BearParser
Portable Executable parsing library (from PE-bear)
Toggle main menu visibility
Loading...
Searching...
No Matches
parser
pe
DOSExe.cpp
Go to the documentation of this file.
1
#include "
pe/DOSExe.h
"
2
3
4
bool
DOSExeBuilder::signatureMatches
(
AbstractByteBuffer
*buf)
5
{
6
if
(buf == NULL)
return
false
;
7
8
WORD *magic = (WORD*) buf->
getContentAt
(0,
sizeof
(WORD));
9
if
(magic == NULL)
return
false
;
10
11
if
((*magic) == pe::S_DOS || (*magic) == pe::S_DOS2) {
12
return
true
;
13
}
14
15
return
false
;
16
}
17
18
Executable
*
DOSExeBuilder::build
(
AbstractByteBuffer
*buf)
19
{
20
Executable
*exe = NULL;
21
if
(
signatureMatches
(buf) ==
false
)
return
NULL;
22
23
try
{
24
exe =
new
DOSExe
(buf);
25
}
catch
(
ExeException
) {
26
//
27
}
28
29
return
exe;
30
}
31
32
//-------------------------------------------------------------
33
34
DOSExe::DOSExe
(
AbstractByteBuffer
*v_buf)
35
:
MappedExe
(v_buf,
Executable
::
BITS_16
),
dosHdrWrapper
(NULL)
36
{
37
wrap
();
38
}
39
40
void
DOSExe::wrap
()
41
{
42
this->
dosHdrWrapper
=
new
DosHdrWrapper
(
this
);
43
44
m_dosHdr
= (IMAGE_DOS_HEADER*)
getContentAt
(0,
sizeof
(IMAGE_DOS_HEADER));
45
if
(
m_dosHdr
== NULL)
throw
ExeException
(
"Could not Wrap!"
);
46
47
WORD* magic = (WORD*) this->
dosHdrWrapper
->getFieldPtr(
DosHdrWrapper::MAGIC
);
48
49
if
(this->
dosHdrWrapper
->getPtr() == NULL || magic == NULL) {
50
throw
ExeException
(
"Could not Wrap!"
);
51
}
52
53
if
((*magic) != pe::S_DOS && (*magic) != pe::S_DOS2) {
54
Logger::append
(
Logger::D_WARNING
,
"It is not a DOS file!\n"
);
55
throw
ExeException
(
"It is not a DOS file!"
);
56
}
57
this->
wrappers
[
WR_DOS_HDR
] = this->
dosHdrWrapper
;
58
}
59
60
offset_t
DOSExe::peSignatureOffset
()
61
{
62
LONG* lfnew = (LONG*) this->
dosHdrWrapper
->getFieldPtr(
DosHdrWrapper::LFNEW
);
63
if
(lfnew == NULL)
return
0;
64
65
return
static_cast<
offset_t
>
(*lfnew);
66
}
67
offset_t
uint64_t offset_t
Definition
AbstractByteBuffer.h:20
DOSExe.h
AbstractByteBuffer
Definition
AbstractByteBuffer.h:36
AbstractByteBuffer::AbstractByteBuffer
AbstractByteBuffer()
Definition
AbstractByteBuffer.h:40
AbstractByteBuffer::getContentAt
virtual BYTE * getContentAt(offset_t offset, bufsize_t size, bool allowExceptions=false)
Definition
AbstractByteBuffer.cpp:57
DOSExeBuilder::build
virtual Executable * build(AbstractByteBuffer *buf)
Definition
DOSExe.cpp:18
DOSExeBuilder::signatureMatches
virtual bool signatureMatches(AbstractByteBuffer *buf)
Definition
DOSExe.cpp:4
DOSExe
Definition
DOSExe.h:19
DOSExe::wrap
virtual void wrap()
Definition
DOSExe.cpp:40
DOSExe::DOSExe
DOSExe(AbstractByteBuffer *v_buf)
Definition
DOSExe.cpp:34
DOSExe::m_dosHdr
IMAGE_DOS_HEADER * m_dosHdr
Definition
DOSExe.h:70
DOSExe::peSignatureOffset
offset_t peSignatureOffset()
Definition
DOSExe.cpp:60
DOSExe::dosHdrWrapper
DosHdrWrapper * dosHdrWrapper
Definition
DOSExe.h:69
DOSExe::WR_DOS_HDR
@ WR_DOS_HDR
Definition
DOSExe.h:23
DosHdrWrapper
Definition
DosHdrWrapper.h:9
DosHdrWrapper::MAGIC
@ MAGIC
Definition
DosHdrWrapper.h:14
DosHdrWrapper::LFNEW
@ LFNEW
Definition
DosHdrWrapper.h:32
ExeException
Definition
Executable.h:9
ExeWrappersContainer::wrappers
std::map< size_t, ExeElementWrapper * > wrappers
Definition
MappedExe.h:27
Executable
Definition
Executable.h:26
Executable::BITS_16
@ BITS_16
Definition
Executable.h:30
Executable::getContentAt
BYTE * getContentAt(offset_t offset, bufsize_t size, bool allowExceptions=false)
Definition
Executable.h:67
Executable::Executable
Executable(AbstractByteBuffer *v_buf, exe_bits v_bitMode)
Definition
Executable.cpp:4
MappedExe::MappedExe
MappedExe(AbstractByteBuffer *v_buf, exe_bits v_bitMode)
Definition
MappedExe.h:52
Logger::append
bool append(dbg_level lvl, const char *format,...)
Definition
Util.cpp:8
Logger::D_WARNING
@ D_WARNING
Definition
Util.h:26
Generated by
1.17.0