4#define INVALID_NAME "<invalid>"
27 if (ptr == NULL)
return NULL;
29 return (IMAGE_EXPORT_DIRECTORY*) ptr;
40 IMAGE_EXPORT_DIRECTORY* exp =
exportDir();
41 if (exp == NULL)
return 0;
43 size_t maxNames = exp->NumberOfNames;
45 offset_t nameOrdRVA = exp->AddressOfNameOrdinals;
48 for (i = 0; i < maxNames; i++) {
52 if (nameOrd == NULL)
break;
56 nameOrdRVA +=
sizeof(WORD);
67 IMAGE_EXPORT_DIRECTORY* exp =
exportDir();
68 if (exp == NULL)
return 0;
70 size_t maxFunc = exp->NumberOfFunctions;
72 for (
size_t i = 0; i < maxFunc; i++) {
75 if (entry->
getPtr() == NULL) {
86 if (
getPtr() == NULL)
return 0;
87 return sizeof(IMAGE_EXPORT_DIRECTORY);
92 QString infoName =
"Export";
94 if (libName.length() >= 0) {
95 infoName +=
": "+ libName;
103 if (d == NULL)
return NULL;
107 case TIMESTAMP:
return &d->TimeDateStamp;
111 case BASE:
return &d->Base;
113 case NAMES_NUM:
return &d->NumberOfNames;
128 return "ReproChecksum";
130 return "TimeDateStamp";
135 case BASE:
return "Base";
161 if (!isOk)
return NULL;
167 if (!ptr)
return NULL;
175 if (!name)
return name;
180 return QString(name);
188 case NAME_RVA:
return getFuncNameRvaPtr();
193DWORD* ExportEntryWrapper::getFuncRvaPtr()
195 if (this->parentDir == NULL)
return NULL;
196 IMAGE_EXPORT_DIRECTORY* exp = parentDir->
exportDir();
197 if (exp == NULL)
return NULL;
199 uint64_t funcRva = exp->AddressOfFunctions;
200 funcRva += (this->
entryNum *
sizeof(DWORD));
208 if (this->parentDir == NULL || parentDir->
exportDir() == NULL) {
211 return sizeof(DWORD);
225 QTextStream(&ordStr) <<
"<ord: " << QString::number(val, 16) <<
">";
229 if (name == NULL)
return "";
230 return QString(name);
237 case NAME_RVA:
return "FuncNameRva";
244 DWORD *ptr = this->getFuncRvaPtr();
252 if (this->parentDir == NULL)
return 0;
253 IMAGE_EXPORT_DIRECTORY* exp = parentDir->
exportDir();
254 if (exp == NULL)
return 0;
256 uint32_t ordinal =
static_cast<uint32_t
>(this->
entryNum) + exp->Base;
260uint32_t ExportEntryWrapper::getFuncNameId()
262 if (this->parentDir == NULL)
return INVALID_ID;
264 WORD ord =
static_cast<WORD
>(this->
entryNum);
265 std::map<WORD, DWORD>::iterator found = parentDir->
ordToNameId.find(ord);
269 return found->second;
272void* ExportEntryWrapper::getFuncNameRvaPtr()
274 uint32_t nameId = getFuncNameId();
277 IMAGE_EXPORT_DIRECTORY* exp = parentDir->
exportDir();
278 if (exp == NULL)
return NULL;
280 if (nameId >= exp->NumberOfNames)
return NULL;
282 uint64_t nameAddrRVA = exp->AddressOfNames + (nameId *
sizeof(DWORD));
289 DWORD* valuePtr = (DWORD*) getFuncNameRvaPtr();
291 DWORD value = (*valuePtr);
292 return static_cast<offset_t>(value);
301 if (name == NULL)
return NULL;
308 if (this->parentDir == NULL)
return NULL;
309 IMAGE_EXPORT_DIRECTORY* exp = parentDir->
exportDir();
310 if (exp == NULL)
return NULL;
312 DWORD* funcRvaPtr = (DWORD*) this->getFuncRvaPtr();
313 if (funcRvaPtr == NULL)
return NULL;
316 if (strPtr == NULL)
return NULL;
323 if (forwarderNameLen > 0) {
const offset_t INVALID_ADDR
virtual offset_t getOffset(void *ptr, bool allowExceptions=false)
offset_t getDirEntryAddress()
virtual uint64_t getNumValue(size_t fieldId, size_t subField, bool *isOk)
std::vector< ExeNodeWrapper * > entries
BYTE * getContentAt(offset_t offset, bufsize_t size, bool allowExceptions=false)
virtual offset_t getRawSize() const
virtual QString getLibraryName()
std::map< WORD, DWORD > ordToNameId
virtual void * getFieldPtr(size_t fieldId, size_t subField)
IMAGE_EXPORT_DIRECTORY * exportDir()
virtual QString getName()
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField=FIELD_NONE)
virtual QString getFieldName(size_t fieldId)
virtual bufsize_t getSize()
friend class ExportEntryWrapper
virtual QString getFieldName(size_t fieldId)
virtual bufsize_t getSize()
offset_t getFuncNameRva()
virtual void * getFieldPtr(size_t fieldId, size_t subField=FIELD_NONE)
virtual QString getName()
size_t forwarderNameLen(const char *ptr, size_t max_len)
bool isStrLonger(const char *inp, size_t maxLen)