BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
Executable Class Referenceabstract

#include <Executable.h>

Collaboration diagram for Executable:

Public Types

enum  exe_bits { UNKNOWN = 0 , BITS_16 = 16 , BITS_32 = 32 , BITS_64 = 64 }
 
enum  exe_arch { ARCH_UNKNOWN = 0 , ARCH_INTEL = 1 , ARCH_ARM = 2 }
 
enum  addr_type { NOT_ADDR = 0 , RAW = 1 , RVA = 2 , VA = 3 }
 

Public Member Functions

bool isBit64 ()
 
bool isBit32 ()
 
virtual ~Executable (void)
 
virtual exe_bits getBitMode ()
 
virtual exe_arch getArch ()=0
 
virtual bufsize_t getContentSize ()
 
virtual BYTE * getContent ()
 
virtual offset_t getRawSize () const
 
BYTE * getContentAtPtr (BYTE *ptr, bufsize_t size, bool allowExceptions=false)
 
BYTE * getContentAt (offset_t offset, bufsize_t size, bool allowExceptions=false)
 
virtual BYTE * getContentAt (offset_t offset, Executable::addr_type aType, bufsize_t size, bool allowExceptions=false)
 
virtual bufsize_t getMappedSize (Executable::addr_type aType)=0
 
virtual bufsize_t getAlignment (Executable::addr_type aType) const =0
 
virtual offset_t getImageBase (bool recalculate=false)=0
 
virtual offset_t getEntryPoint (Executable::addr_type aType=Executable::RVA)=0
 
virtual bufsize_t getImageSize ()
 
virtual size_t getAllEntryPoints (QMap< offset_t, QString > &entrypoints, Executable::addr_type aType=Executable::RVA)
 
virtual bool isValidAddr (offset_t addr, addr_type addrType)
 
virtual bool isValidVA (offset_t va)
 
virtual offset_t convertAddr (offset_t inAddr, Executable::addr_type inType, Executable::addr_type outType)
 
virtual offset_t toRaw (offset_t offset, addr_type addrType, bool allowExceptions=false)
 
Executable::addr_type detectAddrType (offset_t addr, Executable::addr_type hintType)
 
virtual offset_t rawToRva (offset_t raw)=0
 
virtual offset_t rvaToRaw (offset_t rva)=0
 
virtual offset_t VaToRva (offset_t va, bool autodetect=false)
 
virtual offset_t rvaToVa (offset_t rva)
 
virtual offset_t vaToRaw (offset_t va)
 
QString getFileName ()
 
virtual bool resize (bufsize_t newSize)
 
virtual bool isResized ()
 
virtual bool isTruncated ()
 
AbstractByteBuffergetFileBuffer () const
 
bufsize_t getFileSize () const
 
virtual bool dumpFragment (offset_t offset, bufsize_t size, QString fileName)
 
- Public Member Functions inherited from AbstractByteBuffer
 AbstractByteBuffer ()
 
virtual ~AbstractByteBuffer ()
 
BYTE operator[] (size_t idx)
 
virtual offset_t getOffset (void *ptr, bool allowExceptions=false)
 
virtual bool setBufferedValue (BYTE *dstPtr, BYTE *srcPtr, bufsize_t srcSize, bufsize_t paddingSize, bool allowExceptions=false)
 
bool setStringValue (offset_t rawOffset, QString newText)
 
QString getStringValue (offset_t rawOffset, bufsize_t len=BUFSIZE_MAX, bool acceptNonTerminated=false)
 
QString getWStringValue (offset_t rawOffset, bufsize_t len)
 
QString getWAsciiStringValue (offset_t rawOffset, bufsize_t len, bool acceptNonTerminated=false)
 
bufsize_t getMaxSizeFromOffset (offset_t startOffset)
 
bufsize_t getMaxSizeFromPtr (BYTE *ptr)
 
bool isAreaEmpty (offset_t rawOffset, bufsize_t size)
 
bool fillContent (BYTE filling)
 
bool pasteBuffer (offset_t rawOffset, AbstractByteBuffer *buf, bool allowTrunc)
 
bool containsBlock (offset_t rawOffset, bufsize_t size)
 
bool intersectsBlock (offset_t rawOffset, bufsize_t size)
 
uint64_t getNumValue (offset_t offset, bufsize_t size, bool *isOk)
 
bool setNumValue (offset_t offset, bufsize_t size, uint64_t newVal)
 
bool setTextValue (char *textPtr, std::string newText, size_t fieldLimitLen=0)
 
offset_t substFragmentByFile (offset_t offset, bufsize_t contentSize, QFile &fIn)
 

Static Public Member Functions

static bool isBit64 (Executable *exe)
 
static bool isBit32 (Executable *exe)
 
- Static Public Member Functions inherited from AbstractByteBuffer
static bool isValid (AbstractByteBuffer *buf)
 

Protected Member Functions

 Executable (AbstractByteBuffer *v_buf, exe_bits v_bitMode)
 

Protected Attributes

exe_bits bitMode
 
AbstractByteBufferbuf
 

Detailed Description

Definition at line 26 of file Executable.h.

Member Enumeration Documentation

◆ addr_type

Enumerator
NOT_ADDR 
RAW 
RVA 
VA 

Definition at line 41 of file Executable.h.

◆ exe_arch

Enumerator
ARCH_UNKNOWN 
ARCH_INTEL 
ARCH_ARM 

Definition at line 35 of file Executable.h.

◆ exe_bits

Enumerator
UNKNOWN 
BITS_16 
BITS_32 
BITS_64 

Definition at line 28 of file Executable.h.

Constructor & Destructor Documentation

◆ ~Executable()

virtual Executable::~Executable ( void )
inlinevirtual

Definition at line 54 of file Executable.h.

◆ Executable()

Executable::Executable ( AbstractByteBuffer * v_buf,
exe_bits v_bitMode )
protected

Definition at line 4 of file Executable.cpp.

Member Function Documentation

◆ convertAddr()

offset_t Executable::convertAddr ( offset_t inAddr,
Executable::addr_type inType,
Executable::addr_type outType )
virtual

Definition at line 46 of file Executable.cpp.

Here is the call graph for this function:

◆ detectAddrType()

Executable::addr_type Executable::detectAddrType ( offset_t addr,
Executable::addr_type hintType )

Definition at line 125 of file Executable.cpp.

Here is the call graph for this function:

◆ dumpFragment()

bool Executable::dumpFragment ( offset_t offset,
bufsize_t size,
QString fileName )
virtual

Definition at line 169 of file Executable.cpp.

Here is the call graph for this function:

◆ getAlignment()

virtual bufsize_t Executable::getAlignment ( Executable::addr_type aType) const
pure virtual

Implemented in DOSExe, and PEFile.

◆ getAllEntryPoints()

virtual size_t Executable::getAllEntryPoints ( QMap< offset_t, QString > & entrypoints,
Executable::addr_type aType = Executable::RVA )
inlinevirtual

Reimplemented in PEFile.

Definition at line 77 of file Executable.h.

Here is the call graph for this function:

◆ getArch()

virtual exe_arch Executable::getArch ( )
pure virtual

Implemented in DOSExe, and PEFile.

◆ getBitMode()

virtual exe_bits Executable::getBitMode ( )
inlinevirtual

Reimplemented in PEFile.

Definition at line 56 of file Executable.h.

◆ getContent()

virtual BYTE * Executable::getContent ( )
inlinevirtual

Implements AbstractByteBuffer.

Definition at line 60 of file Executable.h.

Here is the call graph for this function:

◆ getContentAt() [1/2]

BYTE * Executable::getContentAt ( offset_t offset,
bufsize_t size,
bool allowExceptions = false )
inlinevirtual

Reimplemented from AbstractByteBuffer.

Definition at line 65 of file Executable.h.

Here is the call graph for this function:

◆ getContentAt() [2/2]

BYTE * Executable::getContentAt ( offset_t offset,
Executable::addr_type aType,
bufsize_t size,
bool allowExceptions = false )
virtual

Definition at line 10 of file Executable.cpp.

Here is the call graph for this function:

◆ getContentAtPtr()

BYTE * Executable::getContentAtPtr ( BYTE * ptr,
bufsize_t size,
bool allowExceptions = false )
inlinevirtual

Reimplemented from AbstractByteBuffer.

Definition at line 64 of file Executable.h.

Here is the call graph for this function:

◆ getContentSize()

virtual bufsize_t Executable::getContentSize ( )
inlinevirtual

Implements AbstractByteBuffer.

Definition at line 59 of file Executable.h.

Here is the call graph for this function:

◆ getEntryPoint()

virtual offset_t Executable::getEntryPoint ( Executable::addr_type aType = Executable::RVA)
pure virtual

Implemented in DOSExe, and PEFile.

◆ getFileBuffer()

AbstractByteBuffer * Executable::getFileBuffer ( ) const
inline

Definition at line 124 of file Executable.h.

◆ getFileName()

QString Executable::getFileName ( )

Definition at line 149 of file Executable.cpp.

Here is the call graph for this function:

◆ getFileSize()

bufsize_t Executable::getFileSize ( ) const

Definition at line 158 of file Executable.cpp.

Here is the call graph for this function:

◆ getImageBase()

virtual offset_t Executable::getImageBase ( bool recalculate = false)
pure virtual

Implemented in DOSExe, and PEFile.

◆ getImageSize()

virtual bufsize_t Executable::getImageSize ( )
inlinevirtual

Definition at line 74 of file Executable.h.

Here is the call graph for this function:

◆ getMappedSize()

virtual bufsize_t Executable::getMappedSize ( Executable::addr_type aType)
pure virtual

Implemented in DOSExe, and PEFile.

◆ getRawSize()

virtual offset_t Executable::getRawSize ( ) const
inlinevirtual

Definition at line 62 of file Executable.h.

Here is the call graph for this function:

◆ isBit32() [1/2]

bool Executable::isBit32 ( )
inline

Definition at line 52 of file Executable.h.

Here is the call graph for this function:

◆ isBit32() [2/2]

static bool Executable::isBit32 ( Executable * exe)
inlinestatic

Definition at line 49 of file Executable.h.

Here is the call graph for this function:

◆ isBit64() [1/2]

bool Executable::isBit64 ( )
inline

Definition at line 51 of file Executable.h.

Here is the call graph for this function:

◆ isBit64() [2/2]

static bool Executable::isBit64 ( Executable * exe)
inlinestatic

Definition at line 48 of file Executable.h.

Here is the call graph for this function:

◆ isResized()

virtual bool Executable::isResized ( )
inlinevirtual

Reimplemented from AbstractByteBuffer.

Definition at line 119 of file Executable.h.

Here is the call graph for this function:

◆ isTruncated()

virtual bool Executable::isTruncated ( )
inlinevirtual

Reimplemented from AbstractByteBuffer.

Definition at line 121 of file Executable.h.

Here is the call graph for this function:

◆ isValidAddr()

bool Executable::isValidAddr ( offset_t addr,
addr_type addrType )
virtual

Definition at line 19 of file Executable.cpp.

Here is the call graph for this function:

◆ isValidVA()

virtual bool Executable::isValidVA ( offset_t va)
inlinevirtual

Definition at line 86 of file Executable.h.

Here is the call graph for this function:

◆ rawToRva()

virtual offset_t Executable::rawToRva ( offset_t raw)
pure virtual

Implemented in DOSExe, and PEFile.

◆ resize()

virtual bool Executable::resize ( bufsize_t newSize)
inlinevirtual

Reimplemented from AbstractByteBuffer.

Reimplemented in MappedExe.

Definition at line 117 of file Executable.h.

Here is the call graph for this function:

◆ rvaToRaw()

virtual offset_t Executable::rvaToRaw ( offset_t rva)
pure virtual

Implemented in DOSExe, and PEFile.

◆ rvaToVa()

virtual offset_t Executable::rvaToVa ( offset_t rva)
inlinevirtual

Definition at line 101 of file Executable.h.

Here is the call graph for this function:

◆ toRaw()

offset_t Executable::toRaw ( offset_t offset,
addr_type addrType,
bool allowExceptions = false )
virtual

Definition at line 85 of file Executable.cpp.

Here is the call graph for this function:

◆ vaToRaw()

virtual offset_t Executable::vaToRaw ( offset_t va)
inlinevirtual

Definition at line 107 of file Executable.h.

Here is the call graph for this function:

◆ VaToRva()

offset_t Executable::VaToRva ( offset_t va,
bool autodetect = false )
virtual

Definition at line 30 of file Executable.cpp.

Here is the call graph for this function:

Member Data Documentation

◆ bitMode

exe_bits Executable::bitMode
protected

Definition at line 132 of file Executable.h.

◆ buf

AbstractByteBuffer* Executable::buf
protected

Definition at line 133 of file Executable.h.


The documentation for this class was generated from the following files: