BearParser
Portable Executable parsing library (from PE-bear)
|
#include <SectHdrsWrapper.h>
Public Types | |
enum | SecFieldId { NAME = 0 , VSIZE , VPTR , RSIZE , RPTR , RELOC_PTR , LINENUM_PTR , RELOC_NUM , LINENUM_NUM , CHARACT , FIELD_COUNTER } |
Public Member Functions | |
SectionHdrWrapper (PEFile *pe, size_t sectionNumber) | |
~SectionHdrWrapper () | |
bool | wrap () |
virtual void * | getPtr () |
virtual bufsize_t | getSize () |
virtual QString | getName () |
virtual size_t | getFieldsCount () |
virtual size_t | getSubFieldsCount () |
virtual void * | getFieldPtr (size_t fieldId, size_t subField=FIELD_NONE) |
virtual QString | getFieldName (size_t fieldId) |
virtual Executable::addr_type | containsAddrType (size_t fieldId, size_t subField=FIELD_NONE) |
virtual WrappedValue::data_type | containsDataType (size_t fieldId, size_t subField=FIELD_NONE) |
offset_t | getContentOffset (Executable::addr_type aType, bool useMapped=true) |
offset_t | getContentEndOffset (Executable::addr_type aType, bool roundup) |
bufsize_t | getContentSize (Executable::addr_type aType, bool recalculate) |
DWORD | getCharacteristics () |
DWORD | getRawPtr () |
DWORD | getVirtualPtr () |
bool | setCharacteristics (DWORD newCharacteristics) |
bool | reloadName () |
Public Member Functions inherited from PENodeWrapper | |
PENodeWrapper (PEFile *pe, PENodeWrapper *parent=NULL) | |
PENodeWrapper (PEFile *pe, PENodeWrapper *parent, size_t entryNumber) | |
virtual | ~PENodeWrapper () |
PEFile * | getPE () |
virtual PENodeWrapper * | getParentNode () |
Public Member Functions inherited from ExeNodeWrapper | |
ExeNodeWrapper (Executable *pe, ExeNodeWrapper *parent=NULL) | |
ExeNodeWrapper (Executable *pe, ExeNodeWrapper *parent, size_t entryNumber) | |
virtual | ~ExeNodeWrapper () |
virtual void | reloadMapping () |
virtual ExeNodeWrapper * | getEntryAt (size_t fieldId) |
virtual size_t | getEntriesCount () |
virtual size_t | getEntriesNum () |
size_t | getEntryId () |
virtual void * | getSubfieldPtr (size_t fieldId, size_t subField) |
virtual bufsize_t | getSubfieldSize (size_t fieldId, size_t subField) |
virtual QString | getSubfieldName (size_t fieldId, size_t subField) |
virtual bool | canAddEntry () |
virtual ExeNodeWrapper * | addEntry (ExeNodeWrapper *entry) |
ExeNodeWrapper * | getLastEntry () |
virtual offset_t | getNextEntryOffset () |
virtual bufsize_t | geEntrySize () |
virtual bool | isValid () |
Public Member Functions inherited from ExeElementWrapper | |
ExeElementWrapper (Executable *exe) | |
virtual | ~ExeElementWrapper () |
virtual bufsize_t | getContentSize () |
virtual BYTE * | getContent () |
virtual offset_t | getOffset () |
virtual offset_t | getOffset (void *ptr, bool allowExceptions=false) |
void * | getFieldPtr (size_t fieldId) |
virtual bufsize_t | getFieldSize (size_t fieldId, size_t subField=FIELD_NONE) |
virtual offset_t | getFieldOffset (size_t fieldId, size_t subField=FIELD_NONE) |
virtual QString | translateFieldContent (size_t fieldId) |
virtual bool | hasSubfieldWrapper (size_t parentType) |
virtual WrappedValue | getWrappedValue (size_t fieldId, size_t subField) |
virtual WrappedValue | getWrappedValue (size_t fieldId) |
virtual uint64_t | getNumValue (size_t fieldId, size_t subField, bool *isOk) |
uint64_t | getNumValue (size_t fieldId, bool *isOk) |
virtual bool | setNumValue (size_t fieldId, size_t subField, uint64_t val) |
bool | setNumValue (size_t fieldId, uint64_t val) |
Executable * | getExe () |
bool | isBit64 () |
bool | isBit32 () |
Public Member Functions inherited from AbstractByteBuffer | |
AbstractByteBuffer () | |
virtual | ~AbstractByteBuffer () |
virtual bool | isTruncated () |
virtual bool | isResized () |
BYTE | operator[] (size_t idx) |
virtual BYTE * | getContentAt (offset_t offset, bufsize_t size, bool allowExceptions=false) |
virtual BYTE * | getContentAtPtr (BYTE *ptr, bufsize_t size, bool allowExceptions=false) |
virtual bool | setBufferedValue (BYTE *dstPtr, BYTE *srcPtr, bufsize_t srcSize, bufsize_t paddingSize, bool allowExceptions=false) |
bool | setStringValue (offset_t rawOffset, QString newText) |
QString | getStringValue (offset_t rawOffset, bufsize_t len=BUFSIZE_MAX, bool acceptNonTerminated=false) |
QString | getWStringValue (offset_t rawOffset, bufsize_t len) |
QString | getWAsciiStringValue (offset_t rawOffset, bufsize_t len, bool acceptNonTerminated=false) |
bufsize_t | getMaxSizeFromOffset (offset_t startOffset) |
bufsize_t | getMaxSizeFromPtr (BYTE *ptr) |
bool | isAreaEmpty (offset_t rawOffset, bufsize_t size) |
bool | fillContent (BYTE filling) |
bool | pasteBuffer (offset_t rawOffset, AbstractByteBuffer *buf, bool allowTrunc) |
bool | containsBlock (offset_t rawOffset, bufsize_t size) |
bool | intersectsBlock (offset_t rawOffset, bufsize_t size) |
uint64_t | getNumValue (offset_t offset, bufsize_t size, bool *isOk) |
bool | setNumValue (offset_t offset, bufsize_t size, uint64_t newVal) |
bool | setTextValue (char *textPtr, std::string newText, size_t fieldLimitLen=0) |
virtual bool | resize (bufsize_t newSize) |
offset_t | substFragmentByFile (offset_t offset, bufsize_t contentSize, QFile &fIn) |
Static Public Member Functions | |
static std::vector< DWORD > | splitCharacteristics (DWORD characteristics) |
static QString | getSecHdrAccessRightsDesc (DWORD characteristics) |
static void | initSecCharacter (std::map< DWORD, QString > &secHdrCharact) |
static QString | translateCharacteristics (DWORD charact) |
Static Public Member Functions inherited from AbstractByteBuffer | |
static bool | isValid (AbstractByteBuffer *buf) |
Public Attributes | |
QString | mappedName |
Static Public Attributes | |
static const size_t | SECNAME_LEN = 8 |
Protected Member Functions | |
SectionHdrWrapper (PEFile *pe, IMAGE_SECTION_HEADER *v_header) | |
offset_t | getContentDeclaredOffset (Executable::addr_type aType) |
bufsize_t | getContentDeclaredSize (Executable::addr_type aType) |
bufsize_t | getMappedRawSize () |
bufsize_t | getMappedVirtualSize () |
Protected Member Functions inherited from ExeNodeWrapper | |
size_t | getEntriesCount (std::vector< ExeNodeWrapper * > &_entries) |
ExeNodeWrapper * | getEntryAt (std::vector< ExeNodeWrapper * > &_entries, size_t fieldId) |
virtual void | clear () |
virtual void | addMapping (ExeNodeWrapper *entry) |
virtual bool | loadNextEntry (size_t entryNum) |
virtual ExeNodeWrapper * | addEntryAt (ExeNodeWrapper *entry, offset_t nextOffset) |
virtual bool | isMyEntryType (ExeNodeWrapper *entry) |
Protected Member Functions inherited from ExeElementWrapper | |
virtual bool | canCopyToOffset (offset_t rawOffset) |
bool | copyToOffset (offset_t rawOffset) |
Protected Attributes | |
char * | name |
size_t | sectNum |
Protected Attributes inherited from PENodeWrapper | |
PEFile * | m_PE |
PENodeWrapper * | peParentNode |
Protected Attributes inherited from ExeNodeWrapper | |
ExeNodeWrapper * | parentNode |
size_t | entryNum |
std::vector< ExeNodeWrapper * > | entries |
Protected Attributes inherited from ExeElementWrapper | |
Executable * | m_Exe |
Friends | |
class | PEFile |
Definition at line 11 of file SectHdrsWrapper.h.
Enumerator | |
---|---|
NAME | |
VSIZE | |
VPTR | |
RSIZE | |
RPTR | |
RELOC_PTR | |
LINENUM_PTR | |
RELOC_NUM | |
LINENUM_NUM | |
CHARACT | |
FIELD_COUNTER |
Definition at line 23 of file SectHdrsWrapper.h.
|
inline |
|
inline |
Definition at line 44 of file SectHdrsWrapper.h.
|
inlineprotected |
|
virtual |
Reimplemented from ExeElementWrapper.
Definition at line 172 of file SectHdrsWrapper.cpp.
|
virtual |
Reimplemented from ExeElementWrapper.
Definition at line 183 of file SectHdrsWrapper.cpp.
|
inline |
Definition at line 73 of file SectHdrsWrapper.h.
|
protected |
Definition at line 193 of file SectHdrsWrapper.cpp.
|
protected |
Definition at line 238 of file SectHdrsWrapper.cpp.
offset_t SectionHdrWrapper::getContentEndOffset | ( | Executable::addr_type | aType, |
bool | roundup ) |
offset_t SectionHdrWrapper::getContentOffset | ( | Executable::addr_type | aType, |
bool | useMapped = true ) |
bufsize_t SectionHdrWrapper::getContentSize | ( | Executable::addr_type | aType, |
bool | recalculate ) |
|
virtual |
Implements ExeNodeWrapper.
Definition at line 154 of file SectHdrsWrapper.cpp.
|
virtual |
Implements ExeElementWrapper.
Definition at line 131 of file SectHdrsWrapper.cpp.
|
inlinevirtual |
Implements ExeElementWrapper.
Definition at line 57 of file SectHdrsWrapper.h.
|
protected |
|
protected |
|
virtual |
Implements ExeElementWrapper.
Definition at line 124 of file SectHdrsWrapper.cpp.
|
virtual |
Implements ExeElementWrapper.
Definition at line 79 of file SectHdrsWrapper.cpp.
|
inline |
Definition at line 75 of file SectHdrsWrapper.h.
|
static |
Definition at line 13 of file SectHdrsWrapper.cpp.
|
virtual |
Implements ExeElementWrapper.
Definition at line 118 of file SectHdrsWrapper.cpp.
|
inlinevirtual |
Reimplemented from ExeNodeWrapper.
Definition at line 58 of file SectHdrsWrapper.h.
|
inline |
Definition at line 77 of file SectHdrsWrapper.h.
|
static |
Definition at line 26 of file SectHdrsWrapper.cpp.
bool SectionHdrWrapper::reloadName | ( | ) |
|
inline |
Definition at line 81 of file SectHdrsWrapper.h.
|
static |
|
static |
|
virtual |
Reimplemented from ExeNodeWrapper.
Definition at line 69 of file SectHdrsWrapper.cpp.
|
friend |
Definition at line 114 of file SectHdrsWrapper.h.
QString SectionHdrWrapper::mappedName |
Definition at line 92 of file SectHdrsWrapper.h.
|
protected |
Definition at line 107 of file SectHdrsWrapper.h.
|
static |
Definition at line 14 of file SectHdrsWrapper.h.
|
protected |
Definition at line 108 of file SectHdrsWrapper.h.