BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
ResourceVersionWrapper.cpp
Go to the documentation of this file.
2
4 : ResourceContentWrapper(pe, v_leaf, pe::RESTYPE_VERSION)
5{
6//TEST
7/* printf("Version: %s\n", getVersionText().toStdString().c_str());
8
9 pe::version_info *info = getVersionInfo();
10 if (info == NULL) return;
11
12 if (info->children == 0) {
13 printf("No children!");
14 return;
15 }
16 BYTE *childEntry = (BYTE*) &info->children;
17 pe::version_child* child = (pe::version_child*) m_Exe->getContentAtPtr(childEntry, sizeof(pe::version_child));
18 if (child == NULL) {
19 printf("[ERR] Cannot fetch a child\n");
20 } else {
21 printf("Got child of type: [%d]\n", child->wType);
22 printf("len = %x\nValLen = %x\ntype = %x\nkey[0] = %c\n", child->wLength, child->wValueLength, child->wType, child->szKey[0]);
23
24 int size = INFOTEXT_LEN;
25 WORD *content = (WORD*) child->szKey;
26 if (content == NULL) return;
27
28 QString str = QString::fromUtf16(content, size);
29 std::string verStr = str.toStdString();
30 printf("key = [%s] len = %d\n", verStr.c_str(), verStr.length());
31 }
32 */
34}
35
37{
38 void *ptr = this->getResContentPtr();
39 if (ptr == NULL) return NULL;
40
41 size_t size = this->getResContentSize();
42 if (size < sizeof(pe::version_info)) return NULL;
43
44 pe::version_info* info = (pe::version_info*) ptr;
45 return info;
46}
47
49{
50 switch (fId) {
51 case STRUCT_LEN: return "Length of Structure";
52 case VAL_LEN: return "Length of Value";
53 case STRUCT_TYPE: return "Type of Structure";
54 case INFO: return "Info";
55 //case PADDING1: return "Padding1";
56 case SIGNATURE: return "Signature";
57 case STRUCT_VER: return "Struct. Version";
58
59 case FILE_VER_0:
60 case FILE_VER_1: return "File Version";
61
62 case PRODUCT_VER_0:
63 case PRODUCT_VER_1: return "Product Version";
64
65 case FLAGS_MASK: return "File Flags mask";
66 case FLAGS: return "Flags";
67 case OS: return "File OS";
68 case TYPE: return "File Type";
69 case SUBTYPE: return "File SubType";
70 case TIMESTAMP_0: case TIMESTAMP_1: return "File Timestamp";
71 //case PADDING2: return "Padding2";
72 case CHILDREN: return "Children";
73 }
74 return "";
75}
76
77void* ResourceVersionWrapper::getFieldPtr(size_t fId, size_t subField)
78{
79 pe::version_info* ptr = getVersionInfo();
80
81 if (ptr == NULL) return NULL;
82
83 switch (fId) {
84 case STRUCT_LEN: return &(ptr->length);
85 case VAL_LEN: return &(ptr->valueLength);
86 case STRUCT_TYPE: return &(ptr->type);
87 case INFO: return &(ptr->key);
88
89 case SIGNATURE: return &(ptr->Value.dwSignature);
90 case STRUCT_VER: return &(ptr->Value.dwStrucVersion);
91 case FILE_VER_0: return &(ptr->Value.dwFileVersionMS);
92 case FILE_VER_1: return &(ptr->Value.dwFileVersionLS);
93
94 case PRODUCT_VER_0: return &(ptr->Value.dwProductVersionMS);
95 case PRODUCT_VER_1: return &(ptr->Value.dwProductVersionLS);
96
97 case FLAGS_MASK: return &(ptr->Value.dwFileFlagsMask);
98 case FLAGS: return &(ptr->Value.dwFileFlags);
99 case OS: return &(ptr->Value.dwFileOS);
100 case TYPE: return &(ptr->Value.dwFileType);
101 case SUBTYPE: return &(ptr->Value.dwFileSubtype);
102 case TIMESTAMP_0: return &(ptr->Value.dwFileDateMS);
103 case TIMESTAMP_1: return &(ptr->Value.dwFileDateLS);
104
105 //case PADDING2: return &(ptr->padding2);
106 case CHILDREN: return &(ptr->children);
107 }
108 return ptr;
109}
110
112{
113 if (fieldId == INFO) {
115 }
116 return WrappedValue::INT;
117}
virtual WrappedValue::data_type containsDataType(size_t fieldId, size_t subField=FIELD_NONE)
ResourceVersionWrapper(Executable *pe, ResourceLeafWrapper *v_leaf)
virtual void * getFieldPtr(size_t fieldId, size_t subField)
virtual QString getFieldName(size_t fieldId)
pe::version_info * getVersionInfo()