From 0bbeaf496d86feb44a05e3a2beb7ff7aa016874b Mon Sep 17 00:00:00 2001 From: hasherezade Date: Thu, 23 Jun 2022 15:41:39 +0000 Subject: [PATCH] deploy: 8da6518b179b9475ef48c9573a69ea572bdccdb9 --- _bound_imp_dir_wrapper_8cpp_source.html | 339 +++++----- _bound_imp_dir_wrapper_8h_source.html | 161 +++-- _data_dir_entry_wrapper_8cpp_source.html | 34 +- _data_dir_entry_wrapper_8h_source.html | 4 +- _exception_dir_wrapper_8cpp_source.html | 4 +- _reloc_dir_wrapper_8cpp_source.html | 615 +++++++++--------- _reloc_dir_wrapper_8h_source.html | 242 ++++--- _resource_strings_wrapper_8cpp_source.html | 134 ++-- _resource_strings_wrapper_8h_source.html | 33 +- _tls_dir_wrapper_8cpp_source.html | 292 +++++---- _tls_dir_wrapper_8h_source.html | 114 ++-- class_bound_entry_wrapper.html | 24 +- class_bound_imp_dir_wrapper-members.html | 169 +++-- class_bound_imp_dir_wrapper.html | 62 +- class_clr_dir_wrapper-members.html | 2 +- class_clr_dir_wrapper.html | 4 +- class_data_dir_entry_wrapper-members.html | 2 +- class_data_dir_entry_wrapper.html | 24 +- ...7a86b9d308f503b8b2a22ff299bd6c5_cgraph.map | 8 + ...7a86b9d308f503b8b2a22ff299bd6c5_cgraph.md5 | 1 + ...7a86b9d308f503b8b2a22ff299bd6c5_cgraph.png | Bin 0 -> 21200 bytes ...d7a51d3dbebfa37841bf2f36c7b6eb6_cgraph.map | 5 - ...d7a51d3dbebfa37841bf2f36c7b6eb6_cgraph.md5 | 1 - ...d7a51d3dbebfa37841bf2f36c7b6eb6_cgraph.png | Bin 9569 -> 0 bytes class_debug_dir_wrapper-members.html | 2 +- class_debug_dir_wrapper.html | 4 +- class_delay_imp_dir_wrapper-members.html | 2 +- class_delay_imp_dir_wrapper.html | 4 +- class_exception_dir_wrapper-members.html | 2 +- class_exception_dir_wrapper.html | 62 +- ...f62d74773a39a6e2f25da0e58c05dcf_cgraph.map | 30 +- ...f62d74773a39a6e2f25da0e58c05dcf_cgraph.md5 | 2 +- ...f62d74773a39a6e2f25da0e58c05dcf_cgraph.png | Bin 61624 -> 77736 bytes ...780166edee43854b4bdbe996e076ff1_cgraph.map | 28 +- ...780166edee43854b4bdbe996e076ff1_cgraph.md5 | 2 +- ...780166edee43854b4bdbe996e076ff1_cgraph.png | Bin 57118 -> 73511 bytes class_export_dir_wrapper-members.html | 2 +- class_export_dir_wrapper.html | 4 +- class_import_base_dir_wrapper-members.html | 2 +- class_import_base_dir_wrapper.html | 4 +- class_import_dir_wrapper-members.html | 2 +- class_import_dir_wrapper.html | 4 +- class_ld_config_dir_wrapper-members.html | 2 +- class_ld_config_dir_wrapper.html | 4 +- class_reloc_block_wrapper.html | 30 +- class_reloc_dir_wrapper-members.html | 2 +- class_reloc_dir_wrapper.html | 104 +-- ...ebd8bd0012704d6677b1f247537b6a7_cgraph.map | 46 +- ...ebd8bd0012704d6677b1f247537b6a7_cgraph.md5 | 2 +- ...ebd8bd0012704d6677b1f247537b6a7_cgraph.png | Bin 106955 -> 126818 bytes ...90a07b3d56bc36a526c1b5a73e2073c_cgraph.map | 48 +- ...90a07b3d56bc36a526c1b5a73e2073c_cgraph.md5 | 2 +- ...90a07b3d56bc36a526c1b5a73e2073c_cgraph.png | Bin 111597 -> 131910 bytes class_reloc_entry_wrapper.html | 30 +- class_resource_dir_wrapper-members.html | 2 +- class_resource_dir_wrapper.html | 4 +- class_resource_strings_wrapper-members.html | 187 +++--- class_resource_strings_wrapper.html | 46 +- class_security_dir_wrapper-members.html | 2 +- class_security_dir_wrapper.html | 4 +- class_tls_dir_wrapper-members.html | 2 +- class_tls_dir_wrapper.html | 16 +- class_tls_entry_wrapper.html | 22 +- functions_e.html | 3 +- functions_func_g.html | 2 +- functions_g.html | 2 +- functions_vars.html | 1 - search/all_5.js | 75 ++- search/all_7.js | 2 +- search/functions_7.js | 2 +- search/variables_4.js | 5 +- 71 files changed, 1513 insertions(+), 1564 deletions(-) create mode 100644 class_data_dir_entry_wrapper_a47a86b9d308f503b8b2a22ff299bd6c5_cgraph.map create mode 100644 class_data_dir_entry_wrapper_a47a86b9d308f503b8b2a22ff299bd6c5_cgraph.md5 create mode 100644 class_data_dir_entry_wrapper_a47a86b9d308f503b8b2a22ff299bd6c5_cgraph.png delete mode 100644 class_data_dir_entry_wrapper_a6d7a51d3dbebfa37841bf2f36c7b6eb6_cgraph.map delete mode 100644 class_data_dir_entry_wrapper_a6d7a51d3dbebfa37841bf2f36c7b6eb6_cgraph.md5 delete mode 100644 class_data_dir_entry_wrapper_a6d7a51d3dbebfa37841bf2f36c7b6eb6_cgraph.png diff --git a/_bound_imp_dir_wrapper_8cpp_source.html b/_bound_imp_dir_wrapper_8cpp_source.html index 0f9a9e59..872547ae 100644 --- a/_bound_imp_dir_wrapper_8cpp_source.html +++ b/_bound_imp_dir_wrapper_8cpp_source.html @@ -73,188 +73,183 @@ $(function() { Go to the documentation of this file.
2#include "pe/PEFile.h"
3
- -
5
-
6/*
-
7typedef struct _IMAGE_BOUND_IMPORT_DESCRIPTOR {
-
8 DWORD TimeDateStamp;
-
9 WORD OffsetModuleName;
-
10 WORD NumberOfModuleForwarderRefs;
-
11 // Array of zero or more IMAGE_BOUND_FORWARDER_REF follows
-
12} IMAGE_BOUND_IMPORT_DESCRIPTOR, *PIMAGE_BOUND_IMPORT_DESCRIPTOR;
-
13
-
14typedef struct _IMAGE_BOUND_FORWARDER_REF {
-
15 DWORD TimeDateStamp;
-
16 WORD OffsetModuleName;
-
17 WORD Reserved;
-
18} IMAGE_BOUND_FORWARDER_REF, *PIMAGE_BOUND_FORWARDER_REF;
-
19
-
20*/
-
21
-
22IMAGE_BOUND_IMPORT_DESCRIPTOR* BoundImpDirWrapper::boundImp()
-
23{
- -
25
-
26 BYTE *ptr = m_Exe->getContentAt(rva, Executable::RVA, sizeof(IMAGE_BOUND_IMPORT_DESCRIPTOR));
-
27 if (ptr == NULL) return NULL;
-
28 return (IMAGE_BOUND_IMPORT_DESCRIPTOR*) ptr;
-
29}
-
30
- -
32{
- -
34 if (!imp || !imp->getPtr()) {
-
35 delete imp;
-
36 return false;
-
37 }
-
38 // TODO! do it in proper way!
-
39 bool isOk = false;
-
40 uint64_t offset = imp->getNumValue(BoundEntryWrapper::MODULE_NAME_OFFSET, &isOk);
-
41 if (!isOk || offset == 0) {
-
42 delete imp;
-
43 return false;
-
44 }
-
45 entries.push_back(imp);
-
46 return true;
-
47}
-
48
- -
50{
-
51 clear();
-
52 size_t oldCount = this->importsCount;
-
53 this->importsCount = 0;
-
54
-
55 if (!getDataDirectory()) {
-
56 return (oldCount != this->importsCount); //has count changed
-
57 }
-
58
-
59 const size_t LIMIT = BoundImpDirWrapper::EntriesLimit;
-
60
-
61 size_t cntr = 0;
-
62 for (cntr = 0; cntr < LIMIT; cntr++) {
-
63 if (loadNextEntry(cntr) == false) break;
-
64 }
+
4/*
+
5typedef struct _IMAGE_BOUND_IMPORT_DESCRIPTOR {
+
6 DWORD TimeDateStamp;
+
7 WORD OffsetModuleName;
+
8 WORD NumberOfModuleForwarderRefs;
+
9 // Array of zero or more IMAGE_BOUND_FORWARDER_REF follows
+
10} IMAGE_BOUND_IMPORT_DESCRIPTOR, *PIMAGE_BOUND_IMPORT_DESCRIPTOR;
+
11
+
12typedef struct _IMAGE_BOUND_FORWARDER_REF {
+
13 DWORD TimeDateStamp;
+
14 WORD OffsetModuleName;
+
15 WORD Reserved;
+
16} IMAGE_BOUND_FORWARDER_REF, *PIMAGE_BOUND_FORWARDER_REF;
+
17
+
18*/
+
19
+
20IMAGE_BOUND_IMPORT_DESCRIPTOR* BoundImpDirWrapper::boundImp()
+
21{
+ +
23
+
24 BYTE *ptr = m_Exe->getContentAt(rva, Executable::RVA, sizeof(IMAGE_BOUND_IMPORT_DESCRIPTOR));
+
25 if (ptr == NULL) return NULL;
+
26 return (IMAGE_BOUND_IMPORT_DESCRIPTOR*) ptr;
+
27}
+
28
+ +
30{
+ +
32 if (!imp || !imp->getPtr()) {
+
33 delete imp;
+
34 return false;
+
35 }
+
36 // TODO! do it in proper way!
+
37 bool isOk = false;
+
38 uint64_t offset = imp->getNumValue(BoundEntryWrapper::MODULE_NAME_OFFSET, &isOk);
+
39 if (!isOk || offset == 0) {
+
40 delete imp;
+
41 return false;
+
42 }
+
43 entries.push_back(imp);
+
44 return true;
+
45}
+
46
+ +
48{
+
49 clear();
+
50 size_t oldCount = this->importsCount;
+
51 this->importsCount = 0;
+
52
+
53 if (!getDataDirectory()) {
+
54 return (oldCount != this->importsCount); //has count changed
+
55 }
+
56
+
57 size_t cntr = 0;
+
58 while (loadNextEntry(cntr)) {
+
59 cntr++;
+
60 }
+
61
+
62 this->importsCount = cntr;
+
63 return (oldCount != this->importsCount); //has count changed
+
64}
65
-
66 this->importsCount = cntr;
-
67 return (oldCount != this->importsCount); //has count changed
-
68}
-
69
- -
71{
-
72 if (getPtr() == NULL) return 0;
-
73 bufsize_t entrySize = static_cast<bufsize_t>(sizeof(IMAGE_BOUND_IMPORT_DESCRIPTOR));
-
74 return entrySize * static_cast<bufsize_t>(this->entries.size());
-
75}
-
76
-
77//-------------------------------------------------------------
-
78
- -
80{
-
81 BoundImpDirWrapper* parent = dynamic_cast<BoundImpDirWrapper*> (this->getParentNode());
-
82 if (!parent) return NULL;
-
83
-
84 IMAGE_BOUND_IMPORT_DESCRIPTOR* firstEntry = parent->boundImp();
-
85 if (firstEntry == NULL) return NULL;
-
86
-
87 uint64_t descAddr = parent->getOffset(firstEntry);
-
88 if (descAddr == INVALID_ADDR) return NULL;
-
89
-
90 uint64_t entryOffset = descAddr + (this->entryNum * sizeof(IMAGE_BOUND_IMPORT_DESCRIPTOR));
-
91 if (entryOffset == INVALID_ADDR) return NULL;
-
92
-
93 BYTE *content = this->m_Exe->getContentAt(entryOffset, Executable::RAW, sizeof(IMAGE_BOUND_IMPORT_DESCRIPTOR));
-
94 if (!content) return NULL;
+ +
67{
+
68 if (getPtr() == NULL) return 0;
+
69 bufsize_t entrySize = static_cast<bufsize_t>(sizeof(IMAGE_BOUND_IMPORT_DESCRIPTOR));
+
70 return entrySize * static_cast<bufsize_t>(this->entries.size());
+
71}
+
72
+
73//-------------------------------------------------------------
+
74
+ +
76{
+
77 BoundImpDirWrapper* parent = dynamic_cast<BoundImpDirWrapper*> (this->getParentNode());
+
78 if (!parent) return NULL;
+
79
+
80 IMAGE_BOUND_IMPORT_DESCRIPTOR* firstEntry = parent->boundImp();
+
81 if (firstEntry == NULL) return NULL;
+
82
+
83 uint64_t descAddr = parent->getOffset(firstEntry);
+
84 if (descAddr == INVALID_ADDR) return NULL;
+
85
+
86 uint64_t entryOffset = descAddr + (this->entryNum * sizeof(IMAGE_BOUND_IMPORT_DESCRIPTOR));
+
87 if (entryOffset == INVALID_ADDR) return NULL;
+
88
+
89 BYTE *content = this->m_Exe->getContentAt(entryOffset, Executable::RAW, sizeof(IMAGE_BOUND_IMPORT_DESCRIPTOR));
+
90 if (!content) return NULL;
+
91
+
92 return content;
+
93}
+
94
95
-
96 return content;
-
97}
-
98
-
99
- -
101{
-
102 if (getPtr() == NULL) return 0;
-
103 return sizeof(IMAGE_BOUND_IMPORT_DESCRIPTOR);
-
104}
-
105
- -
107{
-
108 char* name = getLibraryName();
-
109 if (!name) return "";
-
110 return QString(name);
-
111}
-
112
- -
114{
-
115 //----
-
116 BoundImpDirWrapper* parent = dynamic_cast<BoundImpDirWrapper*> (this->getParentNode());
-
117 if (!parent) return NULL;
-
118
-
119 IMAGE_BOUND_IMPORT_DESCRIPTOR* firstEntry = parent->boundImp();
-
120 if (firstEntry == NULL) return NULL;
-
121
-
122 uint64_t offset = this->getOffset(firstEntry);
-
123 if (offset == INVALID_ADDR) return NULL;
-
124 //----
-
125 IMAGE_BOUND_IMPORT_DESCRIPTOR* bImp = (IMAGE_BOUND_IMPORT_DESCRIPTOR*) this->getPtr();
-
126 if (bImp == NULL) return NULL;
+ +
97{
+
98 if (getPtr() == NULL) return 0;
+
99 return sizeof(IMAGE_BOUND_IMPORT_DESCRIPTOR);
+
100}
+
101
+ +
103{
+
104 char* name = getLibraryName();
+
105 if (!name) return "";
+
106 return QString(name);
+
107}
+
108
+ +
110{
+
111 //----
+
112 BoundImpDirWrapper* parent = dynamic_cast<BoundImpDirWrapper*> (this->getParentNode());
+
113 if (!parent) return NULL;
+
114
+
115 IMAGE_BOUND_IMPORT_DESCRIPTOR* firstEntry = parent->boundImp();
+
116 if (firstEntry == NULL) return NULL;
+
117
+
118 uint64_t offset = this->getOffset(firstEntry);
+
119 if (offset == INVALID_ADDR) return NULL;
+
120 //----
+
121 IMAGE_BOUND_IMPORT_DESCRIPTOR* bImp = (IMAGE_BOUND_IMPORT_DESCRIPTOR*) this->getPtr();
+
122 if (bImp == NULL) return NULL;
+
123
+
124 WORD mnOff = bImp->OffsetModuleName;
+
125
+
126 offset += mnOff;
127
-
128 WORD mnOff = bImp->OffsetModuleName;
-
129
-
130 offset += mnOff;
+
128 char *ptr = (char*) m_Exe->getContentAt(offset, Executable::RAW, 1);
+
129 return ptr;
+
130}
131
-
132 char *ptr = (char*) m_Exe->getContentAt(offset, Executable::RAW, 1);
-
133 return ptr;
-
134}
-
135
-
136void* BoundEntryWrapper::getFieldPtr(size_t fId, size_t subField)
-
137{
-
138 BoundImpDirWrapper* parent = dynamic_cast<BoundImpDirWrapper*> (this->getParentNode());
-
139 if (!parent) return NULL;
-
140
-
141 IMAGE_BOUND_IMPORT_DESCRIPTOR* bImp = (IMAGE_BOUND_IMPORT_DESCRIPTOR*) this->getPtr();
-
142 if (bImp == NULL) return NULL;
-
143
-
144 switch (fId) {
-
145 case TIMESTAMP : return &bImp->TimeDateStamp;
-
146 case MODULE_NAME_OFFSET : return &bImp->OffsetModuleName;
-
147 case MODULE_FORWARDERS_NUM : return &bImp->NumberOfModuleForwarderRefs;
-
148 }
-
149 return this->getPtr();
-
150}
-
151
-
152QString BoundEntryWrapper::getFieldName(size_t fieldId)
-
153{
-
154 switch (fieldId) {
-
155 case TIMESTAMP : return "TimeDateStamp";
-
156 case MODULE_NAME_OFFSET : return "OffsetModuleName";
-
157 case MODULE_FORWARDERS_NUM : return "NumberOfModuleForwarderRefs";
-
158 }
-
159 return getName();
-
160}
-
161
+
132void* BoundEntryWrapper::getFieldPtr(size_t fId, size_t subField)
+
133{
+
134 BoundImpDirWrapper* parent = dynamic_cast<BoundImpDirWrapper*> (this->getParentNode());
+
135 if (!parent) return NULL;
+
136
+
137 IMAGE_BOUND_IMPORT_DESCRIPTOR* bImp = (IMAGE_BOUND_IMPORT_DESCRIPTOR*) this->getPtr();
+
138 if (bImp == NULL) return NULL;
+
139
+
140 switch (fId) {
+
141 case TIMESTAMP : return &bImp->TimeDateStamp;
+
142 case MODULE_NAME_OFFSET : return &bImp->OffsetModuleName;
+
143 case MODULE_FORWARDERS_NUM : return &bImp->NumberOfModuleForwarderRefs;
+
144 }
+
145 return this->getPtr();
+
146}
+
147
+
148QString BoundEntryWrapper::getFieldName(size_t fieldId)
+
149{
+
150 switch (fieldId) {
+
151 case TIMESTAMP : return "TimeDateStamp";
+
152 case MODULE_NAME_OFFSET : return "OffsetModuleName";
+
153 case MODULE_FORWARDERS_NUM : return "NumberOfModuleForwarderRefs";
+
154 }
+
155 return getName();
+
156}
+
157
uint32_t bufsize_t
const offset_t INVALID_ADDR
uint64_t offset_t
-
-
virtual void * getFieldPtr(size_t fieldId, size_t subField)
-
virtual char * getLibraryName()
