mirror of
https://github.com/hasherezade/bearparser
synced 2026-06-08 14:32:38 +00:00
122 lines
3.4 KiB
C++
122 lines
3.4 KiB
C++
#pragma once
|
|
|
|
#include "DataDirEntryWrapper.h"
|
|
#include "../Util.h"
|
|
|
|
class ImportBaseDirWrapper;
|
|
class ImportBaseEntryWrapper;
|
|
class ImportBaseFuncWrapper;
|
|
|
|
namespace imports_util {
|
|
// inline uint64_t getUpperLimit(Executable *pe, void* fieldPtr);
|
|
inline bool isNameValid(Executable *pe, char* myName);
|
|
};
|
|
|
|
class ImportBaseDirWrapper : public DataDirEntryWrapper
|
|
{
|
|
public:
|
|
static bufsize_t thunkSize(Executable::exe_bits bits);
|
|
|
|
virtual bool wrap();
|
|
virtual bool isValid();
|
|
|
|
virtual void clearMapping();
|
|
virtual void reloadMapping();
|
|
virtual size_t getFieldsCount() { return this->importsCount; }
|
|
|
|
virtual void* getFieldPtr(size_t fieldId, size_t subField) { return getSubfieldPtr(fieldId, subField ); }
|
|
virtual QString getFieldName(size_t fieldId, size_t subField) { return getSubfieldName(fieldId, subField ); }
|
|
virtual QString getFieldName(size_t fieldId) { return getFieldName(fieldId, FIELD_NONE); }
|
|
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField = FIELD_NONE) { return getSubfieldSize(fieldId, subField); }
|
|
|
|
QString thunkToFuncName(offset_t thunk, bool shortName=true);
|
|
QString thunkToLibName(offset_t thunk);
|
|
|
|
QList<offset_t> getThunksList() { return this->thunksList; }
|
|
|
|
bool hasThunk(offset_t thunk) {
|
|
std::map<offset_t, size_t>::iterator libItr = thunkToLibMap.find(thunk);
|
|
return (libItr != thunkToLibMap.end());
|
|
}
|
|
|
|
ImportBaseFuncWrapper* thunkToFunction(offset_t thunk);
|
|
|
|
protected:
|
|
ImportBaseDirWrapper(PEFile *pe, pe:: dir_entry v_entryType)
|
|
: DataDirEntryWrapper(pe, v_entryType),
|
|
importsCount(0), invalidEntries(0)
|
|
{
|
|
}
|
|
|
|
//virtual bool loadNextEntry(size_t entryNum) = 0;
|
|
|
|
void addMapping(ExeNodeWrapper *func);
|
|
ImportBaseEntryWrapper* thunkToLib(offset_t thunk);
|
|
//---
|
|
std::map<offset_t, size_t> thunkToLibMap;
|
|
QList<offset_t> thunksList;
|
|
|
|
size_t importsCount;
|
|
size_t invalidEntries;
|
|
|
|
friend class ImportBaseEntryWrapper;
|
|
};
|
|
|
|
|
|
class ImportBaseEntryWrapper : public PENodeWrapper
|
|
{
|
|
public:
|
|
static bufsize_t NameLenLimit;
|
|
|
|
virtual char* getLibraryName() = 0;
|
|
virtual size_t getSubFieldsCount() { return 1; }
|
|
bool wrap();
|
|
virtual bool isValid();
|
|
|
|
protected:
|
|
ImportBaseEntryWrapper(PEFile *pe, ImportBaseDirWrapper *importsDir, size_t entryNumber)
|
|
: PENodeWrapper(pe, importsDir, entryNumber),
|
|
impDir(importsDir), invalidEntries(0)
|
|
{
|
|
}
|
|
|
|
void addMapping(ExeNodeWrapper *func) { if (impDir) impDir->addMapping(func); }
|
|
|
|
std::map<offset_t, size_t> thunkToFuncMap;
|
|
ImportBaseDirWrapper* impDir;
|
|
|
|
size_t invalidEntries;
|
|
|
|
friend class ImportBaseDirWrapper;
|
|
};
|
|
|
|
class ImportBaseFuncWrapper : public PENodeWrapper
|
|
{
|
|
public:
|
|
ImportBaseFuncWrapper(PEFile *pe, ImportBaseEntryWrapper* parentLib, size_t entryNumber)
|
|
: PENodeWrapper(pe, parentLib, entryNumber) { }
|
|
|
|
virtual QString getName();
|
|
QString getShortName();
|
|
QString getLibName();
|
|
|
|
virtual bool isValid();
|
|
|
|
virtual bool isByOrdinal() = 0;
|
|
virtual uint64_t getOrdinal() = 0;
|
|
virtual char* getFunctionName() = 0;
|
|
|
|
virtual offset_t callVia() = 0;
|
|
|
|
inline bufsize_t getAddrSize()
|
|
{
|
|
size_t val = (isBit64()) ? sizeof(uint64_t) : sizeof(uint32_t);
|
|
return static_cast<bufsize_t>(val);
|
|
}
|
|
|
|
inline bufsize_t getThunkValSize() { return getAddrSize(); }
|
|
|
|
friend class ImportBaseDirWrapper;
|
|
};
|
|
|