* Parse visual basic project info * @param structureOffset Offset in file where the structure starts * @return @c true if project info was successfuly parsed, @c false otherwise */
| 1128 | * @return @c true if project info was successfuly parsed, @c false otherwise |
| 1129 | */ |
| 1130 | bool PeFormat::parseVisualBasicProjectInfo(std::size_t structureOffset) |
| 1131 | { |
| 1132 | std::vector<std::uint8_t> bytes; |
| 1133 | std::uint64_t vbExternTableOffset = 0; |
| 1134 | std::uint64_t vbObjectTableOffset = 0; |
| 1135 | std::string projPath; |
| 1136 | std::size_t offset = 0; |
| 1137 | struct VBProjInfo vbpi; |
| 1138 | |
| 1139 | if (!getBytes(bytes, structureOffset, vbpi.structureSize()) || bytes.size() != vbpi.structureSize()) |
| 1140 | { |
| 1141 | return false; |
| 1142 | } |
| 1143 | |
| 1144 | DynamicBuffer structContent(bytes, retdec::utils::Endianness::LITTLE); |
| 1145 | vbpi.version = structContent.read<std::uint32_t>(offset); offset += sizeof(vbpi.version); |
| 1146 | vbpi.objectTableAddr = structContent.read<std::uint32_t>(offset); offset += sizeof(vbpi.objectTableAddr); |
| 1147 | vbpi.null = structContent.read<std::uint32_t>(offset); offset += sizeof(vbpi.null); |
| 1148 | vbpi.codeStartAddr = structContent.read<std::uint32_t>(offset); offset += sizeof(vbpi.codeStartAddr); |
| 1149 | vbpi.codeEndAddr = structContent.read<std::uint32_t>(offset); offset += sizeof(vbpi.codeEndAddr); |
| 1150 | vbpi.dataSize = structContent.read<std::uint32_t>(offset); offset += sizeof(vbpi.dataSize); |
| 1151 | vbpi.threadSpaceAddr = structContent.read<std::uint32_t>(offset); offset += sizeof(vbpi.threadSpaceAddr); |
| 1152 | vbpi.exHandlerAddr = structContent.read<std::uint32_t>(offset); offset += sizeof(vbpi.exHandlerAddr); |
| 1153 | vbpi.nativeCodeAddr = structContent.read<std::uint32_t>(offset); offset += sizeof(vbpi.nativeCodeAddr); |
| 1154 | std::memcpy(&vbpi.pathInformation, static_cast<void *>(&bytes.data()[offset]), sizeof(vbpi.pathInformation)); offset += sizeof(vbpi.pathInformation); |
| 1155 | vbpi.externalTableAddr = structContent.read<std::uint32_t>(offset); offset += sizeof(vbpi.externalTableAddr); |
| 1156 | vbpi.nExternals = structContent.read<std::uint32_t>(offset); offset += sizeof(vbpi.nExternals); |
| 1157 | |
| 1158 | projPath = retdec::utils::unicodeToAscii(vbpi.pathInformation, sizeof(vbpi.pathInformation)); |
| 1159 | visualBasicInfo.setProjectPath(projPath); |
| 1160 | visualBasicInfo.setPcode(vbpi.nativeCodeAddr == 0); |
| 1161 | |
| 1162 | if (getOffsetFromAddress(vbExternTableOffset, vbpi.externalTableAddr)) |
| 1163 | { |
| 1164 | parseVisualBasicExternTable(vbExternTableOffset, vbpi.nExternals); |
| 1165 | } |
| 1166 | |
| 1167 | if (getOffsetFromAddress(vbObjectTableOffset, vbpi.objectTableAddr)) |
| 1168 | { |
| 1169 | parseVisualBasicObjectTable(vbObjectTableOffset); |
| 1170 | } |
| 1171 | |
| 1172 | return true; |
| 1173 | } |
| 1174 | |
| 1175 | /** |
| 1176 | * Parse visual basic extern table |
nothing calls this directly
no test coverage detected