BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
ExeElementWrapper.cpp
Go to the documentation of this file.
1#include "ExeElementWrapper.h"
2
4 : m_Exe(v_exe)
5{
6 if (v_exe == NULL) {
7 Logger::append(Logger::D_ERROR, "Cannot initialize with Exe == NULL!");
8 throw CustomException("Cannot initialize with Exe == NULL!");
9 }
10}
11
12bufsize_t ExeElementWrapper::getFieldSize(size_t fieldId, size_t subField)
13{
14 size_t fieldsCount = getFieldsCount();
15 if (fieldId >= fieldsCount) return this->getSize();
16
17 void *ptr = this->getFieldPtr(fieldId, subField);
18 if (ptr == NULL) return 0;
19
20 void *nextPtr = NULL;
21 size_t nextFID = fieldId + 1;
22
23 if (nextFID < fieldsCount ) nextPtr = this->getFieldPtr(nextFID, subField);
24 if (nextPtr != NULL) {
25 int64_t dif = offset_t (nextPtr) - offset_t (ptr);
26 if (dif < 0) return 0;
27
28 return (bufsize_t) dif;
29 }
30
31 offset_t fullSize = this->getSize();
32 BYTE *bgnPtr = (BYTE*) getPtr();
33 BYTE *endPtr = bgnPtr + fullSize;
34 offset_t dif = offset_t (endPtr) - offset_t (ptr);
35
36 return (bufsize_t) dif;
37}
38
40{
41 BYTE *ptr = (BYTE*)this->getPtr();
42 return getOffset(ptr);
43}
44
45offset_t ExeElementWrapper::getOffset(void *ptr, bool allowExceptions)
46{
47 if (!m_Exe) return INVALID_ADDR;
48 return m_Exe->getOffset(ptr, allowExceptions);
49}
50
51offset_t ExeElementWrapper::getFieldOffset(size_t fieldId, size_t subField)
52{
53 void* ptr = getFieldPtr(fieldId, subField);
54 return getOffset(ptr);
55}
56
57WrappedValue ExeElementWrapper::getWrappedValue(size_t fieldId, size_t subFieldId)
58{
59 if (fieldId == -1) return WrappedValue(); //EMPTY
60 void* ptr = getFieldPtr(fieldId, subFieldId);
61 if (ptr == NULL) return WrappedValue(); //EMPTY
62
63 bufsize_t fieldSize = getFieldSize(fieldId, subFieldId);
64 if (fieldSize == BUFSIZE_MAX || fieldSize == 0) return WrappedValue(); //EMPTY
65
66 offset_t offset = this->getOffset(ptr);
67 if (offset == INVALID_ADDR) return WrappedValue(); //EMPTY
68
69 WrappedValue::data_type dataType = this->containsDataType(fieldId, subFieldId);
70 return WrappedValue(this->m_Exe, offset, fieldSize, dataType);
71}
72
73uint64_t ExeElementWrapper::getNumValue(size_t fId, size_t subField, bool* isOk)
74{
75 if (isOk) (*isOk) = false;
76 if (this->m_Exe == NULL) return (-1);
77
78 offset_t offset = this->getFieldOffset(fId, subField);
79 bufsize_t size = this->getFieldSize(fId, subField);
80 return this->m_Exe->getNumValue(offset, size, isOk);
81}
82
83bool ExeElementWrapper::setNumValue(size_t fId, size_t subField, uint64_t newVal)
84{
85 if (this->m_Exe == NULL) return false;
86
87 offset_t offset = this->getFieldOffset(fId, subField);
88 bufsize_t size = this->getFieldSize(fId, subField);
89 return this->m_Exe->setNumValue(offset, size, newVal);
90}
91
93{
94 if (this->m_Exe == NULL) return false;
95
96 if (this->m_Exe->isAreaEmpty(rawOffset, getSize()) == false) {
97 return false;
98 }
99 return true;
100}
101
103{
104 if (this->m_Exe == NULL) return false;
105
106 if (canCopyToOffset(rawOffset) == false) {
107 Logger::append(Logger::D_ERROR,"The area is not empty!");
108 return false;
109 }
110 if (m_Exe->pasteBuffer(rawOffset, this, false) == false) {
111 Logger::append(Logger::D_ERROR,"Cannot paste the buffer!");
112 return false;
113 }
114 return true;
115}
const bufsize_t BUFSIZE_MAX
uint32_t bufsize_t
const offset_t INVALID_ADDR
uint64_t offset_t
bool setNumValue(offset_t offset, bufsize_t size, uint64_t newVal)
bool pasteBuffer(offset_t rawOffset, AbstractByteBuffer *buf, bool allowTrunc)
uint64_t getNumValue(offset_t offset, bufsize_t size, bool *isOk)
bool isAreaEmpty(offset_t rawOffset, bufsize_t size)
virtual offset_t getOffset(void *ptr, bool allowExceptions=false)
virtual bufsize_t getSize()=0
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField=FIELD_NONE)
virtual bool setNumValue(size_t fieldId, size_t subField, uint64_t val)
virtual bool canCopyToOffset(offset_t rawOffset)
virtual void * getPtr()=0
virtual void * getFieldPtr(size_t fieldId, size_t subField)=0
virtual offset_t getFieldOffset(size_t fieldId, size_t subField=FIELD_NONE)
virtual size_t getFieldsCount()=0
virtual WrappedValue getWrappedValue(size_t fieldId, size_t subField)
ExeElementWrapper(Executable *exe)
virtual WrappedValue::data_type containsDataType(size_t fieldId, size_t subField=FIELD_NONE)
virtual offset_t getOffset()
bool copyToOffset(offset_t rawOffset)
virtual uint64_t getNumValue(size_t fieldId, size_t subField, bool *isOk)
bool append(dbg_level lvl, const char *format,...)
Definition Util.cpp:8
@ D_ERROR
Definition Util.h:26