bdpayne/libvmi — pull request #1 by ssjtoma (2013-01-02 23:05:34+00:00)
Title: Peparse v2 patch, expose peparsing to third-parties

LibVMI currently has PE header definition and parsing and validation code, but the code is only accessible internally. Exposing the structure definitions and some of the functions is desirable when dealing with Windows. As the list of definitions is quite long, creating and installing a separate header I think is a cleaner approach than jamming everything into libvmi.h.

Please see attached patch as a first attempt, comments are welcome! The patch splits parts of peparse.c into a header, and exposes two functions that are renamed to start with peparse_ accordingly.
peparse_get_export_table is slightly modified as to not have the kernel's base address hard-coded, as to be able to take any base_vaddr and PID to get the export table.

http://code.google.com/p/vmitools/issues/detail?id=36