BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
DataDirWrapper.cpp
Go to the documentation of this file.
1#include "pe/DataDirWrapper.h"
2#include "pe/PEFile.h"
3
5{
6 if (m_PE == NULL) return NULL;
7
8 const offset_t myOff = m_PE->peDataDirOffset();
9 IMAGE_DATA_DIRECTORY* ptr = (IMAGE_DATA_DIRECTORY*) m_Exe->getContentAt(myOff, getSize());
10 return ptr;
11}
12
14{
15 if (m_PE == NULL) return 0;
16 const size_t count = getDirsCount();
17 const bufsize_t size = sizeof(IMAGE_DATA_DIRECTORY) * count;
18 return size;
19}
20
22{
23 if (m_PE == NULL) return 0;
25 if (!optHdr) return 0;
26 bool isOk = false;
27 size_t count = optHdr->getNumValue(OptHdrWrapper::RVAS_SIZES_NUM, &isOk);
28 if (!isOk) return 0;
29 if (count > pe::DIR_ENTRIES_COUNT) {
30 count = pe::DIR_ENTRIES_COUNT;
31 }
32 return count;
33}
34
35void* DataDirWrapper::getFieldPtr(size_t fieldId, size_t subField)
36{
37 if (fieldId >= getDirsCount()) {
38 return getPtr(); // invalid fieldID, give default
39 }
40
41 IMAGE_DATA_DIRECTORY* dataDir = (IMAGE_DATA_DIRECTORY*) getPtr();
42 if (dataDir == NULL) return NULL;
43
44 switch (subField) {
45 case ADDRESS :
46 return (void*)(&dataDir[fieldId].VirtualAddress);
47 case SIZE :
48 return (void*)(&dataDir[fieldId].Size);
49 }
50 return (void*)(&dataDir[fieldId].VirtualAddress);
51}
52
53bufsize_t DataDirWrapper::getFieldSize(size_t fieldId, size_t subField)
54{
55 if (fieldId >= getDirsCount()) return getSize();
56
57 IMAGE_DATA_DIRECTORY* dir = (IMAGE_DATA_DIRECTORY*) getPtr();
58 if (dir == NULL) return 0;
59
60 IMAGE_DATA_DIRECTORY record = dir[fieldId];
61
62 switch (subField) {
63 case ADDRESS :
64 return sizeof(record.VirtualAddress);
65 case SIZE :
66 return sizeof(record.Size);
67 }
68 return sizeof(record.VirtualAddress) + sizeof(record.Size);
69}
70
71QString DataDirWrapper::getFieldName(size_t fieldId)
72{
73 switch (fieldId) {
74 case pe::DIR_EXPORT: return "Export Directory";
75 case pe::DIR_IMPORT: return "Import Directory";
76 case pe::DIR_RESOURCE : return "Resource Directory";
77 case pe::DIR_EXCEPTION: return "Exception Directory";
78 case pe::DIR_SECURITY: return "Security Directory";
79 case pe::DIR_BASERELOC: return "Base Relocation Table";
80 case pe::DIR_DEBUG : return "Debug Directory";
81 case pe::DIR_ARCHITECTURE: return "Architecture Specific Data";
82 case pe::DIR_GLOBALPTR : return "RVA of GlobalPtr";
83 case pe::DIR_TLS: return "TLS Directory";
84 case pe::DIR_LOAD_CONFIG: return "Load Configuration Directory";
85 case pe::DIR_BOUND_IMPORT: return "Bound Import Directory";
86 case pe::DIR_IAT: return "Import Address Table";
87 case pe::DIR_DELAY_IMPORT: return "Delay Load Import Descriptors";
88 case pe::DIR_COM_DESCRIPTOR : return ".NET header";
89 }
90 return "";
91}
92
94{
95 if (subField != ADDRESS) return Executable::NOT_ADDR;
96
97 if (fieldId == pe::DIR_SECURITY) return Executable::RAW;
98 return Executable::RVA;
99}
uint32_t bufsize_t
uint64_t offset_t
virtual QString getFieldName(size_t fieldId)
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField)
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField=FIELD_NONE)
virtual void * getPtr()
virtual bufsize_t getSize()
virtual void * getFieldPtr(size_t fieldId, size_t subField)
virtual uint64_t getNumValue(size_t fieldId, size_t subField, bool *isOk)
virtual ExeElementWrapper * getWrapper(size_t wrapperId)
Definition MappedExe.cpp:13
BYTE * getContentAt(offset_t offset, bufsize_t size, bool allowExceptions=false)
Definition Executable.h:65
offset_t peDataDirOffset()
Definition PEFile.cpp:286
@ WR_OPTIONAL_HDR
Definition PEFile.h:52