BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
OptHdrWrapper.h
Go to the documentation of this file.
1#pragma once
2
3#include "PENodeWrapper.h"
4
6{
7public:
8 /* fields :*/
45 static std::map<DWORD, QString> s_optMagic;
46 static std::map<std::pair<WORD,WORD>, QString> s_osVersion;
47 static std::map<DWORD, QString> s_dllCharact;
48 static std::map<DWORD, QString> s_subsystem;
49
50 static void initDllCharact();
51 static std::vector<DWORD> splitDllCharact(DWORD characteristics);
52 static QString translateDllCharacteristics(DWORD charact);
53
54 static QString translateOptMagic(DWORD magic);
55 static QString translateOSVersion(WORD major, WORD minor);
56 static QString translateSubsystem(DWORD subsystem);
57 //----
58
59 OptHdrWrapper(PEFile *pe) : PEElementWrapper(pe), opt32(NULL), opt64(NULL) { wrap(); }
60 bool wrap();
61
62 /* full structure boundaries */
63 virtual void* getPtr();
64 virtual bufsize_t getSize();
65 virtual QString getName() { return "Optional Hdr"; }
66 virtual size_t getFieldsCount() { return FIELD_COUNTER; }
67
68 /* specific field boundaries */
69 virtual void* getFieldPtr(size_t fieldId, size_t subField = FIELD_NONE);
70 virtual bufsize_t getFieldSize(size_t fieldId, size_t subField = FIELD_NONE);
71
72 virtual QString translateFieldContent(size_t fieldId);
73
74 virtual QString getFieldName(size_t fieldId);
75 virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField = FIELD_NONE);
76
78 IMAGE_NT_HEADERS32* nt32();
79 IMAGE_NT_HEADERS64* nt64();
80
81 //DataDirWrapper dataDir;
82protected:
83 IMAGE_OPTIONAL_HEADER32* opt32;
84 IMAGE_OPTIONAL_HEADER64* opt64;
85 std::vector<DWORD> dllCharact;
86};
87
uint32_t bufsize_t
#define FIELD_NONE
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField=FIELD_NONE)
static QString translateOptMagic(DWORD magic)
IMAGE_NT_HEADERS64 * nt64()
static QString translateSubsystem(DWORD subsystem)
virtual QString translateFieldContent(size_t fieldId)
static void initDllCharact()
Executable::exe_bits getHdrBitMode()
IMAGE_OPTIONAL_HEADER64 * opt64
static std::map< DWORD, QString > s_optMagic
IMAGE_OPTIONAL_HEADER32 * opt32
static QString translateDllCharacteristics(DWORD charact)
static QString translateOSVersion(WORD major, WORD minor)
virtual size_t getFieldsCount()
std::vector< DWORD > dllCharact
OptHdrWrapper(PEFile *pe)
IMAGE_NT_HEADERS32 * nt32()
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField=FIELD_NONE)
virtual QString getFieldName(size_t fieldId)
virtual void * getPtr()
virtual bufsize_t getSize()
virtual QString getName()
static std::map< DWORD, QString > s_dllCharact
virtual void * getFieldPtr(size_t fieldId, size_t subField=FIELD_NONE)
static std::vector< DWORD > splitDllCharact(DWORD characteristics)
static std::map< std::pair< WORD, WORD >, QString > s_osVersion
static std::map< DWORD, QString > s_subsystem