10 const time_t rawtime = (
const time_t)timestamp;
11 QString format =
"dddd, dd.MM.yyyy hh:mm:ss";
12#if QT_VERSION >= QT_VERSION_CHECK(6, 0, 0)
13 QDateTime date1(QDateTime::fromSecsSinceEpoch(rawtime));
15 QDateTime date1(QDateTime::fromTime_t(rawtime));
17 return date1.toUTC().toString(format) +
" UTC";
30 s_fHdrCharact[F_RELOCS_STRIPPED] =
"Relocation info stripped from file.";
31 s_fHdrCharact[F_EXECUTABLE_IMAGE] =
"File is executable (i.e. no unresolved external references).";
32 s_fHdrCharact[F_LINE_NUMS_STRIPPED] =
"Line numbers stripped from file.";
33 s_fHdrCharact[F_LOCAL_SYMS_STRIPPED] =
"Local symbols stripped from file.";
34 s_fHdrCharact[F_AGGRESIVE_WS_TRIM] =
"Aggressively trim working set";
35 s_fHdrCharact[F_LARGE_ADDRESS_AWARE] =
"App can handle >2gb addresses";
36 s_fHdrCharact[F_BYTES_REVERSED_LO] =
"Bytes of machine word are reversed.";
38 s_fHdrCharact[F_DEBUG_STRIPPED] =
"Debugging info stripped from file in .DBG file";
39 s_fHdrCharact[F_REMOVABLE_RUN_FROM_SWAP] =
"If Image is on removable media, copy and run from the swap file.";
40 s_fHdrCharact[F_NET_RUN_FROM_SWAP] =
"If Image is on Net, copy and run from the swap file.";
43 s_fHdrCharact[F_UP_SYSTEM_ONLY] =
"File should only be run on a UP machine";
44 s_fHdrCharact[F_BYTES_REVERSED_HI] =
"Bytes of machine word are reversed.";
51 std::vector<DWORD> chSet;
53 if (characteristics & iter->first) {
54 chSet.push_back(iter->first);
71 s_machine[M_UNKNOWN] =
"s_machine unknown";
74 s_machine[M_R3000] =
"MIPS little-endian, 0x160 big-endian";
75 s_machine[M_R4000] =
"MIPS little-endian";
76 s_machine[M_R10000] =
"MIPS little-endian";
77 s_machine[M_WCEMIPSV2] =
" MIPS little-endian WCE v2";
88 s_machine[M_POWERPC] =
"IBM PowerPC Little-Endian";
100 s_machine[M_M32R] =
"M32R little-endian";
102 s_machine[M_RISCV32] =
"RISC-V 32-bit Address Space";
103 s_machine[M_RISCV64] =
"RISC-V 64-bit Address Space";
104 s_machine[M_RISCV128] =
"RISC-V 128-bit Address Space";
105 s_machine[M_ARM64LE] =
"ARM64 Little Endian";
106 s_machine[M_LOONGARCH32] =
"LoongArch 32-bit Processor Family";
107 s_machine[M_LOONGARCH64] =
"LoongArch 64-bit Processor Family";
108 s_machine[M_LINUXDOTNET64] =
"AMD64 .Net For Linux";
109 s_machine[M_OSXDOTNET64] =
"AMD64 .Net For Mac OS";
110 s_machine[M_FREEBSDDOTNET64] =
"AMD64 .Net For Free BSD";
111 s_machine[M_NETBSDDOTNET64] =
"AMD64 .Net For Net BSD";
112 s_machine[M_SUNDOTNET64] =
"AMD64 .Net For Sun (Oracle Solaris)";
113 s_machine[M_LINUXDOTNET32] =
"Intel 386 .Net For Linux";
114 s_machine[M_OSXDOTNET32] =
"Intel 386 .Net For Mac OS";
115 s_machine[M_FREEBSDDOTNET32] =
"Intel 386 .Net For Free BSD";
116 s_machine[M_NETBSDDOTNET32] =
"Intel 386 .Net For Net BSD";
117 s_machine[M_SUNDOTNET32] =
"Intel 386 .Net For Sun (Oracle Solaris)";
135 if (
m_PE == NULL)
return NULL;
138 IMAGE_FILE_HEADER* hdr = (IMAGE_FILE_HEADER*)
m_Exe->
getContentAt(myOff,
sizeof(IMAGE_FILE_HEADER));
139 if (!hdr)
return NULL;
146 IMAGE_FILE_HEADER * hdr =
reinterpret_cast<IMAGE_FILE_HEADER*
>(
getPtr());
147 if (!hdr)
return NULL;
149 IMAGE_FILE_HEADER &fileHeader = (*hdr);
151 case MACHINE:
return (
void*) &fileHeader.Machine;
152 case SEC_NUM:
return (
void*) &fileHeader.NumberOfSections;
153 case TIMESTAMP:
return (
void*) &fileHeader.TimeDateStamp;
154 case SYMBOL_PTR:
return (
void*) &fileHeader.PointerToSymbolTable;
155 case SYMBOL_NUM:
return (
void*) &fileHeader.NumberOfSymbols;
156 case OPTHDR_SIZE:
return (
void*) &fileHeader.SizeOfOptionalHeader;
157 case CHARACT:
return (
void*) &fileHeader.Characteristics;
159 return (
void*) &fileHeader;
165 case MACHINE:
return(
"Machine");
166 case SEC_NUM:
return (
"Sections Count");
170 return "ReproChecksum";
172 return(
"Time Date Stamp");
174 case SYMBOL_PTR:
return(
"Ptr to Symbol Table");
176 case OPTHDR_SIZE:
return(
"Size of OptionalHeader");
177 case CHARACT:
return(
"Characteristics");
189 IMAGE_FILE_HEADER * hdr =
reinterpret_cast<IMAGE_FILE_HEADER*
>(
getPtr());
192 IMAGE_FILE_HEADER &fileHeader = (*hdr);
BYTE * getContentAt(offset_t offset, bufsize_t size, bool allowExceptions=false)
static QString translateMachine(DWORD val)
virtual QString translateFieldContent(size_t fieldId)
virtual void * getFieldPtr(size_t fieldId, size_t subField=FIELD_NONE)
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField=FIELD_NONE)
static std::vector< DWORD > splitCharact(DWORD characteristics)
virtual QString getFieldName(size_t fieldId)
static void initCharact()
static std::map< DWORD, QString > s_fHdrCharact
static std::map< DWORD, QString > s_machine
static void initMachine()
static QString translateCharacteristics(DWORD charact)
offset_t peFileHdrOffset() const
QString getDateString(const quint64 timestamp)