcStatementType.hpp"
+#include "LIEF/PE/signature/OIDToString.hpp"
+namespace LIEF {
+namespace PE {
+
+MsSpcStatementType::MsSpcStatementType() :
+ Attribute(SIG_ATTRIBUTE_TYPES::MS_SPC_STATEMENT_TYPE)
+{}
+
+MsSpcStatementType::MsSpcStatementType(const MsSpcStatementType&) = default;
+MsSpcStatementType& MsSpcStatementType::operator=(const MsSpcStatementType&) = default;
+
+std::unique_ptr<Attribute> MsSpcStatementType::clone(void) const {
+ return std::unique_ptr<Attribute>(new MsSpcStatementType{*this});
+}
+
+MsSpcStatementType::MsSpcStatementType(oid_t oid) :
+ Attribute(SIG_ATTRIBUTE_TYPES::MS_SPC_STATEMENT_TYPE),
+ oid_{std::move(oid)}
+{}
+
+void MsSpcStatementType::accept(Visitor& visitor) const {
+ visitor.visit(*this);
+}
+
+std::string MsSpcStatementType::print() const {
+ return this->oid() + " (" + oid_to_string(this->oid()) + ")";
+}
+
+
+MsSpcStatementType::~MsSpcStatementType() = default;
+
+}
+}
diff --git a/src/PE/signature/attributes/PKCS9AtSequenceNumber.cpp b/src/PE/signature/attributes/PKCS9AtSequenceNumber.cpp
new file mode 100644
index 00000000..8ab11209
--- /dev/null
+++ b/src/PE/signature/attributes/PKCS9AtSequenceNumber.cpp
@@ -0,0 +1,49 @@
+/* Copyright 2021 R. Thomas
+ * Copyright 2021 Quarkslab
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "LIEF/PE/signature/attributes/PKCS9AtSequenceNumber.hpp"
+
+namespace LIEF {
+namespace PE {
+
+PKCS9AtSequenceNumber::PKCS9AtSequenceNumber() :
+ Attribute(SIG_ATTRIBUTE_TYPES::PKCS9_AT_SEQUENCE_NUMBER)
+{}
+
+PKCS9AtSequenceNumber::PKCS9AtSequenceNumber(const PKCS9AtSequenceNumber&) = default;
+PKCS9AtSequenceNumber& PKCS9AtSequenceNumber::operator=(const PKCS9AtSequenceNumber&) = default;
+
+std::unique_ptr<Attribute> PKCS9AtSequenceNumber::clone(void) const {
+ return std::unique_ptr<Attribute>(new PKCS9AtSequenceNumber{*this});
+}
+
+PKCS9AtSequenceNumber::PKCS9AtSequenceNumber(uint32_t num) :
+ Attribute(SIG_ATTRIBUTE_TYPES::PKCS9_AT_SEQUENCE_NUMBER),
+ number_{num}
+{}
+
+void PKCS9AtSequenceNumber::accept(Visitor& visitor) const {
+ visitor.visit(*this);
+}
+
+std::string PKCS9AtSequenceNumber::print() const {
+ return std::to_string(this->number());
+}
+
+
+PKCS9AtSequenceNumber::~PKCS9AtSequenceNumber() = default;
+
+}
+}
diff --git a/src/PE/signature/attributes/PKCS9CounterSignature.cpp b/src/PE/signature/attributes/PKCS9CounterSignature.cpp
new file mode 100644
index 00000000..39adae89
--- /dev/null
+++ b/src/PE/signature/attributes/PKCS9CounterSignature.cpp
@@ -0,0 +1,51 @@
+/* Copyright 2021 R. Thomas
+ * Copyright 2021 Quarkslab
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "LIEF/PE/signature/attributes/PKCS9CounterSignature.hpp"
+#include <sstream>
+namespace LIEF {
+namespace PE {
+
+PKCS9CounterSignature::PKCS9CounterSignature() :
+ Attribute(SIG_ATTRIBUTE_TYPES::PKCS9_COUNTER_SIGNATURE)
+{}
+
+PKCS9CounterSignature::PKCS9CounterSignature(const PKCS9CounterSignature&) = default;
+PKCS9CounterSignature& PKCS9CounterSignature::operator=(const PKCS9CounterSignature&) = default;
+
+PKCS9CounterSignature::PKCS9CounterSignature(SignerInfo signer) :
+ Attribute(SIG_ATTRIBUTE_TYPES::PKCS9_COUNTER_SIGNATURE),
+ signer_{std::move(signer)}
+{}
+
+std::unique_ptr<Attribute> PKCS9CounterSignature::clone(void) const {
+ return std::unique_ptr<Attribute>(new PKCS9CounterSignature{*this});
+}
+
+void PKCS9CounterSignature::accept(Visitor& visitor) const {
+ visitor.visit(*this);
+}
+
+std::string PKCS9CounterSignature::print() const {
+ std::ostringstream oss;
+ oss << this->signer() << "\n";
+ return oss.str();
+}
+
+
+PKCS9CounterSignature::~PKCS9CounterSignature() = default;
+
+}
+}
diff --git a/src/PE/signature/attributes/PKCS9MessageDigest.cpp b/src/PE/signature/attributes/PKCS9MessageDigest.cpp
new file mode 100644
index 00000000..5575ca73
--- /dev/null
+++ b/src/PE/signature/attributes/PKCS9MessageDigest.cpp
@@ -0,0 +1,51 @@
+/* Copyright 2021 R. Thomas
+ * Copyright 2021 Quarkslab
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "LIEF/PE/signature/attributes/PKCS9MessageDigest.hpp"
+#include "LIEF/utils.hpp"
+
+namespace LIEF {
+namespace PE {
+
+PKCS9MessageDigest::PKCS9MessageDigest() :
+ Attribute(SIG_ATTRIBUTE_TYPES::PKCS9_MESSAGE_DIGEST)
+{}
+
+PKCS9MessageDigest::PKCS9MessageDigest(const PKCS9MessageDigest&) = default;
+PKCS9MessageDigest& PKCS9MessageDigest::operator=(const PKCS9MessageDigest&) = default;
+
+PKCS9MessageDigest::PKCS9MessageDigest(std::vector<uint8_t> digest) :
+ Attribute(SIG_ATTRIBUTE_TYPES::PKCS9_MESSAGE_DIGEST),
+ digest_{std::move(digest)}
+{}
+
+std::unique_ptr<Attribute> PKCS9MessageDigest::clone(void) const {
+ return std::unique_ptr<Attribute>(new PKCS9MessageDigest{*this});
+}
+
+
+void PKCS9MessageDigest::accept(Visitor& visitor) const {
+ visitor.visit(*this);
+}
+
+std::string PKCS9MessageDigest::print() const {
+ return hex_dump(this->digest());
+}
+
+
+PKCS9MessageDigest::~PKCS9MessageDigest() = default;
+
+}
+}
diff --git a/src/PE/signature/attributes/PKCS9SigningTime.cpp b/src/PE/signature/attributes/PKCS9SigningTime.cpp
new file mode 100644
index 00000000..7515f532
--- /dev/null
+++ b/src/PE/signature/attributes/PKCS9SigningTime.cpp
@@ -0,0 +1,51 @@
+/* Copyright 2021 R. Thomas
+ * Copyright 2021 Quarkslab
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <spdlog/fmt/fmt.h>
+#include "LIEF/PE/signature/attributes/PKCS9SigningTime.hpp"
+namespace LIEF {
+namespace PE {
+
+PKCS9SigningTime::PKCS9SigningTime() :
+ Attribute(SIG_ATTRIBUTE_TYPES::PKCS9_SIGNING_TIME)
+{}
+
+PKCS9SigningTime::PKCS9SigningTime(const PKCS9SigningTime&) = default;
+PKCS9SigningTime& PKCS9SigningTime::operator=(const PKCS9SigningTime&) = default;
+
+std::unique_ptr<Attribute> PKCS9SigningTime::clone(void) const {
+ return std::unique_ptr<Attribute>(new PKCS9SigningTime{*this});
+}
+
+PKCS9SigningTime::PKCS9SigningTime(time_t time) :
+ Attribute(SIG_ATTRIBUTE_TYPES::PKCS9_SIGNING_TIME),
+ time_{std::move(time)}
+{}
+
+void PKCS9SigningTime::accept(Visitor& visitor) const {
+ visitor.visit(*this);
+}
+
+std::string PKCS9SigningTime::print() const {
+ const time_t& time = this->time();
+ return fmt::format("{}/{}/{} - {}:{}:{}",
+ time[0], time[1], time[2], time[3], time[4], time[5]);
+}
+
+
+PKCS9SigningTime::~PKCS9SigningTime() = default;
+
+}
+}
diff --git a/src/PE/signature/attributes/SpcSpOpusInfo.cpp b/src/PE/signature/attributes/SpcSpOpusInfo.cpp
new file mode 100644
index 00000000..e708f22b
--- /dev/null
+++ b/src/PE/signature/attributes/SpcSpOpusInfo.cpp
@@ -0,0 +1,59 @@
+/* Copyright 2021 R. Thomas
+ * Copyright 2021 Quarkslab
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "LIEF/PE/signature/attributes/SpcSpOpusInfo.hpp"
+namespace LIEF {
+namespace PE {
+
+SpcSpOpusInfo::SpcSpOpusInfo() :
+ Attribute(SIG_ATTRIBUTE_TYPES::SPC_SP_OPUS_INFO)
+{}
+
+SpcSpOpusInfo::SpcSpOpusInfo(const SpcSpOpusInfo&) = default;
+SpcSpOpusInfo& SpcSpOpusInfo::operator=(const SpcSpOpusInfo&) = default;
+
+std::unique_ptr<Attribute> SpcSpOpusInfo::clone(void) const {
+ return std::unique_ptr<Attribute>(new SpcSpOpusInfo{*this});
+}
+
+SpcSpOpusInfo::SpcSpOpusInfo(std::string program_name, std::string more_info) :
+ Attribute(SIG_ATTRIBUTE_TYPES::SPC_SP_OPUS_INFO),
+ program_name_{std::move(program_name)},
+ more_info_{std::move(more_info)}
+{}
+
+void SpcSpOpusInfo::accept(Visitor& visitor) const {
+ visitor.visit(*this);
+}
+
+std::string SpcSpOpusInfo::print() const {
+ std::string out;
+ if (not this->program_name().empty()) {
+ out = this->program_name();
+ }
+ if (not this->more_info().empty()) {
+ if (not out.empty()) {
+ out += " - ";
+ }
+ out += this->more_info();
+ }
+ return out;
+}
+
+
+SpcSpOpusInfo::~SpcSpOpusInfo() = default;
+
+}
+}
diff --git a/src/PE/signature/pkcs7.h b/src/PE/signature/pkcs7.h
index 8efe94c8..1bc89df7 100644
--- a/src/PE/signature/pkcs7.h
+++ b/src/PE/signature/pkcs7.h
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
diff --git a/src/PE/signature/x509.cpp b/src/PE/signature/x509.cpp
index bf530527..7449e3aa 100644
--- a/src/PE/signature/x509.cpp
+++ b/src/PE/signature/x509.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,22 +17,242 @@
#include <iomanip>
#include <numeric>
#include <sstream>
+#include <map>
+#include <fstream>
#include "mbedtls/x509_crt.h"
#include "mbedtls/asn1.h"
-#include <mbedtls/oid.h>
+#include "mbedtls/oid.h"
+#include "mbedtls/error.h"
+
+#include "logging.hpp"
#include "LIEF/PE/signature/OIDToString.hpp"
#include "LIEF/PE/signature/x509.hpp"
+#include "LIEF/PE/signature/RsaInfo.hpp"
+#include "LIEF/PE/EnumToString.hpp"
+
+#include "LIEF/utils.hpp"
+
+namespace {
+ // Copy this function from mbedtls sinc it is not exported
+ inline int x509_get_current_time( mbedtls_x509_time *now )
+ {
+ struct tm *lt, tm_buf;
+ mbedtls_time_t tt;
+ int ret = 0;
+
+ tt = mbedtls_time( NULL );
+ lt = mbedtls_platform_gmtime_r( &tt, &tm_buf );
+
+ if( lt == NULL )
+ ret = -1;
+ else
+ {
+ now->year = lt->tm_year + 1900;
+ now->mon = lt->tm_mon + 1;
+ now->day = lt->tm_mday;
+ now->hour = lt->tm_hour;
+ now->min = lt->tm_min;
+ now->sec = lt->tm_sec;
+ }
+
+ return( ret );
+ }
+}
+
namespace LIEF {
namespace PE {
-x509::x509(void) :
- x509_cert_{nullptr}
-{}
+static const std::map<uint32_t, x509::VERIFICATION_FLAGS> MBEDTLS_ERR_TO_LIEF = {
+ { MBEDTLS_X509_BADCERT_EXPIRED, x509::VERIFICATION_FLAGS::BADCERT_EXPIRED},
+ { MBEDTLS_X509_BADCERT_REVOKED, x509::VERIFICATION_FLAGS::BADCERT_REVOKED},
+ { MBEDTLS_X509_BADCERT_CN_MISMATCH, x509::VERIFICATION_FLAGS::BADCERT_CN_MISMATCH},
+ { MBEDTLS_X509_BADCERT_NOT_TRUSTED, x509::VERIFICATION_FLAGS::BADCERT_NOT_TRUSTED},
+ { MBEDTLS_X509_BADCRL_NOT_TRUSTED, x509::VERIFICATION_FLAGS::BADCRL_NOT_TRUSTED},
+ { MBEDTLS_X509_BADCRL_EXPIRED, x509::VERIFICATION_FLAGS::BADCRL_EXPIRED},
+ { MBEDTLS_X509_BADCERT_MISSING, x509::VERIFICATION_FLAGS::BADCERT_MISSING},
+ { MBEDTLS_X509_BADCERT_SKIP_VERIFY, x509::VERIFICATION_FLAGS::BADCERT_SKIP_VERIFY},
+ { MBEDTLS_X509_BADCERT_OTHER, x509::VERIFICATION_FLAGS::BADCERT_OTHER},
+ { MBEDTLS_X509_BADCERT_FUTURE, x509::VERIFICATION_FLAGS::BADCERT_FUTURE},
+ { MBEDTLS_X509_BADCRL_FUTURE, x509::VERIFICATION_FLAGS::BADCRL_FUTURE},
+ { MBEDTLS_X509_BADCERT_KEY_USAGE, x509::VERIFICATION_FLAGS::BADCERT_KEY_USAGE},
+ { MBEDTLS_X509_BADCERT_EXT_KEY_USAGE, x509::VERIFICATION_FLAGS::BADCERT_EXT_KEY_USAGE},
+ { MBEDTLS_X509_BADCERT_NS_CERT_TYPE, x509::VERIFICATION_FLAGS::BADCERT_NS_CERT_TYPE},
+ { MBEDTLS_X509_BADCERT_BAD_MD, x509::VERIFICATION_FLAGS::BADCERT_BAD_MD},
+ { MBEDTLS_X509_BADCERT_BAD_PK, x509::VERIFICATION_FLAGS::BADCERT_BAD_PK},
+ { MBEDTLS_X509_BADCERT_BAD_KEY, x509::VERIFICATION_FLAGS::BADCERT_BAD_KEY},
+ { MBEDTLS_X509_BADCRL_BAD_MD, x509::VERIFICATION_FLAGS::BADCRL_BAD_MD},
+ { MBEDTLS_X509_BADCRL_BAD_PK, x509::VERIFICATION_FLAGS::BADCRL_BAD_PK},
+ { MBEDTLS_X509_BADCRL_BAD_KEY, x509::VERIFICATION_FLAGS::BADCRL_BAD_KEY},
+};
+
+inline x509::VERIFICATION_FLAGS from_mbedtls_err(uint32_t err) {
+ x509::VERIFICATION_FLAGS flags = x509::VERIFICATION_FLAGS::OK;
+ for (const auto& p : MBEDTLS_ERR_TO_LIEF) {
+ if ((err & p.first) == p.first) {
+ flags |= p.second;
+ }
+ }
+ return flags;
+}
+
+inline x509::date_t from_mbedtls(const mbedtls_x509_time& time) {
+ return {
+ time.year,
+ time.mon,
+ time.day,
+ time.hour,
+ time.min,
+ time.sec
+ };
+}
+
+x509::certificates_t x509::parse(const std::string& path) {
+
+ std::ifstream cert_fs(path);
+ if (not cert_fs) {
+ LIEF_WARN("Can't open {}", path);
+ return {};
+ }
+ cert_fs.unsetf(std::ios::skipws);
+ cert_fs.seekg(0, std::ios::end);
+ const size_t size = cert_fs.tellg();
+ cert_fs.seekg(0, std::ios::beg);
+
+ std::vector<uint8_t> raw(size + 1, 0);
+ cert_fs.read(reinterpret_cast<char*>(raw.data()), raw.size());
+ return x509::parse(std::move(raw));
+}
+
+x509::certificates_t x509::parse(const std::vector<uint8_t>& content) {
+ std::unique_ptr<mbedtls_x509_crt> ca{new mbedtls_x509_crt{}};
+ mbedtls_x509_crt_init(ca.get());
+ //LIEF_INFO("{}", reinterpret_cast<const char*>(content.data()));
+ int ret = mbedtls_x509_crt_parse(ca.get(), content.data(), content.size());
+ if (ret != 0) {
+ std::string strerr(1024, 0);
+ mbedtls_strerror(ret, const_cast<char*>(strerr.data()), strerr.size());
+ LIEF_WARN("Fail to parse certificate blob: '{}'", strerr);
+ return {};
+ }
+ std::vector<x509> crts;
+
+ mbedtls_x509_crt* prev = nullptr;
+ mbedtls_x509_crt* current = ca.release();
+ while (current != nullptr and current != prev) {
+ mbedtls_x509_crt* next = current->next;
+ current->next = nullptr;
+ crts.emplace_back(current);
+ prev = current;
+ current = next;
+ }
+ return crts;
+}
+bool x509::check_time(const date_t& before, const date_t& after) {
+ // Implementation taken
+ // from https://github.com/ARMmbed/mbedtls/blob/1c54b5410fd48d6bcada97e30cac417c5c7eea67/library/x509.c#L926-L962
+ if (before[0] > after[0]) {
+ LIEF_DEBUG("{} > {}", before[0], after[0]);
+ return false;
+ }
+
+ if (
+ before[0] == after[0] and
+ before[1] > after[1]
+ )
+ {
+ LIEF_DEBUG("{} > {}", before[1], after[1]);
+ return false;
+ }
+
+ if (
+ before[0] == after[0] and
+ before[1] == after[1] and
+ before[2] > after[2]
+ )
+ {
+ LIEF_DEBUG("{} > {}", before[2], after[2]);
+ return false;
+ }
+
+ if (
+ before[0] == after[0] and
+ before[1] == after[1] and
+ before[2] == after[2] and
+ before[3] > after[3]
+ )
+ {
+ LIEF_DEBUG("{} > {}", before[3], after[3]);
+ return false;
+ }
+
+ if (
+ before[0] == after[0] and
+ before[1] == after[1] and
+ before[2] == after[2] and
+ before[3] == after[3] and
+ before[4] > after[4]
+ )
+ {
+ LIEF_DEBUG("{} > {}", before[4], after[4]);
+ return false;
+ }
+
+ if (
+ before[0] == after[0] and
+ before[1] == after[1] and
+ before[2] == after[2] and
+ before[3] == after[3] and
+ before[4] == after[4] and
+ before[5] > after[5]
+ )
+ {
+ LIEF_DEBUG("{} > {}", before[5], after[5]);
+ return false;
+ }
+
+ if (
+ before[0] == after[0] and
+ before[1] == after[1] and
+ before[2] == after[2] and
+ before[3] == after[3] and
+ before[4] == after[4] and
+ before[5] == after[5] and
+ before[6] > after[6]
+ )
+ {
+ LIEF_DEBUG("{} > {}", before[6], after[6]);
+ return false;
+ }
+
+ return true;
+}
+
+bool x509::time_is_past(const date_t& to) {
+ mbedtls_x509_time now;
+
+ if (x509_get_current_time(&now) != 0) {
+ return true;
+ }
+ // check_time(): true if now < to else false
+ return not check_time(from_mbedtls(now), to);
+}
+
+bool x509::time_is_future(const date_t& from) {
+ mbedtls_x509_time now;
+
+ if (x509_get_current_time(&now) != 0) {
+ return true;
+ }
+ return check_time(from_mbedtls(now), from);
+}
+
+x509::x509() = default;
+
x509::x509(mbedtls_x509_crt* ca) :
x509_cert_{ca}
{}
@@ -45,7 +265,6 @@ x509::x509(const x509& other) :
mbedtls_x509_crt_parse_der(crt, other.x509_cert_->raw.p, other.x509_cert_->raw.len);
this->x509_cert_ = crt;
-
}
x509& x509::operator=(x509 other) {
@@ -74,44 +293,312 @@ oid_t x509::signature_algorithm(void) const {
}
x509::date_t x509::valid_from(void) const {
- return {{
- this->x509_cert_->valid_from.year,
- this->x509_cert_->valid_from.mon,
- this->x509_cert_->valid_from.day,
- this->x509_cert_->valid_from.hour,
- this->x509_cert_->valid_from.min,
- this->x509_cert_->valid_from.sec
- }};
+ return from_mbedtls(this->x509_cert_->valid_from);
}
x509::date_t x509::valid_to(void) const {
- return {{
- this->x509_cert_->valid_to.year,
- this->x509_cert_->valid_to.mon,
- this->x509_cert_->valid_to.day,
- this->x509_cert_->valid_to.hour,
- this->x509_cert_->valid_to.min,
- this->x509_cert_->valid_to.sec
- }};
+ return from_mbedtls(this->x509_cert_->valid_to);
}
std::string x509::issuer(void) const {
char buffer[1024];
mbedtls_x509_dn_gets(buffer, sizeof(buffer), &this->x509_cert_->issuer);
- return {buffer};
+ return buffer;
}
std::string x509::subject(void) const {
char buffer[1024];
mbedtls_x509_dn_gets(buffer, sizeof(buffer), &this->x509_cert_->subject);
- return {buffer};
+ return buffer;
}
std::vector<uint8_t> x509::raw(void) const {
return {this->x509_cert_->raw.p, this->x509_cert_->raw.p + this->x509_cert_->raw.len};
}
+
+x509::KEY_TYPES x509::key_type() const {
+ static const std::map<mbedtls_pk_type_t, x509::KEY_TYPES> mtype2asi = {
+ {MBEDTLS_PK_NONE, KEY_TYPES::NONE },
+ {MBEDTLS_PK_RSA, KEY_TYPES::RSA },
+ {MBEDTLS_PK_ECKEY, KEY_TYPES::ECKEY },
+ {MBEDTLS_PK_ECKEY_DH, KEY_TYPES::ECKEY_DH },
+ {MBEDTLS_PK_ECDSA, KEY_TYPES::ECDSA },
+ {MBEDTLS_PK_RSA_ALT, KEY_TYPES::RSA_ALT },
+ {MBEDTLS_PK_RSASSA_PSS, KEY_TYPES::RSASSA_PSS },
+ };
+
+ mbedtls_pk_context* ctx = &(this->x509_cert_->pk);
+ mbedtls_pk_type_t type = mbedtls_pk_get_type(ctx);
+
+ auto&& it_key = mtype2asi.find(type);
+ if (it_key != std::end(mtype2asi)) {
+ return it_key->second;
+ }
+ return KEY_TYPES::NONE;
+}
+
+
+std::unique_ptr<RsaInfo> x509::rsa_info(void) const {
+ if (this->key_type() == KEY_TYPES::RSA) {
+ mbedtls_rsa_context* rsa_ctx = mbedtls_pk_rsa(this->x509_cert_->pk);
+ return std::unique_ptr<RsaInfo>{new RsaInfo{rsa_ctx}};
+ }
+ return nullptr;
+}
+
+bool x509::check_signature(const std::vector<uint8_t>& hash, const std::vector<uint8_t>& signature, ALGORITHMS algo) const {
+ static const std::map<ALGORITHMS, mbedtls_md_type_t> LIEF2MBED_MD = {
+ {ALGORITHMS::MD2, MBEDTLS_MD_MD2},
+ {ALGORITHMS::MD4, MBEDTLS_MD_MD4},
+ {ALGORITHMS::MD5, MBEDTLS_MD_MD5},
+
+ {ALGORITHMS::SHA_1, MBEDTLS_MD_SHA1},
+ {ALGORITHMS::SHA_256, MBEDTLS_MD_SHA256},
+ {ALGORITHMS::SHA_384, MBEDTLS_MD_SHA384},
+ {ALGORITHMS::SHA_512, MBEDTLS_MD_SHA512},
+ };
+
+ auto it_md = LIEF2MBED_MD.find(algo);
+ if (it_md == std::end(LIEF2MBED_MD)) {
+ LIEF_ERR("Can't find algorithm {}", to_string(algo));
+ return false;
+ }
+ mbedtls_pk_context& ctx = this->x509_cert_->pk;
+ int ret = mbedtls_pk_verify(&ctx,
+ /* MD_HASH_ALGO */ it_md->second,
+ /* Input Hash */ hash.data(), hash.size(),
+ /* Signature provided */ signature.data(), signature.size());
+
+ /* If the verification failed with mbedtls_pk_verify it
+ * does not necessity means that the signatures don't match.
+ *
+ * For RSA public-key scheme, mbedtls encodes the hash with rsa_rsassa_pkcs1_v15_encode() so that it expands
+ * the hash value with encoded data. On some samples, this encoding failed.
+ *
+ * In the approach below, we manually decrypt and unpad the output of the DEC(signature)
+ * as defined in the RFC #2313
+ */
+ if (ret != 0) {
+ if (mbedtls_pk_get_type(&ctx) == MBEDTLS_PK_RSA) {
+ auto* ctx_rsa = reinterpret_cast<mbedtls_rsa_context*>(ctx.pk_ctx);
+ if ((ctx_rsa->len * 8) < 100 or (ctx_rsa->len * 8) > 2048 * 10) {
+ LIEF_INFO("RSA Key length is not valid ({} bits)", ctx_rsa->len * 8);
+ return false;
+ }
+ std::vector<uint8_t> decrypted(ctx_rsa->len);
+
+ int ret_rsa_public = mbedtls_rsa_public(ctx_rsa, signature.data(), decrypted.data());
+ if (ret_rsa_public != 0) {
+ std::string strerr(1024, 0);
+ mbedtls_strerror(ret_rsa_public, const_cast<char*>(strerr.data()), strerr.size());
+ LIEF_INFO("RSA public key operation failed: '{}'", strerr);
+ return false;
+ }
+
+ // Check padding header
+ if (decrypted[0] != 0x00 and decrypted[1] != 0x01 and decrypted[2] != 0xff) {
+ return false;
+ }
+
+ std::vector<uint8_t> unpadded;
+ for (size_t i = 2; i < decrypted.size(); ++i) {
+ if (decrypted[i] == 0) {
+ unpadded = std::vector<uint8_t>(std::begin(decrypted) + i + 1, std::end(decrypted));
+ break;
+ }
+ if (decrypted[i] != 0xFF) {
+ return false;
+ }
+ }
+ if (unpadded == hash) {
+ return true;
+ }
+ }
+ if (ret != 0) {
+ std::string strerr(1024, 0);
+ mbedtls_strerror(ret, const_cast<char*>(strerr.data()), strerr.size());
+ LIEF_INFO("decrypt() failed with error: '{}'", strerr);
+ return false;
+ }
+ return true;
+ }
+ return true;
+}
+
+
+x509::VERIFICATION_FLAGS x509::is_trusted_by(const std::vector<x509>& ca) const {
+ std::vector<x509> ca_list = ca; // Explicit copy since we will modify mbedtls_x509_crt->next
+ for (size_t i = 0; i < ca_list.size() - 1; ++i) {
+ ca_list[i].x509_cert_->next = ca_list[i + 1].x509_cert_;
+ }
+
+ VERIFICATION_FLAGS result = VERIFICATION_FLAGS::OK;
+ uint32_t flags = 0;
+ mbedtls_x509_crt_profile profile = {
+ MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_MD5) |
+ MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA1) |
+ MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA224) |
+ MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA256) |
+ MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA384) |
+ MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA512),
+ 0xFFFFFFF, /* Any PK alg */
+ 0xFFFFFFF, /* Any curve */
+ 1 /* Min RSA key */,
+ };
+
+ int ret = mbedtls_x509_crt_verify_with_profile(
+ /* crt */ this->x509_cert_,
+ /* Trusted CA */ ca_list.front().x509_cert_,
+ /* CA's CRLs */ nullptr,
+ /* profile */ &profile,
+ /* Common Name */ nullptr,
+ /* Verification */ &flags,
+ /* verification function */ nullptr,
+ /* verification params */ nullptr);
+
+ if (ret != 0) {
+ std::string strerr(1024, 0);
+ mbedtls_strerror(ret, const_cast<char*>(strerr.data()), strerr.size());
+ std::string out(1024, 0);
+ mbedtls_x509_crt_verify_info(const_cast<char*>(out.data()), out.size(), "", flags);
+ LIEF_WARN("X509 verify failed with: {} (0x{:x})\n{}", strerr, ret, out);
+ result = from_mbedtls_err(flags);
+ }
+
+ // Clear the chain since ~x509() will delete each object
+ for (size_t i = 0; i < ca_list.size(); ++i) {
+ ca_list[i].x509_cert_->next = nullptr;
+ }
+ return result;
+}
+
+x509::VERIFICATION_FLAGS x509::verify(const x509& ca) const {
+ uint32_t flags = 0;
+ VERIFICATION_FLAGS result = VERIFICATION_FLAGS::OK;
+ mbedtls_x509_crt_profile profile = {
+ MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA1) |
+ MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA224) |
+ MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA256) |
+ MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA384) |
+ MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA512),
+ 0xFFFFFFF, /* Any PK alg */
+ 0xFFFFFFF, /* Any curve */
+ 1 /* Min RSA key */,
+ };
+
+ int ret = mbedtls_x509_crt_verify_with_profile(
+ /* crt */ ca.x509_cert_,
+ /* Trusted CA */ this->x509_cert_,
+ /* CA's CRLs */ nullptr,
+ /* profile */ &profile,
+ /* Common Name */ nullptr,
+ /* Verification */ &flags,
+ /* verification function */ nullptr,
+ /* verification params */ nullptr);
+
+ if (ret != 0) {
+ std::string strerr(1024, 0);
+ mbedtls_strerror(ret, const_cast<char*>(strerr.data()), strerr.size());
+ std::string out(1024, 0);
+ mbedtls_x509_crt_verify_info(const_cast<char*>(out.data()), out.size(), "", flags);
+ LIEF_WARN("X509 verify failed with: {} (0x{:x})\n{}", strerr, ret, out);
+ result = from_mbedtls_err(flags);
+ }
+ return result;
+}
+
+std::vector<oid_t> x509::ext_key_usage() const {
+ if ((this->x509_cert_->ext_types & MBEDTLS_X509_EXT_EXTENDED_KEY_USAGE) == 0) {
+ return {};
+ }
+ mbedtls_asn1_sequence* current = &this->x509_cert_->ext_key_usage;
+ std::vector<oid_t> oids;
+ while (current != nullptr) {
+ char oid_str[256] = {0};
+ int ret = mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &current->buf);
+ if (ret != MBEDTLS_ERR_OID_BUF_TOO_SMALL) {
+ LIEF_DEBUG("OID: {}", oid_str);
+ oids.push_back(oid_str);
+ } else {
+ std::string strerr(1024, 0);
+ mbedtls_strerror(ret, const_cast<char*>(strerr.data()), strerr.size());
+ LIEF_WARN("{}", strerr);
+ }
+ if (current->next == current) {
+ break;
+ }
+ current = current->next;
+ }
+ return oids;
+}
+
+std::vector<oid_t> x509::certificate_policies() const {
+ if ((this->x509_cert_->ext_types & MBEDTLS_OID_X509_EXT_CERTIFICATE_POLICIES) == 0) {
+ return {};
+ }
+
+ mbedtls_x509_sequence& policies = this->x509_cert_->certificate_policies;
+ mbedtls_asn1_sequence* current = &policies;
+ std::vector<oid_t> oids;
+ while (current != nullptr) {
+ char oid_str[256] = {0};
+ int ret = mbedtls_oid_get_numeric_string(oid_str, sizeof(oid_str), &current->buf);
+ if (ret != MBEDTLS_ERR_OID_BUF_TOO_SMALL) {
+ oids.push_back(oid_str);
+ } else {
+ std::string strerr(1024, 0);
+ mbedtls_strerror(ret, const_cast<char*>(strerr.data()), strerr.size());
+ LIEF_WARN("{}", strerr);
+ }
+ if (current->next == current) {
+ break;
+ }
+ current = current->next;
+ }
+ return oids;
+}
+
+bool x509::is_ca() const {
+ if ((this->x509_cert_->ext_types & MBEDTLS_X509_EXT_BASIC_CONSTRAINTS) == 0) {
+ return true;
+ }
+ return this->x509_cert_->ca_istrue;
+}
+
+std::vector<x509::KEY_USAGE> x509::key_usage() const {
+ static const std::map<uint32_t, KEY_USAGE> MBEDTLS_MAP = {
+ {MBEDTLS_X509_KU_DIGITAL_SIGNATURE, KEY_USAGE::DIGITAL_SIGNATURE},
+ {MBEDTLS_X509_KU_NON_REPUDIATION, KEY_USAGE::NON_REPUDIATION},
+ {MBEDTLS_X509_KU_KEY_ENCIPHERMENT, KEY_USAGE::KEY_ENCIPHERMENT},
+ {MBEDTLS_X509_KU_DATA_ENCIPHERMENT, KEY_USAGE::DATA_ENCIPHERMENT},
+ {MBEDTLS_X509_KU_KEY_AGREEMENT, KEY_USAGE::KEY_AGREEMENT},
+ {MBEDTLS_X509_KU_KEY_CERT_SIGN, KEY_USAGE::KEY_CERT_SIGN},
+ {MBEDTLS_X509_KU_CRL_SIGN, KEY_USAGE::CRL_SIGN},
+ {MBEDTLS_X509_KU_ENCIPHER_ONLY, KEY_USAGE::ENCIPHER_ONLY},
+ {MBEDTLS_X509_KU_DECIPHER_ONLY, KEY_USAGE::DECIPHER_ONLY},
+ };
+
+ if ((this->x509_cert_->ext_types & MBEDTLS_X509_EXT_KEY_USAGE) == 0) {
+ return {};
+ }
+
+ const uint32_t ku = this->x509_cert_->key_usage;
+ std::vector<KEY_USAGE> usages;
+ for (const auto& p : MBEDTLS_MAP) {
+ if ((ku & p.first) > 0) {
+ usages.push_back(p.second);
+ }
+ }
+ return usages;
+}
+
+std::vector<uint8_t> x509::signature() const {
+ mbedtls_x509_buf sig = this->x509_cert_->sig;
+ return {sig.p, sig.p + sig.len};
+}
+
void x509::accept(Visitor& visitor) const {
visitor.visit(*this);
}
@@ -122,56 +609,14 @@ x509::~x509(void) {
}
std::ostream& operator<<(std::ostream& os, const x509& x509_cert) {
-
- constexpr uint8_t wsize = 30;
- const std::vector<uint8_t>& sn = x509_cert.serial_number();
- std::string sn_str = std::accumulate(
- std::begin(sn),
- std::end(sn),
- std::string(""),
- [] (std::string lhs, uint8_t x) {
- std::stringstream ss;
- ss << std::setw(2) << std::setfill('0') << std::hex << static_cast<uint32_t>(x);
- return lhs.empty() ? ss.str() : lhs + ":" + ss.str();
- });
-
- const x509::date_t& valid_from = x509_cert.valid_from();
- const x509::date_t& valid_to = x509_cert.valid_to();
-
- //// 2018-01-11 20:39:31
- std::string valid_from_str =
- std::to_string(valid_from[0]) + "-" +
- std::to_string(valid_from[1]) + "-" +
- std::to_string(valid_from[2]) + " " +
- std::to_string(valid_from[3]) + ":" +
- std::to_string(valid_from[4]) + ":" +
- std::to_string(valid_from[5]);
-
-
- std::string valid_to_str =
- std::to_string(valid_to[0]) + "-" +
- std::to_string(valid_to[1]) + "-" +
- std::to_string(valid_to[2]) + " " +
- std::to_string(valid_to[3]) + ":" +
- std::to_string(valid_to[4]) + ":" +
- std::to_string(valid_to[5]);
-
-
- os << std::hex << std::left;
- os << std::setw(wsize) << std::setfill(' ') << "Version: " << x509_cert.version() << std::endl;
- os << std::setw(wsize) << std::setfill(' ') << "Serial Number: " << sn_str << std::endl;
- os << std::setw(wsize) << std::setfill(' ') << "Signature Algorithm: " << oid_to_string(x509_cert.signature_algorithm()) << std::endl;
- os << std::setw(wsize) << std::setfill(' ') << "Valid from: " << valid_from_str << std::endl;
- os << std::setw(wsize) << std::setfill(' ') << "Valid to: " << valid_to_str << std::endl;
- os << std::setw(wsize) << std::setfill(' ') << "Issuer: " << x509_cert.issuer() << std::endl;
- os << std::setw(wsize) << std::setfill(' ') << "Subject: " << x509_cert.subject() << std::endl;
-
-
- //os << std::endl << std::endl;
- //std::vector<char> buffer(2048, 0);
- //mbedtls_x509_crt_info(buffer.data(), buffer.size(), "", x509_cert.x509_cert_);
- //std::string foo(buffer.data());
- //os << foo;
+ std::vector<char> buffer(2048, 0);
+ int ret = mbedtls_x509_crt_info(buffer.data(), buffer.size(), "", x509_cert.x509_cert_);
+ if (ret < 0) {
+ os << "Can't print certificate information\n";
+ return os;
+ }
+ std::string crt_str(buffer.data());
+ os << crt_str;
return os;
}
diff --git a/src/PE/utils.cpp b/src/PE/utils.cpp
index 041550fe..0a360060 100644
--- a/src/PE/utils.cpp
+++ b/src/PE/utils.cpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,31 +17,45 @@
#include <fstream>
#include <iterator>
#include <exception>
-#include <string.h>
+#include <string>
#include <numeric>
#include <iomanip>
#include <sstream>
#include <string>
-#include "LIEF/logging++.hpp"
+#include "logging.hpp"
#include "mbedtls/md5.h"
#include "LIEF/exception.hpp"
#include "LIEF/PE/utils.hpp"
+#include "LIEF/PE/Structures.hpp"
#include "LIEF/PE/Binary.hpp"
#include "LIEF/PE/Import.hpp"
+#include "LIEF/PE/ImportEntry.hpp"
+#include "LIEF/BinaryStream/VectorStream.hpp"
+#include "LIEF/utils.hpp"
#include "utils/ordinals_lookup_tables/libraries_table.hpp"
+#include "utils/ordinals_lookup_tables_std/libraries_table.hpp"
+
+#include "hash_stream.hpp"
namespace LIEF {
namespace PE {
+inline std::string to_lower(std::string str) {
+ std::string lower = str;
+ std::transform(std::begin(str), std::end(str),
+ std::begin(lower), ::tolower);
+ return lower;
+}
+
bool is_pe(const std::string& file) {
std::ifstream binary(file, std::ios::in | std::ios::binary);
if (not binary) {
- LOG(ERROR) << "Unable to open the file!";
+ LIEF_ERR("Unable to open the file!");
return false;
}
@@ -53,7 +67,7 @@ bool is_pe(const std::string& file) {
if (file_size < sizeof(pe_dos_header)) {
- LOG(ERROR) << "File too small";
+ LIEF_ERR("File too small");
return false;
}
@@ -99,6 +113,19 @@ bool is_pe(const std::vector<uint8_t>& raw) {
}
+result<PE_TYPE> get_type_from_stream(BinaryStream& stream) {
+ const uint64_t cpos = stream.pos();
+ stream.setpos(0);
+ const pe_dos_header& dos_hdr = stream.read<pe_dos_header>();
+ stream.setpos(dos_hdr.AddressOfNewExeHeader + sizeof(pe_header));
+ const pe32_optional_header& opt_hdr = stream.read<pe32_optional_header>();
+ const auto type = static_cast<PE_TYPE>(opt_hdr.Magic);
+ stream.setpos(cpos);
+ if (type == PE_TYPE::PE32 or type == PE_TYPE::PE32_PLUS) {
+ return type;
+ }
+ return make_error_code(lief_errors::read_error);
+}
PE_TYPE get_type(const std::string& file) {
if (not is_pe(file)) {
@@ -151,21 +178,65 @@ PE_TYPE get_type(const std::vector<uint8_t>& raw) {
}
-std::string get_imphash(const Binary& binary) {
- uint8_t md5_buffer[16];
+std::string get_imphash_std(const Binary& binary) {
+ static const std::set<std::string> ALLOWED_EXT = {"dll", "ocx", "sys"};
+ std::vector<uint8_t> md5_buffer(16);
+ if (not binary.has_imports()) {
+ return "";
+ }
+ std::string lstr;
+ bool first_entry = true;
+ hashstream hs(hashstream::HASH::MD5);
+ for (const Import& imp : binary.imports()) {
+ std::string libname = imp.name();
+
+ Import resolved = resolve_ordinals(imp, /* strict */ false, /* use_std */ true);
+ size_t ext_idx = resolved.name().find_last_of(".");
+ std::string name = resolved.name();
+ std::string ext;
+ if (ext_idx != std::string::npos) {
+ ext = to_lower(resolved.name().substr(ext_idx + 1));
+ }
+ if (ALLOWED_EXT.find(ext) != std::end(ALLOWED_EXT)) {
+ name = name.substr(0, ext_idx);
+ }
+
+ std::string entries_string;
+ for (const ImportEntry& e : resolved.entries()) {
+ std::string funcname;
+ if (e.is_ordinal()) {
+ funcname = "ord" + std::to_string(e.ordinal());
+ } else {
+ funcname = e.name();
+ }
+
+ if (not entries_string.empty()) {
+ entries_string += ",";
+ }
+ entries_string += name + "." + funcname;
+ }
+ if (not first_entry) {
+ lstr += ",";
+ } else {
+ first_entry = false;
+ }
+ lstr += to_lower(entries_string);
+
+ // use write(uint8_t*, size_t) instead of write(const std::string&) to avoid null char
+ hs.write(reinterpret_cast<const uint8_t*>(lstr.data()), lstr.size());
+ lstr.clear();
+ }
+
+ return hex_dump(hs.raw(), "");
+}
+
+
+std::string get_imphash_lief(const Binary& binary) {
+ std::vector<uint8_t> md5_buffer(16);
if (not binary.has_imports()) {
return std::to_string(0);
}
- auto to_lower = [] (const std::string& str) {
- std::string lower = str;
- std::transform(
- std::begin(str),
- std::end(str),
- std::begin(lower),
- ::tolower);
- return lower;
- };
it_const_imports imports = binary.imports();
std::string import_list;
@@ -197,24 +268,26 @@ std::string get_imphash(const Binary& binary) {
mbedtls_md5(
reinterpret_cast<const uint8_t*>(import_list.data()),
import_list.size(),
- md5_buffer);
-
- std::string output_hex = std::accumulate(
- std::begin(md5_buffer),
- std::end(md5_buffer),
- std::string{},
- [] (const std::string& a, uint8_t b) {
- std::stringstream ss;
- ss << std::hex;
- ss << std::setw(2) << std::setfill('0') << static_cast<uint32_t>(b);
- return a + ss.str();
- });
-
- return output_hex;
+ md5_buffer.data());
+ return hex_dump(md5_buffer, "");
}
+std::string get_imphash(const Binary& binary, IMPHASH_MODE mode) {
+ switch (mode) {
+ case IMPHASH_MODE::LIEF:
+ {
+ return get_imphash_lief(binary);
+ }
+ case IMPHASH_MODE::PEFILE:
+ {
+ return get_imphash_std(binary);
+ }
+ }
+ return "";
+}
-Import resolve_ordinals(const Import& import, bool strict) {
+Import resolve_ordinals(const Import& import, bool strict, bool use_std) {
+ using ordinal_resolver_t = const char*(*)(uint32_t);
it_const_import_entries entries = import.entries();
@@ -224,45 +297,87 @@ Import resolve_ordinals(const Import& import, bool strict) {
[] (const ImportEntry& entry) {
return not entry.is_ordinal();
})) {
- VLOG(VDEBUG) << "All imports use name. No ordinal!";
+ LIEF_DEBUG("All imports use name. No ordinal!");
return import;
}
- std::string name = import.name();
- std::transform(
- std::begin(name),
- std::end(name),
- std::begin(name),
- ::tolower);
+ std::string name = to_lower(import.name());
- auto&& it_library_lookup = ordinals_library_tables.find(name);
- if (it_library_lookup == std::end(ordinals_library_tables)) {
+ ordinal_resolver_t ordinal_resolver = nullptr;
+ if (use_std) {
+ auto it = imphashstd::ordinals_library_tables.find(name);
+ if (it != std::end(imphashstd::ordinals_library_tables)) {
+ ordinal_resolver = it->second;
+ }
+ } else {
+ auto it = ordinals_library_tables.find(name);
+ if (it != std::end(ordinals_library_tables)) {
+ ordinal_resolver = it->second;
+ }
+ }
+
+ if (ordinal_resolver == nullptr) {
std::string msg = "Ordinal lookup table for '" + name + "' not implemented";
if (strict) {
throw not_found(msg);
}
- VLOG(VDEBUG) << msg;
+ LIEF_DEBUG("{}", msg);
return import;
}
+
Import resolved_import = import;
for (ImportEntry& entry : resolved_import.entries()) {
if (entry.is_ordinal()) {
- VLOG(VDEBUG) << "Dealing with: " << entry;
- auto&& it_entry = it_library_lookup->second.find(static_cast<uint32_t>(entry.ordinal()));
- if (it_entry == std::end(it_library_lookup->second)) {
+ LIEF_DEBUG("Dealing with: {}", entry);
+ const char* entry_name = ordinal_resolver(static_cast<uint32_t>(entry.ordinal()));
+ if (entry_name == nullptr) {
if (strict) {
throw not_found("Unable to resolve ordinal: " + std::to_string(entry.ordinal()));
}
- VLOG(VDEBUG) << "Unable to resolve ordinal:" << std::hex << entry.ordinal();
+ LIEF_DEBUG("Unable to resolve ordinal: #{:d}", entry.ordinal());
continue;
}
entry.data(0);
- entry.name(it_entry->second);
+ entry.name(entry_name);
}
}
return resolved_import;
}
+ALGORITHMS algo_from_oid(const std::string& oid) {
+ static const std::unordered_map<std::string, ALGORITHMS> OID_MAP = {
+ { "2.16.840.1.101.3.4.2.3", ALGORITHMS::SHA_512 },
+ { "2.16.840.1.101.3.4.2.2", ALGORITHMS::SHA_384 },
+ { "2.16.840.1.101.3.4.2.1", ALGORITHMS::SHA_256 },
+ { "1.3.14.3.2.26", ALGORITHMS::SHA_1 },
+
+ { "1.2.840.113549.2.5", ALGORITHMS::MD5 },
+ { "1.2.840.113549.2.4", ALGORITHMS::MD4 },
+ { "1.2.840.113549.2.2", ALGORITHMS::MD2 },
+
+ { "1.2.840.113549.1.1.1", ALGORITHMS::RSA },
+ { "1.2.840.10045.2.1", ALGORITHMS::EC },
+
+ { "1.2.840.113549.1.1.4", ALGORITHMS::MD5_RSA },
+ { "1.2.840.10040.4.3", ALGORITHMS::SHA1_DSA },
+ { "1.2.840.113549.1.1.5", ALGORITHMS::SHA1_RSA },
+ { "1.2.840.113549.1.1.11", ALGORITHMS::SHA_256_RSA },
+ { "1.2.840.113549.1.1.12", ALGORITHMS::SHA_384_RSA },
+ { "1.2.840.113549.1.1.13", ALGORITHMS::SHA_512_RSA },
+ { "1.2.840.10045.4.1", ALGORITHMS::SHA1_ECDSA },
+ { "1.2.840.10045.4.3.2", ALGORITHMS::SHA_256_ECDSA },
+ { "1.2.840.10045.4.3.3", ALGORITHMS::SHA_384_ECDSA },
+ { "1.2.840.10045.4.3.4", ALGORITHMS::SHA_512_ECDSA },
+ };
+
+
+ const auto& it = OID_MAP.find(oid.c_str());
+ if (it == std::end(OID_MAP)) {
+ return ALGORITHMS::UNKNOWN;
+ }
+ return it->second;
+}
+
}
}
diff --git a/src/PE/utils/ordinals_lookup_tables/advapi32_dll_lookup.hpp b/src/PE/utils/ordinals_lookup_tables/advapi32_dll_lookup.hpp
index 79102949..3e0eb127 100644
--- a/src/PE/utils/ordinals_lookup_tables/advapi32_dll_lookup.hpp
+++ b/src/PE/utils/ordinals_lookup_tables/advapi32_dll_lookup.hpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -16,688 +16,690 @@
#ifndef LIEF_PE_ADVAPI32_DLL_LOOKUP_H_
#define LIEF_PE_ADVAPI32_DLL_LOOKUP_H_
-#include <map>
namespace LIEF {
namespace PE {
-static const std::map<uint32_t, const char*> advapi32_dll_lookup {
- { 0x0002, "A_SHAFinal" },
- { 0x0003, "A_SHAInit" },
- { 0x0004, "A_SHAUpdate" },
- { 0x0005, "AbortSystemShutdownA" },
- { 0x0006, "AbortSystemShutdownW" },
- { 0x0007, "AccessCheck" },
- { 0x0008, "AccessCheckAndAuditAlarmA" },
- { 0x0009, "AccessCheckAndAuditAlarmW" },
- { 0x000a, "AccessCheckByType" },
- { 0x000b, "AccessCheckByTypeAndAuditAlarmA" },
- { 0x000c, "AccessCheckByTypeAndAuditAlarmW" },
- { 0x000d, "AccessCheckByTypeResultList" },
- { 0x000e, "AccessCheckByTypeResultListAndAuditAlarmA" },
- { 0x000f, "AccessCheckByTypeResultListAndAuditAlarmByHandleA" },
- { 0x0010, "AccessCheckByTypeResultListAndAuditAlarmByHandleW" },
- { 0x0011, "AccessCheckByTypeResultListAndAuditAlarmW" },
- { 0x0012, "AddAccessAllowedAce" },
- { 0x0013, "AddAccessAllowedAceEx" },
- { 0x0014, "AddAccessAllowedObjectAce" },
- { 0x0015, "AddAccessDeniedAce" },
- { 0x0016, "AddAccessDeniedAceEx" },
- { 0x0017, "AddAccessDeniedObjectAce" },
- { 0x0018, "AddAce" },
- { 0x0019, "AddAuditAccessAce" },
- { 0x001a, "AddAuditAccessAceEx" },
- { 0x001b, "AddAuditAccessObjectAce" },
- { 0x001c, "AddUsersToEncryptedFile" },
- { 0x001d, "AdjustTokenGroups" },
- { 0x001e, "AdjustTokenPrivileges" },
- { 0x001f, "AllocateAndInitializeSid" },
- { 0x0020, "AllocateLocallyUniqueId" },
- { 0x0021, "AreAllAccessesGranted" },
- { 0x0022, "AreAnyAccessesGranted" },
- { 0x0023, "BackupEventLogA" },
- { 0x0024, "BackupEventLogW" },
- { 0x0025, "BuildExplicitAccessWithNameA" },
- { 0x0026, "BuildExplicitAccessWithNameW" },
- { 0x0027, "BuildImpersonateExplicitAccessWithNameA" },
- { 0x0028, "BuildImpersonateExplicitAccessWithNameW" },
- { 0x0029, "BuildImpersonateTrusteeA" },
- { 0x002a, "BuildImpersonateTrusteeW" },
- { 0x002b, "BuildSecurityDescriptorA" },
- { 0x002c, "BuildSecurityDescriptorW" },
- { 0x002d, "BuildTrusteeWithNameA" },
- { 0x002e, "BuildTrusteeWithNameW" },
- { 0x002f, "BuildTrusteeWithObjectsAndNameA" },
- { 0x0030, "BuildTrusteeWithObjectsAndNameW" },
- { 0x0031, "BuildTrusteeWithObjectsAndSidA" },
- { 0x0032, "BuildTrusteeWithObjectsAndSidW" },
- { 0x0033, "BuildTrusteeWithSidA" },
- { 0x0034, "BuildTrusteeWithSidW" },
- { 0x0035, "CancelOverlappedAccess" },
- { 0x0036, "ChangeServiceConfig2A" },
- { 0x0037, "ChangeServiceConfig2W" },
- { 0x0038, "ChangeServiceConfigA" },
- { 0x0039, "ChangeServiceConfigW" },
- { 0x003a, "CheckTokenMembership" },
- { 0x003b, "ClearEventLogA" },
- { 0x003c, "ClearEventLogW" },
- { 0x003d, "CloseCodeAuthzLevel" },
- { 0x003e, "CloseEncryptedFileRaw" },
- { 0x003f, "CloseEventLog" },
- { 0x0040, "CloseServiceHandle" },
- { 0x0041, "CloseTrace" },
- { 0x0042, "CommandLineFromMsiDescriptor" },
- { 0x0043, "ComputeAccessTokenFromCodeAuthzLevel" },
- { 0x0044, "ControlService" },
- { 0x0045, "ControlTraceA" },
- { 0x0046, "ControlTraceW" },
- { 0x0047, "ConvertAccessToSecurityDescriptorA" },
- { 0x0048, "ConvertAccessToSecurityDescriptorW" },
- { 0x0049, "ConvertSDToStringSDRootDomainA" },
- { 0x004a, "ConvertSDToStringSDRootDomainW" },
- { 0x004b, "ConvertSecurityDescriptorToAccessA" },
- { 0x004c, "ConvertSecurityDescriptorToAccessNamedA" },
- { 0x004d, "ConvertSecurityDescriptorToAccessNamedW" },
- { 0x004e, "ConvertSecurityDescriptorToAccessW" },
- { 0x004f, "ConvertSecurityDescriptorToStringSecurityDescriptorA" },
- { 0x0050, "ConvertSecurityDescriptorToStringSecurityDescriptorW" },
- { 0x0051, "ConvertSidToStringSidA" },
- { 0x0052, "ConvertSidToStringSidW" },
- { 0x0053, "ConvertStringSDToSDDomainA" },
- { 0x0054, "ConvertStringSDToSDDomainW" },
- { 0x0055, "ConvertStringSDToSDRootDomainA" },
- { 0x0056, "ConvertStringSDToSDRootDomainW" },
- { 0x0057, "ConvertStringSecurityDescriptorToSecurityDescriptorA" },
- { 0x0058, "ConvertStringSecurityDescriptorToSecurityDescriptorW" },
- { 0x0059, "ConvertStringSidToSidA" },
- { 0x005a, "ConvertStringSidToSidW" },
- { 0x005b, "ConvertToAutoInheritPrivateObjectSecurity" },
- { 0x005c, "CopySid" },
- { 0x005d, "CreateCodeAuthzLevel" },
- { 0x005e, "CreatePrivateObjectSecurity" },
- { 0x005f, "CreatePrivateObjectSecurityEx" },
- { 0x0060, "CreatePrivateObjectSecurityWithMultipleInheritance" },
- { 0x0061, "CreateProcessAsUserA" },
- { 0x0062, "CreateProcessAsUserSecure" },
- { 0x0063, "CreateProcessAsUserW" },
- { 0x0064, "CreateProcessWithLogonW" },
- { 0x0065, "CreateRestrictedToken" },
- { 0x0066, "CreateServiceA" },
- { 0x0067, "CreateServiceW" },
- { 0x0068, "CreateTraceInstanceId" },
- { 0x0069, "CreateWellKnownSid" },
- { 0x006a, "CredDeleteA" },
- { 0x006b, "CredDeleteW" },
- { 0x006c, "CredEnumerateA" },
- { 0x006d, "CredEnumerateW" },
- { 0x006e, "CredFree" },
- { 0x006f, "CredGetSessionTypes" },
- { 0x0070, "CredGetTargetInfoA" },
- { 0x0071, "CredGetTargetInfoW" },
- { 0x0072, "CredIsMarshaledCredentialA" },
- { 0x0073, "CredIsMarshaledCredentialW" },
- { 0x0074, "CredMarshalCredentialA" },
- { 0x0075, "CredMarshalCredentialW" },
- { 0x0076, "CredProfileLoaded" },
- { 0x0077, "CredReadA" },
- { 0x0078, "CredReadDomainCredentialsA" },
- { 0x0079, "CredReadDomainCredentialsW" },
- { 0x007a, "CredReadW" },
- { 0x007b, "CredRenameA" },
- { 0x007c, "CredRenameW" },
- { 0x007d, "CredUnmarshalCredentialA" },
- { 0x007e, "CredUnmarshalCredentialW" },
- { 0x007f, "CredWriteA" },
- { 0x0080, "CredWriteDomainCredentialsA" },
- { 0x0081, "CredWriteDomainCredentialsW" },
- { 0x0082, "CredWriteW" },
- { 0x0083, "CredpConvertCredential" },
- { 0x0084, "CredpConvertTargetInfo" },
- { 0x0085, "CredpDecodeCredential" },
- { 0x0086, "CredpEncodeCredential" },
- { 0x0087, "CryptAcquireContextA" },
- { 0x0088, "CryptAcquireContextW" },
- { 0x0089, "CryptContextAddRef" },
- { 0x008a, "CryptCreateHash" },
- { 0x008b, "CryptDecrypt" },
- { 0x008c, "CryptDeriveKey" },
- { 0x008d, "CryptDestroyHash" },
- { 0x008e, "CryptDestroyKey" },
- { 0x008f, "CryptDuplicateHash" },
- { 0x0090, "CryptDuplicateKey" },
- { 0x0091, "CryptEncrypt" },
- { 0x0092, "CryptEnumProviderTypesA" },
- { 0x0093, "CryptEnumProviderTypesW" },
- { 0x0094, "CryptEnumProvidersA" },
- { 0x0095, "CryptEnumProvidersW" },
- { 0x0096, "CryptExportKey" },
- { 0x0097, "CryptGenKey" },
- { 0x0098, "CryptGenRandom" },
- { 0x0099, "CryptGetDefaultProviderA" },
- { 0x009a, "CryptGetDefaultProviderW" },
- { 0x009b, "CryptGetHashParam" },
- { 0x009c, "CryptGetKeyParam" },
- { 0x009d, "CryptGetProvParam" },
- { 0x009e, "CryptGetUserKey" },
- { 0x009f, "CryptHashData" },
- { 0x00a0, "CryptHashSessionKey" },
- { 0x00a1, "CryptImportKey" },
- { 0x00a2, "CryptReleaseContext" },
- { 0x00a3, "CryptSetHashParam" },
- { 0x00a4, "CryptSetKeyParam" },
- { 0x00a5, "CryptSetProvParam" },
- { 0x00a6, "CryptSetProviderA" },
- { 0x00a7, "CryptSetProviderExA" },
- { 0x00a8, "CryptSetProviderExW" },
- { 0x00a9, "CryptSetProviderW" },
- { 0x00aa, "CryptSignHashA" },
- { 0x00ab, "CryptSignHashW" },
- { 0x00ac, "CryptVerifySignatureA" },
- { 0x00ad, "CryptVerifySignatureW" },
- { 0x00ae, "DecryptFileA" },
- { 0x00af, "DecryptFileW" },
- { 0x00b0, "DeleteAce" },
- { 0x00b1, "DeleteService" },
- { 0x00b2, "DeregisterEventSource" },
- { 0x00b3, "DestroyPrivateObjectSecurity" },
- { 0x00b4, "DuplicateEncryptionInfoFile" },
- { 0x00b5, "DuplicateToken" },
- { 0x00b6, "DuplicateTokenEx" },
- { 0x00b7, "ElfBackupEventLogFileA" },
- { 0x00b8, "ElfBackupEventLogFileW" },
- { 0x00b9, "ElfChangeNotify" },
- { 0x00ba, "ElfClearEventLogFileA" },
- { 0x00bb, "ElfClearEventLogFileW" },
- { 0x00bc, "ElfCloseEventLog" },
- { 0x00bd, "ElfDeregisterEventSource" },
- { 0x00be, "ElfFlushEventLog" },
- { 0x00bf, "ElfNumberOfRecords" },
- { 0x00c0, "ElfOldestRecord" },
- { 0x00c1, "ElfOpenBackupEventLogA" },
- { 0x00c2, "ElfOpenBackupEventLogW" },
- { 0x00c3, "ElfOpenEventLogA" },
- { 0x00c4, "ElfOpenEventLogW" },
- { 0x00c5, "ElfReadEventLogA" },
- { 0x00c6, "ElfReadEventLogW" },
- { 0x00c7, "ElfRegisterEventSourceA" },
- { 0x00c8, "ElfRegisterEventSourceW" },
- { 0x00c9, "ElfReportEventA" },
- { 0x00ca, "ElfReportEventW" },
- { 0x00cb, "EnableTrace" },
- { 0x00cc, "EncryptFileA" },
- { 0x00cd, "EncryptFileW" },
- { 0x00ce, "EncryptedFileKeyInfo" },
- { 0x00cf, "EncryptionDisable" },
- { 0x00d0, "EnumDependentServicesA" },
- { 0x00d1, "EnumDependentServicesW" },
- { 0x00d2, "EnumServiceGroupW" },
- { 0x00d3, "EnumServicesStatusA" },
- { 0x00d4, "EnumServicesStatusExA" },
- { 0x00d5, "EnumServicesStatusExW" },
- { 0x00d6, "EnumServicesStatusW" },
- { 0x00d7, "EnumerateTraceGuids" },
- { 0x00d8, "EqualDomainSid" },
- { 0x00d9, "EqualPrefixSid" },
- { 0x00da, "EqualSid" },
- { 0x00db, "FileEncryptionStatusA" },
- { 0x00dc, "FileEncryptionStatusW" },
- { 0x00dd, "FindFirstFreeAce" },
- { 0x00de, "FlushTraceA" },
- { 0x00df, "FlushTraceW" },
- { 0x00e0, "FreeEncryptedFileKeyInfo" },
- { 0x00e1, "FreeEncryptionCertificateHashList" },
- { 0x00e2, "FreeInheritedFromArray" },
- { 0x00e3, "FreeSid" },
- { 0x00e4, "GetAccessPermissionsForObjectA" },
- { 0x00e5, "GetAccessPermissionsForObjectW" },
- { 0x00e6, "GetAce" },
- { 0x00e7, "GetAclInformation" },
- { 0x00e8, "GetAuditedPermissionsFromAclA" },
- { 0x00e9, "GetAuditedPermissionsFromAclW" },
- { 0x00ea, "GetCurrentHwProfileA" },
- { 0x00eb, "GetCurrentHwProfileW" },
- { 0x00ec, "GetEffectiveRightsFromAclA" },
- { 0x00ed, "GetEffectiveRightsFromAclW" },
- { 0x00ee, "GetEventLogInformation" },
- { 0x00ef, "GetExplicitEntriesFromAclA" },
- { 0x00f0, "GetExplicitEntriesFromAclW" },
- { 0x00f1, "GetFileSecurityA" },
- { 0x00f2, "GetFileSecurityW" },
- { 0x00f3, "GetInformationCodeAuthzLevelW" },
- { 0x00f4, "GetInformationCodeAuthzPolicyW" },
- { 0x00f5, "GetInheritanceSourceA" },
- { 0x00f6, "GetInheritanceSourceW" },
- { 0x00f7, "GetKernelObjectSecurity" },
- { 0x00f8, "GetLengthSid" },
- { 0x00f9, "GetLocalManagedApplicationData" },
- { 0x00fa, "GetLocalManagedApplications" },
- { 0x00fb, "GetManagedApplicationCategories" },
- { 0x00fc, "GetManagedApplications" },
- { 0x00fd, "GetMultipleTrusteeA" },
- { 0x00fe, "GetMultipleTrusteeOperationA" },
- { 0x00ff, "GetMultipleTrusteeOperationW" },
- { 0x0100, "GetMultipleTrusteeW" },
- { 0x0101, "GetNamedSecurityInfoA" },
- { 0x0102, "GetNamedSecurityInfoExA" },
- { 0x0103, "GetNamedSecurityInfoExW" },
- { 0x0104, "GetNamedSecurityInfoW" },
- { 0x0105, "GetNumberOfEventLogRecords" },
- { 0x0106, "GetOldestEventLogRecord" },
- { 0x0107, "GetOverlappedAccessResults" },
- { 0x0108, "GetPrivateObjectSecurity" },
- { 0x0109, "GetSecurityDescriptorControl" },
- { 0x010a, "GetSecurityDescriptorDacl" },
- { 0x010b, "GetSecurityDescriptorGroup" },
- { 0x010c, "GetSecurityDescriptorLength" },
- { 0x010d, "GetSecurityDescriptorOwner" },
- { 0x010e, "GetSecurityDescriptorRMControl" },
- { 0x010f, "GetSecurityDescriptorSacl" },
- { 0x0110, "GetSecurityInfo" },
- { 0x0111, "GetSecurityInfoExA" },
- { 0x0112, "GetSecurityInfoExW" },
- { 0x0113, "GetServiceDisplayNameA" },
- { 0x0114, "GetServiceDisplayNameW" },
- { 0x0115, "GetServiceKeyNameA" },
- { 0x0116, "GetServiceKeyNameW" },
- { 0x0117, "GetSidIdentifierAuthority" },
- { 0x0118, "GetSidLengthRequired" },
- { 0x0119, "GetSidSubAuthority" },
- { 0x011a, "GetSidSubAuthorityCount" },
- { 0x011b, "GetTokenInformation" },
- { 0x011c, "GetTraceEnableFlags" },
- { 0x011d, "GetTraceEnableLevel" },
- { 0x011e, "GetTraceLoggerHandle" },
- { 0x011f, "GetTrusteeFormA" },
- { 0x0120, "GetTrusteeFormW" },
- { 0x0121, "GetTrusteeNameA" },
- { 0x0122, "GetTrusteeNameW" },
- { 0x0123, "GetTrusteeTypeA" },
- { 0x0124, "GetTrusteeTypeW" },
- { 0x0125, "GetUserNameA" },
- { 0x0126, "GetUserNameW" },
- { 0x0127, "GetWindowsAccountDomainSid" },
- { 0x0001, "I_ScGetCurrentGroupStateW" },
- { 0x0128, "I_ScIsSecurityProcess" },
- { 0x0129, "I_ScPnPGetServiceName" },
- { 0x012a, "I_ScSendTSMessage" },
- { 0x012b, "I_ScSetServiceBitsA" },
- { 0x012c, "I_ScSetServiceBitsW" },
- { 0x012d, "IdentifyCodeAuthzLevelW" },
- { 0x012e, "ImpersonateAnonymousToken" },
- { 0x012f, "ImpersonateLoggedOnUser" },
- { 0x0130, "ImpersonateNamedPipeClient" },
- { 0x0131, "ImpersonateSelf" },
- { 0x0132, "InitializeAcl" },
- { 0x0133, "InitializeSecurityDescriptor" },
- { 0x0134, "InitializeSid" },
- { 0x0135, "InitiateSystemShutdownA" },
- { 0x0136, "InitiateSystemShutdownExA" },
- { 0x0137, "InitiateSystemShutdownExW" },
- { 0x0138, "InitiateSystemShutdownW" },
- { 0x0139, "InstallApplication" },
- { 0x013a, "IsTextUnicode" },
- { 0x013b, "IsTokenRestricted" },
- { 0x013c, "IsTokenUntrusted" },
- { 0x013d, "IsValidAcl" },
- { 0x013e, "IsValidSecurityDescriptor" },
- { 0x013f, "IsValidSid" },
- { 0x0140, "IsWellKnownSid" },
- { 0x0141, "LockServiceDatabase" },
- { 0x0142, "LogonUserA" },
- { 0x0143, "LogonUserExA" },
- { 0x0144, "LogonUserExW" },
- { 0x0145, "LogonUserW" },
- { 0x0146, "LookupAccountNameA" },
- { 0x0147, "LookupAccountNameW" },
- { 0x0148, "LookupAccountSidA" },
- { 0x0149, "LookupAccountSidW" },
- { 0x014a, "LookupPrivilegeDisplayNameA" },
- { 0x014b, "LookupPrivilegeDisplayNameW" },
- { 0x014c, "LookupPrivilegeNameA" },
- { 0x014d, "LookupPrivilegeNameW" },
- { 0x014e, "LookupPrivilegeValueA" },
- { 0x014f, "LookupPrivilegeValueW" },
- { 0x0150, "LookupSecurityDescriptorPartsA" },
- { 0x0151, "LookupSecurityDescriptorPartsW" },
- { 0x0152, "LsaAddAccountRights" },
- { 0x0153, "LsaAddPrivilegesToAccount" },
- { 0x0154, "LsaClearAuditLog" },
- { 0x0155, "LsaClose" },
- { 0x0156, "LsaCreateAccount" },
- { 0x0157, "LsaCreateSecret" },
- { 0x0158, "LsaCreateTrustedDomain" },
- { 0x0159, "LsaCreateTrustedDomainEx" },
- { 0x015a, "LsaDelete" },
- { 0x015b, "LsaDeleteTrustedDomain" },
- { 0x015c, "LsaEnumerateAccountRights" },
- { 0x015d, "LsaEnumerateAccounts" },
- { 0x015e, "LsaEnumerateAccountsWithUserRight" },
- { 0x015f, "LsaEnumeratePrivileges" },
- { 0x0160, "LsaEnumeratePrivilegesOfAccount" },
- { 0x0161, "LsaEnumerateTrustedDomains" },
- { 0x0162, "LsaEnumerateTrustedDomainsEx" },
- { 0x0163, "LsaFreeMemory" },
- { 0x0164, "LsaGetQuotasForAccount" },
- { 0x0165, "LsaGetRemoteUserName" },
- { 0x0166, "LsaGetSystemAccessAccount" },
- { 0x0167, "LsaGetUserName" },
- { 0x0168, "LsaICLookupNames" },
- { 0x0169, "LsaICLookupNamesWithCreds" },
- { 0x016a, "LsaICLookupSids" },
- { 0x016b, "LsaICLookupSidsWithCreds" },
- { 0x016d, "LsaLookupNames" },
- { 0x016c, "LsaLookupNames2" },
- { 0x016e, "LsaLookupPrivilegeDisplayName" },
- { 0x016f, "LsaLookupPrivilegeName" },
- { 0x0170, "LsaLookupPrivilegeValue" },
- { 0x0171, "LsaLookupSids" },
- { 0x0172, "LsaNtStatusToWinError" },
- { 0x0173, "LsaOpenAccount" },
- { 0x0174, "LsaOpenPolicy" },
- { 0x0175, "LsaOpenPolicySce" },
- { 0x0176, "LsaOpenSecret" },
- { 0x0177, "LsaOpenTrustedDomain" },
- { 0x0178, "LsaOpenTrustedDomainByName" },
- { 0x0179, "LsaQueryDomainInformationPolicy" },
- { 0x017a, "LsaQueryForestTrustInformation" },
- { 0x017b, "LsaQueryInfoTrustedDomain" },
- { 0x017c, "LsaQueryInformationPolicy" },
- { 0x017d, "LsaQuerySecret" },
- { 0x017e, "LsaQuerySecurityObject" },
- { 0x017f, "LsaQueryTrustedDomainInfo" },
- { 0x0180, "LsaQueryTrustedDomainInfoByName" },
- { 0x0181, "LsaRemoveAccountRights" },
- { 0x0182, "LsaRemovePrivilegesFromAccount" },
- { 0x0183, "LsaRetrievePrivateData" },
- { 0x0184, "LsaSetDomainInformationPolicy" },
- { 0x0185, "LsaSetForestTrustInformation" },
- { 0x0186, "LsaSetInformationPolicy" },
- { 0x0187, "LsaSetInformationTrustedDomain" },
- { 0x0188, "LsaSetQuotasForAccount" },
- { 0x0189, "LsaSetSecret" },
- { 0x018a, "LsaSetSecurityObject" },
- { 0x018b, "LsaSetSystemAccessAccount" },
- { 0x018c, "LsaSetTrustedDomainInfoByName" },
- { 0x018d, "LsaSetTrustedDomainInformation" },
- { 0x018e, "LsaStorePrivateData" },
- { 0x018f, "MD4Final" },
- { 0x0190, "MD4Init" },
- { 0x0191, "MD4Update" },
- { 0x0192, "MD5Final" },
- { 0x0193, "MD5Init" },
- { 0x0194, "MD5Update" },
- { 0x0196, "MSChapSrvChangePassword" },
- { 0x0195, "MSChapSrvChangePassword2" },
- { 0x0198, "MakeAbsoluteSD" },
- { 0x0197, "MakeAbsoluteSD2" },
- { 0x0199, "MakeSelfRelativeSD" },
- { 0x019a, "MapGenericMask" },
- { 0x019b, "NotifyBootConfigStatus" },
- { 0x019c, "NotifyChangeEventLog" },
- { 0x019d, "ObjectCloseAuditAlarmA" },
- { 0x019e, "ObjectCloseAuditAlarmW" },
- { 0x019f, "ObjectDeleteAuditAlarmA" },
- { 0x01a0, "ObjectDeleteAuditAlarmW" },
- { 0x01a1, "ObjectOpenAuditAlarmA" },
- { 0x01a2, "ObjectOpenAuditAlarmW" },
- { 0x01a3, "ObjectPrivilegeAuditAlarmA" },
- { 0x01a4, "ObjectPrivilegeAuditAlarmW" },
- { 0x01a5, "OpenBackupEventLogA" },
- { 0x01a6, "OpenBackupEventLogW" },
- { 0x01a7, "OpenEncryptedFileRawA" },
- { 0x01a8, "OpenEncryptedFileRawW" },
- { 0x01a9, "OpenEventLogA" },
- { 0x01aa, "OpenEventLogW" },
- { 0x01ab, "OpenProcessToken" },
- { 0x01ac, "OpenSCManagerA" },
- { 0x01ad, "OpenSCManagerW" },
- { 0x01ae, "OpenServiceA" },
- { 0x01af, "OpenServiceW" },
- { 0x01b0, "OpenThreadToken" },
- { 0x01b1, "OpenTraceA" },
- { 0x01b2, "OpenTraceW" },
- { 0x01b3, "PrivilegeCheck" },
- { 0x01b4, "PrivilegedServiceAuditAlarmA" },
- { 0x01b5, "PrivilegedServiceAuditAlarmW" },
- { 0x01b6, "ProcessIdleTasks" },
- { 0x01b7, "ProcessTrace" },
- { 0x01b8, "QueryAllTracesA" },
- { 0x01b9, "QueryAllTracesW" },
- { 0x01ba, "QueryRecoveryAgentsOnEncryptedFile" },
- { 0x01bb, "QueryServiceConfig2A" },
- { 0x01bc, "QueryServiceConfig2W" },
- { 0x01bd, "QueryServiceConfigA" },
- { 0x01be, "QueryServiceConfigW" },
- { 0x01bf, "QueryServiceLockStatusA" },
- { 0x01c0, "QueryServiceLockStatusW" },
- { 0x01c1, "QueryServiceObjectSecurity" },
- { 0x01c2, "QueryServiceStatus" },
- { 0x01c3, "QueryServiceStatusEx" },
- { 0x01c4, "QueryTraceA" },
- { 0x01c5, "QueryTraceW" },
- { 0x01c6, "QueryUsersOnEncryptedFile" },
- { 0x01c7, "QueryWindows31FilesMigration" },
- { 0x01c8, "ReadEncryptedFileRaw" },
- { 0x01c9, "ReadEventLogA" },
- { 0x01ca, "ReadEventLogW" },
- { 0x01cb, "RegCloseKey" },
- { 0x01cc, "RegConnectRegistryA" },
- { 0x01cd, "RegConnectRegistryW" },
- { 0x01ce, "RegCreateKeyA" },
- { 0x01cf, "RegCreateKeyExA" },
- { 0x01d0, "RegCreateKeyExW" },
- { 0x01d1, "RegCreateKeyW" },
- { 0x01d2, "RegDeleteKeyA" },
- { 0x01d3, "RegDeleteKeyW" },
- { 0x01d4, "RegDeleteValueA" },
- { 0x01d5, "RegDeleteValueW" },
- { 0x01d6, "RegDisablePredefinedCache" },
- { 0x01d7, "RegEnumKeyA" },
- { 0x01d8, "RegEnumKeyExA" },
- { 0x01d9, "RegEnumKeyExW" },
- { 0x01da, "RegEnumKeyW" },
- { 0x01db, "RegEnumValueA" },
- { 0x01dc, "RegEnumValueW" },
- { 0x01dd, "RegFlushKey" },
- { 0x01de, "RegGetKeySecurity" },
- { 0x01df, "RegLoadKeyA" },
- { 0x01e0, "RegLoadKeyW" },
- { 0x01e1, "RegNotifyChangeKeyValue" },
- { 0x01e2, "RegOpenCurrentUser" },
- { 0x01e3, "RegOpenKeyA" },
- { 0x01e4, "RegOpenKeyExA" },
- { 0x01e5, "RegOpenKeyExW" },
- { 0x01e6, "RegOpenKeyW" },
- { 0x01e7, "RegOpenUserClassesRoot" },
- { 0x01e8, "RegOverridePredefKey" },
- { 0x01e9, "RegQueryInfoKeyA" },
- { 0x01ea, "RegQueryInfoKeyW" },
- { 0x01eb, "RegQueryMultipleValuesA" },
- { 0x01ec, "RegQueryMultipleValuesW" },
- { 0x01ed, "RegQueryValueA" },
- { 0x01ee, "RegQueryValueExA" },
- { 0x01ef, "RegQueryValueExW" },
- { 0x01f0, "RegQueryValueW" },
- { 0x01f1, "RegReplaceKeyA" },
- { 0x01f2, "RegReplaceKeyW" },
- { 0x01f3, "RegRestoreKeyA" },
- { 0x01f4, "RegRestoreKeyW" },
- { 0x01f5, "RegSaveKeyA" },
- { 0x01f6, "RegSaveKeyExA" },
- { 0x01f7, "RegSaveKeyExW" },
- { 0x01f8, "RegSaveKeyW" },
- { 0x01f9, "RegSetKeySecurity" },
- { 0x01fa, "RegSetValueA" },
- { 0x01fb, "RegSetValueExA" },
- { 0x01fc, "RegSetValueExW" },
- { 0x01fd, "RegSetValueW" },
- { 0x01fe, "RegUnLoadKeyA" },
- { 0x01ff, "RegUnLoadKeyW" },
- { 0x0200, "RegisterEventSourceA" },
- { 0x0201, "RegisterEventSourceW" },
- { 0x0202, "RegisterIdleTask" },
- { 0x0203, "RegisterServiceCtrlHandlerA" },
- { 0x0204, "RegisterServiceCtrlHandlerExA" },
- { 0x0205, "RegisterServiceCtrlHandlerExW" },
- { 0x0206, "RegisterServiceCtrlHandlerW" },
- { 0x0207, "RegisterTraceGuidsA" },
- { 0x0208, "RegisterTraceGuidsW" },
- { 0x0209, "RemoveTraceCallback" },
- { 0x020a, "RemoveUsersFromEncryptedFile" },
- { 0x020b, "ReportEventA" },
- { 0x020c, "ReportEventW" },
- { 0x020d, "RevertToSelf" },
- { 0x020e, "SaferCloseLevel" },
- { 0x020f, "SaferComputeTokenFromLevel" },
- { 0x0210, "SaferCreateLevel" },
- { 0x0211, "SaferGetLevelInformation" },
- { 0x0212, "SaferGetPolicyInformation" },
- { 0x0213, "SaferIdentifyLevel" },
- { 0x0214, "SaferRecordEventLogEntry" },
- { 0x0215, "SaferSetLevelInformation" },
- { 0x0216, "SaferSetPolicyInformation" },
- { 0x0217, "SaferiChangeRegistryScope" },
- { 0x0218, "SaferiCompareTokenLevels" },
- { 0x0219, "SaferiIsExecutableFileType" },
- { 0x021a, "SaferiPopulateDefaultsInRegistry" },
- { 0x021b, "SaferiRecordEventLogEntry" },
- { 0x021c, "SaferiReplaceProcessThreadTokens" },
- { 0x021d, "SaferiSearchMatchingHashRules" },
- { 0x021e, "SetAclInformation" },
- { 0x021f, "SetEntriesInAccessListA" },
- { 0x0220, "SetEntriesInAccessListW" },
- { 0x0221, "SetEntriesInAclA" },
- { 0x0222, "SetEntriesInAclW" },
- { 0x0223, "SetEntriesInAuditListA" },
- { 0x0224, "SetEntriesInAuditListW" },
- { 0x0225, "SetFileSecurityA" },
- { 0x0226, "SetFileSecurityW" },
- { 0x0227, "SetInformationCodeAuthzLevelW" },
- { 0x0228, "SetInformationCodeAuthzPolicyW" },
- { 0x0229, "SetKernelObjectSecurity" },
- { 0x022a, "SetNamedSecurityInfoA" },
- { 0x022b, "SetNamedSecurityInfoExA" },
- { 0x022c, "SetNamedSecurityInfoExW" },
- { 0x022d, "SetNamedSecurityInfoW" },
- { 0x022e, "SetPrivateObjectSecurity" },
- { 0x022f, "SetPrivateObjectSecurityEx" },
- { 0x0230, "SetSecurityDescriptorControl" },
- { 0x0231, "SetSecurityDescriptorDacl" },
- { 0x0232, "SetSecurityDescriptorGroup" },
- { 0x0233, "SetSecurityDescriptorOwner" },
- { 0x0234, "SetSecurityDescriptorRMControl" },
- { 0x0235, "SetSecurityDescriptorSacl" },
- { 0x0236, "SetSecurityInfo" },
- { 0x0237, "SetSecurityInfoExA" },
- { 0x0238, "SetSecurityInfoExW" },
- { 0x0239, "SetServiceBits" },
- { 0x023a, "SetServiceObjectSecurity" },
- { 0x023b, "SetServiceStatus" },
- { 0x023c, "SetThreadToken" },
- { 0x023d, "SetTokenInformation" },
- { 0x023e, "SetTraceCallback" },
- { 0x023f, "SetUserFileEncryptionKey" },
- { 0x0240, "StartServiceA" },
- { 0x0241, "StartServiceCtrlDispatcherA" },
- { 0x0242, "StartServiceCtrlDispatcherW" },
- { 0x0243, "StartServiceW" },
- { 0x0244, "StartTraceA" },
- { 0x0245, "StartTraceW" },
- { 0x0246, "StopTraceA" },
- { 0x0247, "StopTraceW" },
- { 0x0248, "SynchronizeWindows31FilesAndWindowsNTRegistry" },
- { 0x0249, "SystemFunction001" },
- { 0x024a, "SystemFunction002" },
- { 0x024b, "SystemFunction003" },
- { 0x024c, "SystemFunction004" },
- { 0x024d, "SystemFunction005" },
- { 0x024e, "SystemFunction006" },
- { 0x024f, "SystemFunction007" },
- { 0x0250, "SystemFunction008" },
- { 0x0251, "SystemFunction009" },
- { 0x0252, "SystemFunction010" },
- { 0x0253, "SystemFunction011" },
- { 0x0254, "SystemFunction012" },
- { 0x0255, "SystemFunction013" },
- { 0x0256, "SystemFunction014" },
- { 0x0257, "SystemFunction015" },
- { 0x0258, "SystemFunction016" },
- { 0x0259, "SystemFunction017" },
- { 0x025a, "SystemFunction018" },
- { 0x025b, "SystemFunction019" },
- { 0x025c, "SystemFunction020" },
- { 0x025d, "SystemFunction021" },
- { 0x025e, "SystemFunction022" },
- { 0x025f, "SystemFunction023" },
- { 0x0260, "SystemFunction024" },
- { 0x0261, "SystemFunction025" },
- { 0x0262, "SystemFunction026" },
- { 0x0263, "SystemFunction027" },
- { 0x0264, "SystemFunction028" },
- { 0x0265, "SystemFunction029" },
- { 0x0266, "SystemFunction030" },
- { 0x0267, "SystemFunction031" },
- { 0x0268, "SystemFunction032" },
- { 0x0269, "SystemFunction033" },
- { 0x026a, "SystemFunction034" },
- { 0x026b, "SystemFunction035" },
- { 0x026c, "SystemFunction036" },
- { 0x026d, "SystemFunction040" },
- { 0x026e, "SystemFunction041" },
- { 0x026f, "TraceEvent" },
- { 0x0270, "TraceEventInstance" },
- { 0x0271, "TraceMessage" },
- { 0x0272, "TraceMessageVa" },
- { 0x0273, "TreeResetNamedSecurityInfoA" },
- { 0x0274, "TreeResetNamedSecurityInfoW" },
- { 0x0275, "TrusteeAccessToObjectA" },
- { 0x0276, "TrusteeAccessToObjectW" },
- { 0x0277, "UninstallApplication" },
- { 0x0278, "UnlockServiceDatabase" },
- { 0x0279, "UnregisterIdleTask" },
- { 0x027a, "UnregisterTraceGuids" },
- { 0x027b, "UpdateTraceA" },
- { 0x027c, "UpdateTraceW" },
- { 0x027d, "WdmWmiServiceMain" },
- { 0x027e, "WmiCloseBlock" },
- { 0x027f, "WmiCloseTraceWithCursor" },
- { 0x0280, "WmiConvertTimestamp" },
- { 0x0281, "WmiDevInstToInstanceNameA" },
- { 0x0282, "WmiDevInstToInstanceNameW" },
- { 0x0283, "WmiEnumerateGuids" },
- { 0x0284, "WmiExecuteMethodA" },
- { 0x0285, "WmiExecuteMethodW" },
- { 0x0286, "WmiFileHandleToInstanceNameA" },
- { 0x0287, "WmiFileHandleToInstanceNameW" },
- { 0x0288, "WmiFreeBuffer" },
- { 0x0289, "WmiGetFirstTraceOffset" },
- { 0x028a, "WmiGetNextEvent" },
- { 0x028b, "WmiGetTraceHeader" },
- { 0x028c, "WmiMofEnumerateResourcesA" },
- { 0x028d, "WmiMofEnumerateResourcesW" },
- { 0x028e, "WmiNotificationRegistrationA" },
- { 0x028f, "WmiNotificationRegistrationW" },
- { 0x0290, "WmiOpenBlock" },
- { 0x0291, "WmiOpenTraceWithCursor" },
- { 0x0292, "WmiParseTraceEvent" },
- { 0x0293, "WmiQueryAllDataA" },
- { 0x0294, "WmiQueryAllDataMultipleA" },
- { 0x0295, "WmiQueryAllDataMultipleW" },
- { 0x0296, "WmiQueryAllDataW" },
- { 0x0297, "WmiQueryGuidInformation" },
- { 0x0298, "WmiQuerySingleInstanceA" },
- { 0x0299, "WmiQuerySingleInstanceMultipleA" },
- { 0x029a, "WmiQuerySingleInstanceMultipleW" },
- { 0x029b, "WmiQuerySingleInstanceW" },
- { 0x029c, "WmiReceiveNotificationsA" },
- { 0x029d, "WmiReceiveNotificationsW" },
- { 0x029e, "WmiSetSingleInstanceA" },
- { 0x029f, "WmiSetSingleInstanceW" },
- { 0x02a0, "WmiSetSingleItemA" },
- { 0x02a1, "WmiSetSingleItemW" },
- { 0x02a2, "Wow64Win32ApiEntry" },
- { 0x02a3, "WriteEncryptedFileRaw" },
-};
+const char* advapi32_dll_lookup(uint32_t i) {
+ switch(i) {
+ case 0x0002: return "A_SHAFinal";
+ case 0x0003: return "A_SHAInit";
+ case 0x0004: return "A_SHAUpdate";
+ case 0x0005: return "AbortSystemShutdownA";
+ case 0x0006: return "AbortSystemShutdownW";
+ case 0x0007: return "AccessCheck";
+ case 0x0008: return "AccessCheckAndAuditAlarmA";
+ case 0x0009: return "AccessCheckAndAuditAlarmW";
+ case 0x000a: return "AccessCheckByType";
+ case 0x000b: return "AccessCheckByTypeAndAuditAlarmA";
+ case 0x000c: return "AccessCheckByTypeAndAuditAlarmW";
+ case 0x000d: return "AccessCheckByTypeResultList";
+ case 0x000e: return "AccessCheckByTypeResultListAndAuditAlarmA";
+ case 0x000f: return "AccessCheckByTypeResultListAndAuditAlarmByHandleA";
+ case 0x0010: return "AccessCheckByTypeResultListAndAuditAlarmByHandleW";
+ case 0x0011: return "AccessCheckByTypeResultListAndAuditAlarmW";
+ case 0x0012: return "AddAccessAllowedAce";
+ case 0x0013: return "AddAccessAllowedAceEx";
+ case 0x0014: return "AddAccessAllowedObjectAce";
+ case 0x0015: return "AddAccessDeniedAce";
+ case 0x0016: return "AddAccessDeniedAceEx";
+ case 0x0017: return "AddAccessDeniedObjectAce";
+ case 0x0018: return "AddAce";
+ case 0x0019: return "AddAuditAccessAce";
+ case 0x001a: return "AddAuditAccessAceEx";
+ case 0x001b: return "AddAuditAccessObjectAce";
+ case 0x001c: return "AddUsersToEncryptedFile";
+ case 0x001d: return "AdjustTokenGroups";
+ case 0x001e: return "AdjustTokenPrivileges";
+ case 0x001f: return "AllocateAndInitializeSid";
+ case 0x0020: return "AllocateLocallyUniqueId";
+ case 0x0021: return "AreAllAccessesGranted";
+ case 0x0022: return "AreAnyAccessesGranted";
+ case 0x0023: return "BackupEventLogA";
+ case 0x0024: return "BackupEventLogW";
+ case 0x0025: return "BuildExplicitAccessWithNameA";
+ case 0x0026: return "BuildExplicitAccessWithNameW";
+ case 0x0027: return "BuildImpersonateExplicitAccessWithNameA";
+ case 0x0028: return "BuildImpersonateExplicitAccessWithNameW";
+ case 0x0029: return "BuildImpersonateTrusteeA";
+ case 0x002a: return "BuildImpersonateTrusteeW";
+ case 0x002b: return "BuildSecurityDescriptorA";
+ case 0x002c: return "BuildSecurityDescriptorW";
+ case 0x002d: return "BuildTrusteeWithNameA";
+ case 0x002e: return "BuildTrusteeWithNameW";
+ case 0x002f: return "BuildTrusteeWithObjectsAndNameA";
+ case 0x0030: return "BuildTrusteeWithObjectsAndNameW";
+ case 0x0031: return "BuildTrusteeWithObjectsAndSidA";
+ case 0x0032: return "BuildTrusteeWithObjectsAndSidW";
+ case 0x0033: return "BuildTrusteeWithSidA";
+ case 0x0034: return "BuildTrusteeWithSidW";
+ case 0x0035: return "CancelOverlappedAccess";
+ case 0x0036: return "ChangeServiceConfig2A";
+ case 0x0037: return "ChangeServiceConfig2W";
+ case 0x0038: return "ChangeServiceConfigA";
+ case 0x0039: return "ChangeServiceConfigW";
+ case 0x003a: return "CheckTokenMembership";
+ case 0x003b: return "ClearEventLogA";
+ case 0x003c: return "ClearEventLogW";
+ case 0x003d: return "CloseCodeAuthzLevel";
+ case 0x003e: return "CloseEncryptedFileRaw";
+ case 0x003f: return "CloseEventLog";
+ case 0x0040: return "CloseServiceHandle";
+ case 0x0041: return "CloseTrace";
+ case 0x0042: return "CommandLineFromMsiDescriptor";
+ case 0x0043: return "ComputeAccessTokenFromCodeAuthzLevel";
+ case 0x0044: return "ControlService";
+ case 0x0045: return "ControlTraceA";
+ case 0x0046: return "ControlTraceW";
+ case 0x0047: return "ConvertAccessToSecurityDescriptorA";
+ case 0x0048: return "ConvertAccessToSecurityDescriptorW";
+ case 0x0049: return "ConvertSDToStringSDRootDomainA";
+ case 0x004a: return "ConvertSDToStringSDRootDomainW";
+ case 0x004b: return "ConvertSecurityDescriptorToAccessA";
+ case 0x004c: return "ConvertSecurityDescriptorToAccessNamedA";
+ case 0x004d: return "ConvertSecurityDescriptorToAccessNamedW";
+ case 0x004e: return "ConvertSecurityDescriptorToAccessW";
+ case 0x004f: return "ConvertSecurityDescriptorToStringSecurityDescriptorA";
+ case 0x0050: return "ConvertSecurityDescriptorToStringSecurityDescriptorW";
+ case 0x0051: return "ConvertSidToStringSidA";
+ case 0x0052: return "ConvertSidToStringSidW";
+ case 0x0053: return "ConvertStringSDToSDDomainA";
+ case 0x0054: return "ConvertStringSDToSDDomainW";
+ case 0x0055: return "ConvertStringSDToSDRootDomainA";
+ case 0x0056: return "ConvertStringSDToSDRootDomainW";
+ case 0x0057: return "ConvertStringSecurityDescriptorToSecurityDescriptorA";
+ case 0x0058: return "ConvertStringSecurityDescriptorToSecurityDescriptorW";
+ case 0x0059: return "ConvertStringSidToSidA";
+ case 0x005a: return "ConvertStringSidToSidW";
+ case 0x005b: return "ConvertToAutoInheritPrivateObjectSecurity";
+ case 0x005c: return "CopySid";
+ case 0x005d: return "CreateCodeAuthzLevel";
+ case 0x005e: return "CreatePrivateObjectSecurity";
+ case 0x005f: return "CreatePrivateObjectSecurityEx";
+ case 0x0060: return "CreatePrivateObjectSecurityWithMultipleInheritance";
+ case 0x0061: return "CreateProcessAsUserA";
+ case 0x0062: return "CreateProcessAsUserSecure";
+ case 0x0063: return "CreateProcessAsUserW";
+ case 0x0064: return "CreateProcessWithLogonW";
+ case 0x0065: return "CreateRestrictedToken";
+ case 0x0066: return "CreateServiceA";
+ case 0x0067: return "CreateServiceW";
+ case 0x0068: return "CreateTraceInstanceId";
+ case 0x0069: return "CreateWellKnownSid";
+ case 0x006a: return "CredDeleteA";
+ case 0x006b: return "CredDeleteW";
+ case 0x006c: return "CredEnumerateA";
+ case 0x006d: return "CredEnumerateW";
+ case 0x006e: return "CredFree";
+ case 0x006f: return "CredGetSessionTypes";
+ case 0x0070: return "CredGetTargetInfoA";
+ case 0x0071: return "CredGetTargetInfoW";
+ case 0x0072: return "CredIsMarshaledCredentialA";
+ case 0x0073: return "CredIsMarshaledCredentialW";
+ case 0x0074: return "CredMarshalCredentialA";
+ case 0x0075: return "CredMarshalCredentialW";
+ case 0x0076: return "CredProfileLoaded";
+ case 0x0077: return "CredReadA";
+ case 0x0078: return "CredReadDomainCredentialsA";
+ case 0x0079: return "CredReadDomainCredentialsW";
+ case 0x007a: return "CredReadW";
+ case 0x007b: return "CredRenameA";
+ case 0x007c: return "CredRenameW";
+ case 0x007d: return "CredUnmarshalCredentialA";
+ case 0x007e: return "CredUnmarshalCredentialW";
+ case 0x007f: return "CredWriteA";
+ case 0x0080: return "CredWriteDomainCredentialsA";
+ case 0x0081: return "CredWriteDomainCredentialsW";
+ case 0x0082: return "CredWriteW";
+ case 0x0083: return "CredpConvertCredential";
+ case 0x0084: return "CredpConvertTargetInfo";
+ case 0x0085: return "CredpDecodeCredential";
+ case 0x0086: return "CredpEncodeCredential";
+ case 0x0087: return "CryptAcquireContextA";
+ case 0x0088: return "CryptAcquireContextW";
+ case 0x0089: return "CryptContextAddRef";
+ case 0x008a: return "CryptCreateHash";
+ case 0x008b: return "CryptDecrypt";
+ case 0x008c: return "CryptDeriveKey";
+ case 0x008d: return "CryptDestroyHash";
+ case 0x008e: return "CryptDestroyKey";
+ case 0x008f: return "CryptDuplicateHash";
+ case 0x0090: return "CryptDuplicateKey";
+ case 0x0091: return "CryptEncrypt";
+ case 0x0092: return "CryptEnumProviderTypesA";
+ case 0x0093: return "CryptEnumProviderTypesW";
+ case 0x0094: return "CryptEnumProvidersA";
+ case 0x0095: return "CryptEnumProvidersW";
+ case 0x0096: return "CryptExportKey";
+ case 0x0097: return "CryptGenKey";
+ case 0x0098: return "CryptGenRandom";
+ case 0x0099: return "CryptGetDefaultProviderA";
+ case 0x009a: return "CryptGetDefaultProviderW";
+ case 0x009b: return "CryptGetHashParam";
+ case 0x009c: return "CryptGetKeyParam";
+ case 0x009d: return "CryptGetProvParam";
+ case 0x009e: return "CryptGetUserKey";
+ case 0x009f: return "CryptHashData";
+ case 0x00a0: return "CryptHashSessionKey";
+ case 0x00a1: return "CryptImportKey";
+ case 0x00a2: return "CryptReleaseContext";
+ case 0x00a3: return "CryptSetHashParam";
+ case 0x00a4: return "CryptSetKeyParam";
+ case 0x00a5: return "CryptSetProvParam";
+ case 0x00a6: return "CryptSetProviderA";
+ case 0x00a7: return "CryptSetProviderExA";
+ case 0x00a8: return "CryptSetProviderExW";
+ case 0x00a9: return "CryptSetProviderW";
+ case 0x00aa: return "CryptSignHashA";
+ case 0x00ab: return "CryptSignHashW";
+ case 0x00ac: return "CryptVerifySignatureA";
+ case 0x00ad: return "CryptVerifySignatureW";
+ case 0x00ae: return "DecryptFileA";
+ case 0x00af: return "DecryptFileW";
+ case 0x00b0: return "DeleteAce";
+ case 0x00b1: return "DeleteService";
+ case 0x00b2: return "DeregisterEventSource";
+ case 0x00b3: return "DestroyPrivateObjectSecurity";
+ case 0x00b4: return "DuplicateEncryptionInfoFile";
+ case 0x00b5: return "DuplicateToken";
+ case 0x00b6: return "DuplicateTokenEx";
+ case 0x00b7: return "ElfBackupEventLogFileA";
+ case 0x00b8: return "ElfBackupEventLogFileW";
+ case 0x00b9: return "ElfChangeNotify";
+ case 0x00ba: return "ElfClearEventLogFileA";
+ case 0x00bb: return "ElfClearEventLogFileW";
+ case 0x00bc: return "ElfCloseEventLog";
+ case 0x00bd: return "ElfDeregisterEventSource";
+ case 0x00be: return "ElfFlushEventLog";
+ case 0x00bf: return "ElfNumberOfRecords";
+ case 0x00c0: return "ElfOldestRecord";
+ case 0x00c1: return "ElfOpenBackupEventLogA";
+ case 0x00c2: return "ElfOpenBackupEventLogW";
+ case 0x00c3: return "ElfOpenEventLogA";
+ case 0x00c4: return "ElfOpenEventLogW";
+ case 0x00c5: return "ElfReadEventLogA";
+ case 0x00c6: return "ElfReadEventLogW";
+ case 0x00c7: return "ElfRegisterEventSourceA";
+ case 0x00c8: return "ElfRegisterEventSourceW";
+ case 0x00c9: return "ElfReportEventA";
+ case 0x00ca: return "ElfReportEventW";
+ case 0x00cb: return "EnableTrace";
+ case 0x00cc: return "EncryptFileA";
+ case 0x00cd: return "EncryptFileW";
+ case 0x00ce: return "EncryptedFileKeyInfo";
+ case 0x00cf: return "EncryptionDisable";
+ case 0x00d0: return "EnumDependentServicesA";
+ case 0x00d1: return "EnumDependentServicesW";
+ case 0x00d2: return "EnumServiceGroupW";
+ case 0x00d3: return "EnumServicesStatusA";
+ case 0x00d4: return "EnumServicesStatusExA";
+ case 0x00d5: return "EnumServicesStatusExW";
+ case 0x00d6: return "EnumServicesStatusW";
+ case 0x00d7: return "EnumerateTraceGuids";
+ case 0x00d8: return "EqualDomainSid";
+ case 0x00d9: return "EqualPrefixSid";
+ case 0x00da: return "EqualSid";
+ case 0x00db: return "FileEncryptionStatusA";
+ case 0x00dc: return "FileEncryptionStatusW";
+ case 0x00dd: return "FindFirstFreeAce";
+ case 0x00de: return "FlushTraceA";
+ case 0x00df: return "FlushTraceW";
+ case 0x00e0: return "FreeEncryptedFileKeyInfo";
+ case 0x00e1: return "FreeEncryptionCertificateHashList";
+ case 0x00e2: return "FreeInheritedFromArray";
+ case 0x00e3: return "FreeSid";
+ case 0x00e4: return "GetAccessPermissionsForObjectA";
+ case 0x00e5: return "GetAccessPermissionsForObjectW";
+ case 0x00e6: return "GetAce";
+ case 0x00e7: return "GetAclInformation";
+ case 0x00e8: return "GetAuditedPermissionsFromAclA";
+ case 0x00e9: return "GetAuditedPermissionsFromAclW";
+ case 0x00ea: return "GetCurrentHwProfileA";
+ case 0x00eb: return "GetCurrentHwProfileW";
+ case 0x00ec: return "GetEffectiveRightsFromAclA";
+ case 0x00ed: return "GetEffectiveRightsFromAclW";
+ case 0x00ee: return "GetEventLogInformation";
+ case 0x00ef: return "GetExplicitEntriesFromAclA";
+ case 0x00f0: return "GetExplicitEntriesFromAclW";
+ case 0x00f1: return "GetFileSecurityA";
+ case 0x00f2: return "GetFileSecurityW";
+ case 0x00f3: return "GetInformationCodeAuthzLevelW";
+ case 0x00f4: return "GetInformationCodeAuthzPolicyW";
+ case 0x00f5: return "GetInheritanceSourceA";
+ case 0x00f6: return "GetInheritanceSourceW";
+ case 0x00f7: return "GetKernelObjectSecurity";
+ case 0x00f8: return "GetLengthSid";
+ case 0x00f9: return "GetLocalManagedApplicationData";
+ case 0x00fa: return "GetLocalManagedApplications";
+ case 0x00fb: return "GetManagedApplicationCategories";
+ case 0x00fc: return "GetManagedApplications";
+ case 0x00fd: return "GetMultipleTrusteeA";
+ case 0x00fe: return "GetMultipleTrusteeOperationA";
+ case 0x00ff: return "GetMultipleTrusteeOperationW";
+ case 0x0100: return "GetMultipleTrusteeW";
+ case 0x0101: return "GetNamedSecurityInfoA";
+ case 0x0102: return "GetNamedSecurityInfoExA";
+ case 0x0103: return "GetNamedSecurityInfoExW";
+ case 0x0104: return "GetNamedSecurityInfoW";
+ case 0x0105: return "GetNumberOfEventLogRecords";
+ case 0x0106: return "GetOldestEventLogRecord";
+ case 0x0107: return "GetOverlappedAccessResults";
+ case 0x0108: return "GetPrivateObjectSecurity";
+ case 0x0109: return "GetSecurityDescriptorControl";
+ case 0x010a: return "GetSecurityDescriptorDacl";
+ case 0x010b: return "GetSecurityDescriptorGroup";
+ case 0x010c: return "GetSecurityDescriptorLength";
+ case 0x010d: return "GetSecurityDescriptorOwner";
+ case 0x010e: return "GetSecurityDescriptorRMControl";
+ case 0x010f: return "GetSecurityDescriptorSacl";
+ case 0x0110: return "GetSecurityInfo";
+ case 0x0111: return "GetSecurityInfoExA";
+ case 0x0112: return "GetSecurityInfoExW";
+ case 0x0113: return "GetServiceDisplayNameA";
+ case 0x0114: return "GetServiceDisplayNameW";
+ case 0x0115: return "GetServiceKeyNameA";
+ case 0x0116: return "GetServiceKeyNameW";
+ case 0x0117: return "GetSidIdentifierAuthority";
+ case 0x0118: return "GetSidLengthRequired";
+ case 0x0119: return "GetSidSubAuthority";
+ case 0x011a: return "GetSidSubAuthorityCount";
+ case 0x011b: return "GetTokenInformation";
+ case 0x011c: return "GetTraceEnableFlags";
+ case 0x011d: return "GetTraceEnableLevel";
+ case 0x011e: return "GetTraceLoggerHandle";
+ case 0x011f: return "GetTrusteeFormA";
+ case 0x0120: return "GetTrusteeFormW";
+ case 0x0121: return "GetTrusteeNameA";
+ case 0x0122: return "GetTrusteeNameW";
+ case 0x0123: return "GetTrusteeTypeA";
+ case 0x0124: return "GetTrusteeTypeW";
+ case 0x0125: return "GetUserNameA";
+ case 0x0126: return "GetUserNameW";
+ case 0x0127: return "GetWindowsAccountDomainSid";
+ case 0x0001: return "I_ScGetCurrentGroupStateW";
+ case 0x0128: return "I_ScIsSecurityProcess";
+ case 0x0129: return "I_ScPnPGetServiceName";
+ case 0x012a: return "I_ScSendTSMessage";
+ case 0x012b: return "I_ScSetServiceBitsA";
+ case 0x012c: return "I_ScSetServiceBitsW";
+ case 0x012d: return "IdentifyCodeAuthzLevelW";
+ case 0x012e: return "ImpersonateAnonymousToken";
+ case 0x012f: return "ImpersonateLoggedOnUser";
+ case 0x0130: return "ImpersonateNamedPipeClient";
+ case 0x0131: return "ImpersonateSelf";
+ case 0x0132: return "InitializeAcl";
+ case 0x0133: return "InitializeSecurityDescriptor";
+ case 0x0134: return "InitializeSid";
+ case 0x0135: return "InitiateSystemShutdownA";
+ case 0x0136: return "InitiateSystemShutdownExA";
+ case 0x0137: return "InitiateSystemShutdownExW";
+ case 0x0138: return "InitiateSystemShutdownW";
+ case 0x0139: return "InstallApplication";
+ case 0x013a: return "IsTextUnicode";
+ case 0x013b: return "IsTokenRestricted";
+ case 0x013c: return "IsTokenUntrusted";
+ case 0x013d: return "IsValidAcl";
+ case 0x013e: return "IsValidSecurityDescriptor";
+ case 0x013f: return "IsValidSid";
+ case 0x0140: return "IsWellKnownSid";
+ case 0x0141: return "LockServiceDatabase";
+ case 0x0142: return "LogonUserA";
+ case 0x0143: return "LogonUserExA";
+ case 0x0144: return "LogonUserExW";
+ case 0x0145: return "LogonUserW";
+ case 0x0146: return "LookupAccountNameA";
+ case 0x0147: return "LookupAccountNameW";
+ case 0x0148: return "LookupAccountSidA";
+ case 0x0149: return "LookupAccountSidW";
+ case 0x014a: return "LookupPrivilegeDisplayNameA";
+ case 0x014b: return "LookupPrivilegeDisplayNameW";
+ case 0x014c: return "LookupPrivilegeNameA";
+ case 0x014d: return "LookupPrivilegeNameW";
+ case 0x014e: return "LookupPrivilegeValueA";
+ case 0x014f: return "LookupPrivilegeValueW";
+ case 0x0150: return "LookupSecurityDescriptorPartsA";
+ case 0x0151: return "LookupSecurityDescriptorPartsW";
+ case 0x0152: return "LsaAddAccountRights";
+ case 0x0153: return "LsaAddPrivilegesToAccount";
+ case 0x0154: return "LsaClearAuditLog";
+ case 0x0155: return "LsaClose";
+ case 0x0156: return "LsaCreateAccount";
+ case 0x0157: return "LsaCreateSecret";
+ case 0x0158: return "LsaCreateTrustedDomain";
+ case 0x0159: return "LsaCreateTrustedDomainEx";
+ case 0x015a: return "LsaDelete";
+ case 0x015b: return "LsaDeleteTrustedDomain";
+ case 0x015c: return "LsaEnumerateAccountRights";
+ case 0x015d: return "LsaEnumerateAccounts";
+ case 0x015e: return "LsaEnumerateAccountsWithUserRight";
+ case 0x015f: return "LsaEnumeratePrivileges";
+ case 0x0160: return "LsaEnumeratePrivilegesOfAccount";
+ case 0x0161: return "LsaEnumerateTrustedDomains";
+ case 0x0162: return "LsaEnumerateTrustedDomainsEx";
+ case 0x0163: return "LsaFreeMemory";
+ case 0x0164: return "LsaGetQuotasForAccount";
+ case 0x0165: return "LsaGetRemoteUserName";
+ case 0x0166: return "LsaGetSystemAccessAccount";
+ case 0x0167: return "LsaGetUserName";
+ case 0x0168: return "LsaICLookupNames";
+ case 0x0169: return "LsaICLookupNamesWithCreds";
+ case 0x016a: return "LsaICLookupSids";
+ case 0x016b: return "LsaICLookupSidsWithCreds";
+ case 0x016d: return "LsaLookupNames";
+ case 0x016c: return "LsaLookupNames2";
+ case 0x016e: return "LsaLookupPrivilegeDisplayName";
+ case 0x016f: return "LsaLookupPrivilegeName";
+ case 0x0170: return "LsaLookupPrivilegeValue";
+ case 0x0171: return "LsaLookupSids";
+ case 0x0172: return "LsaNtStatusToWinError";
+ case 0x0173: return "LsaOpenAccount";
+ case 0x0174: return "LsaOpenPolicy";
+ case 0x0175: return "LsaOpenPolicySce";
+ case 0x0176: return "LsaOpenSecret";
+ case 0x0177: return "LsaOpenTrustedDomain";
+ case 0x0178: return "LsaOpenTrustedDomainByName";
+ case 0x0179: return "LsaQueryDomainInformationPolicy";
+ case 0x017a: return "LsaQueryForestTrustInformation";
+ case 0x017b: return "LsaQueryInfoTrustedDomain";
+ case 0x017c: return "LsaQueryInformationPolicy";
+ case 0x017d: return "LsaQuerySecret";
+ case 0x017e: return "LsaQuerySecurityObject";
+ case 0x017f: return "LsaQueryTrustedDomainInfo";
+ case 0x0180: return "LsaQueryTrustedDomainInfoByName";
+ case 0x0181: return "LsaRemoveAccountRights";
+ case 0x0182: return "LsaRemovePrivilegesFromAccount";
+ case 0x0183: return "LsaRetrievePrivateData";
+ case 0x0184: return "LsaSetDomainInformationPolicy";
+ case 0x0185: return "LsaSetForestTrustInformation";
+ case 0x0186: return "LsaSetInformationPolicy";
+ case 0x0187: return "LsaSetInformationTrustedDomain";
+ case 0x0188: return "LsaSetQuotasForAccount";
+ case 0x0189: return "LsaSetSecret";
+ case 0x018a: return "LsaSetSecurityObject";
+ case 0x018b: return "LsaSetSystemAccessAccount";
+ case 0x018c: return "LsaSetTrustedDomainInfoByName";
+ case 0x018d: return "LsaSetTrustedDomainInformation";
+ case 0x018e: return "LsaStorePrivateData";
+ case 0x018f: return "MD4Final";
+ case 0x0190: return "MD4Init";
+ case 0x0191: return "MD4Update";
+ case 0x0192: return "MD5Final";
+ case 0x0193: return "MD5Init";
+ case 0x0194: return "MD5Update";
+ case 0x0196: return "MSChapSrvChangePassword";
+ case 0x0195: return "MSChapSrvChangePassword2";
+ case 0x0198: return "MakeAbsoluteSD";
+ case 0x0197: return "MakeAbsoluteSD2";
+ case 0x0199: return "MakeSelfRelativeSD";
+ case 0x019a: return "MapGenericMask";
+ case 0x019b: return "NotifyBootConfigStatus";
+ case 0x019c: return "NotifyChangeEventLog";
+ case 0x019d: return "ObjectCloseAuditAlarmA";
+ case 0x019e: return "ObjectCloseAuditAlarmW";
+ case 0x019f: return "ObjectDeleteAuditAlarmA";
+ case 0x01a0: return "ObjectDeleteAuditAlarmW";
+ case 0x01a1: return "ObjectOpenAuditAlarmA";
+ case 0x01a2: return "ObjectOpenAuditAlarmW";
+ case 0x01a3: return "ObjectPrivilegeAuditAlarmA";
+ case 0x01a4: return "ObjectPrivilegeAuditAlarmW";
+ case 0x01a5: return "OpenBackupEventLogA";
+ case 0x01a6: return "OpenBackupEventLogW";
+ case 0x01a7: return "OpenEncryptedFileRawA";
+ case 0x01a8: return "OpenEncryptedFileRawW";
+ case 0x01a9: return "OpenEventLogA";
+ case 0x01aa: return "OpenEventLogW";
+ case 0x01ab: return "OpenProcessToken";
+ case 0x01ac: return "OpenSCManagerA";
+ case 0x01ad: return "OpenSCManagerW";
+ case 0x01ae: return "OpenServiceA";
+ case 0x01af: return "OpenServiceW";
+ case 0x01b0: return "OpenThreadToken";
+ case 0x01b1: return "OpenTraceA";
+ case 0x01b2: return "OpenTraceW";
+ case 0x01b3: return "PrivilegeCheck";
+ case 0x01b4: return "PrivilegedServiceAuditAlarmA";
+ case 0x01b5: return "PrivilegedServiceAuditAlarmW";
+ case 0x01b6: return "ProcessIdleTasks";
+ case 0x01b7: return "ProcessTrace";
+ case 0x01b8: return "QueryAllTracesA";
+ case 0x01b9: return "QueryAllTracesW";
+ case 0x01ba: return "QueryRecoveryAgentsOnEncryptedFile";
+ case 0x01bb: return "QueryServiceConfig2A";
+ case 0x01bc: return "QueryServiceConfig2W";
+ case 0x01bd: return "QueryServiceConfigA";
+ case 0x01be: return "QueryServiceConfigW";
+ case 0x01bf: return "QueryServiceLockStatusA";
+ case 0x01c0: return "QueryServiceLockStatusW";
+ case 0x01c1: return "QueryServiceObjectSecurity";
+ case 0x01c2: return "QueryServiceStatus";
+ case 0x01c3: return "QueryServiceStatusEx";
+ case 0x01c4: return "QueryTraceA";
+ case 0x01c5: return "QueryTraceW";
+ case 0x01c6: return "QueryUsersOnEncryptedFile";
+ case 0x01c7: return "QueryWindows31FilesMigration";
+ case 0x01c8: return "ReadEncryptedFileRaw";
+ case 0x01c9: return "ReadEventLogA";
+ case 0x01ca: return "ReadEventLogW";
+ case 0x01cb: return "RegCloseKey";
+ case 0x01cc: return "RegConnectRegistryA";
+ case 0x01cd: return "RegConnectRegistryW";
+ case 0x01ce: return "RegCreateKeyA";
+ case 0x01cf: return "RegCreateKeyExA";
+ case 0x01d0: return "RegCreateKeyExW";
+ case 0x01d1: return "RegCreateKeyW";
+ case 0x01d2: return "RegDeleteKeyA";
+ case 0x01d3: return "RegDeleteKeyW";
+ case 0x01d4: return "RegDeleteValueA";
+ case 0x01d5: return "RegDeleteValueW";
+ case 0x01d6: return "RegDisablePredefinedCache";
+ case 0x01d7: return "RegEnumKeyA";
+ case 0x01d8: return "RegEnumKeyExA";
+ case 0x01d9: return "RegEnumKeyExW";
+ case 0x01da: return "RegEnumKeyW";
+ case 0x01db: return "RegEnumValueA";
+ case 0x01dc: return "RegEnumValueW";
+ case 0x01dd: return "RegFlushKey";
+ case 0x01de: return "RegGetKeySecurity";
+ case 0x01df: return "RegLoadKeyA";
+ case 0x01e0: return "RegLoadKeyW";
+ case 0x01e1: return "RegNotifyChangeKeyValue";
+ case 0x01e2: return "RegOpenCurrentUser";
+ case 0x01e3: return "RegOpenKeyA";
+ case 0x01e4: return "RegOpenKeyExA";
+ case 0x01e5: return "RegOpenKeyExW";
+ case 0x01e6: return "RegOpenKeyW";
+ case 0x01e7: return "RegOpenUserClassesRoot";
+ case 0x01e8: return "RegOverridePredefKey";
+ case 0x01e9: return "RegQueryInfoKeyA";
+ case 0x01ea: return "RegQueryInfoKeyW";
+ case 0x01eb: return "RegQueryMultipleValuesA";
+ case 0x01ec: return "RegQueryMultipleValuesW";
+ case 0x01ed: return "RegQueryValueA";
+ case 0x01ee: return "RegQueryValueExA";
+ case 0x01ef: return "RegQueryValueExW";
+ case 0x01f0: return "RegQueryValueW";
+ case 0x01f1: return "RegReplaceKeyA";
+ case 0x01f2: return "RegReplaceKeyW";
+ case 0x01f3: return "RegRestoreKeyA";
+ case 0x01f4: return "RegRestoreKeyW";
+ case 0x01f5: return "RegSaveKeyA";
+ case 0x01f6: return "RegSaveKeyExA";
+ case 0x01f7: return "RegSaveKeyExW";
+ case 0x01f8: return "RegSaveKeyW";
+ case 0x01f9: return "RegSetKeySecurity";
