BearParser
Portable Executable parsing library (from PE-bear)
ExeNodeWrapper.cpp
Go to the documentation of this file.
1 #include "ExeNodeWrapper.h"
2 
4  : ExeElementWrapper(exec), parentNode(parent), entryNum(0)
5 {
6  wrap();
7 }
8 
9 ExeNodeWrapper::ExeNodeWrapper(Executable *exec, ExeNodeWrapper* parent, size_t entryNumber)
10  : ExeElementWrapper(exec), parentNode(parent), entryNum(entryNumber)
11 {
12  wrap();
13 }
14 
16 {
17  return this->getEntryAt(this->entries, fieldId);
18 }
19 
20 ExeNodeWrapper* ExeNodeWrapper::getEntryAt(std::vector<ExeNodeWrapper*> &_entries, size_t fieldId)
21 {
22  return (fieldId < _entries.size()) ? _entries[fieldId] : NULL;
23 }
24 
25 size_t ExeNodeWrapper::getEntriesCount(std::vector<ExeNodeWrapper*> &_entries)
26 {
27  return _entries.size();
28 }
29 
31 {
32  size_t entriesCount = this->entries.size();
33  for (size_t i = 0; i < entriesCount; i++) {
34  delete this->entries[i];
35  }
36  this->entries.clear();
37 }
38 
39 void* ExeNodeWrapper::getSubfieldPtr(size_t fieldId, size_t subField)
40 {
41  ExeNodeWrapper* entry = this->getEntryAt(fieldId);
42  if (!entry) return NULL;
43  //---
44  return entry->getFieldPtr(subField);
45 }
46 
47 bufsize_t ExeNodeWrapper::getSubfieldSize(size_t fieldId, size_t subField)
48 {
49  ExeNodeWrapper* entry = this->getEntryAt(fieldId);
50  if (!entry) return 0;
51  //---
52  return entry->getFieldSize(subField);
53 }
54 
55 QString ExeNodeWrapper::getSubfieldName(size_t fieldId, size_t subField)
56 {
57  ExeNodeWrapper* entry = this->getEntryAt(fieldId);
58  if (!entry) return "";
59  //---
60  return entry->getFieldName(subField);
61 }
62 
64 {
65  offset_t nextOffset = getNextEntryOffset();
66  bufsize_t entrySize = geEntrySize();
67  if (entrySize == 0) return false;
68 
69  bufsize_t paddedSize = entrySize * 2;
70  bool haveSpace = this->m_Exe->isAreaEmpty(nextOffset, paddedSize);
72  "NextOffset = %llX size = %lX, canAdd: %u",
73  static_cast<unsigned long long>(nextOffset),
74  static_cast<unsigned long>(entrySize),
75  static_cast<unsigned int>(haveSpace)
76  );
77  return haveSpace;
78 }
79 
81 {
82  if (!entry) return false;
83  return true; //type cast check in inherited wrappers
84 }
85 
87 {
88  size_t lastId = this->getEntriesCount() - 1;
89  return this->getEntryAt(lastId);
90 }
91 
93 {
94  ExeNodeWrapper *lastEntry = getLastEntry();
95  if (lastEntry == NULL) return INVALID_ADDR;
96 
97  offset_t lastOffset = lastEntry->getOffset();
98  if (lastOffset == INVALID_ADDR) return INVALID_ADDR;
99 
100  bufsize_t entrySize = lastEntry->getSize();
101  offset_t nextOffset = lastOffset + entrySize;
102  return nextOffset;
103 }
104 
106 {
107  ExeNodeWrapper *lastEntry = getLastEntry();
108  if (lastEntry == NULL) return 0;
109 
110  bufsize_t entrySize = lastEntry->getSize();
111  return entrySize;
112 }
113 
115 {
116  if (canAddEntry() == false) return NULL;
117 
118  size_t entryNum = this->getEntriesCount();
119 
120  if (nextOffset == INVALID_ADDR) return NULL;
121  if (entry == NULL) {
122  // if no entry supplied, duplicate the last entry...
123  entry = this->getLastEntry();
124  }
125 
126  if (isMyEntryType(entry) == false) return NULL;
127 // if (entrySize != entry->getSize()) return NULL;
128  if (m_Exe->pasteBuffer(nextOffset, entry, false) == false) {
129  return NULL;
130  }
131  if (loadNextEntry(entryNum) == false) return NULL;
132  reloadMapping();
134  "Entries count: %lu",
135  static_cast<unsigned long>(this->getEntriesCount())
136  );
137  return getLastEntry();
138 }
139 
141 {
142  offset_t offset = getNextEntryOffset();
143  return addEntryAt(entry, offset);
144 }
145 
uint32_t bufsize_t
const offset_t INVALID_ADDR
uint64_t offset_t
bool pasteBuffer(offset_t rawOffset, AbstractByteBuffer *buf, bool allowTrunc)
bool isAreaEmpty(offset_t rawOffset, bufsize_t size)
virtual bufsize_t getSize()=0
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField=FIELD_NONE)
virtual void * getFieldPtr(size_t fieldId, size_t subField)=0
virtual QString getFieldName(size_t fieldId)=0
virtual bool isMyEntryType(ExeNodeWrapper *entry)
virtual void * getSubfieldPtr(size_t fieldId, size_t subField)
virtual ExeNodeWrapper * addEntryAt(ExeNodeWrapper *entry, offset_t nextOffset)
ExeNodeWrapper * getLastEntry()
virtual QString getSubfieldName(size_t fieldId, size_t subField)
virtual bool wrap()
ExeNodeWrapper(Executable *pe, ExeNodeWrapper *parent=NULL)
virtual void reloadMapping()
virtual ExeNodeWrapper * getEntryAt(size_t fieldId)
virtual bufsize_t geEntrySize()
std::vector< ExeNodeWrapper * > entries
virtual bool loadNextEntry(size_t entryNum)
virtual bool canAddEntry()
virtual offset_t getNextEntryOffset()
virtual size_t getEntriesCount()
virtual void clear()
virtual bufsize_t getSubfieldSize(size_t fieldId, size_t subField)
virtual ExeNodeWrapper * addEntry(ExeNodeWrapper *entry)
bool append(dbg_level lvl, const char *format,...)
Definition: Util.cpp:8
@ D_INFO
Definition: Util.h:26