BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
DebugDirWrapper.h
Go to the documentation of this file.
1#pragma once
2
4#include "pe_undoc.h"
5
6
8{
9public:
11 : DataDirEntryWrapper(pe, pe::DIR_DEBUG) { wrap(); }
12
13 virtual void* getPtr() { return getDebugDir(); }
14
16 {
17 return getDirEntrySize();
18 }
19
20 virtual QString getName() { return "Debug"; }
21
22 virtual size_t getFieldsCount()
23 {
24 return entries.size();
25 }
26
27 virtual void* getFieldPtr(size_t fieldId, size_t subField) { return getSubfieldPtr(fieldId, subField ); }
28 virtual QString getFieldName(size_t fieldId, size_t subField) { return getSubfieldName(fieldId, subField ); }
29 virtual QString getFieldName(size_t fieldId) { return getFieldName(fieldId, FIELD_NONE); }
30 virtual bufsize_t getFieldSize(size_t fieldId, size_t subField = FIELD_NONE) { return getSubfieldSize(fieldId, subField); }
31
32 // debug dir only
33 bool isRepro();
34
35protected:
36 bool wrap()
37 {
38 clear();
39 if (!getDataDirectory()) {
40 return false;
41 }
42 const size_t LIMIT = (-1);
43 size_t cntr = 0;
44 for (cntr = 0; cntr < LIMIT; cntr++) {
45 if (loadNextEntry(cntr) == false) break;
46 }
47 return true;
48 }
49
50 virtual bool loadNextEntry(size_t cntr);
51
52 IMAGE_DEBUG_DIRECTORY* getDebugDir(size_t index = 0)
53 {
54 const offset_t rva = getDirEntryAddress();
55 if (rva == INVALID_ADDR || rva == 0) {
56 return NULL;
57 }
58 const size_t offset = index * sizeof(IMAGE_DEBUG_DIRECTORY);
59 return (IMAGE_DEBUG_DIRECTORY*) m_Exe->getContentAt((rva + offset), Executable::RVA, sizeof(IMAGE_DEBUG_DIRECTORY));
60 }
61
63};
64
65
67{
68public:
69
82
83 DebugDirEntryWrapper(PEFile *pe, DebugDirWrapper *rootDir, size_t entryNumber)
84 : PENodeWrapper(pe, rootDir, entryNumber), dbgRootDir(rootDir)
85 {
86 wrap();
87 }
88
90
91 bool wrap();
92
93 virtual void* getPtr();
94 virtual bufsize_t getSize();
95
96 virtual QString getName()
97 {
98 IMAGE_DEBUG_DIRECTORY* d = debugDir();
99 if (!d) return "";
100 return translateType(d->Type);
101 }
102
103 virtual size_t getFieldsCount() { return FIELD_COUNTER; }
104 virtual size_t getSubFieldsCount() { return 1; }
105
106 virtual void* getFieldPtr(size_t fieldId, size_t subField);
107 virtual QString getFieldName(size_t fieldId);
108 virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField = FIELD_NONE);
109
110 QString translateType(int type);
111 QString translateFieldContent(size_t fieldId);
112
113protected:
114
115 IMAGE_DEBUG_DIRECTORY* debugDir()
116 {
117 if (!dbgRootDir) return NULL;
118 return this->dbgRootDir->getDebugDir(this->entryNum);
119 }
120
121 BYTE* getDebugStruct();
122 pe::DEBUG_RSDSI* getRDSI();
123 pe::DEBUG_NB10* getNB10();
124
126
128};
129
130
132{
133public:
134 // fields :
143
145 : ExeNodeWrapper(pe, _parentDir, 0)
146 {
147 this->parentDir = _parentDir;
148 }
149
150 // full structure boundaries
151 virtual void* getPtr();
152 virtual bufsize_t getSize();
153
154 virtual QString getName() { return "CodeView Info"; }
155 virtual size_t getFieldsCount() { return getPtr() ? FIELD_COUNTER : 0; }
156 virtual size_t getSubFieldsCount() { return 1; }
157
158 // specific field boundaries
159 virtual void* getFieldPtr(size_t fieldId, size_t subField = FIELD_NONE);
160 virtual QString getFieldName(size_t fieldId);
161 virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField) { return Executable::NOT_ADDR; }
162
163 QString translateFieldContent(size_t fieldId);
164
165 //this wrapper only:
166 QString getGuidString();
167 QString getSignature();
168private:
169 DebugDirEntryWrapper* parentDir;
170};
uint32_t bufsize_t
const offset_t INVALID_ADDR
uint64_t offset_t
#define FIELD_NONE
bufsize_t getDirEntrySize(bool trimToExeSize=false)
offset_t getDirEntryAddress()
IMAGE_DATA_DIRECTORY * getDataDirectory()
QString translateFieldContent(size_t fieldId)
virtual QString getFieldName(size_t fieldId)
virtual QString getName()
QString getSignature()
FieldID
@ F_CVDBG_SIGN
@ F_CVDBG_GUID
@ F_CVDBG_AGE
@ NONE
@ FIELD_COUNTER
@ F_CVDBG_PDB
virtual void * getPtr()
DebugDirCVEntryWrapper(Executable *pe, DebugDirEntryWrapper *_parentDir)
virtual void * getFieldPtr(size_t fieldId, size_t subField=FIELD_NONE)
QString getGuidString()
virtual size_t getFieldsCount()
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField)
virtual bufsize_t getSize()
virtual size_t getSubFieldsCount()
pe::DEBUG_RSDSI * getRDSI()
bool wrap()
virtual QString getName()
DebugDirWrapper * dbgRootDir
QString translateFieldContent(size_t fieldId)
virtual QString getFieldName(size_t fieldId)
DebugDirEntryWrapper(PEFile *pe, DebugDirWrapper *rootDir, size_t entryNumber)
virtual size_t getSubFieldsCount()
~DebugDirEntryWrapper()
virtual void * getPtr()
DebugDirFID
@ RAW_DATA_PTR
@ MINOR_VER
@ CHARACTERISTIC
@ FIELD_COUNTER
@ NONE
@ TYPE
@ MAJOR_VER
@ DATA_SIZE
@ TIMESTAMP
@ RAW_DATA_ADDR
virtual bufsize_t getSize()
IMAGE_DEBUG_DIRECTORY * debugDir()
pe::DEBUG_NB10 * getNB10()
virtual void * getFieldPtr(size_t fieldId, size_t subField)
BYTE * getDebugStruct()
virtual size_t getFieldsCount()
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField=FIELD_NONE)
QString translateType(int type)
virtual QString getFieldName(size_t fieldId)
virtual QString getFieldName(size_t fieldId, size_t subField)
virtual size_t getFieldsCount()
virtual void * getPtr()
virtual QString getName()
IMAGE_DEBUG_DIRECTORY * getDebugDir(size_t index=0)
virtual bool loadNextEntry(size_t cntr)
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField=FIELD_NONE)
virtual void * getFieldPtr(size_t fieldId, size_t subField)
virtual bufsize_t getSize()
DebugDirWrapper(PEFile *pe)
virtual void * getSubfieldPtr(size_t fieldId, size_t subField)
virtual QString getSubfieldName(size_t fieldId, size_t subField)
std::vector< ExeNodeWrapper * > entries
virtual void clear()
virtual bufsize_t getSubfieldSize(size_t fieldId, size_t subField)
BYTE * getContentAt(offset_t offset, bufsize_t size, bool allowExceptions=false)
Definition Executable.h:65