-
@ TIMESTAMP
-
@ MODULE_FORWARDERS_NUM
-
@ MODULE_NAME_OFFSET
-
virtual bufsize_t getSize()
-
virtual QString getFieldName(size_t fieldId)
-
virtual QString getName()
-
virtual void * getPtr()
+
+
virtual void * getFieldPtr(size_t fieldId, size_t subField)
+
virtual char * getLibraryName()
+
@ TIMESTAMP
+
@ MODULE_FORWARDERS_NUM
+
@ MODULE_NAME_OFFSET
+
virtual bufsize_t getSize()
+
virtual QString getFieldName(size_t fieldId)
+
virtual QString getName()
+
virtual void * getPtr()
-
bool loadNextEntry(size_t entryNum)
-
static size_t EntriesLimit
- -
IMAGE_BOUND_IMPORT_DESCRIPTOR * boundImp()
-
virtual void * getPtr()
- -
friend class BoundEntryWrapper
-
virtual bufsize_t getSize()
+
bool loadNextEntry(size_t entryNum)
+ +
IMAGE_BOUND_IMPORT_DESCRIPTOR * boundImp()
+
virtual void * getPtr()
+ +
friend class BoundEntryWrapper
+
virtual bufsize_t getSize()
offset_t getDirEntryAddress()
IMAGE_DATA_DIRECTORY * getDataDirectory()
diff --git a/_bound_imp_dir_wrapper_8h_source.html b/_bound_imp_dir_wrapper_8h_source.html index 1b19b88a..75ae8640 100644 --- a/_bound_imp_dir_wrapper_8h_source.html +++ b/_bound_imp_dir_wrapper_8h_source.html @@ -77,94 +77,91 @@ $(function() {
6{
7public:
-
8 static size_t EntriesLimit;
-
9
- -
11 : DataDirEntryWrapper(pe, pe::DIR_BOUND_IMPORT), importsCount(0) { wrap(); }
+ +
9 : DataDirEntryWrapper(pe, pe::DIR_BOUND_IMPORT), importsCount(0) { wrap(); }
+
10
+
11 virtual bool wrap();
12
-
13 virtual bool wrap();
-
14
-
15 virtual void* getPtr() { return boundImp(); }
-
16 virtual bufsize_t getSize();
-
17 virtual QString getName() { return "BoundImp"; }
-
18 virtual size_t getFieldsCount() { return this->entries.size(); }
-
19
-
20 virtual void* getFieldPtr(size_t fieldId, size_t subField) { return getSubfieldPtr(fieldId, subField ); }
-
21 virtual bufsize_t getFieldSize(size_t fieldId, size_t subField = FIELD_NONE) { return getSubfieldSize(fieldId, subField); }
-
22
-
23 virtual QString getFieldName(size_t fieldId, size_t subField) { return getSubfieldName(fieldId, subField ); }
-
24 virtual QString getFieldName(size_t fieldId) { return getFieldName(fieldId, FIELD_NONE); }
-
25
-
26protected:
-
27 bool loadNextEntry(size_t entryNum);
-
28
-
29 IMAGE_BOUND_IMPORT_DESCRIPTOR* boundImp();
- -
31
-
32friend class BoundEntryWrapper;
-
33};
-
34
- -
36{
-
37public:
-
38 enum FieldID {
- - - - - -
44 };
-
45
- -
47 : ExeNodeWrapper(pe, parent, entryNum ) { }
+
13 virtual void* getPtr() { return boundImp(); }
+
14 virtual bufsize_t getSize();
+
15 virtual QString getName() { return "BoundImp"; }
+
16 virtual size_t getFieldsCount() { return this->entries.size(); }
+
17
+
18 virtual void* getFieldPtr(size_t fieldId, size_t subField) { return getSubfieldPtr(fieldId, subField ); }
+
19 virtual bufsize_t getFieldSize(size_t fieldId, size_t subField = FIELD_NONE) { return getSubfieldSize(fieldId, subField); }
+
20
+
21 virtual QString getFieldName(size_t fieldId, size_t subField) { return getSubfieldName(fieldId, subField ); }
+
22 virtual QString getFieldName(size_t fieldId) { return getFieldName(fieldId, FIELD_NONE); }
+
23
+
24protected:
+
25 bool loadNextEntry(size_t entryNum);
+
26
+
27 IMAGE_BOUND_IMPORT_DESCRIPTOR* boundImp();
+ +
29
+
30friend class BoundEntryWrapper;
+
31};
+
32
+ +
34{
+
35public:
+
36 enum FieldID {
+ + + + + +
42 };
+
43
+ +
45 : ExeNodeWrapper(pe, parent, entryNum ) { }
+
46
+
47 bool wrap() { return true; }
48
-
49 bool wrap() { return true; }
-
50
-
51 virtual void* getPtr();
-
52 virtual bufsize_t getSize();
-
53 virtual QString getName();
-
54 virtual char* getLibraryName();
-
55 virtual size_t getFieldsCount() { return FIELD_COUNTER; }
-
56 virtual size_t getSubFieldsCount() { return 1; }
-
57
-
58 virtual void* getFieldPtr(size_t fieldId, size_t subField);
-
59 virtual QString getFieldName(size_t fieldId);
-
60};
+
49 virtual void* getPtr();
+
50 virtual bufsize_t getSize();
+
51 virtual QString getName();
+
52 virtual char* getLibraryName();
+
53 virtual size_t getFieldsCount() { return FIELD_COUNTER; }
+
54 virtual size_t getSubFieldsCount() { return 1; }
+
55
+
56 virtual void* getFieldPtr(size_t fieldId, size_t subField);
+
57 virtual QString getFieldName(size_t fieldId);
+
58};
uint32_t bufsize_t
#define FIELD_NONE
-
-
virtual void * getFieldPtr(size_t fieldId, size_t subField)
-
virtual size_t getFieldsCount()
-
virtual char * getLibraryName()
-
BoundEntryWrapper(Executable *pe, BoundImpDirWrapper *parent, size_t entryNum)
-
FieldID
-
@ TIMESTAMP
-
@ FIELD_COUNTER
-
@ MODULE_FORWARDERS_NUM
-
@ NONE
-
@ MODULE_NAME_OFFSET
-
virtual size_t getSubFieldsCount()
-
virtual bufsize_t getSize()
-
virtual QString getFieldName(size_t fieldId)
-
virtual QString getName()
-
bool wrap()
-
virtual void * getPtr()
+
+
virtual void * getFieldPtr(size_t fieldId, size_t subField)
+
virtual size_t getFieldsCount()
+
virtual char * getLibraryName()
+
BoundEntryWrapper(Executable *pe, BoundImpDirWrapper *parent, size_t entryNum)
+
FieldID
+
@ TIMESTAMP
+
@ FIELD_COUNTER
+
@ MODULE_FORWARDERS_NUM
+
@ NONE
+
@ MODULE_NAME_OFFSET
+
virtual size_t getSubFieldsCount()
+
virtual bufsize_t getSize()
+
virtual QString getFieldName(size_t fieldId)
+
virtual QString getName()
+
bool wrap()
+
virtual void * getPtr()
-
BoundImpDirWrapper(PEFile *pe)
-
bool loadNextEntry(size_t entryNum)
-
static size_t EntriesLimit
-
virtual void * getFieldPtr(size_t fieldId, size_t subField)
-
virtual QString getFieldName(size_t fieldId, size_t subField)
- -
IMAGE_BOUND_IMPORT_DESCRIPTOR * boundImp()
-
virtual void * getPtr()
- -
virtual size_t getFieldsCount()
-
virtual bufsize_t getSize()
-
virtual QString getName()
-
virtual QString getFieldName(size_t fieldId)
-
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField=FIELD_NONE)
+
BoundImpDirWrapper(PEFile *pe)
+
bool loadNextEntry(size_t entryNum)
+
virtual void * getFieldPtr(size_t fieldId, size_t subField)
+
virtual QString getFieldName(size_t fieldId, size_t subField)
+ +
IMAGE_BOUND_IMPORT_DESCRIPTOR * boundImp()
+
virtual void * getPtr()
+ +
virtual size_t getFieldsCount()
+
virtual bufsize_t getSize()
+
virtual QString getName()
+
virtual QString getFieldName(size_t fieldId)
+
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField=FIELD_NONE)
virtual void * getSubfieldPtr(size_t fieldId, size_t subField)
diff --git a/_data_dir_entry_wrapper_8cpp_source.html b/_data_dir_entry_wrapper_8cpp_source.html index 969ac4f5..5ddb6ada 100644 --- a/_data_dir_entry_wrapper_8cpp_source.html +++ b/_data_dir_entry_wrapper_8cpp_source.html @@ -100,27 +100,43 @@ $(function() {
28 return rva;
29}
30
- +
32{
