BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
parser
pe
rsrc
ResourceContentWrapper.cpp
Go to the documentation of this file.
1
#include "
pe/rsrc/ResourceContentWrapper.h
"
2
3
QString
ResourceContentWrapper::translateType
(pe::resource_type type)
4
{
5
switch
(type) {
6
case
pe::RESTYPE_CURSOR :
return
"Cursor"
;
7
case
pe::RESTYPE_FONT :
return
"Font"
;
8
case
pe::RESTYPE_BITMAP :
return
"Bitmap"
;
9
case
pe::RESTYPE_ICON :
return
"Icon"
;
10
case
pe::RESTYPE_MENU :
return
"Menu"
;
11
case
pe::RESTYPE_DIALOG :
return
"Dialog"
;
12
case
pe::RESTYPE_STRING :
return
"Strings"
;
13
case
pe::RESTYPE_FONTDIR :
return
"Font Dir."
;
14
case
pe::RESTYPE_ACCELERATOR :
return
"Accelerator"
;
15
case
pe::RESTYPE_RCDATA :
return
"RC Data"
;
16
case
pe::RESTYPE_MESSAGETABLE :
return
"Message Table"
;
17
18
case
pe::RESTYPE_GROUP_CURSOR :
return
"Cursors Group"
;
19
case
pe::RESTYPE_GROUP_ICON :
return
"Icons Group"
;
20
case
pe::RESTYPE_VERSION :
return
"Version"
;
21
case
pe::RESTYPE_DLGINCLUDE :
return
"Dialog Include"
;
22
case
pe::RESTYPE_PLUGPLAY :
return
"Plug-n-Play"
;
23
case
pe::RESTYPE_VXD :
return
"VXD"
;
24
case
pe::RESTYPE_ANICURSOR :
return
"Animated Cursor"
;
25
case
pe::RESTYPE_ANIICON :
return
"Animated Icon"
;
26
case
pe::RESTYPE_HTML :
return
"HTML"
;
27
case
pe::RESTYPE_MANIFEST :
return
"Manifest"
;
28
}
29
return
"UNKN"
;
30
}
31
32
//-------------------------------------------------------
33
34
void
*
ResourceContentWrapper::getResContentPtr
()
35
{
36
if
(
myLeaf
== NULL)
return
NULL;
37
38
IMAGE_RESOURCE_DATA_ENTRY* entry = this->
myLeaf
->
leafEntryPtr
();
39
if
(entry == NULL)
return
NULL;
40
41
offset_t
dataRva =
static_cast<
offset_t
>
(entry->OffsetToData);
42
bufsize_t
dataSize =
static_cast<
bufsize_t
>
(entry->Size);
43
44
Executable
*
m_Exe
=
myLeaf
->
getExe
();
45
Executable::addr_type
aT =
m_Exe
->
detectAddrType
(dataRva,
Executable::RVA
);
46
offset_t
dataOffset =
m_Exe
->
toRaw
(dataRva, aT);
47
if
(dataOffset ==
INVALID_ADDR
)
return
NULL;
48
49
BYTE* b =
m_Exe
->
getContentAt
(dataRva, aT, dataSize);
50
return
b;
51
}
52
53
bufsize_t
ResourceContentWrapper::getResContentSize
()
54
{
55
if
(
myLeaf
== NULL) {
56
printf(
"[ERR] MyLeaf is NULL\n"
);
57
return
0;
58
}
59
IMAGE_RESOURCE_DATA_ENTRY* entry = this->
myLeaf
->
leafEntryPtr
();
60
if
(entry == NULL) {
61
printf(
"[ERR] Leaf ERR\n"
);
62
return
0;
63
}
64
DWORD size = entry->Size;
65
return
size;
66
}
67
68
offset_t
ResourceContentWrapper::getContentRaw
()
69
{
70
if
(
myLeaf
== NULL)
return
0;
71
72
IMAGE_RESOURCE_DATA_ENTRY* entry = this->
myLeaf
->
leafEntryPtr
();
73
if
(entry == NULL)
return
0;
74
75
uint64_t dataRva = entry->OffsetToData;
76
Executable
*
m_Exe
=
myLeaf
->
getExe
();
77
Executable::addr_type
aT =
m_Exe
->
detectAddrType
(dataRva,
Executable::RVA
);
78
return
m_Exe
->
toRaw
(dataRva, aT);
79
}
80
81
BYTE*
ResourceContentWrapper::getContentAt
(
offset_t
dataAddr,
Executable::addr_type
aT,
bufsize_t
dataSize)
82
{
83
if
(
myLeaf
== NULL)
return
NULL;
84
85
Executable
*
m_Exe
=
myLeaf
->
getExe
();
86
BYTE* b =
m_Exe
->
getContentAt
(dataAddr, aT, dataSize);
87
return
b;
88
}
89
bufsize_t
uint32_t bufsize_t
Definition
AbstractByteBuffer.h:14
INVALID_ADDR
const offset_t INVALID_ADDR
Definition
AbstractByteBuffer.h:18
offset_t
uint64_t offset_t
Definition
AbstractByteBuffer.h:17
ResourceContentWrapper.h
ExeElementWrapper::m_Exe
Executable * m_Exe
Definition
ExeElementWrapper.h:65
Executable
Definition
Executable.h:26
Executable::addr_type
addr_type
Definition
Executable.h:41
Executable::RVA
@ RVA
Definition
Executable.h:44
Executable::toRaw
virtual offset_t toRaw(offset_t offset, addr_type addrType, bool allowExceptions=false)
Definition
Executable.cpp:85
Executable::getContentAt
BYTE * getContentAt(offset_t offset, bufsize_t size, bool allowExceptions=false)
Definition
Executable.h:65
Executable::detectAddrType
Executable::addr_type detectAddrType(offset_t addr, Executable::addr_type hintType)
Definition
Executable.cpp:125
ResourceContentWrapper::translateType
static QString translateType(pe::resource_type type)
Definition
ResourceContentWrapper.cpp:3
ResourceContentWrapper::getContentAt
BYTE * getContentAt(offset_t dataAddr, Executable::addr_type aT, bufsize_t dataSize)
Definition
ResourceContentWrapper.cpp:81
ResourceContentWrapper::getContentRaw
offset_t getContentRaw()
Definition
ResourceContentWrapper.cpp:68
ResourceContentWrapper::myLeaf
ResourceLeafWrapper * myLeaf
Definition
ResourceContentWrapper.h:40
ResourceContentWrapper::getResContentPtr
void * getResContentPtr()
Definition
ResourceContentWrapper.cpp:34
ResourceContentWrapper::getResContentSize
bufsize_t getResContentSize()
Definition
ResourceContentWrapper.cpp:53
ResourceLeafWrapper::leafEntryPtr
IMAGE_RESOURCE_DATA_ENTRY * leafEntryPtr()
Definition
ResourceDirWrapper.cpp:341
ResourceLeafWrapper::getExe
Executable * getExe()
Definition
ResourceLeafWrapper.h:42
Generated by
1.12.0