ImportDirWrapper.h

Go to the documentation of this file.

#pragma once
 
#include "ImportBaseDirWrapper.h"
#include "pe_formats.h"
 
/*
typedef struct _IMAGE_THUNK_DATA32 {
    union {
        DWORD ForwarderString;    // PBYTE
        DWORD Function;        // PDWORD
        DWORD Ordinal;
        DWORD AddressOfData;    // PIMAGE_IMPORT_BY_NAME
    } u1;
} IMAGE_THUNK_DATA32;
 
typedef struct _IMAGE_THUNK_DATA64 {
    union {
        ULONGLONG ForwarderString;    // PBYTE
        ULONGLONG Function;        // PDWORD
        ULONGLONG Ordinal;
        ULONGLONG AddressOfData;    //PIMAGE_IMPORT_BY_NAME
    } u1;
} IMAGE_THUNK_DATA64;
*/
 
class ImportDirWrapper;
class ImportEntryWrapper;
class ImportedFuncWrapper;
 
class ImportDirWrapper : public ImportBaseDirWrapper
{
public:
    ImportDirWrapper(PEFile *pe)
        : ImportBaseDirWrapper(pe, pe::DIR_IMPORT) { wrap(); }
 
    virtual void* getPtr() { return firstDescriptor(); }
    virtual bufsize_t getSize();
    virtual QString getName() { return "Imports"; }
 
protected:
    virtual bool loadNextEntry(size_t cntr);
 
    IMAGE_DATA_DIRECTORY* getDataDirectory();
    IMAGE_IMPORT_DESCRIPTOR *firstDescriptor();
 
friend class ImportEntryWrapper;
};
 
 
class ImportEntryWrapper : public ImportBaseEntryWrapper
{
public:
    /* fields :*/
    enum FieldID {
        NONE = FIELD_NONE,
        ORIG_FIRST_THUNK,
        TIMESTAMP,
        FORWARDER,
        NAME,
        FIRST_THUNK,
        FIELD_COUNTER
    };
 
    ImportEntryWrapper(PEFile *pe, ImportDirWrapper *importsDir, size_t entryNumber)
        : ImportBaseEntryWrapper(pe, importsDir, entryNumber) { wrap(); }
 
    //virtual bool wrap();
    //bool isValid();
 
    /* full structure boundaries */
    virtual void* getPtr();
 
    virtual bufsize_t getSize();
    bool isBound();
    virtual QString getName();
    virtual size_t getFieldsCount() { return FIELD_COUNTER; }
 
    /* specific field boundaries */
    virtual void* getFieldPtr(size_t fieldId, size_t subField = FIELD_NONE);
    virtual QString getFieldName(size_t fieldId);
    virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField = FIELD_NONE);
 
    bufsize_t geEntrySize()
    {
        if (m_Exe == NULL) return 0;
        return ImportBaseDirWrapper::thunkSize(m_Exe->getBitMode());
    }
 
    virtual offset_t getNextEntryOffset()
    {
         offset_t nextOffset = INVALID_ADDR;
        //get after existing entries:
        if (this->getEntriesCount() > 0) {
            return ExeNodeWrapper::getNextEntryOffset();
        }
        //get by thunk:
        IMAGE_IMPORT_DESCRIPTOR* desc = (IMAGE_IMPORT_DESCRIPTOR*) this->getPtr();
        if (!desc) return INVALID_ADDR;
 
        offset_t firstThunk = desc->FirstThunk;
        if (firstThunk == 0) {
            firstThunk = desc->OriginalFirstThunk;
        }
        nextOffset = m_Exe->convertAddr(desc->FirstThunk, Executable::RVA, Executable::RAW);
        return nextOffset;
    }
 
    char* getLibraryName();
 
protected:
     bool loadNextEntry(size_t entryNum);
 
friend class ImportDirWrapper;
};
 
class ImportedFuncWrapper : public ImportBaseFuncWrapper
{
public:
    /* fields :*/
    enum FieldID {
        NONE = FIELD_NONE,
        ORIG_THUNK,
        THUNK,
        FORWARDER,
        HINT,
        FIELD_COUNTER
    };
 
    ImportedFuncWrapper(PEFile *pe, ImportEntryWrapper* parentLib, size_t entryNumber)
        : ImportBaseFuncWrapper(pe, parentLib, entryNumber) {}// this->parentLib = parentLib; }
 
    /* full structure boundaries */
    virtual void* getPtr();
    virtual IMAGE_IMPORT_BY_NAME* getImportByNamePtr();
 
    virtual bufsize_t getSize();
    //virtual QString getName();
    virtual size_t getFieldsCount() { return FIELD_COUNTER; }
    virtual size_t getSubFieldsCount() { return 1; }
 
    /* specific field boundaries */
    virtual void* getFieldPtr(size_t fieldId, size_t subField = FIELD_NONE);
    virtual bufsize_t getFieldSize(size_t fieldId, size_t subField = FIELD_NONE);
    virtual QString getFieldName(size_t fieldId);
    virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField = FIELD_NONE);
 
    uint64_t getThunkValue();
 
    offset_t getFieldRVA(ImportEntryWrapper::FieldID fId);
    void* getValuePtr(ImportEntryWrapper::FieldID fId);
 
    virtual offset_t callVia() { return getFieldRVA(ImportEntryWrapper::FIRST_THUNK); }
    bool isByOrdinal();
    virtual uint64_t getOrdinal() { return getThunkValue(); }
    char* getFunctionName();
 
friend class ImportDirWrapper;
};