BearParser
Portable Executable parsing library (from PE-bear)
Toggle main menu visibility
Loading...
Searching...
No Matches
parser
ExeElementWrapper.cpp
Go to the documentation of this file.
1
#include "
ExeElementWrapper.h
"
2
3
ExeElementWrapper::ExeElementWrapper
(
Executable
*v_exe)
4
:
m_Exe
(v_exe)
5
{
6
if
(v_exe == NULL) {
7
Logger::append
(
Logger::D_ERROR
,
"Cannot initialize with Exe == NULL!"
);
8
throw
CustomException
(
"Cannot initialize with Exe == NULL!"
);
9
}
10
}
11
12
bufsize_t
ExeElementWrapper::getFieldSize
(
size_t
fieldId,
size_t
subField)
13
{
14
size_t
fieldsCount =
getFieldsCount
();
15
if
(fieldId >= fieldsCount)
return
this->
getSize
();
16
17
void
*ptr = this->
getFieldPtr
(fieldId, subField);
18
if
(ptr == NULL)
return
0;
19
20
void
*nextPtr = NULL;
21
size_t
nextFID = fieldId + 1;
22
23
if
(nextFID < fieldsCount ) nextPtr = this->
getFieldPtr
(nextFID, subField);
24
if
(nextPtr != NULL) {
25
int64_t dif =
offset_t
(nextPtr) -
offset_t
(ptr);
26
if
(dif < 0)
return
0;
27
28
return
(
bufsize_t
) dif;
29
}
30
31
offset_t
fullSize = this->
getSize
();
32
BYTE *bgnPtr = (BYTE*)
getPtr
();
33
BYTE *endPtr = bgnPtr + fullSize;
34
offset_t
dif =
offset_t
(endPtr) -
offset_t
(ptr);
35
36
return
(
bufsize_t
) dif;
37
}
38
39
offset_t
ExeElementWrapper::getOffset
()
40
{
41
BYTE *ptr = (BYTE*)this->
getPtr
();
42
return
getOffset
(ptr);
43
}
44
45
offset_t
ExeElementWrapper::getOffset
(
void
*ptr,
bool
allowExceptions)
46
{
47
if
(!
m_Exe
)
return
INVALID_ADDR
;
48
return
m_Exe
->getOffset(ptr, allowExceptions);
49
}
50
51
offset_t
ExeElementWrapper::getFieldOffset
(
size_t
fieldId,
size_t
subField)
52
{
53
void
* ptr =
getFieldPtr
(fieldId, subField);
54
return
getOffset
(ptr);
55
}
56
57
WrappedValue
ExeElementWrapper::getWrappedValue
(
size_t
fieldId,
size_t
subFieldId)
58
{
59
if
(fieldId == -1)
return
WrappedValue
();
//EMPTY
60
void
* ptr =
getFieldPtr
(fieldId, subFieldId);
61
if
(ptr == NULL)
return
WrappedValue
();
//EMPTY
62
63
bufsize_t
fieldSize =
getFieldSize
(fieldId, subFieldId);
64
if
(fieldSize ==
BUFSIZE_MAX
|| fieldSize == 0)
return
WrappedValue
();
//EMPTY
65
66
offset_t
offset = this->
getOffset
(ptr);
67
if
(offset ==
INVALID_ADDR
)
return
WrappedValue
();
//EMPTY
68
69
WrappedValue::data_type
dataType = this->
containsDataType
(fieldId, subFieldId);
70
return
WrappedValue
(this->
m_Exe
, offset, fieldSize, dataType);
71
}
72
73
uint64_t
ExeElementWrapper::getNumValue
(
size_t
fId,
size_t
subField,
bool
* isOk)
74
{
75
if
(isOk) (*isOk) =
false
;
76
if
(this->
m_Exe
== NULL)
return
(-1);
77
78
offset_t
offset = this->
getFieldOffset
(fId, subField);
79
bufsize_t
size = this->
getFieldSize
(fId, subField);
80
return
this->
m_Exe
->getNumValue(offset, size, isOk);
81
}
82
83
bool
ExeElementWrapper::setNumValue
(
size_t
fId,
size_t
subField, uint64_t newVal)
84
{
85
if
(this->
m_Exe
== NULL)
return
false
;
86
87
offset_t
offset = this->
getFieldOffset
(fId, subField);
88
bufsize_t
size = this->
getFieldSize
(fId, subField);
89
return
this->
m_Exe
->setNumValue(offset, size, newVal);
90
}
91
92
bool
ExeElementWrapper::canCopyToOffset
(
offset_t
rawOffset)
93
{
94
if
(this->
m_Exe
== NULL)
return
false
;
95
96
if
(this->
m_Exe
->isAreaEmpty(rawOffset,
getSize
()) ==
false
) {
97
return
false
;
98
}
99
return
true
;
100
}
101
102
bool
ExeElementWrapper::copyToOffset
(
offset_t
rawOffset)
103
{
104
if
(this->
m_Exe
== NULL)
return
false
;
105
106
if
(
canCopyToOffset
(rawOffset) ==
false
) {
107
Logger::append
(
Logger::D_ERROR
,
"The area is not empty!"
);
108
return
false
;
109
}
110
if
(
m_Exe
->pasteBuffer(rawOffset,
this
,
false
) ==
false
) {
111
Logger::append
(
Logger::D_ERROR
,
"Cannot paste the buffer!"
);
112
return
false
;
113
}
114
return
true
;
115
}
BUFSIZE_MAX
const bufsize_t BUFSIZE_MAX
Definition
AbstractByteBuffer.h:18
INVALID_ADDR
const offset_t INVALID_ADDR
Definition
AbstractByteBuffer.h:21
offset_t
uint64_t offset_t
Definition
AbstractByteBuffer.h:20
bufsize_t
size_t bufsize_t
Definition
AbstractByteBuffer.h:17
ExeElementWrapper.h
CustomException
Definition
CustomException.h:12
ExeElementWrapper::getSize
virtual bufsize_t getSize()=0
ExeElementWrapper::getFieldSize
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField=FIELD_NONE)
Definition
ExeElementWrapper.cpp:12
ExeElementWrapper::setNumValue
virtual bool setNumValue(size_t fieldId, size_t subField, uint64_t val)
Definition
ExeElementWrapper.cpp:83
ExeElementWrapper::canCopyToOffset
virtual bool canCopyToOffset(offset_t rawOffset)
Definition
ExeElementWrapper.cpp:92
ExeElementWrapper::getPtr
virtual void * getPtr()=0
ExeElementWrapper::getFieldPtr
virtual void * getFieldPtr(size_t fieldId, size_t subField)=0
ExeElementWrapper::getFieldOffset
virtual offset_t getFieldOffset(size_t fieldId, size_t subField=FIELD_NONE)
Definition
ExeElementWrapper.cpp:51
ExeElementWrapper::getFieldsCount
virtual size_t getFieldsCount()=0
ExeElementWrapper::getWrappedValue
virtual WrappedValue getWrappedValue(size_t fieldId, size_t subField)
Definition
ExeElementWrapper.cpp:57
ExeElementWrapper::ExeElementWrapper
ExeElementWrapper(Executable *exe)
Definition
ExeElementWrapper.cpp:3
ExeElementWrapper::containsDataType
virtual WrappedValue::data_type containsDataType(size_t fieldId, size_t subField=FIELD_NONE)
Definition
ExeElementWrapper.h:48
ExeElementWrapper::getOffset
virtual offset_t getOffset()
Definition
ExeElementWrapper.cpp:39
ExeElementWrapper::copyToOffset
bool copyToOffset(offset_t rawOffset)
Definition
ExeElementWrapper.cpp:102
ExeElementWrapper::Executable
friend class Executable
Definition
ExeElementWrapper.h:67
ExeElementWrapper::m_Exe
Executable * m_Exe
Definition
ExeElementWrapper.h:65
ExeElementWrapper::getNumValue
virtual uint64_t getNumValue(size_t fieldId, size_t subField, bool *isOk)
Definition
ExeElementWrapper.cpp:73
WrappedValue
Definition
WrappedValue.h:12
WrappedValue::data_type
data_type
Definition
WrappedValue.h:15
Logger::append
bool append(dbg_level lvl, const char *format,...)
Definition
Util.cpp:8
Logger::D_ERROR
@ D_ERROR
Definition
Util.h:26
Generated by
1.17.0