BearParser

https://hasherezade.github.io/bearparser
Admin
BearParser is a Portable Executable (PE) parsing library extracted from PE-bear, designed for...
Tokens:129,721
Snippets:777
Trust Score:9.7
Update:1 month ago
Show doc for...
Tokens:
Raw
### getGuidString method implementation

Source: https://hasherezade.github.io/bearparser/_debug_dir_wrapper_8cpp_source.html

Builds a GUID string from DEBUG_RSDSI fields, using asprintf (Qt 5) or sprintf (older Qt) for formatting. Returns the GUID in braces with hyphens.

```cpp
QString chunk5 = "";
for (size_t i = 0; i < sizeof(rdsi->guidSig.Data5); i++) {
    QString out;
#if QT_VERSION >= 0x050000
    out = QString().asprintf("%02X", rdsi->guidSig.Data5[i]);
#else
    out = QString().sprintf("%02X", rdsi->guidSig.Data5[i]);
#endif
    chunk5 += out;
}
QString out;
#if QT_VERSION >= 0x050000
out = QString().asprintf("%08X-%04X-%04X-",
    rdsi->guidSig.Data1,
    rdsi->guidSig.Data2,
    rdsi->guidSig.Data3);
#else
out = QString().sprintf("%08X-%04X-%04X-",
    rdsi->guidSig.Data1,
    rdsi->guidSig.Data2,
    rdsi->guidSig.Data3);
#endif
return "{" + out + chunk4 + "-" + chunk5 + "}";
```

--------------------------------

### ByteBuffer Initialization Method

Source: https://hasherezade.github.io/bearparser/_byte_buffer_8cpp_source.html

The _init method handles the initial allocation and setup of the buffer content, throwing a BufferException if a zero size is requested.

```cpp
void ByteBuffer::_init(const bufsize_t& v_size, const bufsize_t& v_padding)
{
 if (v_size == 0) throw BufferException("Zero size requested");

 this->content = allocContent(v_size, v_padding);
 if (this->content) {
 this->padding = v_padding;
 this->contentSize = v_size;
 this->originalSize = v_size;
 }
}
```

--------------------------------

### DelayImpDirWrapper::firstDelayLd(bufsize_t size)

Source: https://hasherezade.github.io/bearparser/_delay_imp_dir_wrapper_8cpp_source.html

Gets the content at the directory entry address with the given size. Returns NULL if the content is not available.

```cpp
void* DelayImpDirWrapper::firstDelayLd(bufsize_t size)
{
 offset_t rva = getDirEntryAddress();

 BYTE *ptr = m_Exe->getContentAt(rva, Executable::RVA, size);
 if (ptr == NULL) return NULL;

 return ptr;
}
```

```cpp
void* DelayImpDirWrapper::firstDelayLd(bufsize_t size) {…}
```

--------------------------------

### Get Section Name

Source: https://hasherezade.github.io/bearparser/_sect_hdrs_wrapper_8cpp_source.html

Retrieves the section name as a QString.

```cpp
124QString SectionHdrWrapper::getName()
125{
126 //reloadName();
127 if (!this->name) return ""; //cannot load
128 return this->name;
129}
```

--------------------------------

### nt64: Get 64-bit NT headers

Source: https://hasherezade.github.io/bearparser/_opt_hdr_wrapper_8cpp_source.html

Returns a pointer to the 64-bit NT headers if the PE is 64-bit, otherwise returns NULL.

```cpp
if (m_PE == NULL) return NULL;
if (getHdrBitMode() != Executable::BITS_64) return NULL;

offset_t myOff = m_PE->peNtHdrOffset();
IMAGE_NT_HEADERS64* hdr = (IMAGE_NT_HEADERS64*) m_Exe->getContentAt(myOff, sizeof(IMAGE_NT_HEADERS64));
return hdr;
```

--------------------------------

### DebugDirCVEntryWrapper::getGuidString method

Source: https://hasherezade.github.io/bearparser/_debug_dir_wrapper_8cpp_source.html

Builds a hex string from the GUID's Data4 bytes, using asprintf for Qt5 or sprintf for older Qt versions.

```cpp
DEBUG_RSDSI* rdsi = parentDir->getRDSI();
if (rdsi) {
    QString chunk4 = "";
    for (size_t i = 0; i < sizeof(rdsi->guidSig.Data4); i++) {
        QString out;
#if QT_VERSION >= 0x050000
        out = QString().asprintf("%02X", rdsi->guidSig.Data4[i]);
#else
        out = QString().sprintf("%02X", rdsi->guidSig.Data4[i]);
#endif
        chunk4 += out;
    }
```

--------------------------------

### RichHdrWrapper::getSize() - Get Rich header size

Source: https://hasherezade.github.io/bearparser/_rich_hdr_wrapper_8cpp_source.html

Computes the total size of the Rich header by adding the size of RICH_SIGNATURE to the offset difference between the Rich signature and the header start. Returns 0 if the header is not initialized.

```cpp
bufsize_t RichHdrWrapper::getSize()
{
 if (!this->richSign || !this->dansHdr) {
 return 0;
 }
 const offset_t dansOffset = getOffset(this->dansHdr);
 const offset_t richOffset = getOffset(this->richSign);
 offset_t diff = richOffset - dansOffset;

 pe::RICH_SIGNATURE rich1 = { 0 };
 diff += sizeof(rich1);
 return diff;
}
```

--------------------------------

### PEFile::getRichHeaderSign (partial)

Source: https://hasherezade.github.io/bearparser/_p_e_file_8cpp_source.html

Starts the getRichHeaderSign function, retrieving the DOS stub offset and end (PE header start) from the DOS header.

```cpp
pe::RICH_SIGNATURE* PEFile::getRichHeaderSign()
{
size_t dosStubOffset = this->core.dos->e_lfarlc;
size_t dosStubEnd = this->core.dos->e_lfanew; // PE header start
```

