BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
Public Types | Public Member Functions | Static Public Member Functions | Protected Member Functions | Protected Attributes | Friends | List of all members
PEFile Class Reference

#include <PEFile.h>

Collaboration diagram for PEFile:
Collaboration graph
[legend]

Public Types

enum  WRAPPERS {
  WR_NONE = MappedExe::WR_NONE , WR_DOS_HDR = DOSExe::WR_DOS_HDR , WR_RICH_HDR , WR_FILE_HDR ,
  WR_OPTIONAL_HDR , WR_DATADIR , WR_SECTIONS , WR_DIR_ENTRY ,
  WR_DIR_ENTRY_END = WR_DIR_ENTRY + pe::DIR_ENTRIES_COUNT , COUNT_WRAPPERS
}
 
- Public Types inherited from Executable
enum  exe_bits { UNKNOWN = 0 , BITS_16 = 16 , BITS_32 = 32 , BITS_64 = 64 }
 
enum  addr_type { NOT_ADDR = 0 , RAW = 1 , RVA = 2 , VA = 3 }
 
- Public Types inherited from ExeWrappersContainer
enum  WRAPPERS { WR_NONE = size_t(-1) , COUNT_WRAPPERS = 0 }
 

Public Member Functions

 PEFile (AbstractByteBuffer *v_buf)
 
virtual ~PEFile ()
 
virtual void wrap ()
 
virtual offset_t rawToRva (offset_t raw)
 
virtual offset_t rvaToRaw (offset_t rva)
 
virtual bufsize_t getMappedSize (Executable::addr_type aType)
 
virtual bufsize_t getAlignment (Executable::addr_type aType) const
 
virtual offset_t getImageBase ()
 
virtual offset_t getEntryPoint (Executable::addr_type addrType=Executable::RVA)
 
virtual exe_bits getBitMode ()
 
offset_t peFileHdrOffset () const
 
offset_t peNtHdrOffset () const
 
bufsize_t peNtHeadersSize () const
 
offset_t peOptHdrOffset () const
 
offset_t secHdrsOffset () const
 
offset_t secHdrsEndOffset () const
 
bufsize_t hdrsSize ()
 
offset_t getMinSecRVA ()
 
ResourcesAlbumgetResourcesAlbum () const
 
pe::RICH_SIGNATURE * getRichHeaderSign ()
 
pe::RICH_DANS_HEADER * getRichHeaderBgn (pe::RICH_SIGNATURE *sign)
 
IMAGE_DATA_DIRECTORY * getDataDirectory ()
 
offset_t peDataDirOffset ()
 
size_t hdrSectionsNum () const
 
size_t getSectionsCount (bool useMapped=true) const
 
exe_bits getHdrBitMode ()
 
SectionHdrWrappergetSecHdr (size_t index) const
 
SectionHdrWrappergetSecHdrAtOffset (offset_t offset, Executable::addr_type aType, bool recalculate=false, bool verbose=false)
 
size_t getSecIndex (SectionHdrWrapper *sec) const
 
ResourcesContainergetResourcesOfType (pe::resource_type typeId)
 
DataDirEntryWrappergetDataDirEntry (pe::dir_entry eType)
 
BufferViewcreateSectionView (size_t secNum)
 
bool setEntryPoint (offset_t entry, Executable::addr_type aType)
 
bool moveDataDirEntry (pe::dir_entry id, offset_t newOffset, Executable::addr_type addType=Executable::RAW)
 
SectionHdrWrappergetLastSection ()
 
bool canAddNewSection ()
 
SectionHdrWrapperaddNewSection (QString name, bufsize_t size, bufsize_t v_size=0)
 
SectionHdrWrapperextendLastSection (bufsize_t addedSize)
 
bool unbindImports ()
 
ImportDirWrappergetImports ()
 
DelayImpDirWrappergetDelayedImports ()
 
ExportDirWrappergetExports ()
 
virtual size_t getAllEntryPoints (QMap< offset_t, QString > &entrypoints, Executable::addr_type aType=Executable::RVA)
 
offset_t getLastMapped (Executable::addr_type aType)
 
bool hasDirectory (pe::dir_entry dirNum)
 
bufsize_t getFileAlignment () const
 
bufsize_t getSectionAlignment () const
 
BYTE * getSecContent (SectionHdrWrapper *sec)
 
void setImageSize (size_t newSize)
 
SectionHdrWrappergetEntrySection ()
 
bool clearContent (SectionHdrWrapper *sec)
 
bool dumpSection (SectionHdrWrapper *sec, QString fileName)
 
bool canResize (bufsize_t newSize)
 
bool isReproBuild ()
 
- Public Member Functions inherited from MappedExe
virtual void wrap ()
 
virtual bool canResize (bufsize_t newSize)
 
virtual bool resize (bufsize_t newSize)
 
- Public Member Functions inherited from Executable
bool isBit64 ()
 
bool isBit32 ()
 
virtual ~Executable (void)
 
virtual exe_bits getBitMode ()
 
virtual bufsize_t getContentSize ()
 
virtual BYTE * getContent ()
 
virtual offset_t getRawSize () const
 
BYTE * getContentAtPtr (BYTE *ptr, bufsize_t size, bool allowExceptions=false)
 
BYTE * getContentAt (offset_t offset, bufsize_t size, bool allowExceptions=false)
 
virtual BYTE * getContentAt (offset_t offset, Executable::addr_type aType, bufsize_t size, bool allowExceptions=false)
 
virtual bufsize_t getMappedSize (Executable::addr_type aType)=0
 
virtual bufsize_t getAlignment (Executable::addr_type aType) const =0
 
virtual offset_t getImageBase ()=0
 
virtual offset_t getEntryPoint (Executable::addr_type aType=Executable::RVA)=0
 
virtual bufsize_t getImageSize ()
 
virtual size_t getAllEntryPoints (QMap< offset_t, QString > &entrypoints, Executable::addr_type aType=Executable::RVA)
 
virtual bool isValidAddr (offset_t addr, addr_type addrType)
 
virtual bool isValidVA (offset_t va)
 
virtual offset_t convertAddr (offset_t inAddr, Executable::addr_type inType, Executable::addr_type outType)
 
virtual offset_t toRaw (offset_t offset, addr_type addrType, bool allowExceptions=false)
 
Executable::addr_type detectAddrType (offset_t addr, Executable::addr_type hintType)
 
virtual offset_t rawToRva (offset_t raw)=0
 
virtual offset_t rvaToRaw (offset_t rva)=0
 
virtual offset_t VaToRva (offset_t va, bool autodetect=false)
 
virtual offset_t rvaToVa (offset_t rva)
 
virtual offset_t vaToRaw (offset_t va)
 
QString getFileName ()
 
virtual bool resize (bufsize_t newSize)
 
virtual bool isResized ()
 
virtual bool isTruncated ()
 
AbstractByteBuffergetFileBuffer () const
 
bufsize_t getFileSize () const
 
virtual bool dumpFragment (offset_t offset, bufsize_t size, QString fileName)
 
- Public Member Functions inherited from AbstractByteBuffer
 AbstractByteBuffer ()
 
virtual ~AbstractByteBuffer ()
 
virtual bufsize_t getContentSize ()=0
 
virtual BYTE * getContent ()=0
 
virtual bool isTruncated ()
 
virtual bool isResized ()
 
BYTE operator[] (size_t idx)
 
virtual offset_t getOffset (void *ptr, bool allowExceptions=false)
 
virtual BYTE * getContentAt (offset_t offset, bufsize_t size, bool allowExceptions=false)
 
virtual BYTE * getContentAtPtr (BYTE *ptr, bufsize_t size, bool allowExceptions=false)
 
virtual bool setBufferedValue (BYTE *dstPtr, BYTE *srcPtr, bufsize_t srcSize, bufsize_t paddingSize, bool allowExceptions=false)
 
bool setStringValue (offset_t rawOffset, QString newText)
 
QString getStringValue (offset_t rawOffset, bufsize_t len=BUFSIZE_MAX)
 
QString getWStringValue (offset_t rawOffset, bufsize_t len)
 
QString getWAsciiStringValue (offset_t rawOffset, bufsize_t len)
 
bufsize_t getMaxSizeFromOffset (offset_t startOffset)
 
bufsize_t getMaxSizeFromPtr (BYTE *ptr)
 
bool isAreaEmpty (offset_t rawOffset, bufsize_t size)
 
bool fillContent (BYTE filling)
 
bool pasteBuffer (offset_t rawOffset, AbstractByteBuffer *buf, bool allowTrunc)
 
bool containsBlock (offset_t rawOffset, bufsize_t size)
 
bool intersectsBlock (offset_t rawOffset, bufsize_t size)
 
uint64_t getNumValue (offset_t offset, bufsize_t size, bool *isOk)
 
bool setNumValue (offset_t offset, bufsize_t size, uint64_t newVal)
 
bool setTextValue (char *textPtr, std::string newText, size_t fieldLimitLen=0)
 
virtual bool resize (bufsize_t newSize)
 
offset_t substFragmentByFile (offset_t offset, bufsize_t contentSize, QFile &fIn)
 
- Public Member Functions inherited from ExeWrappersContainer
 ExeWrappersContainer ()
 
virtual ~ExeWrappersContainer (void)
 
virtual ExeElementWrappergetWrapper (size_t wrapperId)
 
size_t wrappersCount ()
 
QString getWrapperName (size_t id)
 

Static Public Member Functions

static long computeChecksum (BYTE *buffer, size_t bufferSize, offset_t checksumOffset)
 
- Static Public Member Functions inherited from Executable
static bool isBit64 (Executable *exe)
 
static bool isBit32 (Executable *exe)
 
- Static Public Member Functions inherited from AbstractByteBuffer
static bool isValid (AbstractByteBuffer *buf)
 

Protected Member Functions

BufferView_createSectionView (SectionHdrWrapper *sec)
 
size_t getExportsMap (QMap< offset_t, QString > &entrypoints, Executable::addr_type aType=Executable::RVA)
 
virtual void clearWrappers ()
 
virtual void wrap (AbstractByteBuffer *v_buf)
 
void initDirEntries ()
 
bool setHdrSectionsNum (size_t newNum)
 
bool setVirtualSize (bufsize_t newSize)
 
- Protected Member Functions inherited from MappedExe
 MappedExe (AbstractByteBuffer *v_buf, exe_bits v_bitMode)
 
virtual ~MappedExe (void)
 
virtual void wrap (AbstractByteBuffer *v_buf)=0
 
- Protected Member Functions inherited from Executable
 Executable (AbstractByteBuffer *v_buf, exe_bits v_bitMode)
 
- Protected Member Functions inherited from ExeWrappersContainer
virtual void wrap (AbstractByteBuffer *v_buf)=0
 
void clearWrappers ()
 

Protected Attributes

PECore core
 
DosHdrWrapperdosHdrWrapper
 
FileHdrWrapperfHdr
 
OptHdrWrapperoptHdr
 
SectHdrsWrappersects
 
ResourcesAlbumalbum
 
DataDirEntryWrapperdataDirEntries [pe::DIR_ENTRIES_COUNT]
 
- Protected Attributes inherited from Executable
exe_bits bitMode
 
AbstractByteBufferbuf
 
- Protected Attributes inherited from ExeWrappersContainer
std::map< size_t, ExeElementWrapper * > wrappers
 

Friends

class SectHdrsWrapper
 

Detailed Description

Definition at line 40 of file PEFile.h.

Member Enumeration Documentation

◆ WRAPPERS

Enumerator
WR_NONE 
WR_DOS_HDR 
WR_RICH_HDR 
WR_FILE_HDR 
WR_OPTIONAL_HDR 
WR_DATADIR 
WR_SECTIONS 
WR_DIR_ENTRY 
WR_DIR_ENTRY_END 
COUNT_WRAPPERS 

Definition at line 43 of file PEFile.h.

Constructor & Destructor Documentation

◆ PEFile()

PEFile::PEFile ( AbstractByteBuffer v_buf)

Definition at line 86 of file PEFile.cpp.

Here is the call graph for this function:

◆ ~PEFile()

virtual PEFile::~PEFile ( )
inlinevirtual

Definition at line 59 of file PEFile.h.

Here is the call graph for this function:

Member Function Documentation

◆ _createSectionView()

BufferView * PEFile::_createSectionView ( SectionHdrWrapper sec)
protected

Definition at line 629 of file PEFile.cpp.

