BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
TlsDirWrapper.cpp
Go to the documentation of this file.
1#include "pe/TlsDirWrapper.h"
2#include "pe/PEFile.h"
3
5{
6 clear();
7 size_t entryId = 0;
8 while (true) {
9 TlsEntryWrapper* entry = new TlsEntryWrapper(this->m_Exe, this, entryId++);
10
11 if (entry->getPtr() == NULL) {
12 delete entry;
13 break;
14 }
15
16 bool isOk = false;
17 uint64_t val = entry->getNumValue(TlsEntryWrapper::CALLBACK_ADDR, &isOk);
18 if (!isOk || val == 0) {
19 delete entry;
20 break;
21 }
22 this->entries.push_back(entry);
23 }
24 return true;
25}
26
28{
30 return tls32();
31 }
32 return tls64();
33}
34
36{
37 if (getPtr() == NULL) return 0;
39 return sizeof(IMAGE_TLS_DIRECTORY32);
40 }
41 return sizeof(IMAGE_TLS_DIRECTORY64);
42}
43
44void* TlsDirWrapper::getTlsDirPtr()
45{
46 bufsize_t dirSize = 0;
47
49 dirSize = sizeof(IMAGE_TLS_DIRECTORY32);
50 } else if (m_Exe->getBitMode() == Executable::BITS_64) {
51 dirSize = sizeof(IMAGE_TLS_DIRECTORY64);
52 }
53
55 BYTE *ptr = m_Exe->getContentAt(rva, Executable::RVA, dirSize);
56 return ptr;
57}
58
59IMAGE_TLS_DIRECTORY32* TlsDirWrapper::tls32()
60{
61 if (m_Exe->getBitMode() != Executable::BITS_32) return NULL;
62 return (IMAGE_TLS_DIRECTORY32*) getTlsDirPtr();
63}
64
65IMAGE_TLS_DIRECTORY64* TlsDirWrapper::tls64()
66{
67 if (m_Exe->getBitMode() != Executable::BITS_64) return NULL;
68 return (IMAGE_TLS_DIRECTORY64*) getTlsDirPtr();
69}
70
71void* TlsDirWrapper::getFieldPtr(size_t fId, size_t subField)
72{
73 IMAGE_TLS_DIRECTORY32* t32 = tls32();
74 IMAGE_TLS_DIRECTORY64* t64 = tls64();
75
76 if (t32 == NULL && t64 == NULL) return NULL;
77
78 switch (fId) {
79 case START_ADDR : return t32 ? (void*) &t32->StartAddressOfRawData : (void*) &t64->StartAddressOfRawData;
80 case END_ADDR : return t32 ? (void*) &t32->EndAddressOfRawData : (void*) &t64->EndAddressOfRawData;
81 case INDEX_ADDR : return t32 ? (void*) &t32->AddressOfIndex : (void*) &t64->AddressOfIndex;
82 case CALLBACKS_ADDR : return t32 ? (void*) &t32->AddressOfCallBacks : (void*) &t64->AddressOfCallBacks;
83 case ZEROF_SIZE : return t32 ? (void*) &t32->SizeOfZeroFill : (void*) &t64->SizeOfZeroFill;
84 case CHARACT : return t32 ? (void*) &t32->Characteristics : (void*) &t64->Characteristics;
85 }
86 return this->getPtr();
87}
88
89QString TlsDirWrapper::getFieldName(size_t fieldId)
90{
91 switch (fieldId) {
92 case START_ADDR : return "StartAddressOfRawData";
93 case END_ADDR : return "EndAddressOfRawData";
94 case INDEX_ADDR : return "AddressOfIndex";
95 case CALLBACKS_ADDR : return "AddressOfCallBacks";
96 case ZEROF_SIZE : return "SizeOfZeroFill";
97 case CHARACT : return "Characteristics";
98 }
99 return getName();
100}
101
103{
104 switch (fieldId) {
105 case START_ADDR :
106 case END_ADDR :
107 case INDEX_ADDR :
108 case CALLBACKS_ADDR :
109 return Executable::VA;
110 }
112}
113
114//----------------
116{
117 if (this->parentDir == NULL) return NULL;
118
119 bool isOk = false;
120 offset_t firstVA = static_cast<offset_t>(this->parentDir->getNumValue(TlsDirWrapper::CALLBACKS_ADDR, &isOk));
121 if (!isOk) return NULL;
122
123 offset_t firstRaw = m_Exe->toRaw(firstVA, Executable::VA);
124 if (firstRaw == INVALID_ADDR) {
125 return NULL;
126 }
127
128 bufsize_t addrSize = this->parentDir->getFieldSize(TlsDirWrapper::CALLBACKS_ADDR);
129 offset_t myRaw = firstRaw + (addrSize * this->entryNum);
130 BYTE *ptr = m_Exe->getContentAt(myRaw, Executable::RAW, addrSize);
131 return ptr;
132}
133
135{
136 if (this->parentDir == NULL) return 0;
137 bufsize_t addrSize = this->parentDir->getFieldSize(TlsDirWrapper::CALLBACKS_ADDR);
138 return addrSize;
139}
uint32_t bufsize_t
const offset_t INVALID_ADDR
uint64_t offset_t
offset_t getDirEntryAddress()
virtual bufsize_t getFieldSize(size_t fieldId, size_t subField=FIELD_NONE)
virtual uint64_t getNumValue(size_t fieldId, size_t subField, bool *isOk)
std::vector< ExeNodeWrapper * > entries
virtual void clear()
virtual exe_bits getBitMode()
Definition Executable.h:56
virtual offset_t toRaw(offset_t offset, addr_type addrType, bool allowExceptions=false)
BYTE * getContentAt(offset_t offset, bufsize_t size, bool allowExceptions=false)
Definition Executable.h:65
virtual QString getName()
virtual bufsize_t getSize()
virtual void * getPtr()
virtual void * getFieldPtr(size_t fieldId, size_t subField)
virtual QString getFieldName(size_t fieldId)
virtual Executable::addr_type containsAddrType(size_t fieldId, size_t subField=FIELD_NONE)
virtual bufsize_t getSize()
virtual void * getPtr()
@ CALLBACK_ADDR