33 if (this->entryType >= pe::DIR_ENTRIES_COUNT) return 0;
-
34
-
35 IMAGE_DATA_DIRECTORY *d = getDataDirectory();
-
36 if (!d) return 0;
-
37
-
38 bufsize_t size = static_cast<bufsize_t>(d[this->entryType].Size);
-
39 return size;
-
40}
+
34 IMAGE_DATA_DIRECTORY *d = getDataDirectory();
+
35 if (!d) return 0;
+
36
+
37 bufsize_t dirSize = static_cast<bufsize_t>(d[this->entryType].Size);
+
38 if (!trimToExeSize) {
+
39 return dirSize;
+
40 }
+
41
+
42 if (!this->m_Exe) return 0; // should never happen
+
43
+
44 bufsize_t dirRva = d[this->entryType].VirtualAddress;
+
45 bufsize_t dirRaw = this->m_Exe->rvaToRaw(dirRva);
+
46 if (dirRaw == INVALID_ADDR) {
+
47 return 0;
+
48 }
+
49 bufsize_t fullSize = this->m_Exe->getContentSize();
+
50 bufsize_t remainingSize = fullSize - dirRaw;
+
51
+
52 return (dirSize < remainingSize) ? dirSize : remainingSize;
+
53}
uint32_t bufsize_t
const offset_t INVALID_ADDR
uint64_t offset_t
-
bufsize_t getDirEntrySize()
+
bufsize_t getDirEntrySize(bool trimToExeSize=false)
offset_t getDirEntryAddress()
int entryType
DataDirEntryWrapper(PEFile *pe, pe::dir_entry v_entryType)
IMAGE_DATA_DIRECTORY * getDataDirectory()
+
virtual bool wrap()
+
virtual offset_t rvaToRaw(offset_t rva)=0
+
virtual bufsize_t getContentSize()
Definition: Executable.h:51
Definition: PEFile.h:41
IMAGE_DATA_DIRECTORY * getDataDirectory()
Definition: PEFile.cpp:195
diff --git a/_data_dir_entry_wrapper_8h_source.html b/_data_dir_entry_wrapper_8h_source.html index eab226a5..030c7475 100644 --- a/_data_dir_entry_wrapper_8h_source.html +++ b/_data_dir_entry_wrapper_8h_source.html @@ -83,7 +83,7 @@ $(function() {
11 IMAGE_DATA_DIRECTORY* getDataDirectory();
12
- +
14 bufsize_t getDirEntrySize(bool trimToExeSize=false);
15 int getDirEntryType() { return this->entryType; }
16
17protected:
@@ -99,7 +99,7 @@ $(function() {
int getDirEntryType()
-
bufsize_t getDirEntrySize()
+
bufsize_t getDirEntrySize(bool trimToExeSize=false)
offset_t getDirEntryAddress()
int entryType
DataDirEntryWrapper(PEFile *pe, pe::dir_entry v_entryType)
diff --git a/_exception_dir_wrapper_8cpp_source.html b/_exception_dir_wrapper_8cpp_source.html index 6413caad..575adedd 100644 --- a/_exception_dir_wrapper_8cpp_source.html +++ b/_exception_dir_wrapper_8cpp_source.html @@ -85,7 +85,7 @@ $(function() {
13{
14 clear();
15 parsedSize = 0;
-
16 bufsize_t maxSize = getDirEntrySize();
+
16 bufsize_t maxSize = getDirEntrySize(true);
17 if (maxSize == 0) return false; // nothing to parse
18
19 if (!exceptFunc64()) return false;
@@ -183,7 +183,7 @@ $(function() {
uint64_t offset_t
-
bufsize_t getDirEntrySize()
+
bufsize_t getDirEntrySize(bool trimToExeSize=false)
offset_t getDirEntryAddress()
friend class ExceptionEntryWrapper
IMAGE_IA64_RUNTIME_FUNCTION_ENTRY * exceptFunc64()
diff --git a/_reloc_dir_wrapper_8cpp_source.html b/_reloc_dir_wrapper_8cpp_source.html index 4e310142..66be049c 100644 --- a/_reloc_dir_wrapper_8cpp_source.html +++ b/_reloc_dir_wrapper_8cpp_source.html @@ -73,317 +73,314 @@ $(function() { Go to the documentation of this file.
2#include "pe/PEFile.h"
3
-
4size_t RelocDirWrapper::EntriesLimit = 10000;
-
5
-
6/*
-
7// Based relocation format.
-
8
-
9typedef struct _IMAGE_BASE_RELOCATION {
-
10 DWORD VirtualAddress;
-
11 DWORD SizeOfBlock;
-
12 // WORD TypeOffset[1];
-
13} IMAGE_BASE_RELOCATION;
-
14typedef IMAGE_BASE_RELOCATION UNALIGNED * PIMAGE_BASE_RELOCATION;
-
15
+
4/*
+
5// Based relocation format.
+
6
+
7typedef struct _IMAGE_BASE_RELOCATION {
+
8 DWORD VirtualAddress;
+
9 DWORD SizeOfBlock;
+
10 // WORD TypeOffset[1];
+
11} IMAGE_BASE_RELOCATION;
+
12typedef IMAGE_BASE_RELOCATION UNALIGNED * PIMAGE_BASE_RELOCATION;
+
13
+
14
+
15//Based relocation types.
16
-
17//Based relocation types.
-
18
-
19enum reloc_based {
-
20 RELB_ABSOLUTE = 0,
-
21 RELB_HIGH = 1,
-
22 RELB_LOW = 2,
-
23 RELB_HIGHLOW = 3,
-
24 RELB_HIGHADJ = 4,
-
25 RELB_MIPS_JMPADDR = 5,
-
26 RELB_SECTION = 6,
-
27 RELB_REL32 = 7,
-
28 RELB_MIPS_JMPADDR16 = 9,
-
29 RELB_IA64_IMM64 = 9,
-
30 RELB_DIR64 = 10,
-
31 RELB_HIGH3ADJ = 11
-
32};
-
33
-
34*/
-
35
- -
37{
-
38 clear();
-
39 parsedSize = 0;
-
40 bufsize_t maxSize = getDirEntrySize();
-
41
-
42 for (size_t i = 0; i < RelocDirWrapper::EntriesLimit && parsedSize < maxSize; i++) {
-
43 RelocBlockWrapper* entry = new RelocBlockWrapper(this->m_Exe, this, i);
-
44
-
45 if (entry->getPtr() == NULL) {
-
46 delete entry;
-
47 break;
-
48 }
-
49 bool isOk = false;
- -
51
-
52 this->parsedSize += val;
-
53 this->entries.push_back(entry);
-
54
-
55 }
-
56 return true;
-
57}
+
17enum reloc_based {
+
18 RELB_ABSOLUTE = 0,
+
19 RELB_HIGH = 1,
+
20 RELB_LOW = 2,
+
21 RELB_HIGHLOW = 3,
+
22 RELB_HIGHADJ = 4,
+
23 RELB_MIPS_JMPADDR = 5,
+
24 RELB_SECTION = 6,
+
25 RELB_REL32 = 7,
+
26 RELB_MIPS_JMPADDR16 = 9,
+
27 RELB_IA64_IMM64 = 9,
+
28 RELB_DIR64 = 10,
+
29 RELB_HIGH3ADJ = 11
+
30};
+
31
+
32*/
+
33
+ +
35{
+
36 clear();
+
37 parsedSize = 0;
+
38 bufsize_t maxSize = getDirEntrySize(true);
+
39 size_t entryId = 0;
+
40 while (parsedSize < maxSize) {
+
41 RelocBlockWrapper* entry = new RelocBlockWrapper(this->m_Exe, this, entryId++);
+
42 if (!entry) break;
+
43
+
44 bool isOk = false;
+ +
46
+
47 if (!entry->getPtr() || !val || !isOk) {
+
48 delete entry;
+
49 break;
+
50 }
+
51 this->parsedSize += val;
+
52 this->entries.push_back(entry);
+
53
+
54 }
+
55 return true;
+
56}
+
57
58
-
59
-
60IMAGE_BASE_RELOCATION* RelocDirWrapper::reloc()
-
61{
- -
63
-
64 BYTE *ptr = m_Exe->getContentAt(rva, Executable::RVA, sizeof(IMAGE_BASE_RELOCATION));
-
65 if (ptr == NULL) return NULL;
-
66
-
67 IMAGE_BASE_RELOCATION *reloc = (IMAGE_BASE_RELOCATION*) ptr;
-
68 return reloc;
-
69}
-
70
-
71//----------------
-
72
- -
74{
-
75 clear();
-
76 parsedSize = 0;
-
77
-
78 IMAGE_BASE_RELOCATION* reloc = myReloc();
-
79 if (!reloc) return false;
-
80
-
81 size_t maxSize = reloc->SizeOfBlock;
-
82 parsedSize = sizeof(reloc->VirtualAddress) + sizeof(reloc->SizeOfBlock);
+
59IMAGE_BASE_RELOCATION* RelocDirWrapper::reloc()
+
60{
+ +
62
+
63 BYTE *ptr = m_Exe->getContentAt(rva, Executable::RVA, sizeof(IMAGE_BASE_RELOCATION));
+
64 if (ptr == NULL) return NULL;
+
65
+
66 IMAGE_BASE_RELOCATION *reloc = (IMAGE_BASE_RELOCATION*) ptr;
+
67 return reloc;
+
68}
+
69
+
70//----------------
+
71
+ +
73{
+
74 clear();
+
75 parsedSize = 0;
+
76
+
77 IMAGE_BASE_RELOCATION* reloc = myReloc();
+
78 if (!reloc) return false;
+
79
+
80 size_t maxSize = reloc->SizeOfBlock;
+
81 parsedSize = sizeof(reloc->VirtualAddress) + sizeof(reloc->SizeOfBlock);
+
82 size_t entryId = 0;
83
-
84 for (size_t i = 0; i < RelocDirWrapper::EntriesLimit && parsedSize < maxSize; i++) {
-
85 RelocEntryWrapper* entry = new RelocEntryWrapper(this->m_Exe, this, i);
+
84 while (parsedSize < maxSize) {
+
85 RelocEntryWrapper* entry = new RelocEntryWrapper(this->m_Exe, this, entryId++);
86
-
87 if (entry->getPtr() == NULL) {
+
87 if (!entry->getPtr()) {
88 delete entry;
89 break;
90 }
-
91 bool isOk = false;
-
92 size_t val = sizeof(WORD);
-
93
-
94 this->parsedSize += val;
-
95 this->entries.push_back(entry);
-
96 }
-
97 return true;
-
98}
-
99
-
100
- -
102{
-
103 if (this->parentDir == NULL) return NULL;
-
104 IMAGE_BASE_RELOCATION* reloc = this->parentDir->reloc();
-
105 if (!reloc) return NULL;
+
91 this->parsedSize += sizeof(WORD);
+
92 this->entries.push_back(entry);
+
93 }
+
94 return true;
+
95}
+
96
+
97
+ +
99{
+
100 if (this->parentDir == NULL) return NULL;
+
101 IMAGE_BASE_RELOCATION* reloc = this->parentDir->reloc();
+
102 if (!reloc) return NULL;
+
103
+ +
105 BYTE *ptr = NULL;
106
- -
108 BYTE *ptr = NULL;
-
109
-
110 // use my cached:
-
111 if (this->cachedRaw != INVALID_ADDR) {
-
112 ptr = m_Exe->getContentAt(this->cachedRaw, Executable::RAW, sizeof(IMAGE_BASE_RELOCATION));
-
113 return ptr;
-
114 }
+
107 // use my cached:
+
108 if (this->cachedRaw != INVALID_ADDR) {
+
109 ptr = m_Exe->getContentAt(this->cachedRaw, Executable::RAW, sizeof(IMAGE_BASE_RELOCATION));
+
110 return ptr;
+
111 }
+
112
+
113 // use previous cached to calculate my cached
+
114 size_t prevNum = this->entryNum - 1;
115
-
116 // use previous cached to calculate my cached
-
117 size_t prevNum = this->entryNum - 1;
-
118
-
119 RelocBlockWrapper *prevEntry = dynamic_cast<RelocBlockWrapper*> (this->parentDir->getEntryAt(prevNum));
-
120 if (prevEntry) {
-
121 offset_t prevRaw = prevEntry->cachedRaw;
+
116 RelocBlockWrapper *prevEntry = dynamic_cast<RelocBlockWrapper*> (this->parentDir->getEntryAt(prevNum));
+
117 if (prevEntry) {
+
118 offset_t prevRaw = prevEntry->cachedRaw;
+
119
+
120 IMAGE_BASE_RELOCATION* prevReloc = (IMAGE_BASE_RELOCATION*) prevEntry->getPtr();
+
121 raw = prevRaw + prevReloc->SizeOfBlock;
122
-
123 IMAGE_BASE_RELOCATION* prevReloc = (IMAGE_BASE_RELOCATION*) prevEntry->getPtr();
-
124 raw = prevRaw + prevReloc->SizeOfBlock;
+
123 if (prevRaw != INVALID_ADDR) {
+
124 ptr = m_Exe->getContentAt(raw, Executable::RAW, sizeof(IMAGE_BASE_RELOCATION));
125
-
126 if (prevRaw != INVALID_ADDR) {
-
127 ptr = m_Exe->getContentAt(raw, Executable::RAW, sizeof(IMAGE_BASE_RELOCATION));
-
128
-
129 if (ptr != NULL) {
-
130 this->cachedRaw = raw;
-
131 return ptr;
-
132 }
-
133 }
-
134 }
-
135 // previous cached not avaliable, calculate...
-
136 offset_t firstRaw = this->getOffset(reloc);
-
137 offset_t blockSize = reloc->SizeOfBlock;
+
126 if (ptr != NULL) {
+
127 this->cachedRaw = raw;
+
128 return ptr;
+
129 }
+
130 }
+
131 }
+
132 // previous cached not avaliable, calculate...
+
133 offset_t firstRaw = this->getOffset(reloc);
+
134 offset_t blockSize = reloc->SizeOfBlock;
+
135
+
136 raw = firstRaw;
+
137 ptr = (BYTE*) reloc;
138
-
139 raw = firstRaw;
-
140 ptr = (BYTE*) reloc;
+
139 for ( size_t i = 0; i < this->entryNum; i++) { //TODO: make caching
+
140 raw += blockSize;
141
-
142 for ( size_t i = 0; i < this->entryNum; i++) { //TODO: make caching
-
143 raw += blockSize;
+
142 ptr = m_Exe->getContentAt(raw, Executable::RAW, sizeof(IMAGE_BASE_RELOCATION));
+
143 if (!ptr) return NULL;
144
-
145 ptr = m_Exe->getContentAt(raw, Executable::RAW, sizeof(IMAGE_BASE_RELOCATION));
-
146 if (!ptr) return NULL;
-
147
-
148 reloc = (IMAGE_BASE_RELOCATION*) ptr;
-
149 blockSize = reloc->SizeOfBlock;
-
150 }
-
151
-
152 this->cachedRaw = raw;
-
153 return ptr;
-
154}
-
155
- -
157{
-
158 if (this->parentDir == NULL) return 0;
-
159 IMAGE_BASE_RELOCATION* reloc = (IMAGE_BASE_RELOCATION*) this->getPtr();
-
160 if (!reloc) return 0;
-
161
-
162 if (reloc->SizeOfBlock > 0) return reloc->SizeOfBlock;
+
145 reloc = (IMAGE_BASE_RELOCATION*) ptr;
+
146 blockSize = reloc->SizeOfBlock;
+
147 }
+
148
+
149 this->cachedRaw = raw;
+
150 return ptr;
+
151}
+
152
+ +
154{
+
155 if (this->parentDir == NULL) return 0;
+
156 IMAGE_BASE_RELOCATION* reloc = (IMAGE_BASE_RELOCATION*) this->getPtr();
+
157 if (!reloc) return 0;
+
158
+
159 if (reloc->SizeOfBlock > 0) return reloc->SizeOfBlock;
+
160
+
161 return sizeof(IMAGE_BASE_RELOCATION);
+
162}
163
-
164 return sizeof(IMAGE_BASE_RELOCATION);
-
165}
-
166
-
167void* RelocBlockWrapper::getFieldPtr(size_t fieldId, size_t subField)
-
168{
-
169 IMAGE_BASE_RELOCATION* reloc = (IMAGE_BASE_RELOCATION*) this->getPtr();
-
170 if (!reloc) return NULL;
-
171
-
172 switch (fieldId) {
-
173 case PAGE_VA: return (void*) &reloc->VirtualAddress;
-
174 case BLOCK_SIZE : return (void*) &reloc->SizeOfBlock;
-
175 case ENTRIES_PTR :
-
176 {
-
177 BYTE *blockSizePtr = (BYTE*) &reloc->SizeOfBlock;
-
178 return blockSizePtr + sizeof(DWORD);
-
179 }
-
180 }
-
181 return getPtr();
-
182}
-
183
-
184QString RelocBlockWrapper::getFieldName(size_t fieldId)
-
185{
-
186 switch (fieldId) {
-
187 case BLOCK_SIZE : return "Block Size";
-
188 case PAGE_VA: return "Page RVA";
-
189 case ENTRIES_PTR: return "Entries";
-
190 }
-
191 return getName();
-
192}
-
193
- -
195{
-
196 switch (fieldId) {
-
197 case PAGE_VA:
-
198 return Executable::RVA;
-
199 }
- -
201}
-
202
- -
204{
-
205 if (fieldId == ENTRIES_PTR){
- -
207 }
-
208 return WrappedValue::INT;
-
209}
-
210
- -
212{
-
213 void *entriesPtr = getFieldPtr(ENTRIES_PTR);
-
214 size_t entriesSize = getFieldSize(ENTRIES_PTR);
-
215
-
216 if (entriesPtr == NULL || entriesSize == 0) return NULL;
+
164void* RelocBlockWrapper::getFieldPtr(size_t fieldId, size_t subField)
+
165{
+
166 IMAGE_BASE_RELOCATION* reloc = (IMAGE_BASE_RELOCATION*) this->getPtr();
+
167 if (!reloc) return NULL;
+
168
+
169 switch (fieldId) {
+
170 case PAGE_VA: return (void*) &reloc->VirtualAddress;
+
171 case BLOCK_SIZE : return (void*) &reloc->SizeOfBlock;
+
172 case ENTRIES_PTR :
+
173 {
+
174 BYTE *blockSizePtr = (BYTE*) &reloc->SizeOfBlock;
+
175 return blockSizePtr + sizeof(DWORD);
+
176 }
+
177 }
+
178 return getPtr();
+
179}
+
180
+
181QString RelocBlockWrapper::getFieldName(size_t fieldId)
+
182{
+
183 switch (fieldId) {
+
184 case BLOCK_SIZE : return "Block Size";
+
185 case PAGE_VA: return "Page RVA";
+
186 case ENTRIES_PTR: return "Entries";
+
187 }
+
188 return getName();
+
189}
+
190
+ +
192{
+
193 switch (fieldId) {
+
194 case PAGE_VA:
+
195 return Executable::RVA;
+
196 }
+ +
198}
+
199
+ +
201{
+
202 if (fieldId == ENTRIES_PTR){
+ +
204 }
+
205 return WrappedValue::INT;
+
206}
+
207
+ +
209{
+
210 void *entriesPtr = getFieldPtr(ENTRIES_PTR);
