BearParser
Portable Executable parsing library (from PE-bear)
ExeElementWrapper.cpp
Go to the documentation of this file.
1 #include "ExeElementWrapper.h"
2 
4 {
5  if (v_exe == NULL) {
6  Logger::append(Logger::D_ERROR, "Cannot initialize with Exe == NULL!");
7  throw CustomException("Cannot initialize with Exe == NULL!");
8  }
9  this->m_Exe = v_exe;
10 }
11 
12 bufsize_t ExeElementWrapper::getFieldSize(size_t fieldId, size_t subField)
13 {
14  size_t fieldsCount = getFieldsCount();
15  if (fieldId >= fieldsCount) return this->getSize();
16 
17  void *ptr = this->getFieldPtr(fieldId, subField);
18  if (ptr == NULL) return 0;
19 
20  void *nextPtr = NULL;
21  size_t nextFID = fieldId + 1;
22 
23  if (nextFID < fieldsCount ) nextPtr = this->getFieldPtr(nextFID, subField);
24  if (nextPtr != NULL) {
25  int64_t dif = offset_t (nextPtr) - offset_t (ptr);
26  if (dif < 0) return 0;
27 
28  return (bufsize_t) dif;
29  }
30 
31  offset_t fullSize = this->getSize();
32  BYTE *bgnPtr = (BYTE*) getPtr();
33  BYTE *endPtr = bgnPtr + fullSize;
34  offset_t dif = offset_t (endPtr) - offset_t (ptr);
35 
36  return (bufsize_t) dif;
37 }
38 
40 {
41  BYTE *ptr = (BYTE*)this->getPtr();
42  return getOffset(ptr);
43 }
44 
46 {
47  if (!m_Exe) return INVALID_ADDR;
48  return m_Exe->getOffset(ptr);
49 }
50 
51 offset_t ExeElementWrapper::getFieldOffset(size_t fieldId, size_t subField)
52 {
53  void* ptr = getFieldPtr(fieldId, subField);
54  return getOffset(ptr);
55 }
56 
57 WrappedValue ExeElementWrapper::getWrappedValue(size_t fieldId, size_t subFieldId)
58 {
59  if (fieldId == -1) return WrappedValue(); //EMPTY
60  void* ptr = getFieldPtr(fieldId, subFieldId);
61  if (ptr == NULL) return WrappedValue(); //EMPTY
62 
63  bufsize_t fieldSize = getFieldSize(fieldId, subFieldId);
64  if (fieldSize == BUFSIZE_MAX || fieldSize == 0) return WrappedValue(); //EMPTY
65 
66  offset_t offset = this->getOffset(ptr);
67  if (offset == INVALID_ADDR) return WrappedValue(); //EMPTY
68 
69  WrappedValue::data_type dataType = this->containsDataType(fieldId, subFieldId);
70  return WrappedValue(this->m_Exe, offset, fieldSize, dataType);
71 }
72 
73 uint64_t ExeElementWrapper::getNumValue(size_t fId, size_t subField, bool* isOk)
74 {
75  if (isOk) (*isOk) = false;
76  if (this->m_Exe == NULL) return (-1);
77 
78  offset_t offset = this->getFieldOffset(fId, subField);
79  bufsize_t size = this->getFieldSize(fId, subField);
80  return this->m_Exe->getNumValue(offset, size, isOk);
81 }
82 
83 bool ExeElementWrapper::setNumValue(size_t fId, size_t subField, uint64_t newVal)
84 {
85  if (this->m_Exe == NULL) return false;
86 
87  offset_t offset = this->getFieldOffset(fId, subField);
88  bufsize_t size = this->getFieldSize(fId, subField);
89  return this->m_Exe->setNumValue(offset, size, newVal);
90 }
91 
93 {
94  if (this->m_Exe == NULL) return false;
95 
96  if (this->m_Exe->isAreaEmpty(rawOffset, getSize()) == false) {
97  return false;
98  }
99  return true;
100 }
101 
103 {
104  if (this->m_Exe == NULL) return false;
105 
106  if (canCopyToOffset(rawOffset) == false) {
107  Logger::append(Logger::D_ERROR,"The area is not empty!");
108  return false;
109  }
110  if (m_Exe->pasteBuffer(rawOffset, this, false) == false) {
111  Logger::append(Logger::D_ERROR,"Cannot paste the buffer!");
112  return false;
113  }
114  return true;
115 }
const bufsize_t BUFSIZE_MAX
uint32_t bufsize_t
const offset_t INVALID_ADDR
uint64_t offset_t
bool setNumValue(offset_t offset, bufsize_t size, uint64_t newVal)
bool pasteBuffer(offset_t rawOffset, AbstractByteBuffer *buf, bool allowTrunc)
uint64_t getNumValue(offset_t offset, bufsize_t size, bool *isOk)
bool isAreaEmpty(offset_t rawOffset, bufsize_t size)
virtual offset_t getOffset(void *ptr, bool allowExceptions=false)
virtual bufsize_t getSize()=0
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField=FIELD_NONE)
virtual bool setNumValue(size_t fieldId, size_t subField, uint64_t val)
virtual bool canCopyToOffset(offset_t rawOffset)
virtual void * getFieldPtr(size_t fieldId, size_t subField)=0
virtual offset_t getFieldOffset(size_t fieldId, size_t subField=FIELD_NONE)
virtual size_t getFieldsCount()=0
virtual void * getPtr()=0
virtual WrappedValue getWrappedValue(size_t fieldId, size_t subField)
ExeElementWrapper(Executable *exe)
virtual WrappedValue::data_type containsDataType(size_t fieldId, size_t subField=FIELD_NONE)
bool copyToOffset(offset_t rawOffset)
virtual uint64_t getNumValue(size_t fieldId, size_t subField, bool *isOk)
bool append(dbg_level lvl, const char *format,...)
Definition: Util.cpp:8
@ D_ERROR
Definition: Util.h:26