BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
ImportDirWrapper Class Reference

#include <ImportDirWrapper.h>

Collaboration diagram for ImportDirWrapper:

Public Member Functions

 ImportDirWrapper (PEFile *pe)
virtual void * getPtr ()
virtual bufsize_t getSize ()
virtual QString getName ()
Public Member Functions inherited from ImportBaseDirWrapper
virtual bool wrap ()
virtual bool isValid ()
virtual void clearMapping ()
virtual void reloadMapping ()
virtual size_t getFieldsCount ()
virtual void * getFieldPtr (size_t fieldId, size_t subField)
virtual QString getFieldName (size_t fieldId, size_t subField)
virtual QString getFieldName (size_t fieldId)
virtual bufsize_t getFieldSize (size_t fieldId, size_t subField=FIELD_NONE)
QString thunkToFuncName (offset_t thunk, bool shortName=true)
QString thunkToLibName (offset_t thunk)
QList< offset_tgetThunksList ()
bool hasThunk (offset_t thunk)
ImportBaseFuncWrapperthunkToFunction (offset_t thunk)
Public Member Functions inherited from DataDirEntryWrapper
IMAGE_DATA_DIRECTORY * getDataDirectory ()
offset_t getDirEntryAddress ()
bufsize_t getDirEntrySize (bool trimToExeSize=false)
int getDirEntryType ()
Public Member Functions inherited from PENodeWrapper
 PENodeWrapper (PEFile *pe, PENodeWrapper *parent=NULL)
 PENodeWrapper (PEFile *pe, PENodeWrapper *parent, size_t entryNumber)
virtual ~PENodeWrapper ()
PEFilegetPE ()
virtual PENodeWrappergetParentNode ()
Public Member Functions inherited from ExeNodeWrapper
 ExeNodeWrapper (Executable *pe, ExeNodeWrapper *parent=NULL)
 ExeNodeWrapper (Executable *pe, ExeNodeWrapper *parent, size_t entryNumber)
virtual ~ExeNodeWrapper ()
virtual ExeNodeWrappergetEntryAt (size_t fieldId)
virtual size_t getEntriesCount ()
virtual size_t getEntriesNum ()
virtual size_t getSubFieldsCount ()
size_t getEntryId ()
virtual void * getSubfieldPtr (size_t fieldId, size_t subField)
virtual bufsize_t getSubfieldSize (size_t fieldId, size_t subField)
virtual QString getSubfieldName (size_t fieldId, size_t subField)
virtual bool canAddEntry ()
virtual ExeNodeWrapperaddEntry (ExeNodeWrapper *entry)
ExeNodeWrappergetLastEntry ()
virtual offset_t getNextEntryOffset ()
virtual bufsize_t geEntrySize ()
Public Member Functions inherited from ExeElementWrapper
 ExeElementWrapper (Executable *exe)
virtual ~ExeElementWrapper ()
virtual bufsize_t getContentSize ()
virtual BYTE * getContent ()
virtual offset_t getOffset ()
virtual offset_t getOffset (void *ptr, bool allowExceptions=false)
void * getFieldPtr (size_t fieldId)
virtual offset_t getFieldOffset (size_t fieldId, size_t subField=FIELD_NONE)
virtual QString translateFieldContent (size_t fieldId)
virtual bool hasSubfieldWrapper (size_t parentType)
virtual WrappedValue getWrappedValue (size_t fieldId, size_t subField)
virtual WrappedValue getWrappedValue (size_t fieldId)
virtual Executable::addr_type containsAddrType (size_t fieldId, size_t subField=FIELD_NONE)
virtual WrappedValue::data_type containsDataType (size_t fieldId, size_t subField=FIELD_NONE)
virtual uint64_t getNumValue (size_t fieldId, size_t subField, bool *isOk)
uint64_t getNumValue (size_t fieldId, bool *isOk)
virtual bool setNumValue (size_t fieldId, size_t subField, uint64_t val)
bool setNumValue (size_t fieldId, uint64_t val)
ExecutablegetExe ()
bool isBit64 ()
bool isBit32 ()
Public Member Functions inherited from AbstractByteBuffer
 AbstractByteBuffer ()
virtual ~AbstractByteBuffer ()
virtual bool isTruncated ()
virtual bool isResized ()
BYTE operator[] (size_t idx)
virtual BYTE * getContentAt (offset_t offset, bufsize_t size, bool allowExceptions=false)
virtual BYTE * getContentAtPtr (BYTE *ptr, bufsize_t size, bool allowExceptions=false)
virtual bool setBufferedValue (BYTE *dstPtr, BYTE *srcPtr, bufsize_t srcSize, bufsize_t paddingSize, bool allowExceptions=false)
bool setStringValue (offset_t rawOffset, QString newText)
QString getStringValue (offset_t rawOffset, bufsize_t len=BUFSIZE_MAX, bool acceptNonTerminated=false)
QString getWStringValue (offset_t rawOffset, bufsize_t len)
QString getWAsciiStringValue (offset_t rawOffset, bufsize_t len, bool acceptNonTerminated=false)
bufsize_t getMaxSizeFromOffset (offset_t startOffset)
bufsize_t getMaxSizeFromPtr (BYTE *ptr)
bool isAreaEmpty (offset_t rawOffset, bufsize_t size)
bool fillContent (BYTE filling)
bool pasteBuffer (offset_t rawOffset, AbstractByteBuffer *buf, bool allowTrunc)
bool containsBlock (offset_t rawOffset, bufsize_t size)
bool intersectsBlock (offset_t rawOffset, bufsize_t size)
uint64_t getNumValue (offset_t offset, bufsize_t size, bool *isOk)
bool setNumValue (offset_t offset, bufsize_t size, uint64_t newVal)
bool setTextValue (char *textPtr, std::string newText, size_t fieldLimitLen=0)
virtual bool resize (bufsize_t newSize)
offset_t substFragmentByFile (offset_t offset, bufsize_t contentSize, QFile &fIn)

Protected Member Functions

virtual bool loadNextEntry (size_t cntr)
IMAGE_DATA_DIRECTORY * getDataDirectory ()
IMAGE_IMPORT_DESCRIPTOR * firstDescriptor ()
Protected Member Functions inherited from ImportBaseDirWrapper
 ImportBaseDirWrapper (PEFile *pe, pe::dir_entry v_entryType)
void addMapping (ExeNodeWrapper *func)
ImportBaseEntryWrapperthunkToLib (offset_t thunk)
Protected Member Functions inherited from DataDirEntryWrapper
 DataDirEntryWrapper (PEFile *pe, pe::dir_entry v_entryType)
Protected Member Functions inherited from ExeNodeWrapper
size_t getEntriesCount (std::vector< ExeNodeWrapper * > &_entries)
ExeNodeWrappergetEntryAt (std::vector< ExeNodeWrapper * > &_entries, size_t fieldId)
virtual void clear ()
virtual ExeNodeWrapperaddEntryAt (ExeNodeWrapper *entry, offset_t nextOffset)
virtual bool isMyEntryType (ExeNodeWrapper *entry)
Protected Member Functions inherited from ExeElementWrapper
virtual bool canCopyToOffset (offset_t rawOffset)
bool copyToOffset (offset_t rawOffset)

Friends

class ImportEntryWrapper

Additional Inherited Members

Static Public Member Functions inherited from ImportBaseDirWrapper
static bufsize_t thunkSize (Executable::exe_bits bits)
Static Public Member Functions inherited from AbstractByteBuffer
static bool isValid (AbstractByteBuffer *buf)
Protected Attributes inherited from ImportBaseDirWrapper
std::map< offset_t, size_t > thunkToLibMap
QList< offset_tthunksList
size_t importsCount
size_t invalidEntries
Protected Attributes inherited from DataDirEntryWrapper
int entryType
Protected Attributes inherited from PENodeWrapper
PEFilem_PE
PENodeWrapperpeParentNode
Protected Attributes inherited from ExeNodeWrapper
ExeNodeWrapperparentNode
size_t entryNum
std::vector< ExeNodeWrapper * > entries
Protected Attributes inherited from ExeElementWrapper
Executablem_Exe

Detailed Description

Definition at line 30 of file ImportDirWrapper.h.

Constructor & Destructor Documentation

◆ ImportDirWrapper()

ImportDirWrapper::ImportDirWrapper ( PEFile * pe)
inline

Definition at line 33 of file ImportDirWrapper.h.

Here is the call graph for this function:

Member Function Documentation

◆ firstDescriptor()

IMAGE_IMPORT_DESCRIPTOR * ImportDirWrapper::firstDescriptor ( )
protected

Definition at line 313 of file ImportDirWrapper.cpp.

Here is the call graph for this function:

◆ getDataDirectory()

IMAGE_DATA_DIRECTORY * ImportDirWrapper::getDataDirectory ( )
protected

Definition at line 304 of file ImportDirWrapper.cpp.

Here is the call graph for this function:

◆ getName()

virtual QString ImportDirWrapper::getName ( )
inlinevirtual

Implements ExeElementWrapper.

Definition at line 38 of file ImportDirWrapper.h.

◆ getPtr()

virtual void * ImportDirWrapper::getPtr ( )
inlinevirtual

Implements ExeElementWrapper.

Definition at line 36 of file ImportDirWrapper.h.

Here is the call graph for this function:

◆ getSize()

bufsize_t ImportDirWrapper::getSize ( )
virtual

Implements ExeElementWrapper.

Definition at line 355 of file ImportDirWrapper.cpp.

Here is the call graph for this function:

◆ loadNextEntry()

bool ImportDirWrapper::loadNextEntry ( size_t cntr)
protectedvirtual

Reimplemented from ExeNodeWrapper.

Definition at line 329 of file ImportDirWrapper.cpp.

Here is the call graph for this function:

◆ ImportEntryWrapper

friend class ImportEntryWrapper
friend

Definition at line 46 of file ImportDirWrapper.h.


The documentation for this class was generated from the following files: