BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
RichHdrWrapper.h
Go to the documentation of this file.
1#pragma once
2
3#include "PENodeWrapper.h"
4#include "pe_undoc.h"
5
6const QString RichHdr_ProdIdToVSversion(WORD prodId);
7const QString RichHdr_translateProdId(WORD prodId);
8
10{
11public:
12 /* fields :*/
24
27
28 size_t compIdCount();
29
30 virtual bool wrap();
31 /* full structure boundaries */
32 virtual void* getPtr();
33 virtual bufsize_t getSize();
34 virtual QString getName() { return "Rich Hdr"; }
35 virtual size_t getFieldsCount();
36
37 /* specific field boundaries */
38 virtual void* getFieldPtr(size_t fieldId, size_t subField = FIELD_NONE);
39 virtual bufsize_t getFieldSize(size_t fieldId, size_t subField = FIELD_NONE);
40 virtual QString translateFieldContent(size_t fieldId);
41 virtual QString getFieldName(size_t fieldId);
42 virtual Executable::addr_type containsAddrType(uint32_t fieldId, uint32_t subField = FIELD_NONE);
43
44 /* only for this wrapper type */
45 pe::RICH_COMP_ID getCompId(size_t fieldId);
46 DWORD calcChecksum();
47
48protected:
49 pe::RICH_SIGNATURE* richSign;
50 pe::RICH_DANS_HEADER* dansHdr;
52};
53
54
uint32_t bufsize_t
#define FIELD_NONE
const QString RichHdr_translateProdId(WORD prodId)
const QString RichHdr_ProdIdToVSversion(WORD prodId)
virtual Executable::addr_type containsAddrType(uint32_t fieldId, uint32_t subField=FIELD_NONE)
virtual void * getPtr()
virtual void * getFieldPtr(size_t fieldId, size_t subField=FIELD_NONE)
pe::RICH_DANS_HEADER * dansHdr
RichHdrWrapper(PEFile *pe)
virtual bool wrap()
virtual bufsize_t getSize()
pe::RICH_COMP_ID getCompId(size_t fieldId)
virtual QString getName()
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField=FIELD_NONE)
virtual size_t getFieldsCount()
virtual QString getFieldName(size_t fieldId)
pe::RICH_SIGNATURE * richSign
virtual QString translateFieldContent(size_t fieldId)