3#define DEFAULT_IMGBASE 0x10000
16 const bool allowExceptionsFromBuffer =
false;
22 this->
dos = (IMAGE_DOS_HEADER*)
buf->
getContentAt(offset,
sizeof(IMAGE_DOS_HEADER), allowExceptionsFromBuffer);
23 if (!
dos)
throw ExeException(
"Could not wrap PECore: invalid DOS Header!");
25 offset =
dos->e_lfanew +
sizeof(DWORD);
26 this->
fHdr = (IMAGE_FILE_HEADER*)
buf->
getContentAt(offset,
sizeof(IMAGE_FILE_HEADER), allowExceptionsFromBuffer);
29 offset = offset +
sizeof(IMAGE_FILE_HEADER);
30 WORD *magic = (WORD*)
buf->
getContentAt(offset,
sizeof(WORD), allowExceptionsFromBuffer);
31 if (!magic)
throw ExeException(
"Could not wrap PECore: invalid FileHeader");
34 const size_t ntHdrSize = (mode ==
Executable::BITS_32) ?
sizeof(IMAGE_OPTIONAL_HEADER32) :
sizeof(IMAGE_OPTIONAL_HEADER64);
35 BYTE *ntHdrPtr =
buf->
getContentAt(offset, ntHdrSize, allowExceptionsFromBuffer);
39 this->
opt32 = (IMAGE_OPTIONAL_HEADER32*)ntHdrPtr;
42 this->
opt64 = (IMAGE_OPTIONAL_HEADER64*)ntHdrPtr;
46 throw ExeException(
"Could not wrap PECore: invalid OptionalHeader");
64 if (this->
fHdr->Machine == M_I386 || this->fHdr->Machine == M_AMD64) {
67 if (this->
fHdr->Machine == M_ARM || this->fHdr->Machine == M_ARM64LE) {
85 const offset_t signSize =
sizeof(DWORD);
86 return offset + signSize;
95 return offset +
sizeof(IMAGE_FILE_HEADER);
101 return sizeof(IMAGE_NT_HEADERS64);
103 return sizeof(IMAGE_NT_HEADERS32);
116 return offset + size;
123 return opt32->SectionAlignment;
127 return opt64->SectionAlignment;
136 imgSize =
opt32->SizeOfImage;
139 imgSize =
opt64->SizeOfImage;
148 hdrsSize =
opt32->SizeOfHeaders;
151 hdrsSize =
opt64->SizeOfHeaders;
160 imgBase =
opt32->ImageBase;
163 imgBase =
opt64->ImageBase;
167 if (imgBase == 0 && recalculate) {
174 if (maxOffset >= 0x80000000 && recalculate) {
const offset_t INVALID_ADDR
virtual BYTE * getContentAt(offset_t offset, bufsize_t size, bool allowExceptions=false)
Executable::exe_arch getHdrArch() const
virtual bufsize_t getAlignment(Executable::addr_type aType) const
bufsize_t hdrsSize() const
offset_t peOptHdrOffset() const
IMAGE_OPTIONAL_HEADER32 * opt32
bool wrap(AbstractByteBuffer *v_buf)
virtual offset_t getImageBase(bool recalculate=false)
offset_t peFileHdrOffset() const
virtual bufsize_t getImageSize()
offset_t peSignatureOffset() const
bufsize_t peNtHeadersSize() const
offset_t secHdrsOffset() const
IMAGE_OPTIONAL_HEADER64 * opt64
Executable::exe_bits getHdrBitMode() const