QuasarApp/pe-parse
4
0
Fork 0
mirror of https://github.com/QuasarApp/pe-parse.git synced 2025-04-27 21:04:31 +00:00
Code Issues Projects Releases Wiki Activity

.

Browse Source
This commit is contained in:
Andrew 2013-07-25 17:49:32 -04:00
parent 12d91daa6f
commit 7f1406397e
1 changed files with 48 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
parser-library/parse.cpp
View File

@ -27,8 +27,54 @@ list<section> getSections(bounded_buffer *file) {
}
bool readOptionalHeader(bounded_buffer *b, optional_header_32 &header) {
#define READ_WORD(x) \
if(readWord(b, _offset(optional_header_32, x), header.x) == false) { \
return false; \
}
#define READ_DWORD(x) \
if(readDword(b, _offset(optional_header_32, x), header.x) == false) { \
return false; \
}
#define READ_BYTE(x) \
if(readByte(b, _offset(optional_header_32, x), header.x) == false) { \
return false; \
}
return false;
READ_WORD(Magic);
READ_BYTE(MajorLinkerVersion);
READ_BYTE(MinorLinkerVersion);
READ_DWORD(SizeOfCode);
READ_DWORD(SizeOfInitializedData);
READ_DWORD(SizeOfUninitializedData);
READ_DWORD(AddressOfEntryPoint);
READ_DWORD(BaseOfCode);
READ_DWORD(BaseOfData);
READ_DWORD(ImageBase);
READ_DWORD(SectionAlignment);
READ_DWORD(FileAlignment);
READ_WORD(MajorOperatingSystemVersion);
READ_WORD(MinorOperatingSystemVersion);
READ_WORD(MajorImageVersion);
READ_WORD(MinorImageVersion);
READ_WORD(MajorSubsystemVersion);
READ_WORD(MinorSubsystemVersion);
READ_DWORD(Win32VersionValue);
READ_DWORD(SizeOfImage);
READ_DWORD(SizeOfHeaders);
READ_DWORD(CheckSum);
READ_WORD(Subsystem);
READ_WORD(DllCharacteristics);
READ_DWORD(SizeOfStackReserve);
READ_DWORD(SizeOfStackCommit);
READ_DWORD(SizeOfHeapReserve);
READ_DWORD(SizeOfHeapCommit);
READ_DWORD(LoaderFlags);
READ_DWORD(NumberOfRvaAndSizes);
#undef READ_WORD
#undef READ_DWORD
#undef READ_BYTE
return true;
}
bool readFileHeader(bounded_buffer *b, file_header &header) {
@ -52,7 +98,7 @@ bool readFileHeader(bounded_buffer *b, file_header &header) {
#undef READ_DWORD
#undef READ_WORD
return false;
return true;
}
bool readNtHeader(bounded_buffer *b, nt_header_32 &header) {