14 s_dllCharact[pe::DLL_CHARACTERISTICS_HIGH_ENTROPY_VA] =
"Image can handle a high entropy 64-bit virtual address space";
16 s_dllCharact[pe::DLL_FORCE_INTEGRITY] =
"Code Integrity Image";
17 s_dllCharact[pe::DLL_NX_COMPAT] =
"Image is NX compatible";
18 s_dllCharact[pe::DLL_NO_ISOLATION] =
"Image understands isolation and doesn't want it";
20 s_dllCharact[pe::DLL_NO_BIND] =
"Do not bind this image";
22 s_dllCharact[pe::DLL_WDM_DRIVER] =
"Driver uses WDM model";
24 s_dllCharact[pe::DLL_TERMINAL_SERVER_AWARE] =
"TerminalServer aware";
40 std::vector<DWORD> chSet;
41 map<DWORD, QString>::iterator iter;
43 if (characteristics & iter->first) {
44 chSet.push_back(iter->first);
66 s_osVersion[pair<WORD,WORD>(6, 0)] =
"Windows Vista / Server 2008";
68 s_osVersion[pair<WORD,WORD>(5, 2)] =
"Windows Server 2003";
70 s_osVersion[pair<WORD,WORD>(5, 0)] =
"Windows 2000 / XP";
74 s_osVersion[pair<WORD,WORD>(4, 0)] =
"Windows 95 / NT 4.0";
76 s_osVersion[pair<WORD,WORD>(3, 51)] =
"Windows NT 3.51";
77 s_osVersion[pair<WORD,WORD>(3, 10)] =
"Windows NT 3.1";
79 pair<WORD,WORD> p(major, minor);
90 s_subsystem[pe::SUB_WINDOWS_CUI] =
"Windows console";
93 s_subsystem[pe::SUB_NATIVE_WINDOWS] =
"Native Win9x driver";
94 s_subsystem[pe::SUB_WINDOWS_CE_GUI] =
"Windows CE subsystem";
95 s_subsystem[pe::SUB_EFI_APPLICATION] =
"EFI_APPLICATION";
96 s_subsystem[pe::SUB_EFI_BOOT_SERVICE_DRIVER] =
"EFI_BOOT_SERVICE_DRIVER";
97 s_subsystem[pe::SUB_EFI_RUNTIME_DRIVER] =
"EFI_RUNTIME_DRIVER";
100 s_subsystem[pe::SUB_WINDOWS_BOOT_APP] =
"WINDOWS_BOOT_APPLICATION";
130 if (
m_PE == NULL)
return NULL;
134 IMAGE_NT_HEADERS32* hdr = (IMAGE_NT_HEADERS32*)
m_Exe->
getContentAt(myOff,
sizeof(IMAGE_NT_HEADERS32));
140 if (
m_PE == NULL)
return NULL;
144 IMAGE_NT_HEADERS64* hdr = (IMAGE_NT_HEADERS64*)
m_Exe->
getContentAt(myOff,
sizeof(IMAGE_NT_HEADERS64));
152 IMAGE_NT_HEADERS32* ntHdr32 =
nt32();
154 this->
opt32 = &(ntHdr32->OptionalHeader);
156 IMAGE_NT_HEADERS64* ntHdr64 =
nt64();
157 this->
opt64 = (ntHdr64) ? &(ntHdr64->OptionalHeader) : NULL;
166 IMAGE_OPTIONAL_HEADER32*
opt32 = (
nt32()) ? &(
nt32()->OptionalHeader) : NULL;
167 IMAGE_OPTIONAL_HEADER64*
opt64 = (
nt64()) ? &(
nt64()->OptionalHeader) : NULL;
170 bufsize_t size =
opt32 ?