+ case 0x01fa: return "RegSetValueA";
+ case 0x01fb: return "RegSetValueExA";
+ case 0x01fc: return "RegSetValueExW";
+ case 0x01fd: return "RegSetValueW";
+ case 0x01fe: return "RegUnLoadKeyA";
+ case 0x01ff: return "RegUnLoadKeyW";
+ case 0x0200: return "RegisterEventSourceA";
+ case 0x0201: return "RegisterEventSourceW";
+ case 0x0202: return "RegisterIdleTask";
+ case 0x0203: return "RegisterServiceCtrlHandlerA";
+ case 0x0204: return "RegisterServiceCtrlHandlerExA";
+ case 0x0205: return "RegisterServiceCtrlHandlerExW";
+ case 0x0206: return "RegisterServiceCtrlHandlerW";
+ case 0x0207: return "RegisterTraceGuidsA";
+ case 0x0208: return "RegisterTraceGuidsW";
+ case 0x0209: return "RemoveTraceCallback";
+ case 0x020a: return "RemoveUsersFromEncryptedFile";
+ case 0x020b: return "ReportEventA";
+ case 0x020c: return "ReportEventW";
+ case 0x020d: return "RevertToSelf";
+ case 0x020e: return "SaferCloseLevel";
+ case 0x020f: return "SaferComputeTokenFromLevel";
+ case 0x0210: return "SaferCreateLevel";
+ case 0x0211: return "SaferGetLevelInformation";
+ case 0x0212: return "SaferGetPolicyInformation";
+ case 0x0213: return "SaferIdentifyLevel";
+ case 0x0214: return "SaferRecordEventLogEntry";
+ case 0x0215: return "SaferSetLevelInformation";
+ case 0x0216: return "SaferSetPolicyInformation";
+ case 0x0217: return "SaferiChangeRegistryScope";
+ case 0x0218: return "SaferiCompareTokenLevels";
+ case 0x0219: return "SaferiIsExecutableFileType";
+ case 0x021a: return "SaferiPopulateDefaultsInRegistry";
+ case 0x021b: return "SaferiRecordEventLogEntry";
+ case 0x021c: return "SaferiReplaceProcessThreadTokens";
+ case 0x021d: return "SaferiSearchMatchingHashRules";
+ case 0x021e: return "SetAclInformation";
+ case 0x021f: return "SetEntriesInAccessListA";
+ case 0x0220: return "SetEntriesInAccessListW";
+ case 0x0221: return "SetEntriesInAclA";
+ case 0x0222: return "SetEntriesInAclW";
+ case 0x0223: return "SetEntriesInAuditListA";
+ case 0x0224: return "SetEntriesInAuditListW";
+ case 0x0225: return "SetFileSecurityA";
+ case 0x0226: return "SetFileSecurityW";
+ case 0x0227: return "SetInformationCodeAuthzLevelW";
+ case 0x0228: return "SetInformationCodeAuthzPolicyW";
+ case 0x0229: return "SetKernelObjectSecurity";
+ case 0x022a: return "SetNamedSecurityInfoA";
+ case 0x022b: return "SetNamedSecurityInfoExA";
+ case 0x022c: return "SetNamedSecurityInfoExW";
+ case 0x022d: return "SetNamedSecurityInfoW";
+ case 0x022e: return "SetPrivateObjectSecurity";
+ case 0x022f: return "SetPrivateObjectSecurityEx";
+ case 0x0230: return "SetSecurityDescriptorControl";
+ case 0x0231: return "SetSecurityDescriptorDacl";
+ case 0x0232: return "SetSecurityDescriptorGroup";
+ case 0x0233: return "SetSecurityDescriptorOwner";
+ case 0x0234: return "SetSecurityDescriptorRMControl";
+ case 0x0235: return "SetSecurityDescriptorSacl";
+ case 0x0236: return "SetSecurityInfo";
+ case 0x0237: return "SetSecurityInfoExA";
+ case 0x0238: return "SetSecurityInfoExW";
+ case 0x0239: return "SetServiceBits";
+ case 0x023a: return "SetServiceObjectSecurity";
+ case 0x023b: return "SetServiceStatus";
+ case 0x023c: return "SetThreadToken";
+ case 0x023d: return "SetTokenInformation";
+ case 0x023e: return "SetTraceCallback";
+ case 0x023f: return "SetUserFileEncryptionKey";
+ case 0x0240: return "StartServiceA";
+ case 0x0241: return "StartServiceCtrlDispatcherA";
+ case 0x0242: return "StartServiceCtrlDispatcherW";
+ case 0x0243: return "StartServiceW";
+ case 0x0244: return "StartTraceA";
+ case 0x0245: return "StartTraceW";
+ case 0x0246: return "StopTraceA";
+ case 0x0247: return "StopTraceW";
+ case 0x0248: return "SynchronizeWindows31FilesAndWindowsNTRegistry";
+ case 0x0249: return "SystemFunction001";
+ case 0x024a: return "SystemFunction002";
+ case 0x024b: return "SystemFunction003";
+ case 0x024c: return "SystemFunction004";
+ case 0x024d: return "SystemFunction005";
+ case 0x024e: return "SystemFunction006";
+ case 0x024f: return "SystemFunction007";
+ case 0x0250: return "SystemFunction008";
+ case 0x0251: return "SystemFunction009";
+ case 0x0252: return "SystemFunction010";
+ case 0x0253: return "SystemFunction011";
+ case 0x0254: return "SystemFunction012";
+ case 0x0255: return "SystemFunction013";
+ case 0x0256: return "SystemFunction014";
+ case 0x0257: return "SystemFunction015";
+ case 0x0258: return "SystemFunction016";
+ case 0x0259: return "SystemFunction017";
+ case 0x025a: return "SystemFunction018";
+ case 0x025b: return "SystemFunction019";
+ case 0x025c: return "SystemFunction020";
+ case 0x025d: return "SystemFunction021";
+ case 0x025e: return "SystemFunction022";
+ case 0x025f: return "SystemFunction023";
+ case 0x0260: return "SystemFunction024";
+ case 0x0261: return "SystemFunction025";
+ case 0x0262: return "SystemFunction026";
+ case 0x0263: return "SystemFunction027";
+ case 0x0264: return "SystemFunction028";
+ case 0x0265: return "SystemFunction029";
+ case 0x0266: return "SystemFunction030";
+ case 0x0267: return "SystemFunction031";
+ case 0x0268: return "SystemFunction032";
+ case 0x0269: return "SystemFunction033";
+ case 0x026a: return "SystemFunction034";
+ case 0x026b: return "SystemFunction035";
+ case 0x026c: return "SystemFunction036";
+ case 0x026d: return "SystemFunction040";
+ case 0x026e: return "SystemFunction041";
+ case 0x026f: return "TraceEvent";
+ case 0x0270: return "TraceEventInstance";
+ case 0x0271: return "TraceMessage";
+ case 0x0272: return "TraceMessageVa";
+ case 0x0273: return "TreeResetNamedSecurityInfoA";
+ case 0x0274: return "TreeResetNamedSecurityInfoW";
+ case 0x0275: return "TrusteeAccessToObjectA";
+ case 0x0276: return "TrusteeAccessToObjectW";
+ case 0x0277: return "UninstallApplication";
+ case 0x0278: return "UnlockServiceDatabase";
+ case 0x0279: return "UnregisterIdleTask";
+ case 0x027a: return "UnregisterTraceGuids";
+ case 0x027b: return "UpdateTraceA";
+ case 0x027c: return "UpdateTraceW";
+ case 0x027d: return "WdmWmiServiceMain";
+ case 0x027e: return "WmiCloseBlock";
+ case 0x027f: return "WmiCloseTraceWithCursor";
+ case 0x0280: return "WmiConvertTimestamp";
+ case 0x0281: return "WmiDevInstToInstanceNameA";
+ case 0x0282: return "WmiDevInstToInstanceNameW";
+ case 0x0283: return "WmiEnumerateGuids";
+ case 0x0284: return "WmiExecuteMethodA";
+ case 0x0285: return "WmiExecuteMethodW";
+ case 0x0286: return "WmiFileHandleToInstanceNameA";
+ case 0x0287: return "WmiFileHandleToInstanceNameW";
+ case 0x0288: return "WmiFreeBuffer";
+ case 0x0289: return "WmiGetFirstTraceOffset";
+ case 0x028a: return "WmiGetNextEvent";
+ case 0x028b: return "WmiGetTraceHeader";
+ case 0x028c: return "WmiMofEnumerateResourcesA";
+ case 0x028d: return "WmiMofEnumerateResourcesW";
+ case 0x028e: return "WmiNotificationRegistrationA";
+ case 0x028f: return "WmiNotificationRegistrationW";
+ case 0x0290: return "WmiOpenBlock";
+ case 0x0291: return "WmiOpenTraceWithCursor";
+ case 0x0292: return "WmiParseTraceEvent";
+ case 0x0293: return "WmiQueryAllDataA";
+ case 0x0294: return "WmiQueryAllDataMultipleA";
+ case 0x0295: return "WmiQueryAllDataMultipleW";
+ case 0x0296: return "WmiQueryAllDataW";
+ case 0x0297: return "WmiQueryGuidInformation";
+ case 0x0298: return "WmiQuerySingleInstanceA";
+ case 0x0299: return "WmiQuerySingleInstanceMultipleA";
+ case 0x029a: return "WmiQuerySingleInstanceMultipleW";
+ case 0x029b: return "WmiQuerySingleInstanceW";
+ case 0x029c: return "WmiReceiveNotificationsA";
+ case 0x029d: return "WmiReceiveNotificationsW";
+ case 0x029e: return "WmiSetSingleInstanceA";
+ case 0x029f: return "WmiSetSingleInstanceW";
+ case 0x02a0: return "WmiSetSingleItemA";
+ case 0x02a1: return "WmiSetSingleItemW";
+ case 0x02a2: return "Wow64Win32ApiEntry";
+ case 0x02a3: return "WriteEncryptedFileRaw";
+ }
+ return nullptr;
+}
}
diff --git a/src/PE/utils/ordinals_lookup_tables/comctl32_dll_lookup.hpp b/src/PE/utils/ordinals_lookup_tables/comctl32_dll_lookup.hpp
index 0c14ba4c..db601e3c 100644
--- a/src/PE/utils/ordinals_lookup_tables/comctl32_dll_lookup.hpp
+++ b/src/PE/utils/ordinals_lookup_tables/comctl32_dll_lookup.hpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -16,161 +16,163 @@
#ifndef LIEF_PE_COMCTL32_DLL_LOOKUP_H_
#define LIEF_PE_COMCTL32_DLL_LOOKUP_H_
-#include <map>
namespace LIEF {
namespace PE {
-static const std::map<uint32_t, const char*> comctl32_dll_lookup {
- { 0x0191, "AddMRUStringW" },
- { 0x00cf, "AttachScrollBars" },
- { 0x00d2, "CCEnableScrollBar" },
- { 0x00d1, "CCGetScrollInfo" },
- { 0x00d0, "CCSetScrollInfo" },
- { 0x0190, "CreateMRUListW" },
- { 0x0008, "CreateMappedBitmap" },
- { 0x000c, "CreatePropertySheetPage" },
- { 0x0013, "CreatePropertySheetPageA" },
- { 0x0014, "CreatePropertySheetPageW" },
- { 0x0015, "CreateStatusWindow" },
- { 0x0006, "CreateStatusWindowA" },
- { 0x0016, "CreateStatusWindowW" },
- { 0x0007, "CreateToolbar" },
- { 0x0017, "CreateToolbarEx" },
- { 0x0010, "CreateUpDownControl" },
- { 0x014b, "DPA_Clone" },
- { 0x0148, "DPA_Create" },
- { 0x0154, "DPA_CreateEx" },
- { 0x0151, "DPA_DeleteAllPtrs" },
- { 0x0150, "DPA_DeletePtr" },
- { 0x0149, "DPA_Destroy" },
- { 0x0182, "DPA_DestroyCallback" },
- { 0x0181, "DPA_EnumCallback" },
- { 0x014c, "DPA_GetPtr" },
- { 0x014d, "DPA_GetPtrIndex" },
- { 0x015b, "DPA_GetSize" },
- { 0x014a, "DPA_Grow" },
- { 0x014e, "DPA_InsertPtr" },
- { 0x0009, "DPA_LoadStream" },
- { 0x000b, "DPA_Merge" },
- { 0x000a, "DPA_SaveStream" },
- { 0x0153, "DPA_Search" },
- { 0x014f, "DPA_SetPtr" },
- { 0x0152, "DPA_Sort" },
- { 0x0157, "DSA_Clone" },
- { 0x0140, "DSA_Create" },
- { 0x0147, "DSA_DeleteAllItems" },
- { 0x0146, "DSA_DeleteItem" },
- { 0x0141, "DSA_Destroy" },
- { 0x0184, "DSA_DestroyCallback" },
- { 0x0183, "DSA_EnumCallback" },
- { 0x0142, "DSA_GetItem" },
- { 0x0143, "DSA_GetItemPtr" },
- { 0x015c, "DSA_GetSize" },
- { 0x0144, "DSA_InsertItem" },
- { 0x0145, "DSA_SetItem" },
- { 0x015a, "DSA_Sort" },
- { 0x019d, "DefSubclassProc" },
- { 0x0018, "DestroyPropertySheetPage" },
- { 0x00ce, "DetachScrollBars" },
- { 0x0019, "DllGetVersion" },
- { 0x001a, "DllInstall" },
- { 0x000f, "DrawInsert" },
- { 0x00c9, "DrawScrollBar" },
- { 0x001b, "DrawShadowText" },
- { 0x00c8, "DrawSizeBox" },
- { 0x001c, "DrawStatusText" },
- { 0x0005, "DrawStatusTextA" },
- { 0x001d, "DrawStatusTextW" },
- { 0x0193, "EnumMRUListW" },
- { 0x001e, "FlatSB_EnableScrollBar" },
- { 0x001f, "FlatSB_GetScrollInfo" },
- { 0x0020, "FlatSB_GetScrollPos" },
- { 0x0021, "FlatSB_GetScrollProp" },
- { 0x0022, "FlatSB_GetScrollPropPtr" },
- { 0x0023, "FlatSB_GetScrollRange" },
- { 0x0024, "FlatSB_SetScrollInfo" },
- { 0x0025, "FlatSB_SetScrollPos" },
- { 0x0026, "FlatSB_SetScrollProp" },
- { 0x0027, "FlatSB_SetScrollRange" },
- { 0x0028, "FlatSB_ShowScrollBar" },
- { 0x0098, "FreeMRUList" },
- { 0x0004, "GetEffectiveClientRect" },
- { 0x0029, "GetMUILanguage" },
- { 0x019b, "GetWindowSubclass" },
- { 0x002a, "HIMAGELIST_QueryInterface" },
- { 0x00cd, "HandleScrollCmd" },
- { 0x002b, "ImageList_Add" },
- { 0x002c, "ImageList_AddIcon" },
- { 0x002d, "ImageList_AddMasked" },
- { 0x002e, "ImageList_BeginDrag" },
- { 0x002f, "ImageList_CoCreateInstance" },
- { 0x0030, "ImageList_Copy" },
- { 0x0031, "ImageList_Create" },
- { 0x0032, "ImageList_Destroy" },
- { 0x0033, "ImageList_DestroyShared" },
- { 0x0034, "ImageList_DragEnter" },
- { 0x0035, "ImageList_DragLeave" },
- { 0x0036, "ImageList_DragMove" },
- { 0x0037, "ImageList_DragShowNolock" },
- { 0x0038, "ImageList_Draw" },
- { 0x0039, "ImageList_DrawEx" },
- { 0x003a, "ImageList_DrawIndirect" },
- { 0x003b, "ImageList_Duplicate" },
- { 0x003c, "ImageList_EndDrag" },
- { 0x003d, "ImageList_GetBkColor" },
- { 0x003e, "ImageList_GetDragImage" },
- { 0x003f, "ImageList_GetFlags" },
- { 0x0040, "ImageList_GetIcon" },
- { 0x0041, "ImageList_GetIconSize" },
- { 0x0042, "ImageList_GetImageCount" },
- { 0x0043, "ImageList_GetImageInfo" },
- { 0x0044, "ImageList_GetImageRect" },
- { 0x0045, "ImageList_LoadImage" },
- { 0x0046, "ImageList_LoadImageA" },
- { 0x004b, "ImageList_LoadImageW" },
- { 0x004c, "ImageList_Merge" },
- { 0x004d, "ImageList_Read" },
- { 0x004e, "ImageList_ReadEx" },
- { 0x004f, "ImageList_Remove" },
- { 0x0050, "ImageList_Replace" },
- { 0x0051, "ImageList_ReplaceIcon" },
- { 0x0052, "ImageList_Resize" },
- { 0x0053, "ImageList_SetBkColor" },
- { 0x0054, "ImageList_SetDragCursorImage" },
- { 0x0055, "ImageList_SetFilter" },
- { 0x0056, "ImageList_SetFlags" },
- { 0x0057, "ImageList_SetIconSize" },
- { 0x0058, "ImageList_SetImageCount" },
- { 0x0059, "ImageList_SetOverlayImage" },
- { 0x005a, "ImageList_Write" },
- { 0x005b, "ImageList_WriteEx" },
- { 0x0011, "InitCommonControls" },
- { 0x005c, "InitCommonControlsEx" },
- { 0x005d, "InitMUILanguage" },
- { 0x005e, "InitializeFlatSB" },
- { 0x000e, "LBItemFromPt" },
- { 0x017c, "LoadIconMetric" },
- { 0x017d, "LoadIconWithScaleDown" },
- { 0x000d, "MakeDragList" },
- { 0x0002, "MenuHelp" },
- { 0x005f, "PropertySheet" },
- { 0x0060, "PropertySheetA" },
- { 0x0061, "PropertySheetW" },
- { 0x018a, "QuerySystemGestureStatus" },
- { 0x0062, "RegisterClassNameW" },
- { 0x019c, "RemoveWindowSubclass" },
- { 0x00cc, "ScrollBar_Menu" },
- { 0x00cb, "ScrollBar_MouseMove" },
- { 0x019a, "SetWindowSubclass" },
- { 0x0003, "ShowHideMenuCtl" },
- { 0x00ca, "SizeBoxHwnd" },
- { 0x00ec, "Str_SetPtrW" },
- { 0x0158, "TaskDialog" },
- { 0x0159, "TaskDialogIndirect" },
- { 0x0063, "UninitializeFlatSB" },
- { 0x0064, "_TrackMouseEvent" },
-};
+const char* comctl32_dll_lookup(uint32_t i) {
+ switch(i) {
+ case 0x0191: return "AddMRUStringW";
+ case 0x00cf: return "AttachScrollBars";
+ case 0x00d2: return "CCEnableScrollBar";
+ case 0x00d1: return "CCGetScrollInfo";
+ case 0x00d0: return "CCSetScrollInfo";
+ case 0x0190: return "CreateMRUListW";
+ case 0x0008: return "CreateMappedBitmap";
+ case 0x000c: return "CreatePropertySheetPage";
+ case 0x0013: return "CreatePropertySheetPageA";
+ case 0x0014: return "CreatePropertySheetPageW";
+ case 0x0015: return "CreateStatusWindow";
+ case 0x0006: return "CreateStatusWindowA";
+ case 0x0016: return "CreateStatusWindowW";
+ case 0x0007: return "CreateToolbar";
+ case 0x0017: return "CreateToolbarEx";
+ case 0x0010: return "CreateUpDownControl";
+ case 0x014b: return "DPA_Clone";
+ case 0x0148: return "DPA_Create";
+ case 0x0154: return "DPA_CreateEx";
+ case 0x0151: return "DPA_DeleteAllPtrs";
+ case 0x0150: return "DPA_DeletePtr";
+ case 0x0149: return "DPA_Destroy";
+ case 0x0182: return "DPA_DestroyCallback";
+ case 0x0181: return "DPA_EnumCallback";
+ case 0x014c: return "DPA_GetPtr";
+ case 0x014d: return "DPA_GetPtrIndex";
+ case 0x015b: return "DPA_GetSize";
+ case 0x014a: return "DPA_Grow";
+ case 0x014e: return "DPA_InsertPtr";
+ case 0x0009: return "DPA_LoadStream";
+ case 0x000b: return "DPA_Merge";
+ case 0x000a: return "DPA_SaveStream";
+ case 0x0153: return "DPA_Search";
+ case 0x014f: return "DPA_SetPtr";
+ case 0x0152: return "DPA_Sort";
+ case 0x0157: return "DSA_Clone";
+ case 0x0140: return "DSA_Create";
+ case 0x0147: return "DSA_DeleteAllItems";
+ case 0x0146: return "DSA_DeleteItem";
+ case 0x0141: return "DSA_Destroy";
+ case 0x0184: return "DSA_DestroyCallback";
+ case 0x0183: return "DSA_EnumCallback";
+ case 0x0142: return "DSA_GetItem";
+ case 0x0143: return "DSA_GetItemPtr";
+ case 0x015c: return "DSA_GetSize";
+ case 0x0144: return "DSA_InsertItem";
+ case 0x0145: return "DSA_SetItem";
+ case 0x015a: return "DSA_Sort";
+ case 0x019d: return "DefSubclassProc";
+ case 0x0018: return "DestroyPropertySheetPage";
+ case 0x00ce: return "DetachScrollBars";
+ case 0x0019: return "DllGetVersion";
+ case 0x001a: return "DllInstall";
+ case 0x000f: return "DrawInsert";
+ case 0x00c9: return "DrawScrollBar";
+ case 0x001b: return "DrawShadowText";
+ case 0x00c8: return "DrawSizeBox";
+ case 0x001c: return "DrawStatusText";
+ case 0x0005: return "DrawStatusTextA";
+ case 0x001d: return "DrawStatusTextW";
+ case 0x0193: return "EnumMRUListW";
+ case 0x001e: return "FlatSB_EnableScrollBar";
+ case 0x001f: return "FlatSB_GetScrollInfo";
+ case 0x0020: return "FlatSB_GetScrollPos";
+ case 0x0021: return "FlatSB_GetScrollProp";
+ case 0x0022: return "FlatSB_GetScrollPropPtr";
+ case 0x0023: return "FlatSB_GetScrollRange";
+ case 0x0024: return "FlatSB_SetScrollInfo";
+ case 0x0025: return "FlatSB_SetScrollPos";
+ case 0x0026: return "FlatSB_SetScrollProp";
+ case 0x0027: return "FlatSB_SetScrollRange";
+ case 0x0028: return "FlatSB_ShowScrollBar";
+ case 0x0098: return "FreeMRUList";
+ case 0x0004: return "GetEffectiveClientRect";
+ case 0x0029: return "GetMUILanguage";
+ case 0x019b: return "GetWindowSubclass";
+ case 0x002a: return "HIMAGELIST_QueryInterface";
+ case 0x00cd: return "HandleScrollCmd";
+ case 0x002b: return "ImageList_Add";
+ case 0x002c: return "ImageList_AddIcon";
+ case 0x002d: return "ImageList_AddMasked";
+ case 0x002e: return "ImageList_BeginDrag";
+ case 0x002f: return "ImageList_CoCreateInstance";
+ case 0x0030: return "ImageList_Copy";
+ case 0x0031: return "ImageList_Create";
+ case 0x0032: return "ImageList_Destroy";
+ case 0x0033: return "ImageList_DestroyShared";
+ case 0x0034: return "ImageList_DragEnter";
+ case 0x0035: return "ImageList_DragLeave";
+ case 0x0036: return "ImageList_DragMove";
+ case 0x0037: return "ImageList_DragShowNolock";
+ case 0x0038: return "ImageList_Draw";
+ case 0x0039: return "ImageList_DrawEx";
+ case 0x003a: return "ImageList_DrawIndirect";
+ case 0x003b: return "ImageList_Duplicate";
+ case 0x003c: return "ImageList_EndDrag";
+ case 0x003d: return "ImageList_GetBkColor";
+ case 0x003e: return "ImageList_GetDragImage";
+ case 0x003f: return "ImageList_GetFlags";
+ case 0x0040: return "ImageList_GetIcon";
+ case 0x0041: return "ImageList_GetIconSize";
+ case 0x0042: return "ImageList_GetImageCount";
+ case 0x0043: return "ImageList_GetImageInfo";
+ case 0x0044: return "ImageList_GetImageRect";
+ case 0x0045: return "ImageList_LoadImage";
+ case 0x0046: return "ImageList_LoadImageA";
+ case 0x004b: return "ImageList_LoadImageW";
+ case 0x004c: return "ImageList_Merge";
+ case 0x004d: return "ImageList_Read";
+ case 0x004e: return "ImageList_ReadEx";
+ case 0x004f: return "ImageList_Remove";
+ case 0x0050: return "ImageList_Replace";
+ case 0x0051: return "ImageList_ReplaceIcon";
+ case 0x0052: return "ImageList_Resize";
+ case 0x0053: return "ImageList_SetBkColor";
+ case 0x0054: return "ImageList_SetDragCursorImage";
+ case 0x0055: return "ImageList_SetFilter";
+ case 0x0056: return "ImageList_SetFlags";
+ case 0x0057: return "ImageList_SetIconSize";
+ case 0x0058: return "ImageList_SetImageCount";
+ case 0x0059: return "ImageList_SetOverlayImage";
+ case 0x005a: return "ImageList_Write";
+ case 0x005b: return "ImageList_WriteEx";
+ case 0x0011: return "InitCommonControls";
+ case 0x005c: return "InitCommonControlsEx";
+ case 0x005d: return "InitMUILanguage";
+ case 0x005e: return "InitializeFlatSB";
+ case 0x000e: return "LBItemFromPt";
+ case 0x017c: return "LoadIconMetric";
+ case 0x017d: return "LoadIconWithScaleDown";
+ case 0x000d: return "MakeDragList";
+ case 0x0002: return "MenuHelp";
+ case 0x005f: return "PropertySheet";
+ case 0x0060: return "PropertySheetA";
+ case 0x0061: return "PropertySheetW";
+ case 0x018a: return "QuerySystemGestureStatus";
+ case 0x0062: return "RegisterClassNameW";
+ case 0x019c: return "RemoveWindowSubclass";
+ case 0x00cc: return "ScrollBar_Menu";
+ case 0x00cb: return "ScrollBar_MouseMove";
+ case 0x019a: return "SetWindowSubclass";
+ case 0x0003: return "ShowHideMenuCtl";
+ case 0x00ca: return "SizeBoxHwnd";
+ case 0x00ec: return "Str_SetPtrW";
+ case 0x0158: return "TaskDialog";
+ case 0x0159: return "TaskDialogIndirect";
+ case 0x0063: return "UninitializeFlatSB";
+ case 0x0064: return "_TrackMouseEvent";
+ }
+ return nullptr;
+}
}
diff --git a/src/PE/utils/ordinals_lookup_tables/gdi32_dll_lookup.hpp b/src/PE/utils/ordinals_lookup_tables/gdi32_dll_lookup.hpp
index 0d0a159b..9424dcaf 100644
--- a/src/PE/utils/ordinals_lookup_tables/gdi32_dll_lookup.hpp
+++ b/src/PE/utils/ordinals_lookup_tables/gdi32_dll_lookup.hpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -16,622 +16,624 @@
#ifndef LIEF_PE_GDI32_DLL_LOOKUP_H_
#define LIEF_PE_GDI32_DLL_LOOKUP_H_
-#include <map>
namespace LIEF {
namespace PE {
-static const std::map<uint32_t, const char*> gdi32_dll_lookup {
- { 0x0001, "AbortDoc" },
- { 0x0002, "AbortPath" },
- { 0x0003, "AddFontMemResourceEx" },
- { 0x0004, "AddFontResourceA" },
- { 0x0005, "AddFontResourceExA" },
- { 0x0006, "AddFontResourceExW" },
- { 0x0007, "AddFontResourceTracking" },
- { 0x0008, "AddFontResourceW" },
- { 0x0009, "AngleArc" },
- { 0x000a, "AnimatePalette" },
- { 0x000b, "AnyLinkedFonts" },
- { 0x000c, "Arc" },
- { 0x000d, "ArcTo" },
- { 0x000e, "BRUSHOBJ_hGetColorTransform" },
- { 0x000f, "BRUSHOBJ_pvAllocRbrush" },
- { 0x0010, "BRUSHOBJ_pvGetRbrush" },
- { 0x0011, "BRUSHOBJ_ulGetBrushColor" },
- { 0x0012, "BeginPath" },
- { 0x0013, "BitBlt" },
- { 0x0014, "CLIPOBJ_bEnum" },
- { 0x0015, "CLIPOBJ_cEnumStart" },
- { 0x0016, "CLIPOBJ_ppoGetPath" },
- { 0x0017, "CancelDC" },
- { 0x0018, "CheckColorsInGamut" },
- { 0x0019, "ChoosePixelFormat" },
- { 0x001a, "Chord" },
- { 0x001b, "ClearBitmapAttributes" },
- { 0x001c, "ClearBrushAttributes" },
- { 0x001d, "CloseEnhMetaFile" },
- { 0x001e, "CloseFigure" },
- { 0x001f, "CloseMetaFile" },
- { 0x0020, "ColorCorrectPalette" },
- { 0x0021, "ColorMatchToTarget" },
- { 0x0022, "CombineRgn" },
- { 0x0023, "CombineTransform" },
- { 0x0024, "CopyEnhMetaFileA" },
- { 0x0025, "CopyEnhMetaFileW" },
- { 0x0026, "CopyMetaFileA" },
- { 0x0027, "CopyMetaFileW" },
- { 0x0028, "CreateBitmap" },
- { 0x0029, "CreateBitmapIndirect" },
- { 0x002a, "CreateBrushIndirect" },
- { 0x002b, "CreateColorSpaceA" },
- { 0x002c, "CreateColorSpaceW" },
- { 0x002d, "CreateCompatibleBitmap" },
- { 0x002e, "CreateCompatibleDC" },
- { 0x002f, "CreateDCA" },
- { 0x0030, "CreateDCW" },
- { 0x0031, "CreateDIBPatternBrush" },
- { 0x0032, "CreateDIBPatternBrushPt" },
- { 0x0033, "CreateDIBSection" },
- { 0x0034, "CreateDIBitmap" },
- { 0x0035, "CreateDiscardableBitmap" },
- { 0x0036, "CreateEllipticRgn" },
- { 0x0037, "CreateEllipticRgnIndirect" },
- { 0x0038, "CreateEnhMetaFileA" },
- { 0x0039, "CreateEnhMetaFileW" },
- { 0x003a, "CreateFontA" },
- { 0x003b, "CreateFontIndirectA" },
- { 0x003c, "CreateFontIndirectExA" },
- { 0x003d, "CreateFontIndirectExW" },
- { 0x003e, "CreateFontIndirectW" },
- { 0x003f, "CreateFontW" },
- { 0x0040, "CreateHalftonePalette" },
- { 0x0041, "CreateHatchBrush" },
- { 0x0042, "CreateICA" },
- { 0x0043, "CreateICW" },
- { 0x0044, "CreateMetaFileA" },
- { 0x0045, "CreateMetaFileW" },
- { 0x0046, "CreatePalette" },
- { 0x0047, "CreatePatternBrush" },
- { 0x0048, "CreatePen" },
- { 0x0049, "CreatePenIndirect" },
- { 0x004a, "CreatePolyPolygonRgn" },
- { 0x004b, "CreatePolygonRgn" },
- { 0x004c, "CreateRectRgn" },
- { 0x004d, "CreateRectRgnIndirect" },
- { 0x004e, "CreateRoundRectRgn" },
- { 0x004f, "CreateScalableFontResourceA" },
- { 0x0050, "CreateScalableFontResourceW" },
- { 0x0051, "CreateSolidBrush" },
- { 0x0052, "DPtoLP" },
- { 0x0053, "DdEntry0" },
- { 0x005e, "DdEntry1" },
- { 0x0054, "DdEntry10" },
- { 0x0055, "DdEntry11" },
- { 0x0056, "DdEntry12" },
- { 0x0057, "DdEntry13" },
- { 0x0058, "DdEntry14" },
- { 0x0059, "DdEntry15" },
- { 0x005a, "DdEntry16" },
- { 0x005b, "DdEntry17" },
- { 0x005c, "DdEntry18" },
- { 0x005d, "DdEntry19" },
- { 0x0069, "DdEntry2" },
- { 0x005f, "DdEntry20" },
- { 0x0060, "DdEntry21" },
- { 0x0061, "DdEntry22" },
- { 0x0062, "DdEntry23" },
- { 0x0063, "DdEntry24" },
- { 0x0064, "DdEntry25" },
- { 0x0065, "DdEntry26" },
- { 0x0066, "DdEntry27" },
- { 0x0067, "DdEntry28" },
- { 0x0068, "DdEntry29" },
- { 0x0074, "DdEntry3" },
- { 0x006a, "DdEntry30" },
- { 0x006b, "DdEntry31" },
- { 0x006c, "DdEntry32" },
- { 0x006d, "DdEntry33" },
- { 0x006e, "DdEntry34" },
- { 0x006f, "DdEntry35" },
- { 0x0070, "DdEntry36" },
- { 0x0071, "DdEntry37" },
- { 0x0072, "DdEntry38" },
- { 0x0073, "DdEntry39" },
- { 0x007f, "DdEntry4" },
- { 0x0075, "DdEntry40" },
- { 0x0076, "DdEntry41" },
- { 0x0077, "DdEntry42" },
- { 0x0078, "DdEntry43" },
- { 0x0079, "DdEntry44" },
- { 0x007a, "DdEntry45" },
- { 0x007b, "DdEntry46" },
- { 0x007c, "DdEntry47" },
- { 0x007d, "DdEntry48" },
- { 0x007e, "DdEntry49" },
- { 0x0087, "DdEntry5" },
- { 0x0080, "DdEntry50" },
- { 0x0081, "DdEntry51" },
- { 0x0082, "DdEntry52" },
- { 0x0083, "DdEntry53" },
- { 0x0084, "DdEntry54" },
- { 0x0085, "DdEntry55" },
- { 0x0086, "DdEntry56" },
- { 0x0088, "DdEntry6" },
- { 0x0089, "DdEntry7" },
- { 0x008a, "DdEntry8" },
- { 0x008b, "DdEntry9" },
- { 0x008c, "DeleteColorSpace" },
- { 0x008d, "DeleteDC" },
- { 0x008e, "DeleteEnhMetaFile" },
- { 0x008f, "DeleteMetaFile" },
- { 0x0090, "DeleteObject" },
- { 0x0091, "DescribePixelFormat" },
- { 0x0092, "DeviceCapabilitiesExA" },
- { 0x0093, "DeviceCapabilitiesExW" },
- { 0x0094, "DrawEscape" },
- { 0x0095, "Ellipse" },
- { 0x0096, "EnableEUDC" },
- { 0x0097, "EndDoc" },
- { 0x0098, "EndFormPage" },
- { 0x0099, "EndPage" },
- { 0x009a, "EndPath" },
- { 0x009b, "EngAcquireSemaphore" },
- { 0x009c, "EngAlphaBlend" },
- { 0x009d, "EngAssociateSurface" },
- { 0x009e, "EngBitBlt" },
- { 0x009f, "EngCheckAbort" },
- { 0x00a0, "EngComputeGlyphSet" },
- { 0x00a1, "EngCopyBits" },
- { 0x00a2, "EngCreateBitmap" },
- { 0x00a3, "EngCreateClip" },
- { 0x00a4, "EngCreateDeviceBitmap" },
- { 0x00a5, "EngCreateDeviceSurface" },
- { 0x00a6, "EngCreatePalette" },
- { 0x00a7, "EngCreateSemaphore" },
- { 0x00a8, "EngDeleteClip" },
- { 0x00a9, "EngDeletePalette" },
- { 0x00aa, "EngDeletePath" },
- { 0x00ab, "EngDeleteSemaphore" },
- { 0x00ac, "EngDeleteSurface" },
- { 0x00ad, "EngEraseSurface" },
- { 0x00ae, "EngFillPath" },
- { 0x00af, "EngFindResource" },
- { 0x00b0, "EngFreeModule" },
- { 0x00b1, "EngGetCurrentCodePage" },
- { 0x00b2, "EngGetDriverName" },
- { 0x00b3, "EngGetPrinterDataFileName" },
- { 0x00b4, "EngGradientFill" },
- { 0x00b5, "EngLineTo" },
- { 0x00b6, "EngLoadModule" },
- { 0x00b7, "EngLockSurface" },
- { 0x00b8, "EngMarkBandingSurface" },
- { 0x00b9, "EngMultiByteToUnicodeN" },
- { 0x00ba, "EngMultiByteToWideChar" },
- { 0x00bb, "EngPaint" },
- { 0x00bc, "EngPlgBlt" },
- { 0x00bd, "EngQueryEMFInfo" },
- { 0x00be, "EngQueryLocalTime" },
- { 0x00bf, "EngReleaseSemaphore" },
- { 0x00c0, "EngStretchBlt" },
- { 0x00c1, "EngStretchBltROP" },
- { 0x00c2, "EngStrokeAndFillPath" },
- { 0x00c3, "EngStrokePath" },
- { 0x00c4, "EngTextOut" },
- { 0x00c5, "EngTransparentBlt" },
- { 0x00c6, "EngUnicodeToMultiByteN" },
- { 0x00c7, "EngUnlockSurface" },
- { 0x00c8, "EngWideCharToMultiByte" },
- { 0x00c9, "EnumEnhMetaFile" },
- { 0x00ca, "EnumFontFamiliesA" },
- { 0x00cb, "EnumFontFamiliesExA" },
- { 0x00cc, "EnumFontFamiliesExW" },
- { 0x00cd, "EnumFontFamiliesW" },
- { 0x00ce, "EnumFontsA" },
- { 0x00cf, "EnumFontsW" },
- { 0x00d0, "EnumICMProfilesA" },
- { 0x00d1, "EnumICMProfilesW" },
- { 0x00d2, "EnumMetaFile" },
- { 0x00d3, "EnumObjects" },
- { 0x00d4, "EqualRgn" },
- { 0x00d5, "Escape" },
- { 0x00d6, "EudcLoadLinkW" },
- { 0x00d7, "EudcUnloadLinkW" },
- { 0x00d8, "ExcludeClipRect" },
- { 0x00d9, "ExtCreatePen" },
- { 0x00da, "ExtCreateRegion" },
- { 0x00db, "ExtEscape" },
- { 0x00dc, "ExtFloodFill" },
- { 0x00dd, "ExtSelectClipRgn" },
- { 0x00de, "ExtTextOutA" },
- { 0x00df, "ExtTextOutW" },
- { 0x00e0, "FONTOBJ_cGetAllGlyphHandles" },
- { 0x00e1, "FONTOBJ_cGetGlyphs" },
- { 0x00e2, "FONTOBJ_pQueryGlyphAttrs" },
- { 0x00e3, "FONTOBJ_pfdg" },
- { 0x00e4, "FONTOBJ_pifi" },
- { 0x00e5, "FONTOBJ_pvTrueTypeFontFile" },
- { 0x00e6, "FONTOBJ_pxoGetXform" },
- { 0x00e7, "FONTOBJ_vGetInfo" },
- { 0x00e8, "FillPath" },
- { 0x00e9, "FillRgn" },
- { 0x00ea, "FixBrushOrgEx" },
- { 0x00eb, "FlattenPath" },
- { 0x00ec, "FloodFill" },
- { 0x00ed, "FontIsLinked" },
- { 0x00ee, "FrameRgn" },
- { 0x00ef, "GdiAddFontResourceW" },
- { 0x00f0, "GdiAddGlsBounds" },
- { 0x00f1, "GdiAddGlsRecord" },
- { 0x00f2, "GdiAlphaBlend" },
- { 0x00f3, "GdiArtificialDecrementDriver" },
- { 0x00f4, "GdiCleanCacheDC" },
- { 0x00f5, "GdiComment" },
- { 0x00f6, "GdiConsoleTextOut" },
- { 0x00f7, "GdiConvertAndCheckDC" },
- { 0x00f8, "GdiConvertBitmap" },
- { 0x00f9, "GdiConvertBitmapV5" },
- { 0x00fa, "GdiConvertBrush" },
- { 0x00fb, "GdiConvertDC" },
- { 0x00fc, "GdiConvertEnhMetaFile" },
- { 0x00fd, "GdiConvertFont" },
- { 0x00fe, "GdiConvertMetaFilePict" },
- { 0x00ff, "GdiConvertPalette" },
- { 0x0100, "GdiConvertRegion" },
- { 0x0101, "GdiConvertToDevmodeW" },
- { 0x0102, "GdiCreateLocalEnhMetaFile" },
- { 0x0103, "GdiCreateLocalMetaFilePict" },
- { 0x0104, "GdiDeleteLocalDC" },
- { 0x0105, "GdiDeleteSpoolFileHandle" },
- { 0x0106, "GdiDescribePixelFormat" },
- { 0x0107, "GdiDllInitialize" },
- { 0x0108, "GdiDrawStream" },
- { 0x0109, "GdiEndDocEMF" },
- { 0x010a, "GdiEndPageEMF" },
- { 0x0112, "GdiEntry1" },
- { 0x010b, "GdiEntry10" },
- { 0x010c, "GdiEntry11" },
- { 0x010d, "GdiEntry12" },
- { 0x010e, "GdiEntry13" },
- { 0x010f, "GdiEntry14" },
- { 0x0110, "GdiEntry15" },
- { 0x0111, "GdiEntry16" },
- { 0x0113, "GdiEntry2" },
- { 0x0114, "GdiEntry3" },
- { 0x0115, "GdiEntry4" },
- { 0x0116, "GdiEntry5" },
- { 0x0117, "GdiEntry6" },
- { 0x0118, "GdiEntry7" },
- { 0x0119, "GdiEntry8" },
- { 0x011a, "GdiEntry9" },
- { 0x011b, "GdiFixUpHandle" },
- { 0x011c, "GdiFlush" },
- { 0x011d, "GdiFullscreenControl" },
- { 0x011e, "GdiGetBatchLimit" },
- { 0x011f, "GdiGetCharDimensions" },
- { 0x0120, "GdiGetCodePage" },
- { 0x0121, "GdiGetDC" },
- { 0x0122, "GdiGetDevmodeForPage" },
- { 0x0123, "GdiGetLocalBrush" },
- { 0x0124, "GdiGetLocalDC" },
- { 0x0125, "GdiGetLocalFont" },
- { 0x0126, "GdiGetPageCount" },
- { 0x0127, "GdiGetPageHandle" },
- { 0x0128, "GdiGetSpoolFileHandle" },
- { 0x0129, "GdiGetSpoolMessage" },
- { 0x012a, "GdiGradientFill" },
- { 0x012b, "GdiInitSpool" },
- { 0x012c, "GdiInitializeLanguagePack" },
- { 0x012d, "GdiIsMetaFileDC" },
- { 0x012e, "GdiIsMetaPrintDC" },
- { 0x012f, "GdiIsPlayMetafileDC" },
- { 0x0130, "GdiPlayDCScript" },
- { 0x0131, "GdiPlayEMF" },
- { 0x0132, "GdiPlayJournal" },
- { 0x0133, "GdiPlayPageEMF" },
- { 0x0134, "GdiPlayPrivatePageEMF" },
- { 0x0135, "GdiPlayScript" },
- { 0x0136, "GdiPrinterThunk" },
- { 0x0137, "GdiProcessSetup" },
- { 0x0138, "GdiQueryFonts" },
- { 0x0139, "GdiQueryTable" },
- { 0x013a, "GdiRealizationInfo" },
- { 0x013b, "GdiReleaseDC" },
- { 0x013c, "GdiReleaseLocalDC" },
- { 0x013d, "GdiResetDCEMF" },
- { 0x013e, "GdiSetAttrs" },
- { 0x013f, "GdiSetBatchLimit" },
- { 0x0140, "GdiSetLastError" },
- { 0x0141, "GdiSetPixelFormat" },
- { 0x0142, "GdiSetServerAttr" },
- { 0x0143, "GdiStartDocEMF" },
- { 0x0144, "GdiStartPageEMF" },
- { 0x0145, "GdiSwapBuffers" },
- { 0x0146, "GdiTransparentBlt" },
- { 0x0147, "GdiValidateHandle" },
- { 0x0148, "GetArcDirection" },
- { 0x0149, "GetAspectRatioFilterEx" },
- { 0x014a, "GetBitmapAttributes" },
- { 0x014b, "GetBitmapBits" },
- { 0x014c, "GetBitmapDimensionEx" },
- { 0x014d, "GetBkColor" },
- { 0x014e, "GetBkMode" },
- { 0x014f, "GetBoundsRect" },
- { 0x0150, "GetBrushAttributes" },
- { 0x0151, "GetBrushOrgEx" },
- { 0x0152, "GetCharABCWidthsA" },
- { 0x0153, "GetCharABCWidthsFloatA" },
- { 0x0154, "GetCharABCWidthsFloatW" },
- { 0x0155, "GetCharABCWidthsI" },
- { 0x0156, "GetCharABCWidthsW" },
- { 0x0157, "GetCharWidth32A" },
- { 0x0158, "GetCharWidth32W" },
- { 0x0159, "GetCharWidthA" },
- { 0x015a, "GetCharWidthFloatA" },
- { 0x015b, "GetCharWidthFloatW" },
- { 0x015c, "GetCharWidthI" },
- { 0x015d, "GetCharWidthInfo" },
- { 0x015e, "GetCharWidthW" },
- { 0x015f, "GetCharacterPlacementA" },
- { 0x0160, "GetCharacterPlacementW" },
- { 0x0161, "GetClipBox" },
- { 0x0162, "GetClipRgn" },
- { 0x0163, "GetColorAdjustment" },
- { 0x0164, "GetColorSpace" },
- { 0x0165, "GetCurrentObject" },
- { 0x0166, "GetCurrentPositionEx" },
- { 0x0167, "GetDCBrushColor" },
- { 0x0168, "GetDCOrgEx" },
- { 0x0169, "GetDCPenColor" },
- { 0x016a, "GetDIBColorTable" },
- { 0x016b, "GetDIBits" },
- { 0x016c, "GetDeviceCaps" },
- { 0x016d, "GetDeviceGammaRamp" },
- { 0x016e, "GetETM" },
- { 0x016f, "GetEUDCTimeStamp" },
- { 0x0170, "GetEUDCTimeStampExW" },
- { 0x0171, "GetEnhMetaFileA" },
- { 0x0172, "GetEnhMetaFileBits" },
- { 0x0173, "GetEnhMetaFileDescriptionA" },
- { 0x0174, "GetEnhMetaFileDescriptionW" },
- { 0x0175, "GetEnhMetaFileHeader" },
- { 0x0176, "GetEnhMetaFilePaletteEntries" },
- { 0x0177, "GetEnhMetaFilePixelFormat" },
- { 0x0178, "GetEnhMetaFileW" },
- { 0x0179, "GetFontAssocStatus" },
- { 0x017a, "GetFontData" },
- { 0x017b, "GetFontLanguageInfo" },
- { 0x017c, "GetFontResourceInfoW" },
- { 0x017d, "GetFontUnicodeRanges" },
- { 0x017e, "GetGlyphIndicesA" },
- { 0x017f, "GetGlyphIndicesW" },
- { 0x0180, "GetGlyphOutline" },
- { 0x0181, "GetGlyphOutlineA" },
- { 0x0182, "GetGlyphOutlineW" },
- { 0x0183, "GetGlyphOutlineWow" },
- { 0x0184, "GetGraphicsMode" },
- { 0x0185, "GetHFONT" },
- { 0x0186, "GetICMProfileA" },
- { 0x0187, "GetICMProfileW" },
- { 0x0188, "GetKerningPairs" },
- { 0x0189, "GetKerningPairsA" },
- { 0x018a, "GetKerningPairsW" },
- { 0x018b, "GetLayout" },
- { 0x018c, "GetLogColorSpaceA" },
- { 0x018d, "GetLogColorSpaceW" },
- { 0x018e, "GetMapMode" },
- { 0x018f, "GetMetaFileA" },
- { 0x0190, "GetMetaFileBitsEx" },
- { 0x0191, "GetMetaFileW" },
- { 0x0192, "GetMetaRgn" },
- { 0x0193, "GetMiterLimit" },
- { 0x0194, "GetNearestColor" },
- { 0x0195, "GetNearestPaletteIndex" },
- { 0x0196, "GetObjectA" },
- { 0x0197, "GetObjectType" },
- { 0x0198, "GetObjectW" },
- { 0x0199, "GetOutlineTextMetricsA" },
- { 0x019a, "GetOutlineTextMetricsW" },
- { 0x019b, "GetPaletteEntries" },
- { 0x019c, "GetPath" },
- { 0x019d, "GetPixel" },
- { 0x019e, "GetPixelFormat" },
- { 0x019f, "GetPolyFillMode" },
- { 0x01a0, "GetROP2" },
- { 0x01a1, "GetRandomRgn" },
- { 0x01a2, "GetRasterizerCaps" },
- { 0x01a3, "GetRegionData" },
- { 0x01a4, "GetRelAbs" },
- { 0x01a5, "GetRgnBox" },
- { 0x01a6, "GetStockObject" },
- { 0x01a7, "GetStretchBltMode" },
- { 0x01a8, "GetStringBitmapA" },
- { 0x01a9, "GetStringBitmapW" },
- { 0x01aa, "GetSystemPaletteEntries" },
- { 0x01ab, "GetSystemPaletteUse" },
- { 0x01ac, "GetTextAlign" },
- { 0x01ad, "GetTextCharacterExtra" },
- { 0x01ae, "GetTextCharset" },
- { 0x01af, "GetTextCharsetInfo" },
- { 0x01b0, "GetTextColor" },
- { 0x01b1, "GetTextExtentExPointA" },
- { 0x01b2, "GetTextExtentExPointI" },
- { 0x01b3, "GetTextExtentExPointW" },
- { 0x01b4, "GetTextExtentExPointWPri" },
- { 0x01b5, "GetTextExtentPoint32A" },
- { 0x01b6, "GetTextExtentPoint32W" },
- { 0x01b7, "GetTextExtentPointA" },
- { 0x01b8, "GetTextExtentPointI" },
- { 0x01b9, "GetTextExtentPointW" },
- { 0x01ba, "GetTextFaceA" },
- { 0x01bb, "GetTextFaceAliasW" },
- { 0x01bc, "GetTextFaceW" },
- { 0x01bd, "GetTextMetricsA" },
- { 0x01be, "GetTextMetricsW" },
- { 0x01bf, "GetTransform" },
- { 0x01c0, "GetViewportExtEx" },
- { 0x01c1, "GetViewportOrgEx" },
- { 0x01c2, "GetWinMetaFileBits" },
- { 0x01c3, "GetWindowExtEx" },
- { 0x01c4, "GetWindowOrgEx" },
- { 0x01c5, "GetWorldTransform" },
- { 0x01c6, "HT_Get8BPPFormatPalette" },
- { 0x01c7, "HT_Get8BPPMaskPalette" },
- { 0x01c8, "IntersectClipRect" },
- { 0x01c9, "InvertRgn" },
- { 0x01ca, "IsValidEnhMetaRecord" },
- { 0x01cb, "IsValidEnhMetaRecordOffExt" },
- { 0x01cc, "LPtoDP" },
- { 0x01cd, "LineDDA" },
- { 0x01ce, "LineTo" },
- { 0x01cf, "MaskBlt" },
- { 0x01d0, "MirrorRgn" },
- { 0x01d1, "ModifyWorldTransform" },
- { 0x01d2, "MoveToEx" },
- { 0x01d3, "NamedEscape" },
- { 0x01d4, "OffsetClipRgn" },
- { 0x01d5, "OffsetRgn" },
- { 0x01d6, "OffsetViewportOrgEx" },
- { 0x01d7, "OffsetWindowOrgEx" },
- { 0x01d8, "PATHOBJ_bEnum" },
- { 0x01d9, "PATHOBJ_bEnumClipLines" },
- { 0x01da, "PATHOBJ_vEnumStart" },
- { 0x01db, "PATHOBJ_vEnumStartClipLines" },
- { 0x01dc, "PATHOBJ_vGetBounds" },
- { 0x01dd, "PaintRgn" },
- { 0x01de, "PatBlt" },
- { 0x01df, "PathToRegion" },
- { 0x01e0, "Pie" },
- { 0x01e1, "PlayEnhMetaFile" },
- { 0x01e2, "PlayEnhMetaFileRecord" },
- { 0x01e3, "PlayMetaFile" },
- { 0x01e4, "PlayMetaFileRecord" },
- { 0x01e5, "PlgBlt" },
- { 0x01e6, "PolyBezier" },
- { 0x01e7, "PolyBezierTo" },
- { 0x01e8, "PolyDraw" },
- { 0x01e9, "PolyPatBlt" },
- { 0x01ea, "PolyPolygon" },
- { 0x01eb, "PolyPolyline" },
- { 0x01ec, "PolyTextOutA" },
- { 0x01ed, "PolyTextOutW" },
- { 0x01ee, "Polygon" },
- { 0x01ef, "Polyline" },
- { 0x01f0, "PolylineTo" },
- { 0x01f1, "PtInRegion" },
- { 0x01f2, "PtVisible" },
- { 0x01f3, "QueryFontAssocStatus" },
- { 0x01f4, "RealizePalette" },
- { 0x01f5, "RectInRegion" },
- { 0x01f6, "RectVisible" },
- { 0x01f7, "Rectangle" },
- { 0x01f8, "RemoveFontMemResourceEx" },
- { 0x01f9, "RemoveFontResourceA" },
- { 0x01fa, "RemoveFontResourceExA" },
- { 0x01fb, "RemoveFontResourceExW" },
- { 0x01fc, "RemoveFontResourceTracking" },
- { 0x01fd, "RemoveFontResourceW" },
- { 0x01fe, "ResetDCA" },
- { 0x01ff, "ResetDCW" },
- { 0x0200, "ResizePalette" },
- { 0x0201, "RestoreDC" },
- { 0x0202, "RoundRect" },
- { 0x0203, "STROBJ_bEnum" },
- { 0x0204, "STROBJ_bEnumPositionsOnly" },
- { 0x0205, "STROBJ_bGetAdvanceWidths" },
- { 0x0206, "STROBJ_dwGetCodePage" },
- { 0x0207, "STROBJ_vEnumStart" },
- { 0x0208, "SaveDC" },
- { 0x0209, "ScaleViewportExtEx" },
- { 0x020a, "ScaleWindowExtEx" },
- { 0x020b, "SelectBrushLocal" },
- { 0x020c, "SelectClipPath" },
- { 0x020d, "SelectClipRgn" },
- { 0x020e, "SelectFontLocal" },
- { 0x020f, "SelectObject" },
- { 0x0210, "SelectPalette" },
- { 0x0211, "SetAbortProc" },
- { 0x0212, "SetArcDirection" },
- { 0x0213, "SetBitmapAttributes" },
- { 0x0214, "SetBitmapBits" },
- { 0x0215, "SetBitmapDimensionEx" },
- { 0x0216, "SetBkColor" },
- { 0x0217, "SetBkMode" },
- { 0x0218, "SetBoundsRect" },
- { 0x0219, "SetBrushAttributes" },
- { 0x021a, "SetBrushOrgEx" },
- { 0x021b, "SetColorAdjustment" },
- { 0x021c, "SetColorSpace" },
- { 0x021d, "SetDCBrushColor" },
- { 0x021e, "SetDCPenColor" },
- { 0x021f, "SetDIBColorTable" },
- { 0x0220, "SetDIBits" },
- { 0x0221, "SetDIBitsToDevice" },
- { 0x0222, "SetDeviceGammaRamp" },
- { 0x0223, "SetEnhMetaFileBits" },
- { 0x0224, "SetFontEnumeration" },
- { 0x0225, "SetGraphicsMode" },
- { 0x0226, "SetICMMode" },
- { 0x0227, "SetICMProfileA" },
- { 0x0228, "SetICMProfileW" },
- { 0x0229, "SetLayout" },
- { 0x022a, "SetLayoutWidth" },
- { 0x022b, "SetMagicColors" },
- { 0x022c, "SetMapMode" },
- { 0x022d, "SetMapperFlags" },
- { 0x022e, "SetMetaFileBitsEx" },
- { 0x022f, "SetMetaRgn" },
- { 0x0230, "SetMiterLimit" },
- { 0x0231, "SetPaletteEntries" },
- { 0x0232, "SetPixel" },
- { 0x0233, "SetPixelFormat" },
- { 0x0234, "SetPixelV" },
- { 0x0235, "SetPolyFillMode" },
- { 0x0236, "SetROP2" },
- { 0x0237, "SetRectRgn" },
- { 0x0238, "SetRelAbs" },
- { 0x0239, "SetStretchBltMode" },
- { 0x023a, "SetSystemPaletteUse" },
- { 0x023b, "SetTextAlign" },
- { 0x023c, "SetTextCharacterExtra" },
- { 0x023d, "SetTextColor" },
- { 0x023e, "SetTextJustification" },
- { 0x023f, "SetViewportExtEx" },
- { 0x0240, "SetViewportOrgEx" },
- { 0x0241, "SetVirtualResolution" },
- { 0x0242, "SetWinMetaFileBits" },
- { 0x0243, "SetWindowExtEx" },
- { 0x0244, "SetWindowOrgEx" },
- { 0x0245, "SetWorldTransform" },
- { 0x0246, "StartDocA" },
- { 0x0247, "StartDocW" },
- { 0x0248, "StartFormPage" },
- { 0x0249, "StartPage" },
- { 0x024a, "StretchBlt" },
- { 0x024b, "StretchDIBits" },
- { 0x024c, "StrokeAndFillPath" },
- { 0x024d, "StrokePath" },
- { 0x024e, "SwapBuffers" },
- { 0x024f, "TextOutA" },
- { 0x0250, "TextOutW" },
- { 0x0251, "TranslateCharsetInfo" },
- { 0x0252, "UnloadNetworkFonts" },
- { 0x0253, "UnrealizeObject" },
- { 0x0254, "UpdateColors" },
- { 0x0255, "UpdateICMRegKeyA" },
- { 0x0256, "UpdateICMRegKeyW" },
- { 0x0257, "WidenPath" },
- { 0x0258, "XFORMOBJ_bApplyXform" },
- { 0x0259, "XFORMOBJ_iGetXform" },
- { 0x025a, "XLATEOBJ_cGetPalette" },
- { 0x025b, "XLATEOBJ_hGetColorTransform" },
- { 0x025c, "XLATEOBJ_iXlate" },
- { 0x025d, "XLATEOBJ_piVector" },
- { 0x025e, "bInitSystemAndFontsDirectoriesW" },
- { 0x025f, "bMakePathNameW" },
- { 0x0260, "cGetTTFFromFOT" },
- { 0x0261, "gdiPlaySpoolStream" },
-};
+const char* gdi32_dll_lookup(uint32_t i) {
+ switch(i) {
+ case 0x0001: return "AbortDoc";
+ case 0x0002: return "AbortPath";
+ case 0x0003: return "AddFontMemResourceEx";
+ case 0x0004: return "AddFontResourceA";
+ case 0x0005: return "AddFontResourceExA";
+ case 0x0006: return "AddFontResourceExW";
+ case 0x0007: return "AddFontResourceTracking";
+ case 0x0008: return "AddFontResourceW";
+ case 0x0009: return "AngleArc";
+ case 0x000a: return "AnimatePalette";
+ case 0x000b: return "AnyLinkedFonts";
+ case 0x000c: return "Arc";
+ case 0x000d: return "ArcTo";
+ case 0x000e: return "BRUSHOBJ_hGetColorTransform";
+ case 0x000f: return "BRUSHOBJ_pvAllocRbrush";
+ case 0x0010: return "BRUSHOBJ_pvGetRbrush";
+ case 0x0011: return "BRUSHOBJ_ulGetBrushColor";
+ case 0x0012: return "BeginPath";
+ case 0x0013: return "BitBlt";
+ case 0x0014: return "CLIPOBJ_bEnum";
+ case 0x0015: return "CLIPOBJ_cEnumStart";
+ case 0x0016: return "CLIPOBJ_ppoGetPath";
+ case 0x0017: return "CancelDC";
+ case 0x0018: return "CheckColorsInGamut";
+ case 0x0019: return "ChoosePixelFormat";
+ case 0x001a: return "Chord";
+ case 0x001b: return "ClearBitmapAttributes";
+ case 0x001c: return "ClearBrushAttributes";
+ case 0x001d: return "CloseEnhMetaFile";
+ case 0x001e: return "CloseFigure";
+ case 0x001f: return "CloseMetaFile";
+ case 0x0020: return "ColorCorrectPalette";
+ case 0x0021: return "ColorMatchToTarget";
+ case 0x0022: return "CombineRgn";
+ case 0x0023: return "CombineTransform";
+ case 0x0024: return "CopyEnhMetaFileA";
+ case 0x0025: return "CopyEnhMetaFileW";
+ case 0x0026: return "CopyMetaFileA";
+ case 0x0027: return "CopyMetaFileW";
+ case 0x0028: return "CreateBitmap";
+ case 0x0029: return "CreateBitmapIndirect";
+ case 0x002a: return "CreateBrushIndirect";
+ case 0x002b: return "CreateColorSpaceA";
+ case 0x002c: return "CreateColorSpaceW";
+ case 0x002d: return "CreateCompatibleBitmap";
+ case 0x002e: return "CreateCompatibleDC";
+ case 0x002f: return "CreateDCA";
+ case 0x0030: return "CreateDCW";
+ case 0x0031: return "CreateDIBPatternBrush";
+ case 0x0032: return "CreateDIBPatternBrushPt";
+ case 0x0033: return "CreateDIBSection";
+ case 0x0034: return "CreateDIBitmap";
+ case 0x0035: return "CreateDiscardableBitmap";
+ case 0x0036: return "CreateEllipticRgn";
+ case 0x0037: return "CreateEllipticRgnIndirect";
+ case 0x0038: return "CreateEnhMetaFileA";
+ case 0x0039: return "CreateEnhMetaFileW";
+ case 0x003a: return "CreateFontA";
+ case 0x003b: return "CreateFontIndirectA";
+ case 0x003c: return "CreateFontIndirectExA";
+ case 0x003d: return "CreateFontIndirectExW";
+ case 0x003e: return "CreateFontIndirectW";
+ case 0x003f: return "CreateFontW";
+ case 0x0040: return "CreateHalftonePalette";
+ case 0x0041: return "CreateHatchBrush";
+ case 0x0042: return "CreateICA";
+ case 0x0043: return "CreateICW";
+ case 0x0044: return "CreateMetaFileA";
+ case 0x0045: return "CreateMetaFileW";
+ case 0x0046: return "CreatePalette";
+ case 0x0047: return "CreatePatternBrush";
+ case 0x0048: return "CreatePen";
+ case 0x0049: return "CreatePenIndirect";
+ case 0x004a: return "CreatePolyPolygonRgn";
+ case 0x004b: return "CreatePolygonRgn";
+ case 0x004c: return "CreateRectRgn";
+ case 0x004d: return "CreateRectRgnIndirect";
+ case 0x004e: return "CreateRoundRectRgn";
+ case 0x004f: return "CreateScalableFontResourceA";
+ case 0x0050: return "CreateScalableFontResourceW";
+ case 0x0051: return "CreateSolidBrush";
+ case 0x0052: return "DPtoLP";
+ case 0x0053: return "DdEntry0";
+ case 0x005e: return "DdEntry1";
+ case 0x0054: return "DdEntry10";
+ case 0x0055: return "DdEntry11";
+ case 0x0056: return "DdEntry12";
+ case 0x0057: return "DdEntry13";
+ case 0x0058: return "DdEntry14";
+ case 0x0059: return "DdEntry15";
+ case 0x005a: return "DdEntry16";
+ case 0x005b: return "DdEntry17";
+ case 0x005c: return "DdEntry18";
+ case 0x005d: return "DdEntry19";
+ case 0x0069: return "DdEntry2";
+ case 0x005f: return "DdEntry20";
+ case 0x0060: return "DdEntry21";
+ case 0x0061: return "DdEntry22";
+ case 0x0062: return "DdEntry23";
+ case 0x0063: return "DdEntry24";
+ case 0x0064: return "DdEntry25";
+ case 0x0065: return "DdEntry26";
+ case 0x0066: return "DdEntry27";
+ case 0x0067: return "DdEntry28";
+ case 0x0068: return "DdEntry29";
+ case 0x0074: return "DdEntry3";
+ case 0x006a: return "DdEntry30";
+ case 0x006b: return "DdEntry31";
+ case 0x006c: return "DdEntry32";
+ case 0x006d: return "DdEntry33";
+ case 0x006e: return "DdEntry34";
+ case 0x006f: return "DdEntry35";
+ case 0x0070: return "DdEntry36";
+ case 0x0071: return "DdEntry37";
+ case 0x0072: return "DdEntry38";
+ case 0x0073: return "DdEntry39";
+ case 0x007f: return "DdEntry4";
+ case 0x0075: return "DdEntry40";
+ case 0x0076: return "DdEntry41";
+ case 0x0077: return "DdEntry42";
+ case 0x0078: return "DdEntry43";
+ case 0x0079: return "DdEntry44";
+ case 0x007a: return "DdEntry45";
+ case 0x007b: return "DdEntry46";
+ case 0x007c: return "DdEntry47";
+ case 0x007d: return "DdEntry48";
+ case 0x007e: return "DdEntry49";
+ case 0x0087: return "DdEntry5";
+ case 0x0080: return "DdEntry50";
+ case 0x0081: return "DdEntry51";
+ case 0x0082: return "DdEntry52";
+ case 0x0083: return "DdEntry53";
+ case 0x0084: return "DdEntry54";
+ case 0x0085: return "DdEntry55";
+ case 0x0086: return "DdEntry56";
+ case 0x0088: return "DdEntry6";
+ case 0x0089: return "DdEntry7";
+ case 0x008a: return "DdEntry8";
+ case 0x008b: return "DdEntry9";
+ case 0x008c: return "DeleteColorSpace";
+ case 0x008d: return "DeleteDC";
+ case 0x008e: return "DeleteEnhMetaFile";
+ case 0x008f: return "DeleteMetaFile";
+ case 0x0090: return "DeleteObject";
+ case 0x0091: return "DescribePixelFormat";
+ case 0x0092: return "DeviceCapabilitiesExA";
+ case 0x0093: return "DeviceCapabilitiesExW";
+ case 0x0094: return "DrawEscape";
+ case 0x0095: return "Ellipse";
+ case 0x0096: return "EnableEUDC";
+ case 0x0097: return "EndDoc";
+ case 0x0098: return "EndFormPage";
+ case 0x0099: return "EndPage";
+ case 0x009a: return "EndPath";
+ case 0x009b: return "EngAcquireSemaphore";
+ case 0x009c: return "EngAlphaBlend";
+ case 0x009d: return "EngAssociateSurface";
+ case 0x009e: return "EngBitBlt";
+ case 0x009f: return "EngCheckAbort";
+ case 0x00a0: return "EngComputeGlyphSet";
+ case 0x00a1: return "EngCopyBits";
+ case 0x00a2: return "EngCreateBitmap";
+ case 0x00a3: return "EngCreateClip";
+ case 0x00a4: return "EngCreateDeviceBitmap";
+ case 0x00a5: return "EngCreateDeviceSurface";
+ case 0x00a6: return "EngCreatePalette";
+ case 0x00a7: return "EngCreateSemaphore";
+ case 0x00a8: return "EngDeleteClip";
+ case 0x00a9: return "EngDeletePalette";
+ case 0x00aa: return "EngDeletePath";
+ case 0x00ab: return "EngDeleteSemaphore";
+ case 0x00ac: return "EngDeleteSurface";
+ case 0x00ad: return "EngEraseSurface";
+ case 0x00ae: return "EngFillPath";
+ case 0x00af: return "EngFindResource";
+ case 0x00b0: return "EngFreeModule";
+ case 0x00b1: return "EngGetCurrentCodePage";
+ case 0x00b2: return "EngGetDriverName";
+ case 0x00b3: return "EngGetPrinterDataFileName";
+ case 0x00b4: return "EngGradientFill";
+ case 0x00b5: return "EngLineTo";
+ case 0x00b6: return "EngLoadModule";
+ case 0x00b7: return "EngLockSurface";
+ case 0x00b8: return "EngMarkBandingSurface";
+ case 0x00b9: return "EngMultiByteToUnicodeN";
+ case 0x00ba: return "EngMultiByteToWideChar";
+ case 0x00bb: return "EngPaint";
+ case 0x00bc: return "EngPlgBlt";
+ case 0x00bd: return "EngQueryEMFInfo";
+ case 0x00be: return "EngQueryLocalTime";
+ case 0x00bf: return "EngReleaseSemaphore";
+ case 0x00c0: return "EngStretchBlt";
+ case 0x00c1: return "EngStretchBltROP";
+ case 0x00c2: return "EngStrokeAndFillPath";
+ case 0x00c3: return "EngStrokePath";
+ case 0x00c4: return "EngTextOut";
+ case 0x00c5: return "EngTransparentBlt";
+ case 0x00c6: return "EngUnicodeToMultiByteN";
+ case 0x00c7: return "EngUnlockSurface";
+ case 0x00c8: return "EngWideCharToMultiByte";
+ case 0x00c9: return "EnumEnhMetaFile";
+ case 0x00ca: return "EnumFontFamiliesA";
+ case 0x00cb: return "EnumFontFamiliesExA";
+ case 0x00cc: return "EnumFontFamiliesExW";
+ case 0x00cd: return "EnumFontFamiliesW";
+ case 0x00ce: return "EnumFontsA";
+ case 0x00cf: return "EnumFontsW";
+ case 0x00d0: return "EnumICMProfilesA";
+ case 0x00d1: return "EnumICMProfilesW";
+ case 0x00d2: return "EnumMetaFile";
+ case 0x00d3: return "EnumObjects";
+ case 0x00d4: return "EqualRgn";
+ case 0x00d5: return "Escape";
+ case 0x00d6: return "EudcLoadLinkW";
+ case 0x00d7: return "EudcUnloadLinkW";
+ case 0x00d8: return "ExcludeClipRect";
+ case 0x00d9: return "ExtCreatePen";
+ case 0x00da: return "ExtCreateRegion";
+ case 0x00db: return "ExtEscape";
+ case 0x00dc: return "ExtFloodFill";
+ case 0x00dd: return "ExtSelectClipRgn";
+ case 0x00de: return "ExtTextOutA";
+ case 0x00df: return "ExtTextOutW";
+ case 0x00e0: return "FONTOBJ_cGetAllGlyphHandles";
+ case 0x00e1: return "FONTOBJ_cGetGlyphs";
+ case 0x00e2: return "FONTOBJ_pQueryGlyphAttrs";
+ case 0x00e3: return "FONTOBJ_pfdg";
+ case 0x00e4: return "FONTOBJ_pifi";
+ case 0x00e5: return "FONTOBJ_pvTrueTypeFontFile";
+ case 0x00e6: return "FONTOBJ_pxoGetXform";
+ case 0x00e7: return "FONTOBJ_vGetInfo";
+ case 0x00e8: return "FillPath";
+ case 0x00e9: return "FillRgn";
+ case 0x00ea: return "FixBrushOrgEx";
+ case 0x00eb: return "FlattenPath";
+ case 0x00ec: return "FloodFill";
+ case 0x00ed: return "FontIsLinked";
+ case 0x00ee: return "FrameRgn";
+ case 0x00ef: return "GdiAddFontResourceW";
+ case 0x00f0: return "GdiAddGlsBounds";
+ case 0x00f1: return "GdiAddGlsRecord";
+ case 0x00f2: return "GdiAlphaBlend";
+ case 0x00f3: return "GdiArtificialDecrementDriver";
+ case 0x00f4: return "GdiCleanCacheDC";
+ case 0x00f5: return "GdiComment";
+ case 0x00f6: return "GdiConsoleTextOut";
+ case 0x00f7: return "GdiConvertAndCheckDC";
+ case 0x00f8: return "GdiConvertBitmap";
+ case 0x00f9: return "GdiConvertBitmapV5";
+ case 0x00fa: return "GdiConvertBrush";
+ case 0x00fb: return "GdiConvertDC";
+ case 0x00fc: return "GdiConvertEnhMetaFile";
+ case 0x00fd: return "GdiConvertFont";
+ case 0x00fe: return "GdiConvertMetaFilePict";
+ case 0x00ff: return "GdiConvertPalette";
+ case 0x0100: return "GdiConvertRegion";
+ case 0x0101: return "GdiConvertToDevmodeW";
+ case 0x0102: return "GdiCreateLocalEnhMetaFile";
+ case 0x0103: return "GdiCreateLocalMetaFilePict";
+ case 0x0104: return "GdiDeleteLocalDC";
+ case 0x0105: return "GdiDeleteSpoolFileHandle";
+ case 0x0106: return "GdiDescribePixelFormat";
+ case 0x0107: return "GdiDllInitialize";
+ case 0x0108: return "GdiDrawStream";
+ case 0x0109: return "GdiEndDocEMF";
+ case 0x010a: return "GdiEndPageEMF";
+ case 0x0112: return "GdiEntry1";
+ case 0x010b: return "GdiEntry10";
+ case 0x010c: return "GdiEntry11";
+ case 0x010d: return "GdiEntry12";
+ case 0x010e: return "GdiEntry13";
+ case 0x010f: return "GdiEntry14";
+ case 0x0110: return "GdiEntry15";
+ case 0x0111: return "GdiEntry16";
+ case 0x0113: return "GdiEntry2";
+ case 0x0114: return "GdiEntry3";
+ case 0x0115: return "GdiEntry4";
+ case 0x0116: return "GdiEntry5";
+ case 0x0117: return "GdiEntry6";
+ case 0x0118: return "GdiEntry7";
+ case 0x0119: return "GdiEntry8";
+ case 0x011a: return "GdiEntry9";
+ case 0x011b: return "GdiFixUpHandle";
+ case 0x011c: return "GdiFlush";
+ case 0x011d: return "GdiFullscreenControl";
+ case 0x011e: return "GdiGetBatchLimit";
+ case 0x011f: return "GdiGetCharDimensions";
+ case 0x0120: return "GdiGetCodePage";
+ case 0x0121: return "GdiGetDC";
+ case 0x0122: return "GdiGetDevmodeForPage";
+ case 0x0123: return "GdiGetLocalBrush";
+ case 0x0124: return "GdiGetLocalDC";
+ case 0x0125: return "GdiGetLocalFont";
+ case 0x0126: return "GdiGetPageCount";
+ case 0x0127: return "GdiGetPageHandle";
+ case 0x0128: return "GdiGetSpoolFileHandle";
+ case 0x0129: return "GdiGetSpoolMessage";
+ case 0x012a: return "GdiGradientFill";
+ case 0x012b: return "GdiInitSpool";
+ case 0x012c: return "GdiInitializeLanguagePack";
+ case 0x012d: return "GdiIsMetaFileDC";
+ case 0x012e: return "GdiIsMetaPrintDC";
+ case 0x012f: return "GdiIsPlayMetafileDC";
+ case 0x0130: return "GdiPlayDCScript";
+ case 0x0131: return "GdiPlayEMF";
+ case 0x0132: return "GdiPlayJournal";
+ case 0x0133: return "GdiPlayPageEMF";
+ case 0x0134: return "GdiPlayPrivatePageEMF";
+ case 0x0135: return "GdiPlayScript";
+ case 0x0136: return "GdiPrinterThunk";
+ case 0x0137: return "GdiProcessSetup";
+ case 0x0138: return "GdiQueryFonts";
+ case 0x0139: return "GdiQueryTable";
+ case 0x013a: return "GdiRealizationInfo";
+ case 0x013b: return "GdiReleaseDC";
+ case 0x013c: return "GdiReleaseLocalDC";
+ case 0x013d: return "GdiResetDCEMF";
+ case 0x013e: return "GdiSetAttrs";
+ case 0x013f: return "GdiSetBatchLimit";
+ case 0x0140: return "GdiSetLastError";
+ case 0x0141: return "GdiSetPixelFormat";
+ case 0x0142: return "GdiSetServerAttr";
+ case 0x0143: return "GdiStartDocEMF";
+ case 0x0144: return "GdiStartPageEMF";
+ case 0x0145: return "GdiSwapBuffers";
+ case 0x0146: return "GdiTransparentBlt";
+ case 0x0147: return "GdiValidateHandle";
+ case 0x0148: return "GetArcDirection";
+ case 0x0149: return "GetAspectRatioFilterEx";
+ case 0x014a: return "GetBitmapAttributes";
+ case 0x014b: return "GetBitmapBits";
+ case 0x014c: return "GetBitmapDimensionEx";
+ case 0x014d: return "GetBkColor";
+ case 0x014e: return "GetBkMode";
+ case 0x014f: return "GetBoundsRect";
+ case 0x0150: return "GetBrushAttributes";
+ case 0x0151: return "GetBrushOrgEx";
+ case 0x0152: return "GetCharABCWidthsA";
+ case 0x0153: return "GetCharABCWidthsFloatA";
+ case 0x0154: return "GetCharABCWidthsFloatW";
+ case 0x0155: return "GetCharABCWidthsI";
+ case 0x0156: return "GetCharABCWidthsW";
+ case 0x0157: return "GetCharWidth32A";
+ case 0x0158: return "GetCharWidth32W";
+ case 0x0159: return "GetCharWidthA";
+ case 0x015a: return "GetCharWidthFloatA";
+ case 0x015b: return "GetCharWidthFloatW";
+ case 0x015c: return "GetCharWidthI";
+ case 0x015d: return "GetCharWidthInfo";
+ case 0x015e: return "GetCharWidthW";
+ case 0x015f: return "GetCharacterPlacementA";
+ case 0x0160: return "GetCharacterPlacementW";
+ case 0x0161: return "GetClipBox";
+ case 0x0162: return "GetClipRgn";
+ case 0x0163: return "GetColorAdjustment";
+ case 0x0164: return "GetColorSpace";
+ case 0x0165: return "GetCurrentObject";
+ case 0x0166: return "GetCurrentPositionEx";
+ case 0x0167: return "GetDCBrushColor";
+ case 0x0168: return "GetDCOrgEx";
+ case 0x0169: return "GetDCPenColor";
+ case 0x016a: return "GetDIBColorTable";
+ case 0x016b: return "GetDIBits";
+ case 0x016c: return "GetDeviceCaps";
+ case 0x016d: return "GetDeviceGammaRamp";
+ case 0x016e: return "GetETM";
+ case 0x016f: return "GetEUDCTimeStamp";
+ case 0x0170: return "GetEUDCTimeStampExW";
+ case 0x0171: return "GetEnhMetaFileA";
+ case 0x0172: return "GetEnhMetaFileBits";
+ case 0x0173: return "GetEnhMetaFileDescriptionA";
+ case 0x0174: return "GetEnhMetaFileDescriptionW";
+ case 0x0175: return "GetEnhMetaFileHeader";
+ case 0x0176: return "GetEnhMetaFilePaletteEntries";
+ case 0x0177: return "GetEnhMetaFilePixelFormat";
+ case 0x0178: return "GetEnhMetaFileW";
+ case 0x0179: return "GetFontAssocStatus";
+ case 0x017a: return "GetFontData";
+ case 0x017b: return "GetFontLanguageInfo";
+ case 0x017c: return "GetFontResourceInfoW";
+ case 0x017d: return "GetFontUnicodeRanges";
+ case 0x017e: return "GetGlyphIndicesA";
+ case 0x017f: return "GetGlyphIndicesW";
+ case 0x0180: return "GetGlyphOutline";
+ case 0x0181: return "GetGlyphOutlineA";
+ case 0x0182: return "GetGlyphOutlineW";
+ case 0x0183: return "GetGlyphOutlineWow";
+ case 0x0184: return "GetGraphicsMode";
+ case 0x0185: return "GetHFONT";
+ case 0x0186: return "GetICMProfileA";
+ case 0x0187: return "GetICMProfileW";
+ case 0x0188: return "GetKerningPairs";
+ case 0x0189: return "GetKerningPairsA";
+ case 0x018a: return "GetKerningPairsW";
+ case 0x018b: return "GetLayout";
+ case 0x018c: return "GetLogColorSpaceA";
+ case 0x018d: return "GetLogColorSpaceW";
+ case 0x018e: return "GetMapMode";
+ case 0x018f: return "GetMetaFileA";
+ case 0x0190: return "GetMetaFileBitsEx";
+ case 0x0191: return "GetMetaFileW";
+ case 0x0192: return "GetMetaRgn";
+ case 0x0193: return "GetMiterLimit";
+ case 0x0194: return "GetNearestColor";
+ case 0x0195: return "GetNearestPaletteIndex";
+ case 0x0196: return "GetObjectA";
+ case 0x0197: return "GetObjectType";
+ case 0x0198: return "GetObjectW";
+ case 0x0199: return "GetOutlineTextMetricsA";
+ case 0x019a: return "GetOutlineTextMetricsW";
+ case 0x019b: return "GetPaletteEntries";
+ case 0x019c: return "GetPath";
+ case 0x019d: return "GetPixel";
+ case 0x019e: return "GetPixelFormat";
+ case 0x019f: return "GetPolyFillMode";
+ case 0x01a0: return "GetROP2";
+ case 0x01a1: return "GetRandomRgn";
+ case 0x01a2: return "GetRasterizerCaps";
+ case 0x01a3: return "GetRegionData";
+ case 0x01a4: return "GetRelAbs";
+ case 0x01a5: return "GetRgnBox";
+ case 0x01a6: return "GetStockObject";
+ case 0x01a7: return "GetStretchBltMode";
+ case 0x01a8: return "GetStringBitmapA";
+ case 0x01a9: return "GetStringBitmapW";
+ case 0x01aa: return "GetSystemPaletteEntries";
+ case 0x01ab: return "GetSystemPaletteUse";
+ case 0x01ac: return "GetTextAlign";
+ case 0x01ad: return "GetTextCharacterExtra";
+ case 0x01ae: return "GetTextCharset";
+ case 0x01af: return "GetTextCharsetInfo";
+ case 0x01b0: return "GetTextColor";
+ case 0x01b1: return "GetTextExtentExPointA";
+ case 0x01b2: return "GetTextExtentExPointI";
+ case 0x01b3: return "GetTextExtentExPointW";
+ case 0x01b4: return "GetTextExtentExPointWPri";
+ case 0x01b5: return "GetTextExtentPoint32A";
+ case 0x01b6: return "GetTextExtentPoint32W";
+ case 0x01b7: return "GetTextExtentPointA";
+ case 0x01b8: return "GetTextExtentPointI";
+ case 0x01b9: return "GetTextExtentPointW";
+ case 0x01ba: return "GetTextFaceA";
+ case 0x01bb: return "GetTextFaceAliasW";
+ case 0x01bc: return "GetTextFaceW";
+ case 0x01bd: return "GetTextMetricsA";
+ case 0x01be: return "GetTextMetricsW";
+ case 0x01bf: return "GetTransform";
+ case 0x01c0: return "GetViewportExtEx";
+ case 0x01c1: return "GetViewportOrgEx";
+ case 0x01c2: return "GetWinMetaFileBits";
+ case 0x01c3: return "GetWindowExtEx";
+ case 0x01c4: return "GetWindowOrgEx";
+ case 0x01c5: return "GetWorldTransform";
+ case 0x01c6: return "HT_Get8BPPFormatPalette";
+ case 0x01c7: return "HT_Get8BPPMaskPalette";
+ case 0x01c8: return "IntersectClipRect";
+ case 0x01c9: return "InvertRgn";
+ case 0x01ca: return "IsValidEnhMetaRecord";
+ case 0x01cb: return "IsValidEnhMetaRecordOffExt";
+ case 0x01cc: return "LPtoDP";
+ case 0x01cd: return "LineDDA";
+ case 0x01ce: return "LineTo";
+ case 0x01cf: return "MaskBlt";
+ case 0x01d0: return "MirrorRgn";
+ case 0x01d1: return "ModifyWorldTransform";
+ case 0x01d2: return "MoveToEx";
+ case 0x01d3: return "NamedEscape";
+ case 0x01d4: return "OffsetClipRgn";
+ case 0x01d5: return "OffsetRgn";
+ case 0x01d6: return "OffsetViewportOrgEx";
+ case 0x01d7: return "OffsetWindowOrgEx";
+ case 0x01d8: return "PATHOBJ_bEnum";
+ case 0x01d9: return "PATHOBJ_bEnumClipLines";
+ case 0x01da: return "PATHOBJ_vEnumStart";
+ case 0x01db: return "PATHOBJ_vEnumStartClipLines";
+ case 0x01dc: return "PATHOBJ_vGetBounds";
+ case 0x01dd: return "PaintRgn";
+ case 0x01de: return "PatBlt";
+ case 0x01df: return "PathToRegion";
+ case 0x01e0: return "Pie";
+ case 0x01e1: return "PlayEnhMetaFile";
+ case 0x01e2: return "PlayEnhMetaFileRecord";
+ case 0x01e3: return "PlayMetaFile";
+ case 0x01e4: return "PlayMetaFileRecord";
+ case 0x01e5: return "PlgBlt";
+ case 0x01e6: return "PolyBezier";
+ case 0x01e7: return "PolyBezierTo";
+ case 0x01e8: return "PolyDraw";
+ case 0x01e9: return "PolyPatBlt";
+ case 0x01ea: return "PolyPolygon";
+ case 0x01eb: return "PolyPolyline";
+ case 0x01ec: return "PolyTextOutA";
+ case 0x01ed: return "PolyTextOutW";
+ case 0x01ee: return "Polygon";
+ case 0x01ef: return "Polyline";
+ case 0x01f0: return "PolylineTo";
+ case 0x01f1: return "PtInRegion";
+ case 0x01f2: return "PtVisible";
+ case 0x01f3: return "QueryFontAssocStatus";
+ case 0x01f4: return "RealizePalette";
+ case 0x01f5: return "RectInRegion";
+ case 0x01f6: return "RectVisible";
+ case 0x01f7: return "Rectangle";
+ case 0x01f8: return "RemoveFontMemResourceEx";
+ case 0x01f9: return "RemoveFontResourceA";
+ case 0x01fa: return "RemoveFontResourceExA";
+ case 0x01fb: return "RemoveFontResourceExW";
+ case 0x01fc: return "RemoveFontResourceTracking";
+ case 0x01fd: return "RemoveFontResourceW";
+ case 0x01fe: return "ResetDCA";
+ case 0x01ff: return "ResetDCW";
+ case 0x0200: return "ResizePalette";
+ case 0x0201: return "RestoreDC";
+ case 0x0202: return "RoundRect";
+ case 0x0203: return "STROBJ_bEnum";
+ case 0x0204: return "STROBJ_bEnumPositionsOnly";
+ case 0x0205: return "STROBJ_bGetAdvanceWidths";
+ case 0x0206: return "STROBJ_dwGetCodePage";
+ case 0x0207: return "STROBJ_vEnumStart";
+ case 0x0208: return "SaveDC";
+ case 0x0209: return "ScaleViewportExtEx";
+ case 0x020a: return "ScaleWindowExtEx";
+ case 0x020b: return "SelectBrushLocal";
+ case 0x020c: return "SelectClipPath";
+ case 0x020d: return "SelectClipRgn";
+ case 0x020e: return "SelectFontLocal";
+ case 0x020f: return "SelectObject";
+ case 0x0210: return "SelectPalette";
+ case 0x0211: return "SetAbortProc";
+ case 0x0212: return "SetArcDirection";
+ case 0x0213: return "SetBitmapAttributes";
+ case 0x0214: return "SetBitmapBits";
+ case 0x0215: return "SetBitmapDimensionEx";
+ case 0x0216: return "SetBkColor";
+ case 0x0217: return "SetBkMode";
+ case 0x0218: return "SetBoundsRect";
+ case 0x0219: return "SetBrushAttributes";
+ case 0x021a: return "SetBrushOrgEx";
+ case 0x021b: return "SetColorAdjustment";
+ case 0x021c: return "SetColorSpace";
+ case 0x021d: return "SetDCBrushColor";
+ case 0x021e: return "SetDCPenColor";
+ case 0x021f: return "SetDIBColorTable";
+ case 0x0220: return "SetDIBits";
+ case 0x0221: return "SetDIBitsToDevice";
+ case 0x0222: return "SetDeviceGammaRamp";
+ case 0x0223: return "SetEnhMetaFileBits";
+ case 0x0224: return "SetFontEnumeration";
+ case 0x0225: return "SetGraphicsMode";
+ case 0x0226: return "SetICMMode";
+ case 0x0227: return "SetICMProfileA";
+ case 0x0228: return "SetICMProfileW";
+ case 0x0229: return "SetLayout";
+ case 0x022a: return "SetLayoutWidth";
+ case 0x022b: return "SetMagicColors";
+ case 0x022c: return "SetMapMode";
+ case 0x022d: return "SetMapperFlags";
+ case 0x022e: return "SetMetaFileBitsEx";
+ case 0x022f: return "SetMetaRgn";
+ case 0x0230: return "SetMiterLimit";
+ case 0x0231: return "SetPaletteEntries";
+ case 0x0232: return "SetPixel";
+ case 0x0233: return "SetPixelFormat";
+ case 0x0234: return "SetPixelV";
+ case 0x0235: return "SetPolyFillMode";
+ case 0x0236: return "SetROP2";
+ case 0x0237: return "SetRectRgn";
+ case 0x0238: return "SetRelAbs";
+ case 0x0239: return "SetStretchBltMode";
+ case 0x023a: return "SetSystemPaletteUse";
+ case 0x023b: return "SetTextAlign";
+ case 0x023c: return "SetTextCharacterExtra";
+ case 0x023d: return "SetTextColor";
+ case 0x023e: return "SetTextJustification";
+ case 0x023f: return "SetViewportExtEx";
+ case 0x0240: return "SetViewportOrgEx";
+ case 0x0241: return "SetVirtualResolution";
+ case 0x0242: return "SetWinMetaFileBits";
+ case 0x0243: return "SetWindowExtEx";
+ case 0x0244: return "SetWindowOrgEx";
+ case 0x0245: return "SetWorldTransform";
+ case 0x0246: return "StartDocA";
+ case 0x0247: return "StartDocW";
+ case 0x0248: return "StartFormPage";
+ case 0x0249: return "StartPage";
+ case 0x024a: return "StretchBlt";
+ case 0x024b: return "StretchDIBits";
+ case 0x024c: return "StrokeAndFillPath";
+ case 0x024d: return "StrokePath";
+ case 0x024e: return "SwapBuffers";
+ case 0x024f: return "TextOutA";
+ case 0x0250: return "TextOutW";
+ case 0x0251: return "TranslateCharsetInfo";
+ case 0x0252: return "UnloadNetworkFonts";
+ case 0x0253: return "UnrealizeObject";
+ case 0x0254: return "UpdateColors";
+ case 0x0255: return "UpdateICMRegKeyA";
+ case 0x0256: return "UpdateICMRegKeyW";
+ case 0x0257: return "WidenPath";
+ case 0x0258: return "XFORMOBJ_bApplyXform";
+ case 0x0259: return "XFORMOBJ_iGetXform";
+ case 0x025a: return "XLATEOBJ_cGetPalette";
+ case 0x025b: return "XLATEOBJ_hGetColorTransform";
+ case 0x025c: return "XLATEOBJ_iXlate";
+ case 0x025d: return "XLATEOBJ_piVector";
+ case 0x025e: return "bInitSystemAndFontsDirectoriesW";
+ case 0x025f: return "bMakePathNameW";
+ case 0x0260: return "cGetTTFFromFOT";
+ case 0x0261: return "gdiPlaySpoolStream";
+ }
+ return nullptr;
+}
}
diff --git a/src/PE/utils/ordinals_lookup_tables/kernel32_dll_lookup.hpp b/src/PE/utils/ordinals_lookup_tables/kernel32_dll_lookup.hpp
index 7533e25c..67d21b1a 100644
--- a/src/PE/utils/ordinals_lookup_tables/kernel32_dll_lookup.hpp
+++ b/src/PE/utils/ordinals_lookup_tables/kernel32_dll_lookup.hpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -16,962 +16,964 @@
#ifndef LIEF_PE_KERNEL32_DLL_LOOKUP_H_
#define LIEF_PE_KERNEL32_DLL_LOOKUP_H_
-#include <map>
namespace LIEF {
namespace PE {
-static const std::map<uint32_t, const char*> kernel32_dll_lookup {
- { 0x0001, "ActivateActCtx" },
- { 0x0002, "AddAtomA" },
- { 0x0003, "AddAtomW" },
- { 0x0004, "AddConsoleAliasA" },
- { 0x0005, "AddConsoleAliasW" },
- { 0x0006, "AddLocalAlternateComputerNameA" },
- { 0x0007, "AddLocalAlternateComputerNameW" },
- { 0x0008, "AddRefActCtx" },
- { 0x0009, "AddVectoredExceptionHandler" },
- { 0x000a, "AllocConsole" },
- { 0x000b, "AllocateUserPhysicalPages" },
- { 0x000c, "AreFileApisANSI" },
- { 0x000d, "AssignProcessToJobObject" },
- { 0x000e, "AttachConsole" },
- { 0x000f, "BackupRead" },
- { 0x0010, "BackupSeek" },
- { 0x0011, "BackupWrite" },
- { 0x0012, "BaseCheckAppcompatCache" },
- { 0x0013, "BaseCleanupAppcompatCache" },
- { 0x0014, "BaseCleanupAppcompatCacheSupport" },
- { 0x0015, "BaseDumpAppcompatCache" },
- { 0x0016, "BaseFlushAppcompatCache" },
- { 0x0017, "BaseInitAppcompatCache" },
- { 0x0018, "BaseInitAppcompatCacheSupport" },
- { 0x0019, "BaseProcessInitPostImport" },
- { 0x001a, "BaseQueryModuleData" },
- { 0x001b, "BaseUpdateAppcompatCache" },
- { 0x001c, "BasepCheckWinSaferRestrictions" },
- { 0x001d, "Beep" },
- { 0x001e, "BeginUpdateResourceA" },
- { 0x001f, "BeginUpdateResourceW" },
- { 0x0020, "BindIoCompletionCallback" },
- { 0x0021, "BuildCommDCBA" },
- { 0x0022, "BuildCommDCBAndTimeoutsA" },
- { 0x0023, "BuildCommDCBAndTimeoutsW" },
- { 0x0024, "BuildCommDCBW" },
- { 0x0025, "CallNamedPipeA" },
- { 0x0026, "CallNamedPipeW" },
- { 0x0027, "CancelDeviceWakeupRequest" },
- { 0x0028, "CancelIo" },
- { 0x0029, "CancelTimerQueueTimer" },
- { 0x002a, "CancelWaitableTimer" },
- { 0x002b, "ChangeTimerQueueTimer" },
- { 0x002c, "CheckNameLegalDOS8Dot3A" },
- { 0x002d, "CheckNameLegalDOS8Dot3W" },
- { 0x002e, "CheckRemoteDebuggerPresent" },
- { 0x002f, "ClearCommBreak" },
- { 0x0030, "ClearCommError" },
- { 0x0031, "CloseConsoleHandle" },
- { 0x0032, "CloseHandle" },
- { 0x0033, "CloseProfileUserMapping" },
- { 0x0034, "CmdBatNotification" },
- { 0x0035, "CommConfigDialogA" },
- { 0x0036, "CommConfigDialogW" },
- { 0x0037, "CompareFileTime" },
- { 0x0038, "CompareStringA" },
- { 0x0039, "CompareStringW" },
- { 0x003a, "ConnectNamedPipe" },
- { 0x003b, "ConsoleMenuControl" },
- { 0x003c, "ContinueDebugEvent" },
- { 0x003d, "ConvertDefaultLocale" },
- { 0x003e, "ConvertFiberToThread" },
- { 0x003f, "ConvertThreadToFiber" },
- { 0x0040, "CopyFileA" },
- { 0x0041, "CopyFileExA" },
- { 0x0042, "CopyFileExW" },
- { 0x0043, "CopyFileW" },
- { 0x0044, "CopyLZFile" },
- { 0x0045, "CreateActCtxA" },
- { 0x0046, "CreateActCtxW" },
- { 0x0047, "CreateConsoleScreenBuffer" },
- { 0x0048, "CreateDirectoryA" },
- { 0x0049, "CreateDirectoryExA" },
- { 0x004a, "CreateDirectoryExW" },
- { 0x004b, "CreateDirectoryW" },
- { 0x004c, "CreateEventA" },
- { 0x004d, "CreateEventW" },
- { 0x004e, "CreateFiber" },
- { 0x004f, "CreateFiberEx" },
- { 0x0050, "CreateFileA" },
- { 0x0051, "CreateFileMappingA" },
- { 0x0052, "CreateFileMappingW" },
- { 0x0053, "CreateFileW" },
- { 0x0054, "CreateHardLinkA" },
- { 0x0055, "CreateHardLinkW" },
- { 0x0056, "CreateIoCompletionPort" },
- { 0x0057, "CreateJobObjectA" },
- { 0x0058, "CreateJobObjectW" },
- { 0x0059, "CreateJobSet" },
- { 0x005a, "CreateMailslotA" },
- { 0x005b, "CreateMailslotW" },
- { 0x005c, "CreateMemoryResourceNotification" },
- { 0x005d, "CreateMutexA" },
- { 0x005e, "CreateMutexW" },
- { 0x005f, "CreateNamedPipeA" },
- { 0x0060, "CreateNamedPipeW" },
- { 0x0061, "CreateNlsSecurityDescriptor" },
- { 0x0062, "CreatePipe" },
- { 0x0063, "CreateProcessA" },
- { 0x0064, "CreateProcessInternalA" },
- { 0x0065, "CreateProcessInternalW" },
- { 0x0066, "CreateProcessInternalWSecure" },
- { 0x0067, "CreateProcessW" },
- { 0x0068, "CreateRemoteThread" },
- { 0x0069, "CreateSemaphoreA" },
- { 0x006a, "CreateSemaphoreW" },
- { 0x006b, "CreateSocketHandle" },
- { 0x006c, "CreateTapePartition" },
- { 0x006d, "CreateThread" },
- { 0x006e, "CreateTimerQueue" },
- { 0x006f, "CreateTimerQueueTimer" },
- { 0x0070, "CreateToolhelp32Snapshot" },
- { 0x0071, "CreateVirtualBuffer" },
- { 0x0072, "CreateWaitableTimerA" },
- { 0x0073, "CreateWaitableTimerW" },
- { 0x0074, "DeactivateActCtx" },
- { 0x0075, "DebugActiveProcess" },
- { 0x0076, "DebugActiveProcessStop" },
- { 0x0077, "DebugBreak" },
- { 0x0078, "DebugBreakProcess" },
- { 0x0079, "DebugSetProcessKillOnExit" },
- { 0x007a, "DecodePointer" },
- { 0x007b, "DecodeSystemPointer" },
- { 0x007c, "DefineDosDeviceA" },
- { 0x007d, "DefineDosDeviceW" },
- { 0x007e, "DelayLoadFailureHook" },
- { 0x007f, "DeleteAtom" },
- { 0x0080, "DeleteCriticalSection" },
- { 0x0081, "DeleteFiber" },
- { 0x0082, "DeleteFileA" },
- { 0x0083, "DeleteFileW" },
- { 0x0084, "DeleteTimerQueue" },
- { 0x0085, "DeleteTimerQueueEx" },
- { 0x0086, "DeleteTimerQueueTimer" },
- { 0x0087, "DeleteVolumeMountPointA" },
- { 0x0088, "DeleteVolumeMountPointW" },
- { 0x0089, "DeviceIoControl" },
- { 0x008a, "DisableThreadLibraryCalls" },
- { 0x008b, "DisconnectNamedPipe" },
- { 0x008c, "DnsHostnameToComputerNameA" },
- { 0x008d, "DnsHostnameToComputerNameW" },
- { 0x008e, "DosDateTimeToFileTime" },
- { 0x008f, "DosPathToSessionPathA" },
- { 0x0090, "DosPathToSessionPathW" },
- { 0x0091, "DuplicateConsoleHandle" },
- { 0x0092, "DuplicateHandle" },
- { 0x0093, "EncodePointer" },
- { 0x0094, "EncodeSystemPointer" },
- { 0x0095, "EndUpdateResourceA" },
- { 0x0096, "EndUpdateResourceW" },
- { 0x0097, "EnterCriticalSection" },
- { 0x0098, "EnumCalendarInfoA" },
- { 0x0099, "EnumCalendarInfoExA" },
- { 0x009a, "EnumCalendarInfoExW" },
- { 0x009b, "EnumCalendarInfoW" },
- { 0x009c, "EnumDateFormatsA" },
- { 0x009d, "EnumDateFormatsExA" },
- { 0x009e, "EnumDateFormatsExW" },
- { 0x009f, "EnumDateFormatsW" },
- { 0x00a0, "EnumLanguageGroupLocalesA" },
- { 0x00a1, "EnumLanguageGroupLocalesW" },
- { 0x00a2, "EnumResourceLanguagesA" },
- { 0x00a3, "EnumResourceLanguagesW" },
- { 0x00a4, "EnumResourceNamesA" },
- { 0x00a5, "EnumResourceNamesW" },
- { 0x00a6, "EnumResourceTypesA" },
- { 0x00a7, "EnumResourceTypesW" },
- { 0x00a8, "EnumSystemCodePagesA" },
- { 0x00a9, "EnumSystemCodePagesW" },
- { 0x00aa, "EnumSystemGeoID" },
- { 0x00ab, "EnumSystemLanguageGroupsA" },
- { 0x00ac, "EnumSystemLanguageGroupsW" },
- { 0x00ad, "EnumSystemLocalesA" },
- { 0x00ae, "EnumSystemLocalesW" },
- { 0x00af, "EnumTimeFormatsA" },
- { 0x00b0, "EnumTimeFormatsW" },
- { 0x00b1, "EnumUILanguagesA" },
- { 0x00b2, "EnumUILanguagesW" },
- { 0x00b3, "EnumerateLocalComputerNamesA" },
- { 0x00b4, "EnumerateLocalComputerNamesW" },
- { 0x00b5, "EraseTape" },
- { 0x00b6, "EscapeCommFunction" },
- { 0x00b7, "ExitProcess" },
- { 0x00b8, "ExitThread" },
- { 0x00b9, "ExitVDM" },
- { 0x00ba, "ExpandEnvironmentStringsA" },
- { 0x00bb, "ExpandEnvironmentStringsW" },
- { 0x00bc, "ExpungeConsoleCommandHistoryA" },
- { 0x00bd, "ExpungeConsoleCommandHistoryW" },
- { 0x00be, "ExtendVirtualBuffer" },
- { 0x00bf, "FatalAppExitA" },
- { 0x00c0, "FatalAppExitW" },
- { 0x00c1, "FatalExit" },
- { 0x00c2, "FileTimeToDosDateTime" },
- { 0x00c3, "FileTimeToLocalFileTime" },
- { 0x00c4, "FileTimeToSystemTime" },
- { 0x00c5, "FillConsoleOutputAttribute" },
- { 0x00c6, "FillConsoleOutputCharacterA" },
- { 0x00c7, "FillConsoleOutputCharacterW" },
- { 0x00c8, "FindActCtxSectionGuid" },
- { 0x00c9, "FindActCtxSectionStringA" },
- { 0x00ca, "FindActCtxSectionStringW" },
- { 0x00cb, "FindAtomA" },
- { 0x00cc, "FindAtomW" },
- { 0x00cd, "FindClose" },
- { 0x00ce, "FindCloseChangeNotification" },
- { 0x00cf, "FindFirstChangeNotificationA" },
- { 0x00d0, "FindFirstChangeNotificationW" },
- { 0x00d1, "FindFirstFileA" },
- { 0x00d2, "FindFirstFileExA" },
- { 0x00d3, "FindFirstFileExW" },
- { 0x00d4, "FindFirstFileW" },
- { 0x00d5, "FindFirstVolumeA" },
- { 0x00d6, "FindFirstVolumeMountPointA" },
- { 0x00d7, "FindFirstVolumeMountPointW" },
- { 0x00d8, "FindFirstVolumeW" },
- { 0x00d9, "FindNextChangeNotification" },
- { 0x00da, "FindNextFileA" },
- { 0x00db, "FindNextFileW" },
- { 0x00dc, "FindNextVolumeA" },
- { 0x00dd, "FindNextVolumeMountPointA" },
- { 0x00de, "FindNextVolumeMountPointW" },
- { 0x00df, "FindNextVolumeW" },
- { 0x00e0, "FindResourceA" },
- { 0x00e1, "FindResourceExA" },
- { 0x00e2, "FindResourceExW" },
- { 0x00e3, "FindResourceW" },
- { 0x00e4, "FindVolumeClose" },
- { 0x00e5, "FindVolumeMountPointClose" },
- { 0x00e6, "FlushConsoleInputBuffer" },
- { 0x00e7, "FlushFileBuffers" },
- { 0x00e8, "FlushInstructionCache" },
- { 0x00e9, "FlushViewOfFile" },
- { 0x00ea, "FoldStringA" },
- { 0x00eb, "FoldStringW" },
- { 0x00ec, "FormatMessageA" },
- { 0x00ed, "FormatMessageW" },
- { 0x00ee, "FreeConsole" },
- { 0x00ef, "FreeEnvironmentStringsA" },
- { 0x00f0, "FreeEnvironmentStringsW" },
- { 0x00f1, "FreeLibrary" },
- { 0x00f2, "FreeLibraryAndExitThread" },
- { 0x00f3, "FreeResource" },
- { 0x00f4, "FreeUserPhysicalPages" },
- { 0x00f5, "FreeVirtualBuffer" },
- { 0x00f6, "GenerateConsoleCtrlEvent" },
- { 0x00f7, "GetACP" },
- { 0x00f8, "GetAtomNameA" },
- { 0x00f9, "GetAtomNameW" },
- { 0x00fa, "GetBinaryType" },
- { 0x00fb, "GetBinaryTypeA" },
- { 0x00fc, "GetBinaryTypeW" },
- { 0x00fd, "GetCPFileNameFromRegistry" },
- { 0x00fe, "GetCPInfo" },
- { 0x00ff, "GetCPInfoExA" },
- { 0x0100, "GetCPInfoExW" },
- { 0x0101, "GetCalendarInfoA" },
- { 0x0102, "GetCalendarInfoW" },
- { 0x0103, "GetComPlusPackageInstallStatus" },
- { 0x0104, "GetCommConfig" },
- { 0x0105, "GetCommMask" },
- { 0x0106, "GetCommModemStatus" },
- { 0x0107, "GetCommProperties" },
- { 0x0108, "GetCommState" },
- { 0x0109, "GetCommTimeouts" },
- { 0x010a, "GetCommandLineA" },
- { 0x010b, "GetCommandLineW" },
- { 0x010c, "GetCompressedFileSizeA" },
- { 0x010d, "GetCompressedFileSizeW" },
- { 0x010e, "GetComputerNameA" },
- { 0x010f, "GetComputerNameExA" },
- { 0x0110, "GetComputerNameExW" },
- { 0x0111, "GetComputerNameW" },
- { 0x0112, "GetConsoleAliasA" },
- { 0x0113, "GetConsoleAliasExesA" },
- { 0x0114, "GetConsoleAliasExesLengthA" },
- { 0x0115, "GetConsoleAliasExesLengthW" },
- { 0x0116, "GetConsoleAliasExesW" },
- { 0x0117, "GetConsoleAliasW" },
- { 0x0118, "GetConsoleAliasesA" },
- { 0x0119, "GetConsoleAliasesLengthA" },
- { 0x011a, "GetConsoleAliasesLengthW" },
- { 0x011b, "GetConsoleAliasesW" },
- { 0x011c, "GetConsoleCP" },
- { 0x011d, "GetConsoleCharType" },
- { 0x011e, "GetConsoleCommandHistoryA" },
- { 0x011f, "GetConsoleCommandHistoryLengthA" },
- { 0x0120, "GetConsoleCommandHistoryLengthW" },
- { 0x0121, "GetConsoleCommandHistoryW" },
- { 0x0122, "GetConsoleCursorInfo" },
- { 0x0123, "GetConsoleCursorMode" },
- { 0x0124, "GetConsoleDisplayMode" },
- { 0x0125, "GetConsoleFontInfo" },
- { 0x0126, "GetConsoleFontSize" },
- { 0x0127, "GetConsoleHardwareState" },
- { 0x0128, "GetConsoleInputExeNameA" },
- { 0x0129, "GetConsoleInputExeNameW" },
- { 0x012a, "GetConsoleInputWaitHandle" },
- { 0x012b, "GetConsoleKeyboardLayoutNameA" },
- { 0x012c, "GetConsoleKeyboardLayoutNameW" },
- { 0x012d, "GetConsoleMode" },
- { 0x012e, "GetConsoleNlsMode" },
- { 0x012f, "GetConsoleOutputCP" },
- { 0x0130, "GetConsoleProcessList" },
- { 0x0131, "GetConsoleScreenBufferInfo" },
- { 0x0132, "GetConsoleSelectionInfo" },
- { 0x0133, "GetConsoleTitleA" },
- { 0x0134, "GetConsoleTitleW" },
- { 0x0135, "GetConsoleWindow" },
- { 0x0136, "GetCurrencyFormatA" },
- { 0x0137, "GetCurrencyFormatW" },
- { 0x0138, "GetCurrentActCtx" },
- { 0x0139, "GetCurrentConsoleFont" },
- { 0x013a, "GetCurrentDirectoryA" },
- { 0x013b, "GetCurrentDirectoryW" },
- { 0x013c, "GetCurrentProcess" },
- { 0x013d, "GetCurrentProcessId" },
- { 0x013e, "GetCurrentThread" },
- { 0x013f, "GetCurrentThreadId" },
- { 0x0140, "GetDateFormatA" },
- { 0x0141, "GetDateFormatW" },
- { 0x0142, "GetDefaultCommConfigA" },
- { 0x0143, "GetDefaultCommConfigW" },
- { 0x0144, "GetDefaultSortkeySize" },
- { 0x0145, "GetDevicePowerState" },
- { 0x0146, "GetDiskFreeSpaceA" },
- { 0x0147, "GetDiskFreeSpaceExA" },
- { 0x0148, "GetDiskFreeSpaceExW" },
- { 0x0149, "GetDiskFreeSpaceW" },
- { 0x014a, "GetDllDirectoryA" },
- { 0x014b, "GetDllDirectoryW" },
- { 0x014c, "GetDriveTypeA" },
- { 0x014d, "GetDriveTypeW" },
- { 0x014e, "GetEnvironmentStrings" },
- { 0x014f, "GetEnvironmentStringsA" },
- { 0x0150, "GetEnvironmentStringsW" },
- { 0x0151, "GetEnvironmentVariableA" },
- { 0x0152, "GetEnvironmentVariableW" },
- { 0x0153, "GetExitCodeProcess" },
- { 0x0154, "GetExitCodeThread" },
- { 0x0155, "GetExpandedNameA" },
- { 0x0156, "GetExpandedNameW" },
- { 0x0157, "GetFileAttributesA" },
- { 0x0158, "GetFileAttributesExA" },
- { 0x0159, "GetFileAttributesExW" },
- { 0x015a, "GetFileAttributesW" },
- { 0x015b, "GetFileInformationByHandle" },
- { 0x015c, "GetFileSize" },
- { 0x015d, "GetFileSizeEx" },
- { 0x015e, "GetFileTime" },
- { 0x015f, "GetFileType" },
- { 0x0160, "GetFirmwareEnvironmentVariableA" },
- { 0x0161, "GetFirmwareEnvironmentVariableW" },
- { 0x0162, "GetFullPathNameA" },
- { 0x0163, "GetFullPathNameW" },
- { 0x0164, "GetGeoInfoA" },
- { 0x0165, "GetGeoInfoW" },
- { 0x0166, "GetHandleContext" },
- { 0x0167, "GetHandleInformation" },
- { 0x0168, "GetLargestConsoleWindowSize" },
- { 0x0169, "GetLastError" },
- { 0x016a, "GetLinguistLangSize" },
- { 0x016b, "GetLocalTime" },
- { 0x016c, "GetLocaleInfoA" },
- { 0x016d, "GetLocaleInfoW" },
- { 0x016e, "GetLogicalDriveStringsA" },
- { 0x016f, "GetLogicalDriveStringsW" },
- { 0x0170, "GetLogicalDrives" },
- { 0x0171, "GetLongPathNameA" },
- { 0x0172, "GetLongPathNameW" },
- { 0x0173, "GetMailslotInfo" },
- { 0x0174, "GetModuleFileNameA" },
- { 0x0175, "GetModuleFileNameW" },
- { 0x0176, "GetModuleHandleA" },
- { 0x0177, "GetModuleHandleExA" },
- { 0x0178, "GetModuleHandleExW" },
- { 0x0179, "GetModuleHandleW" },
- { 0x017a, "GetNamedPipeHandleStateA" },
- { 0x017b, "GetNamedPipeHandleStateW" },
- { 0x017c, "GetNamedPipeInfo" },
- { 0x017d, "GetNativeSystemInfo" },
- { 0x017e, "GetNextVDMCommand" },
- { 0x017f, "GetNlsSectionName" },
- { 0x0180, "GetNumaAvailableMemory" },
- { 0x0181, "GetNumaAvailableMemoryNode" },
- { 0x0182, "GetNumaHighestNodeNumber" },
- { 0x0183, "GetNumaNodeProcessorMask" },
- { 0x0184, "GetNumaProcessorMap" },
- { 0x0185, "GetNumaProcessorNode" },
- { 0x0186, "GetNumberFormatA" },
- { 0x0187, "GetNumberFormatW" },
- { 0x0188, "GetNumberOfConsoleFonts" },
- { 0x0189, "GetNumberOfConsoleInputEvents" },
- { 0x018a, "GetNumberOfConsoleMouseButtons" },
- { 0x018b, "GetOEMCP" },
- { 0x018c, "GetOverlappedResult" },
- { 0x018d, "GetPriorityClass" },
- { 0x018e, "GetPrivateProfileIntA" },
- { 0x018f, "GetPrivateProfileIntW" },
- { 0x0190, "GetPrivateProfileSectionA" },
- { 0x0191, "GetPrivateProfileSectionNamesA" },
- { 0x0192, "GetPrivateProfileSectionNamesW" },
- { 0x0193, "GetPrivateProfileSectionW" },
- { 0x0194, "GetPrivateProfileStringA" },
- { 0x0195, "GetPrivateProfileStringW" },
- { 0x0196, "GetPrivateProfileStructA" },
- { 0x0197, "GetPrivateProfileStructW" },
- { 0x0198, "GetProcAddress" },
- { 0x0199, "GetProcessAffinityMask" },
- { 0x019a, "GetProcessHandleCount" },
- { 0x019b, "GetProcessHeap" },
- { 0x019c, "GetProcessHeaps" },
- { 0x019d, "GetProcessId" },
- { 0x019e, "GetProcessIoCounters" },
- { 0x019f, "GetProcessPriorityBoost" },
- { 0x01a0, "GetProcessShutdownParameters" },
- { 0x01a1, "GetProcessTimes" },
- { 0x01a2, "GetProcessVersion" },
- { 0x01a3, "GetProcessWorkingSetSize" },
- { 0x01a4, "GetProfileIntA" },
- { 0x01a5, "GetProfileIntW" },
- { 0x01a6, "GetProfileSectionA" },
- { 0x01a7, "GetProfileSectionW" },
- { 0x01a8, "GetProfileStringA" },
- { 0x01a9, "GetProfileStringW" },
- { 0x01aa, "GetQueuedCompletionStatus" },
- { 0x01ab, "GetShortPathNameA" },
- { 0x01ac, "GetShortPathNameW" },
- { 0x01ad, "GetStartupInfoA" },
- { 0x01ae, "GetStartupInfoW" },
- { 0x01af, "GetStdHandle" },
- { 0x01b0, "GetStringTypeA" },
- { 0x01b1, "GetStringTypeExA" },
- { 0x01b2, "GetStringTypeExW" },
- { 0x01b3, "GetStringTypeW" },
- { 0x01b4, "GetSystemDefaultLCID" },
- { 0x01b5, "GetSystemDefaultLangID" },
- { 0x01b6, "GetSystemDefaultUILanguage" },
- { 0x01b7, "GetSystemDirectoryA" },
- { 0x01b8, "GetSystemDirectoryW" },
- { 0x01b9, "GetSystemInfo" },
- { 0x01ba, "GetSystemPowerStatus" },
- { 0x01bb, "GetSystemRegistryQuota" },
- { 0x01bc, "GetSystemTime" },
- { 0x01bd, "GetSystemTimeAdjustment" },
- { 0x01be, "GetSystemTimeAsFileTime" },
- { 0x01bf, "GetSystemTimes" },
- { 0x01c0, "GetSystemWindowsDirectoryA" },
- { 0x01c1, "GetSystemWindowsDirectoryW" },
- { 0x01c2, "GetSystemWow64DirectoryA" },
- { 0x01c3, "GetSystemWow64DirectoryW" },
- { 0x01c4, "GetTapeParameters" },
- { 0x01c5, "GetTapePosition" },
- { 0x01c6, "GetTapeStatus" },
- { 0x01c7, "GetTempFileNameA" },
- { 0x01c8, "GetTempFileNameW" },
- { 0x01c9, "GetTempPathA" },
- { 0x01ca, "GetTempPathW" },
- { 0x01cb, "GetThreadContext" },
- { 0x01cc, "GetThreadIOPendingFlag" },
- { 0x01cd, "GetThreadLocale" },
- { 0x01ce, "GetThreadPriority" },
- { 0x01cf, "GetThreadPriorityBoost" },
- { 0x01d0, "GetThreadSelectorEntry" },
- { 0x01d1, "GetThreadTimes" },
- { 0x01d2, "GetTickCount" },
- { 0x01d3, "GetTimeFormatA" },
- { 0x01d4, "GetTimeFormatW" },
- { 0x01d5, "GetTimeZoneInformation" },
- { 0x01d6, "GetUserDefaultLCID" },
- { 0x01d7, "GetUserDefaultLangID" },
- { 0x01d8, "GetUserDefaultUILanguage" },
- { 0x01d9, "GetUserGeoID" },
- { 0x01da, "GetVDMCurrentDirectories" },
- { 0x01db, "GetVersion" },
- { 0x01dc, "GetVersionExA" },
- { 0x01dd, "GetVersionExW" },
- { 0x01de, "GetVolumeInformationA" },
- { 0x01df, "GetVolumeInformationW" },
- { 0x01e0, "GetVolumeNameForVolumeMountPointA" },
- { 0x01e1, "GetVolumeNameForVolumeMountPointW" },
- { 0x01e2, "GetVolumePathNameA" },
- { 0x01e3, "GetVolumePathNameW" },
- { 0x01e4, "GetVolumePathNamesForVolumeNameA" },
- { 0x01e5, "GetVolumePathNamesForVolumeNameW" },
- { 0x01e6, "GetWindowsDirectoryA" },
- { 0x01e7, "GetWindowsDirectoryW" },
- { 0x01e8, "GetWriteWatch" },
- { 0x01e9, "GlobalAddAtomA" },
- { 0x01ea, "GlobalAddAtomW" },
- { 0x01eb, "GlobalAlloc" },
- { 0x01ec, "GlobalCompact" },
- { 0x01ed, "GlobalDeleteAtom" },
- { 0x01ee, "GlobalFindAtomA" },
- { 0x01ef, "GlobalFindAtomW" },
- { 0x01f0, "GlobalFix" },
- { 0x01f1, "GlobalFlags" },
- { 0x01f2, "GlobalFree" },
- { 0x01f3, "GlobalGetAtomNameA" },
- { 0x01f4, "GlobalGetAtomNameW" },
- { 0x01f5, "GlobalHandle" },
- { 0x01f6, "GlobalLock" },
- { 0x01f7, "GlobalMemoryStatus" },
- { 0x01f8, "GlobalMemoryStatusEx" },
- { 0x01f9, "GlobalReAlloc" },
- { 0x01fa, "GlobalSize" },
- { 0x01fb, "GlobalUnWire" },
- { 0x01fc, "GlobalUnfix" },
- { 0x01fd, "GlobalUnlock" },
- { 0x01fe, "GlobalWire" },
- { 0x01ff, "Heap32First" },
- { 0x0200, "Heap32ListFirst" },
- { 0x0201, "Heap32ListNext" },
- { 0x0202, "Heap32Next" },
- { 0x0203, "HeapAlloc" },
- { 0x0204, "HeapCompact" },
- { 0x0205, "HeapCreate" },
- { 0x0206, "HeapCreateTagsW" },
- { 0x0207, "HeapDestroy" },
- { 0x0208, "HeapExtend" },
- { 0x0209, "HeapFree" },
- { 0x020a, "HeapLock" },
- { 0x020b, "HeapQueryInformation" },
- { 0x020c, "HeapQueryTagW" },
- { 0x020d, "HeapReAlloc" },
- { 0x020e, "HeapSetInformation" },
- { 0x020f, "HeapSize" },
- { 0x0210, "HeapSummary" },
- { 0x0211, "HeapUnlock" },
- { 0x0212, "HeapUsage" },
- { 0x0213, "HeapValidate" },
- { 0x0214, "HeapWalk" },
- { 0x0215, "InitAtomTable" },
- { 0x0216, "InitializeCriticalSection" },
- { 0x0217, "InitializeCriticalSectionAndSpinCount" },
- { 0x0218, "InitializeSListHead" },
- { 0x0219, "InterlockedCompareExchange" },
- { 0x021a, "InterlockedDecrement" },
- { 0x021b, "InterlockedExchange" },
- { 0x021c, "InterlockedExchangeAdd" },
- { 0x021d, "InterlockedFlushSList" },
- { 0x021e, "InterlockedIncrement" },
- { 0x021f, "InterlockedPopEntrySList" },
- { 0x0220, "InterlockedPushEntrySList" },
- { 0x0221, "InvalidateConsoleDIBits" },
- { 0x0222, "IsBadCodePtr" },
- { 0x0223, "IsBadHugeReadPtr" },
- { 0x0224, "IsBadHugeWritePtr" },
- { 0x0225, "IsBadReadPtr" },
- { 0x0226, "IsBadStringPtrA" },
- { 0x0227, "IsBadStringPtrW" },
- { 0x0228, "IsBadWritePtr" },
- { 0x0229, "IsDBCSLeadByte" },
- { 0x022a, "IsDBCSLeadByteEx" },
- { 0x022b, "IsDebuggerPresent" },
- { 0x022c, "IsProcessInJob" },
- { 0x022d, "IsProcessorFeaturePresent" },
- { 0x022e, "IsSystemResumeAutomatic" },
- { 0x022f, "IsValidCodePage" },
- { 0x0230, "IsValidLanguageGroup" },
- { 0x0231, "IsValidLocale" },
- { 0x0232, "IsValidUILanguage" },
- { 0x0233, "IsWow64Process" },
- { 0x0234, "LCMapStringA" },
- { 0x0235, "LCMapStringW" },
- { 0x0236, "LZClose" },
- { 0x0237, "LZCloseFile" },
- { 0x0238, "LZCopy" },
- { 0x0239, "LZCreateFileW" },
- { 0x023a, "LZDone" },
- { 0x023b, "LZInit" },
- { 0x023c, "LZOpenFileA" },
- { 0x023d, "LZOpenFileW" },
- { 0x023e, "LZRead" },
- { 0x023f, "LZSeek" },
- { 0x0240, "LZStart" },
- { 0x0241, "LeaveCriticalSection" },
- { 0x0242, "LoadLibraryA" },
- { 0x0243, "LoadLibraryExA" },
- { 0x0244, "LoadLibraryExW" },
- { 0x0245, "LoadLibraryW" },
- { 0x0246, "LoadModule" },
- { 0x0247, "LoadResource" },
- { 0x0248, "LocalAlloc" },
- { 0x0249, "LocalCompact" },
- { 0x024a, "LocalFileTimeToFileTime" },
- { 0x024b, "LocalFlags" },
- { 0x024c, "LocalFree" },
- { 0x024d, "LocalHandle" },
- { 0x024e, "LocalLock" },
- { 0x024f, "LocalReAlloc" },
- { 0x0250, "LocalShrink" },
- { 0x0251, "LocalSize" },
- { 0x0252, "LocalUnlock" },
- { 0x0253, "LockFile" },
- { 0x0254, "LockFileEx" },
- { 0x0255, "LockResource" },
- { 0x0256, "MapUserPhysicalPages" },
- { 0x0257, "MapUserPhysicalPagesScatter" },
- { 0x0258, "MapViewOfFile" },
- { 0x0259, "MapViewOfFileEx" },
- { 0x025a, "Module32First" },
- { 0x025b, "Module32FirstW" },
- { 0x025c, "Module32Next" },
- { 0x025d, "Module32NextW" },
- { 0x025e, "MoveFileA" },
- { 0x025f, "MoveFileExA" },
- { 0x0260, "MoveFileExW" },
- { 0x0261, "MoveFileW" },
- { 0x0262, "MoveFileWithProgressA" },
- { 0x0263, "MoveFileWithProgressW" },
- { 0x0264, "MulDiv" },
- { 0x0265, "MultiByteToWideChar" },
- { 0x0266, "NlsConvertIntegerToString" },
- { 0x0267, "NlsGetCacheUpdateCount" },
- { 0x0268, "NlsResetProcessLocale" },
- { 0x0269, "NumaVirtualQueryNode" },
- { 0x026a, "OpenConsoleW" },
- { 0x026b, "OpenDataFile" },
- { 0x026c, "OpenEventA" },
- { 0x026d, "OpenEventW" },
- { 0x026e, "OpenFile" },
- { 0x026f, "OpenFileMappingA" },
- { 0x0270, "OpenFileMappingW" },
- { 0x0271, "OpenJobObjectA" },
- { 0x0272, "OpenJobObjectW" },
- { 0x0273, "OpenMutexA" },
- { 0x0274, "OpenMutexW" },
- { 0x0275, "OpenProcess" },
- { 0x0276, "OpenProfileUserMapping" },
- { 0x0277, "OpenSemaphoreA" },
- { 0x0278, "OpenSemaphoreW" },
- { 0x0279, "OpenThread" },
- { 0x027a, "OpenWaitableTimerA" },
- { 0x027b, "OpenWaitableTimerW" },
- { 0x027c, "OutputDebugStringA" },
- { 0x027d, "OutputDebugStringW" },
- { 0x027e, "PeekConsoleInputA" },
- { 0x027f, "PeekConsoleInputW" },
- { 0x0280, "PeekNamedPipe" },
- { 0x0281, "PostQueuedCompletionStatus" },
- { 0x0282, "PrepareTape" },
- { 0x0283, "PrivCopyFileExW" },
- { 0x0284, "PrivMoveFileIdentityW" },
- { 0x0285, "Process32First" },
- { 0x0286, "Process32FirstW" },
- { 0x0287, "Process32Next" },
- { 0x0288, "Process32NextW" },
- { 0x0289, "ProcessIdToSessionId" },
- { 0x028a, "PulseEvent" },
- { 0x028b, "PurgeComm" },
- { 0x028c, "QueryActCtxW" },
- { 0x028d, "QueryDepthSList" },
- { 0x028e, "QueryDosDeviceA" },
- { 0x028f, "QueryDosDeviceW" },
- { 0x0290, "QueryInformationJobObject" },
- { 0x0291, "QueryMemoryResourceNotification" },
- { 0x0292, "QueryPerformanceCounter" },
- { 0x0293, "QueryPerformanceFrequency" },
- { 0x0294, "QueryWin31IniFilesMappedToRegistry" },
- { 0x0295, "QueueUserAPC" },
- { 0x0296, "QueueUserWorkItem" },
- { 0x0297, "RaiseException" },
- { 0x0298, "ReadConsoleA" },
- { 0x0299, "ReadConsoleInputA" },
- { 0x029a, "ReadConsoleInputExA" },
- { 0x029b, "ReadConsoleInputExW" },
- { 0x029c, "ReadConsoleInputW" },
- { 0x029d, "ReadConsoleOutputA" },
- { 0x029e, "ReadConsoleOutputAttribute" },
- { 0x029f, "ReadConsoleOutputCharacterA" },
- { 0x02a0, "ReadConsoleOutputCharacterW" },
- { 0x02a1, "ReadConsoleOutputW" },
- { 0x02a2, "ReadConsoleW" },
- { 0x02a3, "ReadDirectoryChangesW" },
- { 0x02a4, "ReadFile" },
- { 0x02a5, "ReadFileEx" },
- { 0x02a6, "ReadFileScatter" },
- { 0x02a7, "ReadProcessMemory" },
- { 0x02a8, "RegisterConsoleIME" },
- { 0x02a9, "RegisterConsoleOS2" },
- { 0x02aa, "RegisterConsoleVDM" },
- { 0x02ab, "RegisterWaitForInputIdle" },
- { 0x02ac, "RegisterWaitForSingleObject" },
- { 0x02ad, "RegisterWaitForSingleObjectEx" },
- { 0x02ae, "RegisterWowBaseHandlers" },
- { 0x02af, "RegisterWowExec" },
- { 0x02b0, "ReleaseActCtx" },
- { 0x02b1, "ReleaseMutex" },
- { 0x02b2, "ReleaseSemaphore" },
- { 0x02b3, "RemoveDirectoryA" },
- { 0x02b4, "RemoveDirectoryW" },
- { 0x02b5, "RemoveLocalAlternateComputerNameA" },
- { 0x02b6, "RemoveLocalAlternateComputerNameW" },
- { 0x02b7, "RemoveVectoredExceptionHandler" },
- { 0x02b8, "ReplaceFile" },
- { 0x02b9, "ReplaceFileA" },
- { 0x02ba, "ReplaceFileW" },
- { 0x02bb, "RequestDeviceWakeup" },
- { 0x02bc, "RequestWakeupLatency" },
- { 0x02bd, "ResetEvent" },
- { 0x02be, "ResetWriteWatch" },
- { 0x02bf, "RestoreLastError" },
- { 0x02c0, "ResumeThread" },
- { 0x02c1, "RtlCaptureContext" },
- { 0x02c2, "RtlCaptureStackBackTrace" },
- { 0x02c3, "RtlFillMemory" },
- { 0x02c4, "RtlMoveMemory" },
- { 0x02c5, "RtlUnwind" },
- { 0x02c6, "RtlZeroMemory" },
- { 0x02c7, "ScrollConsoleScreenBufferA" },
- { 0x02c8, "ScrollConsoleScreenBufferW" },
- { 0x02c9, "SearchPathA" },
- { 0x02ca, "SearchPathW" },
- { 0x02cb, "SetCPGlobal" },
- { 0x02cc, "SetCalendarInfoA" },
- { 0x02cd, "SetCalendarInfoW" },
- { 0x02ce, "SetClientTimeZoneInformation" },
- { 0x02cf, "SetComPlusPackageInstallStatus" },
- { 0x02d0, "SetCommBreak" },
- { 0x02d1, "SetCommConfig" },
- { 0x02d2, "SetCommMask" },
- { 0x02d3, "SetCommState" },
- { 0x02d4, "SetCommTimeouts" },
- { 0x02d5, "SetComputerNameA" },
- { 0x02d6, "SetComputerNameExA" },
- { 0x02d7, "SetComputerNameExW" },
- { 0x02d8, "SetComputerNameW" },
- { 0x02d9, "SetConsoleActiveScreenBuffer" },
- { 0x02da, "SetConsoleCP" },
- { 0x02db, "SetConsoleCommandHistoryMode" },
- { 0x02dc, "SetConsoleCtrlHandler" },
- { 0x02dd, "SetConsoleCursor" },
- { 0x02de, "SetConsoleCursorInfo" },
- { 0x02df, "SetConsoleCursorMode" },
- { 0x02e0, "SetConsoleCursorPosition" },
- { 0x02e1, "SetConsoleDisplayMode" },
- { 0x02e2, "SetConsoleFont" },
- { 0x02e3, "SetConsoleHardwareState" },
- { 0x02e4, "SetConsoleIcon" },
- { 0x02e5, "SetConsoleInputExeNameA" },
- { 0x02e6, "SetConsoleInputExeNameW" },
- { 0x02e7, "SetConsoleKeyShortcuts" },
- { 0x02e8, "SetConsoleLocalEUDC" },
- { 0x02e9, "SetConsoleMaximumWindowSize" },
- { 0x02ea, "SetConsoleMenuClose" },
- { 0x02eb, "SetConsoleMode" },
- { 0x02ec, "SetConsoleNlsMode" },
- { 0x02ed, "SetConsoleNumberOfCommandsA" },
- { 0x02ee, "SetConsoleNumberOfCommandsW" },
- { 0x02ef, "SetConsoleOS2OemFormat" },
- { 0x02f0, "SetConsoleOutputCP" },
- { 0x02f1, "SetConsolePalette" },
- { 0x02f2, "SetConsoleScreenBufferSize" },
- { 0x02f3, "SetConsoleTextAttribute" },
- { 0x02f4, "SetConsoleTitleA" },
- { 0x02f5, "SetConsoleTitleW" },
- { 0x02f6, "SetConsoleWindowInfo" },
- { 0x02f7, "SetCriticalSectionSpinCount" },
- { 0x02f8, "SetCurrentDirectoryA" },
- { 0x02f9, "SetCurrentDirectoryW" },
- { 0x02fa, "SetDefaultCommConfigA" },
- { 0x02fb, "SetDefaultCommConfigW" },
- { 0x02fc, "SetDllDirectoryA" },
- { 0x02fd, "SetDllDirectoryW" },
- { 0x02fe, "SetEndOfFile" },
- { 0x02ff, "SetEnvironmentVariableA" },
- { 0x0300, "SetEnvironmentVariableW" },
- { 0x0301, "SetErrorMode" },
- { 0x0302, "SetEvent" },
- { 0x0303, "SetFileApisToANSI" },
- { 0x0304, "SetFileApisToOEM" },
- { 0x0305, "SetFileAttributesA" },
- { 0x0306, "SetFileAttributesW" },
- { 0x0307, "SetFilePointer" },
- { 0x0308, "SetFilePointerEx" },
- { 0x0309, "SetFileShortNameA" },
- { 0x030a, "SetFileShortNameW" },
- { 0x030b, "SetFileTime" },
- { 0x030c, "SetFileValidData" },
- { 0x030d, "SetFirmwareEnvironmentVariableA" },
- { 0x030e, "SetFirmwareEnvironmentVariableW" },
- { 0x030f, "SetHandleContext" },
- { 0x0310, "SetHandleCount" },
- { 0x0311, "SetHandleInformation" },
- { 0x0312, "SetInformationJobObject" },
- { 0x0313, "SetLastConsoleEventActive" },
- { 0x0314, "SetLastError" },
- { 0x0315, "SetLocalPrimaryComputerNameA" },
- { 0x0316, "SetLocalPrimaryComputerNameW" },
- { 0x0317, "SetLocalTime" },
- { 0x0318, "SetLocaleInfoA" },
- { 0x0319, "SetLocaleInfoW" },
- { 0x031a, "SetMailslotInfo" },
- { 0x031b, "SetMessageWaitingIndicator" },
- { 0x031c, "SetNamedPipeHandleState" },
- { 0x031d, "SetPriorityClass" },
- { 0x031e, "SetProcessAffinityMask" },
- { 0x031f, "SetProcessPriorityBoost" },
- { 0x0320, "SetProcessShutdownParameters" },
- { 0x0321, "SetProcessWorkingSetSize" },
- { 0x0322, "SetStdHandle" },
- { 0x0323, "SetSystemPowerState" },
- { 0x0324, "SetSystemTime" },
- { 0x0325, "SetSystemTimeAdjustment" },
- { 0x0326, "SetTapeParameters" },
- { 0x0327, "SetTapePosition" },
- { 0x0328, "SetTermsrvAppInstallMode" },
- { 0x0329, "SetThreadAffinityMask" },
- { 0x032a, "SetThreadContext" },
- { 0x032b, "SetThreadExecutionState" },
- { 0x032c, "SetThreadIdealProcessor" },
- { 0x032d, "SetThreadLocale" },
- { 0x032e, "SetThreadPriority" },
- { 0x032f, "SetThreadPriorityBoost" },
- { 0x0330, "SetThreadUILanguage" },
- { 0x0331, "SetTimeZoneInformation" },
- { 0x0332, "SetTimerQueueTimer" },
- { 0x0333, "SetUnhandledExceptionFilter" },
- { 0x0334, "SetUserGeoID" },
- { 0x0335, "SetVDMCurrentDirectories" },
- { 0x0336, "SetVolumeLabelA" },
- { 0x0337, "SetVolumeLabelW" },
- { 0x0338, "SetVolumeMountPointA" },
- { 0x0339, "SetVolumeMountPointW" },
- { 0x033a, "SetWaitableTimer" },
- { 0x033b, "SetupComm" },
- { 0x033c, "ShowConsoleCursor" },
- { 0x033d, "SignalObjectAndWait" },
- { 0x033e, "SizeofResource" },
- { 0x033f, "Sleep" },
- { 0x0340, "SleepEx" },
- { 0x0341, "SuspendThread" },
- { 0x0342, "SwitchToFiber" },
- { 0x0343, "SwitchToThread" },
- { 0x0344, "SystemTimeToFileTime" },
- { 0x0345, "SystemTimeToTzSpecificLocalTime" },
- { 0x0346, "TerminateJobObject" },
- { 0x0347, "TerminateProcess" },
- { 0x0348, "TerminateThread" },
- { 0x0349, "TermsrvAppInstallMode" },
- { 0x034a, "Thread32First" },
- { 0x034b, "Thread32Next" },
- { 0x034c, "TlsAlloc" },
- { 0x034d, "TlsFree" },
- { 0x034e, "TlsGetValue" },
- { 0x034f, "TlsSetValue" },
- { 0x0350, "Toolhelp32ReadProcessMemory" },
- { 0x0351, "TransactNamedPipe" },
- { 0x0352, "TransmitCommChar" },
- { 0x0353, "TrimVirtualBuffer" },
- { 0x0354, "TryEnterCriticalSection" },
- { 0x0355, "TzSpecificLocalTimeToSystemTime" },
- { 0x0356, "UTRegister" },
- { 0x0357, "UTUnRegister" },
- { 0x0358, "UnhandledExceptionFilter" },
- { 0x0359, "UnlockFile" },
- { 0x035a, "UnlockFileEx" },
- { 0x035b, "UnmapViewOfFile" },
- { 0x035c, "UnregisterConsoleIME" },
- { 0x035d, "UnregisterWait" },
- { 0x035e, "UnregisterWaitEx" },
- { 0x035f, "UpdateResourceA" },
- { 0x0360, "UpdateResourceW" },
- { 0x0361, "VDMConsoleOperation" },
- { 0x0362, "VDMOperationStarted" },
- { 0x0363, "ValidateLCType" },
- { 0x0364, "ValidateLocale" },
- { 0x0365, "VerLanguageNameA" },
- { 0x0366, "VerLanguageNameW" },
- { 0x0367, "VerSetConditionMask" },
- { 0x0368, "VerifyConsoleIoHandle" },
- { 0x0369, "VerifyVersionInfoA" },
- { 0x036a, "VerifyVersionInfoW" },
- { 0x036b, "VirtualAlloc" },
- { 0x036c, "VirtualAllocEx" },
- { 0x036d, "VirtualBufferExceptionHandler" },
- { 0x036e, "VirtualFree" },
- { 0x036f, "VirtualFreeEx" },
- { 0x0370, "VirtualLock" },
- { 0x0371, "VirtualProtect" },
- { 0x0372, "VirtualProtectEx" },
- { 0x0373, "VirtualQuery" },
- { 0x0374, "VirtualQueryEx" },
- { 0x0375, "VirtualUnlock" },
- { 0x0376, "WTSGetActiveConsoleSessionId" },
- { 0x0377, "WaitCommEvent" },
- { 0x0378, "WaitForDebugEvent" },
- { 0x0379, "WaitForMultipleObjects" },
- { 0x037a, "WaitForMultipleObjectsEx" },
- { 0x037b, "WaitForSingleObject" },
- { 0x037c, "WaitForSingleObjectEx" },
- { 0x037d, "WaitNamedPipeA" },
- { 0x037e, "WaitNamedPipeW" },
- { 0x037f, "WideCharToMultiByte" },
- { 0x0380, "WinExec" },
- { 0x0381, "WriteConsoleA" },
- { 0x0382, "WriteConsoleInputA" },
- { 0x0383, "WriteConsoleInputVDMA" },
- { 0x0384, "WriteConsoleInputVDMW" },
- { 0x0385, "WriteConsoleInputW" },
- { 0x0386, "WriteConsoleOutputA" },
- { 0x0387, "WriteConsoleOutputAttribute" },
- { 0x0388, "WriteConsoleOutputCharacterA" },
- { 0x0389, "WriteConsoleOutputCharacterW" },
- { 0x038a, "WriteConsoleOutputW" },
- { 0x038b, "WriteConsoleW" },
- { 0x038c, "WriteFile" },
- { 0x038d, "WriteFileEx" },
- { 0x038e, "WriteFileGather" },
- { 0x038f, "WritePrivateProfileSectionA" },
- { 0x0390, "WritePrivateProfileSectionW" },
- { 0x0391, "WritePrivateProfileStringA" },
- { 0x0392, "WritePrivateProfileStringW" },
- { 0x0393, "WritePrivateProfileStructA" },
- { 0x0394, "WritePrivateProfileStructW" },
- { 0x0395, "WriteProcessMemory" },
- { 0x0396, "WriteProfileSectionA" },
- { 0x0397, "WriteProfileSectionW" },
- { 0x0398, "WriteProfileStringA" },
- { 0x0399, "WriteProfileStringW" },
- { 0x039a, "WriteTapemark" },
- { 0x039b, "ZombifyActCtx" },
- { 0x039c, "_hread" },
- { 0x039d, "_hwrite" },
- { 0x039e, "_lclose" },
- { 0x039f, "_lcreat" },
- { 0x03a0, "_llseek" },
- { 0x03a1, "_lopen" },
- { 0x03a2, "_lread" },
- { 0x03a3, "_lwrite" },
- { 0x03a4, "lstrcat" },
- { 0x03a5, "lstrcatA" },
- { 0x03a6, "lstrcatW" },
- { 0x03a7, "lstrcmp" },
- { 0x03a8, "lstrcmpA" },
- { 0x03a9, "lstrcmpW" },
- { 0x03aa, "lstrcmpi" },
- { 0x03ab, "lstrcmpiA" },
- { 0x03ac, "lstrcmpiW" },
- { 0x03ad, "lstrcpy" },
- { 0x03ae, "lstrcpyA" },
- { 0x03af, "lstrcpyW" },
- { 0x03b0, "lstrcpyn" },
- { 0x03b1, "lstrcpynA" },
- { 0x03b2, "lstrcpynW" },
- { 0x03b3, "lstrlen" },
- { 0x03b4, "lstrlenA" },
- { 0x03b5, "lstrlenW" },
-};
+const char* kernel32_dll_lookup(uint32_t i) {
+ switch(i) {
+ case 0x0001: return "ActivateActCtx";
+ case 0x0002: return "AddAtomA";
+ case 0x0003: return "AddAtomW";
+ case 0x0004: return "AddConsoleAliasA";
+ case 0x0005: return "AddConsoleAliasW";
+ case 0x0006: return "AddLocalAlternateComputerNameA";
+ case 0x0007: return "AddLocalAlternateComputerNameW";
+ case 0x0008: return "AddRefActCtx";
+ case 0x0009: return "AddVectoredExceptionHandler";
+ case 0x000a: return "AllocConsole";
+ case 0x000b: return "AllocateUserPhysicalPages";
+ case 0x000c: return "AreFileApisANSI";
+ case 0x000d: return "AssignProcessToJobObject";
+ case 0x000e: return "AttachConsole";
+ case 0x000f: return "BackupRead";
+ case 0x0010: return "BackupSeek";
+ case 0x0011: return "BackupWrite";
+ case 0x0012: return "BaseCheckAppcompatCache";
+ case 0x0013: return "BaseCleanupAppcompatCache";
+ case 0x0014: return "BaseCleanupAppcompatCacheSupport";
+ case 0x0015: return "BaseDumpAppcompatCache";
+ case 0x0016: return "BaseFlushAppcompatCache";
+ case 0x0017: return "BaseInitAppcompatCache";
+ case 0x0018: return "BaseInitAppcompatCacheSupport";
+ case 0x0019: return "BaseProcessInitPostImport";
+ case 0x001a: return "BaseQueryModuleData";
+ case 0x001b: return "BaseUpdateAppcompatCache";
+ case 0x001c: return "BasepCheckWinSaferRestrictions";
+ case 0x001d: return "Beep";
+ case 0x001e: return "BeginUpdateResourceA";
+ case 0x001f: return "BeginUpdateResourceW";
+ case 0x0020: return "BindIoCompletionCallback";
+ case 0x0021: return "BuildCommDCBA";
+ case 0x0022: return "BuildCommDCBAndTimeoutsA";
+ case 0x0023: return "BuildCommDCBAndTimeoutsW";
+ case 0x0024: return "BuildCommDCBW";
+ case 0x0025: return "CallNamedPipeA";
+ case 0x0026: return "CallNamedPipeW";
+ case 0x0027: return "CancelDeviceWakeupRequest";
+ case 0x0028: return "CancelIo";
+ case 0x0029: return "CancelTimerQueueTimer";
+ case 0x002a: return "CancelWaitableTimer";
+ case 0x002b: return "ChangeTimerQueueTimer";
+ case 0x002c: return "CheckNameLegalDOS8Dot3A";
+ case 0x002d: return "CheckNameLegalDOS8Dot3W";
+ case 0x002e: return "CheckRemoteDebuggerPresent";
+ case 0x002f: return "ClearCommBreak";
+ case 0x0030: return "ClearCommError";
+ case 0x0031: return "CloseConsoleHandle";
+ case 0x0032: return "CloseHandle";
+ case 0x0033: return "CloseProfileUserMapping";
+ case 0x0034: return "CmdBatNotification";
+ case 0x0035: return "CommConfigDialogA";
+ case 0x0036: return "CommConfigDialogW";
+ case 0x0037: return "CompareFileTime";
+ case 0x0038: return "CompareStringA";
+ case 0x0039: return "CompareStringW";
+ case 0x003a: return "ConnectNamedPipe";
+ case 0x003b: return "ConsoleMenuControl";
+ case 0x003c: return "ContinueDebugEvent";
+ case 0x003d: return "ConvertDefaultLocale";
+ case 0x003e: return "ConvertFiberToThread";
+ case 0x003f: return "ConvertThreadToFiber";
+ case 0x0040: return "CopyFileA";
+ case 0x0041: return "CopyFileExA";
+ case 0x0042: return "CopyFileExW";
+ case 0x0043: return "CopyFileW";
+ case 0x0044: return "CopyLZFile";
+ case 0x0045: return "CreateActCtxA";
+ case 0x0046: return "CreateActCtxW";
+ case 0x0047: return "CreateConsoleScreenBuffer";
+ case 0x0048: return "CreateDirectoryA";
+ case 0x0049: return "CreateDirectoryExA";
+ case 0x004a: return "CreateDirectoryExW";
+ case 0x004b: return "CreateDirectoryW";
+ case 0x004c: return "CreateEventA";
+ case 0x004d: return "CreateEventW";
+ case 0x004e: return "CreateFiber";
+ case 0x004f: return "CreateFiberEx";
+ case 0x0050: return "CreateFileA";
+ case 0x0051: return "CreateFileMappingA";
+ case 0x0052: return "CreateFileMappingW";
+ case 0x0053: return "CreateFileW";
+ case 0x0054: return "CreateHardLinkA";
+ case 0x0055: return "CreateHardLinkW";
+ case 0x0056: return "CreateIoCompletionPort";
+ case 0x0057: return "CreateJobObjectA";
+ case 0x0058: return "CreateJobObjectW";
+ case 0x0059: return "CreateJobSet";
+ case 0x005a: return "CreateMailslotA";
+ case 0x005b: return "CreateMailslotW";
+ case 0x005c: return "CreateMemoryResourceNotification";
+ case 0x005d: return "CreateMutexA";
+ case 0x005e: return "CreateMutexW";
+ case 0x005f: return "CreateNamedPipeA";
+ case 0x0060: return "CreateNamedPipeW";
+ case 0x0061: return "CreateNlsSecurityDescriptor";
+ case 0x0062: return "CreatePipe";
+ case 0x0063: return "CreateProcessA";
+ case 0x0064: return "CreateProcessInternalA";
+ case 0x0065: return "CreateProcessInternalW";
+ case 0x0066: return "CreateProcessInternalWSecure";
+ case 0x0067: return "CreateProcessW";
+ case 0x0068: return "CreateRemoteThread";
+ case 0x0069: return "CreateSemaphoreA";
+ case 0x006a: return "CreateSemaphoreW";
+ case 0x006b: return "CreateSocketHandle";
+ case 0x006c: return "CreateTapePartition";
+ case 0x006d: return "CreateThread";
+ case 0x006e: return "CreateTimerQueue";
+ case 0x006f: return "CreateTimerQueueTimer";
+ case 0x0070: return "CreateToolhelp32Snapshot";
+ case 0x0071: return "CreateVirtualBuffer";
+ case 0x0072: return "CreateWaitableTimerA";
+ case 0x0073: return "CreateWaitableTimerW";
+ case 0x0074: return "DeactivateActCtx";
+ case 0x0075: return "DebugActiveProcess";
+ case 0x0076: return "DebugActiveProcessStop";
+ case 0x0077: return "DebugBreak";
+ case 0x0078: return "DebugBreakProcess";
+ case 0x0079: return "DebugSetProcessKillOnExit";
+ case 0x007a: return "DecodePointer";
+ case 0x007b: return "DecodeSystemPointer";
+ case 0x007c: return "DefineDosDeviceA";
+ case 0x007d: return "DefineDosDeviceW";
+ case 0x007e: return "DelayLoadFailureHook";
+ case 0x007f: return "DeleteAtom";
+ case 0x0080: return "DeleteCriticalSection";
+ case 0x0081: return "DeleteFiber";
+ case 0x0082: return "DeleteFileA";
+ case 0x0083: return "DeleteFileW";
+ case 0x0084: return "DeleteTimerQueue";
+ case 0x0085: return "DeleteTimerQueueEx";
+ case 0x0086: return "DeleteTimerQueueTimer";
+ case 0x0087: return "DeleteVolumeMountPointA";
+ case 0x0088: return "DeleteVolumeMountPointW";
+ case 0x0089: return "DeviceIoControl";
+ case 0x008a: return "DisableThreadLibraryCalls";
+ case 0x008b: return "DisconnectNamedPipe";
+ case 0x008c: return "DnsHostnameToComputerNameA";
+ case 0x008d: return "DnsHostnameToComputerNameW";
+ case 0x008e: return "DosDateTimeToFileTime";
+ case 0x008f: return "DosPathToSessionPathA";
+ case 0x0090: return "DosPathToSessionPathW";
+ case 0x0091: return "DuplicateConsoleHandle";
+ case 0x0092: return "DuplicateHandle";
+ case 0x0093: return "EncodePointer";
+ case 0x0094: return "EncodeSystemPointer";
+ case 0x0095: return "EndUpdateResourceA";
+ case 0x0096: return "EndUpdateResourceW";
+ case 0x0097: return "EnterCriticalSection";
+ case 0x0098: return "EnumCalendarInfoA";
+ case 0x0099: return "EnumCalendarInfoExA";
+ case 0x009a: return "EnumCalendarInfoExW";
+ case 0x009b: return "EnumCalendarInfoW";
+ case 0x009c: return "EnumDateFormatsA";
+ case 0x009d: return "EnumDateFormatsExA";
+ case 0x009e: return "EnumDateFormatsExW";
+ case 0x009f: return "EnumDateFormatsW";
+ case 0x00a0: return "EnumLanguageGroupLocalesA";
+ case 0x00a1: return "EnumLanguageGroupLocalesW";
+ case 0x00a2: return "EnumResourceLanguagesA";
+ case 0x00a3: return "EnumResourceLanguagesW";
+ case 0x00a4: return "EnumResourceNamesA";
+ case 0x00a5: return "EnumResourceNamesW";
+ case 0x00a6: return "EnumResourceTypesA";
+ case 0x00a7: return "EnumResourceTypesW";
+ case 0x00a8: return "EnumSystemCodePagesA";
+ case 0x00a9: return "EnumSystemCodePagesW";
+ case 0x00aa: return "EnumSystemGeoID";
+ case 0x00ab: return "EnumSystemLanguageGroupsA";
+ case 0x00ac: return "EnumSystemLanguageGroupsW";
+ case 0x00ad: return "EnumSystemLocalesA";
+ case 0x00ae: return "EnumSystemLocalesW";
+ case 0x00af: return "EnumTimeFormatsA";
+ case 0x00b0: return "EnumTimeFormatsW";
+ case 0x00b1: return "EnumUILanguagesA";
+ case 0x00b2: return "EnumUILanguagesW";
+ case 0x00b3: return "EnumerateLocalComputerNamesA";
+ case 0x00b4: return "EnumerateLocalComputerNamesW";
+ case 0x00b5: return "EraseTape";
+ case 0x00b6: return "EscapeCommFunction";
+ case 0x00b7: return "ExitProcess";
+ case 0x00b8: return "ExitThread";
+ case 0x00b9: return "ExitVDM";
+ case 0x00ba: return "ExpandEnvironmentStringsA";
+ case 0x00bb: return "ExpandEnvironmentStringsW";
+ case 0x00bc: return "ExpungeConsoleCommandHistoryA";
+ case 0x00bd: return "ExpungeConsoleCommandHistoryW";
+ case 0x00be: return "ExtendVirtualBuffer";
+ case 0x00bf: return "FatalAppExitA";
+ case 0x00c0: return "FatalAppExitW";
+ case 0x00c1: return "FatalExit";
+ case 0x00c2: return "FileTimeToDosDateTime";
+ case 0x00c3: return "FileTimeToLocalFileTime";
+ case 0x00c4: return "FileTimeToSystemTime";
+ case 0x00c5: return "FillConsoleOutputAttribute";
+ case 0x00c6: return "FillConsoleOutputCharacterA";
+ case 0x00c7: return "FillConsoleOutputCharacterW";
+ case 0x00c8: return "FindActCtxSectionGuid";
+ case 0x00c9: return "FindActCtxSectionStringA";
+ case 0x00ca: return "FindActCtxSectionStringW";
+ case 0x00cb: return "FindAtomA";
+ case 0x00cc: return "FindAtomW";
+ case 0x00cd: return "FindClose";
+ case 0x00ce: return "FindCloseChangeNotification";
+ case 0x00cf: return "FindFirstChangeNotificationA";
+ case 0x00d0: return "FindFirstChangeNotificationW";
+ case 0x00d1: return "FindFirstFileA";
+ case 0x00d2: return "FindFirstFileExA";
+ case 0x00d3: return "FindFirstFileExW";
+ case 0x00d4: return "FindFirstFileW";
+ case 0x00d5: return "FindFirstVolumeA";
+ case 0x00d6: return "FindFirstVolumeMountPointA";
+ case 0x00d7: return "FindFirstVolumeMountPointW";
+ case 0x00d8: return "FindFirstVolumeW";
+ case 0x00d9: return "FindNextChangeNotification";
+ case 0x00da: return "FindNextFileA";
+ case 0x00db: return "FindNextFileW";
+ case 0x00dc: return "FindNextVolumeA";
+ case 0x00dd: return "FindNextVolumeMountPointA";
+ case 0x00de: return "FindNextVolumeMountPointW";
+ case 0x00df: return "FindNextVolumeW";
+ case 0x00e0: return "FindResourceA";
+ case 0x00e1: return "FindResourceExA";
+ case 0x00e2: return "FindResourceExW";
+ case 0x00e3: return "FindResourceW";
+ case 0x00e4: return "FindVolumeClose";
+ case 0x00e5: return "FindVolumeMountPointClose";
+ case 0x00e6: return "FlushConsoleInputBuffer";
+ case 0x00e7: return "FlushFileBuffers";
+ case 0x00e8: return "FlushInstructionCache";
+ case 0x00e9: return "FlushViewOfFile";
+ case 0x00ea: return "FoldStringA";
+ case 0x00eb: return "FoldStringW";
+ case 0x00ec: return "FormatMessageA";
+ case 0x00ed: return "FormatMessageW";
+ case 0x00ee: return "FreeConsole";
+ case 0x00ef: return "FreeEnvironmentStringsA";
+ case 0x00f0: return "FreeEnvironmentStringsW";
+ case 0x00f1: return "FreeLibrary";
+ case 0x00f2: return "FreeLibraryAndExitThread";
+ case 0x00f3: return "FreeResource";
+ case 0x00f4: return "FreeUserPhysicalPages";
+ case 0x00f5: return "FreeVirtualBuffer";
+ case 0x00f6: return "GenerateConsoleCtrlEvent";
+ case 0x00f7: return "GetACP";
+ case 0x00f8: return "GetAtomNameA";
+ case 0x00f9: return "GetAtomNameW";
+ case 0x00fa: return "GetBinaryType";
+ case 0x00fb: return "GetBinaryTypeA";
+ case 0x00fc: return "GetBinaryTypeW";
+ case 0x00fd: return "GetCPFileNameFromRegistry";
+ case 0x00fe: return "GetCPInfo";
+ case 0x00ff: return "GetCPInfoExA";
+ case 0x0100: return "GetCPInfoExW";
+ case 0x0101: return "GetCalendarInfoA";
+ case 0x0102: return "GetCalendarInfoW";
+ case 0x0103: return "GetComPlusPackageInstallStatus";
+ case 0x0104: return "GetCommConfig";
+ case 0x0105: return "GetCommMask";
+ case 0x0106: return "GetCommModemStatus";
+ case 0x0107: return "GetCommProperties";
+ case 0x0108: return "GetCommState";
+ case 0x0109: return "GetCommTimeouts";
+ case 0x010a: return "GetCommandLineA";
+ case 0x010b: return "GetCommandLineW";
+ case 0x010c: return "GetCompressedFileSizeA";
+ case 0x010d: return "GetCompressedFileSizeW";
+ case 0x010e: return "GetComputerNameA";
+ case 0x010f: return "GetComputerNameExA";
+ case 0x0110: return "GetComputerNameExW";
+ case 0x0111: return "GetComputerNameW";
+ case 0x0112: return "GetConsoleAliasA";
+ case 0x0113: return "GetConsoleAliasExesA";
+ case 0x0114: return "GetConsoleAliasExesLengthA";
+ case 0x0115: return "GetConsoleAliasExesLengthW";
+ case 0x0116: return "GetConsoleAliasExesW";
+ case 0x0117: return "GetConsoleAliasW";
+ case 0x0118: return "GetConsoleAliasesA";
+ case 0x0119: return "GetConsoleAliasesLengthA";
+ case 0x011a: return "GetConsoleAliasesLengthW";
+ case 0x011b: return "GetConsoleAliasesW";
+ case 0x011c: return "GetConsoleCP";
+ case 0x011d: return "GetConsoleCharType";
+ case 0x011e: return "GetConsoleCommandHistoryA";
+ case 0x011f: return "GetConsoleCommandHistoryLengthA";
+ case 0x0120: return "GetConsoleCommandHistoryLengthW";
+ case 0x0121: return "GetConsoleCommandHistoryW";
+ case 0x0122: return "GetConsoleCursorInfo";
+ case 0x0123: return "GetConsoleCursorMode";
+ case 0x0124: return "GetConsoleDisplayMode";
+ case 0x0125: return "GetConsoleFontInfo";
+ case 0x0126: return "GetConsoleFontSize";
+ case 0x0127: return "GetConsoleHardwareState";
+ case 0x0128: return "GetConsoleInputExeNameA";
+ case 0x0129: return "GetConsoleInputExeNameW";
+ case 0x012a: return "GetConsoleInputWaitHandle";
+ case 0x012b: return "GetConsoleKeyboardLayoutNameA";
+ case 0x012c: return "GetConsoleKeyboardLayoutNameW";
+ case 0x012d: return "GetConsoleMode";
+ case 0x012e: return "GetConsoleNlsMode";
+ case 0x012f: return "GetConsoleOutputCP";
+ case 0x0130: return "GetConsoleProcessList";
+ case 0x0131: return "GetConsoleScreenBufferInfo";
+ case 0x0132: return "GetConsoleSelectionInfo";
+ case 0x0133: return "GetConsoleTitleA";
+ case 0x0134: return "GetConsoleTitleW";
+ case 0x0135: return "GetConsoleWindow";
+ case 0x0136: return "GetCurrencyFormatA";
+ case 0x0137: return "GetCurrencyFormatW";
+ case 0x0138: return "GetCurrentActCtx";
+ case 0x0139: return "GetCurrentConsoleFont";
+ case 0x013a: return "GetCurrentDirectoryA";
+ case 0x013b: return "GetCurrentDirectoryW";
+ case 0x013c: return "GetCurrentProcess";
+ case 0x013d: return "GetCurrentProcessId";
+ case 0x013e: return "GetCurrentThread";
+ case 0x013f: return "GetCurrentThreadId";
+ case 0x0140: return "GetDateFormatA";
+ case 0x0141: return "GetDateFormatW";
+ case 0x0142: return "GetDefaultCommConfigA";
+ case 0x0143: return "GetDefaultCommConfigW";
+ case 0x0144: return "GetDefaultSortkeySize";
+ case 0x0145: return "GetDevicePowerState";
+ case 0x0146: return "GetDiskFreeSpaceA";
+ case 0x0147: return "GetDiskFreeSpaceExA";
+ case 0x0148: return "GetDiskFreeSpaceExW";
+ case 0x0149: return "GetDiskFreeSpaceW";
+ case 0x014a: return "GetDllDirectoryA";
+ case 0x014b: return "GetDllDirectoryW";
+ case 0x014c: return "GetDriveTypeA";
+ case 0x014d: return "GetDriveTypeW";
+ case 0x014e: return "GetEnvironmentStrings";
+ case 0x014f: return "GetEnvironmentStringsA";
+ case 0x0150: return "GetEnvironmentStringsW";
+ case 0x0151: return "GetEnvironmentVariableA";
+ case 0x0152: return "GetEnvironmentVariableW";
+ case 0x0153: return "GetExitCodeProcess";
+ case 0x0154: return "GetExitCodeThread";
+ case 0x0155: return "GetExpandedNameA";
+ case 0x0156: return "GetExpandedNameW";
+ case 0x0157: return "GetFileAttributesA";
+ case 0x0158: return "GetFileAttributesExA";
+ case 0x0159: return "GetFileAttributesExW";
+ case 0x015a: return "GetFileAttributesW";
+ case 0x015b: return "GetFileInformationByHandle";
+ case 0x015c: return "GetFileSize";
+ case 0x015d: return "GetFileSizeEx";
+ case 0x015e: return "GetFileTime";
+ case 0x015f: return "GetFileType";
+ case 0x0160: return "GetFirmwareEnvironmentVariableA";
+ case 0x0161: return "GetFirmwareEnvironmentVariableW";
+ case 0x0162: return "GetFullPathNameA";
+ case 0x0163: return "GetFullPathNameW";
+ case 0x0164: return "GetGeoInfoA";
+ case 0x0165: return "GetGeoInfoW";
+ case 0x0166: return "GetHandleContext";
+ case 0x0167: return "GetHandleInformation";
+ case 0x0168: return "GetLargestConsoleWindowSize";
+ case 0x0169: return "GetLastError";
+ case 0x016a: return "GetLinguistLangSize";
+ case 0x016b: return "GetLocalTime";
+ case 0x016c: return "GetLocaleInfoA";
+ case 0x016d: return "GetLocaleInfoW";
+ case 0x016e: return "GetLogicalDriveStringsA";
+ case 0x016f: return "GetLogicalDriveStringsW";
+ case 0x0170: return "GetLogicalDrives";
+ case 0x0171: return "GetLongPathNameA";
+ case 0x0172: return "GetLongPathNameW";
+ case 0x0173: return "GetMailslotInfo";
+ case 0x0174: return "GetModuleFileNameA";
+ case 0x0175: return "GetModuleFileNameW";
+ case 0x0176: return "GetModuleHandleA";
+ case 0x0177: return "GetModuleHandleExA";
+ case 0x0178: return "GetModuleHandleExW";
+ case 0x0179: return "GetModuleHandleW";
+ case 0x017a: return "GetNamedPipeHandleStateA";
+ case 0x017b: return "GetNamedPipeHandleStateW";
+ case 0x017c: return "GetNamedPipeInfo";
+ case 0x017d: return "GetNativeSystemInfo";
+ case 0x017e: return "GetNextVDMCommand";
+ case 0x017f: return "GetNlsSectionName";
+ case 0x0180: return "GetNumaAvailableMemory";
+ case 0x0181: return "GetNumaAvailableMemoryNode";
+ case 0x0182: return "GetNumaHighestNodeNumber";
+ case 0x0183: return "GetNumaNodeProcessorMask";
+ case 0x0184: return "GetNumaProcessorMap";
+ case 0x0185: return "GetNumaProcessorNode";
+ case 0x0186: return "GetNumberFormatA";
+ case 0x0187: return "GetNumberFormatW";
+ case 0x0188: return "GetNumberOfConsoleFonts";
+ case 0x0189: return "GetNumberOfConsoleInputEvents";
+ case 0x018a: return "GetNumberOfConsoleMouseButtons";
+ case 0x018b: return "GetOEMCP";
+ case 0x018c: return "GetOverlappedResult";
+ case 0x018d: return "GetPriorityClass";
+ case 0x018e: return "GetPrivateProfileIntA";
+ case 0x018f: return "GetPrivateProfileIntW";
+ case 0x0190: return "GetPrivateProfileSectionA";
+ case 0x0191: return "GetPrivateProfileSectionNamesA";
+ case 0x0192: return "GetPrivateProfileSectionNamesW";
+ case 0x0193: return "GetPrivateProfileSectionW";
+ case 0x0194: return "GetPrivateProfileStringA";
+ case 0x0195: return "GetPrivateProfileStringW";
+ case 0x0196: return "GetPrivateProfileStructA";
+ case 0x0197: return "GetPrivateProfileStructW";
+ case 0x0198: return "GetProcAddress";
+ case 0x0199: return "GetProcessAffinityMask";
+ case 0x019a: return "GetProcessHandleCount";
+ case 0x019b: return "GetProcessHeap";
+ case 0x019c: return "GetProcessHeaps";
+ case 0x019d: return "GetProcessId";
+ case 0x019e: return "GetProcessIoCounters";
+ case 0x019f: return "GetProcessPriorityBoost";
+ case 0x01a0: return "GetProcessShutdownParameters";
+ case 0x01a1: return "GetProcessTimes";
+ case 0x01a2: return "GetProcessVersion";
+ case 0x01a3: return "GetProcessWorkingSetSize";
+ case 0x01a4: return "GetProfileIntA";
+ case 0x01a5: return "GetProfileIntW";
+ case 0x01a6: return "GetProfileSectionA";
+ case 0x01a7: return "GetProfileSectionW";
+ case 0x01a8: return "GetProfileStringA";
+ case 0x01a9: return "GetProfileStringW";
+ case 0x01aa: return "GetQueuedCompletionStatus";
+ case 0x01ab: return "GetShortPathNameA";
+ case 0x01ac: return "GetShortPathNameW";
+ case 0x01ad: return "GetStartupInfoA";
+ case 0x01ae: return "GetStartupInfoW";
+ case 0x01af: return "GetStdHandle";
+ case 0x01b0: return "GetStringTypeA";
+ case 0x01b1: return "GetStringTypeExA";
+ case 0x01b2: return "GetStringTypeExW";
+ case 0x01b3: return "GetStringTypeW";
+ case 0x01b4: return "GetSystemDefaultLCID";
+ case 0x01b5: return "GetSystemDefaultLangID";
+ case 0x01b6: return "GetSystemDefaultUILanguage";
+ case 0x01b7: return "GetSystemDirectoryA";
+ case 0x01b8: return "GetSystemDirectoryW";
+ case 0x01b9: return "GetSystemInfo";
+ case 0x01ba: return "GetSystemPowerStatus";
+ case 0x01bb: return "GetSystemRegistryQuota";
+ case 0x01bc: return "GetSystemTime";
+ case 0x01bd: return "GetSystemTimeAdjustment";
+ case 0x01be: return "GetSystemTimeAsFileTime";
+ case 0x01bf: return "GetSystemTimes";
+ case 0x01c0: return "GetSystemWindowsDirectoryA";
+ case 0x01c1: return "GetSystemWindowsDirectoryW";
+ case 0x01c2: return "GetSystemWow64DirectoryA";
+ case 0x01c3: return "GetSystemWow64DirectoryW";
+ case 0x01c4: return "GetTapeParameters";
+ case 0x01c5: return "GetTapePosition";
+ case 0x01c6: return "GetTapeStatus";
+ case 0x01c7: return "GetTempFileNameA";
+ case 0x01c8: return "GetTempFileNameW";
+ case 0x01c9: return "GetTempPathA";
+ case 0x01ca: return "GetTempPathW";
+ case 0x01cb: return "GetThreadContext";
+ case 0x01cc: return "GetThreadIOPendingFlag";
+ case 0x01cd: return "GetThreadLocale";
+ case 0x01ce: return "GetThreadPriority";
+ case 0x01cf: return "GetThreadPriorityBoost";
+ case 0x01d0: return "GetThreadSelectorEntry";
+ case 0x01d1: return "GetThreadTimes";
+ case 0x01d2: return "GetTickCount";
+ case 0x01d3: return "GetTimeFormatA";
+ case 0x01d4: return "GetTimeFormatW";
+ case 0x01d5: return "GetTimeZoneInformation";
+ case 0x01d6: return "GetUserDefaultLCID";
+ case 0x01d7: return "GetUserDefaultLangID";
+ case 0x01d8: return "GetUserDefaultUILanguage";
+ case 0x01d9: return "GetUserGeoID";
+ case 0x01da: return "GetVDMCurrentDirectories";
+ case 0x01db: return "GetVersion";
+ case 0x01dc: return "GetVersionExA";
+ case 0x01dd: return "GetVersionExW";
+ case 0x01de: return "GetVolumeInformationA";
+ case 0x01df: return "GetVolumeInformationW";
+ case 0x01e0: return "GetVolumeNameForVolumeMountPointA";
+ case 0x01e1: return "GetVolumeNameForVolumeMountPointW";
+ case 0x01e2: return "GetVolumePathNameA";
+ case 0x01e3: return "GetVolumePathNameW";
+ case 0x01e4: return "GetVolumePathNamesForVolumeNameA";
+ case 0x01e5: return "GetVolumePathNamesForVolumeNameW";
+ case 0x01e6: return "GetWindowsDirectoryA";
+ case 0x01e7: return "GetWindowsDirectoryW";
+ case 0x01e8: return "GetWriteWatch";
+ case 0x01e9: return "GlobalAddAtomA";
+ case 0x01ea: return "GlobalAddAtomW";
+ case 0x01eb: return "GlobalAlloc";
+ case 0x01ec: return "GlobalCompact";
+ case 0x01ed: return "GlobalDeleteAtom";
+ case 0x01ee: return "GlobalFindAtomA";
+ case 0x01ef: return "GlobalFindAtomW";
+ case 0x01f0: return "GlobalFix";
+ case 0x01f1: return "GlobalFlags";
+ case 0x01f2: return "GlobalFree";
+ case 0x01f3: return "GlobalGetAtomNameA";
+ case 0x01f4: return "GlobalGetAtomNameW";
+ case 0x01f5: return "GlobalHandle";
+ case 0x01f6: return "GlobalLock";
+ case 0x01f7: return "GlobalMemoryStatus";
+ case 0x01f8: return "GlobalMemoryStatusEx";
+ case 0x01f9: return "GlobalReAlloc";
+ case 0x01fa: return "GlobalSize";
+ case 0x01fb: return "GlobalUnWire";
+ case 0x01fc: return "GlobalUnfix";
+ case 0x01fd: return "GlobalUnlock";
+ case 0x01fe: return "GlobalWire";
+ case 0x01ff: return "Heap32First";
+ case 0x0200: return "Heap32ListFirst";
+ case 0x0201: return "Heap32ListNext";
+ case 0x0202: return "Heap32Next";
+ case 0x0203: return "HeapAlloc";
+ case 0x0204: return "HeapCompact";
+ case 0x0205: return "HeapCreate";
+ case 0x0206: return "HeapCreateTagsW";
+ case 0x0207: return "HeapDestroy";
+ case 0x0208: return "HeapExtend";
+ case 0x0209: return "HeapFree";
+ case 0x020a: return "HeapLock";
+ case 0x020b: return "HeapQueryInformation";
+ case 0x020c: return "HeapQueryTagW";
+ case 0x020d: return "HeapReAlloc";
+ case 0x020e: return "HeapSetInformation";
+ case 0x020f: return "HeapSize";
+ case 0x0210: return "HeapSummary";
+ case 0x0211: return "HeapUnlock";
+ case 0x0212: return "HeapUsage";
+ case 0x0213: return "HeapValidate";
+ case 0x0214: return "HeapWalk";
+ case 0x0215: return "InitAtomTable";
+ case 0x0216: return "InitializeCriticalSection";
+ case 0x0217: return "InitializeCriticalSectionAndSpinCount";
+ case 0x0218: return "InitializeSListHead";
+ case 0x0219: return "InterlockedCompareExchange";
+ case 0x021a: return "InterlockedDecrement";
+ case 0x021b: return "InterlockedExchange";
+ case 0x021c: return "InterlockedExchangeAdd";
+ case 0x021d: return "InterlockedFlushSList";
+ case 0x021e: return "InterlockedIncrement";
+ case 0x021f: return "InterlockedPopEntrySList";
+ case 0x0220: return "InterlockedPushEntrySList";
+ case 0x0221: return "InvalidateConsoleDIBits";
+ case 0x0222: return "IsBadCodePtr";
+ case 0x0223: return "IsBadHugeReadPtr";
+ case 0x0224: return "IsBadHugeWritePtr";
+ case 0x0225: return "IsBadReadPtr";
+ case 0x0226: return "IsBadStringPtrA";
+ case 0x0227: return "IsBadStringPtrW";
+ case 0x0228: return "IsBadWritePtr";
+ case 0x0229: return "IsDBCSLeadByte";
+ case 0x022a: return "IsDBCSLeadByteEx";
+ case 0x022b: return "IsDebuggerPresent";
+ case 0x022c: return "IsProcessInJob";
+ case 0x022d: return "IsProcessorFeaturePresent";
+ case 0x022e: return "IsSystemResumeAutomatic";
+ case 0x022f: return "IsValidCodePage";
+ case 0x0230: return "IsValidLanguageGroup";
+ case 0x0231: return "IsValidLocale";
+ case 0x0232: return "IsValidUILanguage";
+ case 0x0233: return "IsWow64Process";
+ case 0x0234: return "LCMapStringA";
+ case 0x0235: return "LCMapStringW";
+ case 0x0236: return "LZClose";
+ case 0x0237: return "LZCloseFile";
+ case 0x0238: return "LZCopy";
+ case 0x0239: return "LZCreateFileW";
+ case 0x023a: return "LZDone";
+ case 0x023b: return "LZInit";
+ case 0x023c: return "LZOpenFileA";
+ case 0x023d: return "LZOpenFileW";
+ case 0x023e: return "LZRead";
+ case 0x023f: return "LZSeek";
+ case 0x0240: return "LZStart";
+ case 0x0241: return "LeaveCriticalSection";
+ case 0x0242: return "LoadLibraryA";
+ case 0x0243: return "LoadLibraryExA";
+ case 0x0244: return "LoadLibraryExW";
+ case 0x0245: return "LoadLibraryW";
+ case 0x0246: return "LoadModule";
+ case 0x0247: return "LoadResource";
+ case 0x0248: return "LocalAlloc";
+ case 0x0249: return "LocalCompact";
+ case 0x024a: return "LocalFileTimeToFileTime";
+ case 0x024b: return "LocalFlags";
+ case 0x024c: return "LocalFree";
+ case 0x024d: return "LocalHandle";
+ case 0x024e: return "LocalLock";
+ case 0x024f: return "LocalReAlloc";
+ case 0x0250: return "LocalShrink";
+ case 0x0251: return "LocalSize";
+ case 0x0252: return "LocalUnlock";
+ case 0x0253: return "LockFile";
+ case 0x0254: return "LockFileEx";
+ case 0x0255: return "LockResource";
+ case 0x0256: return "MapUserPhysicalPages";
+ case 0x0257: return "MapUserPhysicalPagesScatter";
+ case 0x0258: return "MapViewOfFile";
+ case 0x0259: return "MapViewOfFileEx";
+ case 0x025a: return "Module32First";
+ case 0x025b: return "Module32FirstW";
+ case 0x025c: return "Module32Next";
+ case 0x025d: return "Module32NextW";
+ case 0x025e: return "MoveFileA";
+ case 0x025f: return "MoveFileExA";
+ case 0x0260: return "MoveFileExW";
+ case 0x0261: return "MoveFileW";
+ case 0x0262: return "MoveFileWithProgressA";
+ case 0x0263: return "MoveFileWithProgressW";
+ case 0x0264: return "MulDiv";
+ case 0x0265: return "MultiByteToWideChar";
+ case 0x0266: return "NlsConvertIntegerToString";
+ case 0x0267: return "NlsGetCacheUpdateCount";
+ case 0x0268: return "NlsResetProcessLocale";
+ case 0x0269: return "NumaVirtualQueryNode";
+ case 0x026a: return "OpenConsoleW";
+ case 0x026b: return "OpenDataFile";
+ case 0x026c: return "OpenEventA";
+ case 0x026d: return "OpenEventW";
+ case 0x026e: return "OpenFile";
+ case 0x026f: return "OpenFileMappingA";
+ case 0x0270: return "OpenFileMappingW";
+ case 0x0271: return "OpenJobObjectA";
+ case 0x0272: return "OpenJobObjectW";
+ case 0x0273: return "OpenMutexA";
+ case 0x0274: return "OpenMutexW";
+ case 0x0275: return "OpenProcess";
+ case 0x0276: return "OpenProfileUserMapping";
+ case 0x0277: return "OpenSemaphoreA";
+ case 0x0278: return "OpenSemaphoreW";
+ case 0x0279: return "OpenThread";
+ case 0x027a: return "OpenWaitableTimerA";
+ case 0x027b: return "OpenWaitableTimerW";
+ case 0x027c: return "OutputDebugStringA";
+ case 0x027d: return "OutputDebugStringW";
+ case 0x027e: return "PeekConsoleInputA";
+ case 0x027f: return "PeekConsoleInputW";
+ case 0x0280: return "PeekNamedPipe";
+ case 0x0281: return "PostQueuedCompletionStatus";
+ case 0x0282: return "PrepareTape";
+ case 0x0283: return "PrivCopyFileExW";
+ case 0x0284: return "PrivMoveFileIdentityW";
+ case 0x0285: return "Process32First";
+ case 0x0286: return "Process32FirstW";
+ case 0x0287: return "Process32Next";
+ case 0x0288: return "Process32NextW";
+ case 0x0289: return "ProcessIdToSessionId";
+ case 0x028a: return "PulseEvent";
+ case 0x028b: return "PurgeComm";
+ case 0x028c: return "QueryActCtxW";
+ case 0x028d: return "QueryDepthSList";
+ case 0x028e: return "QueryDosDeviceA";
+ case 0x028f: return "QueryDosDeviceW";
+ case 0x0290: return "QueryInformationJobObject";
+ case 0x0291: return "QueryMemoryResourceNotification";
+ case 0x0292: return "QueryPerformanceCounter";
+ case 0x0293: return "QueryPerformanceFrequency";
+ case 0x0294: return "QueryWin31IniFilesMappedToRegistry";
+ case 0x0295: return "QueueUserAPC";
+ case 0x0296: return "QueueUserWorkItem";
+ case 0x0297: return "RaiseException";
+ case 0x0298: return "ReadConsoleA";
+ case 0x0299: return "ReadConsoleInputA";
+ case 0x029a: return "ReadConsoleInputExA";
+ case 0x029b: return "ReadConsoleInputExW";
+ case 0x029c: return "ReadConsoleInputW";
+ case 0x029d: return "ReadConsoleOutputA";
+ case 0x029e: return "ReadConsoleOutputAttribute";
+ case 0x029f: return "ReadConsoleOutputCharacterA";
+ case 0x02a0: return "ReadConsoleOutputCharacterW";
+ case 0x02a1: return "ReadConsoleOutputW";
+ case 0x02a2: return "ReadConsoleW";
+ case 0x02a3: return "ReadDirectoryChangesW";
+ case 0x02a4: return "ReadFile";
+ case 0x02a5: return "ReadFileEx";
+ case 0x02a6: return "ReadFileScatter";
+ case 0x02a7: return "ReadProcessMemory";
+ case 0x02a8: return "RegisterConsoleIME";
+ case 0x02a9: return "RegisterConsoleOS2";
+ case 0x02aa: return "RegisterConsoleVDM";
+ case 0x02ab: return "RegisterWaitForInputIdle";
+ case 0x02ac: return "RegisterWaitForSingleObject";
+ case 0x02ad: return "RegisterWaitForSingleObjectEx";
+ case 0x02ae: return "RegisterWowBaseHandlers";
+ case 0x02af: return "RegisterWowExec";
+ case 0x02b0: return "ReleaseActCtx";
+ case 0x02b1: return "ReleaseMutex";
+ case 0x02b2: return "ReleaseSemaphore";
+ case 0x02b3: return "RemoveDirectoryA";
+ case 0x02b4: return "RemoveDirectoryW";
+ case 0x02b5: return "RemoveLocalAlternateComputerNameA";
+ case 0x02b6: return "RemoveLocalAlternateComputerNameW";
+ case 0x02b7: return "RemoveVectoredExceptionHandler";
+ case 0x02b8: return "ReplaceFile";
+ case 0x02b9: return "ReplaceFileA";
+ case 0x02ba: return "ReplaceFileW";
+ case 0x02bb: return "RequestDeviceWakeup";
+ case 0x02bc: return "RequestWakeupLatency";
+ case 0x02bd: return "ResetEvent";
+ case 0x02be: return "ResetWriteWatch";
+ case 0x02bf: return "RestoreLastError";
+ case 0x02c0: return "ResumeThread";
+ case 0x02c1: return "RtlCaptureContext";
+ case 0x02c2: return "RtlCaptureStackBackTrace";
+ case 0x02c3: return "RtlFillMemory";
+ case 0x02c4: return "RtlMoveMemory";
+ case 0x02c5: return "RtlUnwind";
+ case 0x02c6: return "RtlZeroMemory";
+ case 0x02c7: return "ScrollConsoleScreenBufferA";
+ case 0x02c8: return "ScrollConsoleScreenBufferW";
+ case 0x02c9: return "SearchPathA";
+ case 0x02ca: return "SearchPathW";
+ case 0x02cb: return "SetCPGlobal";
+ case 0x02cc: return "SetCalendarInfoA";
+ case 0x02cd: return "SetCalendarInfoW";
+ case 0x02ce: return "SetClientTimeZoneInformation";
+ case 0x02cf: return "SetComPlusPackageInstallStatus";
+ case 0x02d0: return "SetCommBreak";
+ case 0x02d1: return "SetCommConfig";
+ case 0x02d2: return "SetCommMask";
+ case 0x02d3: return "SetCommState";
+ case 0x02d4: return "SetCommTimeouts";
+ case 0x02d5: return "SetComputerNameA";
+ case 0x02d6: return "SetComputerNameExA";
+ case 0x02d7: return "SetComputerNameExW";
+ case 0x02d8: return "SetComputerNameW";
+ case 0x02d9: return "SetConsoleActiveScreenBuffer";
+ case 0x02da: return "SetConsoleCP";
+ case 0x02db: return "SetConsoleCommandHistoryMode";
+ case 0x02dc: return "SetConsoleCtrlHandler";
+ case 0x02dd: return "SetConsoleCursor";
+ case 0x02de: return "SetConsoleCursorInfo";
+ case 0x02df: return "SetConsoleCursorMode";
+ case 0x02e0: return "SetConsoleCursorPosition";
+ case 0x02e1: return "SetConsoleDisplayMode";
+ case 0x02e2: return "SetConsoleFont";
+ case 0x02e3: return "SetConsoleHardwareState";
+ case 0x02e4: return "SetConsoleIcon";
+ case 0x02e5: return "SetConsoleInputExeNameA";
+ case 0x02e6: return "SetConsoleInputExeNameW";
+ case 0x02e7: return "SetConsoleKeyShortcuts";
+ case 0x02e8: return "SetConsoleLocalEUDC";
+ case 0x02e9: return "SetConsoleMaximumWindowSize";
+ case 0x02ea: return "SetConsoleMenuClose";
+ case 0x02eb: return "SetConsoleMode";
+ case 0x02ec: return "SetConsoleNlsMode";
+ case 0x02ed: return "SetConsoleNumberOfCommandsA";
+ case 0x02ee: return "SetConsoleNumberOfCommandsW";
+ case 0x02ef: return "SetConsoleOS2OemFormat";
+ case 0x02f0: return "SetConsoleOutputCP";
+ case 0x02f1: return "SetConsolePalette";
+ case 0x02f2: return "SetConsoleScreenBufferSize";
+ case 0x02f3: return "SetConsoleTextAttribute";
+ case 0x02f4: return "SetConsoleTitleA";
+ case 0x02f5: return "SetConsoleTitleW";
+ case 0x02f6: return "SetConsoleWindowInfo";
+ case 0x02f7: return "SetCriticalSectionSpinCount";
+ case 0x02f8: return "SetCurrentDirectoryA";
+ case 0x02f9: return "SetCurrentDirectoryW";
+ case 0x02fa: return "SetDefaultCommConfigA";
+ case 0x02fb: return "SetDefaultCommConfigW";
+ case 0x02fc: return "SetDllDirectoryA";
+ case 0x02fd: return "SetDllDirectoryW";
+ case 0x02fe: return "SetEndOfFile";
+ case 0x02ff: return "SetEnvironmentVariableA";
+ case 0x0300: return "SetEnvironmentVariableW";
+ case 0x0301: return "SetErrorMode";
+ case 0x0302: return "SetEvent";
+ case 0x0303: return "SetFileApisToANSI";
+ case 0x0304: return "SetFileApisToOEM";
+ case 0x0305: return "SetFileAttributesA";
+ case 0x0306: return "SetFileAttributesW";
+ case 0x0307: return "SetFilePointer";
+ case 0x0308: return "SetFilePointerEx";
+ case 0x0309: return "SetFileShortNameA";
+ case 0x030a: return "SetFileShortNameW";
+ case 0x030b: return "SetFileTime";
+ case 0x030c: return "SetFileValidData";
+ case 0x030d: return "SetFirmwareEnvironmentVariableA";
+ case 0x030e: return "SetFirmwareEnvironmentVariableW";
+ case 0x030f: return "SetHandleContext";
+ case 0x0310: return "SetHandleCount";
+ case 0x0311: return "SetHandleInformation";
+ case 0x0312: return "SetInformationJobObject";
+ case 0x0313: return "SetLastConsoleEventActive";
+ case 0x0314: return "SetLastError";
+ case 0x0315: return "SetLocalPrimaryComputerNameA";
+ case 0x0316: return "SetLocalPrimaryComputerNameW";
+ case 0x0317: return "SetLocalTime";
+ case 0x0318: return "SetLocaleInfoA";
+ case 0x0319: return "SetLocaleInfoW";
+ case 0x031a: return "SetMailslotInfo";
+ case 0x031b: return "SetMessageWaitingIndicator";
+ case 0x031c: return "SetNamedPipeHandleState";
+ case 0x031d: return "SetPriorityClass";
+ case 0x031e: return "SetProcessAffinityMask";
+ case 0x031f: return "SetProcessPriorityBoost";
+ case 0x0320: return "SetProcessShutdownParameters";
+ case 0x0321: return "SetProcessWorkingSetSize";
+ case 0x0322: return "SetStdHandle";
+ case 0x0323: return "SetSystemPowerState";
+ case 0x0324: return "SetSystemTime";
+ case 0x0325: return "SetSystemTimeAdjustment";
+ case 0x0326: return "SetTapeParameters";
+ case 0x0327: return "SetTapePosition";
+ case 0x0328: return "SetTermsrvAppInstallMode";
+ case 0x0329: return "SetThreadAffinityMask";
+ case 0x032a: return "SetThreadContext";
+ case 0x032b: return "SetThreadExecutionState";
+ case 0x032c: return "SetThreadIdealProcessor";
+ case 0x032d: return "SetThreadLocale";
+ case 0x032e: return "SetThreadPriority";
+ case 0x032f: return "SetThreadPriorityBoost";
+ case 0x0330: return "SetThreadUILanguage";
+ case 0x0331: return "SetTimeZoneInformation";
+ case 0x0332: return "SetTimerQueueTimer";
+ case 0x0333: return "SetUnhandledExceptionFilter";
+ case 0x0334: return "SetUserGeoID";
+ case 0x0335: return "SetVDMCurrentDirectories";
+ case 0x0336: return "SetVolumeLabelA";
+ case 0x0337: return "SetVolumeLabelW";
+ case 0x0338: return "SetVolumeMountPointA";
+ case 0x0339: return "SetVolumeMountPointW";
+ case 0x033a: return "SetWaitableTimer";
+ case 0x033b: return "SetupComm";
+ case 0x033c: return "ShowConsoleCursor";
+ case 0x033d: return "SignalObjectAndWait";
+ case 0x033e: return "SizeofResource";
+ case 0x033f: return "Sleep";
+ case 0x0340: return "SleepEx";
+ case 0x0341: return "SuspendThread";
+ case 0x0342: return "SwitchToFiber";
+ case 0x0343: return "SwitchToThread";
+ case 0x0344: return "SystemTimeToFileTime";
+ case 0x0345: return "SystemTimeToTzSpecificLocalTime";
+ case 0x0346: return "TerminateJobObject";
+ case 0x0347: return "TerminateProcess";
+ case 0x0348: return "TerminateThread";
+ case 0x0349: return "TermsrvAppInstallMode";
+ case 0x034a: return "Thread32First";
+ case 0x034b: return "Thread32Next";
+ case 0x034c: return "TlsAlloc";
+ case 0x034d: return "TlsFree";
+ case 0x034e: return "TlsGetValue";
+ case 0x034f: return "TlsSetValue";
+ case 0x0350: return "Toolhelp32ReadProcessMemory";
+ case 0x0351: return "TransactNamedPipe";
+ case 0x0352: return "TransmitCommChar";
+ case 0x0353: return "TrimVirtualBuffer";
+ case 0x0354: return "TryEnterCriticalSection";
+ case 0x0355: return "TzSpecificLocalTimeToSystemTime";
+ case 0x0356: return "UTRegister";
+ case 0x0357: return "UTUnRegister";
+ case 0x0358: return "UnhandledExceptionFilter";
+ case 0x0359: return "UnlockFile";
+ case 0x035a: return "UnlockFileEx";
+ case 0x035b: return "UnmapViewOfFile";
+ case 0x035c: return "UnregisterConsoleIME";
+ case 0x035d: return "UnregisterWait";
+ case 0x035e: return "UnregisterWaitEx";
+ case 0x035f: return "UpdateResourceA";
+ case 0x0360: return "UpdateResourceW";
+ case 0x0361: return "VDMConsoleOperation";
+ case 0x0362: return "VDMOperationStarted";
+ case 0x0363: return "ValidateLCType";
+ case 0x0364: return "ValidateLocale";
+ case 0x0365: return "VerLanguageNameA";
+ case 0x0366: return "VerLanguageNameW";
+ case 0x0367: return "VerSetConditionMask";
+ case 0x0368: return "VerifyConsoleIoHandle";
+ case 0x0369: return "VerifyVersionInfoA";
+ case 0x036a: return "VerifyVersionInfoW";
+ case 0x036b: return "VirtualAlloc";
+ case 0x036c: return "VirtualAllocEx";
+ case 0x036d: return "VirtualBufferExceptionHandler";
+ case 0x036e: return "VirtualFree";
+ case 0x036f: return "VirtualFreeEx";
+ case 0x0370: return "VirtualLock";
+ case 0x0371: return "VirtualProtect";
+ case 0x0372: return "VirtualProtectEx";
+ case 0x0373: return "VirtualQuery";
+ case 0x0374: return "VirtualQueryEx";
+ case 0x0375: return "VirtualUnlock";
+ case 0x0376: return "WTSGetActiveConsoleSessionId";
+ case 0x0377: return "WaitCommEvent";
+ case 0x0378: return "WaitForDebugEvent";
+ case 0x0379: return "WaitForMultipleObjects";
+ case 0x037a: return "WaitForMultipleObjectsEx";
+ case 0x037b: return "WaitForSingleObject";
+ case 0x037c: return "WaitForSingleObjectEx";
+ case 0x037d: return "WaitNamedPipeA";
+ case 0x037e: return "WaitNamedPipeW";
+ case 0x037f: return "WideCharToMultiByte";
+ case 0x0380: return "WinExec";
+ case 0x0381: return "WriteConsoleA";
+ case 0x0382: return "WriteConsoleInputA";
+ case 0x0383: return "WriteConsoleInputVDMA";
+ case 0x0384: return "WriteConsoleInputVDMW";
+ case 0x0385: return "WriteConsoleInputW";
+ case 0x0386: return "WriteConsoleOutputA";
+ case 0x0387: return "WriteConsoleOutputAttribute";
+ case 0x0388: return "WriteConsoleOutputCharacterA";
+ case 0x0389: return "WriteConsoleOutputCharacterW";
+ case 0x038a: return "WriteConsoleOutputW";
+ case 0x038b: return "WriteConsoleW";
+ case 0x038c: return "WriteFile";
+ case 0x038d: return "WriteFileEx";
+ case 0x038e: return "WriteFileGather";
+ case 0x038f: return "WritePrivateProfileSectionA";
+ case 0x0390: return "WritePrivateProfileSectionW";
+ case 0x0391: return "WritePrivateProfileStringA";
+ case 0x0392: return "WritePrivateProfileStringW";
+ case 0x0393: return "WritePrivateProfileStructA";
+ case 0x0394: return "WritePrivateProfileStructW";
+ case 0x0395: return "WriteProcessMemory";
+ case 0x0396: return "WriteProfileSectionA";
+ case 0x0397: return "WriteProfileSectionW";
+ case 0x0398: return "WriteProfileStringA";
+ case 0x0399: return "WriteProfileStringW";
+ case 0x039a: return "WriteTapemark";
+ case 0x039b: return "ZombifyActCtx";
+ case 0x039c: return "_hread";
+ case 0x039d: return "_hwrite";
+ case 0x039e: return "_lclose";
+ case 0x039f: return "_lcreat";
+ case 0x03a0: return "_llseek";
+ case 0x03a1: return "_lopen";
+ case 0x03a2: return "_lread";
+ case 0x03a3: return "_lwrite";
+ case 0x03a4: return "lstrcat";
+ case 0x03a5: return "lstrcatA";
+ case 0x03a6: return "lstrcatW";
+ case 0x03a7: return "lstrcmp";
+ case 0x03a8: return "lstrcmpA";
+ case 0x03a9: return "lstrcmpW";
+ case 0x03aa: return "lstrcmpi";
+ case 0x03ab: return "lstrcmpiA";
+ case 0x03ac: return "lstrcmpiW";
+ case 0x03ad: return "lstrcpy";
+ case 0x03ae: return "lstrcpyA";
+ case 0x03af: return "lstrcpyW";
+ case 0x03b0: return "lstrcpyn";
+ case 0x03b1: return "lstrcpynA";
+ case 0x03b2: return "lstrcpynW";
+ case 0x03b3: return "lstrlen";
+ case 0x03b4: return "lstrlenA";
+ case 0x03b5: return "lstrlenW";
+ }
+ return nullptr;
+}
}
diff --git a/src/PE/utils/ordinals_lookup_tables/libraries_table.hpp b/src/PE/utils/ordinals_lookup_tables/libraries_table.hpp
index 2102391e..129f4a67 100644
--- a/src/PE/utils/ordinals_lookup_tables/libraries_table.hpp
+++ b/src/PE/utils/ordinals_lookup_tables/libraries_table.hpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -16,8 +16,7 @@
#ifndef LIEF_PE_UTILS_LIBRARY_TABLE_H_
#define LIEF_PE_UTILS_LIBRARY_TABLE_H_
-#include <map>
-#include "frozen.hpp"
+#include <unordered_map>
#include "kernel32_dll_lookup.hpp"
#include "ntdll_dll_lookup.hpp"
@@ -45,25 +44,26 @@
namespace LIEF {
namespace PE {
-static const std::map<std::string, const std::map<uint32_t, const char*>&> ordinals_library_tables =
+static const std::unordered_map<std::string, const char* (*)(uint32_t)>
+ordinals_library_tables =
{
- { "kernel32.dll", kernel32_dll_lookup },
- { "ntdll.dll", ntdll_dll_lookup },
- { "advapi32.dll", advapi32_dll_lookup },
- { "msvcp110.dll", msvcp110_dll_lookup },
- { "msvcp120.dll", msvcp120_dll_lookup },
- { "msvcr100.dll", msvcr100_dll_lookup },
- { "msvcr110.dll", msvcr110_dll_lookup },
- { "msvcr120.dll", msvcr120_dll_lookup },
- { "user32.dll", user32_dll_lookup },
- { "comctl32.dll", comctl32_dll_lookup },
- { "ws2_32.dll", ws2_32_dll_lookup },
- { "shcore.dll", shcore_dll_lookup },
- { "oleaut32.dll", oleaut32_dll_lookup },
- { "mfc42u.dll", mfc42u_dll_lookup },
- { "shlwapi.dll", shlwapi_dll_lookup },
- { "gdi32.dll", gdi32_dll_lookup },
- { "shell32.dll", shell32_dll_lookup },
+ { "kernel32.dll", &kernel32_dll_lookup },
+ { "ntdll.dll", &ntdll_dll_lookup },
+ { "advapi32.dll", &advapi32_dll_lookup },
+ { "msvcp110.dll", &msvcp110_dll_lookup },
+ { "msvcp120.dll", &msvcp120_dll_lookup },
+ { "msvcr100.dll", &msvcr100_dll_lookup },
+ { "msvcr110.dll", &msvcr110_dll_lookup },
+ { "msvcr120.dll", &msvcr120_dll_lookup },
+ { "user32.dll", &user32_dll_lookup },
+ { "comctl32.dll", &comctl32_dll_lookup },
+ { "ws2_32.dll", &ws2_32_dll_lookup },
+ { "shcore.dll", &shcore_dll_lookup },
+ { "oleaut32.dll", &oleaut32_dll_lookup },
+ { "mfc42u.dll", &mfc42u_dll_lookup },
+ { "shlwapi.dll", &shlwapi_dll_lookup },
+ { "gdi32.dll", &gdi32_dll_lookup },
+ { "shell32.dll", &shell32_dll_lookup },
};
}
diff --git a/src/PE/utils/ordinals_lookup_tables/mfc42u_dll_lookup.hpp b/src/PE/utils/ordinals_lookup_tables/mfc42u_dll_lookup.hpp
index 74d4a024..9e27ca72 100644
--- a/src/PE/utils/ordinals_lookup_tables/mfc42u_dll_lookup.hpp
+++ b/src/PE/utils/ordinals_lookup_tables/mfc42u_dll_lookup.hpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -16,19 +16,21 @@
#ifndef LIEF_PE_MFC42U_DLL_LOOKUP_H_
#define LIEF_PE_MFC42U_DLL_LOOKUP_H_
-#include <map>
namespace LIEF {
namespace PE {
-static const std::map<uint32_t, const char*> mfc42u_dll_lookup {
- { 0x0005, "?classCCachedDataPathProperty@CCachedDataPathProperty@@2UCRuntimeClass@@B" },
- { 0x0006, "?classCDataPathProperty@CDataPathProperty@@2UCRuntimeClass@@B" },
- { 0x0002, "DllCanUnloadNow" },
- { 0x0001, "DllGetClassObject" },
- { 0x0003, "DllRegisterServer" },
- { 0x0004, "DllUnregisterServer" },
-};
+const char* mfc42u_dll_lookup(uint32_t i) {
+ switch(i) {
+ case 0x0005: return "?classCCachedDataPathProperty@CCachedDataPathProperty@@2UCRuntimeClass@@B";
+ case 0x0006: return "?classCDataPathProperty@CDataPathProperty@@2UCRuntimeClass@@B";
+ case 0x0002: return "DllCanUnloadNow";
+ case 0x0001: return "DllGetClassObject";
+ case 0x0003: return "DllRegisterServer";
+ case 0x0004: return "DllUnregisterServer";
+ }
+ return nullptr;
+}
}
diff --git a/src/PE/utils/ordinals_lookup_tables/msvcp110_dll_lookup.hpp b/src/PE/utils/ordinals_lookup_tables/msvcp110_dll_lookup.hpp
index 2ecb078b..2f2d0f6d 100644
--- a/src/PE/utils/ordinals_lookup_tables/msvcp110_dll_lookup.hpp
+++ b/src/PE/utils/ordinals_lookup_tables/msvcp110_dll_lookup.hpp
@@ -1,5 +1,5 @@
-/* Copyright 2017 R. Thomas
- * Copyright 2017 Quarkslab
+/* Copyright 2017 - 2021 R. Thomas
+ * Copyright 2017 - 2021 Quarkslab
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -16,1604 +16,1606 @@
#ifndef LIEF_PE_MSVCP110_DLL_LOOKUP_H_
#define LIEF_PE_MSVCP110_DLL_LOOKUP_H_
-#include <map>
namespace LIEF {
namespace PE {
-static const std::map<uint32_t, const char*> msvcp110_dll_lookup {
- { 0x0001, "??$_Getvals@_W@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z" },
- { 0x0002, "??$_Getvals@_W@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z" },
- { 0x0003, "??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z" },
- { 0x0004, "??0?$_Yarn@D@std@@QEAA@AEBV01@@Z" },
- { 0x0005, "??0?$_Yarn@D@std@@QEAA@PEBD@Z" },
- { 0x0006, "??0?$_Yarn@D@std@@QEAA@XZ" },
- { 0x0007, "??0?$_Yarn@_W@std@@QEAA@XZ" },
- { 0x0008, "??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ" },
- { 0x0009, "??0?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z" },
- { 0x000a, "??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ" },
- { 0x000b, "??0?$basic_ios@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z" },
- { 0x000c, "??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ" },
- { 0x000d, "??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z" },
- { 0x000e, "??0?$basic_iostream@DU?$char_traits@D@std@@@std@@IEAA@$$QEAV01@@Z" },
- { 0x000f, "??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z" },
- { 0x0010, "??0?$basic_iostream@GU?$char_traits@G@std@@@std@@IEAA@$$QEAV01@@Z" },
- { 0x0011, "??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z" },
- { 0x0012, "??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IEAA@$$QEAV01@@Z" },
- { 0x0013, "??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z" },
- { 0x0014, "??0?$basic_istream@DU?$char_traits@D@std@@@std@@IEAA@$$QEAV01@@Z" },
- { 0x0015, "??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N1@Z" },
- { 0x0016, "??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z" },
- { 0x0017, "??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@W4_Uninitialized@1@@Z" },
- { 0x0018, "??0?$basic_istream@GU?$char_traits@G@std@@@std@@IEAA@$$QEAV01@@Z" },
- { 0x0019, "??0?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N1@Z" },
- { 0x001a, "??0?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z" },
- { 0x001b, "??0?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA@W4_Uninitialized@1@@Z" },
- { 0x001c, "??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@IEAA@$$QEAV01@@Z" },
- { 0x001d, "??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N1@Z" },
- { 0x001e, "??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z" },
- { 0x001f, "??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@W4_Uninitialized@1@@Z" },
- { 0x0020, "??0?$basic_ostream@DU?$char_traits@D@std@@@std@@IEAA@$$QEAV01@@Z" },
- { 0x0021, "??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z" },
- { 0x0022, "??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@W4_Uninitialized@1@_N@Z" },
- { 0x0023, "??0?$basic_ostream@GU?$char_traits@G@std@@@std@@IEAA@$$QEAV01@@Z" },
- { 0x0024, "??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z" },
- { 0x0025, "??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@W4_Uninitialized@1@_N@Z" },
- { 0x0026, "??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IEAA@$$QEAV01@@Z" },
- { 0x0027, "??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z" },
- { 0x0028, "??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@W4_Uninitialized@1@_N@Z" },
- { 0x0029, "??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@AEBV01@@Z" },
- { 0x002a, "??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@W4_Uninitialized@1@@Z" },
- { 0x002b, "??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ" },
- { 0x002c, "??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@AEBV01@@Z" },
- { 0x002d, "??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@W4_Uninitialized@1@@Z" },
- { 0x002e, "??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ" },
- { 0x002f, "??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@AEBV01@@Z" },
- { 0x0030, "??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@W4_Uninitialized@1@@Z" },
- { 0x0031, "??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ" },
- { 0x0032, "??0?$codecvt@DDH@std@@QEAA@AEBV_Locinfo@1@_K@Z" },
- { 0x0033, "??0?$codecvt@DDH@std@@QEAA@_K@Z" },
- { 0x0034, "??0?$codecvt@GDH@std@@QEAA@AEBV_Locinfo@1@_K@Z" },
- { 0x0035, "??0?$codecvt@GDH@std@@QEAA@_K@Z" },
- { 0x0036, "??0?$codecvt@_WDH@std@@QEAA@AEBV_Locinfo@1@_K@Z" },
- { 0x0037, "??0?$codecvt@_WDH@std@@QEAA@_K@Z" },
- { 0x0038, "??0?$ctype@D@std@@QEAA@AEBV_Locinfo@1@_K@Z" },
- { 0x0039, "??0?$ctype@D@std@@QEAA@PEBF_N_K@Z" },
- { 0x003a, "??0?$ctype@G@std@@QEAA@AEBV_Locinfo@1@_K@Z" },
- { 0x003b, "??0?$ctype@G@std@@QEAA@_K@Z" },
- { 0x003c, "??0?$ctype@_W@std@@QEAA@AEBV_Locinfo@1@_K@Z" },
- { 0x003d, "??0?$ctype@_W@std@@QEAA@_K@Z" },
- { 0x003e, "??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z" },
- { 0x003f, "??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@_K@Z" },
- { 0x0040, "??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z" },
- { 0x0041, "??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@_K@Z" },
- { 0x0042, "??0?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z" },
- { 0x0043, "??0?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@_K@Z" },
- { 0x0044, "??0?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z" },
- { 0x0045, "??0?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@_K@Z" },
- { 0x0046, "??0?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z" },
- { 0x0047, "??0?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@_K@Z" },
- { 0x0048, "??0?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z" },
- { 0x0049, "??0?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@_K@Z" },
- { 0x004a, "??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAA@PEBD_K@Z" },
- { 0x004b, "??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z" },
- { 0x004c, "??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@_K@Z" },
- { 0x004d, "??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAA@PEBD_K@Z" },
- { 0x004e, "??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z" },
- { 0x004f, "??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@_K@Z" },
- { 0x0050, "??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAA@PEBD_K@Z" },
- { 0x0051, "??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z" },
- { 0x0052, "??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@_K@Z" },
- { 0x0053, "??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z" },
- { 0x0054, "??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@_K@Z" },
- { 0x0055, "??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAA@PEBD_K@Z" },
- { 0x0056, "??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z" },
- { 0x0057, "??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@_K@Z" },
- { 0x0058, "??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAA@PEBD_K@Z" },
- { 0x0059, "??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z" },
- { 0x005a, "??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@_K@Z" },
- { 0x005b, "??0Init@ios_base@std@@QEAA@XZ" },
- { 0x005c, "??0_Concurrent_queue_base_v4@details@Concurrency@@IEAA@_K@Z" },
- { 0x005d, "??0_Concurrent_queue_iterator_base_v4@details@Concurrency@@IEAA@AEBV_Concurrent_queue_base_v4@12@@Z" },
- { 0x005e, "??0_Container_base12@std@@QEAA@AEBU01@@Z" },
- { 0x005f, "??0_Container_base12@std@@QEAA@XZ" },
- { 0x0060, "??0_Facet_base@std@@QEAA@AEBV01@@Z" },
- { 0x0061, "??0_Facet_base@std@@QEAA@XZ" },
- { 0x0062, "??0_Init_locks@std@@QEAA@XZ" },
- { 0x0063, "??0_Locimp@locale@std@@AEAA@AEBV012@@Z" },
- { 0x0064, "??0_Locimp@locale@std@@AEAA@_N@Z" },
- { 0x0065, "??0_Locinfo@std@@QEAA@HPEBD@Z" },
- { 0x0066, "??0_Locinfo@std@@QEAA@PEBD@Z" },
- { 0x0067, "??0_Lockit@std@@QEAA@H@Z" },
- { 0x0068, "??0_Lockit@std@@QEAA@XZ" },
- { 0x0069, "??0_Pad@std@@QEAA@AEBV01@@Z" },
- { 0x006a, "??0_Pad@std@@QEAA@XZ" },
- { 0x006b, "??0_Runtime_object@details@Concurrency@@QEAA@H@Z" },
- { 0x006c, "??0_Runtime_object@details@Concurrency@@QEAA@XZ" },
- { 0x006d, "??0_Timevec@std@@QEAA@AEBV01@@Z" },
- { 0x006e, "??0_Timevec@std@@QEAA@PEAX@Z" },
- { 0x006f, "??0_UShinit@std@@QEAA@XZ" },
- { 0x0070, "??0_Winit@std@@QEAA@XZ" },
- { 0x0071, "??0agent@Concurrency@@QEAA@AEAVScheduleGroup@1@@Z" },
- { 0x0072, "??0agent@Concurrency@@QEAA@AEAVScheduler@1@@Z" },
- { 0x0073, "??0agent@Concurrency@@QEAA@XZ" },
- { 0x0074, "??0codecvt_base@std@@QEAA@_K@Z" },
- { 0x0075, "??0ctype_base@std@@QEAA@_K@Z" },
- { 0x0076, "??0facet@locale@std@@IEAA@_K@Z" },
- { 0x0077, "??0id@locale@std@@QEAA@_K@Z" },
- { 0x0078, "??0ios_base@std@@IEAA@XZ" },
- { 0x0079, "??0time_base@std@@QEAA@_K@Z" },
- { 0x007a, "??1?$_Yarn@D@std@@QEAA@XZ" },
- { 0x007b, "??1?$_Yarn@_W@std@@QEAA@XZ" },
- { 0x007c, "??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ" },
- { 0x007d, "??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ" },
- { 0x007e, "??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ" },
- { 0x007f, "??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ" },
- { 0x0080, "??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ" },
- { 0x0081, "??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ" },
- { 0x0082, "??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ" },
- { 0x0083, "??1?$basic_istream@GU?$char_traits@G@std@@@std@@UEAA@XZ" },
- { 0x0084, "??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ" },
- { 0x0085, "??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ" },
- { 0x0086, "??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ" },
- { 0x0087, "??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ" },
- { 0x0088, "??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ" },
- { 0x0089, "??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ" },
- { 0x008a, "??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ" },
- { 0x008b, "??1?$codecvt@DDH@std@@MEAA@XZ" },
- { 0x008c, "??1?$codecvt@GDH@std@@MEAA@XZ" },
- { 0x008d, "??1?$codecvt@_WDH@std@@MEAA@XZ" },
- { 0x008e, "??1?$ctype@D@std@@MEAA@XZ" },
- { 0x008f, "??1?$ctype@G@std@@MEAA@XZ" },
- { 0x0090, "??1?$ctype@_W@std@@MEAA@XZ" },
- { 0x0091, "??1?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEAA@XZ" },
- { 0x0092, "??1?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEAA@XZ" },
- { 0x0093, "??1?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEAA@XZ" },
- { 0x0094, "??1?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEAA@XZ" },
- { 0x0095, "??1?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEAA@XZ" },
- { 0x0096, "??1?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEAA@XZ" },
- { 0x0097, "??1?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEAA@XZ" },
- { 0x0098, "??1?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEAA@XZ" },
- { 0x0099, "??1?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEAA@XZ" },
- { 0x009a, "??1?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEAA@XZ" },
- { 0x009b, "??1?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEAA@XZ" },
- { 0x009c, "??1?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEAA@XZ" },
- { 0x009d, "??1Init@ios_base@std@@QEAA@XZ" },
- { 0x009e, "??1_Concurrent_queue_base_v4@details@Concurrency@@MEAA@XZ" },
- { 0x009f, "??1_Concurrent_queue_iterator_base_v4@details@Concurrency@@IEAA@XZ" },
- { 0x00a0, "??1_Concurrent_vector_base_v4@details@Concurrency@@IEAA@XZ" },
- { 0x00a1, "??1_Container_base12@std@@QEAA@XZ" },
- { 0x00a2, "??1_Facet_base@std@@UEAA@XZ" },
- { 0x00a3, "??1_Init_locks@std@@QEAA@XZ" },
- { 0x00a4, "??1_Locimp@locale@std@@MEAA@XZ" },
- { 0x00a5, "??1_Locinfo@std@@QEAA@XZ" },
- { 0x00a6, "??1_Lockit@std@@QEAA@XZ" },
- { 0x00a7, "??1_Pad@std@@QEAA@XZ" },
- { 0x00a8, "??1_Timevec@std@@QEAA@XZ" },
- { 0x00a9, "??1_UShinit@std@@QEAA@XZ" },
- { 0x00aa, "??1_Winit@std@@QEAA@XZ" },
- { 0x00ab, "??1agent@Concurrency@@UEAA@XZ" },
- { 0x00ac, "??1codecvt_base@std@@UEAA@XZ" },
- { 0x00ad, "??1ctype_base@std@@UEAA@XZ" },
- { 0x00ae, "??1facet@locale@std@@MEAA@XZ" },
- { 0x00af, "??1ios_base@std@@UEAA@XZ" },
- { 0x00b0, "??1time_base@std@@UEAA@XZ" },
- { 0x00b1, "??4?$_Iosb@H@std@@QEAAAEAV01@AEBV01@@Z" },
- { 0x00b2, "??4?$_Yarn@D@std@@QEAAAEAV01@AEBV01@@Z" },
- { 0x00b3, "??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z" },
- { 0x00b4, "??4?$_Yarn@_W@std@@QEAAAEAV01@PEB_W@Z" },
- { 0x00b5, "??4?$basic_iostream@DU?$char_traits@D@std@@@std@@IEAAAEAV01@$$QEAV01@@Z" },
- { 0x00b6, "??4?$basic_iostream@GU?$char_traits@G@std@@@std@@IEAAAEAV01@$$QEAV01@@Z" },
- { 0x00b7, "??4?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IEAAAEAV01@$$QEAV01@@Z" },
- { 0x00b8, "??4?$basic_istream@DU?$char_traits@D@std@@@std@@IEAAAEAV01@$$QEAV01@@Z" },
- { 0x00b9, "??4?$basic_istream@GU?$char_traits@G@std@@@std@@IEAAAEAV01@$$QEAV01@@Z" },
- { 0x00ba, "??4?$basic_istream@_WU?$char_traits@_W@std@@@std@@IEAAAEAV01@$$QEAV01@@Z" },
- { 0x00bb, "??4?$basic_ostream@DU?$char_traits@D@std@@@std@@IEAAAEAV01@$$QEAV01@@Z" },
- { 0x00bc, "??4?$basic_ostream@GU?$char_traits@G@std@@@std@@IEAAAEAV01@$$QEAV01@@Z" },
- { 0x00bd, "??4?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IEAAAEAV01@$$QEAV01@@Z" },
- { 0x00be, "??4?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAAEAV01@AEBV01@@Z" },
- { 0x00bf, "??4?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAAEAV01@AEBV01@@Z" },
- { 0x00c0, "??4?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAAEAV01@AEBV01@@Z" },
- { 0x00c1, "??4Init@ios_base@std@@QEAAAEAV012@AEBV012@@Z" },
- { 0x00c2, "??4_Container_base0@std@@QEAAAEAU01@AEBU01@@Z" },
- { 0x00c3, "??4_Container_base12@std@@QEAAAEAU01@AEBU01@@Z" },
- { 0x00c4, "??4_Facet_base@std@@QEAAAEAV01@AEBV01@@Z" },
- { 0x00c5, "??4_Init_locks@std@@QEAAAEAV01@AEBV01@@Z" },
- { 0x00c6, "??4_Pad@std@@QEAAAEAV01@AEBV01@@Z" },
- { 0x00c7, "??4_Timevec@std@@QEAAAEAV01@AEBV01@@Z" },
- { 0x00c8, "??4_UShinit@std@@QEAAAEAV01@AEBV01@@Z" },
- { 0x00c9, "??4_Winit@std@@QEAAAEAV01@AEBV01@@Z" },
- { 0x00ca, "??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAF@Z" },
- { 0x00cb, "??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAG@Z" },
- { 0x00cc, "??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z" },
- { 0x00cd, "??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z" },
- { 0x00ce, "??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAJ@Z" },
- { 0x00cf, "??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAK@Z" },
- { 0x00d0, "??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z" },
- { 0x00d1, "??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z" },
- { 0x00d2, "??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAO@Z" },
- { 0x00d3, "??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAPEAX@Z" },
- { 0x00d4, "??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_J@Z" },
- { 0x00d5, "??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z" },
- { 0x00d6, "??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z" },
- { 0x00d7, "??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z" },
- { 0x00d8, "??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@DU?$char_traits@D@std@@@1@AEAV21@@Z@Z" },
- { 0x00d9, "??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z" },
- { 0x00da, "??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z" },
- { 0x00db, "??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAF@Z" },
- { 0x00dc, "??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAG@Z" },
- { 0x00dd, "??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAH@Z" },
- { 0x00de, "??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAI@Z" },
- { 0x00df, "??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAJ@Z" },
- { 0x00e0, "??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAK@Z" },
- { 0x00e1, "??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAM@Z" },
- { 0x00e2, "??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAN@Z" },
- { 0x00e3, "??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAO@Z" },
- { 0x00e4, "??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAPEAX@Z" },
- { 0x00e5, "??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEA_J@Z" },
- { 0x00e6, "??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEA_K@Z" },
- { 0x00e7, "??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEA_N@Z" },
- { 0x00e8, "??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z" },
- { 0x00e9, "??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@GU?$char_traits@G@std@@@1@AEAV21@@Z@Z" },
- { 0x00ea, "??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z" },
- { 0x00eb, "??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z" },
- { 0x00ec, "??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAF@Z" },
- { 0x00ed, "??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAG@Z" },
- { 0x00ee, "??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z" },
- { 0x00ef, "??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAI@Z" },
- { 0x00f0, "??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAJ@Z" },
- { 0x00f1, "??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAK@Z" },
- { 0x00f2, "??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAM@Z" },
- { 0x00f3, "??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAN@Z" },
- { 0x00f4, "??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAO@Z" },
- { 0x00f5, "??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAPEAX@Z" },
- { 0x00f6, "??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_J@Z" },
- { 0x00f7, "??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_K@Z" },
- { 0x00f8, "??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_N@Z" },
- { 0x00f9, "??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z" },
- { 0x00fa, "??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@_WU?$char_traits@_W@std@@@1@AEAV21@@Z@Z" },
- { 0x00fb, "??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z" },
- { 0x00fc, "??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z" },
- { 0x00fd, "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z" },
- { 0x00fe, "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z" },
- { 0x00ff, "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z" },
- { 0x0100, "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z" },
- { 0x0101, "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z" },
- { 0x0102, "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z" },
- { 0x0103, "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z" },
- { 0x0104, "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z" },
- { 0x0105, "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@O@Z" },
- { 0x0106, "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z" },
- { 0x0107, "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@DU?$char_traits@D@std@@@1@AEAV21@@Z@Z" },
- { 0x0108, "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z" },
- { 0x0109, "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z" },
- { 0x010a, "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z" },
- { 0x010b, "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z" },
- { 0x010c, "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z" },
- { 0x010d, "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z" },
- { 0x010e, "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@F@Z" },
- { 0x010f, "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@G@Z" },
- { 0x0110, "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z" },
- { 0x0111, "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@I@Z" },
- { 0x0112, "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@J@Z" },
- { 0x0113, "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z" },
- { 0x0114, "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@M@Z" },
- { 0x0115, "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@N@Z" },
- { 0x0116, "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@O@Z" },
- { 0x0117, "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z" },
- { 0x0118, "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@GU?$char_traits@G@std@@@1@AEAV21@@Z@Z" },
- { 0x0119, "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z" },
- { 0x011a, "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z" },
- { 0x011b, "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@PEBX@Z" },
- { 0x011c, "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_J@Z" },
- { 0x011d, "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_K@Z" },
- { 0x011e, "??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_N@Z" },
- { 0x011f, "??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@F@Z" },
- { 0x0120, "??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z" },
- { 0x0121, "??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z" },
- { 0x0122, "??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z" },
- { 0x0123, "??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z" },
- { 0x0124, "??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z" },
- { 0x0125, "??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@M@Z" },
- { 0x0126, "??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z" },
- { 0x0127, "??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@O@Z" },
- { 0x0128, "??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z" },
- { 0x0129, "??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@_WU?$char_traits@_W@std@@@1@AEAV21@@Z@Z" },
- { 0x012a, "??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z" },
- { 0x012b, "??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z" },
- { 0x012c, "??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z" },
- { 0x012d, "??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_J@Z" },
- { 0x012e, "??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z" },
- { 0x012f, "??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z" },
- { 0x0130, "??7ios_base@std@@QEBA_NXZ" },
- { 0x0131, "??Bid@locale@std@@QEAA_KXZ" },
- { 0x0132, "??Bios_base@std@@QEBAPEAXXZ" },
- { 0x0133, "??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@" },
- { 0x0134, "??_7?$basic_ios@GU?$char_traits@G@std@@@std@@6B@" },
- { 0x0135, "??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@" },
- { 0x0136, "??_7?$basic_iostream@DU?$char_traits@D@std@@@std@@6B@" },
- { 0x0137, "??_7?$basic_iostream@GU?$char_traits@G@std@@@std@@6B@" },
- { 0x0138, "??_7?$basic_iostream@_WU?$char_traits@_W@std@@@std@@6B@" },
- { 0x0139, "??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@" },
- { 0x013a, "??_7?$basic_istream@GU?$char_traits@G@std@@@std@@6B@" },
- { 0x013b, "??_7?$basic_istream@_WU?$char_traits@_W@std@@@std@@6B@" },
- { 0x013c, "??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@" },
- { 0x013d, "??_7?$basic_ostream@GU?$char_traits@G@std@@@std@@6B@" },
- { 0x013e, "??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@" },
- { 0x013f, "??_7?$basic_streambuf@DU?$char_traits@D@std@@@std@@6B@" },
- { 0x0140, "??_7?$basic_streambuf@GU?$char_traits@G@std@@@std@@6B@" },
- { 0x0141, "??_7?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@6B@" },
- { 0x0142, "??_7?$codecvt@DDH@std@@6B@" },
- { 0x0143, "??_7?$codecvt@GDH@std@@6B@" },
- { 0x0144, "??_7?$codecvt@_WDH@std@@6B@" },
- { 0x0145, "??_7?$ctype@D@std@@6B@" },
- { 0x0146, "??_7?$ctype@G@std@@6B@" },
- { 0x0147, "??_7?$ctype@_W@std@@6B@" },
- { 0x0148, "??_7?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@" },
- { 0x0149, "??_7?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@" },
- { 0x014a, "??_7?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@" },
- { 0x014b, "??_7?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@" },
- { 0x014c, "??_7?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@" },
- { 0x014d, "??_7?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@" },
- { 0x014e, "??_7?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@" },
- { 0x014f, "??_7?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@" },
- { 0x0150, "??_7?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@" },
- { 0x0151, "??_7?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@" },
- { 0x0152, "??_7?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@" },
- { 0x0153, "??_7?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@" },
- { 0x0154, "??_7_Facet_base@std@@6B@" },
- { 0x0155, "??_7_Locimp@locale@std@@6B@" },
- { 0x0156, "??_7_Pad@std@@6B@" },
- { 0x0157, "??_7codecvt_base@std@@6B@" },
- { 0x0158, "??_7ctype_base@std@@6B@" },
- { 0x0159, "??_7facet@locale@std@@6B@" },
- { 0x015a, "??_7ios_base@std@@6B@" },
- { 0x015b, "??_7time_base@std@@6B@" },
- { 0x015c, "??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@" },
- { 0x015d, "??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_ostream@DU?$char_traits@D@std@@@1@@" },
- { 0x015e, "??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_istream@GU?$char_traits@G@std@@@1@@" },
- { 0x015f, "??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_ostream@GU?$char_traits@G@std@@@1@@" },
- { 0x0160, "??_8?$basic_iostream@_WU?$char_traits@_W@std@@@std@@7B?$basic_istream@_WU?$char_traits@_W@std@@@1@@" },
- { 0x0161, "??_8?$basic_iostream@_WU?$char_traits@_W@std@@@std@@7B?$basic_ostream@_WU?$char_traits@_W@std@@@1@@" },
- { 0x0162, "??_8?$basic_istream@DU?$char_traits@D@std@@@std@@7B@" },
- { 0x0163, "??_8?$basic_istream@GU?$char_traits@G@std@@@std@@7B@" },
- { 0x0164, "??_8?$basic_istream@_WU?$char_traits@_W@std@@@std@@7B@" },
- { 0x0165, "??_8?$basic_ostream@DU?$char_traits@D@std@@@std@@7B@" },
- { 0x0166, "??_8?$basic_ostream@GU?$char_traits@G@std@@@std@@7B@" },
- { 0x0167, "??_8?$basic_ostream@_WU?$char_traits@_W@std@@@std@@7B@" },
- { 0x0168, "??_D?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAAXXZ" },
- { 0x0169, "??_D?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAAXXZ" },
- { 0x016a, "??_D?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ" },
- { 0x016b, "??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAXXZ" },
- { 0x016c, "??_D?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAXXZ" },
- { 0x016d, "??_D?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ" },
- { 0x016e, "??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ" },
- { 0x016f, "??_D?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ" },
- { 0x0170, "??_D?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ" },
- { 0x0171, "??_F?$codecvt@DDH@std@@QEAAXXZ" },
- { 0x0172, "??_F?$codecvt@GDH@std@@QEAAXXZ" },
- { 0x0173, "??_F?$codecvt@_WDH@std@@QEAAXXZ" },
- { 0x0174, "??_F?$ctype@D@std@@QEAAXXZ" },
- { 0x0175, "??_F?$ctype@G@std@@QEAAXXZ" },
- { 0x0176, "??_F?$ctype@_W@std@@QEAAXXZ" },
- { 0x0177, "??_F?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAAXXZ" },
- { 0x0178, "??_F?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAAXXZ" },
- { 0x0179, "??_F?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAAXXZ" },
- { 0x017a, "??_F?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAAXXZ" },
- { 0x017b, "??_F?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAAXXZ" },
- { 0x017c, "??_F?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAAXXZ" },
- { 0x017d, "??_F?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAAXXZ" },
- { 0x017e, "??_F?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAAXXZ" },
- { 0x017f, "??_F?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAAXXZ" },
- { 0x0180, "??_F?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAAXXZ" },
- { 0x0181, "??_F?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAAXXZ" },
- { 0x0182, "??_F?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAAXXZ" },
- { 0x0183, "??_F_Locinfo@std@@QEAAXXZ" },
- { 0x0184, "??_F_Timevec@std@@QEAAXXZ" },
- { 0x0185, "??_Fcodecvt_base@std@@QEAAXXZ" },
- { 0x0186, "??_Fctype_base@std@@QEAAXXZ" },
- { 0x0187, "??_Ffacet@locale@std@@QEAAXXZ" },
- { 0x0188, "??_Fid@locale@std@@QEAAXXZ" },
- { 0x0189, "??_Ftime_base@std@@QEAAXXZ" },
- { 0x018a, "?NFS_Allocate@details@Concurrency@@YAPEAX_K0PEAX@Z" },
- { 0x018b, "?NFS_Free@details@Concurrency@@YAXPEAX@Z" },
- { 0x018c, "?NFS_GetLineSize@details@Concurrency@@YA_KXZ" },
- { 0x018d, "?_10@placeholders@std@@3V?$_Ph@$09@2@A" },
- { 0x018e, "?_11@placeholders@std@@3V?$_Ph@$0L@@2@A" },
- { 0x018f, "?_12@placeholders@std@@3V?$_Ph@$0M@@2@A" },
- { 0x0190, "?_13@placeholders@std@@3V?$_Ph@$0N@@2@A" },
- { 0x0191, "?_14@placeholders@std@@3V?$_Ph@$0O@@2@A" },
- { 0x0192, "?_15@placeholders@std@@3V?$_Ph@$0P@@2@A" },
- { 0x0193, "?_16@placeholders@std@@3V?$_Ph@$0BA@@2@A" },
- { 0x0194, "?_17@placeholders@std@@3V?$_Ph@$0BB@@2@A" },
- { 0x0195, "?_18@placeholders@std@@3V?$_Ph@$0BC@@2@A" },
- { 0x0196, "?_19@placeholders@std@@3V?$_Ph@$0BD@@2@A" },
- { 0x0197, "?_1@placeholders@std@@3V?$_Ph@$00@2@A" },
- { 0x0198, "?_20@placeholders@std@@3V?$_Ph@$0BE@@2@A" },
- { 0x0199, "?_2@placeholders@std@@3V?$_Ph@$01@2@A" },
- { 0x019a, "?_3@placeholders@std@@3V?$_Ph@$02@2@A" },
- { 0x019b, "?_4@placeholders@std@@3V?$_Ph@$03@2@A" },
- { 0x019c, "?_5@placeholders@std@@3V?$_Ph@$04@2@A" },
- { 0x019d, "?_6@placeholders@std@@3V?$_Ph@$05@2@A" },
- { 0x019e, "?_7@placeholders@std@@3V?$_Ph@$06@2@A" },
- { 0x019f, "?_8@placeholders@std@@3V?$_Ph@$07@2@A" },
- { 0x01a0, "?_9@placeholders@std@@3V?$_Ph@$08@2@A" },
- { 0x01a1, "?_Add_vtordisp1@?$basic_ios@DU?$char_traits@D@std@@@std@@UEAAXXZ" },
- { 0x01a2, "?_Add_vtordisp1@?$basic_ios@GU?$char_traits@G@std@@@std@@UEAAXXZ" },
- { 0x01a3, "?_Add_vtordisp1@?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAAXXZ" },
- { 0x01a4, "?_Add_vtordisp1@?$basic_istream@DU?$char_traits@D@std@@@std@@UEAAXXZ" },
- { 0x01a5, "?_Add_vtordisp1@?$basic_istream@GU?$char_traits@G@std@@@std@@UEAAXXZ" },
- { 0x01a6, "?_Add_vtordisp1@?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAAXXZ" },
- { 0x01a7, "?_Add_vtordisp2@?$basic_ios@DU?$char_traits@D@std@@@std@@UEAAXXZ" },
- { 0x01a8, "?_Add_vtordisp2@?$basic_ios@GU?$char_traits@G@std@@@std@@UEAAXXZ" },
- { 0x01a9, "?_Add_vtordisp2@?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAAXXZ" },
- { 0x01aa, "?_Add_vtordisp2@?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAAXXZ" },
- { 0x01ab, "?_Add_vtordisp2@?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAAXXZ" },
- { 0x01ac, "?_Add_vtordisp2@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAAXXZ" },
- { 0x01ad, "?_Addcats@_Locinfo@std@@QEAAAEAV12@HPEBD@Z" },
- { 0x01ae, "?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z" },
- { 0x01af, "?_Addstd@ios_base@std@@SAXPEAV12@@Z" },
- { 0x01b0, "?_Advance@_Concurrent_queue_iterator_base_v4@details@Concurrency@@IEAAXXZ" },
- { 0x01b1, "?_Assign@_Concurrent_queue_iterator_base_v4@details@Concurrency@@IEAAXAEBV123@@Z" },
- { 0x01b2, "?_Atexit@@YAXP6AXXZ@Z" },
- { 0x01b3, "?_BADOFF@std@@3_JB" },
- { 0x01b4, "?_Byte_reverse_table@details@Concurrency@@3QBEB" },
- { 0x01b5, "?_C_str@?$_Yarn@D@std@@QEBAPEBDXZ" },
- { 0x01b6, "?_C_str@?$_Yarn@_W@std@@QEBAPEB_WXZ" },
- { 0x01b7, "?_Callfns@ios_base@std@@AEAAXW4event@12@@Z" },
- { 0x01b8, "?_Clocptr@_Locimp@locale@std@@0PEAV123@EA" },
- { 0x01b9, "?_Close_dir@sys@tr2@std@@YAXPEAX@Z" },
- { 0x01ba, "?_Copy_file@sys@tr2@std@@YAHPEBD0_N@Z" },
- { 0x01bb, "?_Copy_file@sys@tr2@std@@YAHPEB_W0_N@Z" },
- { 0x01bc, "?_Current_get@sys@tr2@std@@YAPEADPEAD@Z" },
- { 0x01bd, "?_Current_get@sys@tr2@std@@YAPEA_WPEA_W@Z" },
- { 0x01be, "?_Current_set@sys@tr2@std@@YA_NPEBD@Z" },
- { 0x01bf, "?_Current_set@sys@tr2@std@@YA_NPEB_W@Z" },
- { 0x01c0, "?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ" },
- { 0x01c1, "?_Donarrow@?$ctype@G@std@@IEBADGD@Z" },
- { 0x01c2, "?_Donarrow@?$ctype@_W@std@@IEBAD_WD@Z" },
- { 0x01c3, "?_Dowiden@?$ctype@G@std@@IEBAGD@Z" },
- { 0x01c4, "?_Dowiden@?$ctype@_W@std@@IEBA_WD@Z" },
- { 0x01c5, "?_Empty@?$_Yarn@D@std@@QEBA_NXZ" },
- { 0x01c6, "?_Empty@?$_Yarn@_W@std@@QEBA_NXZ" },
- { 0x01c7, "?_Equivalent@sys@tr2@std@@YAHPEBD0@Z" },
- { 0x01c8, "?_Equivalent@sys@tr2@std@@YAHPEB_W0@Z" },
- { 0x01c9, "?_Ffmt@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAPEADPEADDH@Z" },
- { 0x01ca, "?_Ffmt@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAPEADPEADDH@Z" },
- { 0x01cb, "?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAPEADPEADDH@Z" },
- { 0x01cc, "?_File_size@sys@tr2@std@@YA_KPEBD@Z" },
- { 0x01cd, "?_File_size@sys@tr2@std@@YA_KPEB_W@Z" },
- { 0x01ce, "?_Findarr@ios_base@std@@AEAAAEAU_Iosarray@12@H@Z" },
- { 0x01cf, "?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z" },
- { 0x01d0, "?_Fiopen@std@@YAPEAU_iobuf@@PEBGHH@Z" },
- { 0x01d1, "?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z" },
- { 0x01d2, "?_Fput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBD_K333@Z" },
- { 0x01d3, "?_Fput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GPEBD_K333@Z" },
- { 0x01d4, "?_Fput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBD_K444@Z" },
- { 0x01d5, "?_Future_error_map@std@@YAPEBDH@Z" },
- { 0x01d6, "?_GetCombinableSize@details@Concurrency@@YA_KXZ" },
- { 0x01d7, "?_GetCurrentThreadId@details@Concurrency@@YAKXZ" },
- { 0x01d8, "?_GetNextAsyncId@details@Concurrency@@YAIXZ" },
- { 0x01d9, "?_Get_future_error_what@std@@YAPEBDH@Z" },
- { 0x01da, "?_Getcat@?$codecvt@DDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z" },
- { 0x01db, "?_Getcat@?$codecvt@GDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z" },
- { 0x01dc, "?_Getcat@?$codecvt@_WDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z" },
- { 0x01dd, "?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z" },
- { 0x01de, "?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z" },
- { 0x01df, "?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z" },
- { 0x01e0, "?_Getcat@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z" },
- { 0x01e1, "?_Getcat@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z" },
- { 0x01e2, "?_Getcat@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z" },
- { 0x01e3, "?_Getcat@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z" },
- { 0x01e4, "?_Getcat@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z" },
- { 0x01e5, "?_Getcat@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z" },
- { 0x01e6, "?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z" },
- { 0x01e7, "?_Getcat@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z" },
- { 0x01e8, "?_Getcat@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z" },
- { 0x01e9, "?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z" },
- { 0x01ea, "?_Getcat@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z" },
- { 0x01eb, "?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z" },
- { 0x01ec, "?_Getcat@facet@locale@std@@SA_KPEAPEBV123@PEBV23@@Z" },
- { 0x01ed, "?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ" },
- { 0x01ee, "?_Getctype@_Locinfo@std@@QEBA?AU_Ctypevec@@XZ" },
- { 0x01ef, "?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ" },
- { 0x01f0, "?_Getdateorder@_Locinfo@std@@QEBAHXZ" },
- { 0x01f1, "?_Getdays@_Locinfo@std@@QEBAPEBDXZ" },
- { 0x01f2, "?_Getfalse@_Locinfo@std@@QEBAPEBDXZ" },
- { 0x01f3, "?_Getffld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1AEAVios_base@2@PEAH@Z" },
- { 0x01f4, "?_Getffld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1AEAVios_base@2@PEAH@Z" },
- { 0x01f5, "?_Getffld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1AEAVios_base@2@PEAH@Z" },
- { 0x01f6, "?_Getffldx@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1AEAVios_base@2@PEAH@Z" },
- { 0x01f7, "?_Getffldx@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1AEAVios_base@2@PEAH@Z" },
- { 0x01f8, "?_Getffldx@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1AEAVios_base@2@PEAH@Z" },
- { 0x01f9, "?_Getfmt@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD@Z" },
- { 0x01fa, "?_Getfmt@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD@Z" },
- { 0x01fb, "?_Getfmt@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD@Z" },
- { 0x01fc, "?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ" },
- { 0x01fd, "?_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1HAEBVlocale@2@@Z" },
- { 0x01fe, "?_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1HAEBVlocale@2@@Z" },
- { 0x01ff, "?_Getifld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1HAEBVlocale@2@@Z" },
- { 0x0200, "?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAHAEAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAEAHAEBV?$ctype@D@2@@Z" },
- { 0x0201, "?_Getint@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAHAEAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@0HHAEAHAEBV?$ctype@G@2@@Z" },
- { 0x0202, "?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAHAEAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAEAHAEBV?$ctype@_W@2@@Z" },
- { 0x0203, "?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ" },
- { 0x0204, "?_Getmonths@_Locinfo@std@@QEBAPEBDXZ" },
- { 0x0205, "?_Getname@_Locinfo@std@@QEBAPEBDXZ" },
- { 0x0206, "?_Getpfirst@_Container_base12@std@@QEBAPEAPEAU_Iterator_base12@2@XZ" },
- { 0x0207, "?_Getptr@_Timevec@std@@QEBAPEAXXZ" },
- { 0x0208, "?_Gettnames@_Locinfo@std@@QEBA?AV_Timevec@2@XZ" },
- { 0x0209, "?_Gettrue@_Locinfo@std@@QEBAPEBDXZ" },
- { 0x020a, "?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ" },
- { 0x020b, "?_Gnavail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBA_JXZ" },
- { 0x020c, "?_Gnavail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBA_JXZ" },
- { 0x020d, "?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ" },
- { 0x020e, "?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ" },
- { 0x020f, "?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ" },
- { 0x0210, "?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ" },
- { 0x0211, "?_Gninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ" },
- { 0x0212, "?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ" },
- { 0x0213, "?_Gnpreinc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ" },
- { 0x0214, "?_Gnpreinc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ" },
- { 0x0215, "?_Gnpreinc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ" },
- { 0x0216, "?_Id_cnt@id@locale@std@@0HA" },
- { 0x0217, "?_Ifmt@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAPEADPEADPEBDH@Z" },
- { 0x0218, "?_Ifmt@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAPEADPEADPEBDH@Z" },
- { 0x0219, "?_Ifmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAPEADPEADPEBDH@Z" },
- { 0x021a, "?_Incref@facet@locale@std@@UEAAXXZ" },
- { 0x021b, "?_Index@ios_base@std@@0HA" },
- { 0x021c, "?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z" },
- { 0x021d, "?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ" },
- { 0x021e, "?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAPEAG0PEAH001@Z" },
- { 0x021f, "?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXXZ" },
- { 0x0220, "?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEAPEA_W0PEAH001@Z" },
- { 0x0221, "?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ" },
- { 0x0222, "?_Init@?$codecvt@DDH@std@@IEAAXAEBV_Locinfo@2@@Z" },
- { 0x0223, "?_Init@?$codecvt@GDH@std@@IEAAXAEBV_Locinfo@2@@Z" },
- { 0x0224, "?_Init@?$codecvt@_WDH@std@@IEAAXAEBV_Locinfo@2@@Z" },
- { 0x0225, "?_Init@?$ctype@D@std@@IEAAXAEBV_Locinfo@2@@Z" },
- { 0x0226, "?_Init@?$ctype@G@std@@IEAAXAEBV_Locinfo@2@@Z" },
- { 0x0227, "?_Init@?$ctype@_W@std@@IEAAXAEBV_Locinfo@2@@Z" },
- { 0x0228, "?_Init@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z" },
- { 0x0229, "?_Init@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z" },
- { 0x022a, "?_Init@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z" },
- { 0x022b, "?_Init@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z" },
- { 0x022c, "?_Init@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z" },
- { 0x022d, "?_Init@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z" },
- { 0x022e, "?_Init@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z" },
- { 0x022f, "?_Init@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z" },
- { 0x0230, "?_Init@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z" },
- { 0x0231, "?_Init@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z" },
- { 0x0232, "?_Init@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z" },
- { 0x0233, "?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAXAEBV_Locinfo@2@@Z" },
- { 0x0234, "?_Init@ios_base@std@@IEAAXXZ" },
- { 0x0235, "?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z" },
- { 0x0236, "?_Init_cnt@Init@ios_base@std@@0HA" },
- { 0x0237, "?_Init_cnt@_UShinit@std@@0HA" },
- { 0x0238, "?_Init_cnt@_Winit@std@@0HA" },
- { 0x0239, "?_Init_cnt_func@Init@ios_base@std@@CAAEAHXZ" },
- { 0x023a, "?_Init_ctor@Init@ios_base@std@@CAXPEAV123@@Z" },
- { 0x023b, "?_Init_dtor@Init@ios_base@std@@CAXPEAV123@@Z" },
- { 0x023c, "?_Init_locks_ctor@_Init_locks@std@@CAXPEAV12@@Z" },
- { 0x023d, "?_Init_locks_dtor@_Init_locks@std@@CAXPEAV12@@Z" },
- { 0x023e, "?_Internal_assign@_Concurrent_vector_base_v4@details@Concurrency@@IEAAXAEBV123@_KP6AXPEAX1@ZP6AX2PEBX1@Z5@Z" },
- { 0x023f, "?_Internal_capacity@_Concurrent_vector_base_v4@details@Concurrency@@IEBA_KXZ" },
- { 0x0240, "?_Internal_clear@_Concurrent_vector_base_v4@details@Concurrency@@IEAA_KP6AXPEAX_K@Z@Z" },
- { 0x0241, "?_Internal_compact@_Concurrent_vector_base_v4@details@Concurrency@@IEAAPEAX_KPEAXP6AX10@ZP6AX1PEBX0@Z@Z" },
- { 0x0242, "?_Internal_copy@_Concurrent_vector_base_v4@details@Concurrency@@IEAAXAEBV123@_KP6AXPEAXPEBX1@Z@Z" },
- { 0x0243, "?_Internal_empty@_Concurrent_queue_base_v4@details@Concurrency@@IEBA_NXZ" },
- { 0x0244, "?_Internal_finish_clear@_Concurrent_queue_base_v4@details@Concurrency@@IEAAXXZ" },
- { 0x0245, "?_Internal_grow_by@_Concurrent_vector_base_v4@details@Concurrency@@IEAA_K_K0P6AXPEAXPEBX0@Z2@Z" },
- { 0x0246, "?_Internal_grow_to_at_least_with_result@_Concurrent_vector_base_v4@details@Concurrency@@IEAA_K_K0P6AXPEAXPEBX0@Z2@Z" },
- { 0x0247, "?_Internal_move_push@_Concurrent_queue_base_v4@details@Concurrency@@IEAAXPEAX@Z" },
- { 0x0248, "?_Internal_pop_if_present@_Concurrent_queue_base_v4@details@Concurrency@@IEAA_NPEAX@Z" },
- { 0x0249, "?_Internal_push@_Concurrent_queue_base_v4@details@Concurrency@@IEAAXPEBX@Z" },
- { 0x024a, "?_Internal_push_back@_Concurrent_vector_base_v4@details@Concurrency@@IEAAPEAX_KAEA_K@Z" },
- { 0x024b, "?_Internal_reserve@_Concurrent_vector_base_v4@details@Concurrency@@IEAAX_K00@Z" },
- { 0x024c, "?_Internal_resize@_Concurrent_vector_base_v4@details@Concurrency@@IEAAX_K00P6AXPEAX0@ZP6AX1PEBX0@Z3@Z" },
- { 0x024d, "?_Internal_size@_Concurrent_queue_base_v4@details@Concurrency@@IEBA_KXZ" },
- { 0x024e, "?_Internal_swap@_Concurrent_queue_base_v4@details@Concurrency@@IEAAXAEAV123@@Z" },
- { 0x024f, "?_Internal_swap@_Concurrent_vector_base_v4@details@Concurrency@@IEAAXAEAV123@@Z" },
- { 0x0250, "?_Internal_throw_exception@_Concurrent_queue_base_v4@details@Concurrency@@IEBAXXZ" },
- { 0x0251, "?_Internal_throw_exception@_Concurrent_vector_base_v4@details@Concurrency@@IEBAX_K@Z" },
- { 0x0252, "?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z" },
- { 0x0253, "?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z" },
- { 0x0254, "?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA_N_N@Z" },
- { 0x0255, "?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z" },
- { 0x0256, "?_Iput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEAD_K@Z" },
- { 0x0257, "?_Iput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GPEAD_K@Z" },
- { 0x0258, "?_Iput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEAD_K@Z" },
- { 0x0259, "?_Last_write_time@sys@tr2@std@@YAXPEBD_J@Z" },
- { 0x025a, "?_Last_write_time@sys@tr2@std@@YAXPEB_W_J@Z" },
- { 0x025b, "?_Last_write_time@sys@tr2@std@@YA_JPEBD@Z" },
- { 0x025c, "?_Last_write_time@sys@tr2@std@@YA_JPEB_W@Z" },
- { 0x025d, "?_Launch@_Pad@std@@QEAAXPEAU_Thrd_imp_t@@@Z" },
- { 0x025e, "?_Link@sys@tr2@std@@YAHPEBD0@Z" },
- { 0x025f, "?_Link@sys@tr2@std@@YAHPEB_W0@Z" },
- { 0x0260, "?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z" },
- { 0x0261, "?_Locimp_ctor@_Locimp@locale@std@@CAXPEAV123@AEBV123@@Z" },
- { 0x0262, "?_Locimp_dtor@_Locimp@locale@std@@CAXPEAV123@@Z" },
- { 0x0263, "?_Locinfo_Addcats@_Locinfo@std@@SAAEAV12@PEAV12@HPEBD@Z" },
- { 0x0264, "?_Locinfo_ctor@_Locinfo@std@@SAXPEAV12@HPEBD@Z" },
- { 0x0265, "?_Locinfo_ctor@_Locinfo@std@@SAXPEAV12@PEBD@Z" },
- { 0x0266, "?_Locinfo_dtor@_Locinfo@std@@SAXPEAV12@@Z" },
- { 0x0267, "?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ" },
- { 0x0268, "?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ" },
- { 0x0269, "?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ" },
- { 0x026a, "?_Lockit_ctor@_Lockit@std@@CAXPEAV12@@Z" },
- { 0x026b, "?_Lockit_ctor@_Lockit@std@@CAXPEAV12@H@Z" },
- { 0x026c, "?_Lockit_ctor@_Lockit@std@@SAXH@Z" },
- { 0x026d, "?_Lockit_dtor@_Lockit@std@@CAXPEAV12@@Z" },
- { 0x026e, "?_Lockit_dtor@_Lockit@std@@SAXH@Z" },
- { 0x026f, "?_Lstat@sys@tr2@std@@YA?AW4file_type@123@PEBDAEAH@Z" },
- { 0x0270, "?_Lstat@sys@tr2@std@@YA?AW4file_type@123@PEB_WAEAH@Z" },
- { 0x0271, "?_MP_Add@std@@YAXQEA_K_K@Z" },
- { 0x0272, "?_MP_Get@std@@YA_KQEA_K@Z" },
- { 0x0273, "?_MP_Mul@std@@YAXQEA_K_K1@Z" },
- { 0x0274, "?_MP_Rem@std@@YAXQEA_K_K@Z" },
- { 0x0275, "?_Make_dir@sys@tr2@std@@YAHPEBD@Z" },
- { 0x0276, "?_Make_dir@sys@tr2@std@@YAHPEB_W@Z" },
- { 0x0277, "?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z" },
- { 0x0278, "?_Makeushloc@_Locimp@locale@std@@CAXAEBV_Locinfo@3@HPEAV123@PEBV23@@Z" },
- { 0x0279, "?_Makewloc@_Locimp@locale@std@@CAXAEBV_Locinfo@3@HPEAV123@PEBV23@@Z" },
- { 0x027a, "?_Makexloc@_Locimp@locale@std@@CAXAEBV_Locinfo@3@HPEAV123@PEBV23@@Z" },
- { 0x027b, "?_Mtx_delete@threads@stdext@@YAXPEAX@Z" },
- { 0x027c, "?_Mtx_lock@threads@stdext@@YAXPEAX@Z" },
- { 0x027d, "?_Mtx_new@threads@stdext@@YAXAEAPEAX@Z" },
- { 0x027e, "?_Mtx_unlock@threads@stdext@@YAXPEAX@Z" },
- { 0x027f, "?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z" },
- { 0x0280, "?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z" },
- { 0x0281, "?_Open_dir@sys@tr2@std@@YAPEAXPEADPEBDAEAHAEAW4file_type@123@@Z" },
- { 0x0282, "?_Open_dir@sys@tr2@std@@YAPEAXPEA_WPEB_WAEAHAEAW4file_type@123@@Z" },
- { 0x0283, "?_Orphan_all@_Container_base0@std@@QEAAXXZ" },
- { 0x0284, "?_Orphan_all@_Container_base12@std@@QEAAXXZ" },
- { 0x0285, "?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ" },
- { 0x0286, "?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ" },
- { 0x0287, "?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ" },
- { 0x0288, "?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ" },
- { 0x0289, "?_Pnavail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBA_JXZ" },
- { 0x028a, "?_Pnavail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBA_JXZ" },
- { 0x028b, "?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ" },
- { 0x028c, "?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ" },
- { 0x028d, "?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ" },
- { 0x028e, "?_Ptr_cerr@std@@3PEAV?$basic_ostream@DU?$char_traits@D@std@@@1@EA" },
- { 0x028f, "?_Ptr_cin@std@@3PEAV?$basic_istream@DU?$char_traits@D@std@@@1@EA" },
- { 0x0290, "?_Ptr_clog@std@@3PEAV?$basic_ostream@DU?$char_traits@D@std@@@1@EA" },
- { 0x0291, "?_Ptr_cout@std@@3PEAV?$basic_ostream@DU?$char_traits@D@std@@@1@EA" },
- { 0x0292, "?_Ptr_wcerr@std@@3PEAV?$basic_ostream@GU?$char_traits@G@std@@@1@EA" },
- { 0x0293, "?_Ptr_wcerr@std@@3PEAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@EA" },
- { 0x0294, "?_Ptr_wcin@std@@3PEAV?$basic_istream@GU?$char_traits@G@std@@@1@EA" },
- { 0x0295, "?_Ptr_wcin@std@@3PEAV?$basic_istream@_WU?$char_traits@_W@std@@@1@EA" },
- { 0x0296, "?_Ptr_wclog@std@@3PEAV?$basic_ostream@GU?$char_traits@G@std@@@1@EA" },
- { 0x0297, "?_Ptr_wclog@std@@3PEAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@EA" },
- { 0x0298, "?_Ptr_wcout@std@@3PEAV?$basic_ostream@GU?$char_traits@G@std@@@1@EA" },
- { 0x0299, "?_Ptr_wcout@std@@3PEAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@EA" },
- { 0x029a, "?_Put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@PEBD_K@Z" },
- { 0x029b, "?_Put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@PEBG_K@Z" },
- { 0x029c, "?_Put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@PEB_W_K@Z" },
- { 0x029d, "?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA" },
- { 0x029e, "?_Random_device@std@@YAIXZ" },
- { 0x029f, "?_Read_dir@sys@tr2@std@@YAPEADPEADPEAXAEAW4file_type@123@@Z" },
- { 0x02a0, "?_Read_dir@sys@tr2@std@@YAPEA_WPEA_WPEAXAEAW4file_type@123@@Z" },
- { 0x02a1, "?_Release@_Pad@std@@QEAAXXZ" },
- { 0x02a2, "?_Remove_dir@sys@tr2@std@@YA_NPEBD@Z" },
- { 0x02a3, "?_Remove_dir@sys@tr2@std@@YA_NPEB_W@Z" },
- { 0x02a4, "?_Rename@sys@tr2@std@@YAHPEBD0@Z" },
- { 0x02a5, "?_Rename@sys@tr2@std@@YAHPEB_W0@Z" },
- { 0x02a6, "?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@D_K@Z" },
- { 0x02a7, "?_Rep@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@G_K@Z" },
- { 0x02a8, "?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_W_K@Z" },
- { 0x02a9, "?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z" },
- { 0x02aa, "?_Rng_abort@std@@YAXPEBD@Z" },
- { 0x02ab, "?_Segment_index_of@_Concurrent_vector_base_v4@details@Concurrency@@KA_K_K@Z" },
- { 0x02ac, "?_Setgloballocale@locale@std@@CAXPEAX@Z" },
- { 0x02ad, "?_Src@?1??_Getffldx@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@DU?$char_traits@D@std@@@3@1AEAVios_base@3@PEAH@Z@4QBDB" },
- { 0x02ae, "?_Src@?1??_Getffldx@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@GU?$char_traits@G@std@@@3@1AEAVios_base@3@PEAH@Z@4QBDB" },
- { 0x02af, "?_Src@?1??_Getffldx@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@3@1AEAVios_base@3@PEAH@Z@4QBDB" },
- { 0x02b0, "?_Src@?1??_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@DU?$char_traits@D@std@@@3@1HAEBVlocale@3@@Z@4QBDB" },
- { 0x02b1, "?_Src@?1??_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@GU?$char_traits@G@std@@@3@1HAEBVlocale@3@@Z@4QBDB" },
- { 0x02b2, "?_Src@?1??_Getifld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@3@1HAEBVlocale@3@@Z@4QBDB" },
- { 0x02b3, "?_Src@?3??_Getffld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@DU?$char_traits@D@std@@@3@1AEAVios_base@3@PEAH@Z@4QBDB" },
- { 0x02b4, "?_Src@?3??_Getffld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@GU?$char_traits@G@std@@@3@1AEAVios_base@3@PEAH@Z@4QBDB" },
- { 0x02b5, "?_Src@?3??_Getffld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEBAHPEADAEAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@3@1AEAVios_base@3@PEAH@Z@4QBDB" },
- { 0x02b6, "?_Stat@sys@tr2@std@@YA?AW4file_type@123@PEBDAEAH@Z" },
- { 0x02b7, "?_Stat@sys@tr2@std@@YA?AW4file_type@123@PEB_WAEAH@Z" },
- { 0x02b8, "?_Statvfs@sys@tr2@std@@YA?AUspace_info@123@PEBD@Z" },
- { 0x02b9, "?_Statvfs@sys@tr2@std@@YA?AUspace_info@123@PEB_W@Z" },
- { 0x02ba, "?_Swap_all@_Container_base0@std@@QEAAXAEAU12@@Z" },
- { 0x02bb, "?_Swap_all@_Container_base12@std@@QEAAXAEAU12@@Z" },
- { 0x02bc, "?_Symlink@sys@tr2@std@@YAHPEBD0@Z" },
- { 0x02bd, "?_Symlink@sys@tr2@std@@YAHPEB_W0@Z" },
- { 0x02be, "?_Sync@ios_base@std@@0_NA" },
- { 0x02bf, "?_Syserror_map@std@@YAPEBDH@Z" },
- { 0x02c0, "?_Throw_C_error@std@@YAXH@Z" },
- { 0x02c1, "?_Throw_Cpp_error@std@@YAXH@Z" },
- { 0x02c2, "?_Throw_future_error@std@@YAXAEBVerror_code@1@@Z" },
- { 0x02c3, "?_Throw_lock_error@threads@stdext@@YAXXZ" },
- { 0x02c4, "?_Throw_resource_error@threads@stdext@@YAXXZ" },
- { 0x02c5, "?_Tidy@?$_Yarn@D@std@@AEAAXXZ" },
- { 0x02c6, "?_Tidy@?$_Yarn@_W@std@@AEAAXXZ" },
- { 0x02c7, "?_Tidy@?$ctype@D@std@@IEAAXXZ" },
- { 0x02c8, "?_Tidy@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AEAAXXZ" },
- { 0x02c9, "?_Tidy@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AEAAXXZ" },
- { 0x02ca, "?_Tidy@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AEAAXXZ" },
- { 0x02cb, "?_Tidy@ios_base@std@@AEAAXXZ" },
- { 0x02cc, "?_Unlink@sys@tr2@std@@YAHPEBD@Z" },
- { 0x02cd, "?_Unlink@sys@tr2@std@@YAHPEB_W@Z" },
- { 0x02ce, "?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ" },
- { 0x02cf, "?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ" },
- { 0x02d0, "?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ" },
- { 0x02d1, "?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ" },
- { 0x02d2, "?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ" },
- { 0x02d3, "?_W_Gettnames@_Locinfo@std@@QEBA?AV_Timevec@2@XZ" },
- { 0x02d4, "?_Winerror_map@std@@YAPEBDH@Z" },
- { 0x02d5, "?_XLgamma@std@@YAMM@Z" },
- { 0x02d6, "?_XLgamma@std@@YANN@Z" },
- { 0x02d7, "?_XLgamma@std@@YAOO@Z" },
- { 0x02d8, "?_Xbad_alloc@std@@YAXXZ" },
- { 0x02d9, "?_Xbad_function_call@std@@YAXXZ" },
- { 0x02da, "?_Xinvalid_argument@std@@YAXPEBD@Z" },
- { 0x02db, "?_Xlength_error@std@@YAXPEBD@Z" },
- { 0x02dc, "?_Xout_of_range@std@@YAXPEBD@Z" },
- { 0x02dd, "?_Xoverflow_error@std@@YAXPEBD@Z" },
- { 0x02de, "?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z" },
- { 0x02df, "?_Xruntime_error@std@@YAXPEBD@Z" },
- { 0x02e0, "?adopt_lock@std@@3Uadopt_lock_t@1@B" },
- { 0x02e1, "?always_noconv@codecvt_base@std@@QEBA_NXZ" },
- { 0x02e2, "?bad@ios_base@std@@QEBA_NXZ" },
- { 0x02e3, "?c_str@?$_Yarn@D@std@@QEBAPEBDXZ" },
- { 0x02e4, "?cancel@agent@Concurrency@@QEAA_NXZ" },
- { 0x02e5, "?cancel_current_task@Concurrency@@YAXXZ" },
- { 0x02e6, "?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A" },
- { 0x02e7, "?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A" },
- { 0x02e8, "?classic@locale@std@@SAAEBV12@XZ" },
- { 0x02e9, "?classic_table@?$ctype@D@std@@SAPEBFXZ" },
- { 0x02ea, "?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z" },
- { 0x02eb, "?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXI@Z" },
- { 0x02ec, "?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z" },
- { 0x02ed, "?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXI@Z" },
- { 0x02ee, "?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z" },
- { 0x02ef, "?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXI@Z" },
- { 0x02f0, "?clear@ios_base@std@@QEAAXH@Z" },
- { 0x02f1, "?clear@ios_base@std@@QEAAXH_N@Z" },
- { 0x02f2, "?clear@ios_base@std@@QEAAXI@Z" },
- { 0x02f3, "?clog@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A" },
- { 0x02f4, "?copyfmt@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEBV12@@Z" },
- { 0x02f5, "?copyfmt@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAAEAV12@AEBV12@@Z" },
- { 0x02f6, "?copyfmt@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@AEBV12@@Z" },
- { 0x02f7, "?copyfmt@ios_base@std@@QEAAAEAV12@AEBV12@@Z" },
- { 0x02f8, "?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A" },
- { 0x02f9, "?date_order@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AW4dateorder@time_base@2@XZ" },
- { 0x02fa, "?date_order@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AW4dateorder@time_base@2@XZ" },
- { 0x02fb, "?date_order@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AW4dateorder@time_base@2@XZ" },
- { 0x02fc, "?defer_lock@std@@3Udefer_lock_t@1@B" },
- { 0x02fd, "?do_always_noconv@?$codecvt@DDH@std@@MEBA_NXZ" },
- { 0x02fe, "?do_always_noconv@?$codecvt@GDH@std@@MEBA_NXZ" },
- { 0x02ff, "?do_always_noconv@?$codecvt@_WDH@std@@MEBA_NXZ" },
- { 0x0300, "?do_always_noconv@codecvt_base@std@@MEBA_NXZ" },
- { 0x0301, "?do_date_order@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AW4dateorder@time_base@2@XZ" },
- { 0x0302, "?do_date_order@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AW4dateorder@time_base@2@XZ" },
- { 0x0303, "?do_date_order@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AW4dateorder@time_base@2@XZ" },
- { 0x0304, "?do_encoding@?$codecvt@GDH@std@@MEBAHXZ" },
- { 0x0305, "?do_encoding@?$codecvt@_WDH@std@@MEBAHXZ" },
- { 0x0306, "?do_encoding@codecvt_base@std@@MEBAHXZ" },
- { 0x0307, "?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAG@Z" },
- { 0x0308, "?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAI@Z" },
- { 0x0309, "?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAJ@Z" },
- { 0x030a, "?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAK@Z" },
- { 0x030b, "?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAM@Z" },
- { 0x030c, "?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAN@Z" },
- { 0x030d, "?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAO@Z" },
- { 0x030e, "?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAPEAX@Z" },
- { 0x030f, "?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEA_J@Z" },
- { 0x0310, "?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEA_K@Z" },
- { 0x0311, "?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEA_N@Z" },
- { 0x0312, "?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAG@Z" },
- { 0x0313, "?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAI@Z" },
- { 0x0314, "?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAJ@Z" },
- { 0x0315, "?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAK@Z" },
- { 0x0316, "?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAM@Z" },
- { 0x0317, "?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAN@Z" },
- { 0x0318, "?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAO@Z" },
- { 0x0319, "?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAPEAX@Z" },
- { 0x031a, "?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEA_J@Z" },
- { 0x031b, "?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEA_K@Z" },
- { 0x031c, "?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEA_N@Z" },
- { 0x031d, "?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAG@Z" },
- { 0x031e, "?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAI@Z" },
- { 0x031f, "?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAJ@Z" },
- { 0x0320, "?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAK@Z" },
- { 0x0321, "?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAM@Z" },
- { 0x0322, "?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAN@Z" },
- { 0x0323, "?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAO@Z" },
- { 0x0324, "?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAPEAX@Z" },
- { 0x0325, "?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEA_J@Z" },
- { 0x0326, "?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEA_K@Z" },
- { 0x0327, "?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEA_N@Z" },
- { 0x0328, "?do_get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@DD@Z" },
- { 0x0329, "?do_get@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@DD@Z" },
- { 0x032a, "?do_get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@DD@Z" },
- { 0x032b, "?do_get_date@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x032c, "?do_get_date@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x032d, "?do_get_date@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x032e, "?do_get_monthname@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x032f, "?do_get_monthname@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x0330, "?do_get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x0331, "?do_get_time@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x0332, "?do_get_time@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x0333, "?do_get_time@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x0334, "?do_get_weekday@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x0335, "?do_get_weekday@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x0336, "?do_get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x0337, "?do_get_year@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x0338, "?do_get_year@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x0339, "?do_get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x033a, "?do_in@?$codecvt@DDH@std@@MEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z" },
- { 0x033b, "?do_in@?$codecvt@GDH@std@@MEBAHAEAHPEBD1AEAPEBDPEAG3AEAPEAG@Z" },
- { 0x033c, "?do_in@?$codecvt@_WDH@std@@MEBAHAEAHPEBD1AEAPEBDPEA_W3AEAPEA_W@Z" },
- { 0x033d, "?do_is@?$ctype@G@std@@MEBAPEBGPEBG0PEAF@Z" },
- { 0x033e, "?do_is@?$ctype@G@std@@MEBA_NFG@Z" },
- { 0x033f, "?do_is@?$ctype@_W@std@@MEBAPEB_WPEB_W0PEAF@Z" },
- { 0x0340, "?do_is@?$ctype@_W@std@@MEBA_NF_W@Z" },
- { 0x0341, "?do_length@?$codecvt@DDH@std@@MEBAHAEAHPEBD1_K@Z" },
- { 0x0342, "?do_length@?$codecvt@GDH@std@@MEBAHAEAHPEBD1_K@Z" },
- { 0x0343, "?do_length@?$codecvt@_WDH@std@@MEBAHAEAHPEBD1_K@Z" },
- { 0x0344, "?do_max_length@?$codecvt@GDH@std@@MEBAHXZ" },
- { 0x0345, "?do_max_length@?$codecvt@_WDH@std@@MEBAHXZ" },
- { 0x0346, "?do_max_length@codecvt_base@std@@MEBAHXZ" },
- { 0x0347, "?do_narrow@?$ctype@D@std@@MEBADDD@Z" },
- { 0x0348, "?do_narrow@?$ctype@D@std@@MEBAPEBDPEBD0DPEAD@Z" },
- { 0x0349, "?do_narrow@?$ctype@G@std@@MEBADGD@Z" },
- { 0x034a, "?do_narrow@?$ctype@G@std@@MEBAPEBGPEBG0DPEAD@Z" },
- { 0x034b, "?do_narrow@?$ctype@_W@std@@MEBAD_WD@Z" },
- { 0x034c, "?do_narrow@?$ctype@_W@std@@MEBAPEB_WPEB_W0DPEAD@Z" },
- { 0x034d, "?do_out@?$codecvt@DDH@std@@MEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z" },
- { 0x034e, "?do_out@?$codecvt@GDH@std@@MEBAHAEAHPEBG1AEAPEBGPEAD3AEAPEAD@Z" },
- { 0x034f, "?do_out@?$codecvt@_WDH@std@@MEBAHAEAHPEB_W1AEAPEB_WPEAD3AEAPEAD@Z" },
- { 0x0350, "?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DJ@Z" },
- { 0x0351, "?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DK@Z" },
- { 0x0352, "?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DN@Z" },
- { 0x0353, "?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DO@Z" },
- { 0x0354, "?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBX@Z" },
- { 0x0355, "?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@D_J@Z" },
- { 0x0356, "?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@D_K@Z" },
- { 0x0357, "?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@D_N@Z" },
- { 0x0358, "?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GJ@Z" },
- { 0x0359, "?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GK@Z" },
- { 0x035a, "?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GN@Z" },
- { 0x035b, "?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GO@Z" },
- { 0x035c, "?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GPEBX@Z" },
- { 0x035d, "?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@G_J@Z" },
- { 0x035e, "?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@G_K@Z" },
- { 0x035f, "?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@G_N@Z" },
- { 0x0360, "?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WJ@Z" },
- { 0x0361, "?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WK@Z" },
- { 0x0362, "?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WN@Z" },
- { 0x0363, "?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WO@Z" },
- { 0x0364, "?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBX@Z" },
- { 0x0365, "?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_W_J@Z" },
- { 0x0366, "?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_W_K@Z" },
- { 0x0367, "?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_W_N@Z" },
- { 0x0368, "?do_put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@DD@Z" },
- { 0x0369, "?do_put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GPEBUtm@@DD@Z" },
- { 0x036a, "?do_put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@DD@Z" },
- { 0x036b, "?do_scan_is@?$ctype@G@std@@MEBAPEBGFPEBG0@Z" },
- { 0x036c, "?do_scan_is@?$ctype@_W@std@@MEBAPEB_WFPEB_W0@Z" },
- { 0x036d, "?do_scan_not@?$ctype@G@std@@MEBAPEBGFPEBG0@Z" },
- { 0x036e, "?do_scan_not@?$ctype@_W@std@@MEBAPEB_WFPEB_W0@Z" },
- { 0x036f, "?do_tolower@?$ctype@D@std@@MEBADD@Z" },
- { 0x0370, "?do_tolower@?$ctype@D@std@@MEBAPEBDPEADPEBD@Z" },
- { 0x0371, "?do_tolower@?$ctype@G@std@@MEBAGG@Z" },
- { 0x0372, "?do_tolower@?$ctype@G@std@@MEBAPEBGPEAGPEBG@Z" },
- { 0x0373, "?do_tolower@?$ctype@_W@std@@MEBAPEB_WPEA_WPEB_W@Z" },
- { 0x0374, "?do_tolower@?$ctype@_W@std@@MEBA_W_W@Z" },
- { 0x0375, "?do_toupper@?$ctype@D@std@@MEBADD@Z" },
- { 0x0376, "?do_toupper@?$ctype@D@std@@MEBAPEBDPEADPEBD@Z" },
- { 0x0377, "?do_toupper@?$ctype@G@std@@MEBAGG@Z" },
- { 0x0378, "?do_toupper@?$ctype@G@std@@MEBAPEBGPEAGPEBG@Z" },
- { 0x0379, "?do_toupper@?$ctype@_W@std@@MEBAPEB_WPEA_WPEB_W@Z" },
- { 0x037a, "?do_toupper@?$ctype@_W@std@@MEBA_W_W@Z" },
- { 0x037b, "?do_unshift@?$codecvt@DDH@std@@MEBAHAEAHPEAD1AEAPEAD@Z" },
- { 0x037c, "?do_unshift@?$codecvt@GDH@std@@MEBAHAEAHPEAD1AEAPEAD@Z" },
- { 0x037d, "?do_unshift@?$codecvt@_WDH@std@@MEBAHAEAHPEAD1AEAPEAD@Z" },
- { 0x037e, "?do_widen@?$ctype@D@std@@MEBADD@Z" },
- { 0x037f, "?do_widen@?$ctype@D@std@@MEBAPEBDPEBD0PEAD@Z" },
- { 0x0380, "?do_widen@?$ctype@G@std@@MEBAGD@Z" },
- { 0x0381, "?do_widen@?$ctype@G@std@@MEBAPEBDPEBD0PEAG@Z" },
- { 0x0382, "?do_widen@?$ctype@_W@std@@MEBAPEBDPEBD0PEA_W@Z" },
- { 0x0383, "?do_widen@?$ctype@_W@std@@MEBA_WD@Z" },
- { 0x0384, "?done@agent@Concurrency@@IEAA_NXZ" },
- { 0x0385, "?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ" },
- { 0x0386, "?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ" },
- { 0x0387, "?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ" },
- { 0x0388, "?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ" },
- { 0x0389, "?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ" },
- { 0x038a, "?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ" },
- { 0x038b, "?empty@?$_Yarn@D@std@@QEBA_NXZ" },
- { 0x038c, "?empty@locale@std@@SA?AV12@XZ" },
- { 0x038d, "?encoding@codecvt_base@std@@QEBAHXZ" },
- { 0x038e, "?endl@std@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@1@AEAV21@@Z" },
- { 0x038f, "?endl@std@@YAAEAV?$basic_ostream@GU?$char_traits@G@std@@@1@AEAV21@@Z" },
- { 0x0390, "?endl@std@@YAAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@AEAV21@@Z" },
- { 0x0391, "?ends@std@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@1@AEAV21@@Z" },
- { 0x0392, "?ends@std@@YAAEAV?$basic_ostream@GU?$char_traits@G@std@@@1@AEAV21@@Z" },
- { 0x0393, "?ends@std@@YAAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@AEAV21@@Z" },
- { 0x0394, "?eof@ios_base@std@@QEBA_NXZ" },
- { 0x0395, "?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ" },
- { 0x0396, "?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ" },
- { 0x0397, "?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ" },
- { 0x0398, "?exceptions@ios_base@std@@QEAAXH@Z" },
- { 0x0399, "?exceptions@ios_base@std@@QEAAXI@Z" },
- { 0x039a, "?exceptions@ios_base@std@@QEBAHXZ" },
- { 0x039b, "?fail@ios_base@std@@QEBA_NXZ" },
- { 0x039c, "?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z" },
- { 0x039d, "?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ" },
- { 0x039e, "?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAGG@Z" },
- { 0x039f, "?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ" },
- { 0x03a0, "?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA_W_W@Z" },
- { 0x03a1, "?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ" },
- { 0x03a2, "?flags@ios_base@std@@QEAAHH@Z" },
- { 0x03a3, "?flags@ios_base@std@@QEBAHXZ" },
- { 0x03a4, "?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ" },
- { 0x03a5, "?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ" },
- { 0x03a6, "?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ" },
- { 0x03a7, "?flush@std@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@1@AEAV21@@Z" },
- { 0x03a8, "?flush@std@@YAAEAV?$basic_ostream@GU?$char_traits@G@std@@@1@AEAV21@@Z" },
- { 0x03a9, "?flush@std@@YAAEAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@AEAV21@@Z" },
- { 0x03aa, "?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z" },
- { 0x03ab, "?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z" },
- { 0x03ac, "?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z" },
- { 0x03ad, "?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QEBA_JXZ" },
- { 0x03ae, "?gcount@?$basic_istream@GU?$char_traits@G@std@@@std@@QEBA_JXZ" },
- { 0x03af, "?gcount@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEBA_JXZ" },
- { 0x03b0, "?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEAD@Z" },
- { 0x03b1, "?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@@Z" },
- { 0x03b2, "?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@D@Z" },
- { 0x03b3, "?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z" },
- { 0x03b4, "?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_JD@Z" },
- { 0x03b5, "?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ" },
- { 0x03b6, "?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@AEAG@Z" },
- { 0x03b7, "?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@AEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@@Z" },
- { 0x03b8, "?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@AEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@G@Z" },
- { 0x03b9, "?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@PEAG_J@Z" },
- { 0x03ba, "?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@PEAG_JG@Z" },
- { 0x03bb, "?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAGXZ" },
- { 0x03bc, "?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@AEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@@Z" },
- { 0x03bd, "?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@AEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@_W@Z" },
- { 0x03be, "?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@AEA_W@Z" },
- { 0x03bf, "?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEA_W_J@Z" },
- { 0x03c0, "?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEA_W_J_W@Z" },
- { 0x03c1, "?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAGXZ" },
- { 0x03c2, "?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAG@Z" },
- { 0x03c3, "?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAI@Z" },
- { 0x03c4, "?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAJ@Z" },
- { 0x03c5, "?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAK@Z" },
- { 0x03c6, "?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAM@Z" },
- { 0x03c7, "?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAN@Z" },
- { 0x03c8, "?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAO@Z" },
- { 0x03c9, "?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEAPEAX@Z" },
- { 0x03ca, "?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEA_J@Z" },
- { 0x03cb, "?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEA_K@Z" },
- { 0x03cc, "?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHAEA_N@Z" },
- { 0x03cd, "?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAG@Z" },
- { 0x03ce, "?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAI@Z" },
- { 0x03cf, "?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAJ@Z" },
- { 0x03d0, "?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAK@Z" },
- { 0x03d1, "?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAM@Z" },
- { 0x03d2, "?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAN@Z" },