+
211 size_t entriesSize = getFieldSize(ENTRIES_PTR);
+
212
+
213 if (entriesPtr == NULL || entriesSize == 0) return NULL;
+
214
+
215 offset_t entriesOffset = getFieldOffset(ENTRIES_PTR);
+
216 void *ptr = this->m_Exe->getContentAt(entriesOffset, Executable::RAW, sizeof(WORD));
217
-
218 offset_t entriesOffset = getFieldOffset(ENTRIES_PTR);
-
219 void *ptr = this->m_Exe->getContentAt(entriesOffset, Executable::RAW, sizeof(WORD));
+
218 return ptr;
+
219}
220
-
221 return ptr;
-
222}
-
223
- -
225{
-
226 if (this->cachedMaxNum > 0) return this->cachedMaxNum;
+ +
222{
+
223 if (this->cachedMaxNum > 0) return this->cachedMaxNum;
+
224
+
225 IMAGE_BASE_RELOCATION* reloc = (IMAGE_BASE_RELOCATION*) this->getPtr();
+
226 if (!reloc) return 0;
227
-
228 IMAGE_BASE_RELOCATION* reloc = (IMAGE_BASE_RELOCATION*) this->getPtr();
-
229 if (!reloc) return 0;
+
228 bufsize_t entriesSize = getFieldSize(ENTRIES_PTR);
+
229 offset_t entriesOffset = getFieldOffset(ENTRIES_PTR);
230
-
231 bufsize_t entriesSize = getFieldSize(ENTRIES_PTR);
-
232 offset_t entriesOffset = getFieldOffset(ENTRIES_PTR);
-
233
-
234 offset_t fileSize = m_Exe->getRawSize();
-
235 if (entriesOffset + entriesSize > fileSize) {
-
236 entriesSize = fileSize - entriesOffset; // truncate to fileSize
-
237 }
-
238
-
239 void *ptr = this->m_Exe->getContentAt(entriesOffset, Executable::RAW, entriesSize);
-
240
-
241 bufsize_t entriesNum = 0;
-
242 if (ptr) {
-
243 entriesNum = entriesSize / sizeof(WORD); //sizeof(BASE_RELOCATION_ENTRY);
-
244 }
-
245 this->cachedMaxNum = entriesNum;
-
246 return entriesNum;
-
247}
-
248//-------------------------------------------------------------------------------------------------
-
249
- -
251{
-
252 if (this->parentDir == NULL) return NULL;
+
231 offset_t fileSize = m_Exe->getRawSize();
+
232 if (entriesOffset + entriesSize > fileSize) {
+
233 entriesSize = fileSize - entriesOffset; // truncate to fileSize
+
234 }
+
235
+
236 void *ptr = this->m_Exe->getContentAt(entriesOffset, Executable::RAW, entriesSize);
+
237
+
238 bufsize_t entriesNum = 0;
+
239 if (ptr) {
+
240 entriesNum = entriesSize / sizeof(WORD); //sizeof(BASE_RELOCATION_ENTRY);
+
241 }
+
242 this->cachedMaxNum = entriesNum;
+
243 return entriesNum;
+
244}
+
245//-------------------------------------------------------------------------------------------------
+
246
+ +
248{
+
249 if (this->parentDir == NULL) return NULL;
+
250
+
251 size_t maxNum = this->parentDir->maxEntriesNumInBlock();
+
252 if (this->entryNum >= maxNum) return NULL;
253
-
254 size_t maxNum = this->parentDir->maxEntriesNumInBlock();
-
255 if (this->entryNum >= maxNum) return NULL;
+
254 WORD* entriesPtr = (WORD* ) parentDir->getEntriesPtr();
+
255 if (entriesPtr == NULL) return NULL;
256
-
257 WORD* entriesPtr = (WORD* ) parentDir->getEntriesPtr();
-
258 if (entriesPtr == NULL) return NULL;
-
259
-
260 WORD* ptr = &entriesPtr[this->entryNum];
-
261 return ptr;
-
262}
-
263
- -
265{
-
266 if (this->parentDir == NULL) return 0;
-
267 return sizeof(WORD);
-
268}
-
269
-
270WORD RelocEntryWrapper::getType(WORD relocEntryVal)
-
271{
-
272 pe::BASE_RELOCATION_ENTRY* entry = (pe::BASE_RELOCATION_ENTRY*) &relocEntryVal;
-
273 return entry->Type;
-
274}
-
275
-
276WORD RelocEntryWrapper::getDelta(WORD relocEntryVal)
-
277{
-
278 pe::BASE_RELOCATION_ENTRY* entry = (pe::BASE_RELOCATION_ENTRY*) &relocEntryVal;
-
279 return entry->Offset;
-
280}
-
281
- -
283{
-
284 switch (type) {
-
285 case 0 : return "Padding (skipped)";
-
286 case 1 : return "High WORD of 32-bit field";
-
287 case 2 : return "Low WORD of 32-bit field";
-
288 case 3 : return "32 bit field";
-
289 case 4 : return "HighAdj";
-
290 case 5 : return "MIPS JumpAddr";
-
291 case 6 : case 7 : return "Reserved";
-
292 case 9 : return "MIPS16 JumpAddr";
-
293 case 10 : return "64 bit field";
-
294 }
-
295 return "";
-
296}
-
297
- -
299{
-
300 if (this->parentDir == NULL) return INVALID_ADDR;
+
257 WORD* ptr = &entriesPtr[this->entryNum];
+
258 return ptr;
+
259}
+
260
+ +
262{
+
263 if (this->parentDir == NULL) return 0;
+
264 return sizeof(WORD);
+
265}
+
266
+
267WORD RelocEntryWrapper::getType(WORD relocEntryVal)
+
268{
+
269 pe::BASE_RELOCATION_ENTRY* entry = (pe::BASE_RELOCATION_ENTRY*) &relocEntryVal;
+
270 return entry->Type;
+
271}
+
272
+
273WORD RelocEntryWrapper::getDelta(WORD relocEntryVal)
+
274{
+
275 pe::BASE_RELOCATION_ENTRY* entry = (pe::BASE_RELOCATION_ENTRY*) &relocEntryVal;
+
276 return entry->Offset;
+
277}
+
278
+ +
280{
+
281 switch (type) {
+
282 case 0 : return "Padding (skipped)";
+
283 case 1 : return "High WORD of 32-bit field";
+
284 case 2 : return "Low WORD of 32-bit field";
+
285 case 3 : return "32 bit field";
+
286 case 4 : return "HighAdj";
+
287 case 5 : return "MIPS JumpAddr";
+
288 case 6 : case 7 : return "Reserved";
+
289 case 9 : return "MIPS16 JumpAddr";
+
290 case 10 : return "64 bit field";
+
291 }
+
292 return "";
+
293}
+
294
+ +
296{
+
297 if (this->parentDir == NULL) return INVALID_ADDR;
+
298
+
299 IMAGE_BASE_RELOCATION* reloc = parentDir->myReloc();
+
300 if (reloc == NULL) return INVALID_ADDR;
301
-
302 IMAGE_BASE_RELOCATION* reloc = parentDir->myReloc();
-
303 if (reloc == NULL) return INVALID_ADDR;
-
304
-
305 offset_t offset = static_cast<offset_t>(reloc->VirtualAddress + delta);
-
306 return offset;
-
307}
-
308
+
302 offset_t offset = static_cast<offset_t>(reloc->VirtualAddress + delta);
+
303 return offset;
+
304}
+
305
uint32_t bufsize_t
const offset_t INVALID_ADDR
uint64_t offset_t
-
bufsize_t getDirEntrySize()
+
bufsize_t getDirEntrySize(bool trimToExeSize=false)
offset_t getDirEntryAddress()
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField=FIELD_NONE)
virtual offset_t getFieldOffset(size_t fieldId, size_t subField=FIELD_NONE)
@@ -400,31 +397,31 @@ $(function() {
BYTE * getContentAt(offset_t offset, bufsize_t size, bool allowExceptions=false)
Definition: Executable.h:57
virtual offset_t getRawSize() const
Definition: Executable.h:54
- -
virtual QString getFieldName(size_t fieldId)
-
virtual WrappedValue::data_type containsDataType(size_t fieldId, size_t subField)
-
virtual void * getFieldPtr(size_t fieldId, size_t subField=FIELD_NONE)
- -
virtual void * getPtr()
-
virtual QString getName()
-
virtual bufsize_t getSize()
- - - - - -
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField)
-
IMAGE_BASE_RELOCATION * myReloc()
- -
friend class RelocBlockWrapper
-
IMAGE_BASE_RELOCATION * reloc()
-
-
offset_t deltaToRVA(WORD delta)
-
static QString translateType(WORD type)
-
virtual void * getPtr()
-
virtual bufsize_t getSize()
-
static WORD getDelta(WORD relocEntryVal)
-
static WORD getType(WORD relocEntryVal)
+ +
virtual QString getFieldName(size_t fieldId)
+
virtual WrappedValue::data_type containsDataType(size_t fieldId, size_t subField)
+
virtual void * getFieldPtr(size_t fieldId, size_t subField=FIELD_NONE)
+ +
virtual void * getPtr()
+
virtual QString getName()
+
virtual bufsize_t getSize()
+ + + + + +
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField)
+
IMAGE_BASE_RELOCATION * myReloc()
+ +
friend class RelocBlockWrapper
+
IMAGE_BASE_RELOCATION * reloc()
+
+
offset_t deltaToRVA(WORD delta)
+
static QString translateType(WORD type)
+
virtual void * getPtr()
+
virtual bufsize_t getSize()
+
static WORD getDelta(WORD relocEntryVal)
+
static WORD getType(WORD relocEntryVal)
diff --git a/_reloc_dir_wrapper_8h_source.html b/_reloc_dir_wrapper_8h_source.html index 806763f5..b0fcd7f2 100644 --- a/_reloc_dir_wrapper_8h_source.html +++ b/_reloc_dir_wrapper_8h_source.html @@ -101,94 +101,90 @@ $(function() {
29 IMAGE_BASE_RELOCATION* reloc();
30
31private:
-
32 static size_t EntriesLimit;
+
32 bufsize_t parsedSize;
33
-
34 bufsize_t parsedSize;
-
35
-
36friend class RelocBlockWrapper;
-
37};
-
38
-
39
- -
41{
-
42public:
-
43 // fields :
- - - - - - -
50 };
-
51
-
52 RelocBlockWrapper(Executable *pe, RelocDirWrapper *parentDir, size_t entryNumber)
-
53 : ExeNodeWrapper(pe, parentDir, entryNumber), cachedRaw(INVALID_ADDR), cachedMaxNum(-1) { this->parentDir = parentDir; wrap(); }
+
34friend class RelocBlockWrapper;
+
35};
+
36
+
37
+ +
39{
+
40public:
+
41 // fields :
+ + + + + + +
48 };
+
49
+
50 RelocBlockWrapper(Executable *pe, RelocDirWrapper *parentDir, size_t entryNumber)
+
51 : ExeNodeWrapper(pe, parentDir, entryNumber), cachedRaw(INVALID_ADDR), cachedMaxNum(-1) { this->parentDir = parentDir; wrap(); }
+
52
+
53 bool wrap();
54
-
55 bool wrap();
-
56
-
57 // full structure boundaries
-
58 virtual void* getPtr();
-
59 virtual bufsize_t getSize();
-
60 virtual QString getName() { return "Relocation Block"; }
-
61 virtual size_t getFieldsCount() { return FIELD_COUNTER; }
-
62
-
63 // specific field boundaries
-
64 virtual void* getFieldPtr(size_t fieldId, size_t subField = FIELD_NONE);
-
65 virtual QString getFieldName(size_t fieldId);
-
66 virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField);
-
67 virtual WrappedValue::data_type containsDataType(size_t fieldId, size_t subField);
-
68
-
69 void* getEntriesPtr();
-
70 size_t maxEntriesNumInBlock();
+
55 // full structure boundaries
+
56 virtual void* getPtr();
+
57 virtual bufsize_t getSize();
+
58 virtual QString getName() { return "Relocation Block"; }
+
59 virtual size_t getFieldsCount() { return FIELD_COUNTER; }
+
60
+
61 // specific field boundaries
+
62 virtual void* getFieldPtr(size_t fieldId, size_t subField = FIELD_NONE);
+
63 virtual QString getFieldName(size_t fieldId);
+
64 virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField);
+
65 virtual WrappedValue::data_type containsDataType(size_t fieldId, size_t subField);
+
66
+
67 void* getEntriesPtr();
+
68 size_t maxEntriesNumInBlock();
+
69
+
70 IMAGE_BASE_RELOCATION* myReloc() { return (IMAGE_BASE_RELOCATION*) getPtr(); }
71
-
72 IMAGE_BASE_RELOCATION* myReloc() { return (IMAGE_BASE_RELOCATION*) getPtr(); }
-
73
-
74private:
-
75 static size_t EntriesLimit;
+
72private:
+
73 offset_t cachedRaw;
+
74 //size_t cachedSize; // TODO
+
75 offset_t cachedMaxNum;
76
-
77 offset_t cachedRaw;
-
78 //size_t cachedSize; // TODO
-
79 offset_t cachedMaxNum;
-
80
-
81 RelocDirWrapper* parentDir;
-
82
-
83 size_t parsedSize;
-
84};
-
85
- -
87{
-
88public:
-
89 // fields :
-
90 enum FieldID {
- - - -
94 };
-
95
-
96 RelocEntryWrapper(Executable* pe, RelocBlockWrapper *parentDir, size_t entryNumber)
-
97 : ExeNodeWrapper(pe, parentDir, entryNumber) { this->parentDir = parentDir; }
-
98
-
99 // full structure boundaries
-
100 virtual void* getPtr();
-
101 virtual bufsize_t getSize();
-
102 virtual QString getName() { return "Type-Offset"; }
-
103 virtual size_t getFieldsCount() { return FIELD_COUNTER; }
-
104 virtual size_t getSubFieldsCount() { return 1; }
-
105
-
106 // specific field boundaries
-
107 virtual void* getFieldPtr(size_t fieldId, size_t subField = FIELD_NONE) { return getPtr(); }
-
108 virtual QString getFieldName(size_t fieldId) { return getName(); }
-
109 virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField) { return Executable::NOT_ADDR; }
-
110
-
111 offset_t deltaToRVA(WORD delta);
-
112 static WORD getType(WORD relocEntryVal);
-
113 static WORD getDelta(WORD relocEntryVal);
-
114 static QString translateType(WORD type);
+
77 RelocDirWrapper* parentDir;
+
78
+
79 size_t parsedSize;
+
80};
+
81
+ +
83{
+
84public:
+
85 // fields :
+
86 enum FieldID {
+ + + +
90 };
+
91
+
92 RelocEntryWrapper(Executable* pe, RelocBlockWrapper *parentDir, size_t entryNumber)
+
93 : ExeNodeWrapper(pe, parentDir, entryNumber) { this->parentDir = parentDir; }
+
94
+
95 // full structure boundaries
+
96 virtual void* getPtr();
+
97 virtual bufsize_t getSize();
+
98 virtual QString getName() { return "Type-Offset"; }
+
99 virtual size_t getFieldsCount() { return FIELD_COUNTER; }
+
100 virtual size_t getSubFieldsCount() { return 1; }
+
101
+
102 // specific field boundaries
+
103 virtual void* getFieldPtr(size_t fieldId, size_t subField = FIELD_NONE) { return getPtr(); }
+
104 virtual QString getFieldName(size_t fieldId) { return getName(); }
+
105 virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField) { return Executable::NOT_ADDR; }
+
106
+
107 offset_t deltaToRVA(WORD delta);
+
108 static WORD getType(WORD relocEntryVal);
+
109 static WORD getDelta(WORD relocEntryVal);
+
110 static QString translateType(WORD type);
+
111
+
112private:
+
113 RelocBlockWrapper* parentDir;
+
114};
115
-
116private:
-
117 RelocBlockWrapper* parentDir;
-
118};
-
119
uint32_t bufsize_t
const offset_t INVALID_ADDR
uint64_t offset_t
@@ -204,28 +200,28 @@ $(function() {
Definition: PEFile.h:41
- -
virtual QString getFieldName(size_t fieldId)
-
virtual WrappedValue::data_type containsDataType(size_t fieldId, size_t subField)
-
virtual void * getFieldPtr(size_t fieldId, size_t subField=FIELD_NONE)
-
RelocBlockWrapper(Executable *pe, RelocDirWrapper *parentDir, size_t entryNumber)
- -
virtual void * getPtr()
-
virtual size_t getFieldsCount()
-
virtual QString getName()
-
virtual bufsize_t getSize()
- - - - - - - - -
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField)
-
IMAGE_BASE_RELOCATION * myReloc()
+ +
virtual QString getFieldName(size_t fieldId)
+
virtual WrappedValue::data_type containsDataType(size_t fieldId, size_t subField)
+
virtual void * getFieldPtr(size_t fieldId, size_t subField=FIELD_NONE)
+
RelocBlockWrapper(Executable *pe, RelocDirWrapper *parentDir, size_t entryNumber)
+ +
virtual void * getPtr()
+
virtual size_t getFieldsCount()
+
virtual QString getName()
+
virtual bufsize_t getSize()
+ + + + + + + + +
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField)
+
IMAGE_BASE_RELOCATION * myReloc()
- +
virtual QString getName()
virtual void * getFieldPtr(size_t fieldId, size_t subField)
virtual QString getFieldName(size_t fieldId, size_t subField)
@@ -234,26 +230,26 @@ $(function() {
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField)
RelocDirWrapper(PEFile *pe)
virtual void * getPtr()
-
IMAGE_BASE_RELOCATION * reloc()
+
IMAGE_BASE_RELOCATION * reloc()
virtual size_t getFieldsCount()
-
-
offset_t deltaToRVA(WORD delta)
-
virtual size_t getSubFieldsCount()
-
static QString translateType(WORD type)
-
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField)
-
virtual size_t getFieldsCount()
-
FieldID
-
@ FIELD_COUNTER
-
@ RELOC_ENTRY_VAL
-
@ NONE
-
virtual void * getPtr()
-
virtual void * getFieldPtr(size_t fieldId, size_t subField=FIELD_NONE)
-
virtual bufsize_t getSize()
-
static WORD getDelta(WORD relocEntryVal)
-
RelocEntryWrapper(Executable *pe, RelocBlockWrapper *parentDir, size_t entryNumber)
-
virtual QString getName()
-
virtual QString getFieldName(size_t fieldId)
-
static WORD getType(WORD relocEntryVal)
+
+
offset_t deltaToRVA(WORD delta)
+
virtual size_t getSubFieldsCount()
+
static QString translateType(WORD type)
+
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField)
+
virtual size_t getFieldsCount()
+
FieldID
+
@ FIELD_COUNTER
+
@ RELOC_ENTRY_VAL
+
@ NONE
+
virtual void * getPtr()
+
virtual void * getFieldPtr(size_t fieldId, size_t subField=FIELD_NONE)
+
virtual bufsize_t getSize()
+
static WORD getDelta(WORD relocEntryVal)
+
RelocEntryWrapper(Executable *pe, RelocBlockWrapper *parentDir, size_t entryNumber)
+
virtual QString getName()
+
virtual QString getFieldName(size_t fieldId)
+
static WORD getType(WORD relocEntryVal)
diff --git a/_resource_strings_wrapper_8cpp_source.html b/_resource_strings_wrapper_8cpp_source.html index 36e31ae6..b3128a13 100644 --- a/_resource_strings_wrapper_8cpp_source.html +++ b/_resource_strings_wrapper_8cpp_source.html @@ -126,68 +126,67 @@ $(function() {
54 return 0;
55}
56//------------------------------------------------------
-
57size_t ResourceStringsWrapper::EntriesLimit = 10000;
-
58
-
59bool ResourceStringsWrapper::wrap()
-
60{
-
61 clear();
-
62 this->parsedSize = 0;
-
63
-
64 BYTE *c = static_cast<BYTE*>(this->getPtr());
-
65 if (!c) {
-
66 return false;
-
67 }
-
68 size_t maxSize = this->getSize();
-
69 //printf("maxSize = %x\n", maxSize);
-
70 offset_t startRaw = getContentRaw();
-
71 offset_t cRaw = startRaw;
-
72
-
73 for (size_t i = 0; i < ResourceStringsWrapper::EntriesLimit && parsedSize < maxSize; i++) {
-
74
-
75 WORD* stringSize = (WORD*) this->getContentAt(cRaw, Executable::RAW, sizeof(WORD));
-
76 if (stringSize == NULL){
-
77 printf("Cannot fetch the string size!\n");
-
78 break;
-
79 }
-
80 this->parsedSize += sizeof(WORD);
-
81 cRaw += sizeof(WORD);
-
82
-
83 size_t wStrSize = (*stringSize);
-
84 if (wStrSize == 0) {
-
85 continue;
-
86 }
-
87 bufsize_t totalStrSize = wStrSize * sizeof(WORD);
-
88
-
89 WORD* uStringPtr = (WORD*) this->getContentAt(cRaw, Executable::RAW, totalStrSize);
-
90 if (uStringPtr == NULL) break;
-
91
-
92 Executable *exe = this->myLeaf->getExe();
-
93 ResString *rStr = new ResString(uStringPtr, stringSize, cRaw, exe);
-
94 this->entries.push_back(rStr);
-
95
-
96 this->parsedSize += totalStrSize;
-
97 cRaw += totalStrSize;
-
98 }
-
99 return true;
-
100}
-
101
-
102QString ResourceStringsWrapper::getFieldName(size_t fId)
-
103{
-
104 return "ResourceString";
-
105}
-
106
-
107void* ResourceStringsWrapper::getFieldPtr(size_t fId, size_t subField)
-
108{
-
109 if (fId >= this->entries.size()) return NULL;
-
110 return this->entries[fId]->getFieldPtr(subField);
-
111}
-
112
-
113bufsize_t ResourceStringsWrapper::getFieldSize(size_t fId, size_t subField)
-
114{
-
115 if (fId >= this->entries.size()) return 0;
-
116 return this->entries[fId]->getFieldSize(subField);
-
117}
-
118
+
57
+
58bool ResourceStringsWrapper::wrap()
+
59{
+
60 clear();
+
61 this->parsedSize = 0;
+
62
+
63 BYTE *c = static_cast<BYTE*>(this->getPtr());
+
64 if (!c) {
+
65 return false;
+
66 }
+
67 size_t maxSize = this->getSize();
+
68 //printf("maxSize = %x\n", maxSize);
+
69 offset_t startRaw = getContentRaw();
+
70 offset_t cRaw = startRaw;
+
71
+
72 while (parsedSize < maxSize) {
+
73
+
74 WORD* stringSize = (WORD*) this->getContentAt(cRaw, Executable::RAW, sizeof(WORD));
+
75 if (stringSize == NULL){
+
76 printf("Cannot fetch the string size!\n");
+
77 break;
+
78 }
+
79 this->parsedSize += sizeof(WORD);
+
80 cRaw += sizeof(WORD);
+
81
+
82 size_t wStrSize = (*stringSize);
+
83 if (wStrSize == 0) {
+
84 continue;
+
85 }
+
86 bufsize_t totalStrSize = wStrSize * sizeof(WORD);
+
87
+
88 WORD* uStringPtr = (WORD*) this->getContentAt(cRaw, Executable::RAW, totalStrSize);
+
89 if (uStringPtr == NULL) break;
+
90
+
91 Executable *exe = this->myLeaf->getExe();
+
92 ResString *rStr = new ResString(uStringPtr, stringSize, cRaw, exe);
+
93 this->entries.push_back(rStr);
+
94
+
95 this->parsedSize += totalStrSize;
+
96 cRaw += totalStrSize;
+
97 }
+
98 return true;
+
99}
+
100
+
101QString ResourceStringsWrapper::getFieldName(size_t fId)
+
102{
+
103 return "ResourceString";
+
104}
+
105
+
106void* ResourceStringsWrapper::getFieldPtr(size_t fId, size_t subField)
+
107{
+
108 if (fId >= this->entries.size()) return NULL;
+
109 return this->entries[fId]->getFieldPtr(subField);
+
110}
+
111
+
112bufsize_t ResourceStringsWrapper::getFieldSize(size_t fId, size_t subField)
+
113{
+
114 if (fId >= this->entries.size()) return 0;
+
115 return this->entries[fId]->getFieldSize(subField);
+
116}
+
117
uint32_t bufsize_t
uint64_t offset_t
@@ -215,12 +214,11 @@ $(function() {
ResourceLeafWrapper * myLeaf
virtual bufsize_t getSize()
Executable * getExe()
-
virtual void * getFieldPtr(size_t fieldId, size_t subField)
-
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField=FIELD_NONE)
-
virtual QString getFieldName(size_t fieldId)
-
static size_t EntriesLimit
-
size_t parsedSize
-
bool wrap()
+
virtual void * getFieldPtr(size_t fieldId, size_t subField)
+
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField=FIELD_NONE)
+
virtual QString getFieldName(size_t fieldId)
+
size_t parsedSize
+
bool wrap()