BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
Util.cpp
Go to the documentation of this file.
1#include "Util.h"
2#include <stdarg.h>
3
4using namespace pe_util;
5
6#define MAX_LINE 255
7
8bool Logger::append(dbg_level lvl, const char* format, ...)
9{
10 if (lvl > DBG_LVL) {
11 return false;
12 }
13 if (format == NULL) {
14 return false;
15 }
16 va_list argptr;
17 // Initializing arguments to store all values after format
18 va_start(argptr, format);
19
20 char line[MAX_LINE + 1];
21 memset(line, 0, MAX_LINE + 1);
22
23 int printed = vsnprintf(line, MAX_LINE, format, argptr);
24
25 //cleaning up the list:
26 va_end(argptr);
27 if (printed <= 0) return false;
28
29 const char *prefixes[D_LVL_COUNT] = { "ERROR", "WARNING", "INFO" };
30 if (static_cast<unsigned>(lvl) > static_cast<unsigned>(D_LVL_COUNT)) {
31 lvl = Logger::D_ERROR;
32 }
33
34 fprintf(stderr, "[%s] %s\n", prefixes[lvl], line);
35 return true;
36}
37
38bool pe_util::isStrLonger(const char *inp, size_t maxLen)
39{
40 for (size_t i = 0; i < maxLen; i++ ) {
41 if (inp[i] == '\0') return false;
42 }
43 return true;
44}
45
46size_t pe_util::getAsciiLen(const char *inp, size_t maxInp, bool acceptNotTerminated)
47{
48 size_t i = 0;
49 for (; i < maxInp; i++) {
50 const char c = inp[i];
51 if (c == '\0') return i; //end of string
52 if (!IS_PRINTABLE(c) && !IS_ENDLINE(c)) break;
53 }
54 if (acceptNotTerminated) return i;
55 return 0;
56}
57
58size_t pe_util::getAsciiLenW(const WORD *inp, size_t maxInp, bool acceptNotTerminated)
59{
60 size_t i = 0;
61 for (; i < maxInp; i++) {
62 const WORD w = inp[i];
63 if (w == 0) return i; //end of string
64 if (!IS_PRINTABLE(w) && !IS_ENDLINE(w)) break;
65 }
66 if (acceptNotTerminated) return i;
67 return 0;
68}
69
70bool pe_util::hasNonPrintable(const char *inp, size_t maxInp)
71{
72 unsigned int i = 0;
73 for ( i = 0; i < maxInp; i++) {
74 char c = inp[i];
75 if (c == '\0') break; //end of string
76 if (!IS_PRINTABLE(c)) return true;
77 }
78 return false;
79}
80
81bool _isFuncChar(const char c)
82{
83 char charset[] = "_.#@?-\\/:$ ";
84
85 if (::isalnum(c)) {
86 return true;
87 }
88 for (size_t i = 0; i < sizeof(charset); ++i) {
89 if (c == charset[i]) return true;
90 }
91 return false;
92}
93
94bool pe_util::validateFuncName(const char* fPtr, size_t bufSize)
95{
96 if (!fPtr || !bufSize) return false;
97
98 for (char i = 0; i < bufSize; i++) {
99 const char c = fPtr[i];
100 if (c == 0) break;
101 if (!_isFuncChar(c)) {
102 return false;
103 }
104 }
105 return true;
106}
107
108size_t pe_util::forwarderNameLen(const char* fPtr, size_t bufSize)
109{
110 if (!fPtr || bufSize == 0) return 0;
111
112 // names can be also mangled, i.e. MSVCRT.??0__non_rtti_object@std@@QAE@ABV01@@Z
113 bool has_dot = false;
114 size_t len = 0;
115 while ((*fPtr == '.') || _isFuncChar(*fPtr))
116 {
117 if (*fPtr == '.') has_dot = true;
118 len++;
119 if ((--bufSize) == 0) break;
120 fPtr++;
121 }
122 if (*fPtr == '\0') {
123 if (!has_dot) {
124 return 0; //this is not a valid forwarder
125 }
126 return len;
127 }
128 return 0;
129}
130
131size_t pe_util::noWhiteCount(char *buf, size_t bufSize) {
132 size_t cntr = 0;
133 size_t i = 0;
134 for (i = 0; i < bufSize; i++) {
135 if (IS_PRINTABLE(buf[i]) && buf[i] != ' ')
136 cntr++;
137 }
138 return cntr;
139}
140
141size_t pe_util::noWhiteCount(std::string s)
142{
143 size_t bufSize = s.length();
144 size_t cntr = 0;
145 size_t i = 0;
146 for (i = 0; i < bufSize; i++) {
147 if (IS_PRINTABLE(s[i]) && s[i] != ' ')
148 cntr++;
149 }
150 return cntr;
151}
152
153bool pe_util::isSpaceClear(void* ptr, uint64_t size)
154{
155 BYTE* testblock = (BYTE*) calloc(size, sizeof(BYTE));
156 bool isClear = true;
157 if (memcmp (testblock, ptr, size)) {
158 isClear = false;
159 }
160 free(testblock);
161 return isClear;
162}
163
165{
166 if (isdigit(c)) return true;
167 if (c >= 'A' && c <= 'F') return true;
168 if (c >= 'a' && c <= 'f') return true;
169 return false;
170}
171
172void pe_util::hexdump(BYTE *buf, size_t bufSize, size_t pad)
173{
174 if (buf == NULL) return;
175 printf("\n---\n");
176 for (size_t i = 0; i < bufSize; i++) {
177 if (i % pad == 0) printf("\n");
178 printf("0x%02X ", buf[i]);
179 }
180 printf("\n---\n");
181}
182
183bool pe_util::endsWith(std::string str, std::string endStr)
184{
185 if (str.length() < endStr.length()) {
186 return false;
187 }
188 size_t pos = str.length() - endStr.length();
189 std::string str3 = str.substr(pos);
190 if ( str3 == endStr ) {
191 return true;
192 }
193 return false;
194}
#define MAX_LINE
Definition Util.cpp:6
bool _isFuncChar(const char c)
Definition Util.cpp:81
#define IS_ENDLINE(c)
Definition Util.h:12
#define IS_PRINTABLE(c)
Definition Util.h:11
#define DBG_LVL
Definition Util.h:18
bool append(dbg_level lvl, const char *format,...)
Definition Util.cpp:8
dbg_level
Definition Util.h:25
@ D_LVL_COUNT
Definition Util.h:26
@ D_ERROR
Definition Util.h:26
Definition Util.h:31
bool hasNonPrintable(const char *ptr, size_t maxInp)
Definition Util.cpp:70
size_t forwarderNameLen(const char *ptr, size_t max_len)
Definition Util.cpp:108
size_t getAsciiLen(const char *ptr, size_t maxCount, bool acceptNotTerminated=false)
Definition Util.cpp:46
bool isStrLonger(const char *inp, size_t maxLen)
Definition Util.cpp:38
size_t noWhiteCount(char *buf, size_t bufSize)
Definition Util.cpp:131
bool validateFuncName(const char *fPtr, size_t bufSize)
Definition Util.cpp:94
void hexdump(BYTE *buf, size_t bufSize, size_t pad)
Definition Util.cpp:172
bool isSpaceClear(void *ptr, uint64_t size)
Definition Util.cpp:153
size_t getAsciiLenW(const WORD *ptr, size_t maxCount, bool acceptNotTerminated=false)
Definition Util.cpp:58
bool isHexChar(char c)
Definition Util.cpp:164
bool endsWith(std::string string, std::string endStr)
Definition Util.cpp:183