From a69cf456eaa0d68223f5d9ada2f4cace0fe4c7b3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Fri, 27 Feb 2026 22:59:46 +0800
Subject: [PATCH] Binary (Windows): removes `imagehlp` dep

---
 CMakeLists.txt                   |  1 -
 src/common/impl/binary_windows.c | 34 ++++++++++++++++++++++----------
 src/common/windows/nt.h          |  2 ++
 3 files changed, 26 insertions(+), 11 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 8d8c55f53..f395efea7 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1725,7 +1725,6 @@ elseif(WIN32)
         PRIVATE "version"
         PRIVATE "hid"
         PRIVATE "wtsapi32"
-        PRIVATE "imagehlp"
         PRIVATE "cfgmgr32"
         PRIVATE "winbrand"
         PRIVATE "propsys"
diff --git a/src/common/impl/binary_windows.c b/src/common/impl/binary_windows.c
index b6f0bb1fa..980c0d313 100644
--- a/src/common/impl/binary_windows.c
+++ b/src/common/impl/binary_windows.c
@@ -1,10 +1,9 @@
 #include "common/binary.h"
 #include "common/io.h"
 #include "common/stringUtils.h"
-#include "common/mallocHelper.h"
+#include "common/windows/nt.h"
 
 #include <windows.h>
-#include <imagehlp.h>
 #include <stdlib.h>
 #include <string.h>
 
@@ -17,19 +16,33 @@
  */
 const char* ffBinaryExtractStrings(const char *peFile, bool (*cb)(const char *str, uint32_t len, void *userdata), void *userdata, uint32_t minLength)
 {
-    // Use MapAndLoad with cleanup attribute to ensure proper unloading
-    __attribute__((__cleanup__(UnMapAndLoad))) LOADED_IMAGE loadedImage = {};
-    if (!MapAndLoad(peFile, NULL, &loadedImage, FALSE, TRUE))
-        return "File could not be loaded";
+    FF_AUTO_CLOSE_FD HANDLE hFile = CreateFileA(peFile, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+        NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
+    if (hFile == INVALID_HANDLE_VALUE)
+        return "CreateFileA() failed";
 
-    // Iterate through all sections in the PE file
-    for (ULONG i = 0; i < loadedImage.NumberOfSections; ++i)
+    FF_AUTO_CLOSE_FD HANDLE hMap = CreateFileMappingW(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
+    if (!hMap)
+        return "CreateFileMappingW() failed";
+
+    void* base = MapViewOfFile(hMap, FILE_MAP_READ, 0, 0, 0);
+    if (!base)
+        return "MapViewOfFile() failed";
+
+    PIMAGE_NT_HEADERS ntHeaders = RtlImageNtHeader(base);
+    if (!ntHeaders)
+    {
+        UnmapViewOfFile(base);
+        return "RtlImageNtHeader() failed";
+    }
+
+    PIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION(ntHeaders);
+    for (WORD i = 0; i < ntHeaders->FileHeader.NumberOfSections; ++i, ++section)
     {
-        PIMAGE_SECTION_HEADER section = &loadedImage.Sections[i];
         // Look for initialized data sections with the name ".rdata" which typically contains string literals
         if ((section->Characteristics & IMAGE_SCN_CNT_INITIALIZED_DATA) && ffStrEquals((const char*) section->Name, ".rdata"))
         {
-            uint8_t *data = (uint8_t *) loadedImage.MappedAddress + section->PointerToRawData;
+            uint8_t *data = (uint8_t *) base + section->PointerToRawData;
 
             // Scan the section for string literals
             for (size_t off = 0; off < section->SizeOfRawData; ++off)
@@ -48,5 +61,6 @@ const char* ffBinaryExtractStrings(const char *peFile, bool (*cb)(const char *st
         }
     }
 
+    UnmapViewOfFile(base);
     return NULL;
 }
diff --git a/src/common/windows/nt.h b/src/common/windows/nt.h
index 197aeab26..732106e47 100644
--- a/src/common/windows/nt.h
+++ b/src/common/windows/nt.h
@@ -276,3 +276,5 @@ typedef struct _CURDIR
     UNICODE_STRING DosPath;
     HANDLE Handle;
 } CURDIR, *PCURDIR;
+
+PIMAGE_NT_HEADERS NTAPI RtlImageNtHeader(IN PVOID BaseOfImage);