sizeof(IMAGE_OPTIONAL_HEADER32) :
sizeof(IMAGE_OPTIONAL_HEADER64);
176 IMAGE_OPTIONAL_HEADER64*
opt64 = (
nt64()) ? &(
nt64()->OptionalHeader) : NULL;
186 IMAGE_OPTIONAL_HEADER32*
opt32 = (
nt32()) ? &(
nt32()->OptionalHeader) : NULL;
187 IMAGE_OPTIONAL_HEADER64*
opt64 = (
nt64()) ? &(
nt64()->OptionalHeader) : NULL;
194 return opt32 ? (
void*)&
opt32->MajorLinkerVersion : (
void*)&
opt64->MajorLinkerVersion;
196 return opt32 ? (
void*)&
opt32->MinorLinkerVersion : (
void*)&
opt64->MinorLinkerVersion;
201 return opt32 ? (
void*)&
opt32->SizeOfInitializedData : (
void*)&
opt64->SizeOfInitializedData;
203 return opt32 ? (
void*)&
opt32->SizeOfUninitializedData : (
void*)&
opt64->SizeOfUninitializedData;
205 return opt32 ? &
opt32->AddressOfEntryPoint : (
void*)&
opt64->AddressOfEntryPoint;
210 return opt32 ? (
void*)&
opt32->BaseOfData : NULL;
215 return opt32 ? (
void*)&
opt32->SectionAlignment : (
void*)&
opt64->SectionAlignment;
217 return opt32 ? (
void*)&
opt32->FileAlignment : (
void*)&
opt64->FileAlignment;
220 return opt32 ? (
void*)&
opt32->MajorOperatingSystemVersion : (
void*)&
opt64->MajorOperatingSystemVersion;
222 return opt32 ? (
void*)&
opt32->MinorOperatingSystemVersion : (
void*)&
opt64->MinorOperatingSystemVersion;
225 return opt32 ? (
void*)&
opt32->MajorImageVersion : (
void*)&
opt64->MajorImageVersion;
227 return opt32 ? (
void*)&
opt32->MinorImageVersion : (
void*)&
opt64->MinorImageVersion;
230 return opt32 ? (
void*)&
opt32->MajorSubsystemVersion : (
void*)&
opt64->MajorSubsystemVersion;
232 return opt32 ? (
void*)&
opt32->MinorSubsystemVersion : (
void*)&
opt64->MinorSubsystemVersion;
235 return opt32 ? (
void*)&
opt32->Win32VersionValue : (
void*)&
opt64->Win32VersionValue;
237 return opt32 ? (
void*)&
opt32->SizeOfImage : (
void*)&
opt64->SizeOfImage;
239 return opt32 ? (
void*)&
opt32->SizeOfHeaders : (
void*)&
opt64->SizeOfHeaders;
245 return opt32 ? (
void*)&
opt32->DllCharacteristics : (
void*)&
opt64->DllCharacteristics;
247 return opt32 ? (
void*)&
opt32->SizeOfStackReserve : (
void*)&
opt64->SizeOfStackReserve;
249 return opt32 ? (
void*)&
opt32->SizeOfStackCommit : (
void*)&
opt64->SizeOfStackCommit;
251 return opt32 ? (
void*)&
opt32->SizeOfHeapReserve : (
void*)&
opt64->SizeOfHeapReserve;
253 return opt32 ? (
void*)&
opt32->SizeOfHeapCommit : (
void*)&
opt64->SizeOfHeapCommit;
255 return opt32 ? (
void*)&
opt32->LoaderFlags : (
void*)&
opt64->LoaderFlags;
257 return opt32 ? (
void*)&
opt32->NumberOfRvaAndSizes : (
void*)&
opt64->NumberOfRvaAndSizes;
259 return opt32 ? (
void*)&
opt32->DataDirectory : (
void*)&
opt64->DataDirectory;
271 num =
static_cast<uint32_t
>(this->
getNumValue(fieldId, &isOk));
272 if (!isOk)
return "";
275 num =
static_cast<uint32_t
>(this->
getNumValue(fieldId, &isOk));
276 if (!isOk)
return "";
285 case MAGIC:
return (
"Magic");
292 case EP:
return (
"Entry Point");
300 case SEC_ALIGN:
return (
"Section Alignment");
312 case WIN32_VER:
return (
"Win32 Version Value");
314 case HDRS_SIZE:
return (
"Size of Headers");
316 case SUBSYS:
return (
"Subsystem");
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField=FIELD_NONE)
virtual uint64_t getNumValue(size_t fieldId, size_t subField, bool *isOk)
BYTE * getContentAt(offset_t offset, bufsize_t size, bool allowExceptions=false)
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField=FIELD_NONE)
static QString translateOptMagic(DWORD magic)
IMAGE_NT_HEADERS64 * nt64()
static QString translateSubsystem(DWORD subsystem)
virtual QString translateFieldContent(size_t fieldId)
static void initDllCharact()
Executable::exe_bits getHdrBitMode()
IMAGE_OPTIONAL_HEADER64 * opt64
static std::map< DWORD, QString > s_optMagic
IMAGE_OPTIONAL_HEADER32 * opt32
static QString translateDllCharacteristics(DWORD charact)
static QString translateOSVersion(WORD major, WORD minor)
std::vector< DWORD > dllCharact
IMAGE_NT_HEADERS32 * nt32()
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField=FIELD_NONE)
virtual QString getFieldName(size_t fieldId)
virtual bufsize_t getSize()
static std::map< DWORD, QString > s_dllCharact
virtual void * getFieldPtr(size_t fieldId, size_t subField=FIELD_NONE)
static std::vector< DWORD > splitDllCharact(DWORD characteristics)
static std::map< std::pair< WORD, WORD >, QString > s_osVersion
static std::map< DWORD, QString > s_subsystem
offset_t peNtHdrOffset() const