BearParser
Portable Executable parsing library (from PE-bear)
|
#include <PECore.h>
Public Member Functions | |
PECore () | |
virtual | ~PECore () |
bool | wrap (AbstractByteBuffer *v_buf) |
virtual offset_t | getRawSize () const |
virtual bufsize_t | getAlignment (Executable::addr_type aType) const |
virtual offset_t | getImageBase (bool recalculate=false) |
virtual bufsize_t | getImageSize () |
Executable::exe_bits | getHdrBitMode () const |
Executable::exe_arch | getHdrArch () const |
offset_t | peSignatureOffset () const |
offset_t | peFileHdrOffset () const |
offset_t | secHdrsOffset () const |
offset_t | peOptHdrOffset () const |
bufsize_t | peNtHeadersSize () const |
bufsize_t | hdrsSize () const |
void | setImageSize (bufsize_t newSize) |
IMAGE_FILE_HEADER * | getFileHeader () const |
Protected Member Functions | |
void | reset () |
Protected Attributes | |
AbstractByteBuffer * | buf |
IMAGE_DOS_HEADER * | dos |
IMAGE_FILE_HEADER * | fHdr |
IMAGE_OPTIONAL_HEADER32 * | opt32 |
IMAGE_OPTIONAL_HEADER64 * | opt64 |
Friends | |
class | PEFile |
|
inlinevirtual |
|
virtual |
Definition at line 119 of file PECore.cpp.
Executable::exe_arch PECore::getHdrArch | ( | ) | const |
Definition at line 59 of file PECore.cpp.
Executable::exe_bits PECore::getHdrBitMode | ( | ) | const |
Definition at line 51 of file PECore.cpp.
|
virtual |
|
virtual |
Definition at line 132 of file PECore.cpp.
|
inlinevirtual |
bufsize_t PECore::hdrsSize | ( | ) | const |
offset_t PECore::peFileHdrOffset | ( | ) | const |
bufsize_t PECore::peNtHeadersSize | ( | ) | const |
offset_t PECore::peOptHdrOffset | ( | ) | const |
offset_t PECore::peSignatureOffset | ( | ) | const |
Definition at line 73 of file PECore.cpp.
|
protected |
Definition at line 5 of file PECore.cpp.
offset_t PECore::secHdrsOffset | ( | ) | const |
bool PECore::wrap | ( | AbstractByteBuffer * | v_buf | ) |
|
protected |