#include <Executable.h>

Collaboration diagram for Executable:

[legend]

Public Types
enum	exe_bits { UNKNOWN = 0 , BITS_16 = 16 , BITS_32 = 32 , BITS_64 = 64 }
enum	exe_arch { ARCH_UNKNOWN = 0 , ARCH_INTEL = 1 , ARCH_ARM = 2 , EXE_ARCH_COUNT }
enum	addr_type { NOT_ADDR = 0 , RAW = 1 , RVA = 2 , VA = 3 , ADDR_TYPE_COUNT }

Public Member Functions
bool	isBit64 ()
bool	isBit32 ()
virtual	~Executable (void)
virtual exe_bits	getBitMode ()
virtual exe_arch	getArch ()=0
virtual bufsize_t	getContentSize ()
virtual BYTE *	getContent ()
virtual offset_t	getRawSize () const
BYTE *	getContentAtPtr (BYTE *ptr, bufsize_t size, bool allowExceptions=false)
BYTE *	getContentAt (offset_t offset, bufsize_t size, bool allowExceptions=false)
virtual BYTE *	getContentAt (offset_t offset, Executable::addr_type aType, bufsize_t size, bool allowExceptions=false)
virtual bufsize_t	getMappedSize (Executable::addr_type aType)=0
virtual bufsize_t	getAlignment (Executable::addr_type aType) const =0
virtual offset_t	getImageBase (bool recalculate=false)=0
virtual offset_t	getEntryPoint (Executable::addr_type aType=Executable::RVA)=0
virtual bufsize_t	getImageSize ()
virtual size_t	getAllEntryPoints (QMap< offset_t, QString > &entrypoints, Executable::addr_type aType=Executable::RVA)
virtual bool	isValidAddr (offset_t addr, addr_type addrType)
virtual bool	isValidVA (offset_t va)
virtual offset_t	convertAddr (offset_t inAddr, Executable::addr_type inType, Executable::addr_type outType)
virtual offset_t	toRaw (offset_t offset, addr_type addrType, bool allowExceptions=false)
Executable::addr_type	detectAddrType (offset_t addr, Executable::addr_type hintType)
virtual offset_t	rawToRva (offset_t raw)=0
virtual offset_t	rvaToRaw (offset_t rva)=0
virtual offset_t	VaToRva (offset_t va, bool autodetect=false)
virtual offset_t	rvaToVa (offset_t rva)
virtual offset_t	vaToRaw (offset_t va)
QString	getFileName ()
virtual bool	resize (bufsize_t newSize)
virtual bool	isResized ()
virtual bool	isTruncated ()
AbstractByteBuffer *	getFileBuffer () const
bufsize_t	getFileSize () const
virtual bool	dumpFragment (offset_t offset, bufsize_t size, QString fileName)
Public Member Functions inherited from AbstractByteBuffer
	AbstractByteBuffer ()
virtual	~AbstractByteBuffer ()
BYTE	operator[] (size_t idx)
virtual offset_t	getOffset (void *ptr, bool allowExceptions=false)
virtual bool	setBufferedValue (BYTE dstPtr, BYTE srcPtr, bufsize_t srcSize, bufsize_t paddingSize, bool allowExceptions=false)
bool	setStringValue (offset_t rawOffset, QString newText)
QString	getStringValue (offset_t rawOffset, bufsize_t len=BUFSIZE_MAX, bool acceptNonTerminated=false)
QString	getWStringValue (offset_t rawOffset, bufsize_t len)
QString	getWAsciiStringValue (offset_t rawOffset, bufsize_t len, bool acceptNonTerminated=false)
bufsize_t	getMaxSizeFromOffset (offset_t startOffset)
bufsize_t	getMaxSizeFromPtr (BYTE *ptr)
bool	isAreaEmpty (offset_t rawOffset, bufsize_t size)
bool	fillContent (BYTE filling)
bool	pasteBuffer (offset_t rawOffset, AbstractByteBuffer *buf, bool allowTrunc)
bool	containsBlock (offset_t rawOffset, bufsize_t size)
bool	intersectsBlock (offset_t rawOffset, bufsize_t size)
uint64_t	getNumValue (offset_t offset, bufsize_t size, bool *isOk)
bool	setNumValue (offset_t offset, bufsize_t size, uint64_t newVal)
bool	setTextValue (char *textPtr, std::string newText, size_t fieldLimitLen=0)
offset_t	substFragmentByFile (offset_t offset, bufsize_t contentSize, QFile &fIn)

Static Public Member Functions
static bool	isBit64 (Executable *exe)
static bool	isBit32 (Executable *exe)
Static Public Member Functions inherited from AbstractByteBuffer
static bool	isValid (AbstractByteBuffer *buf)

Protected Member Functions
	Executable (AbstractByteBuffer *v_buf, exe_bits v_bitMode)

Protected Attributes
exe_bits	bitMode
AbstractByteBuffer *	buf

Detailed Description

Definition at line 26 of file Executable.h.

Member Enumeration Documentation

◆ addr_type

enum Executable::addr_type

Enumerator
NOT_ADDR
RAW
RVA
VA
ADDR_TYPE_COUNT

Definition at line 42 of file Executable.h.

◆ exe_arch

enum Executable::exe_arch

Enumerator
ARCH_UNKNOWN
ARCH_INTEL
ARCH_ARM
EXE_ARCH_COUNT

Definition at line 35 of file Executable.h.

◆ exe_bits

enum Executable::exe_bits

Enumerator
UNKNOWN
BITS_16
BITS_32
BITS_64

Definition at line 28 of file Executable.h.

Constructor & Destructor Documentation

◆ ~Executable()

virtual Executable::~Executable ( void )

inlinevirtual

Definition at line 56 of file Executable.h.

◆ Executable()

Executable::Executable	(	AbstractByteBuffer *	v_buf,
		exe_bits	v_bitMode )

protected

Definition at line 4 of file Executable.cpp.

Here is the call graph for this function:

Member Function Documentation

◆ convertAddr()

offset_t Executable::convertAddr	(	offset_t	inAddr,
		Executable::addr_type	inType,
		Executable::addr_type	outType )

virtual

Definition at line 46 of file Executable.cpp.

Here is the call graph for this function:

◆ detectAddrType()

Executable::addr_type Executable::detectAddrType	(	offset_t	addr,
		Executable::addr_type	hintType )

Definition at line 125 of file Executable.cpp.

Here is the call graph for this function:

◆ dumpFragment()

bool Executable::dumpFragment	(	offset_t	offset,
		bufsize_t	size,
		QString	fileName )

virtual

Definition at line 169 of file Executable.cpp.

Here is the call graph for this function:

◆ getAlignment()

virtual bufsize_t Executable::getAlignment ( Executable::addr_type aType ) const

pure virtual

Implemented in DOSExe, and PEFile.

◆ getAllEntryPoints()

virtual size_t Executable::getAllEntryPoints	(	QMap< offset_t, QString > &	entrypoints,
		Executable::addr_type	aType = Executable::RVA )

inlinevirtual

Reimplemented in PEFile.

Definition at line 79 of file Executable.h.

Here is the call graph for this function:

◆ getArch()

virtual exe_arch Executable::getArch ( )

pure virtual

Implemented in DOSExe, and PEFile.

◆ getBitMode()

virtual exe_bits Executable::getBitMode ( )

inlinevirtual

Reimplemented in PEFile.

Definition at line 58 of file Executable.h.

◆ getContent()

virtual BYTE * Executable::getContent ( )

inlinevirtual

Implements AbstractByteBuffer.

Definition at line 62 of file Executable.h.

◆ getContentAt() [1/2]

BYTE * Executable::getContentAt	(	offset_t	offset,
		bufsize_t	size,
		bool	allowExceptions = false )

inlinevirtual

Reimplemented from AbstractByteBuffer.

Definition at line 67 of file Executable.h.

Here is the call graph for this function:

◆ getContentAt() [2/2]

BYTE * Executable::getContentAt	(	offset_t	offset,
		Executable::addr_type	aType,
		bufsize_t	size,
		bool	allowExceptions = false )

virtual

Definition at line 10 of file Executable.cpp.

Here is the call graph for this function:

◆ getContentAtPtr()

BYTE * Executable::getContentAtPtr	(	BYTE *	ptr,
		bufsize_t	size,
		bool	allowExceptions = false )

inlinevirtual

Reimplemented from AbstractByteBuffer.

Definition at line 66 of file Executable.h.

Here is the call graph for this function:

◆ getContentSize()

virtual bufsize_t Executable::getContentSize ( )

inlinevirtual

Implements AbstractByteBuffer.

Definition at line 61 of file Executable.h.

◆ getEntryPoint()

virtual offset_t Executable::getEntryPoint ( Executable::addr_type aType = Executable::RVA )

pure virtual

Implemented in DOSExe, and PEFile.

◆ getFileBuffer()

AbstractByteBuffer * Executable::getFileBuffer ( ) const

inline

Definition at line 126 of file Executable.h.

Here is the call graph for this function:

◆ getFileName()

QString Executable::getFileName ( )

Definition at line 149 of file Executable.cpp.

Here is the call graph for this function:

◆ getFileSize()

bufsize_t Executable::getFileSize ( ) const

Definition at line 158 of file Executable.cpp.

Here is the call graph for this function:

◆ getImageBase()

virtual offset_t Executable::getImageBase ( bool recalculate = false )

pure virtual

Implemented in DOSExe, and PEFile.

◆ getImageSize()

virtual bufsize_t Executable::getImageSize ( )

inlinevirtual

Definition at line 76 of file Executable.h.

Here is the call graph for this function:

◆ getMappedSize()

virtual bufsize_t Executable::getMappedSize ( Executable::addr_type aType )

pure virtual

Implemented in DOSExe, and PEFile.

◆ getRawSize()

virtual offset_t Executable::getRawSize ( ) const

inlinevirtual

Definition at line 64 of file Executable.h.

◆ isBit32() [1/2]

bool Executable::isBit32 ( )

inline

Definition at line 54 of file Executable.h.

Here is the call graph for this function:

◆ isBit32() [2/2]

bool Executable::isBit32 ( Executable * exe )

inlinestatic

Definition at line 51 of file Executable.h.

Here is the call graph for this function:

◆ isBit64() [1/2]

bool Executable::isBit64 ( )

inline

Definition at line 53 of file Executable.h.

Here is the call graph for this function:

◆ isBit64() [2/2]

bool Executable::isBit64 ( Executable * exe )

inlinestatic

Definition at line 50 of file Executable.h.

Here is the call graph for this function:

◆ isResized()

virtual bool Executable::isResized ( )

inlinevirtual

Reimplemented from AbstractByteBuffer.

Definition at line 121 of file Executable.h.

◆ isTruncated()

virtual bool Executable::isTruncated ( )

inlinevirtual

Reimplemented from AbstractByteBuffer.

Definition at line 123 of file Executable.h.

◆ isValidAddr()

bool Executable::isValidAddr	(	offset_t	addr,
		addr_type	addrType )

virtual

Definition at line 19 of file Executable.cpp.

Here is the call graph for this function:

◆ isValidVA()

virtual bool Executable::isValidVA ( offset_t va )

inlinevirtual

Definition at line 88 of file Executable.h.

Here is the call graph for this function:

◆ rawToRva()

virtual offset_t Executable::rawToRva ( offset_t raw )

pure virtual

Implemented in DOSExe, and PEFile.

◆ resize()

virtual bool Executable::resize ( bufsize_t newSize )

inlinevirtual

Reimplemented from AbstractByteBuffer.

Reimplemented in MappedExe.

Definition at line 119 of file Executable.h.

◆ rvaToRaw()

virtual offset_t Executable::rvaToRaw ( offset_t rva )

pure virtual

Implemented in DOSExe, and PEFile.

◆ rvaToVa()

virtual offset_t Executable::rvaToVa ( offset_t rva )

inlinevirtual

Definition at line 103 of file Executable.h.

Here is the call graph for this function:

◆ toRaw()

offset_t Executable::toRaw	(	offset_t	offset,
		addr_type	addrType,
		bool	allowExceptions = false )

virtual

Definition at line 85 of file Executable.cpp.

Here is the call graph for this function:

◆ vaToRaw()

virtual offset_t Executable::vaToRaw ( offset_t va )

inlinevirtual

Definition at line 109 of file Executable.h.

Here is the call graph for this function:

◆ VaToRva()

offset_t Executable::VaToRva	(	offset_t	va,
		bool	autodetect = false )

virtual

Definition at line 30 of file Executable.cpp.

Here is the call graph for this function:

Member Data Documentation

◆ bitMode

exe_bits Executable::bitMode

protected

Definition at line 134 of file Executable.h.

◆ buf

AbstractByteBuffer* Executable::buf

protected

Definition at line 135 of file Executable.h.

The documentation for this class was generated from the following files:

parser/include/bearparser/Executable.h
parser/Executable.cpp

Public Types

Public Member Functions

Static Public Member Functions

Protected Member Functions

Protected Attributes

Detailed Description

Member Enumeration Documentation

◆ addr_type

◆ exe_arch

◆ exe_bits

Constructor & Destructor Documentation

◆ ~Executable()

◆ Executable()

Member Function Documentation

◆ convertAddr()

◆ detectAddrType()

◆ dumpFragment()

◆ getAlignment()

◆ getAllEntryPoints()

◆ getArch()

◆ getBitMode()

◆ getContent()

◆ getContentAt() [1/2]

◆ getContentAt() [2/2]

◆ getContentAtPtr()

◆ getContentSize()

◆ getEntryPoint()

◆ getFileBuffer()

◆ getFileName()

◆ getFileSize()

◆ getImageBase()

◆ getImageSize()

◆ getMappedSize()

◆ getRawSize()

◆ isBit32() [1/2]

◆ isBit32() [2/2]

◆ isBit64() [1/2]

◆ isBit64() [2/2]

◆ isResized()

◆ isTruncated()

◆ isValidAddr()

◆ isValidVA()

◆ rawToRva()

◆ resize()

◆ rvaToRaw()

◆ rvaToVa()

◆ toRaw()

◆ vaToRaw()

◆ VaToRva()

Member Data Documentation

◆ bitMode

◆ buf