29 if (ptr == NULL)
return NULL;
37 if (!imp || !imp->
getPtr()) {
44 if (!isOk || offset == 0) {
66 return sizeof(pe::IMAGE_DELAY_LOAD);
75 if(!isOk)
return NULL;
79 return (IMAGE_IMPORT_BY_NAME*) ptr;
85 if (entry->
getPtr() == NULL) {
109 const size_t DL_SIZE =
sizeof(pe::IMAGE_DELAY_LOAD);
110 pe::IMAGE_DELAY_LOAD* first = (pe::IMAGE_DELAY_LOAD*) parent->
firstDelayLd(DL_SIZE);
111 if (!first)
return NULL;
113 uint64_t descAddr = parent->
getOffset(first);
116 uint64_t entryOffset = descAddr + (this->
entryNum * DL_SIZE);
120 if (!content)
return NULL;
122 return (pe::IMAGE_DELAY_LOAD*) content;
127 if (
getPtr() == NULL)
return 0;
128 return sizeof(pe::IMAGE_DELAY_LOAD);
134 if (!name)
return "";
135 return QString(name);
142 if (!isOk)
return NULL;
148 if (!ptr)
return NULL;
155 pe::IMAGE_DELAY_LOAD* dLd = (pe::IMAGE_DELAY_LOAD*) this->
getPtr();
156 if (dLd == NULL)
return NULL;
159 case ATTRS :
return &dLd->grAttrs;
160 case NAME :
return &dLd->szName;
161 case MOD :
return &dLd->phmod;
162 case IAT :
return &dLd->pIAT;
163 case INT :
return &dLd->pINT;
166 case TIMESTAMP :
return &dLd->dwTimestamp;
174 case ATTRS :
return "Attributes";
175 case NAME :
return "Name Addr.";
176 case MOD :
return "ModuleHandle";
177 case IAT :
return "IAT";
178 case INT :
return "ImportNameTable";
197 uint64_t offset = this->
getNumValue(fieldId, &isOk);
215 if (addr & ORDINAL_FLAG64)
return true;
218 if (addr & ORDINAL_FLAG32)
return true;
229 size_t fieldSize = this->ptrLen() * 8;
230 size_t shiftSize = (
sizeof(addr) - fieldSize) + 1;
232 uint64_t shiftedVal = (addr << shiftSize) >> shiftSize;
241 IMAGE_IMPORT_BY_NAME* ptr = getImportByNamePtr();
242 if (ptr == NULL)
return NULL;
244 return (
char*) &ptr->Name;
251 IMAGE_IMPORT_BY_NAME* ptr = getImportByNamePtr();
252 if (ptr == NULL)
return 0;
259 if (this->parentDir == NULL)
return NULL;
261 if (parentDir->
getPtr() == NULL)
return NULL;
279 offset += (this->
entryNum * ptrLen());
292 offset += (this->
entryNum * ptrLen());
311 if (!
m_Exe)
return 0;
313 return sizeof (ULONGLONG);
315 return sizeof (DWORD);
335IMAGE_IMPORT_BY_NAME* DelayImpFuncWrapper::getImportByNamePtr()
343 return (IMAGE_IMPORT_BY_NAME*) ptr;
const offset_t INVALID_ADDR
offset_t getDirEntryAddress()
pe::IMAGE_DELAY_LOAD * firstDelayLd()
virtual bool loadNextEntry(size_t cntr)
virtual bufsize_t getSize()
friend class DelayImpEntryWrapper
virtual void * getFieldPtr(size_t fieldId, size_t subField)
virtual QString getFieldName(size_t fieldId)
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField=FIELD_NONE)
virtual char * getLibraryName()
virtual bufsize_t getSize()
virtual IMAGE_IMPORT_BY_NAME * getFirstImpByNamePtr()
bool loadNextEntry(size_t entryNum)
friend class DelayImpFuncWrapper
virtual QString getName()
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField)
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField=FIELD_NONE)
virtual uint64_t getOrdinal()
virtual QString getFieldName(size_t fieldId)
virtual void * getFieldPtr(size_t fieldId, size_t subField=FIELD_NONE)
virtual offset_t getOffset()
virtual uint64_t getNumValue(size_t fieldId, size_t subField, bool *isOk)
std::vector< ExeNodeWrapper * > entries
ExeNodeWrapper * parentNode
virtual size_t getEntriesCount()
virtual exe_bits getBitMode()
BYTE * getContentAt(offset_t offset, bufsize_t size, bool allowExceptions=false)
Executable::addr_type detectAddrType(offset_t addr, Executable::addr_type hintType)
static bool isBit32(Executable *exe)
void addMapping(ExeNodeWrapper *func)
ImportBaseDirWrapper * impDir