QuasarApp/pe-parse
4
0
Fork 0
mirror of https://github.com/QuasarApp/pe-parse.git synced 2025-05-16 21:09:34 +00:00
Code Issues Projects Releases Wiki Activity

.

Browse Source
This commit is contained in:
Andrew 2013-07-25 15:19:00 -04:00
parent 9ed4759bc7
commit e6f3f4f948
2 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
parser-library/nt-headers.h
View File

@ -2,6 +2,12 @@
#define _NT_HEADERS #define _NT_HEADERS
#include <boost/cstdint.hpp> #include <boost/cstdint.hpp>
//need an offsetof macro
//need to pack these structure definitions
//some constant definitions
struct dos_header { struct dos_header {
boost::uint16_t e_magic; boost::uint16_t e_magic;
boost::uint16_t e_cblp; boost::uint16_t e_cblp;
@ -24,4 +30,14 @@ struct dos_header {
boost::uint32_t e_lfanew; boost::uint32_t e_lfanew;
}; };
struct file_header {
boost::uint16_t Machine;
boost::uint16_t NumberOfSections;
boost::uint32_t TimeDateStamp;
boost::uint32_t PointerToSymbolTable;
boost::uint32_t NumberOfSymbols;
boost::uint16_t SizeOfOptionalHeader;
boost::uint16_t Characteristics;
};
#endif #endif

2
parser-library/parse.h
View File

@ -18,6 +18,8 @@ bool readWord(bounded_buffer *b, boost::uint32_t offset, boost::uint16_t &out);
bool readDword(bounded_buffer *b, boost::uint32_t offset, boost::uint32_t &out); bool readDword(bounded_buffer *b, boost::uint32_t offset, boost::uint32_t &out);
bounded_buffer *readFileToFileBuffer(const char *filePath); bounded_buffer *readFileToFileBuffer(const char *filePath);
bounded_buffer *splitBuffer(bounded_buffer *b, boost::uint32_t from, boost::uint32_t to);
void deleteBuffer(bounded_buffer *b);
void deleteBuffer(bounded_buffer *b); void deleteBuffer(bounded_buffer *b);