#include "PECommander.h" #include "pe/rsrc/ResourceStringsWrapper.h" using namespace std; PEFile* cmd_util::getPEFromContext(CmdContext *ctx) { Executable* exe = cmd_util::getExeFromContext(ctx); PEFile *pe = dynamic_cast(exe); if (!pe) { std::cerr << "It's not a PE file" << std::endl; } return pe; } void cmd_util::printSectionMapping(SectionHdrWrapper *sec, Executable::addr_type aType) { if (sec == NULL) return; offset_t hdrStart = sec->getContentOffset(aType, false); bufsize_t hdrSize = sec->getContentSize(aType, false); offset_t start = sec->getContentOffset(aType, true); bufsize_t size = sec->getContentSize(aType, true); std::string typeStr = cmd_util::addrTypeToStr(aType); printf("[%s]\n",typeStr.c_str()); printf(" ------------[In Hdr]------[Mapped]\n"); printf(" Offset: %10llX \t%10llX\n", static_cast(hdrStart), static_cast(start) ); printf(" Size: %10lX \t%10lX\n", static_cast(hdrSize), static_cast(size) ); printf(" Scope: [%10llX - %10llX], size = %lX\n", static_cast(start), static_cast(start + size), static_cast(size) ); printf(" \n"); } void cmd_util::printResourceTypes(PEFile *pe) { if (pe == NULL || pe->getResourcesAlbum() == NULL) return; ResourcesAlbum *album = pe->getResourcesAlbum(); std::vector types = album->getResourceTypes(); for (size_t i = 0 ; i < types.size(); i++) { pe::resource_type type = types[i]; QString info = ResourceContentWrapper::translateType(type); printf("[%3d]\t%s\n", type, info.toStdString().c_str()); } } void cmd_util::printStrings(PEFile *pe, size_t limit) { ResourcesContainer *allStrings = pe->getResourcesOfType(pe::RESTYPE_STRING); if (allStrings == NULL) return; size_t wrappersCount = allStrings->count(); if (wrappersCount == 0) { printf ("No Strings in Resources!\n"); return; } int limCount = 0; for (size_t i = 0; i < wrappersCount; i++) { ResourceStringsWrapper* wrapper = dynamic_cast(allStrings->getWrapperAt(i)); if (wrapper == NULL) { printf("[ERROR] Null wrapper!\n"); continue; } size_t count = wrapper->getResStringsCount(); for (int i = 0; i < count; i++) { if (limit != 0 && limCount >= limit) return; ResString *resStr = wrapper->getResStringAt(i); if (resStr != NULL) { printf("[%8llX] [%lu] %s\n", static_cast(resStr->offset), static_cast(resStr->getSize()), resStr->getQString().toStdString().c_str() ); limCount++; } } } } void cmd_util::dumpResourcesInfo(PEFile *pe, pe::resource_type type, size_t wrapperId) { ResourcesContainer* wrappers = pe->getResourcesOfType(type); if (wrappers == NULL || wrappers->count() == 0) { printf ("No such resource type\n"); return; } size_t wrappersCount = wrappers->count(); printf ("Found in Resources: %lu, wrappers: %lu\n", static_cast(wrappers->entriesCount()), static_cast(wrappersCount) ); int limCount = 0; std::vector::iterator itr; if (wrapperId >= wrappersCount) return; ResourceContentWrapper* wrapper = wrappers->getWrapperAt(wrapperId); cmd_util::dumpEntryInfo(wrapper); cmd_util::dumpNodeInfo(dynamic_cast(wrapper)); } void cmd_util::listDataDirs(PEFile *pe) { for (size_t i = 0 ; i < pe::DIR_ENTRIES_COUNT; i++) { DataDirEntryWrapper* entry = pe->getDataDirEntry(pe::dir_entry(i)); if (entry == NULL) continue; printf("[%lu] %s\n", static_cast(i), entry->getName().toStdString().c_str() ); } } //------------------------------------------ void PECommander::initCommands() { // this->addCommand("secV", new SectionByAddrCommand(Executable::RVA, "Section by RVA")); this->addCommand("secR", new SectionByAddrCommand(Executable::RAW, "Section by RAW")); this->addCommand("rstrings", new PrintStringsCommand("Print Strings from resources")); this->addCommand("rsl", new PrintWrapperTypesCommand("List Resource Types")); this->addCommand("rs", new WrapperInfoCommand("Resource Info")); this->addCommand("dir_mv", new MoveDataDirEntryCommand("Move DataDirectory")); this->addCommand("secdump", new SectionDumpCommand("Dump chosen Section info")); this->addCommand("secfdump", new SectionDumpCommand("Dump chosen Section Content into a file", true)); }