BearParser
Portable Executable parsing library (from PE-bear)
Toggle main menu visibility
Loading...
Searching...
No Matches
parser
Util.cpp
Go to the documentation of this file.
1
#include "
Util.h
"
2
#include <stdarg.h>
3
4
using namespace
pe_util
;
5
6
#define MAX_LINE 255
7
8
bool
Logger::append
(
dbg_level
lvl,
const
char
* format, ...)
9
{
10
if
(lvl >
DBG_LVL
) {
11
return
false
;
12
}
13
if
(format == NULL) {
14
return
false
;
15
}
16
va_list argptr;
17
// Initializing arguments to store all values after format
18
va_start(argptr, format);
19
20
char
line[
MAX_LINE
+ 1];
21
memset(line, 0,
MAX_LINE
+ 1);
22
23
int
printed = vsnprintf(line,
MAX_LINE
, format, argptr);
24
25
//cleaning up the list:
26
va_end(argptr);
27
if
(printed <= 0)
return
false
;
28
29
const
char
*prefixes[
D_LVL_COUNT
] = {
"ERROR"
,
"WARNING"
,
"INFO"
};
30
if
(
static_cast<
unsigned
>
(lvl) >
static_cast<
unsigned
>
(
D_LVL_COUNT
)) {
31
lvl =
Logger::D_ERROR
;
32
}
33
34
fprintf(stderr,
"[%s] %s\n"
, prefixes[lvl], line);
35
return
true
;
36
}
37
38
bool
pe_util::isStrLonger
(
const
char
*inp,
size_t
maxLen)
39
{
40
for
(
size_t
i = 0; i < maxLen; i++ ) {
41
if
(inp[i] ==
'\0'
)
return
false
;
42
}
43
return
true
;
44
}
45
46
size_t
pe_util::getAsciiLen
(
const
char
*inp,
size_t
maxInp,
bool
acceptNotTerminated)
47
{
48
size_t
i = 0;
49
for
(; i < maxInp; i++) {
50
const
char
c = inp[i];
51
if
(c ==
'\0'
)
return
i;
//end of string
52
if
(!
IS_PRINTABLE
(c) && !
IS_ENDLINE
(c))
break
;
53
}
54
if
(acceptNotTerminated)
return
i;
55
return
0;
56
}
57
58
size_t
pe_util::getAsciiLenW
(
const
WORD *inp,
size_t
maxInp,
bool
acceptNotTerminated)
59
{
60
size_t
i = 0;
61
for
(; i < maxInp; i++) {
62
const
WORD w = inp[i];
63
if
(w == 0)
return
i;
//end of string
64
if
(!
IS_PRINTABLE
(w) && !
IS_ENDLINE
(w))
break
;
65
}
66
if
(acceptNotTerminated)
return
i;
67
return
0;
68
}
69
70
bool
pe_util::hasNonPrintable
(
const
char
*inp,
size_t
maxInp)
71
{
72
unsigned
int
i = 0;
73
for
( i = 0; i < maxInp; i++) {
74
char
c = inp[i];
75
if
(c ==
'\0'
)
break
;
//end of string
76
if
(!
IS_PRINTABLE
(c))
return
true
;
77
}
78
return
false
;
79
}
80
81
bool
_isFuncChar
(
const
char
c)
82
{
83
char
charset[] =
"_.#@?-\\/:$ "
;
84
85
if
(::isalnum(c)) {
86
return
true
;
87
}
88
for
(
size_t
i = 0; i <
sizeof
(charset); ++i) {
89
if
(c == charset[i])
return
true
;
90
}
91
return
false
;
92
}
93
94
bool
pe_util::validateFuncName
(
const
char
* fPtr,
size_t
bufSize)
95
{
96
if
(!fPtr || !bufSize)
return
false
;
97
98
for
(
char
i = 0; i < bufSize; i++) {
99
const
char
c = fPtr[i];
100
if
(c == 0)
break
;
101
if
(!
_isFuncChar
(c)) {
102
return
false
;
103
}
104
}
105
return
true
;
106
}
107
108
size_t
pe_util::forwarderNameLen
(
const
char
* fPtr,
size_t
bufSize)
109
{
110
if
(!fPtr || bufSize == 0)
return
0;
111
112
// names can be also mangled, i.e. MSVCRT.??0__non_rtti_object@std@@QAE@ABV01@@Z
113
bool
has_dot =
false
;
114
size_t
len = 0;
115
while
((*fPtr ==
'.'
) ||
_isFuncChar
(*fPtr))
116
{
117
if
(*fPtr ==
'.'
) has_dot =
true
;
118
len++;
119
if
((--bufSize) == 0)
break
;
120
fPtr++;
121
}
122
if
(*fPtr ==
'\0'
) {
123
if
(!has_dot) {
124
return
0;
//this is not a valid forwarder
125
}
126
return
len;
127
}
128
return
0;
129
}
130
131
size_t
pe_util::noWhiteCount
(
char
*buf,
size_t
bufSize) {
132
size_t
cntr = 0;
133
size_t
i = 0;
134
for
(i = 0; i < bufSize; i++) {
135
if
(
IS_PRINTABLE
(buf[i]) && buf[i] !=
' '
)
136
cntr++;
137
}
138
return
cntr;
139
}
140
141
size_t
pe_util::noWhiteCount
(std::string s)
142
{
143
size_t
bufSize = s.length();
144
size_t
cntr = 0;
145
size_t
i = 0;
146
for
(i = 0; i < bufSize; i++) {
147
if
(
IS_PRINTABLE
(s[i]) && s[i] !=
' '
)
148
cntr++;
149
}
150
return
cntr;
151
}
152
153
bool
pe_util::isSpaceClear
(
void
* ptr, uint64_t size)
154
{
155
BYTE* testblock = (BYTE*) calloc(size,
sizeof
(BYTE));
156
bool
isClear =
true
;
157
if
(memcmp (testblock, ptr, size)) {
158
isClear =
false
;
159
}
160
free(testblock);
161
return
isClear;
162
}
163
164
bool
pe_util::isHexChar
(
char
c)
165
{
166
if
(isdigit(c))
return
true
;
167
if
(c >=
'A'
&& c <=
'F'
)
return
true
;
168
if
(c >=
'a'
&& c <=
'f'
)
return
true
;
169
return
false
;
170
}
171
172
void
pe_util::hexdump
(BYTE *buf,
size_t
bufSize,
size_t
pad)
173
{
174
if
(buf == NULL)
return
;
175
printf(
"\n---\n"
);
176
for
(
size_t
i = 0; i < bufSize; i++) {
177
if
(i % pad == 0) printf(
"\n"
);
178
printf(
"0x%02X "
, buf[i]);
179
}
180
printf(
"\n---\n"
);
181
}
182
183
bool
pe_util::endsWith
(std::string str, std::string endStr)
184
{
185
if
(str.length() < endStr.length()) {
186
return
false
;
187
}
188
size_t
pos = str.length() - endStr.length();
189
std::string str3 = str.substr(pos);
190
if
( str3 == endStr ) {
191
return
true
;
192
}
193
return
false
;
194
}
MAX_LINE
#define MAX_LINE
Definition
Util.cpp:6
_isFuncChar
bool _isFuncChar(const char c)
Definition
Util.cpp:81
Util.h
IS_ENDLINE
#define IS_ENDLINE(c)
Definition
Util.h:12
IS_PRINTABLE
#define IS_PRINTABLE(c)
Definition
Util.h:11
DBG_LVL
#define DBG_LVL
Definition
Util.h:18
Logger::append
bool append(dbg_level lvl, const char *format,...)
Definition
Util.cpp:8
Logger::dbg_level
dbg_level
Definition
Util.h:25
Logger::D_LVL_COUNT
@ D_LVL_COUNT
Definition
Util.h:26
Logger::D_ERROR
@ D_ERROR
Definition
Util.h:26
pe_util
Definition
Util.h:31
pe_util::hasNonPrintable
bool hasNonPrintable(const char *ptr, size_t maxInp)
Definition
Util.cpp:70
pe_util::forwarderNameLen
size_t forwarderNameLen(const char *ptr, size_t max_len)
Definition
Util.cpp:108
pe_util::getAsciiLen
size_t getAsciiLen(const char *ptr, size_t maxCount, bool acceptNotTerminated=false)
Definition
Util.cpp:46
pe_util::isStrLonger
bool isStrLonger(const char *inp, size_t maxLen)
Definition
Util.cpp:38
pe_util::noWhiteCount
size_t noWhiteCount(char *buf, size_t bufSize)
Definition
Util.cpp:131
pe_util::validateFuncName
bool validateFuncName(const char *fPtr, size_t bufSize)
Definition
Util.cpp:94
pe_util::hexdump
void hexdump(BYTE *buf, size_t bufSize, size_t pad)
Definition
Util.cpp:172
pe_util::isSpaceClear
bool isSpaceClear(void *ptr, uint64_t size)
Definition
Util.cpp:153
pe_util::getAsciiLenW
size_t getAsciiLenW(const WORD *ptr, size_t maxCount, bool acceptNotTerminated=false)
Definition
Util.cpp:58
pe_util::isHexChar
bool isHexChar(char c)
Definition
Util.cpp:164
pe_util::endsWith
bool endsWith(std::string string, std::string endStr)
Definition
Util.cpp:183
Generated by
1.17.0