80 virtual QString
getName() {
return "LdConfig"; }
88 for (; fId != 0; fId--) {
89 fieldDelta = _getFieldDelta(is32b, fId);
90 if (fieldDelta < realSize)
break;
92 if ((fieldDelta ==
INVALID_ADDR) || (fieldDelta > realSize)) {
100 virtual void*
getFieldPtr(
size_t fieldId,
size_t subField);
106 std::vector<ExeNodeWrapper*> *subList = getSubEntriesList(parentType);
107 if (subList == NULL)
return 0;
113 std::vector<ExeNodeWrapper*> *subList = getSubEntriesList(parentType);
114 if (subList == NULL)
return 0;
120 std::vector<ExeNodeWrapper*> *subList = getSubEntriesList(parentType);
121 if (subList == NULL)
return false;
128 bool isSupressed =
false;
131 isSupressed = (GuardFlags & IMAGE_GUARD_CF_EXPORT_SUPPRESSION_INFO_PRESENT) || (GuardFlags & 0x10000000);
143 bool isSupressed = (GuardFlags & IMAGE_GUARD_CF_EXPORT_SUPPRESSION_INFO_PRESENT) || (GuardFlags & 0x10000000);
147 const size_t metadata_fields = ((GuardFlags & IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_MASK) >> IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_SHIFT);
148 return metadata_fields;
155 virtual void clear();
162 return sizeof(DWORD);
165 return sizeof(DWORD) + (metadata_fields *
sizeof(BYTE));
169 static offset_t _getFieldDelta(
bool is32b,
size_t fId);
171 bool wrapSubentriesTable(
size_t parentFieldId,
size_t counterFieldId);
179 inline void* getLdConfigDirPtr();
181 std::vector<ExeNodeWrapper*>* getSubEntriesList(
size_t parentType)
183 std::map<uint32_t, std::vector<ExeNodeWrapper*> >::iterator itr = subEntriesMap.find(parentType);
184 if (itr == subEntriesMap.end()){
187 return &(itr->second);
190 std::map<uint32_t, std::vector<ExeNodeWrapper*> > subEntriesMap;
207 parentFieldId(_parentFieldId)
209 this->parentDir = _parentDir;
216 virtual QString
getName() {
return "Address"; }
220 if (!this->parentDir)
return 1;
250 size_t parentFieldId;
const offset_t INVALID_ADDR
virtual uint64_t getNumValue(size_t fieldId, size_t subField, bool *isOk)
virtual ExeNodeWrapper * getEntryAt(size_t fieldId)
virtual size_t getEntriesCount()
virtual exe_bits getBitMode()
virtual size_t getFieldsCount()
virtual void * getFieldPtr(size_t fieldId, size_t subField)
virtual bufsize_t getSize()
virtual ExeNodeWrapper * getSubfieldWrapper(size_t parentType, size_t fieldId)
size_t firstSubEntrySize(size_t parentId)
virtual size_t getSubfieldWrapperCount(size_t parentType)
static QString translateGuardFlag(DWORD flags)
QString translateGuardFlagsContent(const QString &delim)
virtual bool hasSubfieldWrapper(size_t parentType)
static std::set< DWORD > getGuardFlagsSet(DWORD flags)
virtual QString getFieldName(size_t fieldId)
void * firstSubEntryPtr(size_t parentId)
virtual size_t getSubFieldsCount()
virtual QString getName()
virtual QString translateFieldContent(size_t fieldId)
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField=FIELD_NONE)
LdConfigDirWrapper(PEFile *pe)
@ DYNAMIC_VAL_RELOC_TABLE_SECTION
@ DYNAMIC_VAL_RELOC_TABLE_OFFSET
@ GUARD_ADDR_IAT_ENTRY_TABLE
@ CODE_INTEGRITY_RESERVED
@ GUARD_ADDR_IAT_ENTRY_COUNT
@ GUARD_FAILURE_ROUTINE_FUNC_PTR
@ CODE_INTEGRITY_CATALOG_OFFSET
virtual QString getName()
virtual void * getFieldPtr(size_t fieldId, size_t subField=FIELD_NONE)
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField)
virtual QString getFieldName(size_t fieldId)
virtual bufsize_t getSize()
virtual size_t getFieldsCount()
bufsize_t getFieldSize(size_t fieldId, size_t subField)
LdConfigEntryWrapper(Executable *pe, LdConfigDirWrapper *_parentDir, size_t entryNumber, size_t _parentFieldId)