hasherezade-bearparser/parser/pe/ImportBaseDirWrapper.h

#pragma once

#include "DataDirEntryWrapper.h"
#include "../Util.h"

class ImportBaseDirWrapper;
class ImportBaseEntryWrapper;
class ImportBaseFuncWrapper;

class ImportBaseDirWrapper : public DataDirEntryWrapper
{
public:
    static size_t EntriesLimit;

    virtual size_t getFieldsCount() { return this->importsCount; }

    virtual void* getFieldPtr(size_t fieldId, size_t subField) { return getSubfieldPtr(fieldId, subField ); }
    virtual QString getFieldName(size_t fieldId, size_t subField) { return getSubfieldName(fieldId, subField ); }
    virtual QString getFieldName(size_t fieldId) { return getFieldName(fieldId, FIELD_NONE); }
    virtual bufsize_t getFieldSize(size_t fieldId, size_t subField = FIELD_NONE) { return getSubfieldSize(fieldId, subField); }

    QString thunkToFuncName(offset_t thunk);

protected:
    ImportBaseDirWrapper(PEFile *pe, pe:: dir_entry v_entryType)
        : DataDirEntryWrapper(pe, v_entryType), importsCount(0) { }

    virtual bool wrap();
    virtual bool loadNextEntry(size_t entryNum) = 0;

    void addFuncMapping(ImportBaseFuncWrapper *func);
    //---
    std::map<offset_t, size_t> thunkToLibMap;
    size_t importsCount;

friend class ImportBaseEntryWrapper;
};


class ImportBaseEntryWrapper : public PENodeWrapper
{
public:
    static size_t EntriesLimit;
    static bufsize_t NameLenLimit;

    virtual char* getLibraryName() = 0;
    virtual size_t getSubFieldsCount() { return 1; }

protected:
    ImportBaseEntryWrapper(PEFile *pe, ImportBaseDirWrapper *importsDir, size_t entryNumber)
        : PENodeWrapper(pe, importsDir, entryNumber), impDir(importsDir) { wrap(); }

    void addFuncMapping(ImportBaseFuncWrapper *func) { if (impDir) impDir->addFuncMapping(func); }

    std::map<offset_t, size_t> thunkToFuncMap;
    ImportBaseDirWrapper* impDir;

friend class ImportBaseDirWrapper;
};

class ImportBaseFuncWrapper : public PENodeWrapper
{
public:
    ImportBaseFuncWrapper(PEFile *pe, ImportBaseEntryWrapper* parentLib, size_t entryNumber)
        : PENodeWrapper(pe, parentLib, entryNumber) { }

    virtual QString getName();

    virtual bool isByOrdinal() = 0;
    virtual uint64_t getOrdinal() = 0;
    virtual char* getFunctionName() = 0;

    virtual offset_t callVia() = 0;

    inline size_t getAddrSize() {return (isBit64()) ? sizeof(uint64_t) : sizeof(uint32_t); }
    inline size_t getThunkValSize() {return getAddrSize(); }

friend class ImportBaseDirWrapper;
};