hasherezade-bearparser/parser/include/bearparser/pe/ImportDirWrapper.h

#pragma once

#include "ImportBaseDirWrapper.h"
#include "pe_formats.h"

/*
typedef struct _IMAGE_THUNK_DATA32 {
    union {
        DWORD ForwarderString;    // PBYTE
        DWORD Function;        // PDWORD
        DWORD Ordinal;
        DWORD AddressOfData;    // PIMAGE_IMPORT_BY_NAME
    } u1;
} IMAGE_THUNK_DATA32;

typedef struct _IMAGE_THUNK_DATA64 {
    union {
        ULONGLONG ForwarderString;    // PBYTE
        ULONGLONG Function;        // PDWORD
        ULONGLONG Ordinal;
        ULONGLONG AddressOfData;    //PIMAGE_IMPORT_BY_NAME
    } u1;
} IMAGE_THUNK_DATA64;
*/

class ImportDirWrapper;
class ImportEntryWrapper;
class ImportedFuncWrapper;

class ImportDirWrapper : public ImportBaseDirWrapper
{
public:
    ImportDirWrapper(PEFile *pe)
        : ImportBaseDirWrapper(pe, pe::DIR_IMPORT) { wrap(); }

    virtual void* getPtr() { return firstDescriptor(); }
    virtual bufsize_t getSize();
    virtual QString getName() { return "Imports"; }

protected:
    virtual bool loadNextEntry(size_t cntr);

    IMAGE_DATA_DIRECTORY* getDataDirectory();
    IMAGE_IMPORT_DESCRIPTOR *firstDescriptor();

friend class ImportEntryWrapper;
};


class ImportEntryWrapper : public ImportBaseEntryWrapper
{
public:
    /* fields :*/
    enum FieldID {
        NONE = FIELD_NONE,
        ORIG_FIRST_THUNK,
        TIMESTAMP,
        FORWARDER,
        NAME,
        FIRST_THUNK,
        FIELD_COUNTER
    };

    ImportEntryWrapper(PEFile *pe, ImportDirWrapper *importsDir, size_t entryNumber)
        : ImportBaseEntryWrapper(pe, importsDir, entryNumber) { wrap(); }

    //virtual bool wrap();
    //bool isValid();

    /* full structure boundaries */
    virtual void* getPtr();

    virtual bufsize_t getSize();
    bool isBound();
    virtual QString getName();
    virtual size_t getFieldsCount() { return FIELD_COUNTER; }

    /* specific field boundaries */
    virtual void* getFieldPtr(size_t fieldId, size_t subField = FIELD_NONE);
    virtual QString getFieldName(size_t fieldId);
    virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField = FIELD_NONE);

    bufsize_t geEntrySize()
    {
        if (m_Exe == NULL) return 0;
        return ImportBaseDirWrapper::thunkSize(m_Exe->getBitMode());
    }

    virtual offset_t getNextEntryOffset()
    {
         offset_t nextOffset = INVALID_ADDR;
        //get after existing entries:
        if (this->getEntriesCount() > 0) {
            return ExeNodeWrapper::getNextEntryOffset();
        }
        //get by thunk:
        IMAGE_IMPORT_DESCRIPTOR* desc = (IMAGE_IMPORT_DESCRIPTOR*) this->getPtr();
        if (!desc) return INVALID_ADDR;

        offset_t firstThunk = desc->FirstThunk;
        if (firstThunk == 0) {
            firstThunk = desc->OriginalFirstThunk;
        }
        nextOffset = m_Exe->convertAddr(desc->FirstThunk, Executable::RVA, Executable::RAW);
        return nextOffset;
    }

    char* getLibraryName();

protected:
     bool loadNextEntry(size_t entryNum);

friend class ImportDirWrapper;
};

class ImportedFuncWrapper : public ImportBaseFuncWrapper
{
public:
    /* fields :*/
    enum FieldID {
        NONE = FIELD_NONE,
        ORIG_THUNK,
        THUNK,
        FORWARDER,
        HINT,
        FIELD_COUNTER
    };

    ImportedFuncWrapper(PEFile *pe, ImportEntryWrapper* parentLib, size_t entryNumber)
        : ImportBaseFuncWrapper(pe, parentLib, entryNumber) {}// this->parentLib = parentLib; }

    /* full structure boundaries */
    virtual void* getPtr();
    virtual IMAGE_IMPORT_BY_NAME* getImportByNamePtr();

    virtual bufsize_t getSize();
    //virtual QString getName();
    virtual size_t getFieldsCount() { return FIELD_COUNTER; }
    virtual size_t getSubFieldsCount() { return 1; }

    /* specific field boundaries */
    virtual void* getFieldPtr(size_t fieldId, size_t subField = FIELD_NONE);
    virtual bufsize_t getFieldSize(size_t fieldId, size_t subField = FIELD_NONE);
    virtual QString getFieldName(size_t fieldId);
    virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField = FIELD_NONE);

    uint64_t getThunkValue();

    offset_t getFieldRVA(ImportEntryWrapper::FieldID fId);
    void* getValuePtr(ImportEntryWrapper::FieldID fId);

    virtual offset_t callVia() { return getFieldRVA(ImportEntryWrapper::FIRST_THUNK); }
    bool isByOrdinal();
    virtual uint64_t getOrdinal() { return getThunkValue(); }
    char* getFunctionName();

friend class ImportDirWrapper;
};