- { 0x03d3, "?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAO@Z" },
- { 0x03d4, "?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEAPEAX@Z" },
- { 0x03d5, "?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEA_J@Z" },
- { 0x03d6, "?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEA_K@Z" },
- { 0x03d7, "?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHAEA_N@Z" },
- { 0x03d8, "?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAG@Z" },
- { 0x03d9, "?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAI@Z" },
- { 0x03da, "?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAJ@Z" },
- { 0x03db, "?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAK@Z" },
- { 0x03dc, "?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAM@Z" },
- { 0x03dd, "?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAN@Z" },
- { 0x03de, "?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAO@Z" },
- { 0x03df, "?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEAPEAX@Z" },
- { 0x03e0, "?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEA_J@Z" },
- { 0x03e1, "?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEA_K@Z" },
- { 0x03e2, "?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHAEA_N@Z" },
- { 0x03e3, "?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@DD@Z" },
- { 0x03e4, "?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD4@Z" },
- { 0x03e5, "?get@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@DD@Z" },
- { 0x03e6, "?get@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBG4@Z" },
- { 0x03e7, "?get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@DD@Z" },
- { 0x03e8, "?get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEB_W4@Z" },
- { 0x03e9, "?get_date@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x03ea, "?get_date@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x03eb, "?get_date@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x03ec, "?get_monthname@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x03ed, "?get_monthname@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x03ee, "?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x03ef, "?get_new_handler@std@@YAP6AXXZXZ" },
- { 0x03f0, "?get_time@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x03f1, "?get_time@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x03f2, "?get_time@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x03f3, "?get_weekday@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x03f4, "?get_weekday@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x03f5, "?get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x03f6, "?get_year@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x03f7, "?get_year@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x03f8, "?get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@@Z" },
- { 0x03f9, "?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z" },
- { 0x03fa, "?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_JD@Z" },
- { 0x03fb, "?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@PEAG_J@Z" },
- { 0x03fc, "?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@PEAG_JG@Z" },
- { 0x03fd, "?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEA_W_J@Z" },
- { 0x03fe, "?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEA_W_J_W@Z" },
- { 0x03ff, "?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ" },
- { 0x0400, "?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEBA?AVlocale@2@XZ" },
- { 0x0401, "?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ" },
- { 0x0402, "?getloc@ios_base@std@@QEBA?AVlocale@2@XZ" },
- { 0x0403, "?global@locale@std@@SA?AV12@AEBV12@@Z" },
- { 0x0404, "?good@ios_base@std@@QEBA_NXZ" },
- { 0x0405, "?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ" },
- { 0x0406, "?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ" },
- { 0x0407, "?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ" },
- { 0x0408, "?id@?$codecvt@DDH@std@@2V0locale@2@A" },
- { 0x0409, "?id@?$codecvt@GDH@std@@2V0locale@2@A" },
- { 0x040a, "?id@?$codecvt@_WDH@std@@2V0locale@2@A" },
- { 0x040b, "?id@?$collate@D@std@@2V0locale@2@A" },
- { 0x040c, "?id@?$collate@G@std@@2V0locale@2@A" },
- { 0x040d, "?id@?$collate@_W@std@@2V0locale@2@A" },
- { 0x040e, "?id@?$ctype@D@std@@2V0locale@2@A" },
- { 0x040f, "?id@?$ctype@G@std@@2V0locale@2@A" },
- { 0x0410, "?id@?$ctype@_W@std@@2V0locale@2@A" },
- { 0x0411, "?id@?$messages@D@std@@2V0locale@2@A" },
- { 0x0412, "?id@?$messages@G@std@@2V0locale@2@A" },
- { 0x0413, "?id@?$messages@_W@std@@2V0locale@2@A" },
- { 0x0414, "?id@?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A" },
- { 0x0415, "?id@?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A" },
- { 0x0416, "?id@?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A" },
- { 0x0417, "?id@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A" },
- { 0x0418, "?id@?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A" },
- { 0x0419, "?id@?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A" },
- { 0x041a, "?id@?$moneypunct@D$00@std@@2V0locale@2@A" },
- { 0x041b, "?id@?$moneypunct@D$0A@@std@@2V0locale@2@A" },
- { 0x041c, "?id@?$moneypunct@G$00@std@@2V0locale@2@A" },
- { 0x041d, "?id@?$moneypunct@G$0A@@std@@2V0locale@2@A" },
- { 0x041e, "?id@?$moneypunct@_W$00@std@@2V0locale@2@A" },
- { 0x041f, "?id@?$moneypunct@_W$0A@@std@@2V0locale@2@A" },
- { 0x0420, "?id@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A" },
- { 0x0421, "?id@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A" },
- { 0x0422, "?id@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A" },
- { 0x0423, "?id@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A" },
- { 0x0424, "?id@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A" },
- { 0x0425, "?id@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A" },
- { 0x0426, "?id@?$numpunct@D@std@@2V0locale@2@A" },
- { 0x0427, "?id@?$numpunct@G@std@@2V0locale@2@A" },
- { 0x0428, "?id@?$numpunct@_W@std@@2V0locale@2@A" },
- { 0x0429, "?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A" },
- { 0x042a, "?id@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A" },
- { 0x042b, "?id@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A" },
- { 0x042c, "?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A" },
- { 0x042d, "?id@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A" },
- { 0x042e, "?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A" },
- { 0x042f, "?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z" },
- { 0x0430, "?ignore@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@_JG@Z" },
- { 0x0431, "?ignore@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_JG@Z" },
- { 0x0432, "?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z" },
- { 0x0433, "?imbue@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z" },
- { 0x0434, "?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z" },
- { 0x0435, "?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z" },
- { 0x0436, "?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z" },
- { 0x0437, "?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z" },
- { 0x0438, "?imbue@ios_base@std@@QEAA?AVlocale@2@AEBV32@@Z" },
- { 0x0439, "?in@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z" },
- { 0x043a, "?in@?$codecvt@GDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAG3AEAPEAG@Z" },
- { 0x043b, "?in@?$codecvt@_WDH@std@@QEBAHAEAHPEBD1AEAPEBDPEA_W3AEAPEA_W@Z" },
- { 0x043c, "?in_avail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JXZ" },
- { 0x043d, "?in_avail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JXZ" },
- { 0x043e, "?in_avail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JXZ" },
- { 0x043f, "?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z" },
- { 0x0440, "?init@?$basic_ios@GU?$char_traits@G@std@@@std@@IEAAXPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@_N@Z" },
- { 0x0441, "?init@?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAAXPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@_N@Z" },
- { 0x0442, "?intl@?$moneypunct@D$00@std@@2_NB" },
- { 0x0443, "?intl@?$moneypunct@D$0A@@std@@2_NB" },
- { 0x0444, "?intl@?$moneypunct@G$00@std@@2_NB" },
- { 0x0445, "?intl@?$moneypunct@G$0A@@std@@2_NB" },
- { 0x0446, "?intl@?$moneypunct@_W$00@std@@2_NB" },
- { 0x0447, "?intl@?$moneypunct@_W$0A@@std@@2_NB" },
- { 0x0448, "?ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z" },
- { 0x0449, "?ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA_N_N@Z" },
- { 0x044a, "?ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z" },
- { 0x044b, "?is@?$ctype@D@std@@QEBAPEBDPEBD0PEAF@Z" },
- { 0x044c, "?is@?$ctype@D@std@@QEBA_NFD@Z" },
- { 0x044d, "?is@?$ctype@G@std@@QEBAPEBGPEBG0PEAF@Z" },
- { 0x044e, "?is@?$ctype@G@std@@QEBA_NFG@Z" },
- { 0x044f, "?is@?$ctype@_W@std@@QEBAPEB_WPEB_W0PEAF@Z" },
- { 0x0450, "?is@?$ctype@_W@std@@QEBA_NF_W@Z" },
- { 0x0451, "?is_current_task_group_canceling@Concurrency@@YA_NXZ" },
- { 0x0452, "?is_task_cancellation_requested@Concurrency@@YA_NXZ" },
- { 0x0453, "?isfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAXXZ" },
- { 0x0454, "?isfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAXXZ" },
- { 0x0455, "?isfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ" },
- { 0x0456, "?iword@ios_base@std@@QEAAAEAJH@Z" },
- { 0x0457, "?length@?$codecvt@DDH@std@@QEBAHAEAHPEBD1_K@Z" },
- { 0x0458, "?length@?$codecvt@GDH@std@@QEBAHAEAHPEBD1_K@Z" },
- { 0x0459, "?length@?$codecvt@_WDH@std@@QEBAHAEAHPEBD1_K@Z" },
- { 0x045a, "?max_length@codecvt_base@std@@QEBAHXZ" },
- { 0x045b, "?move@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAX$$QEAV12@@Z" },
- { 0x045c, "?move@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXAEAV12@@Z" },
- { 0x045d, "?move@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAX$$QEAV12@@Z" },
- { 0x045e, "?move@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXAEAV12@@Z" },
- { 0x045f, "?move@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAX$$QEAV12@@Z" },
- { 0x0460, "?move@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXAEAV12@@Z" },
- { 0x0461, "?narrow@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADDD@Z" },
- { 0x0462, "?narrow@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBADGD@Z" },
- { 0x0463, "?narrow@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAD_WD@Z" },
- { 0x0464, "?narrow@?$ctype@D@std@@QEBADDD@Z" },
- { 0x0465, "?narrow@?$ctype@D@std@@QEBAPEBDPEBD0DPEAD@Z" },
- { 0x0466, "?narrow@?$ctype@G@std@@QEBADGD@Z" },
- { 0x0467, "?narrow@?$ctype@G@std@@QEBAPEBGPEBG0DPEAD@Z" },
- { 0x0468, "?narrow@?$ctype@_W@std@@QEBAD_WD@Z" },
- { 0x0469, "?narrow@?$ctype@_W@std@@QEBAPEB_WPEB_W0DPEAD@Z" },
- { 0x046a, "?opfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA_NXZ" },
- { 0x046b, "?opfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA_NXZ" },
- { 0x046c, "?opfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA_NXZ" },
- { 0x046d, "?osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ" },
- { 0x046e, "?osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ" },
- { 0x046f, "?osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ" },
- { 0x0470, "?out@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z" },
- { 0x0471, "?out@?$codecvt@GDH@std@@QEBAHAEAHPEBG1AEAPEBGPEAD3AEAPEAD@Z" },
- { 0x0472, "?out@?$codecvt@_WDH@std@@QEBAHAEAHPEB_W1AEAPEB_WPEAD3AEAPEAD@Z" },
- { 0x0473, "?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z" },
- { 0x0474, "?overflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGG@Z" },
- { 0x0475, "?overflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGG@Z" },
- { 0x0476, "?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z" },
- { 0x0477, "?pbackfail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGG@Z" },
- { 0x0478, "?pbackfail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGG@Z" },
- { 0x0479, "?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ" },
- { 0x047a, "?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ" },
- { 0x047b, "?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ" },
- { 0x047c, "?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z" },
- { 0x047d, "?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z" },
- { 0x047e, "?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z" },
- { 0x047f, "?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ" },
- { 0x0480, "?peek@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAGXZ" },
- { 0x0481, "?peek@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAGXZ" },
- { 0x0482, "?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ" },
- { 0x0483, "?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ" },
- { 0x0484, "?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ" },
- { 0x0485, "?precision@ios_base@std@@QEAA_J_J@Z" },
- { 0x0486, "?precision@ios_base@std@@QEBA_JXZ" },
- { 0x0487, "?pubimbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z" },
- { 0x0488, "?pubimbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z" },
- { 0x0489, "?pubimbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z" },
- { 0x048a, "?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@H@2@_JHH@Z" },
- { 0x048b, "?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@H@2@_JII@Z" },
- { 0x048c, "?pubseekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA?AV?$fpos@H@2@_JHH@Z" },
- { 0x048d, "?pubseekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA?AV?$fpos@H@2@_JII@Z" },
- { 0x048e, "?pubseekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@H@2@_JHH@Z" },
- { 0x048f, "?pubseekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@H@2@_JII@Z" },
- { 0x0490, "?pubseekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@H@2@V32@H@Z" },
- { 0x0491, "?pubseekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@H@2@V32@I@Z" },
- { 0x0492, "?pubseekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA?AV?$fpos@H@2@V32@H@Z" },
- { 0x0493, "?pubseekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA?AV?$fpos@H@2@V32@I@Z" },
- { 0x0494, "?pubseekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@H@2@V32@H@Z" },
- { 0x0495, "?pubseekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@H@2@V32@I@Z" },
- { 0x0496, "?pubsetbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAPEAV12@PEAD_J@Z" },
- { 0x0497, "?pubsetbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAPEAV12@PEAG_J@Z" },
- { 0x0498, "?pubsetbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAPEAV12@PEA_W_J@Z" },
- { 0x0499, "?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ" },
- { 0x049a, "?pubsync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAHXZ" },
- { 0x049b, "?pubsync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAHXZ" },
- { 0x049c, "?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z" },
- { 0x049d, "?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@G@Z" },
- { 0x049e, "?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z" },
- { 0x049f, "?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DJ@Z" },
- { 0x04a0, "?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DK@Z" },
- { 0x04a1, "?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DN@Z" },
- { 0x04a2, "?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DO@Z" },
- { 0x04a3, "?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBX@Z" },
- { 0x04a4, "?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@D_J@Z" },
- { 0x04a5, "?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@D_K@Z" },
- { 0x04a6, "?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@D_N@Z" },
- { 0x04a7, "?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GJ@Z" },
- { 0x04a8, "?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GK@Z" },
- { 0x04a9, "?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GN@Z" },
- { 0x04aa, "?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GO@Z" },
- { 0x04ab, "?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GPEBX@Z" },
- { 0x04ac, "?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@G_J@Z" },
- { 0x04ad, "?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@G_K@Z" },
- { 0x04ae, "?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@G_N@Z" },
- { 0x04af, "?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WJ@Z" },
- { 0x04b0, "?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WK@Z" },
- { 0x04b1, "?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WN@Z" },
- { 0x04b2, "?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WO@Z" },
- { 0x04b3, "?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBX@Z" },
- { 0x04b4, "?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_W_J@Z" },
- { 0x04b5, "?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_W_K@Z" },
- { 0x04b6, "?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_W_N@Z" },
- { 0x04b7, "?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@DD@Z" },
- { 0x04b8, "?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z" },
- { 0x04b9, "?put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GPEBUtm@@DD@Z" },
- { 0x04ba, "?put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AEAVios_base@2@GPEBUtm@@PEBG3@Z" },
- { 0x04bb, "?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@DD@Z" },
- { 0x04bc, "?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@PEB_W4@Z" },
- { 0x04bd, "?putback@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z" },
- { 0x04be, "?putback@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@G@Z" },
- { 0x04bf, "?putback@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z" },
- { 0x04c0, "?pword@ios_base@std@@QEAAAEAPEAXH@Z" },
- { 0x04c1, "?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PEAV32@@Z" },
- { 0x04c2, "?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ" },
- { 0x04c3, "?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@PEAV32@@Z" },
- { 0x04c4, "?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ" },
- { 0x04c5, "?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@PEAV32@@Z" },
- { 0x04c6, "?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ" },
- { 0x04c7, "?rdstate@ios_base@std@@QEBAHXZ" },
- { 0x04c8, "?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z" },
- { 0x04c9, "?read@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@PEAG_J@Z" },
- { 0x04ca, "?read@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEA_W_J@Z" },
- { 0x04cb, "?readsome@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_JPEAD_J@Z" },
- { 0x04cc, "?readsome@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA_JPEAG_J@Z" },
- { 0x04cd, "?readsome@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_JPEA_W_J@Z" },
- { 0x04ce, "?register_callback@ios_base@std@@QEAAXP6AXW4event@12@AEAV12@H@ZH@Z" },
- { 0x04cf, "?resetiosflags@std@@YA?AU?$_Smanip@H@1@H@Z" },
- { 0x04d0, "?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ" },
- { 0x04d1, "?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ" },
- { 0x04d2, "?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ" },
- { 0x04d3, "?scan_is@?$ctype@D@std@@QEBAPEBDFPEBD0@Z" },
- { 0x04d4, "?scan_is@?$ctype@G@std@@QEBAPEBGFPEBG0@Z" },
- { 0x04d5, "?scan_is@?$ctype@_W@std@@QEBAPEB_WFPEB_W0@Z" },
- { 0x04d6, "?scan_not@?$ctype@D@std@@QEBAPEBDFPEBD0@Z" },
- { 0x04d7, "?scan_not@?$ctype@G@std@@QEBAPEBGFPEBG0@Z" },
- { 0x04d8, "?scan_not@?$ctype@_W@std@@QEBAPEB_WFPEB_W0@Z" },
- { 0x04d9, "?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@H@2@@Z" },
- { 0x04da, "?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z" },
- { 0x04db, "?seekg@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@V?$fpos@H@2@@Z" },
- { 0x04dc, "?seekg@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@_JH@Z" },
- { 0x04dd, "?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@V?$fpos@H@2@@Z" },
- { 0x04de, "?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_JH@Z" },
- { 0x04df, "?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@H@2@_JHH@Z" },
- { 0x04e0, "?seekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA?AV?$fpos@H@2@_JHH@Z" },
- { 0x04e1, "?seekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA?AV?$fpos@H@2@_JHH@Z" },
- { 0x04e2, "?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@H@2@@Z" },
- { 0x04e3, "?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z" },
- { 0x04e4, "?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@V?$fpos@H@2@@Z" },
- { 0x04e5, "?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@_JH@Z" },
- { 0x04e6, "?seekp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@V?$fpos@H@2@@Z" },
- { 0x04e7, "?seekp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_JH@Z" },
- { 0x04e8, "?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@H@2@V32@H@Z" },
- { 0x04e9, "?seekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA?AV?$fpos@H@2@V32@H@Z" },
- { 0x04ea, "?seekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA?AV?$fpos@H@2@V32@H@Z" },
- { 0x04eb, "?set_new_handler@std@@YAP6AXXZP6AXXZ@Z" },
- { 0x04ec, "?set_rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@@Z" },
- { 0x04ed, "?set_rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@@Z" },
- { 0x04ee, "?set_rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@@Z" },
- { 0x04ef, "?setbase@std@@YA?AU?$_Smanip@H@1@H@Z" },
- { 0x04f0, "?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z" },
- { 0x04f1, "?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z" },
- { 0x04f2, "?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z" },
- { 0x04f3, "?setf@ios_base@std@@QEAAHH@Z" },
- { 0x04f4, "?setf@ios_base@std@@QEAAHHH@Z" },
- { 0x04f5, "?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z" },
- { 0x04f6, "?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z" },
- { 0x04f7, "?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z" },
- { 0x04f8, "?setiosflags@std@@YA?AU?$_Smanip@H@1@H@Z" },
- { 0x04f9, "?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z" },
- { 0x04fa, "?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z" },
- { 0x04fb, "?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z" },
- { 0x04fc, "?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z" },
- { 0x04fd, "?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z" },
- { 0x04fe, "?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z" },
- { 0x04ff, "?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z" },
- { 0x0500, "?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z" },
- { 0x0501, "?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXI@Z" },
- { 0x0502, "?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z" },
- { 0x0503, "?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXI@Z" },
- { 0x0504, "?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z" },
- { 0x0505, "?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXI@Z" },
- { 0x0506, "?setstate@ios_base@std@@QEAAXH@Z" },
- { 0x0507, "?setstate@ios_base@std@@QEAAXH_N@Z" },
- { 0x0508, "?setstate@ios_base@std@@QEAAXI@Z" },
- { 0x0509, "?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z" },
- { 0x050a, "?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ" },
- { 0x050b, "?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ" },
- { 0x050c, "?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ" },
- { 0x050d, "?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEAD_J@Z" },
- { 0x050e, "?sgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEAG_J@Z" },
- { 0x050f, "?sgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEA_W_J@Z" },
- { 0x0510, "?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ" },
- { 0x0511, "?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ" },
- { 0x0512, "?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ" },
- { 0x0513, "?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ" },
- { 0x0514, "?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ" },
- { 0x0515, "?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ" },
- { 0x0516, "?sputbackc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z" },
- { 0x0517, "?sputbackc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z" },
- { 0x0518, "?sputbackc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z" },
- { 0x0519, "?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z" },
- { 0x051a, "?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z" },
- { 0x051b, "?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z" },
- { 0x051c, "?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z" },
- { 0x051d, "?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z" },
- { 0x051e, "?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z" },
- { 0x051f, "?start@agent@Concurrency@@QEAA_NXZ" },
- { 0x0520, "?status@agent@Concurrency@@QEAA?AW4agent_status@2@XZ" },
- { 0x0521, "?status_port@agent@Concurrency@@QEAAPEAV?$ISource@W4agent_status@Concurrency@@@2@XZ" },
- { 0x0522, "?stossc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAXXZ" },
- { 0x0523, "?stossc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAXXZ" },
- { 0x0524, "?stossc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAXXZ" },
- { 0x0525, "?sungetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ" },
- { 0x0526, "?sungetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ" },
- { 0x0527, "?sungetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ" },
- { 0x0528, "?swap@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXAEAV12@@Z" },
- { 0x0529, "?swap@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXAEAV12@@Z" },
- { 0x052a, "?swap@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXAEAV12@@Z" },
- { 0x052b, "?swap@?$basic_iostream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z" },
- { 0x052c, "?swap@?$basic_iostream@GU?$char_traits@G@std@@@std@@IEAAXAEAV12@@Z" },
- { 0x052d, "?swap@?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IEAAXAEAV12@@Z" },
- { 0x052e, "?swap@?$basic_istream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z" },
- { 0x052f, "?swap@?$basic_istream@GU?$char_traits@G@std@@@std@@IEAAXAEAV12@@Z" },
- { 0x0530, "?swap@?$basic_istream@_WU?$char_traits@_W@std@@@std@@IEAAXAEAV12@@Z" },
- { 0x0531, "?swap@?$basic_ostream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z" },
- { 0x0532, "?swap@?$basic_ostream@GU?$char_traits@G@std@@@std@@IEAAXAEAV12@@Z" },
- { 0x0533, "?swap@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IEAAXAEAV12@@Z" },
- { 0x0534, "?swap@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z" },
- { 0x0535, "?swap@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXAEAV12@@Z" },
- { 0x0536, "?swap@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXAEAV12@@Z" },
- { 0x0537, "?swap@ios_base@std@@QEAAXAEAV12@@Z" },
- { 0x0538, "?sync@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ" },
- { 0x0539, "?sync@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAHXZ" },
- { 0x053a, "?sync@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAHXZ" },
- { 0x053b, "?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ" },
- { 0x053c, "?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ" },
- { 0x053d, "?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ" },
- { 0x053e, "?sync_with_stdio@ios_base@std@@SA_N_N@Z" },
- { 0x053f, "?table@?$ctype@D@std@@QEBAPEBFXZ" },
- { 0x0540, "?table_size@?$ctype@D@std@@2_KB" },
- { 0x0541, "?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@H@2@XZ" },
- { 0x0542, "?tellg@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA?AV?$fpos@H@2@XZ" },
- { 0x0543, "?tellg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@H@2@XZ" },
- { 0x0544, "?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@H@2@XZ" },
- { 0x0545, "?tellp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA?AV?$fpos@H@2@XZ" },
- { 0x0546, "?tellp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@H@2@XZ" },
- { 0x0547, "?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@PEAV32@@Z" },
- { 0x0548, "?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ" },
- { 0x0549, "?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@PEAV32@@Z" },
- { 0x054a, "?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ" },
- { 0x054b, "?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@PEAV32@@Z" },
- { 0x054c, "?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ" },
- { 0x054d, "?tolower@?$ctype@D@std@@QEBADD@Z" },
- { 0x054e, "?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z" },
- { 0x054f, "?tolower@?$ctype@G@std@@QEBAGG@Z" },
- { 0x0550, "?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z" },
- { 0x0551, "?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z" },
- { 0x0552, "?tolower@?$ctype@_W@std@@QEBA_W_W@Z" },
- { 0x0553, "?toupper@?$ctype@D@std@@QEBADD@Z" },
- { 0x0554, "?toupper@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z" },
- { 0x0555, "?toupper@?$ctype@G@std@@QEBAGG@Z" },
- { 0x0556, "?toupper@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z" },
- { 0x0557, "?toupper@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z" },
- { 0x0558, "?toupper@?$ctype@_W@std@@QEBA_W_W@Z" },
- { 0x0559, "?try_to_lock@std@@3Utry_to_lock_t@1@B" },
- { 0x055a, "?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ" },
- { 0x055b, "?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ" },
- { 0x055c, "?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ" },
- { 0x055d, "?uncaught_exception@std@@YA_NXZ" },
- { 0x055e, "?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ" },
- { 0x055f, "?underflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ" },
- { 0x0560, "?underflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ" },
- { 0x0561, "?unget@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ" },
- { 0x0562, "?unget@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ" },
- { 0x0563, "?unget@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ" },
- { 0x0564, "?unsetf@ios_base@std@@QEAAXH@Z" },
- { 0x0565, "?unshift@?$codecvt@DDH@std@@QEBAHAEAHPEAD1AEAPEAD@Z" },
- { 0x0566, "?unshift@?$codecvt@GDH@std@@QEBAHAEAHPEAD1AEAPEAD@Z" },
- { 0x0567, "?unshift@?$codecvt@_WDH@std@@QEBAHAEAHPEAD1AEAPEAD@Z" },
- { 0x0568, "?wait@agent@Concurrency@@SA?AW4agent_status@2@PEAV12@I@Z" },
- { 0x0569, "?wait_for_all@agent@Concurrency@@SAX_KPEAPEAV12@PEAW4agent_status@2@I@Z" },
- { 0x056a, "?wait_for_one@agent@Concurrency@@SAX_KPEAPEAV12@AEAW4agent_status@2@AEA_KI@Z" },
- { 0x056b, "?wcerr@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A" },
- { 0x056c, "?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A" },
- { 0x056d, "?wcin@std@@3V?$basic_istream@GU?$char_traits@G@std@@@1@A" },
- { 0x056e, "?wcin@std@@3V?$basic_istream@_WU?$char_traits@_W@std@@@1@A" },
- { 0x056f, "?wclog@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A" },
- { 0x0570, "?wclog@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A" },
- { 0x0571, "?wcout@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A" },
- { 0x0572, "?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A" },
- { 0x0573, "?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z" },
- { 0x0574, "?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGD@Z" },
- { 0x0575, "?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z" },
- { 0x0576, "?widen@?$ctype@D@std@@QEBADD@Z" },
- { 0x0577, "?widen@?$ctype@D@std@@QEBAPEBDPEBD0PEAD@Z" },
- { 0x0578, "?widen@?$ctype@G@std@@QEBAGD@Z" },
- { 0x0579, "?widen@?$ctype@G@std@@QEBAPEBDPEBD0PEAG@Z" },
- { 0x057a, "?widen@?$ctype@_W@std@@QEBAPEBDPEBD0PEA_W@Z" },
- { 0x057b, "?widen@?$ctype@_W@std@@QEBA_WD@Z" },
- { 0x057c, "?width@ios_base@std@@QEAA_J_J@Z" },
- { 0x057d, "?width@ios_base@std@@QEBA_JXZ" },
- { 0x057e, "?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z" },
- { 0x057f, "?write@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@PEBG_J@Z" },
- { 0x0580, "?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z" },
- { 0x0581, "?ws@std@@YAAEAV?$basic_istream@DU?$char_traits@D@std@@@1@AEAV21@@Z" },
- { 0x0582, "?ws@std@@YAAEAV?$basic_istream@GU?$char_traits@G@std@@@1@AEAV21@@Z" },
- { 0x0583, "?ws@std@@YAAEAV?$basic_istream@_WU?$char_traits@_W@std@@@1@AEAV21@@Z" },
- { 0x0584, "?xalloc@ios_base@std@@SAHXZ" },
- { 0x0585, "?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z" },
- { 0x0586, "?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z" },
- { 0x0587, "?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z" },
- { 0x0588, "?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z" },
- { 0x0589, "?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z" },
- { 0x058a, "?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z" },
- { 0x058b, "_Call_once" },
- { 0x058c, "_Call_onceEx" },
- { 0x058d, "_Cnd_broadcast" },
- { 0x058e, "_Cnd_destroy" },
- { 0x058f, "_Cnd_do_broadcast_at_thread_exit" },
- { 0x0590, "_Cnd_init" },
- { 0x0591, "_Cnd_register_at_thread_exit" },
- { 0x0592, "_Cnd_signal" },
- { 0x0593, "_Cnd_timedwait" },
- { 0x0594, "_Cnd_unregister_at_thread_exit" },
- { 0x0595, "_Cnd_wait" },
- { 0x0596, "_Cosh" },
- { 0x0597, "_Denorm" },
- { 0x0598, "_Dint" },
- { 0x0599, "_Dnorm" },
- { 0x059a, "_Do_call" },
- { 0x059b, "_Dscale" },
- { 0x059c, "_Dtento" },
- { 0x059d, "_Dtest" },
- { 0x059e, "_Dunscale" },
- { 0x059f, "_Eps" },
- { 0x05a0, "_Exp" },
- { 0x05a1, "_FCosh" },
- { 0x05a2, "_FDenorm" },
- { 0x05a3, "_FDint" },
- { 0x05a4, "_FDnorm" },
- { 0x05a5, "_FDscale" },
- { 0x05a6, "_FDtento" },
- { 0x05a7, "_FDtest" },
- { 0x05a8, "_FDunscale" },
- { 0x05a9, "_FEps" },
- { 0x05aa, "_FExp" },
- { 0x05ab, "_FInf" },
- { 0x05ac, "_FNan" },
- { 0x05ad, "_FRteps" },
- { 0x05ae, "_FSinh" },
- { 0x05af, "_FSnan" },
- { 0x05b0, "_FXbig" },
- { 0x05b1, "_FXp_addh" },
- { 0x05b2, "_FXp_addx" },
- { 0x05b3, "_FXp_getw" },
- { 0x05b4, "_FXp_invx" },
- { 0x05b5, "_FXp_ldexpx" },
- { 0x05b6, "_FXp_movx" },
- { 0x05b7, "_FXp_mulh" },
- { 0x05b8, "_FXp_mulx" },
- { 0x05b9, "_FXp_setn" },
- { 0x05ba, "_FXp_setw" },
- { 0x05bb, "_FXp_sqrtx" },
- { 0x05bc, "_FXp_subx" },
- { 0x05bd, "_FZero" },
- { 0x05be, "_Getcoll" },
- { 0x05bf, "_Getctype" },
- { 0x05c0, "_Getcvt" },
- { 0x05c1, "_Getdateorder" },
- { 0x05c2, "_Getwctype" },
- { 0x05c3, "_Getwctypes" },
- { 0x05c4, "_Hugeval" },
- { 0x05c5, "_Inf" },
- { 0x05c6, "_LCosh" },
- { 0x05c7, "_LDenorm" },
- { 0x05c8, "_LDint" },
- { 0x05c9, "_LDscale" },
- { 0x05ca, "_LDtento" },
- { 0x05cb, "_LDtest" },
- { 0x05cc, "_LDunscale" },
- { 0x05cd, "_LEps" },
- { 0x05ce, "_LExp" },
- { 0x05cf, "_LInf" },
- { 0x05d0, "_LNan" },
- { 0x05d1, "_LPoly" },
- { 0x05d2, "_LRteps" },
- { 0x05d3, "_LSinh" },
- { 0x05d4, "_LSnan" },
- { 0x05d5, "_LXbig" },
- { 0x05d6, "_LXp_addh" },
- { 0x05d7, "_LXp_addx" },
- { 0x05d8, "_LXp_getw" },
- { 0x05d9, "_LXp_invx" },
- { 0x05da, "_LXp_ldexpx" },
- { 0x05db, "_LXp_movx" },
- { 0x05dc, "_LXp_mulh" },
- { 0x05dd, "_LXp_mulx" },
- { 0x05de, "_LXp_setn" },
- { 0x05df, "_LXp_setw" },
- { 0x05e0, "_LXp_sqrtx" },
- { 0x05e1, "_LXp_subx" },
- { 0x05e2, "_LZero" },
- { 0x05e3, "_Lock_shared_ptr_spin_lock" },
- { 0x05e4, "_Mbrtowc" },
- { 0x05e5, "_Mtx_clear_owner" },
- { 0x05e6, "_Mtx_current_owns" },
- { 0x05e7, "_Mtx_destroy" },
- { 0x05e8, "_Mtx_getconcrtcs" },
- { 0x05e9, "_Mtx_init" },
- { 0x05ea, "_Mtx_lock" },
- { 0x05eb, "_Mtx_reset_owner" },
- { 0x05ec, "_Mtx_timedlock" },
- { 0x05ed, "_Mtx_trylock" },
- { 0x05ee, "_Mtx_unlock" },
- { 0x05ef, "_Mtxdst" },
- { 0x05f0, "_Mtxinit" },
- { 0x05f1, "_Mtxlock" },
- { 0x05f2, "_Mtxunlock" },
- { 0x05f3, "_Nan" },
- { 0x05f4, "_Once" },
- { 0x05f5, "_Poly" },
- { 0x05f6, "_Rteps" },
- { 0x05f7, "_Sinh" },
- { 0x05f8, "_Snan" },
- { 0x05f9, "_Stod" },
- { 0x05fa, "_Stodx" },
- { 0x05fb, "_Stof" },
- { 0x05fc, "_Stoflt" },
- { 0x05fd, "_Stofx" },
- { 0x05fe, "_Stold" },
- { 0x05ff, "_Stoldx" },
- { 0x0600, "_Stoll" },
- { 0x0601, "_Stollx" },
- { 0x0602, "_Stolx" },
- { 0x0603, "_Stopfx" },
- { 0x0604, "_Stoul" },
- { 0x0605, "_Stoull" },
- { 0x0606, "_Stoullx" },
- { 0x0607, "_Stoulx" },
- { 0x0608, "_Stoxflt" },
- { 0x0609, "_Strcoll" },
- { 0x060a, "_Strxfrm" },
- { 0x060b, "_Thrd_abort" },
- { 0x060c, "_Thrd_create" },
- { 0x060d, "_Thrd_current" },
- { 0x060e, "_Thrd_detach" },
- { 0x060f, "_Thrd_equal" },
- { 0x0610, "_Thrd_exit" },
- { 0x0611, "_Thrd_join" },
- { 0x0612, "_Thrd_lt" },
- { 0x0613, "_Thrd_sleep" },
- { 0x0614, "_Thrd_start" },
- { 0x0615, "_Thrd_yield" },
- { 0x0616, "_Tolower" },
- { 0x0617, "_Toupper" },
- { 0x0618, "_Towlower" },
- { 0x0619, "_Towupper" },
- { 0x061a, "_Tss_create" },
- { 0x061b, "_Tss_delete" },
- { 0x061c, "_Tss_get" },
- { 0x061d, "_Tss_set" },
- { 0x061e, "_Unlock_shared_ptr_spin_lock" },
- { 0x061f, "_Wcrtomb" },
- { 0x0620, "_Wcscoll" },
- { 0x0621, "_Wcsxfrm" },
- { 0x0622, "_Xbig" },
- { 0x0623, "_Xp_addh" },
- { 0x0624, "_Xp_addx" },
- { 0x0625, "_Xp_getw" },
- { 0x0626, "_Xp_invx" },
- { 0x0627, "_Xp_ldexpx" },
- { 0x0628, "_Xp_movx" },
- { 0x0629, "_Xp_mulh" },
- { 0x062a, "_Xp_mulx" },
- { 0x062b, "_Xp_setn" },
- { 0x062c, "_Xp_setw" },
- { 0x062d, "_Xp_sqrtx" },
- { 0x062e, "_Xp_subx" },
- { 0x062f, "_Xtime_diff_to_millis" },
- { 0x0630, "_Xtime_diff_to_millis2" },
- { 0x0631, "_Xtime_get_ticks" },
- { 0x0632, "_Zero" },
- { 0x0633, "__Wcrtomb_lk" },
- { 0x0634, "towctrans" },
- { 0x0635, "wctrans" },
- { 0x0636, "wctype" },
- { 0x0637, "xtime_get" },
-};
+const char* msvcp110_dll_lookup(uint32_t i) {
+ switch(i) {
+ case 0x0001: return "??$_Getvals@_W@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z";
+ case 0x0002: return "??$_Getvals@_W@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z";
+ case 0x0003: return "??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z";
+ case 0x0004: return "??0?$_Yarn@D@std@@QEAA@AEBV01@@Z";
+ case 0x0005: return "??0?$_Yarn@D@std@@QEAA@PEBD@Z";
+ case 0x0006: return "??0?$_Yarn@D@std@@QEAA@XZ";
+ case 0x0007: return "??0?$_Yarn@_W@std@@QEAA@XZ";
+ case 0x0008: return "??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ";
+ case 0x0009: return "??0?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z";
+ case 0x000a: return "??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ";
+ case 0x000b: return "??0?$basic_ios@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z";
+ case 0x000c: return "??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ";
+ case 0x000d: return "??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z";
+ case 0x000e: return "??0?$basic_iostream@DU?$char_traits@D@std@@@std@@IEAA@$$QEAV01@@Z";
+ case 0x000f: return "??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z";
+ case 0x0010: return "??0?$basic_iostream@GU?$char_traits@G@std@@@std@@IEAA@$$QEAV01@@Z";
+ case 0x0011: return "??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z";
+ case 0x0012: return "??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IEAA@$$QEAV01@@Z";
+ case 0x0013: return "??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z";
+ case 0x0014: return "??0?$basic_istream@DU?$char_traits@D@std@@@std@@IEAA@$$QEAV01@@Z";
+ case 0x0015: return "??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N1@Z";
+ case 0x0016: return "??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z";
+ case 0x0017: return "??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@W4_Uninitialized@1@@Z";
+ case 0x0018: return "??0?$basic_istream@GU?$char_traits@G@std@@@std@@IEAA@$$QEAV01@@Z";
+ case 0x0019: return "??0?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N1@Z";
+ case 0x001a: return "??0?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z";
+ case 0x001b: return "??0?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA@W4_Uninitialized@1@@Z";
+ case 0x001c: return "??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@IEAA@$$QEAV01@@Z";
+ case 0x001d: return "??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N1@Z";
+ case 0x001e: return "??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z";
+ case 0x001f: return "??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@W4_Uninitialized@1@@Z";
+ case 0x0020: return "??0?$basic_ostream@DU?$char_traits@D@std@@@std@@IEAA@$$QEAV01@@Z";
+ case 0x0021: return "??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z";
+ case 0x0022: return "??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@W4_Uninitialized@1@_N@Z";
+ case 0x0023: return "??0?$basic_ostream@GU?$char_traits@G@std@@@std@@IEAA@$$QEAV01@@Z";
+ case 0x0024: return "??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z";
+ case 0x0025: return "??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@W4_Uninitialized@1@_N@Z";
+ case 0x0026: return "??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IEAA@$$QEAV01@@Z";
+ case 0x0027: return "??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z";
+ case 0x0028: return "??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@W4_Uninitialized@1@_N@Z";
+ case 0x0029: return "??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@AEBV01@@Z";
+ case 0x002a: return "??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@W4_Uninitialized@1@@Z";
+ case 0x002b: return "??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ";
+ case 0x002c: return "??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@AEBV01@@Z";
+ case 0x002d: return "??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@W4_Uninitialized@1@@Z";
+ case 0x002e: return "??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ";
+ case 0x002f: return "??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@AEBV01@@Z";
+ case 0x0030: return "??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@W4_Uninitialized@1@@Z";
+ case 0x0031: return "??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ";
+ case 0x0032: return "??0?$codecvt@DDH@std@@QEAA@AEBV_Locinfo@1@_K@Z";
+ case 0x0033: return "??0?$codecvt@DDH@std@@QEAA@_K@Z";
+ case 0x0034: return "??0?$codecvt@GDH@std@@QEAA@AEBV_Locinfo@1@_K@Z";
+ case 0x0035: return "??0?$codecvt@GDH@std@@QEAA@_K@Z";
+ case 0x0036: return "??0?$codecvt@_WDH@std@@QEAA@AEBV_Locinfo@1@_K@Z";
+ case 0x0037: return "??0?$codecvt@_WDH@std@@QEAA@_K@Z";
+ case 0x0038: return "??0?$ctype@D@std@@QEAA@AEBV_Locinfo@1@_K@Z";
+ case 0x0039: return "??0?$ctype@D@std@@QEAA@PEBF_N_K@Z";
+ case 0x003a: return "??0?$ctype@G@std@@QEAA@AEBV_Locinfo@1@_K@Z";
+ case 0x003b: return "??0?$ctype@G@std@@QEAA@_K@Z";
+ case 0x003c: return "??0?$ctype@_W@std@@QEAA@AEBV_Locinfo@1@_K@Z";
+ case 0x003d: return "??0?$ctype@_W@std@@QEAA@_K@Z";
+ case 0x003e: return "??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z";
+ case 0x003f: return "??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEAA@_K@Z";
+ case 0x0040: return "??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z";
+ case 0x0041: return "??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QEAA@_K@Z";
+ case 0x0042: return "??0?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@AEBV_Locinfo@1@_K@Z";
+ case 0x0043: return "??0?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEAA@_K@Z";
+ case 0x0044: return "??0?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@st
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment