BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
LdConfigDirWrapper.h
Go to the documentation of this file.
1#pragma once
3#include <set>
4
6{
7public:
18 SIZE = 0,
30 PROC_HEAP_FLAGS32, // PROC_AFF_MASK64
31 PROC_AFF_MASK32, // PROC_HEAP_FLAGS32
38 FIELD_COUNTER_OLD, //end of old LoadConfigDir
44 FIELD_COUNTER_W81, //end of old LoadConfigDir Win8.1
45 CODE_INTEGRITY_FLAGS = FIELD_COUNTER_W81, //IMAGE_LOAD_CONFIG_CODE_INTEGRITY.Flags
46 CODE_INTEGRITY_CATALOG = CODE_INTEGRITY_FLAGS + 1, //IMAGE_LOAD_CONFIG_CODE_INTEGRITY.Catalog
47 CODE_INTEGRITY_CATALOG_OFFSET, //IMAGE_LOAD_CONFIG_CODE_INTEGRITY.CatalogOffset
48 CODE_INTEGRITY_RESERVED, //IMAGE_LOAD_CONFIG_CODE_INTEGRITY.Reserved
67 FIELD_COUNTER //end of LoadConfigDir Win10
68 };
69
70 static std::set<DWORD> getGuardFlagsSet(DWORD flags);
71 static QString translateGuardFlag(DWORD flags);
72
74 : DataDirEntryWrapper(pe, pe::DIR_LOAD_CONFIG) { wrap(); }
75
76 bool wrap();
77
78 virtual void* getPtr();
79 virtual bufsize_t getSize();
80 virtual QString getName() { return "LdConfig"; }
81
82 virtual size_t getFieldsCount()
83 {
84 const offset_t realSize = getSize();
85 const bool is32b = (m_Exe->getBitMode() == Executable::BITS_32) ? true : false;
86 size_t fId = FIELD_COUNTER - 1;
87 offset_t fieldDelta = INVALID_ADDR;
88 for (; fId != 0; fId--) {
89 fieldDelta = _getFieldDelta(is32b, fId);
90 if (fieldDelta < realSize) break;
91 }
92 if ((fieldDelta == INVALID_ADDR) || (fieldDelta > realSize)) {
93 return 0;
94 }
95 return (fId + 1);
96 }
97
98 virtual size_t getSubFieldsCount() { return 1; }
99
100 virtual void* getFieldPtr(size_t fieldId, size_t subField);
101 virtual QString getFieldName(size_t fieldId);
102 virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField = FIELD_NONE);
103
104 virtual ExeNodeWrapper* getSubfieldWrapper(size_t parentType, size_t fieldId)
105 {
106 std::vector<ExeNodeWrapper*> *subList = getSubEntriesList(parentType);
107 if (subList == NULL) return 0;
108 return this->getEntryAt(*subList, fieldId);
109 }
110
111 virtual size_t getSubfieldWrapperCount(size_t parentType)
112 {
113 std::vector<ExeNodeWrapper*> *subList = getSubEntriesList(parentType);
114 if (subList == NULL) return 0;
115 return getEntriesCount(*subList);
116 }
117
118 virtual bool hasSubfieldWrapper(size_t parentType)
119 {
120 std::vector<ExeNodeWrapper*> *subList = getSubEntriesList(parentType);
121 if (subList == NULL) return false;
122 return true;
123 }
124
126 {
127 bool isOk = false;
128 bool isSupressed = false;
129 uint64_t GuardFlags = this->getNumValue(GUARD_FLAGS, &isOk);
130 if (isOk) {
131 isSupressed = (GuardFlags & IMAGE_GUARD_CF_EXPORT_SUPPRESSION_INFO_PRESENT) || (GuardFlags & 0x10000000);
132 }
133 return isSupressed;
134 }
135
137 {
138 bool isOk = false;
139 uint64_t GuardFlags = this->getNumValue(GUARD_FLAGS, &isOk);
140 if (!isOk) {
141 return 0;
142 }
143 bool isSupressed = (GuardFlags & IMAGE_GUARD_CF_EXPORT_SUPPRESSION_INFO_PRESENT) || (GuardFlags & 0x10000000);
144 if (!isSupressed) {
145 return 0;
146 }
147 const size_t metadata_fields = ((GuardFlags & IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_MASK) >> IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_SHIFT);
148 return metadata_fields;
149 }
150
151 QString translateGuardFlagsContent(const QString &delim);
152 virtual QString translateFieldContent(size_t fieldId);
153
154protected:
155 virtual void clear();
156 void* firstSubEntryPtr(size_t parentId);
157
158 size_t firstSubEntrySize(size_t parentId)
159 {
160 if (parentId == LdConfigDirWrapper::SEH_TABLE) {
161 // SEH entries have no metadata
162 return sizeof(DWORD);
163 }
164 const size_t metadata_fields = metadataSize();
