BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
DOSExe Class Reference

#include <DOSExe.h>

Collaboration diagram for DOSExe:

Public Types

enum  WRAPPERS { WR_NONE = MappedExe::WR_NONE , WR_DOS_HDR = 0 , COUNT_WRAPPERS }
Public Types inherited from Executable
enum  exe_bits { UNKNOWN = 0 , BITS_16 = 16 , BITS_32 = 32 , BITS_64 = 64 }
enum  exe_arch { ARCH_UNKNOWN = 0 , ARCH_INTEL = 1 , ARCH_ARM = 2 , EXE_ARCH_COUNT }
enum  addr_type {
  NOT_ADDR = 0 , RAW = 1 , RVA = 2 , VA = 3 ,
  ADDR_TYPE_COUNT
}
Public Types inherited from ExeWrappersContainer
enum  WRAPPERS { WR_NONE = size_t(-1) , COUNT_WRAPPERS = 0 }

Public Member Functions

 DOSExe (AbstractByteBuffer *v_buf)
virtual ~DOSExe ()
virtual exe_arch getArch ()
virtual void wrap ()
virtual offset_t rawToRva (offset_t raw)
virtual offset_t rvaToRaw (offset_t rva)
virtual bufsize_t getMappedSize (Executable::addr_type aType)
virtual bufsize_t getAlignment (Executable::addr_type aType) const
virtual offset_t getImageBase (bool recalculate=false)
virtual offset_t getEntryPoint (Executable::addr_type aType=Executable::RVA)
virtual offset_t dosHeaderOffset ()
offset_t peSignatureOffset ()
Public Member Functions inherited from MappedExe
virtual bool canResize (bufsize_t newSize)
virtual bool resize (bufsize_t newSize)
Public Member Functions inherited from Executable
bool isBit64 ()
bool isBit32 ()
virtual ~Executable (void)
virtual exe_bits getBitMode ()
virtual bufsize_t getContentSize ()
virtual BYTE * getContent ()
virtual offset_t getRawSize () const
BYTE * getContentAtPtr (BYTE *ptr, bufsize_t size, bool allowExceptions=false)
BYTE * getContentAt (offset_t offset, bufsize_t size, bool allowExceptions=false)
virtual BYTE * getContentAt (offset_t offset, Executable::addr_type aType, bufsize_t size, bool allowExceptions=false)
virtual bufsize_t getImageSize ()
virtual size_t getAllEntryPoints (QMap< offset_t, QString > &entrypoints, Executable::addr_type aType=Executable::RVA)
virtual bool isValidAddr (offset_t addr, addr_type addrType)
virtual bool isValidVA (offset_t va)
virtual offset_t convertAddr (offset_t inAddr, Executable::addr_type inType, Executable::addr_type outType)
virtual offset_t toRaw (offset_t offset, addr_type addrType, bool allowExceptions=false)
Executable::addr_type detectAddrType (offset_t addr, Executable::addr_type hintType)
virtual offset_t VaToRva (offset_t va, bool autodetect=false)
virtual offset_t rvaToVa (offset_t rva)
virtual offset_t vaToRaw (offset_t va)
QString getFileName ()
virtual bool isResized ()
virtual bool isTruncated ()
AbstractByteBuffergetFileBuffer () const
bufsize_t getFileSize () const
virtual bool dumpFragment (offset_t offset, bufsize_t size, QString fileName)
Public Member Functions inherited from AbstractByteBuffer
 AbstractByteBuffer ()
virtual ~AbstractByteBuffer ()
BYTE operator[] (size_t idx)
virtual offset_t getOffset (void *ptr, bool allowExceptions=false)
virtual bool setBufferedValue (BYTE *dstPtr, BYTE *srcPtr, bufsize_t srcSize, bufsize_t paddingSize, bool allowExceptions=false)
bool setStringValue (offset_t rawOffset, QString newText)
QString getStringValue (offset_t rawOffset, bufsize_t len=BUFSIZE_MAX, bool acceptNonTerminated=false)
QString getWStringValue (offset_t rawOffset, bufsize_t len)
QString getWAsciiStringValue (offset_t rawOffset, bufsize_t len, bool acceptNonTerminated=false)
bufsize_t getMaxSizeFromOffset (offset_t startOffset)
bufsize_t getMaxSizeFromPtr (BYTE *ptr)
bool isAreaEmpty (offset_t rawOffset, bufsize_t size)
bool fillContent (BYTE filling)
bool pasteBuffer (offset_t rawOffset, AbstractByteBuffer *buf, bool allowTrunc)
bool containsBlock (offset_t rawOffset, bufsize_t size)
bool intersectsBlock (offset_t rawOffset, bufsize_t size)
uint64_t getNumValue (offset_t offset, bufsize_t size, bool *isOk)
bool setNumValue (offset_t offset, bufsize_t size, uint64_t newVal)
bool setTextValue (char *textPtr, std::string newText, size_t fieldLimitLen=0)
offset_t substFragmentByFile (offset_t offset, bufsize_t contentSize, QFile &fIn)
Public Member Functions inherited from ExeWrappersContainer
 ExeWrappersContainer ()
virtual ~ExeWrappersContainer (void)
virtual ExeElementWrappergetWrapper (size_t wrapperId)
size_t wrappersCount ()
QString getWrapperName (size_t id)

Protected Member Functions

offset_t codeOffset ()
bufsize_t moduleSize ()
Protected Member Functions inherited from MappedExe
 MappedExe (AbstractByteBuffer *v_buf, exe_bits v_bitMode)
virtual ~MappedExe (void)
Protected Member Functions inherited from Executable
 Executable (AbstractByteBuffer *v_buf, exe_bits v_bitMode)
Protected Member Functions inherited from ExeWrappersContainer
void clearWrappers ()

Protected Attributes

DosHdrWrapperdosHdrWrapper
IMAGE_DOS_HEADER * m_dosHdr
Protected Attributes inherited from Executable
exe_bits bitMode
AbstractByteBufferbuf
Protected Attributes inherited from ExeWrappersContainer
std::map< size_t, ExeElementWrapper * > wrappers

Additional Inherited Members

Static Public Member Functions inherited from Executable
static bool isBit64 (Executable *exe)
static bool isBit32 (Executable *exe)
Static Public Member Functions inherited from AbstractByteBuffer
static bool isValid (AbstractByteBuffer *buf)

Detailed Description

Definition at line 18 of file DOSExe.h.

Member Enumeration Documentation

◆ WRAPPERS

Enumerator
WR_NONE 
WR_DOS_HDR 
COUNT_WRAPPERS 

Definition at line 21 of file DOSExe.h.

Constructor & Destructor Documentation

◆ DOSExe()

DOSExe::DOSExe ( AbstractByteBuffer * v_buf)

Definition at line 34 of file DOSExe.cpp.

Here is the call graph for this function:

◆ ~DOSExe()

virtual DOSExe::~DOSExe ( )
inlinevirtual

Definition at line 28 of file DOSExe.h.

Member Function Documentation

◆ codeOffset()

offset_t DOSExe::codeOffset ( )
inlineprotected

Definition at line 56 of file DOSExe.h.

◆ dosHeaderOffset()

virtual offset_t DOSExe::dosHeaderOffset ( )
inlinevirtual

Definition at line 52 of file DOSExe.h.

◆ getAlignment()

virtual bufsize_t DOSExe::getAlignment ( Executable::addr_type aType) const
inlinevirtual

Implements Executable.

Definition at line 46 of file DOSExe.h.

◆ getArch()

virtual exe_arch DOSExe::getArch ( )
inlinevirtual

Implements Executable.

Definition at line 30 of file DOSExe.h.

◆ getEntryPoint()

virtual offset_t DOSExe::getEntryPoint ( Executable::addr_type aType = Executable::RVA)
inlinevirtual

Implements Executable.

Definition at line 48 of file DOSExe.h.

Here is the call graph for this function:

◆ getImageBase()

virtual offset_t DOSExe::getImageBase ( bool recalculate = false)
inlinevirtual

Implements Executable.

Definition at line 47 of file DOSExe.h.

◆ getMappedSize()

virtual bufsize_t DOSExe::getMappedSize ( Executable::addr_type aType)
inlinevirtual

Implements Executable.

Definition at line 39 of file DOSExe.h.

Here is the call graph for this function:

◆ moduleSize()

bufsize_t DOSExe::moduleSize ( )
inlineprotected

Definition at line 57 of file DOSExe.h.

◆ peSignatureOffset()

offset_t DOSExe::peSignatureOffset ( )

Definition at line 60 of file DOSExe.cpp.

◆ rawToRva()

virtual offset_t DOSExe::rawToRva ( offset_t raw)
inlinevirtual

Implements Executable.

Definition at line 36 of file DOSExe.h.

Here is the call graph for this function:

◆ rvaToRaw()

virtual offset_t DOSExe::rvaToRaw ( offset_t rva)
inlinevirtual

Implements Executable.

Definition at line 37 of file DOSExe.h.

Here is the call graph for this function:

◆ wrap()

void DOSExe::wrap ( )
virtual

Implements MappedExe.

Definition at line 40 of file DOSExe.cpp.

Here is the call graph for this function:

Member Data Documentation

◆ dosHdrWrapper

DosHdrWrapper* DOSExe::dosHdrWrapper
protected

Definition at line 69 of file DOSExe.h.

◆ m_dosHdr

IMAGE_DOS_HEADER* DOSExe::m_dosHdr
protected

Definition at line 70 of file DOSExe.h.


The documentation for this class was generated from the following files: