BearParser
Portable Executable parsing library (from PE-bear)
Loading...
Searching...
No Matches
PEElementWrapper Class Reference

#include <PENodeWrapper.h>

Collaboration diagram for PEElementWrapper:

Public Member Functions

 PEElementWrapper (PEFile *pe)
virtual ~PEElementWrapper ()
PEFilegetPE ()
Public Member Functions inherited from ExeElementWrapper
 ExeElementWrapper (Executable *exe)
virtual ~ExeElementWrapper ()
virtual bool wrap ()
virtual bufsize_t getContentSize ()
virtual BYTE * getContent ()
virtual void * getPtr ()=0
virtual bufsize_t getSize ()=0
virtual QString getName ()=0
virtual size_t getFieldsCount ()=0
virtual size_t getSubFieldsCount ()
virtual offset_t getOffset ()
virtual offset_t getOffset (void *ptr, bool allowExceptions=false)
virtual void * getFieldPtr (size_t fieldId, size_t subField)=0
void * getFieldPtr (size_t fieldId)
virtual bufsize_t getFieldSize (size_t fieldId, size_t subField=FIELD_NONE)
virtual offset_t getFieldOffset (size_t fieldId, size_t subField=FIELD_NONE)
virtual QString translateFieldContent (size_t fieldId)
virtual bool hasSubfieldWrapper (size_t parentType)
virtual QString getFieldName (size_t fieldId)=0
virtual WrappedValue getWrappedValue (size_t fieldId, size_t subField)
virtual WrappedValue getWrappedValue (size_t fieldId)
virtual Executable::addr_type containsAddrType (size_t fieldId, size_t subField=FIELD_NONE)
virtual WrappedValue::data_type containsDataType (size_t fieldId, size_t subField=FIELD_NONE)
virtual uint64_t getNumValue (size_t fieldId, size_t subField, bool *isOk)
uint64_t getNumValue (size_t fieldId, bool *isOk)
virtual bool setNumValue (size_t fieldId, size_t subField, uint64_t val)
bool setNumValue (size_t fieldId, uint64_t val)
ExecutablegetExe ()
bool isBit64 ()
bool isBit32 ()
Public Member Functions inherited from AbstractByteBuffer
 AbstractByteBuffer ()
virtual ~AbstractByteBuffer ()
virtual bool isTruncated ()
virtual bool isResized ()
BYTE operator[] (size_t idx)
virtual BYTE * getContentAt (offset_t offset, bufsize_t size, bool allowExceptions=false)
virtual BYTE * getContentAtPtr (BYTE *ptr, bufsize_t size, bool allowExceptions=false)
virtual bool setBufferedValue (BYTE *dstPtr, BYTE *srcPtr, bufsize_t srcSize, bufsize_t paddingSize, bool allowExceptions=false)
bool setStringValue (offset_t rawOffset, QString newText)
QString getStringValue (offset_t rawOffset, bufsize_t len=BUFSIZE_MAX, bool acceptNonTerminated=false)
QString getWStringValue (offset_t rawOffset, bufsize_t len)
QString getWAsciiStringValue (offset_t rawOffset, bufsize_t len, bool acceptNonTerminated=false)
bufsize_t getMaxSizeFromOffset (offset_t startOffset)
bufsize_t getMaxSizeFromPtr (BYTE *ptr)
bool isAreaEmpty (offset_t rawOffset, bufsize_t size)
bool fillContent (BYTE filling)
bool pasteBuffer (offset_t rawOffset, AbstractByteBuffer *buf, bool allowTrunc)
bool containsBlock (offset_t rawOffset, bufsize_t size)
bool intersectsBlock (offset_t rawOffset, bufsize_t size)
uint64_t getNumValue (offset_t offset, bufsize_t size, bool *isOk)
bool setNumValue (offset_t offset, bufsize_t size, uint64_t newVal)
bool setTextValue (char *textPtr, std::string newText, size_t fieldLimitLen=0)
virtual bool resize (bufsize_t newSize)
offset_t substFragmentByFile (offset_t offset, bufsize_t contentSize, QFile &fIn)

Protected Attributes

PEFilem_PE
Protected Attributes inherited from ExeElementWrapper
Executablem_Exe

Friends

class PEFile

Additional Inherited Members

Static Public Member Functions inherited from AbstractByteBuffer
static bool isValid (AbstractByteBuffer *buf)
Protected Member Functions inherited from ExeElementWrapper
virtual bool canCopyToOffset (offset_t rawOffset)
bool copyToOffset (offset_t rawOffset)

Detailed Description

Definition at line 8 of file PENodeWrapper.h.

Constructor & Destructor Documentation

◆ PEElementWrapper()

PEElementWrapper::PEElementWrapper ( PEFile * pe)

Definition at line 4 of file PENodeWrapper.cpp.

Here is the call graph for this function:

◆ ~PEElementWrapper()

virtual PEElementWrapper::~PEElementWrapper ( )
inlinevirtual

Definition at line 12 of file PENodeWrapper.h.

Member Function Documentation

◆ getPE()

PEFile * PEElementWrapper::getPE ( )
inline

Definition at line 14 of file PENodeWrapper.h.

Here is the call graph for this function:

◆ PEFile

friend class PEFile
friend

Definition at line 19 of file PENodeWrapper.h.

Member Data Documentation

◆ m_PE

PEFile* PEElementWrapper::m_PE
protected

Definition at line 17 of file PENodeWrapper.h.


The documentation for this class was generated from the following files: