BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
ExeElementWrapper Class Referenceabstract

#include <ExeElementWrapper.h>

Collaboration diagram for ExeElementWrapper:

Public Member Functions

 ExeElementWrapper (Executable *exe)
 
virtual ~ExeElementWrapper ()
 
virtual bool wrap ()
 
virtual bufsize_t getContentSize ()
 
virtual BYTE * getContent ()
 
virtual void * getPtr ()=0
 
virtual bufsize_t getSize ()=0
 
virtual QString getName ()=0
 
virtual size_t getFieldsCount ()=0
 
virtual size_t getSubFieldsCount ()
 
virtual offset_t getOffset ()
 
virtual offset_t getOffset (void *ptr, bool allowExceptions=false)
 
virtual void * getFieldPtr (size_t fieldId, size_t subField)=0
 
void * getFieldPtr (size_t fieldId)
 
virtual bufsize_t getFieldSize (size_t fieldId, size_t subField=FIELD_NONE)
 
virtual offset_t getFieldOffset (size_t fieldId, size_t subField=FIELD_NONE)
 
virtual QString translateFieldContent (size_t fieldId)
 
virtual bool hasSubfieldWrapper (size_t parentType)
 
virtual QString getFieldName (size_t fieldId)=0
 
virtual WrappedValue getWrappedValue (size_t fieldId, size_t subField)
 
virtual WrappedValue getWrappedValue (size_t fieldId)
 
virtual Executable::addr_type containsAddrType (size_t fieldId, size_t subField=FIELD_NONE)
 
virtual WrappedValue::data_type containsDataType (size_t fieldId, size_t subField=FIELD_NONE)
 
virtual uint64_t getNumValue (size_t fieldId, size_t subField, bool *isOk)
 
uint64_t getNumValue (size_t fieldId, bool *isOk)
 
virtual bool setNumValue (size_t fieldId, size_t subField, uint64_t val)
 
bool setNumValue (size_t fieldId, uint64_t val)
 
ExecutablegetExe ()
 
bool isBit64 ()
 
bool isBit32 ()
 
- Public Member Functions inherited from AbstractByteBuffer
 AbstractByteBuffer ()
 
virtual ~AbstractByteBuffer ()
 
virtual bool isTruncated ()
 
virtual bool isResized ()
 
BYTE operator[] (size_t idx)
 
virtual BYTE * getContentAt (offset_t offset, bufsize_t size, bool allowExceptions=false)
 
virtual BYTE * getContentAtPtr (BYTE *ptr, bufsize_t size, bool allowExceptions=false)
 
virtual bool setBufferedValue (BYTE *dstPtr, BYTE *srcPtr, bufsize_t srcSize, bufsize_t paddingSize, bool allowExceptions=false)
 
bool setStringValue (offset_t rawOffset, QString newText)
 
QString getStringValue (offset_t rawOffset, bufsize_t len=BUFSIZE_MAX, bool acceptNonTerminated=false)
 
QString getWStringValue (offset_t rawOffset, bufsize_t len)
 
QString getWAsciiStringValue (offset_t rawOffset, bufsize_t len, bool acceptNonTerminated=false)
 
bufsize_t getMaxSizeFromOffset (offset_t startOffset)
 
bufsize_t getMaxSizeFromPtr (BYTE *ptr)
 
bool isAreaEmpty (offset_t rawOffset, bufsize_t size)
 
bool fillContent (BYTE filling)
 
bool pasteBuffer (offset_t rawOffset, AbstractByteBuffer *buf, bool allowTrunc)
 
bool containsBlock (offset_t rawOffset, bufsize_t size)
 
bool intersectsBlock (offset_t rawOffset, bufsize_t size)
 
uint64_t getNumValue (offset_t offset, bufsize_t size, bool *isOk)
 
bool setNumValue (offset_t offset, bufsize_t size, uint64_t newVal)
 
bool setTextValue (char *textPtr, std::string newText, size_t fieldLimitLen=0)
 
virtual bool resize (bufsize_t newSize)
 
offset_t substFragmentByFile (offset_t offset, bufsize_t contentSize, QFile &fIn)
 

Protected Member Functions

virtual bool canCopyToOffset (offset_t rawOffset)
 
bool copyToOffset (offset_t rawOffset)
 

Protected Attributes

Executablem_Exe
 

Friends

class Executable
 

Additional Inherited Members

- Static Public Member Functions inherited from AbstractByteBuffer
static bool isValid (AbstractByteBuffer *buf)
 

Detailed Description

Definition at line 11 of file ExeElementWrapper.h.

Constructor & Destructor Documentation

◆ ExeElementWrapper()

ExeElementWrapper::ExeElementWrapper ( Executable * exe)

Definition at line 3 of file ExeElementWrapper.cpp.

Here is the call graph for this function:

◆ ~ExeElementWrapper()

virtual ExeElementWrapper::~ExeElementWrapper ( )
inlinevirtual

Definition at line 15 of file ExeElementWrapper.h.

Member Function Documentation

◆ canCopyToOffset()

bool ExeElementWrapper::canCopyToOffset ( offset_t rawOffset)
protectedvirtual

Definition at line 92 of file ExeElementWrapper.cpp.

Here is the call graph for this function:

◆ containsAddrType()

◆ containsDataType()

virtual WrappedValue::data_type ExeElementWrapper::containsDataType ( size_t fieldId,
size_t subField = FIELD_NONE )
inlinevirtual

◆ copyToOffset()

bool ExeElementWrapper::copyToOffset ( offset_t rawOffset)
protected

Definition at line 102 of file ExeElementWrapper.cpp.

Here is the call graph for this function:

◆ getContent()

virtual BYTE * ExeElementWrapper::getContent ( )
inlinevirtual

Implements AbstractByteBuffer.

Definition at line 21 of file ExeElementWrapper.h.

Here is the call graph for this function:

◆ getContentSize()

virtual bufsize_t ExeElementWrapper::getContentSize ( )
inlinevirtual

Implements AbstractByteBuffer.

Definition at line 20 of file ExeElementWrapper.h.

Here is the call graph for this function:

◆ getExe()

Executable * ExeElementWrapper::getExe ( )
inline

Definition at line 56 of file ExeElementWrapper.h.

◆ getFieldName()

◆ getFieldOffset()

offset_t ExeElementWrapper::getFieldOffset ( size_t fieldId,
size_t subField = FIELD_NONE )
virtual

Definition at line 51 of file ExeElementWrapper.cpp.

Here is the call graph for this function:

◆ getFieldPtr() [1/2]

void * ExeElementWrapper::getFieldPtr ( size_t fieldId)
inline

Definition at line 36 of file ExeElementWrapper.h.

Here is the call graph for this function:

◆ getFieldPtr() [2/2]

◆ getFieldsCount()

◆ getFieldSize()

bufsize_t ExeElementWrapper::getFieldSize ( size_t fieldId,
size_t subField = FIELD_NONE )
virtual

◆ getName()

◆ getNumValue() [1/2]

uint64_t ExeElementWrapper::getNumValue ( size_t fieldId,
bool * isOk )
inline

Definition at line 51 of file ExeElementWrapper.h.

Here is the call graph for this function:

◆ getNumValue() [2/2]

uint64_t ExeElementWrapper::getNumValue ( size_t fieldId,
size_t subField,
bool * isOk )
virtual

Definition at line 73 of file ExeElementWrapper.cpp.

Here is the call graph for this function:

◆ getOffset() [1/2]

offset_t ExeElementWrapper::getOffset ( )
virtual

Definition at line 39 of file ExeElementWrapper.cpp.

Here is the call graph for this function:

◆ getOffset() [2/2]

offset_t ExeElementWrapper::getOffset ( void * ptr,
bool allowExceptions = false )
virtual

Reimplemented from AbstractByteBuffer.

Definition at line 45 of file ExeElementWrapper.cpp.

Here is the call graph for this function:

◆ getPtr()

◆ getSize()

◆ getSubFieldsCount()

◆ getWrappedValue() [1/2]

virtual WrappedValue ExeElementWrapper::getWrappedValue ( size_t fieldId)
inlinevirtual

Definition at line 45 of file ExeElementWrapper.h.

Here is the call graph for this function:

◆ getWrappedValue() [2/2]

WrappedValue ExeElementWrapper::getWrappedValue ( size_t fieldId,
size_t subField )
virtual

Definition at line 57 of file ExeElementWrapper.cpp.

Here is the call graph for this function:

◆ hasSubfieldWrapper()

virtual bool ExeElementWrapper::hasSubfieldWrapper ( size_t parentType)
inlinevirtual

Reimplemented in LdConfigDirWrapper.

Definition at line 41 of file ExeElementWrapper.h.

◆ isBit32()

bool ExeElementWrapper::isBit32 ( )
inline

Definition at line 59 of file ExeElementWrapper.h.

Here is the call graph for this function:

◆ isBit64()

bool ExeElementWrapper::isBit64 ( )
inline

Definition at line 58 of file ExeElementWrapper.h.

Here is the call graph for this function:

◆ setNumValue() [1/2]

bool ExeElementWrapper::setNumValue ( size_t fieldId,
size_t subField,
uint64_t val )
virtual

Definition at line 83 of file ExeElementWrapper.cpp.

Here is the call graph for this function:

◆ setNumValue() [2/2]

bool ExeElementWrapper::setNumValue ( size_t fieldId,
uint64_t val )
inline

Definition at line 54 of file ExeElementWrapper.h.

Here is the call graph for this function:

◆ translateFieldContent()

virtual QString ExeElementWrapper::translateFieldContent ( size_t fieldId)
inlinevirtual

◆ wrap()

Friends And Related Symbol Documentation

◆ Executable

friend class Executable
friend

Definition at line 67 of file ExeElementWrapper.h.

Member Data Documentation

◆ m_Exe

Executable* ExeElementWrapper::m_Exe
protected

Definition at line 65 of file ExeElementWrapper.h.


The documentation for this class was generated from the following files: