#pragma once #include "DataDirEntryWrapper.h" class ExportDirWrapper : public DataDirEntryWrapper { public: enum ExportDirFID { NONE = FIELD_NONE, CHARACTERISTIC, TIMESTAMP, MAJOR_VER, MINOR_VER, NAME_RVA, BASE, FUNCTIONS_NUM, NAMES_NUM, FUNCTIONS_RVA, FUNC_NAMES_RVA, NAMES_ORDINALS_RVA, FIELD_COUNTER }; ExportDirWrapper(PEFile *pe) : DataDirEntryWrapper(pe, pe::DIR_EXPORT) { wrap(); } bool wrap(); virtual void* getPtr() { return exportDir(); } virtual bufsize_t getSize(); virtual QString getName(); virtual size_t getFieldsCount() { return FIELD_COUNTER; } virtual size_t getSubFieldsCount() { return 1; } virtual void* getFieldPtr(size_t fieldId, size_t subField); virtual QString getFieldName(size_t fieldId); virtual QString getLibraryName(); virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField = FIELD_NONE); protected: char* _getLibraryName(); void clear(); size_t mapNames(); IMAGE_EXPORT_DIRECTORY* exportDir(); std::map ordToNameId; friend class ExportEntryWrapper; }; class ExportEntryWrapper : public ExeNodeWrapper { public: // fields : enum FieldID { NONE = FIELD_NONE, FUNCTION_RVA, NAME_RVA, FIELD_COUNTER }; ExportEntryWrapper(Executable *pe, ExportDirWrapper *parentDir, size_t entryNumber) : ExeNodeWrapper(pe, parentDir, entryNumber) { this->parentDir = parentDir; } // full structure boundaries virtual void* getPtr() { return getFuncRvaPtr(); } virtual bufsize_t getSize(); virtual QString getName(); virtual size_t getFieldsCount() { return FIELD_COUNTER; } virtual size_t getSubFieldsCount() { return 1; } // specific field boundaries virtual void* getFieldPtr(size_t fieldId, size_t subField = FIELD_NONE);// { return getPtr(); } virtual bufsize_t getFieldSize(size_t fieldId, size_t subField = FIELD_NONE) { return sizeof(DWORD); } virtual QString getFieldName(size_t fieldId); virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField) { return Executable::RVA; } bool isByOrdinal(); uint32_t getOrdinal(); offset_t getFuncRva(); offset_t getFuncNameRva(); char* getFuncName(); QString getuncNameStr() { char* name = getFuncName(); return name ? name : ""; } char* getForwarder(); // NULL if not forwarded QString getForwarderStr() { char* forwarder = getForwarder(); return forwarder ? forwarder : ""; } private: DWORD* getFuncRvaPtr(); uint32_t getFuncNameId(); void* getFuncNameRvaPtr(); ExportDirWrapper* parentDir; };