BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
ResourceDirWrapper.h
Go to the documentation of this file.
1#pragma once
2
5
8
9#include <map>
10#include <vector>
11
12
14{
15public:
16
27
28 ResourceDirWrapper(PEFile* pe, ResourcesAlbum *resAlbum = NULL, offset_t rawOffset = 0, long depth = 0, long topEntryId = TOP_ENTRY_ROOT)
29 : DataDirEntryWrapper(pe, pe::DIR_RESOURCE),
30 rawOff(rawOffset), dirDepth(depth), album(resAlbum), topEntryID(topEntryId)
31 {
32 wrap();
33 }
34
35 bool wrap();
36
37 virtual void* getPtr() { return resourceDir(); }
38 virtual bufsize_t getSize();
39
40 virtual QString getName() { return "Resources"; }
41 virtual size_t getFieldsCount() { return FIELD_COUNTER; }
42 virtual size_t getSubFieldsCount() { return 1; }
43
44 virtual void* getFieldPtr(size_t fieldId, size_t subField);
45 virtual bufsize_t getFieldSize(size_t fieldId, size_t subField);
46 virtual QString getFieldName(size_t fieldId);
47
49 {
50 return static_cast<bufsize_t>(this->getEntriesCount()) * sizeof(IMAGE_RESOURCE_DIRECTORY_ENTRY);
51 }
52
53 long getDepth() { return this->dirDepth; }
54
55 IMAGE_RESOURCE_DIRECTORY* mainResourceDir();
56 ResourcesAlbum* getAlbumPtr() { return album; }
57
58private:
59 IMAGE_RESOURCE_DIRECTORY* resourceDir();
60 offset_t rawOff;
61 long dirDepth;
62 ResourcesAlbum *album;
63 long topEntryID;
64};
65
67{
68public:
69 // fields :
76
77 static QString translateType(WORD id);
78
79 ResourceEntryWrapper(PEFile *pe, ResourceDirWrapper *parentDir, size_t entryNumber, long topEntryId, ResourcesAlbum *resAlbum)
80 : PENodeWrapper(pe, parentDir, entryNumber), topEntryID(topEntryId), album(resAlbum), childDir(NULL), childLeaf(NULL)
81 {
82 this->parentDir = parentDir;
83 wrap();
84 }
85
87
88 bool wrap();
89 // full structure boundaries
90 virtual void* getPtr() { return getEntryPtr(); }
91 virtual bufsize_t getSize() { return sizeof(IMAGE_RESOURCE_DIRECTORY_ENTRY); }
92
93 virtual QString getName() { return "Resource entry: "+ translateType(getID());}
94 virtual size_t getFieldsCount() { return FIELD_COUNTER; }
95 virtual size_t getSubFieldsCount() { return 1; }
96
97 // specific field boundaries
98 virtual void* getFieldPtr(size_t fieldId, size_t subField = FIELD_NONE);
99 virtual QString getFieldName(size_t fieldId);
100 virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField) { return Executable::NOT_ADDR; }
101
102 bool isByName();
103 bool isDir();
104
105 WORD getID();
106 offset_t getChildOffsetToDirectory(); //relative offset!
108
109 IMAGE_RESOURCE_DIRECTORY_STRING* getNameStr();
111
112 IMAGE_RESOURCE_DIRECTORY_ENTRY *getEntryPtr();
113 ResourcesAlbum* getAlbumPtr() { return album; }
114 long getTopEntryID() { return topEntryID; }
115
116protected:
117 virtual void clear();
118
119private:
120 long topEntryID;
121 ResourcesAlbum *album;
122
123 ResourceDirWrapper* parentDir, *childDir;
124 ResourceLeafWrapper *childLeaf;
125};
126
uint32_t bufsize_t
uint64_t offset_t
#define FIELD_NONE
#define TOP_ENTRY_ROOT
virtual size_t getEntriesCount()
ResourceDirWrapper(PEFile *pe, ResourcesAlbum *resAlbum=NULL, offset_t rawOffset=0, long depth=0, long topEntryId=TOP_ENTRY_ROOT)
virtual bufsize_t getSize()
virtual QString getFieldName(size_t fieldId)
virtual size_t getSubFieldsCount()
virtual void * getFieldPtr(size_t fieldId, size_t subField)
virtual size_t getFieldsCount()
virtual void * getPtr()
IMAGE_RESOURCE_DIRECTORY * mainResourceDir()
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField)
virtual QString getName()
bufsize_t getEntriesAreaSize()
ResourcesAlbum * getAlbumPtr()
WORD getID()
virtual QString getFieldName(size_t fieldId)
ResourcesAlbum * getAlbumPtr()
virtual size_t getFieldsCount()
long getTopEntryID()
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField)
virtual ~ResourceEntryWrapper()
offset_t getChildAddress()
IMAGE_RESOURCE_DIRECTORY_ENTRY * getEntryPtr()
offset_t getNameOffset()
virtual void clear()
bool isDir()
static QString translateType(WORD id)
bool isByName()
virtual QString getName()
bool wrap()
IMAGE_RESOURCE_DIRECTORY_STRING * getNameStr()
ResourceEntryWrapper(PEFile *pe, ResourceDirWrapper *parentDir, size_t entryNumber, long topEntryId, ResourcesAlbum *resAlbum)
offset_t getChildOffsetToDirectory()
FieldID
@ NONE
@ NAME_ID_ADDR
@ FIELD_COUNTER
@ OFFSET_TO_DATA
virtual void * getPtr()
virtual size_t getSubFieldsCount()
virtual void * getFieldPtr(size_t fieldId, size_t subField=FIELD_NONE)
virtual bufsize_t getSize()