BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
ExeElementWrapper.h
Go to the documentation of this file.
1#pragma once
2
3#include <QtCore>
4#include "CustomException.h"
5#include "win_hdrs/win_types.h"
6#include "Executable.h"
7#include "WrappedValue.h"
8
9#define FIELD_NONE (-1)
10
12{
13public:
15 virtual ~ExeElementWrapper() {}
16
17 virtual bool wrap() { return true; }
18
19 /* inherited from: AbstractByteBuffer */
20 virtual bufsize_t getContentSize() { return getSize(); }
21 virtual BYTE* getContent() { return static_cast<BYTE*>(getPtr()); }
22
23 /* full structure boundaries */
24 virtual void* getPtr() = 0;
25 virtual bufsize_t getSize() = 0;
26 virtual QString getName() = 0;
27
28 virtual size_t getFieldsCount() = 0;
29 virtual size_t getSubFieldsCount() { return 1; }
30
31 virtual offset_t getOffset();
32 virtual offset_t getOffset(void *ptr, bool allowExceptions = false);
33
34 /* specific field boundaries */
35 virtual void* getFieldPtr(size_t fieldId, size_t subField) = 0;
36 void* getFieldPtr(size_t fieldId) { return getFieldPtr(fieldId, FIELD_NONE); }
37 virtual bufsize_t getFieldSize(size_t fieldId, size_t subField = FIELD_NONE);
38 virtual offset_t getFieldOffset(size_t fieldId, size_t subField = FIELD_NONE);
39
40 virtual QString translateFieldContent(size_t fieldId) { return ""; }
41 virtual bool hasSubfieldWrapper(size_t parentType) { return false; }
42
43 virtual QString getFieldName(size_t fieldId) = 0;
44 virtual WrappedValue getWrappedValue(size_t fieldId, size_t subField);
45 virtual WrappedValue getWrappedValue(size_t fieldId) { return getWrappedValue(fieldId, FIELD_NONE); }
46
47 virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField = FIELD_NONE) { return Executable::NOT_ADDR; }
48 virtual WrappedValue::data_type containsDataType(size_t fieldId, size_t subField = FIELD_NONE) { return WrappedValue::INT; }
49
50 virtual uint64_t getNumValue(size_t fieldId, size_t subField, bool* isOk);
51 uint64_t getNumValue(size_t fieldId, bool* isOk) { return getNumValue(fieldId, FIELD_NONE, isOk); }
52
53 virtual bool setNumValue(size_t fieldId, size_t subField, uint64_t val);
54 bool setNumValue(size_t fieldId, uint64_t val) { return setNumValue(fieldId, FIELD_NONE, val); }
55
56 Executable* getExe() { return m_Exe; }
57
58 inline bool isBit64() { return Executable::isBit64(m_Exe); }
59 inline bool isBit32() { return Executable::isBit32(m_Exe); }
60
61protected:
62 virtual bool canCopyToOffset(offset_t rawOffset);
63 bool copyToOffset(offset_t rawOffset);
64
66
67friend class Executable;
68};
69
uint32_t bufsize_t
uint64_t offset_t
#define FIELD_NONE
virtual bufsize_t getSize()=0
virtual bufsize_t getContentSize()
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField=FIELD_NONE)
virtual bool setNumValue(size_t fieldId, size_t subField, uint64_t val)
virtual bool canCopyToOffset(offset_t rawOffset)
virtual void * getPtr()=0
virtual bool hasSubfieldWrapper(size_t parentType)
virtual WrappedValue getWrappedValue(size_t fieldId)
virtual void * getFieldPtr(size_t fieldId, size_t subField)=0
virtual offset_t getFieldOffset(size_t fieldId, size_t subField=FIELD_NONE)
virtual size_t getFieldsCount()=0
virtual WrappedValue getWrappedValue(size_t fieldId, size_t subField)
bool setNumValue(size_t fieldId, uint64_t val)
virtual size_t getSubFieldsCount()
virtual QString getFieldName(size_t fieldId)=0
virtual BYTE * getContent()
ExeElementWrapper(Executable *exe)
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField=FIELD_NONE)
virtual WrappedValue::data_type containsDataType(size_t fieldId, size_t subField=FIELD_NONE)
virtual offset_t getOffset()
bool copyToOffset(offset_t rawOffset)
uint64_t getNumValue(size_t fieldId, bool *isOk)
virtual QString translateFieldContent(size_t fieldId)
Executable * getExe()
void * getFieldPtr(size_t fieldId)
virtual bool wrap()
virtual QString getName()=0
virtual uint64_t getNumValue(size_t fieldId, size_t subField, bool *isOk)
bool isBit32()
Definition Executable.h:52
bool isBit64()
Definition Executable.h:51