165 return sizeof(DWORD) + (metadata_fields * sizeof(BYTE));
166 }
167
168private:
169 static offset_t _getFieldDelta(bool is32b, size_t fId);
170
171 bool wrapSubentriesTable(size_t parentFieldId, size_t counterFieldId);
172
173 // get the size of the structure
174 inline bufsize_t getLdConfigDirSize();
175
176 // get the size that was defined in the header:
177 bufsize_t getHdrDefinedSize();
178
179 inline void* getLdConfigDirPtr();
180
181 std::vector<ExeNodeWrapper*>* getSubEntriesList(size_t parentType)
182 {
183 std::map<uint32_t, std::vector<ExeNodeWrapper*> >::iterator itr = subEntriesMap.find(parentType);
184 if (itr == subEntriesMap.end()){
185 return NULL;
186 }
187 return &(itr->second);
188 }
189
190 std::map<uint32_t, std::vector<ExeNodeWrapper*> > subEntriesMap;
192};
193
195{
196public:
197 // fields :
204
205 LdConfigEntryWrapper(Executable* pe, LdConfigDirWrapper *_parentDir, size_t entryNumber, size_t _parentFieldId)
206 : ExeNodeWrapper(pe, _parentDir, entryNumber),
207 parentFieldId(_parentFieldId)
208 {
209 this->parentDir = _parentDir;
210 }
211
212 // full structure boundaries
213 virtual void* getPtr();
214 virtual bufsize_t getSize();
215
216 virtual QString getName() { return "Address"; }
217
218 virtual size_t getFieldsCount()
219 {
220 if (!this->parentDir) return 1;
221 if (this->parentFieldId == LdConfigDirWrapper::SEH_TABLE) {
222 return 1;
223 }
224 return 1 + this->parentDir->metadataSize();
225 }
226
227 // specific field boundaries
228 virtual void* getFieldPtr(size_t fieldId, size_t subField = FIELD_NONE);
229
230 bufsize_t getFieldSize(size_t fieldId, size_t subField);
231
232 virtual QString getFieldName(size_t fieldId)
233 {
234 if (fieldId == HANDLER_ADDR) {
235 return "Address";
236 }
237 return "Metadata";
238 }
239
240 virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField)
241 {
242 if (fieldId == HANDLER_ADDR) {
243 return Executable::RVA;
244 }
246 }
247
248private:
249 LdConfigDirWrapper* parentDir;
250 size_t parentFieldId;
251};
uint32_t bufsize_t
const offset_t INVALID_ADDR
uint64_t offset_t
#define FIELD_NONE
virtual uint64_t getNumValue(size_t fieldId, size_t subField, bool *isOk)
virtual ExeNodeWrapper * getEntryAt(size_t fieldId)
virtual size_t getEntriesCount()
virtual exe_bits getBitMode()
Definition Executable.h:56
virtual size_t getFieldsCount()
virtual void * getFieldPtr(size_t fieldId, size_t subField)
virtual bufsize_t getSize()
virtual ExeNodeWrapper * getSubfieldWrapper(size_t parentType, size_t fieldId)
size_t firstSubEntrySize(size_t parentId)
virtual size_t getSubfieldWrapperCount(size_t parentType)
static QString translateGuardFlag(DWORD flags)
QString translateGuardFlagsContent(const QString &delim)
virtual bool hasSubfieldWrapper(size_t parentType)
static std::set< DWORD > getGuardFlagsSet(DWORD flags)
virtual void * getPtr()
virtual QString getFieldName(size_t fieldId)
void * firstSubEntryPtr(size_t parentId)
virtual size_t getSubFieldsCount()
virtual QString getName()
virtual QString translateFieldContent(size_t fieldId)
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField=FIELD_NONE)
LdConfigDirWrapper(PEFile *pe)
virtual QString getName()
virtual void * getFieldPtr(size_t fieldId, size_t subField=FIELD_NONE)
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField)
virtual QString getFieldName(size_t fieldId)
virtual bufsize_t getSize()
virtual size_t getFieldsCount()
bufsize_t getFieldSize(size_t fieldId, size_t subField)
FieldID
@ HANDLER_ADDR
@ METADATA
@ NONE
@ FIELD_COUNTER
virtual void * getPtr()
LdConfigEntryWrapper(Executable *pe, LdConfigDirWrapper *_parentDir, size_t entryNumber, size_t _parentFieldId)