Build the full _PEB64 tree (0x7D0 bytes), unions mapped to first member
| 151 | |
| 152 | // Build the full _PEB64 tree (0x7D0 bytes), unions mapped to first member |
| 153 | static NodeTree makeTestTree() { |
| 154 | NodeTree tree; |
| 155 | tree.baseAddress = 0x000000D87B5E5000ULL; |
| 156 | |
| 157 | // Root struct |
| 158 | Node root; |
| 159 | root.kind = NodeKind::Struct; |
| 160 | root.structTypeName = "_PEB64"; |
| 161 | root.name = "Peb"; |
| 162 | root.parentId = 0; |
| 163 | root.offset = 0; |
| 164 | int ri = tree.addNode(root); |
| 165 | uint64_t rootId = tree.nodes[ri].id; |
| 166 | |
| 167 | // Helpers |
| 168 | auto field = [&](int off, NodeKind k, const char* name) { |
| 169 | Node n; n.kind = k; n.name = name; |
| 170 | n.parentId = rootId; n.offset = off; |
| 171 | tree.addNode(n); |
| 172 | }; |
| 173 | auto pad = [&](int off, int len, const char* name) { |
| 174 | Node n; n.kind = NodeKind::Padding; n.name = name; |
| 175 | n.parentId = rootId; n.offset = off; n.arrayLen = len; |
| 176 | tree.addNode(n); |
| 177 | }; |
| 178 | auto arr = [&](int off, NodeKind ek, int len, const char* name) { |
| 179 | Node n; n.kind = NodeKind::Array; n.name = name; |
| 180 | n.parentId = rootId; n.offset = off; |
| 181 | n.arrayLen = len; n.elementKind = ek; |
| 182 | tree.addNode(n); |
| 183 | }; |
| 184 | auto sub = [&](int off, const char* ty, const char* name) -> uint64_t { |
| 185 | Node n; n.kind = NodeKind::Struct; n.structTypeName = ty; n.name = name; |
| 186 | n.parentId = rootId; n.offset = off; |
| 187 | int idx = tree.addNode(n); return tree.nodes[idx].id; |
| 188 | }; |
| 189 | |
| 190 | // ── 0x000 – 0x007 ── |
| 191 | field(0x000, NodeKind::UInt8, "InheritedAddressSpace"); |
| 192 | field(0x001, NodeKind::UInt8, "ReadImageFileExecOptions"); |
| 193 | field(0x002, NodeKind::UInt8, "BeingDebugged"); |
| 194 | field(0x003, NodeKind::UInt8, "BitField"); // union → first member |
| 195 | pad (0x004, 4, "Padding0"); |
| 196 | |
| 197 | // ── 0x008 – 0x04F ── |
| 198 | field(0x008, NodeKind::Pointer64, "Mutant"); |
| 199 | field(0x010, NodeKind::Pointer64, "ImageBaseAddress"); |
| 200 | field(0x018, NodeKind::Pointer64, "Ldr"); |
| 201 | field(0x020, NodeKind::Pointer64, "ProcessParameters"); |
| 202 | field(0x028, NodeKind::Pointer64, "SubSystemData"); |
| 203 | field(0x030, NodeKind::Pointer64, "ProcessHeap"); |
| 204 | field(0x038, NodeKind::Pointer64, "FastPebLock"); |
| 205 | field(0x040, NodeKind::Pointer64, "AtlThunkSListPtr"); |
| 206 | field(0x048, NodeKind::Pointer64, "IFEOKey"); |
| 207 | |
| 208 | // ── 0x050 – 0x07F ── |
| 209 | field(0x050, NodeKind::UInt32, "CrossProcessFlags"); // union → first member |
| 210 | pad (0x054, 4, "Padding1"); |
no test coverage detected