BearParser
Portable Executable parsing library (from PE-bear)
ResourceVersionWrapper.cpp
Go to the documentation of this file.
2 
4  : ResourceContentWrapper(pe, v_leaf, pe::RESTYPE_VERSION)
5 {
6 //TEST
7 /* printf("Version: %s\n", getVersionText().toStdString().c_str());
8 
9  pe::version_info *info = getVersionInfo();
10  if (info == NULL) return;
11 
12  if (info->children == 0) {
13  printf("No children!");
14  return;
15  }
16  BYTE *childEntry = (BYTE*) &info->children;
17  pe::version_child* child = (pe::version_child*) m_Exe->getContentAtPtr(childEntry, sizeof(pe::version_child));
18  if (child == NULL) {
19  printf("[ERR] Cannot fetch a child\n");
20  } else {
21  printf("Got child of type: [%d]\n", child->wType);
22  printf("len = %x\nValLen = %x\ntype = %x\nkey[0] = %c\n", child->wLength, child->wValueLength, child->wType, child->szKey[0]);
23 
24  int size = INFOTEXT_LEN;
25  WORD *content = (WORD*) child->szKey;
26  if (content == NULL) return;
27 
28  QString str = QString::fromUtf16(content, size);
29  std::string verStr = str.toStdString();
30  printf("key = [%s] len = %d\n", verStr.c_str(), verStr.length());
31  }
32  */
34 }
35 
37 {
38  void *ptr = this->getResContentPtr();
39  if (ptr == NULL) return NULL;
40 
41  size_t size = this->getResContentSize();
42  if (size < sizeof(pe::version_info)) return NULL;
43 
44  pe::version_info* info = (pe::version_info*) ptr;
45  return info;
46 }
47 
49 {
50  switch (fId) {
51  case STRUCT_LEN: return "Length of Structure";
52  case VAL_LEN: return "Length of Value";
53  case STRUCT_TYPE: return "Type of Structure";
54  case INFO: return "Info";
55  //case PADDING1: return "Padding1";
56  case SIGNATURE: return "Signature";
57  case STRUCT_VER: return "Struct. Version";
58 
59  case FILE_VER_0:
60  case FILE_VER_1: return "File Version";
61 
62  case PRODUCT_VER_0:
63  case PRODUCT_VER_1: return "Product Version";
64 
65  case FLAGS_MASK: return "File Flags mask";
66  case FLAGS: return "Flags";
67  case OS: return "File OS";
68  case TYPE: return "File Type";
69  case SUBTYPE: return "File SubType";
70  case TIMESTAMP_0: case TIMESTAMP_1: return "File Timestamp";
71  //case PADDING2: return "Padding2";
72  case CHILDREN: return "Children";
73  }
74  return "";
75 }
76 
77 void* ResourceVersionWrapper::getFieldPtr(size_t fId, size_t subField)
78 {
79  pe::version_info* ptr = getVersionInfo();
80 
81  if (ptr == NULL) return NULL;
82 
83  switch (fId) {
84  case STRUCT_LEN: return &(ptr->length);
85  case VAL_LEN: return &(ptr->valueLength);
86  case STRUCT_TYPE: return &(ptr->type);
87  case INFO: return &(ptr->key);
88 
89  case SIGNATURE: return &(ptr->Value.dwSignature);
90  case STRUCT_VER: return &(ptr->Value.dwStrucVersion);
91  case FILE_VER_0: return &(ptr->Value.dwFileVersionMS);
92  case FILE_VER_1: return &(ptr->Value.dwFileVersionLS);
93 
94  case PRODUCT_VER_0: return &(ptr->Value.dwProductVersionMS);
95  case PRODUCT_VER_1: return &(ptr->Value.dwProductVersionLS);
96 
97  case FLAGS_MASK: return &(ptr->Value.dwFileFlagsMask);
98  case FLAGS: return &(ptr->Value.dwFileFlags);
99  case OS: return &(ptr->Value.dwFileOS);
100  case TYPE: return &(ptr->Value.dwFileType);
101  case SUBTYPE: return &(ptr->Value.dwFileSubtype);
102  case TIMESTAMP_0: return &(ptr->Value.dwFileDateMS);
103  case TIMESTAMP_1: return &(ptr->Value.dwFileDateLS);
104 
105  //case PADDING2: return &(ptr->padding2);
106  case CHILDREN: return &(ptr->children);
107  }
108  return ptr;
109 }
110 
112 {
113  if (fieldId == INFO) {
114  return WrappedValue::WSTRING;
115  }
116  return WrappedValue::INT;
117 }
virtual WrappedValue::data_type containsDataType(size_t fieldId, size_t subField=FIELD_NONE)
ResourceVersionWrapper(Executable *pe, ResourceLeafWrapper *v_leaf)
virtual void * getFieldPtr(size_t fieldId, size_t subField)
virtual QString getFieldName(size_t fieldId)
pe::version_info * getVersionInfo()