hasherezade-bearparser/parser/include/bearparser/pe/DebugDirWrapper.h

#pragma once

#include "DataDirEntryWrapper.h"
#include "pe_undoc.h"


class DebugDirWrapper : public DataDirEntryWrapper
{
public:
    DebugDirWrapper(PEFile *pe)
        : DataDirEntryWrapper(pe, pe::DIR_DEBUG) { wrap(); }

    virtual void* getPtr() { return getDebugDir(); }
    
    virtual bufsize_t getSize()
    {
        return getDirEntrySize();
    }
    
    virtual QString getName() { return "Debug"; }
    
    virtual size_t getFieldsCount()
    {
        return entries.size();
    }

    virtual void* getFieldPtr(size_t fieldId, size_t subField) { return getSubfieldPtr(fieldId, subField ); }
    virtual QString getFieldName(size_t fieldId, size_t subField) { return getSubfieldName(fieldId, subField ); }
    virtual QString getFieldName(size_t fieldId) { return getFieldName(fieldId, FIELD_NONE); }
    virtual bufsize_t getFieldSize(size_t fieldId, size_t subField = FIELD_NONE) { return getSubfieldSize(fieldId, subField); }

    // debug dir only
    bool isRepro();
    
protected:
    bool wrap()
    {
        clear();
        if (!getDataDirectory()) {
            return false;
        }
        const size_t LIMIT = (-1);
        size_t cntr = 0;
        for (cntr = 0; cntr < LIMIT; cntr++) {
            if (loadNextEntry(cntr) == false) break;
        }
        return true;
    }

    virtual bool loadNextEntry(size_t cntr);

    IMAGE_DEBUG_DIRECTORY* getDebugDir(size_t index = 0)
    {
        const offset_t rva = getDirEntryAddress();
        if (rva == INVALID_ADDR || rva == 0) {
            return NULL;
        }
        const size_t offset = index * sizeof(IMAGE_DEBUG_DIRECTORY);
        return (IMAGE_DEBUG_DIRECTORY*) m_Exe->getContentAt((rva + offset), Executable::RVA, sizeof(IMAGE_DEBUG_DIRECTORY));
    }

friend class DebugDirEntryWrapper;
};


class DebugDirEntryWrapper : public PENodeWrapper
{
public:

    enum DebugDirFID {
        NONE = FIELD_NONE,
        CHARACTERISTIC,
        TIMESTAMP,
        MAJOR_VER,
        MINOR_VER,
        TYPE,
        DATA_SIZE,
        RAW_DATA_ADDR,
        RAW_DATA_PTR,
        FIELD_COUNTER
    };

    DebugDirEntryWrapper(PEFile *pe, DebugDirWrapper *rootDir, size_t entryNumber)
        : PENodeWrapper(pe, rootDir, entryNumber), dbgRootDir(rootDir)
    {
        wrap();
    }

    ~DebugDirEntryWrapper() { clear(); }

    bool wrap();

    virtual void* getPtr();
    virtual bufsize_t getSize();
    
    virtual QString getName()
    {
        IMAGE_DEBUG_DIRECTORY* d = debugDir();
        if (!d) return "";
        return translateType(d->Type);
    }
    
    virtual size_t getFieldsCount() { return FIELD_COUNTER; }
    virtual size_t getSubFieldsCount() { return 1; }

    virtual void* getFieldPtr(size_t fieldId, size_t subField);
    virtual QString getFieldName(size_t fieldId);
    virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField = FIELD_NONE);

    QString translateType(int type);
    QString translateFieldContent(size_t fieldId);

protected:
    
    IMAGE_DEBUG_DIRECTORY* debugDir()
    {
        if (!dbgRootDir) return NULL;
        return this->dbgRootDir->getDebugDir(this->entryNum);
    }
    
    BYTE* getDebugStruct();
    pe::DEBUG_RSDSI* getRDSI();
    pe::DEBUG_NB10* getNB10();

    DebugDirWrapper* dbgRootDir;

friend class DebugDirCVEntryWrapper;
};


class DebugDirCVEntryWrapper : public ExeNodeWrapper
{
public:
    // fields :
    enum FieldID {
        NONE = FIELD_NONE,
        F_CVDBG_SIGN,
        F_CVDBG_GUID,
        F_CVDBG_AGE,
        F_CVDBG_PDB,
        FIELD_COUNTER
    };

    DebugDirCVEntryWrapper(Executable* pe, DebugDirEntryWrapper *_parentDir)
        : ExeNodeWrapper(pe, _parentDir, 0)
    {
        this->parentDir = _parentDir;
    }

    // full structure boundaries
    virtual void* getPtr();
    virtual bufsize_t getSize();

    virtual QString getName() { return "CodeView Info"; }
    virtual size_t getFieldsCount() { return getPtr() ? FIELD_COUNTER : 0; }
    virtual size_t getSubFieldsCount() { return 1; }

    // specific field boundaries
    virtual void* getFieldPtr(size_t fieldId, size_t subField = FIELD_NONE);
    virtual QString getFieldName(size_t fieldId);
    virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField) { return Executable::NOT_ADDR; }

    QString translateFieldContent(size_t fieldId);

    //this wrapper only:
    QString getGuidString();
    QString getSignature();
private:
    DebugDirEntryWrapper* parentDir;
};