Function peExtractStrings

emmy_hook/src/libpe/libpe.cpp:209–249

}

template<typename T> void peExtractStrings( PE *pe, uint32_t dwMinSize, PE_STRING_ENCODING encoding, PE_STRING_DUP dup, ht_t *LookupTable )
{
#define STRING_BUFF_SIZE 0xFFFF

	T zBuffer[STRING_BUFF_SIZE] = {0};
	int byte = 0;
	uint32_t dwOffset, dwEnd = ( pe->dwFileSize - sizeof(T) ), dwCurrent = 0;
	PE_STRING *pString = NULL;

	for( dwOffset = 0; dwOffset < dwEnd; dwOffset += sizeof(T) )
	{
		byte = *(T *)&pe->pData[dwOffset];
		if( peIsPrintable( byte, encoding ) == false )
		{
			if( dwCurrent > dwMinSize )
			{
				zBuffer[dwCurrent] = 0x00;

				if( ht_get( LookupTable, zBuffer ) == NULL )
				{
					pString = (PE_STRING *)malloc( sizeof(PE_STRING) );

					pString->Encoding   = encoding;
					pString->CharLength = dwCurrent - 1;
					pString->ByteLength = pString->CharLength * sizeof(T);
					pString->Data		= (uint8_t *)dup(zBuffer);
					pString->Offset		= dwOffset;

					ht_add( LookupTable, pString->Data, pString );
					ll_append( &pe->Strings.List, pString );
				}
			}

			dwCurrent = 0;
		}
		else if( dwCurrent < STRING_BUFF_SIZE - 2 )
		{
			zBuffer[dwCurrent++] = byte;
		}
	}
}

#pragma endregion