BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
Public Types | Public Member Functions | Static Public Member Functions | Static Public Attributes | List of all members
FileHdrWrapper Class Reference

#include <FileHdrWrapper.h>

Collaboration diagram for FileHdrWrapper:
Collaboration graph
[legend]

Public Types

enum  FieldID {
  NONE = -1 , MACHINE = 0 , SEC_NUM , TIMESTAMP ,
  SYMBOL_PTR , SYMBOL_NUM , OPTHDR_SIZE , CHARACT ,
  FIELD_COUNTER
}

Public Member Functions

 FileHdrWrapper (PEFile *pe)
bool wrap ()
virtual void * getPtr ()
virtual bufsize_t getSize ()
virtual QString getName ()
virtual size_t getFieldsCount ()
virtual void * getFieldPtr (size_t fieldId, size_t subField=FIELD_NONE)
virtual QString getFieldName (size_t fieldId)
virtual Executable::addr_type containsAddrType (size_t fieldId, size_t subField=FIELD_NONE)
virtual QString translateFieldContent (size_t fieldId)
Public Member Functions inherited from PEElementWrapper
 PEElementWrapper (PEFile *pe)
virtual ~PEElementWrapper ()
PEFile * getPE ()
Public Member Functions inherited from ExeElementWrapper
 ExeElementWrapper (Executable *exe)
virtual ~ExeElementWrapper ()
virtual bufsize_t getContentSize ()
virtual BYTE * getContent ()
virtual size_t getSubFieldsCount ()
virtual offset_t getOffset ()
virtual offset_t getOffset (void *ptr, bool allowExceptions=false)
void * getFieldPtr (size_t fieldId)
virtual bufsize_t getFieldSize (size_t fieldId, size_t subField=FIELD_NONE)
virtual offset_t getFieldOffset (size_t fieldId, size_t subField=FIELD_NONE)
virtual bool hasSubfieldWrapper (size_t parentType)
virtual WrappedValue getWrappedValue (size_t fieldId, size_t subField)
virtual WrappedValue getWrappedValue (size_t fieldId)
virtual WrappedValue::data_type containsDataType (size_t fieldId, size_t subField=FIELD_NONE)
virtual uint64_t getNumValue (size_t fieldId, size_t subField, bool *isOk)
uint64_t getNumValue (size_t fieldId, bool *isOk)
virtual bool setNumValue (size_t fieldId, size_t subField, uint64_t val)
bool setNumValue (size_t fieldId, uint64_t val)
Executable * getExe ()
bool isBit64 ()
bool isBit32 ()
Public Member Functions inherited from AbstractByteBuffer
 AbstractByteBuffer ()
virtual ~AbstractByteBuffer ()
virtual bool isTruncated ()
virtual bool isResized ()
BYTE operator[] (size_t idx)
virtual BYTE * getContentAt (offset_t offset, bufsize_t size, bool allowExceptions=false)
virtual BYTE * getContentAtPtr (BYTE *ptr, bufsize_t size, bool allowExceptions=false)
virtual bool setBufferedValue (BYTE *dstPtr, BYTE *srcPtr, bufsize_t srcSize, bufsize_t paddingSize, bool allowExceptions=false)
bool setStringValue (offset_t rawOffset, QString newText)
QString getStringValue (offset_t rawOffset, bufsize_t len=BUFSIZE_MAX, bool acceptNonTerminated=false)
QString getWStringValue (offset_t rawOffset, bufsize_t len)
QString getWAsciiStringValue (offset_t rawOffset, bufsize_t len, bool acceptNonTerminated=false)
bufsize_t getMaxSizeFromOffset (offset_t startOffset)
bufsize_t getMaxSizeFromPtr (BYTE *ptr)
bool isAreaEmpty (offset_t rawOffset, bufsize_t size)
bool fillContent (BYTE filling)
bool pasteBuffer (offset_t rawOffset, AbstractByteBuffer *buf, bool allowTrunc)
bool containsBlock (offset_t rawOffset, bufsize_t size)
bool intersectsBlock (offset_t rawOffset, bufsize_t size)
uint64_t getNumValue (offset_t offset, bufsize_t size, bool *isOk)
bool setNumValue (offset_t offset, bufsize_t size, uint64_t newVal)
bool setTextValue (char *textPtr, std::string newText, size_t fieldLimitLen=0)
virtual bool resize (bufsize_t newSize)
offset_t substFragmentByFile (offset_t offset, bufsize_t contentSize, QFile &fIn)

Static Public Member Functions

static void initCharact ()
static std::vector< DWORD > splitCharact (DWORD characteristics)
static QString translateCharacteristics (DWORD charact)
static void initMachine ()
static QString translateMachine (DWORD val)
Static Public Member Functions inherited from AbstractByteBuffer
static bool isValid (AbstractByteBuffer *buf)

Static Public Attributes

static std::map< DWORD, QString > s_fHdrCharact
static std::map< DWORD, QString > s_machine

Additional Inherited Members

Protected Member Functions inherited from ExeElementWrapper
virtual bool canCopyToOffset (offset_t rawOffset)
bool copyToOffset (offset_t rawOffset)
Protected Attributes inherited from PEElementWrapper
PEFile * m_PE
Protected Attributes inherited from ExeElementWrapper
Executable * m_Exe

Detailed Description

Definition at line 10 of file FileHdrWrapper.h.

Member Enumeration Documentation

◆ FieldID

enum FileHdrWrapper::FieldID
Enumerator
NONE 
MACHINE 
SEC_NUM 
TIMESTAMP 
SYMBOL_PTR 
SYMBOL_NUM 
OPTHDR_SIZE 
CHARACT 
FIELD_COUNTER 

Definition at line 14 of file FileHdrWrapper.h.

Constructor & Destructor Documentation

◆ FileHdrWrapper()

FileHdrWrapper::FileHdrWrapper ( PEFile * pe)
inline

Definition at line 36 of file FileHdrWrapper.h.

Here is the call graph for this function:

Member Function Documentation

◆ containsAddrType()

Executable::addr_type FileHdrWrapper::containsAddrType ( size_t fieldId,
size_t subField = FIELD_NONE )
virtual

Reimplemented from ExeElementWrapper.

Definition at line 182 of file FileHdrWrapper.cpp.

◆ getFieldName()

QString FileHdrWrapper::getFieldName ( size_t fieldId)
virtual

Implements ExeElementWrapper.

Definition at line 162 of file FileHdrWrapper.cpp.

Here is the call graph for this function:

◆ getFieldPtr()

void * FileHdrWrapper::getFieldPtr ( size_t fieldId,
size_t subField = FIELD_NONE )
virtual

Implements ExeElementWrapper.

Definition at line 144 of file FileHdrWrapper.cpp.

Here is the call graph for this function:

◆ getFieldsCount()

virtual size_t FileHdrWrapper::getFieldsCount ( )
inlinevirtual

Implements ExeElementWrapper.

Definition at line 43 of file FileHdrWrapper.h.

◆ getName()

virtual QString FileHdrWrapper::getName ( )
inlinevirtual

Implements ExeElementWrapper.

Definition at line 42 of file FileHdrWrapper.h.

◆ getPtr()

void * FileHdrWrapper::getPtr ( )
virtual

Implements ExeElementWrapper.

Definition at line 129 of file FileHdrWrapper.cpp.

◆ getSize()

virtual bufsize_t FileHdrWrapper::getSize ( )
inlinevirtual

Implements ExeElementWrapper.

Definition at line 41 of file FileHdrWrapper.h.

◆ initCharact()

void FileHdrWrapper::initCharact ( )
static

Definition at line 25 of file FileHdrWrapper.cpp.

◆ initMachine()

void FileHdrWrapper::initMachine ( )
static

Definition at line 69 of file FileHdrWrapper.cpp.

◆ splitCharact()

std::vector< DWORD > FileHdrWrapper::splitCharact ( DWORD characteristics)
static

Definition at line 47 of file FileHdrWrapper.cpp.

Here is the call graph for this function:

◆ translateCharacteristics()

QString FileHdrWrapper::translateCharacteristics ( DWORD charact)
static

Definition at line 60 of file FileHdrWrapper.cpp.

Here is the call graph for this function:

◆ translateFieldContent()

QString FileHdrWrapper::translateFieldContent ( size_t fieldId)
virtual

Reimplemented from ExeElementWrapper.

Definition at line 187 of file FileHdrWrapper.cpp.

Here is the call graph for this function:

◆ translateMachine()

QString FileHdrWrapper::translateMachine ( DWORD val)
static

Definition at line 120 of file FileHdrWrapper.cpp.

Here is the call graph for this function:

◆ wrap()

bool FileHdrWrapper::wrap ( )
inlinevirtual

Reimplemented from ExeElementWrapper.

Definition at line 37 of file FileHdrWrapper.h.

Here is the call graph for this function:

Member Data Documentation

◆ s_fHdrCharact

std::map< DWORD, QString > FileHdrWrapper::s_fHdrCharact
static

Definition at line 26 of file FileHdrWrapper.h.

◆ s_machine

std::map< DWORD, QString > FileHdrWrapper::s_machine
static

Definition at line 27 of file FileHdrWrapper.h.

The documentation for this class was generated from the following files:
Generated by doxygen 1.17.0