From f477a765b3d21a603140eb177ec002391704306f Mon Sep 17 00:00:00 2001 From: hasherezade Date: Sat, 11 Feb 2017 20:45:37 +0100 Subject: [PATCH] [W-I-P] Refactoring started --- commander/CMakeLists.txt | 4 +- commander/PECommander.cpp | 2 +- commander/PECommander.h | 2 +- commander/main.cpp | 3 +- parser/AbstractByteBuffer.cpp | 10 +- parser/ExeElementWrapper.cpp | 6 +- parser/ExeNodeWrapper.cpp | 4 +- parser/Executable.cpp | 2 +- parser/FileBuffer.cpp | 2 +- parser/Util.cpp | 6 +- parser/Util.h | 2 +- parser/pe/BoundImpDirWrapper.cpp | 22 +- parser/pe/BoundImpDirWrapper.h | 2 +- parser/pe/DOSExe.cpp | 4 +- parser/pe/DataDirEntryWrapper.cpp | 2 +- parser/pe/DataDirEntryWrapper.h | 8 +- parser/pe/DataDirWrapper.cpp | 8 +- parser/pe/DebugDirWrapper.cpp | 36 +-- parser/pe/DebugDirWrapper.h | 2 +- parser/pe/DelayImpDirWrapper.cpp | 44 +-- parser/pe/DelayImpDirWrapper.h | 12 +- parser/pe/ExceptionDirWrapper.cpp | 18 +- parser/pe/ExceptionDirWrapper.h | 2 +- parser/pe/ExportDirWrapper.cpp | 22 +- parser/pe/ExportDirWrapper.h | 2 +- parser/pe/FileHdrWrapper.h | 1 - parser/pe/ImportDirWrapper.cpp | 6 +- parser/pe/ImportDirWrapper.h | 6 +- parser/pe/LdConfigDirWrapper.cpp | 36 +-- parser/pe/LdConfigDirWrapper.h | 8 +- parser/pe/OptHdrWrapper.cpp | 8 +- parser/pe/OptHdrWrapper.h | 6 +- parser/pe/PECore.cpp | 8 +- parser/pe/PECore.h | 9 +- parser/pe/PEFile.cpp | 18 +- parser/pe/PEFile.h | 4 +- parser/pe/PENodeWrapper.h | 2 - parser/pe/RelocDirWrapper.cpp | 36 +-- parser/pe/RelocDirWrapper.h | 4 +- parser/pe/ResourceDirWrapper.cpp | 30 +- parser/pe/ResourceDirWrapper.h | 12 +- parser/pe/ResourceLeafWrapper.h | 4 +- parser/pe/SectHdrsWrapper.cpp | 14 +- parser/pe/SectHdrsWrapper.h | 4 +- parser/pe/SecurityDirWrapper.cpp | 16 +- parser/pe/SecurityDirWrapper.h | 2 +- parser/pe/TlsDirWrapper.cpp | 20 +- parser/pe/TlsDirWrapper.h | 4 +- parser/pe/pe_formats.h | 342 +++++++++++----------- parser/pe/rsrc/ResourceContentFactory.cpp | 8 +- parser/pe/rsrc/ResourceContentWrapper.cpp | 49 ++-- parser/pe/rsrc/ResourceContentWrapper.h | 4 +- parser/pe/rsrc/ResourceStringsWrapper.h | 2 +- parser/pe/rsrc/ResourceVersionWrapper.cpp | 28 +- parser/win_hdrs/win_types.h | 7 +- 55 files changed, 466 insertions(+), 459 deletions(-) diff --git a/commander/CMakeLists.txt b/commander/CMakeLists.txt index 00bc96d5..57b99b31 100644 --- a/commander/CMakeLists.txt +++ b/commander/CMakeLists.txt @@ -9,6 +9,8 @@ set(CMAKE_AUTOMOC ON) find_package(Qt5Core REQUIRED) get_target_property(QtCore_location Qt5::Core LOCATION) +find_package(Qt5Widgets) + set (imps_srcs main.cpp Commander.cpp @@ -23,5 +25,5 @@ set (imps_hdrs ) add_executable (bearcommander ${imps_hdrs} ${imps_srcs} ) -target_link_libraries(bearcommander ${PARSER_LIB} Qt5::Core) +target_link_libraries(bearcommander ${PARSER_LIB} Qt5::Core Qt5::Widgets) diff --git a/commander/PECommander.cpp b/commander/PECommander.cpp index 373d975c..cf421f72 100644 --- a/commander/PECommander.cpp +++ b/commander/PECommander.cpp @@ -56,7 +56,7 @@ void cmd_util::printResourceTypes(PEFile *pe) void cmd_util::printStrings(PEFile *pe, size_t limit) { - ResourcesContainer *allStrings = pe->getResourcesOfType(pe::RT_STRING); + ResourcesContainer *allStrings = pe->getResourcesOfType(pe::RESTYPE_STRING); if (allStrings == NULL) return; size_t wrappersCount = allStrings->count(); diff --git a/commander/PECommander.h b/commander/PECommander.h index 11ba3311..e27408af 100644 --- a/commander/PECommander.h +++ b/commander/PECommander.h @@ -87,7 +87,7 @@ public: PEFile *pe = cmd_util::getPEFromContext(context); if (!pe) return; - ResourcesContainer* container = pe->getResourcesOfType(pe::RT_STRING); + ResourcesContainer* container = pe->getResourcesOfType(pe::RESTYPE_STRING); if (container == NULL) { printf("No such resource type!\n"); return; diff --git a/commander/main.cpp b/commander/main.cpp index 6daa2b02..6eb223a7 100644 --- a/commander/main.cpp +++ b/commander/main.cpp @@ -5,6 +5,7 @@ #include #include #include +#include #include "PECommander.h" @@ -33,8 +34,6 @@ QString getFileName() int main(int argc, char *argv[]) { - printf("Bearparser version: %s\n", BEARPARSER_VERSION); - printf("[READY]\n"); QCoreApplication app(argc, argv); ExeFactory::init(); diff --git a/parser/AbstractByteBuffer.cpp b/parser/AbstractByteBuffer.cpp index 26824b9d..b850a3b6 100644 --- a/parser/AbstractByteBuffer.cpp +++ b/parser/AbstractByteBuffer.cpp @@ -212,7 +212,7 @@ bool AbstractByteBuffer::pasteBuffer(offset_t rawOffset, AbstractByteBuffer *buf bufsize_t mySize = this->getContentSize(); if (static_cast(mySize) <= rawOffset) { - Logger::append(Logger::ERROR, + Logger::append(Logger::D_ERROR, "Too far offset requested: %llX while mySize: %lX", static_cast(rawOffset), static_cast(mySize) @@ -264,7 +264,7 @@ bool AbstractByteBuffer::intersectsBlock(offset_t rawOffset, bufsize_t size) offset_t srchdEnd = rawOffset + size; if (rawOffset >= startOffset && rawOffset <= endOffset) { - Logger::append(Logger::INFO, + Logger::append(Logger::D_INFO, "Found in bounds: %llX - %llX end: %llX", static_cast(startOffset), static_cast(endOffset), @@ -273,7 +273,7 @@ bool AbstractByteBuffer::intersectsBlock(offset_t rawOffset, bufsize_t size) return true; } if (srchdEnd >= startOffset && srchdEnd <= endOffset) { - Logger::append(Logger::INFO, + Logger::append(Logger::D_INFO, "Found in bounds: %llX - %llX", static_cast(startOffset), static_cast(endOffset) @@ -310,7 +310,7 @@ bool AbstractByteBuffer::setNumValue(offset_t offset, bufsize_t size, uint64_t n if (size == 0 || offset == INVALID_ADDR) return false; void* ptr = this->getContentAt(offset, size); if (ptr == NULL) { - Logger::append(Logger::ERROR, + Logger::append(Logger::D_ERROR, "Cannot get Ptr at: %llX of size: %lX!", static_cast(offset), static_cast(size) @@ -342,7 +342,7 @@ bool AbstractByteBuffer::setNumValue(offset_t offset, bufsize_t size, uint64_t n if ((*valPtr) == nVal) return false; (*valPtr) = nVal; } else { - Logger::append(Logger::ERROR, "Wrong size!"); + Logger::append(Logger::D_ERROR, "Wrong size!"); return false; } return true; diff --git a/parser/ExeElementWrapper.cpp b/parser/ExeElementWrapper.cpp index f9e76557..63631bff 100644 --- a/parser/ExeElementWrapper.cpp +++ b/parser/ExeElementWrapper.cpp @@ -3,7 +3,7 @@ ExeElementWrapper::ExeElementWrapper(Executable *v_exe) { if (v_exe == NULL) { - Logger::append(Logger::ERROR, "Cannot initialize with Exe == NULL!"); + Logger::append(Logger::D_ERROR, "Cannot initialize with Exe == NULL!"); throw CustomException("Cannot initialize with Exe == NULL!"); } this->m_Exe = v_exe; @@ -104,11 +104,11 @@ bool ExeElementWrapper::copyToOffset(offset_t rawOffset) if (this->m_Exe == NULL) return false; if (canCopyToOffset(rawOffset) == false) { - Logger::append(Logger::ERROR,"The area is not empty!"); + Logger::append(Logger::D_ERROR,"The area is not empty!"); return false; } if (m_Exe->pasteBuffer(rawOffset, this, false) == false) { - Logger::append(Logger::ERROR,"Cannot paste the buffer!"); + Logger::append(Logger::D_ERROR,"Cannot paste the buffer!"); return false; } return true; diff --git a/parser/ExeNodeWrapper.cpp b/parser/ExeNodeWrapper.cpp index d2a82194..378e426b 100644 --- a/parser/ExeNodeWrapper.cpp +++ b/parser/ExeNodeWrapper.cpp @@ -58,7 +58,7 @@ bool ExeNodeWrapper::canAddEntry() bufsize_t paddedSize = entrySize * 2; bool haveSpace = this->m_Exe->isAreaEmpty(nextOffset, paddedSize); - Logger::append(Logger::INFO, + Logger::append(Logger::D_INFO, "NextOffset = %llX size = %lX, canAdd: %u", static_cast(nextOffset), static_cast(entrySize), @@ -120,7 +120,7 @@ ExeNodeWrapper* ExeNodeWrapper::addEntryAt(ExeNodeWrapper *entry, offset_t nextO } if (loadNextEntry(entryNum) == false) return NULL; reloadMapping(); - Logger::append(Logger::INFO, + Logger::append(Logger::D_INFO, "Entries count: %lu", static_cast(this->getEntriesCount()) ); diff --git a/parser/Executable.cpp b/parser/Executable.cpp index 0bc68a6e..e004111f 100644 --- a/parser/Executable.cpp +++ b/parser/Executable.cpp @@ -104,7 +104,7 @@ offset_t Executable::toRaw(offset_t offset, addr_type aT, bool allowExceptions) } //--- if (convertedOffset == INVALID_ADDR) { - Logger::append(Logger::WARNING, + Logger::append(Logger::D_WARNING, "Address out of bounds: offset = %llX addrType = %u", static_cast(offset), static_cast(aT) diff --git a/parser/FileBuffer.cpp b/parser/FileBuffer.cpp index 97757b9d..bc2a61ec 100644 --- a/parser/FileBuffer.cpp +++ b/parser/FileBuffer.cpp @@ -72,7 +72,7 @@ ByteBuffer* AbstractFileBuffer::read(QFile &fIn, bufsize_t minBufSize) //throws if (prevOffset == fIn.pos()) break; //cannot read more! prevOffset = fIn.pos(); } - Logger::append(Logger::INFO, + Logger::append(Logger::D_INFO, "Read size: %lX", static_cast(readSize) ); diff --git a/parser/Util.cpp b/parser/Util.cpp index 62b3dddf..0bd019ec 100644 --- a/parser/Util.cpp +++ b/parser/Util.cpp @@ -26,9 +26,9 @@ bool Logger::append(dbg_level lvl, const char* format, ...) va_end(argptr); if (printed <= 0) return false; - const char *prefixes[LVL_COUNT] = {"ERROR", "WARNING", "INFO"}; - if (static_cast(lvl) > static_cast(LVL_COUNT)) { - lvl = ERROR; + const char *prefixes[D_LVL_COUNT] = {"ERROR", "WARNING", "INFO"}; + if (static_cast(lvl) > static_cast(D_LVL_COUNT)) { + lvl = Logger::D_ERROR; } fprintf(stderr, "[%s] %s\n", prefixes[lvl], line); diff --git a/parser/Util.h b/parser/Util.h index 73d79787..213fea22 100644 --- a/parser/Util.h +++ b/parser/Util.h @@ -23,7 +23,7 @@ namespace Logger { enum dbg_level{ - ERROR = 0, WARNING, INFO, LVL_COUNT + D_ERROR = 0, D_WARNING, D_INFO, D_LVL_COUNT }; bool append(dbg_level lvl, const char* format, ...); }; diff --git a/parser/pe/BoundImpDirWrapper.cpp b/parser/pe/BoundImpDirWrapper.cpp index a9374462..776a071d 100644 --- a/parser/pe/BoundImpDirWrapper.cpp +++ b/parser/pe/BoundImpDirWrapper.cpp @@ -20,13 +20,13 @@ typedef struct _IMAGE_BOUND_FORWARDER_REF { */ -pe::IMAGE_BOUND_IMPORT_DESCRIPTOR* BoundImpDirWrapper::boundImp() +IMAGE_BOUND_IMPORT_DESCRIPTOR* BoundImpDirWrapper::boundImp() { offset_t rva = getDirEntryAddress(); - BYTE *ptr = m_Exe->getContentAt(rva, Executable::RVA, sizeof(pe::IMAGE_BOUND_IMPORT_DESCRIPTOR)); + BYTE *ptr = m_Exe->getContentAt(rva, Executable::RVA, sizeof(IMAGE_BOUND_IMPORT_DESCRIPTOR)); if (ptr == NULL) return NULL; - return (pe::IMAGE_BOUND_IMPORT_DESCRIPTOR*) ptr; + return (IMAGE_BOUND_IMPORT_DESCRIPTOR*) ptr; } bool BoundImpDirWrapper::loadNextEntry(size_t entryNum) @@ -71,7 +71,7 @@ bool BoundImpDirWrapper::wrap() bufsize_t BoundImpDirWrapper::getSize() { if (getPtr() == NULL) return 0; - bufsize_t entrySize = static_cast(sizeof(pe::IMAGE_BOUND_IMPORT_DESCRIPTOR)); + bufsize_t entrySize = static_cast(sizeof(IMAGE_BOUND_IMPORT_DESCRIPTOR)); return entrySize * static_cast(this->entries.size()); } @@ -82,16 +82,16 @@ void* BoundEntryWrapper::getPtr() BoundImpDirWrapper* parent = dynamic_cast (this->getParentNode()); if (!parent) return NULL; - pe::IMAGE_BOUND_IMPORT_DESCRIPTOR* firstEntry = parent->boundImp(); + IMAGE_BOUND_IMPORT_DESCRIPTOR* firstEntry = parent->boundImp(); if (firstEntry == NULL) return NULL; uint64_t descAddr = parent->getOffset(firstEntry); if (descAddr == INVALID_ADDR) return NULL; - uint64_t entryOffset = descAddr + (this->entryNum * sizeof(pe::IMAGE_BOUND_IMPORT_DESCRIPTOR)); + uint64_t entryOffset = descAddr + (this->entryNum * sizeof(IMAGE_BOUND_IMPORT_DESCRIPTOR)); if (entryOffset == INVALID_ADDR) return NULL; - BYTE *content = this->m_Exe->getContentAt(entryOffset, Executable::RAW, sizeof(pe::IMAGE_BOUND_IMPORT_DESCRIPTOR)); + BYTE *content = this->m_Exe->getContentAt(entryOffset, Executable::RAW, sizeof(IMAGE_BOUND_IMPORT_DESCRIPTOR)); if (!content) return NULL; return content; @@ -101,7 +101,7 @@ void* BoundEntryWrapper::getPtr() bufsize_t BoundEntryWrapper::getSize() { if (getPtr() == NULL) return 0; - return sizeof(pe::IMAGE_BOUND_IMPORT_DESCRIPTOR); + return sizeof(IMAGE_BOUND_IMPORT_DESCRIPTOR); } QString BoundEntryWrapper::getName() @@ -117,13 +117,13 @@ char* BoundEntryWrapper::getLibraryName() BoundImpDirWrapper* parent = dynamic_cast (this->getParentNode()); if (!parent) return NULL; - pe::IMAGE_BOUND_IMPORT_DESCRIPTOR* firstEntry = parent->boundImp(); + IMAGE_BOUND_IMPORT_DESCRIPTOR* firstEntry = parent->boundImp(); if (firstEntry == NULL) return NULL; uint64_t offset = this->getOffset(firstEntry); if (offset == INVALID_ADDR) return NULL; //---- - pe::IMAGE_BOUND_IMPORT_DESCRIPTOR* bImp = (pe::IMAGE_BOUND_IMPORT_DESCRIPTOR*) this->getPtr(); + IMAGE_BOUND_IMPORT_DESCRIPTOR* bImp = (IMAGE_BOUND_IMPORT_DESCRIPTOR*) this->getPtr(); if (bImp == NULL) return NULL; WORD mnOff = bImp->OffsetModuleName; @@ -139,7 +139,7 @@ void* BoundEntryWrapper::getFieldPtr(size_t fId, size_t subField) BoundImpDirWrapper* parent = dynamic_cast (this->getParentNode()); if (!parent) return NULL; - pe::IMAGE_BOUND_IMPORT_DESCRIPTOR* bImp = (pe::IMAGE_BOUND_IMPORT_DESCRIPTOR*) this->getPtr(); + IMAGE_BOUND_IMPORT_DESCRIPTOR* bImp = (IMAGE_BOUND_IMPORT_DESCRIPTOR*) this->getPtr(); if (bImp == NULL) return NULL; switch (fId) { diff --git a/parser/pe/BoundImpDirWrapper.h b/parser/pe/BoundImpDirWrapper.h index 3bb1b3d8..1c904f4a 100644 --- a/parser/pe/BoundImpDirWrapper.h +++ b/parser/pe/BoundImpDirWrapper.h @@ -26,7 +26,7 @@ public: protected: bool loadNextEntry(size_t entryNum); - pe::IMAGE_BOUND_IMPORT_DESCRIPTOR* boundImp(); + IMAGE_BOUND_IMPORT_DESCRIPTOR* boundImp(); size_t importsCount; friend class BoundEntryWrapper; diff --git a/parser/pe/DOSExe.cpp b/parser/pe/DOSExe.cpp index 886c53ca..a37603b4 100644 --- a/parser/pe/DOSExe.cpp +++ b/parser/pe/DOSExe.cpp @@ -49,8 +49,8 @@ void DOSExe::wrap(AbstractByteBuffer *v_buf) throw ExeException("Could not Wrap!"); } - if ((*magic) != S_DOS && (*magic) != S_DOS2) { - Logger::append(Logger::WARNING, "It is not a DOS file!\n"); + if ((*magic) != pe::S_DOS && (*magic) != pe::S_DOS2) { + Logger::append(Logger::D_WARNING, "It is not a DOS file!\n"); throw ExeException("It is not a DOS file!"); } this->wrappers[WR_DOS_HDR] = this->dosHdrWrapper; diff --git a/parser/pe/DataDirEntryWrapper.cpp b/parser/pe/DataDirEntryWrapper.cpp index 227e5770..b931735f 100644 --- a/parser/pe/DataDirEntryWrapper.cpp +++ b/parser/pe/DataDirEntryWrapper.cpp @@ -9,7 +9,7 @@ DataDirEntryWrapper::DataDirEntryWrapper(PEFile* pe, pe:: dir_entry v_entryType) wrap(); } -pe::IMAGE_DATA_DIRECTORY* DataDirEntryWrapper::getDataDirectory() +IMAGE_DATA_DIRECTORY* DataDirEntryWrapper::getDataDirectory() { if (m_PE == NULL) return NULL; diff --git a/parser/pe/DataDirEntryWrapper.h b/parser/pe/DataDirEntryWrapper.h index b393abc0..069db177 100644 --- a/parser/pe/DataDirEntryWrapper.h +++ b/parser/pe/DataDirEntryWrapper.h @@ -4,22 +4,20 @@ class PEFile; -using namespace pe; - class DataDirEntryWrapper : public PENodeWrapper { public: - pe::IMAGE_DATA_DIRECTORY* getDataDirectory(); + IMAGE_DATA_DIRECTORY* getDataDirectory(); offset_t getDirEntryAddress(); bufsize_t getDirEntrySize(); - pe:: dir_entry getDirEntryType() { return this->entryType; } + int getDirEntryType() { return this->entryType; } protected: DataDirEntryWrapper(PEFile* pe, pe:: dir_entry v_entryType); - pe::dir_entry entryType; + int entryType; friend class PEFile; }; diff --git a/parser/pe/DataDirWrapper.cpp b/parser/pe/DataDirWrapper.cpp index 416fc5e5..a1ee2aa3 100644 --- a/parser/pe/DataDirWrapper.cpp +++ b/parser/pe/DataDirWrapper.cpp @@ -8,13 +8,13 @@ void* DataDirWrapper::getPtr() if (m_PE == NULL) return NULL; offset_t myOff = m_PE->peDataDirOffset(); - pe::IMAGE_DATA_DIRECTORY* ptr = (pe::IMAGE_DATA_DIRECTORY*) m_Exe->getContentAt(myOff, getSize()); + IMAGE_DATA_DIRECTORY* ptr = (IMAGE_DATA_DIRECTORY*) m_Exe->getContentAt(myOff, getSize()); return ptr; } bufsize_t DataDirWrapper::getSize() { - bufsize_t size = sizeof(pe::IMAGE_DATA_DIRECTORY) * DIRECTORY_ENTRIES_NUM; + bufsize_t size = sizeof(IMAGE_DATA_DIRECTORY) * DIRECTORY_ENTRIES_NUM; return size; } @@ -40,10 +40,10 @@ bufsize_t DataDirWrapper::getFieldSize(size_t fieldId, size_t subField) { if (fieldId >= DIRECTORY_ENTRIES_NUM) return getSize(); - pe::IMAGE_DATA_DIRECTORY* dir = (IMAGE_DATA_DIRECTORY*) getPtr(); + IMAGE_DATA_DIRECTORY* dir = (IMAGE_DATA_DIRECTORY*) getPtr(); if (dir == NULL) return 0; - pe::IMAGE_DATA_DIRECTORY record = dir[fieldId]; + IMAGE_DATA_DIRECTORY record = dir[fieldId]; switch (subField) { case ADDRESS : diff --git a/parser/pe/DebugDirWrapper.cpp b/parser/pe/DebugDirWrapper.cpp index 765c1f82..e846d12e 100644 --- a/parser/pe/DebugDirWrapper.cpp +++ b/parser/pe/DebugDirWrapper.cpp @@ -16,14 +16,14 @@ typedef struct _IMAGE_DEBUG_DIRECTORY { */ -pe::IMAGE_DEBUG_DIRECTORY* DebugDirWrapper::debugDir() +IMAGE_DEBUG_DIRECTORY* DebugDirWrapper::debugDir() { offset_t rva = getDirEntryAddress(); - BYTE *ptr = m_Exe->getContentAt(rva, Executable::RVA, sizeof(pe::IMAGE_DEBUG_DIRECTORY)); + BYTE *ptr = m_Exe->getContentAt(rva, Executable::RVA, sizeof(IMAGE_DEBUG_DIRECTORY)); if (ptr == NULL) return NULL; - return (pe::IMAGE_DEBUG_DIRECTORY*) ptr; + return (IMAGE_DEBUG_DIRECTORY*) ptr; } bool DebugDirWrapper::wrap() @@ -39,7 +39,7 @@ void* DebugDirWrapper::getPtr() bufsize_t DebugDirWrapper::getSize() { if (getPtr() == NULL) return 0; - return sizeof(pe::IMAGE_DEBUG_DIRECTORY); + return sizeof(IMAGE_DEBUG_DIRECTORY); } QString DebugDirWrapper::getName() @@ -50,7 +50,7 @@ QString DebugDirWrapper::getName() void* DebugDirWrapper::getFieldPtr(size_t fId, size_t subField) { - pe::IMAGE_DEBUG_DIRECTORY* d = debugDir(); + IMAGE_DEBUG_DIRECTORY* d = debugDir(); if (d == NULL) return NULL; switch (fId) { @@ -93,18 +93,18 @@ Executable::addr_type DebugDirWrapper::containsAddrType(size_t fieldId, size_t s QString DebugDirWrapper::translateType(int type) { switch (type) { - case pe::DT_UNKNOWN : return "unknown"; - case pe::DT_COFF : return "COFF"; - case pe::DT_CODEVIEW : return "Visual C++"; - case pe::DT_FPO : return "frame pointer omission"; - case pe::DT_MISC : return "DBG file"; - case pe::DT_EXCEPTION : return "A copy of .pdata section"; - case pe::DT_FIXUP : return "Reserved"; - case pe::DT_OMAP_TO_SRC : return "mapping from an RVA in image to an RVA in source image"; - case pe::DT_OMAP_FROM_SRC : return "mapping from an RVA in source image to an RVA in image"; - case pe::DT_BORLAND : return "Borland"; - case pe::DT_RESERVED10 : return "Reserved"; - case pe::DT_CLSID : return "CLSID"; + case DT_UNKNOWN : return "unknown"; + case DT_COFF : return "COFF"; + case DT_CODEVIEW : return "Visual C++"; + case DT_FPO : return "frame pointer omission"; + case DT_MISC : return "DBG file"; + case DT_EXCEPTION : return "A copy of .pdata section"; + case DT_FIXUP : return "Reserved"; + case DT_OMAP_TO_SRC : return "mapping from an RVA in image to an RVA in source image"; + case DT_OMAP_FROM_SRC : return "mapping from an RVA in source image to an RVA in image"; + case DT_BORLAND : return "Borland"; + case DT_RESERVED10 : return "Reserved"; + case DT_CLSID : return "CLSID"; } return ""; } @@ -113,7 +113,7 @@ QString DebugDirWrapper::translateFieldContent(size_t fieldId) { if (fieldId != TYPE) return ""; - pe::IMAGE_DEBUG_DIRECTORY* d = debugDir(); + IMAGE_DEBUG_DIRECTORY* d = debugDir(); if (d == NULL) return NULL; return translateType(d->Type); diff --git a/parser/pe/DebugDirWrapper.h b/parser/pe/DebugDirWrapper.h index a986ee1d..b29d29c6 100644 --- a/parser/pe/DebugDirWrapper.h +++ b/parser/pe/DebugDirWrapper.h @@ -40,7 +40,7 @@ public: QString translateFieldContent(size_t fieldId); private: - pe::IMAGE_DEBUG_DIRECTORY* debugDir(); + IMAGE_DEBUG_DIRECTORY* debugDir(); void clear() {} }; diff --git a/parser/pe/DelayImpDirWrapper.cpp b/parser/pe/DelayImpDirWrapper.cpp index bb5933c4..8fb2d2c9 100644 --- a/parser/pe/DelayImpDirWrapper.cpp +++ b/parser/pe/DelayImpDirWrapper.cpp @@ -20,9 +20,9 @@ typedef struct _IMAGE_DELAY_LOAD { bool DelayImpDirWrapper::is64() { if (m_Exe->isBit32()) return false; - size_t size = sizeof(pe::IMAGE_DELAY_LOAD64); + size_t size = sizeof(IMAGE_DELAY_LOAD64); - pe::IMAGE_DELAY_LOAD64* ld64 = firstDelayLd64(); + IMAGE_DELAY_LOAD64* ld64 = firstDelayLd64(); if (ld64) { if (this->m_Exe->toRaw(ld64->szName, Executable::RVA) == INVALID_ADDR) return false; if (this->m_Exe->toRaw(ld64->phmod, Executable::RVA) == INVALID_ADDR) return false; @@ -76,24 +76,24 @@ bufsize_t DelayImpDirWrapper::getEntrySize() size_t size = 0; if (is64()) { - size = sizeof(pe::IMAGE_DELAY_LOAD64); + size = sizeof(IMAGE_DELAY_LOAD64); } else { - size = sizeof(pe::IMAGE_DELAY_LOAD32); + size = sizeof(IMAGE_DELAY_LOAD32); } return static_cast(size); } //--------------------------------------------------------------------------- -pe::IMAGE_IMPORT_BY_NAME* DelayImpEntryWrapper::getFirstImpByNamePtr() +IMAGE_IMPORT_BY_NAME* DelayImpEntryWrapper::getFirstImpByNamePtr() { bool isOk = false; uint64_t value = this->getNumValue(INT, &isOk); if(!isOk) return NULL; Executable::addr_type aT = containsAddrType(INT); - BYTE *ptr = m_Exe->getContentAt(value, aT, sizeof(pe::IMAGE_IMPORT_BY_NAME)); - return (pe::IMAGE_IMPORT_BY_NAME*) ptr; + BYTE *ptr = m_Exe->getContentAt(value, aT, sizeof(IMAGE_IMPORT_BY_NAME)); + return (IMAGE_IMPORT_BY_NAME*) ptr; } bool DelayImpEntryWrapper::loadNextEntry(size_t entryNum) @@ -127,14 +127,14 @@ bool DelayImpEntryWrapper::wrap() return true; } */ -pe::IMAGE_DELAY_LOAD32* DelayImpEntryWrapper::dl32() +IMAGE_DELAY_LOAD32* DelayImpEntryWrapper::dl32() { DelayImpDirWrapper *parent = dynamic_cast(this->parentNode); if (!parent) return NULL; - const size_t DL_SIZE = sizeof(pe::IMAGE_DELAY_LOAD32); - pe::IMAGE_DELAY_LOAD32* first = (pe::IMAGE_DELAY_LOAD32*) parent->firstDelayLd(DL_SIZE); + const size_t DL_SIZE = sizeof(IMAGE_DELAY_LOAD32); + IMAGE_DELAY_LOAD32* first = (IMAGE_DELAY_LOAD32*) parent->firstDelayLd(DL_SIZE); if (!first) return NULL; uint64_t descAddr = parent->getOffset(first); @@ -146,16 +146,16 @@ pe::IMAGE_DELAY_LOAD32* DelayImpEntryWrapper::dl32() BYTE *content = this->m_Exe->getContentAt(entryOffset, Executable::RAW, DL_SIZE); if (!content) return NULL; - return (pe::IMAGE_DELAY_LOAD32*)content; + return (IMAGE_DELAY_LOAD32*)content; } -pe::IMAGE_DELAY_LOAD64* DelayImpEntryWrapper::dl64() +IMAGE_DELAY_LOAD64* DelayImpEntryWrapper::dl64() { DelayImpDirWrapper *parent = dynamic_cast(this->parentNode); if (!parent) return NULL; - const size_t DL_SIZE = sizeof(pe::IMAGE_DELAY_LOAD64); - pe::IMAGE_DELAY_LOAD64* first = (pe::IMAGE_DELAY_LOAD64*) parent->firstDelayLd(DL_SIZE); + const size_t DL_SIZE = sizeof(IMAGE_DELAY_LOAD64); + IMAGE_DELAY_LOAD64* first = (IMAGE_DELAY_LOAD64*) parent->firstDelayLd(DL_SIZE); if (!first) return NULL; uint64_t descAddr = parent->getOffset(first); @@ -167,7 +167,7 @@ pe::IMAGE_DELAY_LOAD64* DelayImpEntryWrapper::dl64() BYTE *content = this->m_Exe->getContentAt(entryOffset, Executable::RAW, DL_SIZE); if (!content) return NULL; - return (pe::IMAGE_DELAY_LOAD64*)content; + return (IMAGE_DELAY_LOAD64*)content; } void* DelayImpEntryWrapper::getPtr() @@ -189,9 +189,9 @@ bufsize_t DelayImpEntryWrapper::getSize() if (!parent) return 0; if (parent->is64()) { - return sizeof(pe::IMAGE_DELAY_LOAD64); + return sizeof(IMAGE_DELAY_LOAD64); } - return sizeof(pe::IMAGE_DELAY_LOAD32); + return sizeof(IMAGE_DELAY_LOAD32); } QString DelayImpEntryWrapper::getName() @@ -218,7 +218,7 @@ char* DelayImpEntryWrapper::getLibraryName() void* DelayImpEntryWrapper::getFieldPtr(size_t fId, size_t subField) { - pe::IMAGE_DELAY_LOAD32* dLd = (pe::IMAGE_DELAY_LOAD32*) this->getPtr(); + IMAGE_DELAY_LOAD32* dLd = (IMAGE_DELAY_LOAD32*) this->getPtr(); if (dLd == NULL) return NULL; switch (fId) { @@ -324,8 +324,8 @@ void* DelayImpFuncWrapper::getFieldPtr(size_t fId, size_t subField) { if (this->parentDir == NULL) return NULL; - pe::IMAGE_DELAY_LOAD32* dLd32 = parentDir->dl32(); - pe::IMAGE_DELAY_LOAD64* dLd64 = parentDir->dl64(); + IMAGE_DELAY_LOAD32* dLd32 = parentDir->dl32(); + IMAGE_DELAY_LOAD64* dLd64 = parentDir->dl64(); if (dLd32 == NULL && dLd64 == NULL) return NULL; @@ -400,7 +400,7 @@ IMAGE_IMPORT_BY_NAME* DelayImpFuncWrapper::getImportByNamePtr() if (!isOk || addr == INVALID_ADDR) return NULL; Executable::addr_type aT = m_Exe->detectAddrType(addr, Executable::RVA); - BYTE *ptr = m_Exe->getContentAt(addr, aT, sizeof(pe::IMAGE_IMPORT_BY_NAME)); - return (pe::IMAGE_IMPORT_BY_NAME*) ptr; + BYTE *ptr = m_Exe->getContentAt(addr, aT, sizeof(IMAGE_IMPORT_BY_NAME)); + return (IMAGE_IMPORT_BY_NAME*) ptr; } diff --git a/parser/pe/DelayImpDirWrapper.h b/parser/pe/DelayImpDirWrapper.h index 671e3161..86b9e28c 100644 --- a/parser/pe/DelayImpDirWrapper.h +++ b/parser/pe/DelayImpDirWrapper.h @@ -21,8 +21,8 @@ protected: bool is64(); // autodetect! 64bit PE may use IMAGE_DELAY_LOAD32! bool is32() { return !is64(); } - pe::IMAGE_DELAY_LOAD32* firstDelayLd32() { return (pe::IMAGE_DELAY_LOAD32*) firstDelayLd(sizeof(pe::IMAGE_DELAY_LOAD32)); } - pe::IMAGE_DELAY_LOAD64* firstDelayLd64() { return (pe::IMAGE_DELAY_LOAD64*) firstDelayLd(sizeof(pe::IMAGE_DELAY_LOAD64)); } + IMAGE_DELAY_LOAD32* firstDelayLd32() { return (IMAGE_DELAY_LOAD32*) firstDelayLd(sizeof(IMAGE_DELAY_LOAD32)); } + IMAGE_DELAY_LOAD64* firstDelayLd64() { return (IMAGE_DELAY_LOAD64*) firstDelayLd(sizeof(IMAGE_DELAY_LOAD64)); } void* firstDelayLd(bufsize_t size); bufsize_t getEntrySize(); @@ -63,9 +63,9 @@ public: protected: bool loadNextEntry(size_t entryNum); - pe::IMAGE_DELAY_LOAD32* dl32(); - pe::IMAGE_DELAY_LOAD64* dl64(); - virtual pe::IMAGE_IMPORT_BY_NAME* getFirstImpByNamePtr(); + IMAGE_DELAY_LOAD32* dl32(); + IMAGE_DELAY_LOAD64* dl64(); + virtual IMAGE_IMPORT_BY_NAME* getFirstImpByNamePtr(); friend class DelayImpFuncWrapper; friend class DelayImpDirWrapper; @@ -109,7 +109,7 @@ public: private: size_t ptrLen() { return (m_Exe->getBitMode() == Executable::BITS_64) ? sizeof(uint64_t) : sizeof(uint32_t); } - virtual pe::IMAGE_IMPORT_BY_NAME* getImportByNamePtr(); + virtual IMAGE_IMPORT_BY_NAME* getImportByNamePtr(); DelayImpEntryWrapper* parentDir; }; diff --git a/parser/pe/ExceptionDirWrapper.cpp b/parser/pe/ExceptionDirWrapper.cpp index 9ab02fae..fe1c18bb 100644 --- a/parser/pe/ExceptionDirWrapper.cpp +++ b/parser/pe/ExceptionDirWrapper.cpp @@ -21,7 +21,7 @@ bool ExceptionDirWrapper::wrap() if (!exceptFunc64()) return false; //printf("maxSize = %x\n", maxSize); - const size_t ENTRY_SIZE = sizeof(pe::IMAGE_IA64_RUNTIME_FUNCTION_ENTRY); + const size_t ENTRY_SIZE = sizeof(IMAGE_IA64_RUNTIME_FUNCTION_ENTRY); for (int i = 0; i < ExceptionDirWrapper::EntriesLimit && parsedSize < maxSize; i++) { ExceptionEntryWrapper* entry = new ExceptionEntryWrapper(this->m_Exe, this, i); @@ -38,7 +38,7 @@ bool ExceptionDirWrapper::wrap() entry->getNumValue(ExceptionEntryWrapper::BLOCK_SIZE, &isOk) );*/ } - Logger::append(Logger::INFO, + Logger::append(Logger::D_INFO, "Entries num = %lu, parsedSize = %lX", static_cast(entries.size()), static_cast(parsedSize) @@ -46,13 +46,13 @@ bool ExceptionDirWrapper::wrap() return true; } -pe::IMAGE_IA64_RUNTIME_FUNCTION_ENTRY* ExceptionDirWrapper::exceptFunc64() +IMAGE_IA64_RUNTIME_FUNCTION_ENTRY* ExceptionDirWrapper::exceptFunc64() { offset_t rva = getDirEntryAddress(); - BYTE *ptr = m_Exe->getContentAt(rva, Executable::RVA, sizeof(pe::IMAGE_IA64_RUNTIME_FUNCTION_ENTRY)); + BYTE *ptr = m_Exe->getContentAt(rva, Executable::RVA, sizeof(IMAGE_IA64_RUNTIME_FUNCTION_ENTRY)); if (ptr == NULL) return NULL; - pe::IMAGE_IA64_RUNTIME_FUNCTION_ENTRY* exc = (pe::IMAGE_IA64_RUNTIME_FUNCTION_ENTRY*) ptr; + IMAGE_IA64_RUNTIME_FUNCTION_ENTRY* exc = (IMAGE_IA64_RUNTIME_FUNCTION_ENTRY*) ptr; return exc; } @@ -61,10 +61,10 @@ pe::IMAGE_IA64_RUNTIME_FUNCTION_ENTRY* ExceptionDirWrapper::exceptFunc64() void* ExceptionEntryWrapper::getPtr() { if (this->parentDir == NULL) return NULL; - pe::IMAGE_IA64_RUNTIME_FUNCTION_ENTRY* first = this->parentDir->exceptFunc64(); + IMAGE_IA64_RUNTIME_FUNCTION_ENTRY* first = this->parentDir->exceptFunc64(); if (!first) return NULL; - const size_t ENTRY_SIZE = sizeof(pe::IMAGE_IA64_RUNTIME_FUNCTION_ENTRY); + const size_t ENTRY_SIZE = sizeof(IMAGE_IA64_RUNTIME_FUNCTION_ENTRY); uint64_t firstOffset = this->getOffset(first); uint64_t myOffset = firstOffset + this->entryNum * ENTRY_SIZE; @@ -78,12 +78,12 @@ bufsize_t ExceptionEntryWrapper::getSize() if (this->parentDir == NULL) return 0; if (this->getPtr() == NULL) return 0; - return sizeof(pe::IMAGE_IA64_RUNTIME_FUNCTION_ENTRY); + return sizeof(IMAGE_IA64_RUNTIME_FUNCTION_ENTRY); } void* ExceptionEntryWrapper::getFieldPtr(size_t fieldId, size_t subField) { - pe::IMAGE_IA64_RUNTIME_FUNCTION_ENTRY* exc = (pe::IMAGE_IA64_RUNTIME_FUNCTION_ENTRY*) this->getPtr(); + IMAGE_IA64_RUNTIME_FUNCTION_ENTRY* exc = (IMAGE_IA64_RUNTIME_FUNCTION_ENTRY*) this->getPtr(); if (!exc) return NULL; switch (fieldId) { diff --git a/parser/pe/ExceptionDirWrapper.h b/parser/pe/ExceptionDirWrapper.h index 65c7e406..d50f5bb8 100644 --- a/parser/pe/ExceptionDirWrapper.h +++ b/parser/pe/ExceptionDirWrapper.h @@ -24,7 +24,7 @@ public: virtual QString getFieldName(size_t fieldId, size_t subField) { return getSubfieldName(fieldId, subField); } protected: - pe::IMAGE_IA64_RUNTIME_FUNCTION_ENTRY* exceptFunc64(); + IMAGE_IA64_RUNTIME_FUNCTION_ENTRY* exceptFunc64(); private: static uint64_t EntriesLimit; diff --git a/parser/pe/ExportDirWrapper.cpp b/parser/pe/ExportDirWrapper.cpp index 0e0f7d8d..3e2113be 100644 --- a/parser/pe/ExportDirWrapper.cpp +++ b/parser/pe/ExportDirWrapper.cpp @@ -22,13 +22,13 @@ typedef struct _IMAGE_EXPORT_DIRECTORY { } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY; */ -pe::IMAGE_EXPORT_DIRECTORY* ExportDirWrapper::exportDir() +IMAGE_EXPORT_DIRECTORY* ExportDirWrapper::exportDir() { offset_t rva = getDirEntryAddress(); - BYTE *ptr = m_Exe->getContentAt(rva, Executable::RVA, sizeof(pe::IMAGE_EXPORT_DIRECTORY)); + BYTE *ptr = m_Exe->getContentAt(rva, Executable::RVA, sizeof(IMAGE_EXPORT_DIRECTORY)); if (ptr == NULL) return NULL; - return (pe::IMAGE_EXPORT_DIRECTORY*) ptr; + return (IMAGE_EXPORT_DIRECTORY*) ptr; } void ExportDirWrapper::clear() @@ -39,7 +39,7 @@ void ExportDirWrapper::clear() size_t ExportDirWrapper::mapNames() { - pe::IMAGE_EXPORT_DIRECTORY* exp = exportDir(); + IMAGE_EXPORT_DIRECTORY* exp = exportDir(); if (exp == NULL) return 0; size_t maxNames = exp->NumberOfNames; @@ -67,7 +67,7 @@ bool ExportDirWrapper::wrap() clear(); size_t mapNum = mapNames(); - pe::IMAGE_EXPORT_DIRECTORY* exp = exportDir(); + IMAGE_EXPORT_DIRECTORY* exp = exportDir(); if (exp == NULL) return 0; size_t maxFunc = exp->NumberOfFunctions; @@ -87,7 +87,7 @@ bool ExportDirWrapper::wrap() bufsize_t ExportDirWrapper::getSize() { if (getPtr() == NULL) return 0; - return sizeof(pe::IMAGE_EXPORT_DIRECTORY); + return sizeof(IMAGE_EXPORT_DIRECTORY); } QString ExportDirWrapper::getName() @@ -105,7 +105,7 @@ QString ExportDirWrapper::getName() void* ExportDirWrapper::getFieldPtr(size_t fId, size_t subField) { - pe::IMAGE_EXPORT_DIRECTORY* d = exportDir(); + IMAGE_EXPORT_DIRECTORY* d = exportDir(); if (d == NULL) return NULL; switch (fId) { @@ -182,7 +182,7 @@ void* ExportEntryWrapper::getFieldPtr(size_t fieldId, size_t subField) DWORD* ExportEntryWrapper::getFuncRvaPtr() { if (this->parentDir == NULL) return NULL; - pe::IMAGE_EXPORT_DIRECTORY* exp = parentDir->exportDir(); + IMAGE_EXPORT_DIRECTORY* exp = parentDir->exportDir(); if (exp == NULL) return NULL; uint64_t funcRva = exp->AddressOfFunctions; @@ -239,7 +239,7 @@ offset_t ExportEntryWrapper::getFuncRva() uint32_t ExportEntryWrapper::getOrdinal() { if (this->parentDir == NULL) return 0; - pe::IMAGE_EXPORT_DIRECTORY* exp = parentDir->exportDir(); + IMAGE_EXPORT_DIRECTORY* exp = parentDir->exportDir(); if (exp == NULL) return 0; DWORD ordinal = static_cast(this->entryNum) + exp->Base; @@ -263,7 +263,7 @@ void* ExportEntryWrapper::getFuncNameRvaPtr() uint32_t nameId = getFuncNameId(); if (nameId == INVALID_ID) return NULL; - pe::IMAGE_EXPORT_DIRECTORY* exp = parentDir->exportDir(); + IMAGE_EXPORT_DIRECTORY* exp = parentDir->exportDir(); if (exp == NULL) return NULL; if (nameId >= exp->NumberOfNames) return NULL; @@ -295,7 +295,7 @@ char* ExportEntryWrapper::getFuncName() char* ExportEntryWrapper::getForwarder() { if (this->parentDir == NULL) return NULL; - pe::IMAGE_EXPORT_DIRECTORY* exp = parentDir->exportDir(); + IMAGE_EXPORT_DIRECTORY* exp = parentDir->exportDir(); if (exp == NULL) return NULL; DWORD* funcRvaPtr = (DWORD*) this->getFuncRvaPtr(); diff --git a/parser/pe/ExportDirWrapper.h b/parser/pe/ExportDirWrapper.h index af66a9f8..bc66bdbf 100644 --- a/parser/pe/ExportDirWrapper.h +++ b/parser/pe/ExportDirWrapper.h @@ -44,7 +44,7 @@ protected: void clear(); size_t mapNames(); - pe::IMAGE_EXPORT_DIRECTORY* exportDir(); + IMAGE_EXPORT_DIRECTORY* exportDir(); std::map ordToNameId; friend class ExportEntryWrapper; diff --git a/parser/pe/FileHdrWrapper.h b/parser/pe/FileHdrWrapper.h index 1c529e18..15e486ab 100644 --- a/parser/pe/FileHdrWrapper.h +++ b/parser/pe/FileHdrWrapper.h @@ -3,7 +3,6 @@ #include "PENodeWrapper.h" #include "pe_formats.h" -using namespace pe; class FileHdrWrapper : public PEElementWrapper { diff --git a/parser/pe/ImportDirWrapper.cpp b/parser/pe/ImportDirWrapper.cpp index 2865f797..db636419 100644 --- a/parser/pe/ImportDirWrapper.cpp +++ b/parser/pe/ImportDirWrapper.cpp @@ -309,7 +309,7 @@ char* ImportEntryWrapper::getLibraryName() //--------------------------------- -pe::IMAGE_DATA_DIRECTORY* ImportDirWrapper::getDataDirectory() +IMAGE_DATA_DIRECTORY* ImportDirWrapper::getDataDirectory() { PEFile *pe = dynamic_cast (this->m_Exe); if (pe == NULL) return NULL; @@ -318,7 +318,7 @@ pe::IMAGE_DATA_DIRECTORY* ImportDirWrapper::getDataDirectory() return d; } -pe::IMAGE_IMPORT_DESCRIPTOR* ImportDirWrapper::firstDescriptor() +IMAGE_IMPORT_DESCRIPTOR* ImportDirWrapper::firstDescriptor() { IMAGE_DATA_DIRECTORY *d = getDataDirectory(); if (!d) return NULL; @@ -331,7 +331,7 @@ pe::IMAGE_IMPORT_DESCRIPTOR* ImportDirWrapper::firstDescriptor() BYTE *dirPtr = this->m_Exe->getContentAt(descAddr, Executable::RAW, sizeof(IMAGE_IMPORT_DESCRIPTOR)); if (dirPtr == NULL) return NULL; // address invalid - return (pe::IMAGE_IMPORT_DESCRIPTOR*) dirPtr; + return (IMAGE_IMPORT_DESCRIPTOR*) dirPtr; } bool ImportDirWrapper::loadNextEntry(size_t cntr) diff --git a/parser/pe/ImportDirWrapper.h b/parser/pe/ImportDirWrapper.h index f99918fc..09dd9b8c 100644 --- a/parser/pe/ImportDirWrapper.h +++ b/parser/pe/ImportDirWrapper.h @@ -40,8 +40,8 @@ public: protected: virtual bool loadNextEntry(size_t cntr); - pe::IMAGE_DATA_DIRECTORY* getDataDirectory(); - pe::IMAGE_IMPORT_DESCRIPTOR *firstDescriptor(); + IMAGE_DATA_DIRECTORY* getDataDirectory(); + IMAGE_IMPORT_DESCRIPTOR *firstDescriptor(); friend class ImportEntryWrapper; }; @@ -131,7 +131,7 @@ public: /* full structure boundatries */ virtual void* getPtr(); - virtual pe::IMAGE_IMPORT_BY_NAME* getImportByNamePtr(); + virtual IMAGE_IMPORT_BY_NAME* getImportByNamePtr(); virtual bufsize_t getSize(); //virtual QString getName(); diff --git a/parser/pe/LdConfigDirWrapper.cpp b/parser/pe/LdConfigDirWrapper.cpp index 2e15543c..85d76e33 100644 --- a/parser/pe/LdConfigDirWrapper.cpp +++ b/parser/pe/LdConfigDirWrapper.cpp @@ -6,9 +6,9 @@ bufsize_t LdConfigDirWrapper::getLdConfigDirSize() bufsize_t dirSize = 0; if (m_Exe->getBitMode() == Executable::BITS_32) { - dirSize = sizeof(pe::IMAGE_LOAD_CONFIG_DIRECTORY32); + dirSize = sizeof(IMAGE_LOAD_CONFIG_DIRECTORY32); } else if (m_Exe->getBitMode() == Executable::BITS_64) { - dirSize = sizeof(pe::IMAGE_LOAD_CONFIG_DIRECTORY64); + dirSize = sizeof(IMAGE_LOAD_CONFIG_DIRECTORY64); } return dirSize; } @@ -18,9 +18,9 @@ bufsize_t LdConfigDirWrapper::getW81partSize() bufsize_t dirSize = 0; if (m_Exe->getBitMode() == Executable::BITS_32) { - dirSize = sizeof(pe::IMAGE_LOAD_CONFIG_D32_W81); + dirSize = sizeof(IMAGE_LOAD_CONFIG_D32_W81); } else if (m_Exe->getBitMode() == Executable::BITS_64) { - dirSize = sizeof(pe::IMAGE_LOAD_CONFIG_D64_W81); + dirSize = sizeof(IMAGE_LOAD_CONFIG_D64_W81); } return dirSize; } @@ -34,16 +34,16 @@ void* LdConfigDirWrapper::getLdConfigDirPtr() return ptr; } -pe::IMAGE_LOAD_CONFIG_DIRECTORY32* LdConfigDirWrapper::ldConf32() +IMAGE_LOAD_CONFIG_DIRECTORY32* LdConfigDirWrapper::ldConf32() { if (m_Exe->getBitMode() != Executable::BITS_32) return NULL; - return (pe::IMAGE_LOAD_CONFIG_DIRECTORY32*) getLdConfigDirPtr(); + return (IMAGE_LOAD_CONFIG_DIRECTORY32*) getLdConfigDirPtr(); } -pe::IMAGE_LOAD_CONFIG_DIRECTORY64* LdConfigDirWrapper::ldConf64() +IMAGE_LOAD_CONFIG_DIRECTORY64* LdConfigDirWrapper::ldConf64() { if (m_Exe->getBitMode() != Executable::BITS_64) return NULL; - return (pe::IMAGE_LOAD_CONFIG_DIRECTORY64*) getLdConfigDirPtr(); + return (IMAGE_LOAD_CONFIG_DIRECTORY64*) getLdConfigDirPtr(); } void* LdConfigDirWrapper::getW81part() @@ -55,10 +55,10 @@ void* LdConfigDirWrapper::getW81part() size_t realSize = 0; if (m_Exe->getBitMode() == Executable::BITS_32) { - realSize = ((pe::IMAGE_LOAD_CONFIG_DIRECTORY32*) ldPtr)->Size; + realSize = ((IMAGE_LOAD_CONFIG_DIRECTORY32*) ldPtr)->Size; } else if (m_Exe->getBitMode() == Executable::BITS_64) { - realSize = ((pe::IMAGE_LOAD_CONFIG_DIRECTORY64*) ldPtr)->Size; + realSize = ((IMAGE_LOAD_CONFIG_DIRECTORY64*) ldPtr)->Size; } if (realSize <= dirSize) return NULL; @@ -73,16 +73,16 @@ void* LdConfigDirWrapper::getW81part() return NULL; } -pe::IMAGE_LOAD_CONFIG_D32_W81* LdConfigDirWrapper::getW81part32() +IMAGE_LOAD_CONFIG_D32_W81* LdConfigDirWrapper::getW81part32() { if (m_Exe->getBitMode() != Executable::BITS_32) return NULL; - return (pe::IMAGE_LOAD_CONFIG_D32_W81*) getW81part(); + return (IMAGE_LOAD_CONFIG_D32_W81*) getW81part(); } -pe::IMAGE_LOAD_CONFIG_D64_W81* LdConfigDirWrapper::getW81part64() +IMAGE_LOAD_CONFIG_D64_W81* LdConfigDirWrapper::getW81part64() { if (m_Exe->getBitMode() != Executable::BITS_64) return NULL; - return (pe::IMAGE_LOAD_CONFIG_D64_W81*) getW81part(); + return (IMAGE_LOAD_CONFIG_D64_W81*) getW81part(); } bool LdConfigDirWrapper::wrap() @@ -139,12 +139,12 @@ bufsize_t LdConfigDirWrapper::getSize() void* LdConfigDirWrapper::getFieldPtr(size_t fId, size_t subField) { - pe::IMAGE_LOAD_CONFIG_DIRECTORY32* ld32 = ldConf32(); - pe::IMAGE_LOAD_CONFIG_DIRECTORY64* ld64 = ldConf64(); + IMAGE_LOAD_CONFIG_DIRECTORY32* ld32 = ldConf32(); + IMAGE_LOAD_CONFIG_DIRECTORY64* ld64 = ldConf64(); if (ld64 == NULL && ld32 == NULL) return NULL; - pe::IMAGE_LOAD_CONFIG_D32_W81* p32 = getW81part32(); - pe::IMAGE_LOAD_CONFIG_D64_W81* p64 = getW81part64(); + IMAGE_LOAD_CONFIG_D32_W81* p32 = getW81part32(); + IMAGE_LOAD_CONFIG_D64_W81* p64 = getW81part64(); if (p32 == NULL && p64 == NULL) { if (fId > SEH_COUNT) this->getPtr(); } diff --git a/parser/pe/LdConfigDirWrapper.h b/parser/pe/LdConfigDirWrapper.h index c7b7d9dd..5c643cd2 100644 --- a/parser/pe/LdConfigDirWrapper.h +++ b/parser/pe/LdConfigDirWrapper.h @@ -59,13 +59,13 @@ public: private: inline bufsize_t getLdConfigDirSize(); inline void* getLdConfigDirPtr(); - pe::IMAGE_LOAD_CONFIG_DIRECTORY32* ldConf32(); - pe::IMAGE_LOAD_CONFIG_DIRECTORY64* ldConf64(); + IMAGE_LOAD_CONFIG_DIRECTORY32* ldConf32(); + IMAGE_LOAD_CONFIG_DIRECTORY64* ldConf64(); inline bufsize_t getW81partSize(); void* getW81part(); - pe::IMAGE_LOAD_CONFIG_D32_W81* getW81part32(); - pe::IMAGE_LOAD_CONFIG_D64_W81* getW81part64(); + IMAGE_LOAD_CONFIG_D32_W81* getW81part32(); + IMAGE_LOAD_CONFIG_D64_W81* getW81part64(); }; diff --git a/parser/pe/OptHdrWrapper.cpp b/parser/pe/OptHdrWrapper.cpp index a6c06df3..defc719c 100644 --- a/parser/pe/OptHdrWrapper.cpp +++ b/parser/pe/OptHdrWrapper.cpp @@ -124,7 +124,7 @@ Executable::exe_bits OptHdrWrapper::getHdrBitMode() return m_PE->getHdrBitMode(); } -pe::IMAGE_NT_HEADERS32* OptHdrWrapper::nt32() +IMAGE_NT_HEADERS32* OptHdrWrapper::nt32() { if (m_PE == NULL) return NULL; if (getHdrBitMode() != Executable::BITS_32) return NULL; @@ -134,7 +134,7 @@ pe::IMAGE_NT_HEADERS32* OptHdrWrapper::nt32() return hdr; } -pe::IMAGE_NT_HEADERS64* OptHdrWrapper::nt64() +IMAGE_NT_HEADERS64* OptHdrWrapper::nt64() { if (m_PE == NULL) return NULL; if (getHdrBitMode() != Executable::BITS_64) return NULL; @@ -148,11 +148,11 @@ pe::IMAGE_NT_HEADERS64* OptHdrWrapper::nt64() void* OptHdrWrapper::getPtr() { if (opt32 == NULL && opt64 == NULL) { - pe::IMAGE_NT_HEADERS32* ntHdr32 = nt32(); + IMAGE_NT_HEADERS32* ntHdr32 = nt32(); if (ntHdr32 != NULL) { this->opt32 = ntHdr32 ? &(ntHdr32->OptionalHeader) : NULL; } else { - pe::IMAGE_NT_HEADERS64* ntHdr64 = nt64(); + IMAGE_NT_HEADERS64* ntHdr64 = nt64(); this->opt64 = (ntHdr64) ? &(ntHdr64->OptionalHeader) : NULL; } } diff --git a/parser/pe/OptHdrWrapper.h b/parser/pe/OptHdrWrapper.h index c22a9f27..d5cbc1b5 100644 --- a/parser/pe/OptHdrWrapper.h +++ b/parser/pe/OptHdrWrapper.h @@ -2,8 +2,6 @@ #include "PENodeWrapper.h" -using namespace pe; - class OptHdrWrapper : public PEElementWrapper { public: @@ -77,8 +75,8 @@ public: virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField = FIELD_NONE); Executable::exe_bits getHdrBitMode(); - pe::IMAGE_NT_HEADERS32* nt32(); - pe::IMAGE_NT_HEADERS64* nt64(); + IMAGE_NT_HEADERS32* nt32(); + IMAGE_NT_HEADERS64* nt64(); //DataDirWrapper dataDir; protected: diff --git a/parser/pe/PECore.cpp b/parser/pe/PECore.cpp index d3983870..10bf062b 100644 --- a/parser/pe/PECore.cpp +++ b/parser/pe/PECore.cpp @@ -28,11 +28,11 @@ bool PECore::wrap(AbstractByteBuffer *v_buf) if (dos == NULL) throw ExeException("Could not wrap PECore: invalid DOS Header!"); offset = dos->e_lfanew + sizeof(DWORD); //skip 'PE' signature - this->fHdr = (IMAGE_FILE_HEADER*) buf->getContentAt(offset, sizeof(pe::IMAGE_FILE_HEADER), allowExceptions); + this->fHdr = (IMAGE_FILE_HEADER*) buf->getContentAt(offset, sizeof(IMAGE_FILE_HEADER), allowExceptions); if (fHdr == NULL) throw ExeException("Could not wrap PECore!"); - offset = offset + sizeof(pe::IMAGE_FILE_HEADER); + offset = offset + sizeof(IMAGE_FILE_HEADER); WORD *magic = (WORD*) buf->getContentAt(offset, sizeof(WORD), allowExceptions); if (magic == NULL) throw ExeException("Could not wrap PECore: invalid FileHeader"); @@ -42,10 +42,10 @@ bool PECore::wrap(AbstractByteBuffer *v_buf) } if (mode == Executable::BITS_32) { - this->opt32 = (pe::IMAGE_OPTIONAL_HEADER32*) buf->getContentAt(offset, sizeof(pe::IMAGE_OPTIONAL_HEADER32), allowExceptions); + this->opt32 = (IMAGE_OPTIONAL_HEADER32*) buf->getContentAt(offset, sizeof(IMAGE_OPTIONAL_HEADER32), allowExceptions); } else if (mode == Executable::BITS_64) { - this->opt64 = (pe::IMAGE_OPTIONAL_HEADER64*) buf->getContentAt(offset, sizeof(pe::IMAGE_OPTIONAL_HEADER64), allowExceptions); + this->opt64 = (IMAGE_OPTIONAL_HEADER64*) buf->getContentAt(offset, sizeof(IMAGE_OPTIONAL_HEADER64), allowExceptions); } if ( this->opt32 == NULL && this->opt64 == NULL) { throw ExeException("Could not wrap PECore : invalid OptionalHeader"); diff --git a/parser/pe/PECore.h b/parser/pe/PECore.h index 3f39612f..61b3a7f4 100644 --- a/parser/pe/PECore.h +++ b/parser/pe/PECore.h @@ -37,11 +37,10 @@ protected: void reset(); AbstractByteBuffer *buf; - pe::IMAGE_DOS_HEADER *dos; - pe::IMAGE_FILE_HEADER* fHdr; - pe::IMAGE_OPTIONAL_HEADER32* opt32; - pe::IMAGE_OPTIONAL_HEADER64* opt64; - + IMAGE_DOS_HEADER *dos; + IMAGE_FILE_HEADER* fHdr; + IMAGE_OPTIONAL_HEADER32* opt32; + IMAGE_OPTIONAL_HEADER64* opt64; //cached: offset_t signatureOff; offset_t fileHdrOff; diff --git a/parser/pe/PEFile.cpp b/parser/pe/PEFile.cpp index 1fd8d57a..a3a5b347 100644 --- a/parser/pe/PEFile.cpp +++ b/parser/pe/PEFile.cpp @@ -48,7 +48,7 @@ PEFile::PEFile(AbstractByteBuffer *v_buf) { album = new ResourcesAlbum(this); wrap(v_buf); - Logger::append(Logger::INFO,"Wrapped"); + Logger::append(Logger::D_INFO,"Wrapped"); } void PEFile::clearWrappers() @@ -193,7 +193,7 @@ bool PEFile::setHdrSectionsNum(size_t newNum) uint64_t count = newNum; bool canSet = fHdr->setNumValue(FileHdrWrapper::SEC_NUM , count); if (canSet == false) { - Logger::append(Logger::ERROR,"Can not change FileHdr!"); + Logger::append(Logger::D_ERROR,"Can not change FileHdr!"); return false; } return true; @@ -204,7 +204,7 @@ bool PEFile::setVitualSize(bufsize_t newSize) uint64_t size = newSize; bool canSet = optHdr->setNumValue(OptHdrWrapper::IMAGE_SIZE, 0, size); if (canSet == false) { - Logger::append(Logger::ERROR, "Can not change OptHdr!"); + Logger::append(Logger::D_ERROR, "Can not change OptHdr!"); return false; } return true; @@ -278,7 +278,7 @@ BufferView* PEFile::createSectionView(size_t secId) { SectionHdrWrapper *sec = this->getSecHdr(secId); if (sec == NULL) { - Logger::append(Logger::WARNING, "No such section"); + Logger::append(Logger::D_WARNING, "No such section"); return NULL; } Executable::addr_type aType = Executable::RAW; @@ -351,12 +351,12 @@ SectionHdrWrapper* PEFile::addNewSection(QString name, bufsize_t size) bufsize_t newVirtualSize = roundedVirtualEnd + size; if (setVitualSize(newVirtualSize) == false) { - Logger::append(Logger::ERROR, "Failed to change virtual size"); + Logger::append(Logger::D_ERROR, "Failed to change virtual size"); return NULL; } if (resize(newSize) == false) { - Logger::append(Logger::ERROR, "Failed to resize"); + Logger::append(Logger::D_ERROR, "Failed to resize"); return NULL; } // fetch again after resize: @@ -365,8 +365,8 @@ SectionHdrWrapper* PEFile::addNewSection(QString name, bufsize_t size) return NULL; } - pe::IMAGE_SECTION_HEADER secHdr; - memset(&secHdr, 0, sizeof(pe::IMAGE_SECTION_HEADER)); + IMAGE_SECTION_HEADER secHdr; + memset(&secHdr, 0, sizeof(IMAGE_SECTION_HEADER)); //name copy: std::string nameStr = name.toStdString(); @@ -430,7 +430,7 @@ SectionHdrWrapper* PEFile::extendLastSection(bufsize_t addedSize) bool PEFile::unbindImports() { - pe::IMAGE_DATA_DIRECTORY* ddir = this->getDataDirectory(); + IMAGE_DATA_DIRECTORY* ddir = this->getDataDirectory(); if (ddir[pe::DIR_BOUND_IMPORT].VirtualAddress == 0 && ddir[pe::DIR_BOUND_IMPORT].Size == 0) { // No bound imports already, nothing to do here! return true; diff --git a/parser/pe/PEFile.h b/parser/pe/PEFile.h index 44acc2ae..8087bccb 100644 --- a/parser/pe/PEFile.h +++ b/parser/pe/PEFile.h @@ -78,7 +78,7 @@ public: ResourcesAlbum* getResourcesAlbum() const { return this->album; } - pe::IMAGE_DATA_DIRECTORY* getDataDirectory(); + IMAGE_DATA_DIRECTORY* getDataDirectory(); offset_t peDataDirOffset(); size_t hdrSectionsNum(); @@ -147,7 +147,7 @@ protected: SectHdrsWrapper *sects; ResourcesAlbum *album; - DataDirEntryWrapper* dataDirEntries[pe::DIR_ENTRIES_COUNT]; + DataDirEntryWrapper* dataDirEntries[DIR_ENTRIES_COUNT]; friend class SectHdrsWrapper; }; diff --git a/parser/pe/PENodeWrapper.h b/parser/pe/PENodeWrapper.h index a084eea7..4b576e30 100644 --- a/parser/pe/PENodeWrapper.h +++ b/parser/pe/PENodeWrapper.h @@ -5,8 +5,6 @@ class PEFile; -using namespace pe; - class PEElementWrapper : public ExeElementWrapper { public: diff --git a/parser/pe/RelocDirWrapper.cpp b/parser/pe/RelocDirWrapper.cpp index 23c7837a..723f5ba3 100644 --- a/parser/pe/RelocDirWrapper.cpp +++ b/parser/pe/RelocDirWrapper.cpp @@ -57,14 +57,14 @@ bool RelocDirWrapper::wrap() } -pe::IMAGE_BASE_RELOCATION* RelocDirWrapper::reloc() +IMAGE_BASE_RELOCATION* RelocDirWrapper::reloc() { offset_t rva = getDirEntryAddress(); - BYTE *ptr = m_Exe->getContentAt(rva, Executable::RVA, sizeof(pe::IMAGE_BASE_RELOCATION)); + BYTE *ptr = m_Exe->getContentAt(rva, Executable::RVA, sizeof(IMAGE_BASE_RELOCATION)); if (ptr == NULL) return NULL; - pe::IMAGE_BASE_RELOCATION *reloc = (pe::IMAGE_BASE_RELOCATION*) ptr; + IMAGE_BASE_RELOCATION *reloc = (IMAGE_BASE_RELOCATION*) ptr; return reloc; } @@ -75,7 +75,7 @@ bool RelocBlockWrapper::wrap() clear(); parsedSize = 0; - pe::IMAGE_BASE_RELOCATION* reloc = myReloc(); + IMAGE_BASE_RELOCATION* reloc = myReloc(); if (!reloc) return false; size_t maxSize = reloc->SizeOfBlock; @@ -101,7 +101,7 @@ bool RelocBlockWrapper::wrap() void* RelocBlockWrapper::getPtr() { if (this->parentDir == NULL) return NULL; - pe::IMAGE_BASE_RELOCATION* reloc = this->parentDir->reloc(); + IMAGE_BASE_RELOCATION* reloc = this->parentDir->reloc(); if (!reloc) return NULL; offset_t raw = INVALID_ADDR; @@ -109,7 +109,7 @@ void* RelocBlockWrapper::getPtr() // use my cached: if (this->cachedRaw != INVALID_ADDR) { - ptr = m_Exe->getContentAt(this->cachedRaw, Executable::RAW, sizeof(pe::IMAGE_BASE_RELOCATION)); + ptr = m_Exe->getContentAt(this->cachedRaw, Executable::RAW, sizeof(IMAGE_BASE_RELOCATION)); return ptr; } @@ -120,11 +120,11 @@ void* RelocBlockWrapper::getPtr() if (prevEntry) { offset_t prevRaw = prevEntry->cachedRaw; - pe::IMAGE_BASE_RELOCATION* prevReloc = (pe::IMAGE_BASE_RELOCATION*) prevEntry->getPtr(); + IMAGE_BASE_RELOCATION* prevReloc = (IMAGE_BASE_RELOCATION*) prevEntry->getPtr(); raw = prevRaw + prevReloc->SizeOfBlock; if (prevRaw != INVALID_ADDR) { - ptr = m_Exe->getContentAt(raw, Executable::RAW, sizeof(pe::IMAGE_BASE_RELOCATION)); + ptr = m_Exe->getContentAt(raw, Executable::RAW, sizeof(IMAGE_BASE_RELOCATION)); if (ptr != NULL) { this->cachedRaw = raw; @@ -142,10 +142,10 @@ void* RelocBlockWrapper::getPtr() for ( int i = 0; i < this->entryNum; i++) { //TODO: make caching raw += blockSize; - ptr = m_Exe->getContentAt(raw, Executable::RAW, sizeof(pe::IMAGE_BASE_RELOCATION)); + ptr = m_Exe->getContentAt(raw, Executable::RAW, sizeof(IMAGE_BASE_RELOCATION)); if (!ptr) return NULL; - reloc = (pe::IMAGE_BASE_RELOCATION*) ptr; + reloc = (IMAGE_BASE_RELOCATION*) ptr; blockSize = reloc->SizeOfBlock; } @@ -156,17 +156,17 @@ void* RelocBlockWrapper::getPtr() bufsize_t RelocBlockWrapper::getSize() { if (this->parentDir == NULL) return 0; - pe::IMAGE_BASE_RELOCATION* reloc = (pe::IMAGE_BASE_RELOCATION*) this->getPtr(); + IMAGE_BASE_RELOCATION* reloc = (IMAGE_BASE_RELOCATION*) this->getPtr(); if (!reloc) return 0; if (reloc->SizeOfBlock > 0) return reloc->SizeOfBlock; - return sizeof(pe::IMAGE_BASE_RELOCATION); + return sizeof(IMAGE_BASE_RELOCATION); } void* RelocBlockWrapper::getFieldPtr(size_t fieldId, size_t subField) { - pe::IMAGE_BASE_RELOCATION* reloc = (pe::IMAGE_BASE_RELOCATION*) this->getPtr(); + IMAGE_BASE_RELOCATION* reloc = (IMAGE_BASE_RELOCATION*) this->getPtr(); if (!reloc) return NULL; switch (fieldId) { @@ -225,7 +225,7 @@ size_t RelocBlockWrapper::maxEntriesNumInBlock() { if (this->cachedMaxNum > 0) return this->cachedMaxNum; - pe::IMAGE_BASE_RELOCATION* reloc = (pe::IMAGE_BASE_RELOCATION*) this->getPtr(); + IMAGE_BASE_RELOCATION* reloc = (IMAGE_BASE_RELOCATION*) this->getPtr(); if (!reloc) return 0; bufsize_t entriesSize = getFieldSize(ENTRIES_PTR); @@ -240,7 +240,7 @@ size_t RelocBlockWrapper::maxEntriesNumInBlock() bufsize_t entriesNum = 0; if (ptr) { - entriesNum = entriesSize / sizeof(WORD); //sizeof(pe::BASE_RELOCATION_ENTRY); + entriesNum = entriesSize / sizeof(WORD); //sizeof(BASE_RELOCATION_ENTRY); } this->cachedMaxNum = entriesNum; return entriesNum; @@ -269,13 +269,13 @@ bufsize_t RelocEntryWrapper::getSize() WORD RelocEntryWrapper::getType(WORD relocEntryVal) { - pe::BASE_RELOCATION_ENTRY* entry = (pe::BASE_RELOCATION_ENTRY*) &relocEntryVal; + BASE_RELOCATION_ENTRY* entry = (BASE_RELOCATION_ENTRY*) &relocEntryVal; return entry->Type; } WORD RelocEntryWrapper::getDelta(WORD relocEntryVal) { - pe::BASE_RELOCATION_ENTRY* entry = (pe::BASE_RELOCATION_ENTRY*) &relocEntryVal; + BASE_RELOCATION_ENTRY* entry = (BASE_RELOCATION_ENTRY*) &relocEntryVal; return entry->Offset; } @@ -299,7 +299,7 @@ offset_t RelocEntryWrapper::deltaToRVA(WORD delta) { if (this->parentDir == NULL) return INVALID_ADDR; - pe::IMAGE_BASE_RELOCATION* reloc = parentDir->myReloc(); + IMAGE_BASE_RELOCATION* reloc = parentDir->myReloc(); if (reloc == NULL) return INVALID_ADDR; offset_t offset = static_cast(reloc->VirtualAddress + delta); diff --git a/parser/pe/RelocDirWrapper.h b/parser/pe/RelocDirWrapper.h index e162c33c..e2cb5280 100644 --- a/parser/pe/RelocDirWrapper.h +++ b/parser/pe/RelocDirWrapper.h @@ -26,7 +26,7 @@ public: virtual QString getFieldName(size_t fieldId, size_t subField) { return getSubfieldName(fieldId, subField ); } protected: - pe::IMAGE_BASE_RELOCATION* reloc(); + IMAGE_BASE_RELOCATION* reloc(); private: static size_t EntriesLimit; @@ -69,7 +69,7 @@ public: void* getEntriesPtr(); size_t maxEntriesNumInBlock(); - pe::IMAGE_BASE_RELOCATION* myReloc() { return (pe::IMAGE_BASE_RELOCATION*) getPtr(); } + IMAGE_BASE_RELOCATION* myReloc() { return (IMAGE_BASE_RELOCATION*) getPtr(); } private: static size_t EntriesLimit; diff --git a/parser/pe/ResourceDirWrapper.cpp b/parser/pe/ResourceDirWrapper.cpp index 4a9bce8d..6c550639 100644 --- a/parser/pe/ResourceDirWrapper.cpp +++ b/parser/pe/ResourceDirWrapper.cpp @@ -56,20 +56,20 @@ typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY { */ //------------- -pe::IMAGE_RESOURCE_DIRECTORY* ResourceDirWrapper::mainResourceDir() +IMAGE_RESOURCE_DIRECTORY* ResourceDirWrapper::mainResourceDir() { offset_t rva = getDirEntryAddress(); - BYTE *ptr = m_Exe->getContentAt(rva, Executable::RVA, sizeof(pe::IMAGE_RESOURCE_DIRECTORY)); - return (pe::IMAGE_RESOURCE_DIRECTORY*) ptr; + BYTE *ptr = m_Exe->getContentAt(rva, Executable::RVA, sizeof(IMAGE_RESOURCE_DIRECTORY)); + return (IMAGE_RESOURCE_DIRECTORY*) ptr; } -pe::IMAGE_RESOURCE_DIRECTORY* ResourceDirWrapper::resourceDir() +IMAGE_RESOURCE_DIRECTORY* ResourceDirWrapper::resourceDir() { if (this->rawOff == 0) return mainResourceDir(); - BYTE *ptr = m_Exe->getContentAt(this->rawOff, Executable::RAW, sizeof(pe::IMAGE_RESOURCE_DIRECTORY)); - return (pe::IMAGE_RESOURCE_DIRECTORY*) ptr; + BYTE *ptr = m_Exe->getContentAt(this->rawOff, Executable::RAW, sizeof(IMAGE_RESOURCE_DIRECTORY)); + return (IMAGE_RESOURCE_DIRECTORY*) ptr; } bool ResourceDirWrapper::wrap() @@ -78,7 +78,7 @@ bool ResourceDirWrapper::wrap() if (this->topEntryID == TOP_ENTRY_ROOT && this->album != NULL) { this->album->clear(); } - pe::IMAGE_RESOURCE_DIRECTORY* dir = resourceDir(); + IMAGE_RESOURCE_DIRECTORY* dir = resourceDir(); if (dir == NULL) return false; size_t namesNum = dir->NumberOfNamedEntries; size_t idsNum = dir->NumberOfIdEntries; @@ -96,7 +96,7 @@ bool ResourceDirWrapper::wrap() break; } if (this->topEntryID == TOP_ENTRY_ROOT && this->album != NULL) { - pe::resource_type typeId = static_cast(entry->getID()); + resource_type typeId = static_cast(entry->getID()); this->album->mapIdToLeafType(i, typeId); } //this->parsedSize += val; @@ -110,14 +110,14 @@ bool ResourceDirWrapper::wrap() bufsize_t ResourceDirWrapper::getSize() { if (getPtr() == NULL) return 0; - bufsize_t size = sizeof(pe::IMAGE_RESOURCE_DIRECTORY); + bufsize_t size = sizeof(IMAGE_RESOURCE_DIRECTORY); size += getEntriesAreaSize(); return size; } void* ResourceDirWrapper::getFieldPtr(size_t fId, size_t subField) { - pe::IMAGE_RESOURCE_DIRECTORY* d = resourceDir(); + IMAGE_RESOURCE_DIRECTORY* d = resourceDir(); if (d == NULL) return NULL; switch (fId) { @@ -226,7 +226,7 @@ bool ResourceEntryWrapper::isByName() { IMAGE_RESOURCE_DIRECTORY_ENTRY* entry = getEntryPtr(); if (entry == NULL) return false; - if (entry->name.NameIsString == 1) return true; + if (entry->NameIsString == 1) return true; return false; } @@ -234,7 +234,7 @@ bool ResourceEntryWrapper::isDir() { IMAGE_RESOURCE_DIRECTORY_ENTRY* entry = getEntryPtr(); if (entry == NULL) return false; - if (entry->dir.DataIsDirectory == 1) return true; + if (entry->DataIsDirectory == 1) return true; return false; } @@ -247,8 +247,8 @@ offset_t ResourceEntryWrapper::getNameOffset() offset_t fOff = this->parentDir->getOffset(this->parentDir->getPtr()); if (fOff == INVALID_ADDR) return INVALID_ADDR; - if (entry->name.NameIsString != 1) return INVALID_ADDR; - return fOff + entry->name.NameOffset; + if (entry->NameIsString != 1) return INVALID_ADDR; + return fOff + entry->NameOffset; } IMAGE_RESOURCE_DIRECTORY_STRING* ResourceEntryWrapper::getNameStr() @@ -303,7 +303,7 @@ DWORD ResourceEntryWrapper::getChildOffsetToDirectory() { IMAGE_RESOURCE_DIRECTORY_ENTRY* entry = getEntryPtr(); if (entry == NULL) return 0; - return entry->dir.OffsetToDirectory; + return entry->OffsetToDirectory; } offset_t ResourceEntryWrapper::getChildAddress() diff --git a/parser/pe/ResourceDirWrapper.h b/parser/pe/ResourceDirWrapper.h index b7efeb4c..48eb0a01 100644 --- a/parser/pe/ResourceDirWrapper.h +++ b/parser/pe/ResourceDirWrapper.h @@ -43,14 +43,14 @@ public: virtual void* getFieldPtr(size_t fieldId, size_t subField); virtual QString getFieldName(size_t fieldId); - bufsize_t getEntriesAreaSize() { return static_cast(this->getEntriesCount()) * sizeof(pe::IMAGE_RESOURCE_DIRECTORY_ENTRY); } + bufsize_t getEntriesAreaSize() { return static_cast(this->getEntriesCount()) * sizeof(IMAGE_RESOURCE_DIRECTORY_ENTRY); } long getDepth() { return this->dirDepth; } - pe::IMAGE_RESOURCE_DIRECTORY* mainResourceDir(); + IMAGE_RESOURCE_DIRECTORY* mainResourceDir(); ResourcesAlbum* getAlbumPtr() { return album; } private: - pe::IMAGE_RESOURCE_DIRECTORY* resourceDir(); + IMAGE_RESOURCE_DIRECTORY* resourceDir(); offset_t rawOff; long dirDepth; ResourcesAlbum *album; @@ -78,7 +78,7 @@ public: bool wrap(); // full structure boundatries virtual void* getPtr() { return getEntryPtr(); } - virtual bufsize_t getSize() { return sizeof(pe::IMAGE_RESOURCE_DIRECTORY_ENTRY); } + virtual bufsize_t getSize() { return sizeof(IMAGE_RESOURCE_DIRECTORY_ENTRY); } virtual QString getName() { return "Resource entry: "+ translateType(getID());} virtual size_t getFieldsCount() { return FIELD_COUNTER; } @@ -96,10 +96,10 @@ public: DWORD getChildOffsetToDirectory(); //relative offset! offset_t getNameOffset(); - pe::IMAGE_RESOURCE_DIRECTORY_STRING* getNameStr(); + IMAGE_RESOURCE_DIRECTORY_STRING* getNameStr(); offset_t getChildAddress(); - pe::IMAGE_RESOURCE_DIRECTORY_ENTRY *getEntryPtr(); + IMAGE_RESOURCE_DIRECTORY_ENTRY *getEntryPtr(); ResourcesAlbum* getAlbumPtr() { return album; } long getTopEntryID() { return topEntryID; } diff --git a/parser/pe/ResourceLeafWrapper.h b/parser/pe/ResourceLeafWrapper.h index 6ce1c372..2e824439 100644 --- a/parser/pe/ResourceLeafWrapper.h +++ b/parser/pe/ResourceLeafWrapper.h @@ -27,7 +27,7 @@ class ResourceLeafWrapper : public ExeNodeWrapper virtual ~ResourceLeafWrapper() { } virtual void* getPtr() { return leafEntryPtr(); } - virtual bufsize_t getSize() { return sizeof(pe::IMAGE_RESOURCE_DATA_ENTRY); } + virtual bufsize_t getSize() { return sizeof(IMAGE_RESOURCE_DATA_ENTRY); } virtual QString getName() { return "Resource Data"; } virtual size_t getFieldsCount() { return FIELD_COUNTER; } @@ -36,7 +36,7 @@ class ResourceLeafWrapper : public ExeNodeWrapper virtual QString getFieldName(size_t fieldId); virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField) { return (fieldId == OFFSET_TO_DATA) ? Executable::RVA : Executable::NOT_ADDR; } - pe::IMAGE_RESOURCE_DATA_ENTRY *leafEntryPtr(); + IMAGE_RESOURCE_DATA_ENTRY *leafEntryPtr(); Executable* getExe() { return this->m_Exe; } diff --git a/parser/pe/SectHdrsWrapper.cpp b/parser/pe/SectHdrsWrapper.cpp index c5f51b68..afd30d52 100644 --- a/parser/pe/SectHdrsWrapper.cpp +++ b/parser/pe/SectHdrsWrapper.cpp @@ -27,16 +27,16 @@ void* SectionHdrWrapper::getPtr() //if (this->sectNum >= m_PE->hdrSectionsNum()) return NULL; offset_t firstSecOffset = m_PE->secHdrsOffset(); - offset_t secOffset = firstSecOffset + (this->sectNum * sizeof(pe::IMAGE_SECTION_HEADER)); + offset_t secOffset = firstSecOffset + (this->sectNum * sizeof(IMAGE_SECTION_HEADER)); //cache the header: - this->header = (pe::IMAGE_SECTION_HEADER*) m_PE->getContentAt(secOffset, sizeof(pe::IMAGE_SECTION_HEADER)); + this->header = (IMAGE_SECTION_HEADER*) m_PE->getContentAt(secOffset, sizeof(IMAGE_SECTION_HEADER)); return (void*) this->header; } bool SectionHdrWrapper::reloadName() { - pe::IMAGE_SECTION_HEADER* header = (pe::IMAGE_SECTION_HEADER*) getPtr(); + IMAGE_SECTION_HEADER* header = (IMAGE_SECTION_HEADER*) getPtr(); if (!header) return false; if (this->name) { @@ -57,7 +57,7 @@ bool SectionHdrWrapper::reloadName() bufsize_t SectionHdrWrapper::getSize() { if (m_PE == NULL) return 0; - return sizeof(pe::IMAGE_SECTION_HEADER); + return sizeof(IMAGE_SECTION_HEADER); } QString SectionHdrWrapper::getName() @@ -69,7 +69,7 @@ QString SectionHdrWrapper::getName() void* SectionHdrWrapper::getFieldPtr(size_t fieldId, size_t subField) { - pe::IMAGE_SECTION_HEADER* sec = (pe::IMAGE_SECTION_HEADER*) getPtr(); + IMAGE_SECTION_HEADER* sec = (IMAGE_SECTION_HEADER*) getPtr(); if (!sec) return NULL; if (!this->name) return NULL; switch (fieldId) @@ -301,7 +301,7 @@ bool SectHdrsWrapper::loadNextEntry(size_t entryNum) SectionHdrWrapper *sec = new SectionHdrWrapper(this->m_PE, entryNum); if (sec == NULL) return false; if (sec->getPtr() == NULL) { - Logger::append(Logger::WARNING, "Deleting invalid section..."); + Logger::append(Logger::D_WARNING, "Deleting invalid section..."); delete sec; sec = NULL; return false; @@ -384,7 +384,7 @@ bufsize_t SectHdrsWrapper::getSize() offset_t hdrOffset = m_PE->secHdrsOffset(); offset_t fileSize = m_PE->getRawSize(); - offset_t endOffset = hdrOffset + (secCount * sizeof(pe::IMAGE_SECTION_HEADER)); + offset_t endOffset = hdrOffset + (secCount * sizeof(IMAGE_SECTION_HEADER)); if (endOffset > fileSize) { return bufsize_t (fileSize - hdrOffset); diff --git a/parser/pe/SectHdrsWrapper.h b/parser/pe/SectHdrsWrapper.h index a67b3eba..cde538cb 100644 --- a/parser/pe/SectHdrsWrapper.h +++ b/parser/pe/SectHdrsWrapper.h @@ -66,7 +66,7 @@ public: } protected: - SectionHdrWrapper(PEFile *pe, pe::IMAGE_SECTION_HEADER *v_header) //standalone entry + SectionHdrWrapper(PEFile *pe, IMAGE_SECTION_HEADER *v_header) //standalone entry : PENodeWrapper(pe), sectNum(INVALID_ENTRYNUM), name(NULL), header(v_header) { reloadName(); @@ -84,7 +84,7 @@ protected: size_t sectNum; private: - pe::IMAGE_SECTION_HEADER *header; + IMAGE_SECTION_HEADER *header; friend class PEFile; }; diff --git a/parser/pe/SecurityDirWrapper.cpp b/parser/pe/SecurityDirWrapper.cpp index 1fda7e61..9075e2ff 100644 --- a/parser/pe/SecurityDirWrapper.cpp +++ b/parser/pe/SecurityDirWrapper.cpp @@ -1,21 +1,21 @@ #include "SecurityDirWrapper.h" #include "PEFile.h" -pe::WIN_CERTIFICATE* SecurityDirWrapper::getCert() +WIN_CERTIFICATE* SecurityDirWrapper::getCert() { offset_t rva = getDirEntryAddress(); - BYTE *ptr = m_Exe->getContentAt(rva, Executable::RAW, sizeof(pe::WIN_CERTIFICATE)); + BYTE *ptr = m_Exe->getContentAt(rva, Executable::RAW, sizeof(WIN_CERTIFICATE)); if (ptr == NULL) return NULL; - return (pe::WIN_CERTIFICATE*) ptr; + return (WIN_CERTIFICATE*) ptr; } bool SecurityDirWrapper::wrap() { this->sizeOk = false; - pe::WIN_CERTIFICATE* cert = getCert(); + WIN_CERTIFICATE* cert = getCert(); if (cert == NULL) return false; offset_t offset = this->getFieldOffset(SecurityDirWrapper::CERT_CONTENT); @@ -39,10 +39,10 @@ void* SecurityDirWrapper::getPtr() bufsize_t SecurityDirWrapper::getSize() { - pe::WIN_CERTIFICATE* cert = getCert(); + WIN_CERTIFICATE* cert = getCert(); if (cert == NULL) return 0; - bufsize_t fullSize = static_cast(sizeof(pe::WIN_CERTIFICATE)); // TODO: check it + bufsize_t fullSize = static_cast(sizeof(WIN_CERTIFICATE)); // TODO: check it if (this->sizeOk) { fullSize = static_cast(cert->dwLength); } @@ -52,7 +52,7 @@ bufsize_t SecurityDirWrapper::getSize() void* SecurityDirWrapper::getFieldPtr(size_t fId, size_t subField) { - pe::WIN_CERTIFICATE* cert = getCert(); + WIN_CERTIFICATE* cert = getCert(); if (cert == NULL) return 0; switch (fId) { @@ -98,7 +98,7 @@ QString SecurityDirWrapper::translateFieldContent(size_t fieldId) { if (fieldId != TYPE) return ""; - pe::WIN_CERTIFICATE* cert = getCert(); + WIN_CERTIFICATE* cert = getCert(); if (cert == NULL) return ""; return translateType(cert->wCertificateType); diff --git a/parser/pe/SecurityDirWrapper.h b/parser/pe/SecurityDirWrapper.h index 3732970b..fd0a861c 100644 --- a/parser/pe/SecurityDirWrapper.h +++ b/parser/pe/SecurityDirWrapper.h @@ -50,7 +50,7 @@ public: virtual QString translateFieldContent(size_t fieldId); private: - pe::WIN_CERTIFICATE* getCert(); + WIN_CERTIFICATE* getCert(); void clear() {} bool sizeOk; diff --git a/parser/pe/TlsDirWrapper.cpp b/parser/pe/TlsDirWrapper.cpp index 9924f7fc..5c805973 100644 --- a/parser/pe/TlsDirWrapper.cpp +++ b/parser/pe/TlsDirWrapper.cpp @@ -38,9 +38,9 @@ bufsize_t TlsDirWrapper::getSize() { if (getPtr() == NULL) return 0; if (m_Exe->getBitMode() == Executable::BITS_32) { - return sizeof(pe::IMAGE_TLS_DIRECTORY32); + return sizeof(IMAGE_TLS_DIRECTORY32); } - return sizeof(pe::IMAGE_TLS_DIRECTORY64); + return sizeof(IMAGE_TLS_DIRECTORY64); } void* TlsDirWrapper::getTlsDirPtr() @@ -48,9 +48,9 @@ void* TlsDirWrapper::getTlsDirPtr() bufsize_t dirSize = 0; if (m_Exe->getBitMode() == Executable::BITS_32) { - dirSize = sizeof(pe::IMAGE_TLS_DIRECTORY32); + dirSize = sizeof(IMAGE_TLS_DIRECTORY32); } else if (m_Exe->getBitMode() == Executable::BITS_64) { - dirSize = sizeof(pe::IMAGE_TLS_DIRECTORY64); + dirSize = sizeof(IMAGE_TLS_DIRECTORY64); } offset_t rva = getDirEntryAddress(); @@ -58,22 +58,22 @@ void* TlsDirWrapper::getTlsDirPtr() return ptr; } -pe::IMAGE_TLS_DIRECTORY32* TlsDirWrapper::tls32() +IMAGE_TLS_DIRECTORY32* TlsDirWrapper::tls32() { if (m_Exe->getBitMode() != Executable::BITS_32) return NULL; - return (pe::IMAGE_TLS_DIRECTORY32*) getTlsDirPtr(); + return (IMAGE_TLS_DIRECTORY32*) getTlsDirPtr(); } -pe::IMAGE_TLS_DIRECTORY64* TlsDirWrapper::tls64() +IMAGE_TLS_DIRECTORY64* TlsDirWrapper::tls64() { if (m_Exe->getBitMode() != Executable::BITS_64) return NULL; - return (pe::IMAGE_TLS_DIRECTORY64*) getTlsDirPtr(); + return (IMAGE_TLS_DIRECTORY64*) getTlsDirPtr(); } void* TlsDirWrapper::getFieldPtr(size_t fId, size_t subField) { - pe::IMAGE_TLS_DIRECTORY32* t32 = tls32(); - pe::IMAGE_TLS_DIRECTORY64* t64 = tls64(); + IMAGE_TLS_DIRECTORY32* t32 = tls32(); + IMAGE_TLS_DIRECTORY64* t64 = tls64(); if (t32 == NULL && t64 == NULL) return NULL; diff --git a/parser/pe/TlsDirWrapper.h b/parser/pe/TlsDirWrapper.h index 24693395..f2ab3b19 100644 --- a/parser/pe/TlsDirWrapper.h +++ b/parser/pe/TlsDirWrapper.h @@ -41,8 +41,8 @@ private: static size_t EntriesLimit; inline void* getTlsDirPtr(); - pe::IMAGE_TLS_DIRECTORY64* tls64(); - pe::IMAGE_TLS_DIRECTORY32* tls32(); + IMAGE_TLS_DIRECTORY64* tls64(); + IMAGE_TLS_DIRECTORY32* tls32(); }; diff --git a/parser/pe/pe_formats.h b/parser/pe/pe_formats.h index daf8e2ae..d15d5a26 100644 --- a/parser/pe/pe_formats.h +++ b/parser/pe/pe_formats.h @@ -1,16 +1,23 @@ -#ifndef _PE_FORMATS_H_ -#define _PE_FORMATS_H_ +#pragma once #ifndef UNALIGNED #define UNALIGNED #endif #include "../win_hdrs/win_types.h" +#if _MSC_VER +#define USE_WINNT +#include +#include +#endif +/* + * Directory Entries + */ + +#ifndef USE_WINNT //additional : WIN_CERTIFICATE //additional : VS_VERSIONINFO -namespace pe -{ /* * Platform independent definitions @@ -19,17 +26,6 @@ namespace pe * their serialization/deserialization should be handled by memio.h * primitives when required */ -enum signature { - S_LX = 0x584C , - S_W3_WIN386 = 0x3357, - S_W4_VMM32 = 0x3457, - S_OS2 = 0x454E, - S_VXD = 0x454C, - S_NT = 0x00004550, - S_OS2_LE = S_VXD, - S_DOS = 0x5A4D, // MZ - S_DOS2 = 0x4D5A //ZM -}; /* * Platform independent definitions (for gcc, vxd, sys ...) @@ -225,7 +221,6 @@ typedef struct _IMAGE_DATA_DIRECTORY { DWORD Size; } IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY; -#define DIRECTORY_ENTRIES_NUM 16 /* * Optional header format. @@ -320,12 +315,6 @@ typedef struct _IMAGE_OPTIONAL_HEADER64 { IMAGE_DATA_DIRECTORY DataDirectory[DIRECTORY_ENTRIES_NUM]; } IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64; -enum opt_hdr_magic { - OH_NT32 = 0x10b, - OH_NT64 = 0x20b, - OH_ROM = 0x107 -}; - typedef struct _IMAGE_NT_HEADERS64 { DWORD Signature; IMAGE_FILE_HEADER FileHeader; @@ -355,71 +344,6 @@ typedef struct _IMAGE_ROM_HEADERS { ((PE_PIMAGE_NT_HEADERS32)(ntheader))->FileHeader.SizeOfOptionalHeader \ )) -/* - * Subsystem Values - */ - -enum subsystem { - SUB_UNKNOWN = 0, // Unknown subsystem. - SUB_NATIVE = 1, // Image doesn't require a subsystem. - SUB_WINDOWS_GUI = 2, // Image runs in the Windows GUI subsystem. - SUB_WINDOWS_CUI = 3, // Image runs in the Windows character subsystem. - SUB_OS2_CUI = 5, // image runs in the OS/2 character subsystem. - SUB_POSIX_CUI = 7, // image runs in the Posix character subsystem. - SUB_NATIVE_WINDOWS = 8, // image is a native Win9x driver. - SUB_WINDOWS_CE_GUI = 9, // Image runs in the Windows CE subsystem. - SUB_EFI_APPLICATION = 10, // - SUB_EFI_BOOT_SERVICE_DRIVER = 11, // - SUB_EFI_RUNTIME_DRIVER = 12, // - SUB_EFI_ROM = 13, - SUB_XBOX = 14, - SUB_WINDOWS_BOOT_APP = 16 -}; - -/* - * DllCharacteristics Entries - */ -enum dll_charact { - // DLL_PROCESS_INIT 0x0001 // Reserved. - // DLL_PROCESS_TERM 0x0002 // Reserved. - // DLL_THREAD_INIT 0x0004 // Reserved. - // DLL_THREAD_TERM 0x0008 // Reserved. - DLL_DYNAMIC_BASE = 0x0040, // DLL can move. - DLL_FORCE_INTEGRITY = 0x0080, // Code Integrity Image - DLL_NX_COMPAT = 0x0100, // Image is NX compatible - DLL_NO_ISOLATION = 0x0200, // Image understands isolation and doesn't want it - DLL_NO_SEH = 0x0400, // Image does not use SEH. No SE handler may reside in this image - DLL_NO_BIND = 0x0800, // Do not bind this image. - DLL_APPCONTAINER = 0x1000, // AppContainer (W8) - DLL_WDM_DRIVER = 0x2000, // Driver uses WDM model - DLL_GUARD_CF = 0x4000, // Guard CF (W8.1) - DLL_TERMINAL_SERVER_AWARE = 0x8000 - -}; - -/* - * Directory Entries - */ -enum dir_entry { - DIR_EXPORT = 0, // Export Directory - DIR_IMPORT = 1, // Import Directory - DIR_RESOURCE = 2, // Resource Directory - DIR_EXCEPTION = 3, // Exception Directory - DIR_SECURITY = 4, // Security Directory - DIR_BASERELOC = 5, // Base Relocation Table - DIR_DEBUG = 6, // Debug Directory - // IMAGE_DIRECTORY_ENTRY_COPYRIGHT = 7, // (X86 usage) - DIR_ARCHITECTURE = 7, // Architecture Specific Data - DIR_GLOBALPTR = 8, // RVA of GP - DIR_TLS = 9, // TLS Directory - DIR_LOAD_CONFIG = 10, // Load Configuration Directory - DIR_BOUND_IMPORT = 11, // Bound Import Directory in headers - DIR_IAT = 12, // Import Address Table - DIR_DELAY_IMPORT = 13, // Delay Load Import Descriptors - DIR_COM_DESCRIPTOR = 14, // COM Runtime descriptor - DIR_ENTRIES_COUNT // counter - convinience field -}; - /* * Non-COFF Object file header */ @@ -1212,6 +1136,7 @@ typedef struct _IMAGE_THUNK_DATA32 { } u1; } IMAGE_THUNK_DATA32; typedef IMAGE_THUNK_DATA32 * PIMAGE_THUNK_DATA32; +#endif #define ORDINAL_FLAG64 0x8000000000000000ULL #define ORDINAL_FLAG32 0x80000000 @@ -1220,7 +1145,7 @@ typedef IMAGE_THUNK_DATA32 * PIMAGE_THUNK_DATA32; #define SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & ORDINAL_FLAG64) != 0) #define SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & ORDINAL_FLAG32) != 0) - +#ifndef USE_WINNT /* * Thread Local Storage * (reference) @@ -1456,6 +1381,7 @@ typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64{ // if Size > sizeof(IMAGE_LOAD_CONFIG_DIRECTORY64) // IMAGE_LOAD_CONFIG_D64_W81 ldc_W81_part; } IMAGE_LOAD_CONFIG_DIRECTORY64, *PIMAGE_LOAD_CONFIG_DIRECTORY64; +#endif // IMAGE_LOAD_CONFIG_DIRECTORY32 extension for W8.1 : typedef struct _IMAGE_LOAD_CONFIG_D32_W81 { @@ -1475,6 +1401,7 @@ typedef struct _IMAGE_LOAD_CONFIG_D64_W81 { DWORD GuardFlags; } IMAGE_LOAD_CONFIG_D64_W81, *PIMAGE_LOAD_CONFIG_D64_W81; +#ifndef USE_WINNT /* * WIN CE Exception table format * @@ -1543,22 +1470,6 @@ typedef struct _IMAGE_DEBUG_DIRECTORY { DWORD PointerToRawData; } IMAGE_DEBUG_DIRECTORY, *PIMAGE_DEBUG_DIRECTORY; -enum debug_type -{ - DT_UNKNOWN = 0, - DT_COFF = 1, - DT_CODEVIEW = 2, - DT_FPO = 3, - DT_MISC = 4, - DT_EXCEPTION = 5, - DT_FIXUP = 6, - DT_OMAP_TO_SRC = 7, - DT_OMAP_FROM_SRC = 8, - DT_BORLAND = 9, - DT_RESERVED10 = 10, - DT_CLSID = 11 -}; - typedef struct _IMAGE_COFF_SYMBOLS_HEADER { DWORD NumberOfSymbols; @@ -1757,6 +1668,7 @@ typedef enum IMPORT_OBJECT_NAME_TYPE /* additional PE structures - from other headers */ #include "../win_hdrs/pshpack4.h" // 4 byte packing (DWORD alligned) +#endif typedef struct _WIN_CERTIFICATE { DWORD dwLength; @@ -1797,6 +1709,7 @@ typedef struct _IMAGE_DELAY_LOAD64 { ULONGLONG dwTimestamp; } IMAGE_DELAY_LOAD64, *LPIMAGE_DELAY_LOAD64; +#ifndef USE_WINNT // DIR_EXCEPTION -> RUNTIME_FUNCTION -> UNWIND_INFO typedef struct _UNWIND_CODE { @@ -1836,6 +1749,7 @@ ExceptionHandlerAddress: #include "../win_hdrs/poppack.h" // Back to the initial value #include "../win_hdrs/pshpack2.h" // 2 byte packing (WORD alligned) +#endif // IMAGE_BASE_RELOCATION -> Entry: typedef struct _BASE_RELOCATION_ENTRY { @@ -1843,78 +1757,37 @@ typedef struct _BASE_RELOCATION_ENTRY { WORD Type: 4; } BASE_RELOCATION_ENTRY; - +#ifndef USE_WINNT //From winuser.h: #define DIFFERENCE 11 -enum resource_type { - RT_CURSOR = 1, - RT_FONT = 8, - RT_BITMAP = 2, - RT_ICON = 3, - RT_MENU = 4, - RT_DIALOG = 5, - RT_STRING = 6, - RT_FONTDIR = 7, - RT_ACCELERATOR = 9, - RT_RCDATA = 10, - RT_MESSAGETABLE = 11, +#define CREATEPROCESS_MANIFEST_RESOURCE_ID 1 +#define ISOLATIONAWARE_MANIFEST_RESOURCE_ID 2 +#define ISOLATIONAWARE_NOSTATICIMPORT_MANIFEST_RESOURCE_ID 3 - RT_GROUP_CURSOR = (DWORD)RT_CURSOR + DIFFERENCE, - RT_GROUP_ICON = (DWORD)RT_ICON + DIFFERENCE, - RT_VERSION = 16, - RT_DLGINCLUDE = 17, - RT_PLUGPLAY = 19, - RT_VXD = 20, - RT_ANICURSOR = 21, - RT_ANIICON = 22, - RT_HTML = 23, - RT_MANIFEST = 24, - - CREATEPROCESS_MANIFEST_RESOURCE_ID = 1, - ISOLATIONAWARE_MANIFEST_RESOURCE_ID = 2, - ISOLATIONAWARE_NOSTATICIMPORT_MANIFEST_RESOURCE_ID = 3 -}; //#include "../win_hdrs/poppack.h" // Back to the initial value //#include "../win_hdrs/pshpack4.h" // 4 byte packing (DWORD alligned) -typedef struct tagVS_FIXEDFILEINFO { - DWORD signature; - DWORD strucVersion; - DWORD fileVersionMS; - DWORD fileVersionLS; - DWORD productVersionMS; - DWORD productVersionLS; - DWORD fileFlagsMask; - DWORD fileFlags; - DWORD fileOS; - DWORD fileType; - DWORD fileSubtype; - DWORD fileDateMS; - DWORD fileDateLS; +typedef struct tagVS_FIXEDFILEINFO +{ + DWORD dwSignature; /* e.g. 0xfeef04bd */ + DWORD dwStrucVersion; /* e.g. 0x00000042 = "0.42" */ + DWORD dwFileVersionMS; /* e.g. 0x00030075 = "3.75" */ + DWORD dwFileVersionLS; /* e.g. 0x00000031 = "0.31" */ + DWORD dwProductVersionMS; /* e.g. 0x00030010 = "3.10" */ + DWORD dwProductVersionLS; /* e.g. 0x00000031 = "0.31" */ + DWORD dwFileFlagsMask; /* = 0x3F for version "0.42" */ + DWORD dwFileFlags; /* e.g. VFF_DEBUG | VFF_PRERELEASE */ + DWORD dwFileOS; /* e.g. VOS_DOS_WINDOWS16 */ + DWORD dwFileType; /* e.g. VFT_DRIVER */ + DWORD dwFileSubtype; /* e.g. VFT2_DRV_KEYBOARD */ + DWORD dwFileDateMS; /* e.g. 0 */ + DWORD dwFileDateLS; /* e.g. 0 */ } VS_FIXEDFILEINFO; //#include "../win_hdrs/poppack.h" // Back to the initial value //#include "../win_hdrs/pshpack2.h" // 2 byte packing (WORD alligned) -#define INFOTEXT_LEN 17 - -typedef struct version_info { - WORD length; - WORD valueLength; - WORD type; //0 -bin, 1-text - WORD key[INFOTEXT_LEN]; - VS_FIXEDFILEINFO Value; - WORD children; //VS_VERSIONCHILD in array -} VS_VERSIONINFO; - -typedef struct version_child { - WORD wLength; - WORD wValueLength; - WORD wType; - WCHAR szKey[INFOTEXT_LEN]; - WORD subVal; // String or Var, depending on wType -} VS_VERSIONCHILD; typedef struct { WORD wLength; @@ -1965,6 +1838,143 @@ typedef struct { #include "../win_hdrs/poppack.h" // Back to the initial value -}; /* namespace pe */ +#endif //USE_WINNT -#endif /* _PE_FORMATS_H_ */ +namespace pe { + + enum opt_hdr_magic { + OH_NT32 = 0x10b, + OH_NT64 = 0x20b, + OH_ROM = 0x107 + }; + + enum resource_type { + RESTYPE_CURSOR = 1, + RESTYPE_FONT = 8, + RESTYPE_BITMAP = 2, + RESTYPE_ICON = 3, + RESTYPE_MENU = 4, + RESTYPE_DIALOG = 5, + RESTYPE_STRING = 6, + RESTYPE_FONTDIR = 7, + RESTYPE_ACCELERATOR = 9, + RESTYPE_RCDATA = 10, + RESTYPE_MESSAGETABLE = 11, + + RESTYPE_GROUP_CURSOR = (DWORD)RESTYPE_CURSOR + DIFFERENCE, + RESTYPE_GROUP_ICON = (DWORD)RESTYPE_ICON + DIFFERENCE, + RESTYPE_VERSION = 16, + RESTYPE_DLGINCLUDE = 17, + RESTYPE_PLUGPLAY = 19, + RESTYPE_VXD = 20, + RESTYPE_ANICURSOR = 21, + RESTYPE_ANIICON = 22, + RESTYPE_HTML = 23, + RESTYPE_MANIFEST = 24, + }; + + enum dir_entry { + DIR_EXPORT = 0, // Export Directory + DIR_IMPORT = 1, // Import Directory + DIR_RESOURCE = 2, // Resource Directory + DIR_EXCEPTION = 3, // Exception Directory + DIR_SECURITY = 4, // Security Directory + DIR_BASERELOC = 5, // Base Relocation Table + DIR_DEBUG = 6, // Debug Directory// IMAGE_DIRECTORY_ENTRY_COPYRIGHT = 7, // (X86 usage) + DIR_ARCHITECTURE = 7, // Architecture Specific Data + DIR_GLOBALPTR = 8, // RVA of GP + DIR_TLS = 9, // TLS Directory + DIR_LOAD_CONFIG = 10, // Load Configuration Directory + DIR_BOUND_IMPORT = 11, // Bound Import Directory in headers + DIR_IAT = 12, // Import Address Table + DIR_DELAY_IMPORT = 13, // Delay Load Import Descriptors + DIR_COM_DESCRIPTOR = 14, // COM Runtime descriptor + DIR_ENTRIES_COUNT // counter - convinience field + }; + + enum signature { + S_LX = 0x584C, + S_W3_WIN386 = 0x3357, + S_W4_VMM32 = 0x3457, + S_OS2 = 0x454E, + S_VXD = 0x454C, + S_NT = 0x00004550, + S_OS2_LE = S_VXD, + S_DOS = 0x5A4D, // MZ + S_DOS2 = 0x4D5A //ZM + }; + + enum debug_type + { + DT_UNKNOWN = 0, + DT_COFF = 1, + DT_CODEVIEW = 2, + DT_FPO = 3, + DT_MISC = 4, + DT_EXCEPTION = 5, + DT_FIXUP = 6, + DT_OMAP_TO_SRC = 7, + DT_OMAP_FROM_SRC = 8, + DT_BORLAND = 9, + DT_RESERVED10 = 10, + DT_CLSID = 11 + }; + + enum subsystem { + SUB_UNKNOWN = 0, // Unknown subsystem. + SUB_NATIVE = 1, // Image doesn't require a subsystem. + SUB_WINDOWS_GUI = 2, // Image runs in the Windows GUI subsystem. + SUB_WINDOWS_CUI = 3, // Image runs in the Windows character subsystem. + SUB_OS2_CUI = 5, // image runs in the OS/2 character subsystem. + SUB_POSIX_CUI = 7, // image runs in the Posix character subsystem. + SUB_NATIVE_WINDOWS = 8, // image is a native Win9x driver. + SUB_WINDOWS_CE_GUI = 9, // Image runs in the Windows CE subsystem. + SUB_EFI_APPLICATION = 10, // + SUB_EFI_BOOT_SERVICE_DRIVER = 11, // + SUB_EFI_RUNTIME_DRIVER = 12, // + SUB_EFI_ROM = 13, + SUB_XBOX = 14, + SUB_WINDOWS_BOOT_APP = 16 + }; + + /* + * DllCharacteristics Entries + */ + enum dll_charact { + // DLL_PROCESS_INIT 0x0001 // Reserved. + // DLL_PROCESS_TERM 0x0002 // Reserved. + // DLL_THREAD_INIT 0x0004 // Reserved. + // DLL_THREAD_TERM 0x0008 // Reserved. + DLL_DYNAMIC_BASE = 0x0040, // DLL can move. + DLL_FORCE_INTEGRITY = 0x0080, // Code Integrity Image + DLL_NX_COMPAT = 0x0100, // Image is NX compatible + DLL_NO_ISOLATION = 0x0200, // Image understands isolation and doesn't want it + DLL_NO_SEH = 0x0400, // Image does not use SEH. No SE handler may reside in this image + DLL_NO_BIND = 0x0800, // Do not bind this image. + DLL_APPCONTAINER = 0x1000, // AppContainer (W8) + DLL_WDM_DRIVER = 0x2000, // Driver uses WDM model + DLL_GUARD_CF = 0x4000, // Guard CF (W8.1) + DLL_TERMINAL_SERVER_AWARE = 0x8000 + }; + + #define INFOTEXT_LEN 17 + + typedef struct version_info { + WORD length; + WORD valueLength; + WORD type; //0 -bin, 1-text + WORD key[INFOTEXT_LEN]; + VS_FIXEDFILEINFO Value; + WORD children; //VS_VERSIONCHILD in array + } VS_VERSIONINFO; + + typedef struct version_child { + WORD wLength; + WORD wValueLength; + WORD wType; + WCHAR szKey[INFOTEXT_LEN]; + WORD subVal; // String or Var, depending on wType + } VS_VERSIONCHILD; +} + +#define DIRECTORY_ENTRIES_NUM 16 diff --git a/parser/pe/rsrc/ResourceContentFactory.cpp b/parser/pe/rsrc/ResourceContentFactory.cpp index 2337c89b..22628076 100644 --- a/parser/pe/rsrc/ResourceContentFactory.cpp +++ b/parser/pe/rsrc/ResourceContentFactory.cpp @@ -14,16 +14,16 @@ ResourceContentWrapper* ResourceContentFactory::makeResContentWrapper(pe::resour ResourceContentWrapper* cw = NULL; switch (typeId) { - case pe::RT_STRING: + case pe::RESTYPE_STRING: return new ResourceStringsWrapper(pe, leaf); - case pe::RT_VERSION: + case pe::RESTYPE_VERSION: return new ResourceVersionWrapper(pe, leaf); - case pe::RT_MANIFEST: + case pe::RESTYPE_MANIFEST: return new ReourceManifestWrapper(pe, leaf); - case pe::RT_HTML: + case pe::RESTYPE_HTML: return new ReourceHTMLWrapper(pe, leaf); default: diff --git a/parser/pe/rsrc/ResourceContentWrapper.cpp b/parser/pe/rsrc/ResourceContentWrapper.cpp index 03355957..97a1e092 100644 --- a/parser/pe/rsrc/ResourceContentWrapper.cpp +++ b/parser/pe/rsrc/ResourceContentWrapper.cpp @@ -1,32 +1,31 @@ #include "ResourceContentWrapper.h" - using namespace pe; QString ResourceContentWrapper::translateType(pe::resource_type type) { switch (type) { - case RT_CURSOR : return "Cursor"; - case RT_FONT : return "Font"; - case RT_BITMAP : return "Bitmap"; - case RT_ICON : return "Icon"; - case RT_MENU : return "Menu"; - case RT_DIALOG : return "Dialog"; - case RT_STRING : return "Strings"; - case RT_FONTDIR : return "Font Dir."; - case RT_ACCELERATOR : return "Accelerator"; - case RT_RCDATA : return "RC Data"; - case RT_MESSAGETABLE : return "Message Table"; + case RESTYPE_CURSOR : return "Cursor"; + case RESTYPE_FONT : return "Font"; + case RESTYPE_BITMAP : return "Bitmap"; + case RESTYPE_ICON : return "Icon"; + case RESTYPE_MENU : return "Menu"; + case RESTYPE_DIALOG : return "Dialog"; + case RESTYPE_STRING : return "Strings"; + case RESTYPE_FONTDIR : return "Font Dir."; + case RESTYPE_ACCELERATOR : return "Accelerator"; + case RESTYPE_RCDATA : return "RC Data"; + case RESTYPE_MESSAGETABLE : return "Message Table"; - case RT_GROUP_CURSOR : return "Cursors Group"; - case RT_GROUP_ICON : return "Icons Group"; - case RT_VERSION : return "Version"; - case RT_DLGINCLUDE : return "Dialog Include"; - case RT_PLUGPLAY : return "Plug-n-Play"; - case RT_VXD : return "VXD"; - case RT_ANICURSOR : return "Animated Cursor"; - case RT_ANIICON : return "Animated Icon"; - case RT_HTML : return "HTML"; - case RT_MANIFEST : return "Manifest"; + case RESTYPE_GROUP_CURSOR : return "Cursors Group"; + case RESTYPE_GROUP_ICON : return "Icons Group"; + case RESTYPE_VERSION : return "Version"; + case RESTYPE_DLGINCLUDE : return "Dialog Include"; + case RESTYPE_PLUGPLAY : return "Plug-n-Play"; + case RESTYPE_VXD : return "VXD"; + case RESTYPE_ANICURSOR : return "Animated Cursor"; + case RESTYPE_ANIICON : return "Animated Icon"; + case RESTYPE_HTML : return "HTML"; + case RESTYPE_MANIFEST : return "Manifest"; } return "UNKN"; } @@ -37,7 +36,7 @@ void* ResourceContentWrapper::getResContentPtr() { if (myLeaf == NULL) return NULL; - pe::IMAGE_RESOURCE_DATA_ENTRY* entry = this->myLeaf->leafEntryPtr(); + IMAGE_RESOURCE_DATA_ENTRY* entry = this->myLeaf->leafEntryPtr(); if (entry == NULL) return NULL; offset_t dataRva = static_cast(entry->OffsetToData); @@ -58,7 +57,7 @@ bufsize_t ResourceContentWrapper::getResContentSize() printf("[ERR] MyLeaf is NULL\n"); return 0; } - pe::IMAGE_RESOURCE_DATA_ENTRY* entry = this->myLeaf->leafEntryPtr(); + IMAGE_RESOURCE_DATA_ENTRY* entry = this->myLeaf->leafEntryPtr(); if (entry == NULL) { printf("[ERR] Leaf ERR\n"); return 0; @@ -71,7 +70,7 @@ offset_t ResourceContentWrapper::getContentRaw() { if (myLeaf == NULL) return 0; - pe::IMAGE_RESOURCE_DATA_ENTRY* entry = this->myLeaf->leafEntryPtr(); + IMAGE_RESOURCE_DATA_ENTRY* entry = this->myLeaf->leafEntryPtr(); if (entry == NULL) return 0; uint64_t dataRva = entry->OffsetToData; diff --git a/parser/pe/rsrc/ResourceContentWrapper.h b/parser/pe/rsrc/ResourceContentWrapper.h index 416c204d..d15c1185 100644 --- a/parser/pe/rsrc/ResourceContentWrapper.h +++ b/parser/pe/rsrc/ResourceContentWrapper.h @@ -51,7 +51,7 @@ public: protected: ReourceManifestWrapper(Executable *pe, ResourceLeafWrapper* v_leaf) - : ResourceContentWrapper(pe, v_leaf, pe::RT_MANIFEST) {} + : ResourceContentWrapper(pe, v_leaf, pe::RESTYPE_MANIFEST) {} friend class ResourceContentFactory; }; @@ -63,7 +63,7 @@ public: protected: ReourceHTMLWrapper(Executable *pe, ResourceLeafWrapper* v_leaf) - : ResourceContentWrapper(pe, v_leaf, pe::RT_HTML + : ResourceContentWrapper(pe, v_leaf, pe::RESTYPE_HTML ) {} friend class ResourceContentFactory; diff --git a/parser/pe/rsrc/ResourceStringsWrapper.h b/parser/pe/rsrc/ResourceStringsWrapper.h index b98df444..a33592d7 100644 --- a/parser/pe/rsrc/ResourceStringsWrapper.h +++ b/parser/pe/rsrc/ResourceStringsWrapper.h @@ -96,7 +96,7 @@ protected: static size_t EntriesLimit; ResourceStringsWrapper(Executable *pe, ResourceLeafWrapper* v_leaf) - : ResourceContentWrapper(pe, v_leaf, pe::RT_STRING) { wrap(); } + : ResourceContentWrapper(pe, v_leaf, pe::RESTYPE_STRING) { wrap(); } bool wrap(); diff --git a/parser/pe/rsrc/ResourceVersionWrapper.cpp b/parser/pe/rsrc/ResourceVersionWrapper.cpp index df962612..b1b7b7c5 100644 --- a/parser/pe/rsrc/ResourceVersionWrapper.cpp +++ b/parser/pe/rsrc/ResourceVersionWrapper.cpp @@ -1,7 +1,7 @@ #include "ResourceVersionWrapper.h" ResourceVersionWrapper::ResourceVersionWrapper(Executable *pe, ResourceLeafWrapper* v_leaf) - : ResourceContentWrapper(pe, v_leaf, pe::RT_VERSION) + : ResourceContentWrapper(pe, v_leaf, pe::RESTYPE_VERSION) { //TEST /* printf("Version: %s\n", getVersionText().toStdString().c_str()); @@ -86,21 +86,21 @@ void* ResourceVersionWrapper::getFieldPtr(size_t fId, size_t subField) case STRUCT_TYPE: return &(ptr->type); case INFO: return &(ptr->key); - case SIGNATURE: return &(ptr->Value.signature); - case STRUCT_VER: return &(ptr->Value.strucVersion); - case FILE_VER_0: return &(ptr->Value.fileVersionMS); - case FILE_VER_1: return &(ptr->Value.fileVersionLS); + case SIGNATURE: return &(ptr->Value.dwSignature); + case STRUCT_VER: return &(ptr->Value.dwStrucVersion); + case FILE_VER_0: return &(ptr->Value.dwFileVersionMS); + case FILE_VER_1: return &(ptr->Value.dwFileVersionLS); - case PRODUCT_VER_0: return &(ptr->Value.productVersionMS); - case PRODUCT_VER_1: return &(ptr->Value.productVersionLS); + case PRODUCT_VER_0: return &(ptr->Value.dwProductVersionMS); + case PRODUCT_VER_1: return &(ptr->Value.dwProductVersionLS); - case FLAGS_MASK: return &(ptr->Value.fileFlagsMask); - case FLAGS: return &(ptr->Value.fileFlags); - case OS: return &(ptr->Value.fileOS); - case TYPE: return &(ptr->Value.fileType); - case SUBTYPE: return &(ptr->Value.fileSubtype); - case TIMESTAMP_0: return &(ptr->Value.fileDateMS); - case TIMESTAMP_1: return &(ptr->Value.fileDateLS); + case FLAGS_MASK: return &(ptr->Value.dwFileFlagsMask); + case FLAGS: return &(ptr->Value.dwFileFlags); + case OS: return &(ptr->Value.dwFileOS); + case TYPE: return &(ptr->Value.dwFileType); + case SUBTYPE: return &(ptr->Value.dwFileSubtype); + case TIMESTAMP_0: return &(ptr->Value.dwFileDateMS); + case TIMESTAMP_1: return &(ptr->Value.dwFileDateLS); //case PADDING2: return &(ptr->padding2); case CHILDREN: return &(ptr->children); diff --git a/parser/win_hdrs/win_types.h b/parser/win_hdrs/win_types.h index 1fbad1e6..cb9abc40 100644 --- a/parser/win_hdrs/win_types.h +++ b/parser/win_hdrs/win_types.h @@ -1,6 +1,11 @@ +#pragma once +#if _MSC_VER +#define USE_WINNT +#include +#endif #ifndef USE_WINNT -#ifndef __WIN_TYPES__ +#ifndef __WIN_TYPES #define __WIN_TYPES__ /*