BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
ResourceStringsWrapper.h
Go to the documentation of this file.
1#pragma once
4
5#include <vector>
6
7class ResString : public ExeNodeWrapper {
8public:
15
16 ResString(WORD *v_ptr, WORD *v_sizePtr, offset_t v_offset, Executable* v_exe)
17 : ExeNodeWrapper(v_exe), ptr(v_ptr), sizePtr(v_sizePtr), offset(v_offset) { }
18
19 /* full structure boundatries */
20 virtual void* getPtr();
21 virtual bufsize_t getSize();
22 virtual QString getName();
23 virtual size_t getFieldsCount() { return FIELD_COUNTER; }
24 virtual size_t getSubFieldsCount() { return 1; }
25
26 /* specific field boundatries */
27 virtual void* getFieldPtr(size_t fieldId, size_t subField);
28 virtual QString getFieldName(size_t fieldId);
29 virtual bufsize_t getFieldSize(size_t fId, size_t subField);
30
31 QString getQString()
32 {
33 if (this->m_Exe == NULL) return ""; //ERROR
34 WORD* entries = ptr;
35 int size = *(sizePtr);
36 WORD *content = (WORD*) this->m_Exe->getContentAt(offset,Executable::RAW, size);
37 if (content == NULL) return "";
38
39 return QString::fromUtf16(content, size);
40 }
41
42 virtual size_t getStrLen() { return (sizePtr == NULL) ? 0 : static_cast<size_t>(*sizePtr); }
43 virtual WrappedValue::data_type containsDataType(size_t fieldId, size_t subField)
44 {
45 if (fieldId == WSTRING) {
47 }
48 return WrappedValue::INT;
49 }
50 WORD *ptr;
51 WORD *sizePtr;
53};
54
56{
57public:
64
65 /* specific field boundatries */
66 virtual QString getFieldName(size_t fieldId);
67 virtual void* getFieldPtr(size_t fieldId, size_t subField);
68 virtual bufsize_t getFieldSize(size_t fieldId, size_t subField = FIELD_NONE);
69
70 virtual size_t getFieldsCount() { return entries.size(); }
71
73 {
74 if (index > entries.size()) return NULL;
75 ResString* str = dynamic_cast<ResString*>(entries[index]);
76 return str;
77 }
78
79 QString getQStringAt(size_t index)
80 {
81 ResString* str = getResStringAt(index);
82 return str->getQString();
83 }
84
85 size_t getResStringsCount() { return entries.size(); }
86
87 virtual WrappedValue::data_type containsDataType(size_t fieldId, size_t subField)
88 {
89 if (fieldId == WSTRING) {
91 }
92 return WrappedValue::INT;
93 }
94
95protected:
97 : ResourceContentWrapper(pe, v_leaf, pe::RESTYPE_STRING) { wrap(); }
98
99 bool wrap();
100
102
104friend class ResourcesAlbum;
105};
106
uint32_t bufsize_t
uint64_t offset_t
#define FIELD_NONE
std::vector< ExeNodeWrapper * > entries
BYTE * getContentAt(offset_t offset, bufsize_t size, bool allowExceptions=false)
Definition Executable.h:65
virtual QString getFieldName(size_t fieldId)
virtual void * getFieldPtr(size_t fieldId, size_t subField)
virtual bufsize_t getFieldSize(size_t fId, size_t subField)
virtual bufsize_t getSize()
virtual void * getPtr()
virtual QString getName()
virtual size_t getStrLen()
virtual size_t getSubFieldsCount()
virtual size_t getFieldsCount()
virtual WrappedValue::data_type containsDataType(size_t fieldId, size_t subField)
ResString(WORD *v_ptr, WORD *v_sizePtr, offset_t v_offset, Executable *v_exe)
virtual void * getFieldPtr(size_t fieldId, size_t subField)
ResourceStringsWrapper(Executable *pe, ResourceLeafWrapper *v_leaf)
ResString * getResStringAt(size_t index)
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField=FIELD_NONE)
virtual QString getFieldName(size_t fieldId)
QString getQStringAt(size_t index)
virtual WrappedValue::data_type containsDataType(size_t fieldId, size_t subField)