Here is the call graph for this function:

◆ addNewSection()

SectionHdrWrapper * PEFile::addNewSection ( QString  name,
bufsize_t  size,
bufsize_t  v_size = 0 
)

Definition at line 459 of file PEFile.cpp.

Here is the call graph for this function:

◆ canAddNewSection()

bool PEFile::canAddNewSection ( )

Definition at line 445 of file PEFile.cpp.

Here is the call graph for this function:

◆ canResize()

bool PEFile::canResize ( bufsize_t  newSize)
inlinevirtual

Reimplemented from MappedExe.

Definition at line 228 of file PEFile.h.

Here is the call graph for this function:

◆ clearContent()

bool PEFile::clearContent ( SectionHdrWrapper sec)
inline

Definition at line 213 of file PEFile.h.

Here is the call graph for this function:

◆ clearWrappers()

void PEFile::clearWrappers ( )
protectedvirtual

Definition at line 95 of file PEFile.cpp.

Here is the call graph for this function:

◆ computeChecksum()

long PEFile::computeChecksum ( BYTE *  buffer,
size_t  bufferSize,
offset_t  checksumOffset 
)
static

Definition at line 45 of file PEFile.cpp.

◆ createSectionView()

BufferView * PEFile::createSectionView ( size_t  secNum)

Definition at line 400 of file PEFile.cpp.

Here is the call graph for this function:

◆ dumpSection()

bool PEFile::dumpSection ( SectionHdrWrapper sec,
QString  fileName 
)

Definition at line 613 of file PEFile.cpp.

Here is the call graph for this function:

◆ extendLastSection()

SectionHdrWrapper * PEFile::extendLastSection ( bufsize_t  addedSize)

Definition at line 558 of file PEFile.cpp.

Here is the call graph for this function:

◆ getAlignment()

virtual bufsize_t PEFile::getAlignment ( Executable::addr_type  aType) const
inlinevirtual

Implements Executable.

Definition at line 70 of file PEFile.h.

Here is the call graph for this function:

◆ getAllEntryPoints()

virtual size_t PEFile::getAllEntryPoints ( QMap< offset_t, QString > &  entrypoints,
Executable::addr_type  aType = Executable::RVA 
)
inlinevirtual

Reimplemented from Executable.

Definition at line 160 of file PEFile.h.

Here is the call graph for this function:

◆ getBitMode()

virtual exe_bits PEFile::getBitMode ( )
inlinevirtual

Reimplemented from Executable.

Definition at line 74 of file PEFile.h.

Here is the call graph for this function:

◆ getDataDirectory()

IMAGE_DATA_DIRECTORY * PEFile::getDataDirectory ( )

Definition at line 249 of file PEFile.cpp.

◆ getDataDirEntry()

DataDirEntryWrapper * PEFile::getDataDirEntry ( pe::dir_entry  eType)

Definition at line 394 of file PEFile.cpp.

◆ getDelayedImports()

DelayImpDirWrapper * PEFile::getDelayedImports ( )
inline

Definition at line 149 of file PEFile.h.

Here is the call graph for this function:

◆ getEntryPoint()

offset_t PEFile::getEntryPoint ( Executable::addr_type  addrType = Executable::RVA)
virtual

Implements Executable.

Definition at line 273 of file PEFile.cpp.

Here is the call graph for this function:

◆ getEntrySection()

SectionHdrWrapper * PEFile::getEntrySection ( )
inline

Definition at line 207 of file PEFile.h.

Here is the call graph for this function:

◆ getExports()

ExportDirWrapper * PEFile::getExports ( )
inline

Definition at line 154 of file PEFile.h.

Here is the call graph for this function:

◆ getExportsMap()

size_t PEFile::getExportsMap ( QMap< offset_t, QString > &  entrypoints,
Executable::addr_type  aType = Executable::RVA 
)
protected

Definition at line 640 of file PEFile.cpp.

Here is the call graph for this function:

◆ getFileAlignment()

bufsize_t PEFile::getFileAlignment ( ) const
inline

Definition at line 179 of file PEFile.h.

Here is the call graph for this function:

◆ getHdrBitMode()

exe_bits PEFile::getHdrBitMode ( )
inline

Definition at line 107 of file PEFile.h.

Here is the call graph for this function:

◆ getImageBase()

virtual offset_t PEFile::getImageBase ( )
inlinevirtual

Implements Executable.

Definition at line 71 of file PEFile.h.

Here is the call graph for this function:

◆ getImports()

ImportDirWrapper * PEFile::getImports ( )
inline

Definition at line 144 of file PEFile.h.

Here is the call graph for this function:

◆ getLastMapped()

offset_t PEFile::getLastMapped ( Executable::addr_type  aType)

Definition at line 514 of file PEFile.cpp.

Here is the call graph for this function:

◆ getLastSection()

SectionHdrWrapper * PEFile::getLastSection ( )

Definition at line 507 of file PEFile.cpp.

Here is the call graph for this function:

◆ getMappedSize()

bufsize_t PEFile::getMappedSize ( Executable::addr_type  aType)
virtual

Implements Executable.

Definition at line 255 of file PEFile.cpp.

Here is the call graph for this function:

◆ getMinSecRVA()

offset_t PEFile::getMinSecRVA ( )

Definition at line 231 of file PEFile.cpp.

Here is the call graph for this function:

◆ getResourcesAlbum()

ResourcesAlbum * PEFile::getResourcesAlbum ( ) const
inline

Definition at line 96 of file PEFile.h.

◆ getResourcesOfType()

ResourcesContainer * PEFile::getResourcesOfType ( pe::resource_type  typeId)
inline

Definition at line 124 of file PEFile.h.

Here is the call graph for this function:

◆ getRichHeaderBgn()

pe::RICH_DANS_HEADER * PEFile::getRichHeaderBgn ( pe::RICH_SIGNATURE *  sign)

Definition at line 174 of file PEFile.cpp.

Here is the call graph for this function:

◆ getRichHeaderSign()

pe::RICH_SIGNATURE * PEFile::getRichHeaderSign ( )

Definition at line 201 of file PEFile.cpp.

Here is the call graph for this function:

◆ getSecContent()

BYTE * PEFile::getSecContent ( SectionHdrWrapper sec)
inline

Definition at line 189 of file PEFile.h.

Here is the call graph for this function:

◆ getSecHdr()

SectionHdrWrapper * PEFile::getSecHdr ( size_t  index) const
inline

Definition at line 109 of file PEFile.h.

Here is the call graph for this function:

◆ getSecHdrAtOffset()

SectionHdrWrapper * PEFile::getSecHdrAtOffset ( offset_t  offset,
Executable::addr_type  aType,
bool  recalculate = false,
bool  verbose = false 
)
inline

Definition at line 114 of file PEFile.h.

Here is the call graph for this function:

◆ getSecIndex()

size_t PEFile::getSecIndex ( SectionHdrWrapper sec) const
inline

Definition at line 119 of file PEFile.h.

Here is the call graph for this function:

◆ getSectionAlignment()

bufsize_t PEFile::getSectionAlignment ( ) const
inline

Definition at line 184 of file PEFile.h.

Here is the call graph for this function:

◆ getSectionsCount()

size_t PEFile::getSectionsCount ( bool  useMapped = true) const

Definition at line 328 of file PEFile.cpp.

Here is the call graph for this function:

◆ hasDirectory()

bool PEFile::hasDirectory ( pe::dir_entry  dirNum)
inline

Definition at line 174 of file PEFile.h.

Here is the call graph for this function:

◆ hdrSectionsNum()

size_t PEFile::hdrSectionsNum ( ) const

Definition at line 297 of file PEFile.cpp.

Here is the call graph for this function:

◆ hdrsSize()

bufsize_t PEFile::hdrsSize ( )
inline

Definition at line 93 of file PEFile.h.

Here is the call graph for this function:

◆ initDirEntries()

void PEFile::initDirEntries ( )
protected

Definition at line 106 of file PEFile.cpp.

◆ isReproBuild()

bool PEFile::isReproBuild ( )
inline

Definition at line 241 of file PEFile.h.

Here is the call graph for this function:

◆ moveDataDirEntry()

bool PEFile::moveDataDirEntry ( pe::dir_entry  id,
offset_t  newOffset,
Executable::addr_type  addType = Executable::RAW 
)

Definition at line 410 of file PEFile.cpp.

Here is the call graph for this function:

◆ peDataDirOffset()

offset_t PEFile::peDataDirOffset ( )

Definition at line 243 of file PEFile.cpp.

Here is the call graph for this function:

◆ peFileHdrOffset()

offset_t PEFile::peFileHdrOffset ( ) const
inline

Definition at line 77 of file PEFile.h.

Here is the call graph for this function:

◆ peNtHdrOffset()

offset_t PEFile::peNtHdrOffset ( ) const
inline

Definition at line 78 of file PEFile.h.

Here is the call graph for this function:

◆ peNtHeadersSize()

bufsize_t PEFile::peNtHeadersSize ( ) const
inline

Definition at line 79 of file PEFile.h.

Here is the call graph for this function:

◆ peOptHdrOffset()

offset_t PEFile::peOptHdrOffset ( ) const
inline

Definition at line 80 of file PEFile.h.

Here is the call graph for this function:

◆ rawToRva()

offset_t PEFile::rawToRva ( offset_t  raw)
virtual

Implements Executable.

Definition at line 336 of file PEFile.cpp.

Here is the call graph for this function:

◆ rvaToRaw()

offset_t PEFile::rvaToRaw ( offset_t  rva)
virtual

Implements Executable.

Definition at line 363 of file PEFile.cpp.

Here is the call graph for this function:

◆ secHdrsEndOffset()

offset_t PEFile::secHdrsEndOffset ( ) const
inline

Definition at line 83 of file PEFile.h.

Here is the call graph for this function:

◆ secHdrsOffset()

offset_t PEFile::secHdrsOffset ( ) const
inline

Definition at line 81 of file PEFile.h.

Here is the call graph for this function:

◆ setEntryPoint()

bool PEFile::setEntryPoint ( offset_t  entry,
Executable::addr_type  aType 
)

Definition at line 288 of file PEFile.cpp.

Here is the call graph for this function:

◆ setHdrSectionsNum()

bool PEFile::setHdrSectionsNum ( size_t  newNum)
protected

Definition at line 306 of file PEFile.cpp.

Here is the call graph for this function:

◆ setImageSize()

void PEFile::setImageSize ( size_t  newSize)
inline

Definition at line 202 of file PEFile.h.

Here is the call graph for this function:

◆ setVirtualSize()

bool PEFile::setVirtualSize ( bufsize_t  newSize)
protected

Definition at line 317 of file PEFile.cpp.

Here is the call graph for this function:

◆ unbindImports()

bool PEFile::unbindImports ( )

Definition at line 594 of file PEFile.cpp.

Here is the call graph for this function:

◆ wrap() [1/2]

void PEFile::wrap ( )
virtual

Reimplemented from MappedExe.

Definition at line 113 of file PEFile.cpp.

Here is the call graph for this function:

◆ wrap() [2/2]

void PEFile::wrap ( AbstractByteBuffer v_buf)
protectedvirtual

Implements MappedExe.

Definition at line 118 of file PEFile.cpp.

Here is the call graph for this function:

Friends And Related Function Documentation

◆ SectHdrsWrapper

friend class SectHdrsWrapper
friend

Definition at line 274 of file PEFile.h.

Member Data Documentation

◆ album

ResourcesAlbum* PEFile::album
protected

Definition at line 271 of file PEFile.h.

◆ core

PECore PEFile::core
protected

Definition at line 259 of file PEFile.h.

◆ dataDirEntries

DataDirEntryWrapper* PEFile::dataDirEntries[pe::DIR_ENTRIES_COUNT]
protected

Definition at line 272 of file PEFile.h.

◆ dosHdrWrapper

DosHdrWrapper* PEFile::dosHdrWrapper
protected

Definition at line 265 of file PEFile.h.

◆ fHdr

FileHdrWrapper* PEFile::fHdr
protected

Definition at line 267 of file PEFile.h.

◆ optHdr

OptHdrWrapper* PEFile::optHdr
protected

Definition at line 268 of file PEFile.h.

◆ sects

SectHdrsWrapper* PEFile::sects
protected

Definition at line 269 of file PEFile.h.


The documentation for this class was generated from the following files: