BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
ImportBaseDirWrapper.h
Go to the documentation of this file.
1#pragma once
2
4#include "../Util.h"
5
9
10namespace imports_util {
11// inline uint64_t getUpperLimit(Executable *pe, void* fieldPtr);
12 inline bool isNameValid(Executable *pe, char* myName);
13};
14
16{
17public:
19
20 virtual bool wrap();
21 virtual bool isValid();
22
23 virtual void clearMapping();
24 virtual void reloadMapping();
25 virtual size_t getFieldsCount() { return this->importsCount; }
26
27 virtual void* getFieldPtr(size_t fieldId, size_t subField) { return getSubfieldPtr(fieldId, subField ); }
28 virtual QString getFieldName(size_t fieldId, size_t subField) { return getSubfieldName(fieldId, subField ); }
29 virtual QString getFieldName(size_t fieldId) { return getFieldName(fieldId, FIELD_NONE); }
30 virtual bufsize_t getFieldSize(size_t fieldId, size_t subField = FIELD_NONE) { return getSubfieldSize(fieldId, subField); }
31
32 QString thunkToFuncName(offset_t thunk, bool shortName=true);
33 QString thunkToLibName(offset_t thunk);
34
35 QList<offset_t> getThunksList() { return this->thunksList; }
36
37 bool hasThunk(offset_t thunk) {
38 std::map<offset_t, size_t>::iterator libItr = thunkToLibMap.find(thunk);
39 return (libItr != thunkToLibMap.end());
40 }
41
43
44protected:
45 ImportBaseDirWrapper(PEFile *pe, pe:: dir_entry v_entryType)
46 : DataDirEntryWrapper(pe, v_entryType),
48 {
49 }
50
51 //virtual bool loadNextEntry(size_t entryNum) = 0;
52
53 void addMapping(ExeNodeWrapper *func);
55 //---
56 std::map<offset_t, size_t> thunkToLibMap;
57 QList<offset_t> thunksList;
58
61
63};
64
65
67{
68public:
70
71 virtual char* getLibraryName() = 0;
72 virtual size_t getSubFieldsCount() { return 1; }
73 bool wrap();
74 virtual bool isValid();
75
76protected:
77 ImportBaseEntryWrapper(PEFile *pe, ImportBaseDirWrapper *importsDir, size_t entryNumber)
78 : PENodeWrapper(pe, importsDir, entryNumber),
79 impDir(importsDir), invalidEntries(0)
80 {
81 }
82
83 void addMapping(ExeNodeWrapper *func) { if (impDir) impDir->addMapping(func); }
84
85 std::map<offset_t, size_t> thunkToFuncMap;
87
89
91};
92
94{
95public:
96 ImportBaseFuncWrapper(PEFile *pe, ImportBaseEntryWrapper* parentLib, size_t entryNumber)
97 : PENodeWrapper(pe, parentLib, entryNumber) { }
98
99 virtual QString getName();
100 QString getShortName();
101 QString getLibName();
102
103 virtual bool isValid();
104
105 virtual bool isByOrdinal() = 0;
106 virtual uint64_t getOrdinal() = 0;
107 virtual char* getFunctionName() = 0;
108
109 virtual offset_t callVia() = 0;
110
112 {
113 size_t val = (isBit64()) ? sizeof(uint64_t) : sizeof(uint32_t);
114 return static_cast<bufsize_t>(val);
115 }
116
117 inline bufsize_t getThunkValSize() { return getAddrSize(); }
118
120};
121
uint32_t bufsize_t
uint64_t offset_t
#define FIELD_NONE
virtual void * getSubfieldPtr(size_t fieldId, size_t subField)
virtual QString getSubfieldName(size_t fieldId, size_t subField)
virtual bufsize_t getSubfieldSize(size_t fieldId, size_t subField)
static bufsize_t thunkSize(Executable::exe_bits bits)
ImportBaseEntryWrapper * thunkToLib(offset_t thunk)
QList< offset_t > thunksList
virtual QString getFieldName(size_t fieldId, size_t subField)
bool hasThunk(offset_t thunk)
std::map< offset_t, size_t > thunkToLibMap
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField=FIELD_NONE)
QList< offset_t > getThunksList()
QString thunkToLibName(offset_t thunk)
ImportBaseFuncWrapper * thunkToFunction(offset_t thunk)
virtual QString getFieldName(size_t fieldId)
void addMapping(ExeNodeWrapper *func)
QString thunkToFuncName(offset_t thunk, bool shortName=true)
ImportBaseDirWrapper(PEFile *pe, pe::dir_entry v_entryType)
virtual size_t getFieldsCount()
virtual void * getFieldPtr(size_t fieldId, size_t subField)
size_t invalidEntries
ImportBaseDirWrapper * impDir
virtual size_t getSubFieldsCount()
static bufsize_t NameLenLimit
bool wrap()
void addMapping(ExeNodeWrapper *func)
virtual bool isValid()
ImportBaseEntryWrapper(PEFile *pe, ImportBaseDirWrapper *importsDir, size_t entryNumber)
virtual char * getLibraryName()=0
std::map< offset_t, size_t > thunkToFuncMap
virtual uint64_t getOrdinal()=0
virtual char * getFunctionName()=0
virtual offset_t callVia()=0
virtual bool isByOrdinal()=0
ImportBaseFuncWrapper(PEFile *pe, ImportBaseEntryWrapper *parentLib, size_t entryNumber)
bool isNameValid(Executable *pe, char *myName)