BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
FileHdrWrapper.cpp
Go to the documentation of this file.
1#include "pe/FileHdrWrapper.h"
2#include "pe/PEFile.h"
3
4#include <time.h>
5#include <QDateTime>
6
7namespace util {
8 QString getDateString(const quint64 timestamp)
9 {
10 const time_t rawtime = (const time_t)timestamp;
11 QString format = "dddd, dd.MM.yyyy hh:mm:ss";
12#if QT_VERSION >= QT_VERSION_CHECK(6, 0, 0)
13 QDateTime date1(QDateTime::fromSecsSinceEpoch(rawtime));
14#else
15 QDateTime date1(QDateTime::fromTime_t(rawtime));
16#endif
17 return date1.toUTC().toString(format) + " UTC";
18 }
19};
20
21
22std::map<DWORD, QString> FileHdrWrapper::s_fHdrCharact;
23std::map<DWORD, QString> FileHdrWrapper::s_machine;
24
26{
27 if (s_fHdrCharact.size() != 0) {
28 return; //already initialized
29 }
30 s_fHdrCharact[F_RELOCS_STRIPPED] = "Relocation info stripped from file.";
31 s_fHdrCharact[F_EXECUTABLE_IMAGE] = "File is executable (i.e. no unresolved external references).";
32 s_fHdrCharact[F_LINE_NUMS_STRIPPED] = "Line numbers stripped from file.";
33 s_fHdrCharact[F_LOCAL_SYMS_STRIPPED] = "Local symbols stripped from file.";
34 s_fHdrCharact[F_AGGRESIVE_WS_TRIM] = "Aggressively trim working set";
35 s_fHdrCharact[F_LARGE_ADDRESS_AWARE] = "App can handle >2gb addresses";
36 s_fHdrCharact[F_BYTES_REVERSED_LO] = "Bytes of machine word are reversed.";
37 s_fHdrCharact[F_MACHINE_32BIT] = "32 bit word machine.";
38 s_fHdrCharact[F_DEBUG_STRIPPED] = "Debugging info stripped from file in .DBG file";
39 s_fHdrCharact[F_REMOVABLE_RUN_FROM_SWAP] = "If Image is on removable media, copy and run from the swap file.";
40 s_fHdrCharact[F_NET_RUN_FROM_SWAP] = "If Image is on Net, copy and run from the swap file.";
41 s_fHdrCharact[F_SYSTEM] = "System File.";
42 s_fHdrCharact[F_DLL] = "File is a DLL.";
43 s_fHdrCharact[F_UP_SYSTEM_ONLY] = "File should only be run on a UP machine";
44 s_fHdrCharact[F_BYTES_REVERSED_HI] = "Bytes of machine word are reversed.";
45}
46
47std::vector<DWORD> FileHdrWrapper::splitCharact(DWORD characteristics)
48{
49 if (s_fHdrCharact.size() == 0) initCharact();
50
51 std::vector<DWORD> chSet;
52 for (std::map<DWORD, QString>::iterator iter = s_fHdrCharact.begin(); iter != s_fHdrCharact.end(); ++iter) {
53 if (characteristics & iter->first) {
54 chSet.push_back(iter->first);
55 }
56 }
57 return chSet;
58}
59
61{
62 if (s_fHdrCharact.size() == 0)
64
65 if (s_fHdrCharact.find(charact) == s_fHdrCharact.end()) return "";
66 return s_fHdrCharact[charact];
67}
68
70{
71 s_machine[M_UNKNOWN] = "s_machine unknown";
72
73 s_machine[M_I386] = "Intel 386";
74 s_machine[M_R3000] = "MIPS little-endian, 0x160 big-endian";
75 s_machine[M_R4000] = "MIPS little-endian";
76 s_machine[M_R10000] = "MIPS little-endian";
77 s_machine[M_WCEMIPSV2] = " MIPS little-endian WCE v2";
78 s_machine[M_ALPHA] = "Alpha_AXP";
79 s_machine[M_SH3] = "SH3 little-endian";
80 s_machine[M_SH3DSP] = "SH3DSP";
81 s_machine[M_SH3E] = "SH3E little-endian";
82 s_machine[M_SH4] = "SH4 little-endian";
83 s_machine[M_SH5] = "SH5";
84 s_machine[M_ARM] = "ARM Little-Endian";
85 s_machine[M_THUMB] = "Thumb";
86 s_machine[M_THUMB2] = "Thumb2";
87 s_machine[M_AM33] = "AM33";
88 s_machine[M_POWERPC] = "IBM PowerPC Little-Endian";
89 s_machine[M_POWERPCFP] = "PowerRPCFP";
90 s_machine[M_IA64] = "Intel 64";
91 s_machine[M_MIPS16] = "MIPS";
92 s_machine[M_ALPHA64] = "ALPHA64";
93 s_machine[M_MIPSFPU] = "MIPS";
94 s_machine[M_MIPSFPU16] = "MIPS";
95 s_machine[M_AXP64] = "M_ALPHA64";
96 s_machine[M_TRICORE] = " Infineon";
97 s_machine[M_CEF] = "CEF";
98 s_machine[M_EBC] = "EFI Byte Code";
99 s_machine[M_AMD64] = "AMD64 (K8)";
100 s_machine[M_M32R] = "M32R little-endian";
101 s_machine[M_CEE] = "CEE";
102 s_machine[M_RISCV32] = "RISC-V 32-bit Address Space";
103 s_machine[M_RISCV64] = "RISC-V 64-bit Address Space";
104 s_machine[M_RISCV128] = "RISC-V 128-bit Address Space";
105 s_machine[M_ARM64LE] = "ARM64 Little Endian";
106 s_machine[M_LOONGARCH32] = "LoongArch 32-bit Processor Family";
107 s_machine[M_LOONGARCH64] = "LoongArch 64-bit Processor Family";
108 s_machine[M_LINUXDOTNET64] = "AMD64 .Net For Linux";
109 s_machine[M_OSXDOTNET64] = "AMD64 .Net For Mac OS";
110 s_machine[M_FREEBSDDOTNET64] = "AMD64 .Net For Free BSD";
111 s_machine[M_NETBSDDOTNET64] = "AMD64 .Net For Net BSD";
112 s_machine[M_SUNDOTNET64] = "AMD64 .Net For Sun (Oracle Solaris)";
113 s_machine[M_LINUXDOTNET32] = "Intel 386 .Net For Linux";
114 s_machine[M_OSXDOTNET32] = "Intel 386 .Net For Mac OS";
115 s_machine[M_FREEBSDDOTNET32] = "Intel 386 .Net For Free BSD";
116 s_machine[M_NETBSDDOTNET32] = "Intel 386 .Net For Net BSD";
117 s_machine[M_SUNDOTNET32] = "Intel 386 .Net For Sun (Oracle Solaris)";
118}
119
121{
122 if (s_machine.size() == 0)
123 initMachine();
124
125 if (s_machine.find(val) == s_machine.end()) return "";
126 return s_machine[val];
127}
128
130{
131 if (this->hdr) {
132 // use cached if exists
133 return (void*) hdr;
134 }
135 if (m_PE == NULL) return NULL;
136
137 offset_t myOff = m_PE->peFileHdrOffset();
138 IMAGE_FILE_HEADER* hdr = (IMAGE_FILE_HEADER*) m_Exe->getContentAt(myOff, sizeof(IMAGE_FILE_HEADER));
139 if (!hdr) return NULL; //error
140
141 return (void*) hdr;
142}
143
144void* FileHdrWrapper::getFieldPtr(size_t fieldId, size_t subField)
145{
146 IMAGE_FILE_HEADER * hdr = reinterpret_cast<IMAGE_FILE_HEADER*>(getPtr());
147 if (!hdr) return NULL;
148
149 IMAGE_FILE_HEADER &fileHeader = (*hdr);
150 switch (fieldId) {
151 case MACHINE: return (void*) &fileHeader.Machine;
152 case SEC_NUM: return (void*) &fileHeader.NumberOfSections;
153 case TIMESTAMP: return (void*) &fileHeader.TimeDateStamp;
154 case SYMBOL_PTR: return (void*) &fileHeader.PointerToSymbolTable;
155 case SYMBOL_NUM: return (void*) &fileHeader.NumberOfSymbols;
156 case OPTHDR_SIZE: return (void*) &fileHeader.SizeOfOptionalHeader;
157 case CHARACT: return (void*) &fileHeader.Characteristics;
158 }
159 return (void*) &fileHeader;
160}
161
162QString FileHdrWrapper::getFieldName(size_t fieldId)
163{
164 switch (fieldId) {
165 case MACHINE: return("Machine");
166 case SEC_NUM: return ("Sections Count");
167 case TIMESTAMP: {
168 PEFile* myPe = dynamic_cast<PEFile*>(this->m_Exe);
169 if (myPe && myPe->isReproBuild()) {
170 return "ReproChecksum";
171 }
172 return("Time Date Stamp");
173 }
174 case SYMBOL_PTR: return("Ptr to Symbol Table");
175 case SYMBOL_NUM: return("Num. of Symbols");
176 case OPTHDR_SIZE: return("Size of OptionalHeader");
177 case CHARACT: return("Characteristics");
178 }
179 return "";
180}
181
183{
185}
186
188{
189 IMAGE_FILE_HEADER * hdr = reinterpret_cast<IMAGE_FILE_HEADER*>(getPtr());
190 if (!hdr) return "";
191
192 IMAGE_FILE_HEADER &fileHeader = (*hdr);
193 switch (fieldId) {
194 case MACHINE: return FileHdrWrapper::translateMachine(fileHeader.Machine);
195 case TIMESTAMP: {
196 PEFile* myPe = dynamic_cast<PEFile*>(this->m_Exe);
197 if (myPe && myPe->isReproBuild()) {
198 return ""; // This is not a real timestamp
199 }
200 return util::getDateString(fileHeader.TimeDateStamp);
201 }
202 }
203 return "";
204}
205
uint64_t offset_t
BYTE * getContentAt(offset_t offset, bufsize_t size, bool allowExceptions=false)
Definition Executable.h:65
static QString translateMachine(DWORD val)
virtual QString translateFieldContent(size_t fieldId)
virtual void * getFieldPtr(size_t fieldId, size_t subField=FIELD_NONE)
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField=FIELD_NONE)
static std::vector< DWORD > splitCharact(DWORD characteristics)
virtual void * getPtr()
virtual QString getFieldName(size_t fieldId)
static void initCharact()
static std::map< DWORD, QString > s_fHdrCharact
static std::map< DWORD, QString > s_machine
static void initMachine()
static QString translateCharacteristics(DWORD charact)
offset_t peFileHdrOffset() const
Definition PEFile.h:77
bool isReproBuild()
Definition PEFile.h:336
QString getDateString(const quint64 timestamp)