BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
ResourceStringsWrapper.cpp
Go to the documentation of this file.
2
4{
5 return this->sizePtr;
6}
7
9 WORD* len = this->sizePtr;
10 if (len == NULL) return 0;
11 return (*len) * sizeof(WORD) + sizeof(WORD);
12}
13
15{
16 return getQString();
17}
18
19/* specific field boundatries */
20void* ResString::getFieldPtr(size_t fId, size_t subField)
21{
22 switch (fId) {
23 case STR_LEN: return this->sizePtr;
24 case WSTRING:
25 {
26 bufsize_t size = (sizePtr == NULL) ? 0 : static_cast<bufsize_t>(*sizePtr);
27 WORD *content = (WORD*) this->m_Exe->getContentAt(offset,Executable::RAW, size);
28 return content;
29 }
30 }
31 return this->getPtr();
32}
33
34QString ResString::getFieldName(size_t fId)
35{
36 switch (fId) {
37 case STR_LEN: return "Length";
38 case WSTRING: return "WString";
39 }
40 return "";
41}
42
43bufsize_t ResString::getFieldSize(size_t fId, size_t subField)
44{
45 switch (fId) {
46 case STR_LEN: return sizeof(WORD);
47 case WSTRING:
48 {
49 WORD* len = this->sizePtr;
50 if (len == NULL) return 0;
51 return (*len) * sizeof(WORD);
52 }
53 }
54 return 0;
55}
56//------------------------------------------------------
57
59{
60 clear();
61 this->parsedSize = 0;
62
63 BYTE *c = static_cast<BYTE*>(this->getPtr());
64 if (!c) {
65 return false;
66 }
67 size_t maxSize = this->getSize();
68 //printf("maxSize = %x\n", maxSize);
69 offset_t startRaw = getContentRaw();
70 offset_t cRaw = startRaw;
71
72 while (parsedSize < maxSize) {
73
74 WORD* stringSize = (WORD*) this->getContentAt(cRaw, Executable::RAW, sizeof(WORD));
75 if (stringSize == NULL){
76 printf("Cannot fetch the string size!\n");
77 break;
78 }
79 this->parsedSize += sizeof(WORD);
80 cRaw += sizeof(WORD);
81
82 size_t wStrSize = (*stringSize);
83 if (wStrSize == 0) {
84 continue;
85 }
86 bufsize_t totalStrSize = wStrSize * sizeof(WORD);
87
88 WORD* uStringPtr = (WORD*) this->getContentAt(cRaw, Executable::RAW, totalStrSize);
89 if (uStringPtr == NULL) break;
90
91 Executable *exe = this->myLeaf->getExe();
92 ResString *rStr = new ResString(uStringPtr, stringSize, cRaw, exe);
93 this->entries.push_back(rStr);
94
95 this->parsedSize += totalStrSize;
96 cRaw += totalStrSize;
97 }
98 return true;
99}
100
102{
103 return "ResourceString";
104}
105
106void* ResourceStringsWrapper::getFieldPtr(size_t fId, size_t subField)
107{
108 if (fId >= this->entries.size()) return NULL;
109 return this->entries[fId]->getFieldPtr(subField);
110}
111
113{
114 if (fId >= this->entries.size()) return 0;
115 return this->entries[fId]->getFieldSize(subField);
116}
117
uint32_t bufsize_t
uint64_t offset_t
std::vector< ExeNodeWrapper * > entries
virtual void clear()
BYTE * getContentAt(offset_t offset, bufsize_t size, bool allowExceptions=false)
Definition Executable.h:65
virtual QString getFieldName(size_t fieldId)
virtual void * getFieldPtr(size_t fieldId, size_t subField)
virtual bufsize_t getFieldSize(size_t fId, size_t subField)
virtual bufsize_t getSize()
virtual void * getPtr()
virtual QString getName()
BYTE * getContentAt(offset_t dataAddr, Executable::addr_type aT, bufsize_t dataSize)
ResourceLeafWrapper * myLeaf
virtual void * getFieldPtr(size_t fieldId, size_t subField)
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField=FIELD_NONE)
virtual QString getFieldName(size_t fieldId)