#include "DebugDirWrapper.h" #include "PEFile.h" using namespace pe; /* typedef struct _IMAGE_DEBUG_DIRECTORY { DWORD Characteristics; DWORD TimeDateStamp; WORD MajorVersion; WORD MinorVersion; DWORD Type; DWORD SizeOfData; DWORD AddressOfRawData; DWORD PointerToRawData; } IMAGE_DEBUG_DIRECTORY, *PIMAGE_DEBUG_DIRECTORY; */ IMAGE_DEBUG_DIRECTORY* DebugDirWrapper::debugDir() { offset_t rva = getDirEntryAddress(); BYTE *ptr = m_Exe->getContentAt(rva, Executable::RVA, sizeof(IMAGE_DEBUG_DIRECTORY)); if (ptr == NULL) return NULL; return (IMAGE_DEBUG_DIRECTORY*) ptr; } bool DebugDirWrapper::wrap() { return true; } void* DebugDirWrapper::getPtr() { return debugDir(); } bufsize_t DebugDirWrapper::getSize() { if (getPtr() == NULL) return 0; return sizeof(IMAGE_DEBUG_DIRECTORY); } QString DebugDirWrapper::getName() { return "Debug"; } void* DebugDirWrapper::getFieldPtr(size_t fId, size_t subField) { IMAGE_DEBUG_DIRECTORY* d = debugDir(); if (d == NULL) return NULL; switch (fId) { case CHARACTERISTIC: return &d->Characteristics; case TIMESTAMP: return &d->TimeDateStamp; case MAJOR_VER: return &d->MajorVersion; case MINOR_VER: return &d->MinorVersion; case TYPE: return &d->Type; case DATA_SIZE: return &d->SizeOfData; case RAW_DATA_ADDR: return &d->AddressOfRawData; case RAW_DATA_PTR: return &d->PointerToRawData; } return this->getPtr(); } QString DebugDirWrapper::getFieldName(size_t fieldId) { switch (fieldId) { case CHARACTERISTIC: return "Characteristics"; case TIMESTAMP: return "TimeDateStamp"; case MAJOR_VER: return "MajorVersion"; case MINOR_VER: return "MinorVersion"; case TYPE: return "Type"; case DATA_SIZE: return "SizeOfData"; case RAW_DATA_ADDR: return "AddressOfRawData"; case RAW_DATA_PTR: return "PointerToRawData"; } return getName(); } Executable::addr_type DebugDirWrapper::containsAddrType(size_t fieldId, size_t subField) { switch (fieldId) { case RAW_DATA_ADDR: return Executable::RVA; case RAW_DATA_PTR: return Executable::RAW; } return Executable::NOT_ADDR; } QString DebugDirWrapper::translateType(int type) { switch (type) { case DT_UNKNOWN : return "unknown"; case DT_COFF : return "COFF"; case DT_CODEVIEW : return "Visual C++"; case DT_FPO : return "frame pointer omission"; case DT_MISC : return "DBG file"; case DT_EXCEPTION : return "A copy of .pdata section"; case DT_FIXUP : return "Reserved"; case DT_OMAP_TO_SRC : return "mapping from an RVA in image to an RVA in source image"; case DT_OMAP_FROM_SRC : return "mapping from an RVA in source image to an RVA in image"; case DT_BORLAND : return "Borland"; case DT_RESERVED10 : return "Reserved"; case DT_CLSID : return "CLSID"; } return ""; } QString DebugDirWrapper::translateFieldContent(size_t fieldId) { if (fieldId != TYPE) return ""; IMAGE_DEBUG_DIRECTORY* d = debugDir(); if (d == NULL) return NULL; return translateType(d->Type); }