--------------------------------

### PEFile::_init wrapper generation

Source: https://hasherezade.github.io/bearparser/_p_e_file_8cpp_source.html

Initializes the PEFile by wrapping the core buffer, creating a ResourcesAlbum, and generating all header and directory wrappers. Throws ExeException if the FileHdr or OptionalHeader cannot be parsed.

```cpp
void PEFile::_init(AbstractByteBuffer *v_buf)
{
// wrap the core:
core.wrap(v_buf);

album = new ResourcesAlbum(this);

//generate wrappers:
this->dosHdrWrapper = new DosHdrWrapper(this);
this->wrappers[WR_DOS_HDR] = this->dosHdrWrapper;

this->fHdr = new FileHdrWrapper(this);
if (fHdr->getPtr() == NULL) throw ExeException("Cannot parse FileHdr: It is not PE File!");
this->wrappers[WR_FILE_HDR] = fHdr;
this->wrappers[WR_RICH_HDR] = new RichHdrWrapper(this);

this->optHdr = new OptHdrWrapper(this);
if (optHdr->getPtr() == NULL) throw ExeException("Cannot parse OptionalHeader: It is not PE File!");
this->wrappers[WR_OPTIONAL_HDR] = optHdr;

this->sects = new SectHdrsWrapper(this);
this->wrappers[WR_SECTIONS] = sects;

this->wrappers[WR_DATADIR] = new DataDirWrapper(this);
dataDirEntries[pe::DIR_IMPORT] = new ImportDirWrapper(this);
dataDirEntries[pe::DIR_DELAY_IMPORT] = new DelayImpDirWrapper(this);
dataDirEntries[pe::DIR_BOUND_IMPORT] = new BoundImpDirWrapper(this);
dataDirEntries[pe::DIR_DEBUG] = new DebugDirWrapper(this);
dataDirEntries[pe::DIR_EXPORT] = new ExportDirWrapper(this);
dataDirEntries[pe::DIR_SECURITY] = new SecurityDirWrapper(this);
dataDirEntries[pe::DIR_TLS] = new TlsDirWrapper(this);
dataDirEntries[pe::DIR_LOAD_CONFIG] = new LdConfigDirWrapper(this);
dataDirEntries[pe::DIR_BASERELOC] = new RelocDirWrapper(this);
dataDirEntries[pe::DIR_EXCEPTION] = new ExceptionDirWrapper(this);
dataDirEntries[pe::DIR_RESOURCE] = new ResourceDirWrapper(this, album);
dataDirEntries[pe::DIR_COM_DESCRIPTOR] = new ClrDirWrapper(this); 

for (int i = 0; i < pe::DIR_ENTRIES_COUNT; i++) {
this->wrappers[WR_DIR_ENTRY + i] = dataDirEntries[i];
}
if (this->album) {
this->album->wrapLeafsContent();
}
}
```

--------------------------------

### ExeFactory::init()

Source: https://hasherezade.github.io/bearparser/class_exe_factory.html

Initializes the factory, likely registering available builders. This is a static method that must be called before using the factory.

```APIDOC
## ExeFactory::init()

### Description
Initializes the ExeFactory, preparing it for use. This static method should be called before building any executables.

### Method
init

### Signature
`static void ExeFactory::init()`

### Parameters
None.

### Returns
void

```

--------------------------------

### ExeFactory::init() implementation

Source: https://hasherezade.github.io/bearparser/_exe_factory_8cpp_source.html

Initializes the builders map with DOSExeBuilder for MZ and PEFileBuilder for PE, but only if not already initialized.

```cpp
void ExeFactory::init()
{
 if (builders.size() > 0) {
 return; // already initialized
 }
 builders[MZ] = new DOSExeBuilder();
 builders[PE] = new PEFileBuilder();
}
```

--------------------------------

### getNumValue

Source: https://hasherezade.github.io/bearparser/class_abstract_byte_buffer.html

Get a numeric value from the buffer.

```APIDOC
## getNumValue

### Description
Get a numeric value from the buffer.

### Method
Non-virtual

### Signature
uint64_t getNumValue(offset_t offset, bufsize_t size, bool* isOk)

### Parameters
- **offset** (offset_t) - Offset to read from.
- **size** (bufsize_t) - Size of the value.
- **isOk** (bool*) - Pointer to a bool to indicate success.

### Returns
- **uint64_t** - The numeric value.

```

--------------------------------

### ExeNodeWrapper constructors and methods

Source: https://hasherezade.github.io/bearparser/_exe_node_wrapper_8cpp_source.html

The source code of ExeNodeWrapper.cpp, showing constructors, getEntryAt overloads, getEntriesCount, clear, getSubfieldPtr/Size/Name, and canAddEntry methods.

```cpp
#include "ExeNodeWrapper.h"

ExeNodeWrapper::ExeNodeWrapper(Executable *exec, ExeNodeWrapper* parent)
 : ExeElementWrapper(exec), parentNode(parent), entryNum(0)
{
 wrap();
}

ExeNodeWrapper::ExeNodeWrapper(Executable *exec, ExeNodeWrapper* parent, size_t entryNumber)
 : ExeElementWrapper(exec), parentNode(parent), entryNum(entryNumber)
{
 wrap();
}

ExeNodeWrapper* ExeNodeWrapper::getEntryAt(size_t fieldId)
{
 return this->getEntryAt(this->entries, fieldId);
}

ExeNodeWrapper* ExeNodeWrapper::getEntryAt(std::vector<ExeNodeWrapper*> &_entries, size_t fieldId)
{
 return (fieldId < _entries.size()) ? _entries[fieldId] : NULL;
}

size_t ExeNodeWrapper::getEntriesCount(std::vector<ExeNodeWrapper*> &_entries)
{
 return _entries.size();
}

void ExeNodeWrapper::clear()
{
 size_t entriesCount = this->entries.size();
 for (size_t i = 0; i < entriesCount; i++) {
 delete this->entries[i];
 }
 this->entries.clear();
}

void* ExeNodeWrapper::getSubfieldPtr(size_t fieldId, size_t subField)
{
 ExeNodeWrapper* entry = this->getEntryAt(fieldId);
 if (!entry) return NULL;
 //---
 return entry->getFieldPtr(subField);
}

bufsize_t ExeNodeWrapper::getSubfieldSize(size_t fieldId, size_t subField)
{
 ExeNodeWrapper* entry = this->getEntryAt(fieldId);
 if (!entry) return 0;
 //---
 return entry->getFieldSize(subField);
}

QString ExeNodeWrapper::getSubfieldName(size_t fieldId, size_t subField)
{
 ExeNodeWrapper* entry = this->getEntryAt(fieldId);
 if (!entry) return "";
 //---
 return entry->getFieldName(subField);
}

bool ExeNodeWrapper::canAddEntry()
{
 offset_t nextOffset = getNextEntryOffset();
 bufsize_t entrySize = geEntrySize();
 if (entrySize == 0) return false;

 bufsize_t paddedSize = entrySize * 2;
 bool haveSpace = this->m_Exe->isAreaEmpty(nextOffset, paddedSize);
 Logger::append(Logger::D_INFO,
 "NextOffset = %llX size = %lX, canAdd: %u", 
 static_cast<unsigned long long>(nextOffset),
 static_cast<unsigned long>(entrySize),
 static_cast<unsigned int>(haveSpace)
 );
}
```

--------------------------------

### BoundEntryWrapper::getPtr() - Get Bound Entry Pointer

Source: https://hasherezade.github.io/bearparser/_bound_imp_dir_wrapper_8cpp_source.html

Returns a pointer to the bound entry at the current index. It uses the parent BoundImpDirWrapper to get the first entry and calculates the offset based on the entry number. Returns NULL on failure.

```cpp
void* BoundEntryWrapper::getPtr()
{
 BoundImpDirWrapper* parent = dynamic_cast<BoundImpDirWrapper*> (this->getParentNode());
 if (!parent) return NULL;

 IMAGE_BOUND_IMPORT_DESCRIPTOR* firstEntry = parent->boundImp();
 if (firstEntry == NULL) return NULL;

 uint64_t descAddr = parent->getOffset(firstEntry);
 if (descAddr == INVALID_ADDR) return NULL;

 uint64_t entryOffset = descAddr + (this->entryNum * sizeof(IMAGE_BOUND_IMPORT_DESCRIPTOR));
 if (entryOffset == INVALID_ADDR) return NULL;
}
```

--------------------------------

### DOSExe constructor - Initialize DOSExe

Source: https://hasherezade.github.io/bearparser/_d_o_s_exe_8cpp_source.html

Constructor for DOSExe, initializes base class with BITS_16 and calls wrap().

```cpp
DOSExe::DOSExe(AbstractByteBuffer *v_buf)
 : MappedExe(v_buf, Executable::BITS_16), dosHdrWrapper(NULL)
{
 wrap();
}
```

--------------------------------

### getMaxSizeFromPtr

Source: https://hasherezade.github.io/bearparser/class_abstract_byte_buffer.html

Get the maximum size from a given pointer.

```APIDOC
## getMaxSizeFromPtr

### Description
Get the maximum size from a given pointer.

### Method
Non-virtual

### Signature
bufsize_t getMaxSizeFromPtr(BYTE* ptr)

### Parameters
- **ptr** (BYTE*) - Pointer to start from.

### Returns
- **bufsize_t** - The maximum size from the pointer.

```

--------------------------------

### Executable constructor with NULL buffer check

Source: https://hasherezade.github.io/bearparser/_executable_8cpp_source.html

Initializes an Executable object with a buffer and bit mode, throwing an ExeException if the buffer is NULL.

```cpp
Executable::Executable(AbstractByteBuffer *v_buf, exe_bits v_bitMode)
 : buf(v_buf), bitMode(v_bitMode)
{
 if (!v_buf) throw ExeException("Cannot make an Exe from NULL buffer");
}
```

--------------------------------

### getMaxSizeFromOffset

Source: https://hasherezade.github.io/bearparser/class_abstract_byte_buffer.html

Get the maximum size from a given offset.

```APIDOC
## getMaxSizeFromOffset

### Description
Get the maximum size from a given offset.

### Method
Non-virtual

### Signature
bufsize_t getMaxSizeFromOffset(offset_t startOffset)

### Parameters
- **startOffset** (offset_t) - Offset to start from.

### Returns
- **bufsize_t** - The maximum size from the offset.

```

--------------------------------

### TlsDirWrapper::wrap Method

Source: https://hasherezade.github.io/bearparser/_tls_dir_wrapper_8cpp_source.html

Iterates through TLS directory entries and populates the internal entries list.

```cpp
bool TlsDirWrapper::wrap()
{
 clear();
 size_t entryId = 0;
 while (true) {
 TlsEntryWrapper* entry = new TlsEntryWrapper(this->m_Exe, this, entryId++);
 if (!entry->getPtr()) {
 delete entry;
 break;
 }

 bool isOk = false;
 uint64_t val = entry->getNumValue(TlsEntryWrapper::CALLBACK_ADDR, &isOk);
 if (!isOk || val == 0) {
 delete entry;
 break;
 }
 this->entries.push_back(entry);
 }
 return true;
}
```

--------------------------------

### getStringValue

Source: https://hasherezade.github.io/bearparser/class_abstract_byte_buffer.html

Get a string value from a given offset.

```APIDOC
## getStringValue

### Description
Get a string value from a given offset.

### Method
Non-virtual

### Signature
QString getStringValue(offset_t rawOffset, bufsize_t len = BUFSIZE_MAX, bool acceptNonTerminated = false)

### Parameters
- **rawOffset** (offset_t) - Offset to get the string from.
- **len** (bufsize_t) - Optional. Maximum length of the string.
- **acceptNonTerminated** (bool) - Optional. Whether to accept non-terminated strings.

### Returns
- **QString** - The string value.

```

--------------------------------

### translateOSVersion: Map OS version pairs to strings

Source: https://hasherezade.github.io/bearparser/_opt_hdr_wrapper_8cpp_source.html

Initializes a static map from OS version pairs to descriptive strings and returns the mapped string for the given major/minor version. Returns an empty string if the version is not found.

```cpp
s_osVersion[pair<WORD,WORD>(4, 90)] = "Windows ME";
s_osVersion[pair<WORD,WORD>(4, 10)] = "Windows 98";
s_osVersion[pair<WORD,WORD>(4, 0)] = "Windows 95 / NT 4.0";

s_osVersion[pair<WORD,WORD>(3, 51)] = "Windows NT 3.51";
s_osVersion[pair<WORD,WORD>(3, 10)] = "Windows NT 3.1";
}
pair<WORD,WORD> p(major, minor);
if (s_osVersion.find(p) == s_osVersion.end()) return "";
return s_osVersion[p];
```

--------------------------------

### getOffset

Source: https://hasherezade.github.io/bearparser/class_abstract_byte_buffer.html

Get the offset of a pointer within the buffer.

```APIDOC
## getOffset

### Description
Get the offset of a pointer within the buffer.

### Method
Virtual

### Signature
virtual offset_t getOffset(void* ptr, bool allowExceptions = false)

### Parameters
- **ptr** (void*) - Pointer to find the offset for.
- **allowExceptions** (bool) - Optional. Whether to allow exceptions.

### Returns
- **offset_t** - The offset of the pointer.

```

--------------------------------

### ExeNodeWrapper::addEntry implementation

Source: https://hasherezade.github.io/bearparser/_exe_node_wrapper_8cpp_source.html

Adds an entry by first computing the next free offset, then delegating to addEntryAt.

```cpp
ExeNodeWrapper* ExeNodeWrapper::addEntry(ExeNodeWrapper *entry)
{
    offset_t offset = getNextEntryOffset();
    return addEntryAt(entry, offset);
}
```

--------------------------------

### ResourceDirWrapper::wrap implementation

Source: https://hasherezade.github.io/bearparser/_resource_dir_wrapper_8cpp_source.html

Initializes the wrapper by clearing previous state and calculating the total number of entries in the resource directory.

```cpp
bool ResourceDirWrapper::wrap()
{
 clear();
 if (this->topEntryID == TOP_ENTRY_ROOT && this->album != NULL) {
 this->album->clear();
 }
 IMAGE_RESOURCE_DIRECTORY* dir = resourceDir();
 if (dir == NULL) return false;
 size_t namesNum = dir->NumberOfNamedEntries;
 size_t idsNum = dir->NumberOfIdEntries;

 size_t totalEntries = namesNum + idsNum;
```

--------------------------------

### Get Section Size

Source: https://hasherezade.github.io/bearparser/_sect_hdrs_wrapper_8cpp_source.html

Returns the size of the IMAGE_SECTION_HEADER structure.

```cpp
118bufsize_t SectionHdrWrapper::getSize()
119{
120 if (m_PE == NULL) return 0;
121 return sizeof(IMAGE_SECTION_HEADER);
122}
```

--------------------------------

### getWStringValue

Source: https://hasherezade.github.io/bearparser/class_abstract_byte_buffer.html

Get a wide string value from a given offset.

```APIDOC
## getWStringValue

### Description
Get a wide string value from a given offset.

### Method
Non-virtual

### Signature
QString getWStringValue(offset_t rawOffset, bufsize_t len)

### Parameters
- **rawOffset** (offset_t) - Offset to get the wide string from.
- **len** (bufsize_t) - Length of the wide string.

### Returns
- **QString** - The wide string value.

```

--------------------------------

### BufferView Constructor

Source: https://hasherezade.github.io/bearparser/_abstract_byte_buffer_8cpp_source.html

Initializes a BufferView with a parent buffer, offset, and size. Throws a BufferException if the parent is NULL.

```cpp
BufferView::BufferView(AbstractByteBuffer *v_parent, offset_t v_offset, bufsize_t v_size)
 : parent(v_parent), offset(v_offset), size(v_size)
{
	if (v_parent == NULL) throw BufferException("Cannot make subBuffer for NULL buffer!");
}
```

--------------------------------

### getContentAtPtr

Source: https://hasherezade.github.io/bearparser/class_abstract_byte_buffer.html

Get a pointer to content at a given pointer and size.

```APIDOC
## getContentAtPtr

### Description
Get a pointer to content at a given pointer and size.

### Method
Virtual

### Signature
virtual BYTE* getContentAtPtr(BYTE* ptr, bufsize_t size, bool allowExceptions = false)

### Parameters
- **ptr** (BYTE*) - Pointer to get content from.
- **size** (bufsize_t) - Size of the content to get.
- **allowExceptions** (bool) - Optional. Whether to allow exceptions.

### Returns
- **BYTE*** - Pointer to the content at the given pointer.

```

--------------------------------

### getSecurityDir

Source: https://hasherezade.github.io/bearparser/_p_e_file_8h_source.html

Returns a wrapper for the security directory.

```cpp
SecurityDirWrapper* getSecurityDir()
{
return dynamic_cast<SecurityDirWrapper*>(getWrapper(PEFile::WR_DIR_ENTRY + pe::DIR_SECURITY));
}
```

--------------------------------

### getContentAt

Source: https://hasherezade.github.io/bearparser/class_abstract_byte_buffer.html

Get a pointer to content at a given offset and size.

```APIDOC
## getContentAt

### Description
Get a pointer to content at a given offset and size.

### Method
Virtual

### Signature
virtual BYTE* getContentAt(offset_t offset, bufsize_t size, bool allowExceptions = false)

### Parameters
- **offset** (offset_t) - Offset to get content from.
- **size** (bufsize_t) - Size of the content to get.
- **allowExceptions** (bool) - Optional. Whether to allow exceptions.

### Returns
- **BYTE*** - Pointer to the content at the given offset.

```

--------------------------------

### ExeFactory::build() implementation

Source: https://hasherezade.github.io/bearparser/_exe_factory_8cpp_source.html

Builds an executable of the given type using the corresponding builder, or returns NULL if the type is not supported or builder is null. Initializes builders if needed.

```cpp
Executable* ExeFactory::build(AbstractByteBuffer *buf, exe_type type)
{
 ExeFactory::init(); //ensue that the builders are initialized

 if (builders.find(type) == builders.end()) {
 return NULL;
 }
 ExeBuilder* builder = builders[type];
 if (!builder) return NULL;

 return builder->build(buf);
}
```

--------------------------------

### getLoadConfigDir

Source: https://hasherezade.github.io/bearparser/_p_e_file_8h_source.html

Returns a wrapper for the load configuration directory.

```cpp
LdConfigDirWrapper* getLoadConfigDir()
{
return dynamic_cast<LdConfigDirWrapper*>(getWrapper(PEFile::WR_DIR_ENTRY + pe::DIR_LOAD_CONFIG));
}
```

--------------------------------

### getWAsciiStringValue

Source: https://hasherezade.github.io/bearparser/class_abstract_byte_buffer.html

Get a wide ASCII string value from a given offset.

```APIDOC
## getWAsciiStringValue

### Description
Get a wide ASCII string value from a given offset.

### Method
Non-virtual

### Signature
QString getWAsciiStringValue(offset_t rawOffset, bufsize_t len, bool acceptNonTerminated = false)

### Parameters
- **rawOffset** (offset_t) - Offset to get the string from.
- **len** (bufsize_t) - Length of the string.
- **acceptNonTerminated** (bool) - Optional. Whether to accept non-terminated strings.

### Returns
- **QString** - The wide ASCII string value.

```

--------------------------------

### SecurityDirWrapper::getCert() implementation

Source: https://hasherezade.github.io/bearparser/_security_dir_wrapper_8cpp_source.html

Retrieves the WIN_CERTIFICATE structure from the PE file at the directory entry address. Returns NULL if the content is unavailable.

```cpp
pe::WIN_CERTIFICATE* SecurityDirWrapper::getCert()
{
 offset_t rva = getDirEntryAddress();

 BYTE *ptr = m_Exe->getContentAt(rva, Executable::RAW, sizeof(pe::WIN_CERTIFICATE));
 if (ptr == NULL) return NULL;

 return (pe::WIN_CERTIFICATE*) ptr;
}
```

--------------------------------

### getContent()

Source: https://hasherezade.github.io/bearparser/class_abstract_byte_buffer.html

Pure virtual method to get a pointer to the buffer content.

```APIDOC
## getContent()

### Description
Pure virtual method to get a pointer to the buffer content.

### Method
Pure virtual

### Signature
virtual BYTE* getContent() = 0

### Returns
- **BYTE*** - Pointer to the buffer content.

```

--------------------------------

### getContentSize()

Source: https://hasherezade.github.io/bearparser/class_abstract_byte_buffer.html

Pure virtual method to get the size of the buffer content.

```APIDOC
## getContentSize()

### Description
Pure virtual method to get the size of the buffer content.

### Method
Pure virtual

### Signature
virtual bufsize_t getContentSize() = 0

### Returns
- **bufsize_t** - The size of the buffer content.

```

--------------------------------

### AbstractFileBuffer::getReadableSize

Source: https://hasherezade.github.io/bearparser/_file_buffer_8h_source.html

Static method to get the readable size of a file.

```APIDOC
## AbstractFileBuffer::getReadableSize

### Description
Static method to get the readable size of a file.

### Method
static bufsize_t getReadableSize(QFile &fIn)

### Parameters
- **fIn** (QFile&) - Required - The file to get the size from.

### Returns
- **bufsize_t** - The readable size.

### Definition
FileBuffer.cpp:95
```

--------------------------------

### ResourceStringsWrapper::wrap

Source: https://hasherezade.github.io/bearparser/_resource_strings_wrapper_8cpp_source.html

Parses the resource strings from the executable and populates the entries list.

```cpp
bool ResourceStringsWrapper::wrap()
{
 clear();
 this->parsedSize = 0;

 BYTE *c = static_cast<BYTE*>(this->getPtr());
 if (!c) {
 return false;
 }
 size_t maxSize = this->getSize();
 //printf("maxSize = %x\n", maxSize);
 offset_t startRaw = getContentRaw();
 offset_t cRaw = startRaw;

 while (parsedSize < maxSize) {

 WORD* stringSize = (WORD*) this->getContentAt(cRaw, Executable::RAW, sizeof(WORD));
 if (stringSize == NULL){
 printf("Cannot fetch the string size!\n");
 break;
 }
 this->parsedSize += sizeof(WORD);
 cRaw += sizeof(WORD);

 size_t wStrSize = (*stringSize);
 if (wStrSize == 0) {
 continue;
 }
 bufsize_t totalStrSize = wStrSize * sizeof(WORD);

 WORD* uStringPtr = (WORD*) this->getContentAt(cRaw, Executable::RAW, totalStrSize);
 if (uStringPtr == NULL) break;

 Executable *exe = this->myLeaf->getExe();
 ResString *rStr = new ResString(uStringPtr, stringSize, cRaw, exe);
 this->entries.push_back(rStr);

 this->parsedSize += totalStrSize;
 cRaw += totalStrSize;
 }
 return true;
}
```

--------------------------------

### Util.h Header File with Utility Macros and Function Declarations

Source: https://hasherezade.github.io/bearparser/_util_8h_source.html

This is the complete Util.h header file. It defines macros for buffer size (DEFAULT_BUFSIZE), character classification (IS_PRINTABLE, IS_ENDLINE), debug level (DBG_LVL), and logging (TRACE, LOG). It declares the Logger namespace with an enum for debug levels and the pe_util namespace with various utility function declarations and inline implementations for unitsCount and roundup.

```cpp
#pragma once

#include <iostream>
#include <string.h>
#include <stdlib.h>
#include <stdio.h>
#include <QtCore>
#include "win_hdrs/win_types.h"

#define DEFAULT_BUFSIZE 0xFF
#define IS_PRINTABLE(c) (c >= 0x20 && c < 0x7f)
#define IS_ENDLINE(c) (c == 0x0A || c == 0xD)

//----
#ifdef _DEBUG
#define DBG_LVL 2
#else
#define DBG_LVL 0
#endif

#define TRACE() if (DBG_LVL) printf(">%s line: %d [%s]\n", __FUNCTION__, __LINE__, __FILE__);
#define LOG(msg) if (DBG_LVL) printf("%s: %s\n", __FUNCTION__,msg);

namespace Logger {
 enum dbg_level{
 D_ERROR = 0, D_WARNING, D_INFO, D_LVL_COUNT
 };
 bool append(dbg_level lvl, const char* format, ...);
};
//----
namespace pe_util {
 inline bool isPrintable(char c) { return IS_PRINTABLE(c); }

 bool isStrLonger(const char *inp, size_t maxLen);
 //QString getString(const char *ptr, size_t maxInp, size_t maxBuf = DEFAULT_BUFSIZE);
 bool hasNonPrintable(const char *ptr, size_t maxInp);
 size_t getAsciiLen(const char *ptr, size_t maxCount, bool acceptNotTerminated = false);
 size_t getAsciiLenW(const WORD *ptr, size_t maxCount, bool acceptNotTerminated = false);

 size_t noWhiteCount(char *buf, size_t bufSize);
 size_t noWhiteCount(std::string);
 bool validateFuncName(const char* fPtr, size_t bufSize);
 size_t forwarderNameLen(const char *ptr, size_t max_len);

 void hexdump(BYTE *buf, size_t bufSize, size_t pad);

 inline size_t unitsCount(uint64_t value, uint64_t unit, bool roundup = true)
 {
 if (unit == 0) return 0;
 size_t units = value / unit;
 if (roundup) {
 if (value % unit) units++;
 }
 return units;
 }

 inline uint64_t roundup(uint64_t value, uint64_t unit)
 {
 const size_t units = unitsCount(value, unit);
 return units * unit;
 }

 bool isSpaceClear(void* ptr, uint64_t size);
 bool isHexChar(char c);

 bool endsWith(std::string string, std::string endStr);
};

```

--------------------------------

### FileBuffer::getFileSize

Source: https://hasherezade.github.io/bearparser/_file_buffer_8h_source.html

Instance method to get the real size of the file.

```APIDOC
## FileBuffer::getFileSize

### Description
Returns the real size of the file as an offset_t.

### Method
Instance method

### Signature
offset_t getFileSize()

### Returns
- **offset_t** - The file size.
```

--------------------------------

### FileView Constructor and Destructor

Source: https://hasherezade.github.io/bearparser/_file_buffer_8cpp_source.html

Initializes a file view by mapping a file into memory using Qt's QFile and cleans up resources upon destruction.

```cpp
1#include "FileBuffer.h"
2
3
4FileView::FileView(QString &path, bufsize_t maxSize)
5 : AbstractFileBuffer(path), fIn (path)
6{
7 if (fIn.open(QIODevice::ReadOnly) == false) {
8 throw FileBufferException("Cannot open the file: " + path);
9 }
10 this->fileSize = fIn.size();
11 if (fileSize == 0) {
12 std::cerr << fIn.errorString().toStdString() << std::endl;
13 throw FileBufferException("The file is empty");
14 }
15 bufsize_t readableSize = getMappableSize(fIn);
16 this->mappedSize = (readableSize > maxSize) ? maxSize : readableSize;
17
18 uchar *pData = fIn.map(0, this->mappedSize);
19 if (!pData) {
20 throw BufferException("Cannot map the file: " + path + " of size: 0x" + QString::number(this->mappedSize, 16));
21 }
22 this->mappedContent = (BYTE*) pData;
23}
4FileView::FileView(QString &path, bufsize_t maxSize) {…}
24
25FileView::~FileView()
26{
27 fIn.unmap((uchar*)this->mappedContent);
28 fIn.close();
29}
25FileView::~FileView() {…}
```

--------------------------------

### FileBuffer::getContent

Source: https://hasherezade.github.io/bearparser/_file_buffer_8h_source.html

Instance method to get a pointer to the buffer content.

```APIDOC
## FileBuffer::getContent

### Description
Returns a pointer to the buffer content, or NULL if the buffer is null.

### Method
Instance method

### Signature
virtual BYTE* getContent()

### Returns
- **BYTE*** - Pointer to the buffer content.
```

--------------------------------

### DataDirEntryWrapper Constructor

Source: https://hasherezade.github.io/bearparser/_data_dir_entry_wrapper_8cpp_source.html

Initializes a new instance of the DataDirEntryWrapper with a pointer to the PE file and the specific directory entry type.

```cpp
DataDirEntryWrapper::DataDirEntryWrapper(PEFile* pe, pe:: dir_entry v_entryType)
 : PENodeWrapper(pe), entryType(v_entryType)
{
 wrap();
}
```

--------------------------------

### FileBuffer::getContentSize

Source: https://hasherezade.github.io/bearparser/_file_buffer_8h_source.html

Instance method to get the size of the buffer content.

```APIDOC
## FileBuffer::getContentSize

### Description
Returns the size of the buffer content, or 0 if the buffer is null.

### Method
Instance method

### Signature
virtual bufsize_t getContentSize()

### Returns
- **bufsize_t** - The size of the buffer content.
```

--------------------------------

### FileView::getContent

Source: https://hasherezade.github.io/bearparser/_file_buffer_8h_source.html

Instance method to get a pointer to the mapped content.

```APIDOC
## FileView::getContent

### Description
Returns a pointer to the mapped content.

### Method
Instance method

### Signature
virtual BYTE* getContent()

### Returns
- **BYTE*** - Pointer to the mapped content.
```

--------------------------------

### ExeFactory.cpp: Includes and static builder map

Source: https://hasherezade.github.io/bearparser/_exe_factory_8cpp_source.html

Includes the ExeFactory header and the DOSExe and PEFile headers, and declares the static map of executable type builders.

```cpp
#include "ExeFactory.h"

#include "pe/DOSExe.h"
#include "pe/PEFile.h"

std::map<ExeFactory::exe_type, ExeBuilder*> ExeFactory::builders;
```

--------------------------------

### FileView::getContentSize

Source: https://hasherezade.github.io/bearparser/_file_buffer_8h_source.html

Instance method to get the size of the mapped content.

```APIDOC
## FileView::getContentSize

### Description
Returns the size of the mapped content.

### Method
Instance method

### Signature
virtual bufsize_t getContentSize()

### Returns
- **bufsize_t** - The size of the mapped content.
```

--------------------------------

### ImportBaseDirWrapper Mapping Method

Source: https://hasherezade.github.io/bearparser/_import_base_dir_wrapper_8h_source.html

Method to add a mapping for an ExeNodeWrapper within the ImportBaseDirWrapper.

```cpp
void addMapping(ExeNodeWrapper *func) { if (impDir) impDir->addMapping(func); }
```

--------------------------------

### ExeElementWrapper constructor with null check

Source: https://hasherezade.github.io/bearparser/_exe_element_wrapper_8cpp_source.html

Initializes an ExeElementWrapper with an Executable pointer. Throws a CustomException and logs an error if the pointer is NULL.

```cpp
ExeElementWrapper::ExeElementWrapper(Executable *v_exe)
 : m_Exe(v_exe)
{
 if (v_exe == NULL) {
 Logger::append(Logger::D_ERROR, "Cannot initialize with Exe == NULL!");
 throw CustomException("Cannot initialize with Exe == NULL!");
 }
}
```

--------------------------------

### AbstractFileBuffer::getFileName

Source: https://hasherezade.github.io/bearparser/_file_buffer_8h_source.html

Instance method to get the file name associated with the buffer.

```APIDOC
## AbstractFileBuffer::getFileName

### Description
Returns the file name of the file associated with this buffer.

### Method
Instance method

### Signature
QString getFileName()

### Returns
- **QString** - The file name.
```

--------------------------------

### getAllEntryPoints

Source: https://hasherezade.github.io/bearparser/_p_e_file_8h_source.html

Retrieves all entry points of the application, including main EP, exports, and TLS callbacks.

```cpp
virtual size_t getAllEntryPoints(QMap<offset_t,QString> &entrypoints, Executable::addr_type aType = Executable::RVA) 
{
size_t initialSize = entrypoints.size();

Executable::getAllEntryPoints(entrypoints, aType);
this->getExportsMap(entrypoints, aType);

return entrypoints.size() - initialSize;
}
```

--------------------------------

### ImportEntryWrapper::getSize() - Get import descriptor size

Source: https://hasherezade.github.io/bearparser/_import_dir_wrapper_8cpp_source.html

Returns the size of the IMAGE_IMPORT_DESCRIPTOR structure.

```cpp
bufsize_t ImportEntryWrapper::getSize()
{
 return sizeof(IMAGE_IMPORT_DESCRIPTOR);
}
```

--------------------------------

### AbstractByteBuffer::getMaxSizeFromOffset

Source: https://hasherezade.github.io/bearparser/_abstract_byte_buffer_8cpp_source.html

Calculates the maximum available size from a given start offset within the buffer.

```cpp
bufsize_t AbstractByteBuffer::getMaxSizeFromOffset(offset_t startOffset)
{
 if (startOffset == INVALID_ADDR) return 0;

 offset_t contentSize = getContentSize();
 if (contentSize < startOffset) return 0;

 bufsize_t limit = static_cast<bufsize_t>(contentSize - startOffset);
 return limit;
}
```

--------------------------------

### DOSExeBuilder::build - Build DOSExe from buffer

Source: https://hasherezade.github.io/bearparser/_d_o_s_exe_8cpp_source.html

Builds a DOSExe object from the buffer if the signature matches. Returns NULL if signature does not match or if construction throws ExeException.

```cpp
Executable* DOSExeBuilder::build(AbstractByteBuffer *buf)
{
 Executable *exe = NULL;
 if (signatureMatches(buf) == false) return NULL;

 try {
 exe = new DOSExe(buf);
 } catch (ExeException) {
 //
 }

 return exe;
}
```

--------------------------------

### Include statements for DelayImpDirWrapper.cpp

Source: https://hasherezade.github.io/bearparser/_delay_imp_dir_wrapper_8cpp_source.html

The file includes its corresponding header and the PEFile.h header.

```cpp
#include "pe/DelayImpDirWrapper.h"
#include "pe/PEFile.h"
```

--------------------------------

### Get Content Declared Offset

Source: https://hasherezade.github.io/bearparser/_sect_hdrs_wrapper_8cpp_source.html

Retrieves the offset declared in the header for a specific address type.

```cpp
193offset_t SectionHdrWrapper::getContentDeclaredOffset(Executable::addr_type aType)
194{
195 if (this->header == NULL) return INVALID_ADDR;
196 offset_t offset = INVALID_ADDR;
197
198 if (aType == Executable::RAW) {
199 offset = static_cast<offset_t>(this->header->PointerToRawData);//(this->getNumValue(RPTR, &isOk));
200 } else if (aType == Executable::VA || aType == Executable::RVA) {
201 offset = static_cast<offset_t>(this->header->VirtualAddress);//this->getNumValue(VPTR, &isOk));
202 }
203 return offset;
204}
```

--------------------------------

### ImportedFuncWrapper::getSize() - Get import size

Source: https://hasherezade.github.io/bearparser/_import_dir_wrapper_8cpp_source.html

Returns the size of the import entry by delegating to getAddrSize().

```cpp
bufsize_t ImportedFuncWrapper::getSize()
{
 return getAddrSize();
}
```

--------------------------------

### Get Content Offset

Source: https://hasherezade.github.io/bearparser/_sect_hdrs_wrapper_8cpp_source.html

Calculates the content offset, optionally applying alignment if the mapped flag is set.

```cpp
206offset_t SectionHdrWrapper::getContentOffset(Executable::addr_type aType, bool useMapped)
207{
208 offset_t offset = getContentDeclaredOffset(aType);
209 if (!useMapped) {
210 return offset; //returning as is
211 }
212 if (aType == Executable::RAW) {
213 bufsize_t align = m_PE->getAlignment(Executable::RAW);
214 const size_t units = pe_util::unitsCount(offset, align, false);
215 const offset_t rounded = units * align; //round down to section alignment
216 if (rounded != 0) {
217 offset = rounded;
218 }
219 const size_t peSize = m_PE->getMappedSize(aType);
220 if (offset > peSize) {
221 offset = INVALID_ADDR;
222 }
223 }
224 return offset;
225}
```

--------------------------------

### DOSExe::wrap - Wrap DOS header

Source: https://hasherezade.github.io/bearparser/_d_o_s_exe_8cpp_source.html

Creates DosHdrWrapper, retrieves IMAGE_DOS_HEADER, validates magic, and stores wrapper. Throws ExeException on failure.

```cpp
void DOSExe::wrap()
{
 this->dosHdrWrapper = new DosHdrWrapper(this);

 m_dosHdr = (IMAGE_DOS_HEADER*) getContentAt(0, sizeof(IMAGE_DOS_HEADER));
 if (m_dosHdr == NULL) throw ExeException("Could not Wrap!");

 WORD* magic = (WORD*) this->dosHdrWrapper->getFieldPtr(DosHdrWrapper::MAGIC);

 if (this->dosHdrWrapper->getPtr() == NULL || magic == NULL) {
 throw ExeException("Could not Wrap!");
 }

 if ((*magic) != pe::S_DOS && (*magic) != pe::S_DOS2) {
 Logger::append(Logger::D_WARNING, "It is not a DOS file!\n");
 throw ExeException("It is not a DOS file!");
 }
 this->wrappers[WR_DOS_HDR] = this->dosHdrWrapper;
}
```

--------------------------------

### AbstractByteBuffer::getOffset

Source: https://hasherezade.github.io/bearparser/_abstract_byte_buffer_8cpp_source.html

Calculates the offset of a pointer relative to the buffer start, optionally throwing exceptions for invalid pointers.

```cpp
offset_t AbstractByteBuffer::getOffset(void *ptr, bool allowExceptions)
{
 if (ptr == NULL) return INVALID_ADDR;
 BYTE* buf = this->getContent();
 bufsize_t bufSize = this->getContentSize();

 if (buf == NULL || bufSize == 0) {
 if (allowExceptions) throw BufferException("Buffer if empty!");
 return INVALID_ADDR;
 }
 if (ptr < buf) {
 if (allowExceptions) throw BufferException("Pointer before buffer begining!");
 return INVALID_ADDR;
 }
 offset_t offset = static_cast<BYTE*>(ptr) - buf;
 if (offset >= bufSize) {
 if (allowExceptions) throw BufferException("Pointer does not belong to buffer!");
 return INVALID_ADDR;
 }
 return offset;
}
```

--------------------------------

### getExceptionsDir

Source: https://hasherezade.github.io/bearparser/_p_e_file_8h_source.html

Returns a wrapper for the exception directory.

```cpp
ExceptionDirWrapper* getExceptionsDir()
{
return dynamic_cast<ExceptionDirWrapper*>(getWrapper(PEFile::WR_DIR_ENTRY + pe::DIR_EXCEPTION));
}
```

--------------------------------

### LdConfigDirWrapper class implementation

Source: https://hasherezade.github.io/bearparser/_ld_config_dir_wrapper_8cpp_source.html

This snippet contains the full implementation of the LdConfigDirWrapper class methods, including getLdConfigDirSize, getHdrDefinedSize, getLdConfigDirPtr, wrapSubentriesTable, wrap, getPtr, and clear. It handles both 32-bit and 64-bit PE formats and uses the getStructFieldOffset macro to calculate field offsets.

```cpp
#include "pe/LdConfigDirWrapper.h"

// offset from the beginning of the structure
#define getStructFieldOffset(STRUCT, FIELD) ((ULONGLONG) &(STRUCT.FIELD) - (ULONGLONG)&STRUCT)

bufsize_t LdConfigDirWrapper::getLdConfigDirSize()
{
 bufsize_t dirSize = 0;

 if (m_Exe->getBitMode() == Executable::BITS_32) {
 dirSize = sizeof(pe::IMAGE_LOAD_CONFIG_DIRECTORY32);
 } else if (m_Exe->getBitMode() == Executable::BITS_64) {
 dirSize = sizeof(pe::IMAGE_LOAD_CONFIG_DIRECTORY64);
 }
 return dirSize;
}

bufsize_t LdConfigDirWrapper::getHdrDefinedSize()
{
 const offset_t rva = getDirEntryAddress();
 offset_t raw = INVALID_ADDR;
 try {
 raw = m_Exe->rvaToRaw(rva);
 } catch (CustomException) {
 raw = INVALID_ADDR;
 }
 if (raw == INVALID_ADDR) return 0;

 offset_t offset = INVALID_ADDR;

 if (m_Exe->getBitMode() == Executable::BITS_32) {
 pe::IMAGE_LOAD_CONFIG_DIRECTORY32 ld = { 0 };
 offset = getStructFieldOffset(ld, Size);

 } else if (m_Exe->getBitMode() == Executable::BITS_64) {
 pe::IMAGE_LOAD_CONFIG_DIRECTORY64 ld = { 0 };
 offset = getStructFieldOffset(ld, Size);
 }
 DWORD* sizePtr = (DWORD*) m_Exe->getContentAt((raw + offset), sizeof(DWORD));
 if (!sizePtr) return 0;
 return bufsize_t(*sizePtr);
}

void* LdConfigDirWrapper::getLdConfigDirPtr()
{
 offset_t rva = getDirEntryAddress();
 BYTE *ptr = m_Exe->getContentAt(rva, Executable::RVA, this->getSize());
 return ptr;
}

bool LdConfigDirWrapper::wrapSubentriesTable(size_t parentFieldId, size_t counterFieldId)
{
 bool isOk = false;
 size_t count = this->getNumValue(counterFieldId, &isOk);
 if (!isOk) {
 return false;
 }
 for (size_t i = 0 ; i < count; i++) {
 LdConfigEntryWrapper *entry = new LdConfigEntryWrapper(m_Exe, this, i, parentFieldId);
 if (!entry || !entry->getPtr()) {
 delete entry;
 break;
 }
 this->entries.push_back(entry);
 this->subEntriesMap[parentFieldId].push_back(entry);
 }
 return isOk;
}

bool LdConfigDirWrapper::wrap()
{
 clear();
 if (!getPtr()) return false;
 //SEHandlerTable:
 wrapSubentriesTable(SEH_TABLE, SEH_COUNT);

 //GuardCFFunctionTable:
 wrapSubentriesTable(GUARD_TABLE, GUARD_COUNT);

 wrapSubentriesTable(GUARD_LONG_JUMP_TABLE, GUARD_LONG_JUMP_COUNT);
 wrapSubentriesTable(GUARD_ADDR_IAT_ENTRY_TABLE, GUARD_ADDR_IAT_ENTRY_COUNT);

 wrapSubentriesTable(GUARD_EH_CONT_TABLE, GUARD_EH_CONT_COUNT);
 return true;
}

void* LdConfigDirWrapper::getPtr()
{
 return getLdConfigDirPtr();
}

void LdConfigDirWrapper::clear()
{
 std::map<uint32_t, std::vector<ExeNodeWrapper*> >::iterator mapItr;
}
```

--------------------------------

### DelayImpEntryWrapper::getSize - Get entry size

Source: https://hasherezade.github.io/bearparser/_delay_imp_dir_wrapper_8cpp_source.html

Returns the size of the IMAGE_DELAY_LOAD structure if the pointer is valid, otherwise 0.

```cpp
bufsize_t DelayImpEntryWrapper::getSize()
{
if (getPtr() == NULL) return 0;
return sizeof(pe::IMAGE_DELAY_LOAD);
}

```

--------------------------------

### LdConfigEntryWrapper constructor

Source: https://hasherezade.github.io/bearparser/_ld_config_dir_wrapper_8h_source.html

Initializes a new instance of the LdConfigEntryWrapper.

```cpp
LdConfigEntryWrapper(Executable* pe, LdConfigDirWrapper *_parentDir, size_t entryNumber, size_t _parentFieldId)
: ExeNodeWrapper(pe, _parentDir, entryNumber), 
parentFieldId(_parentFieldId)
{
this->parentDir = _parentDir;
}
```

--------------------------------

### Get Field Pointer

Source: https://hasherezade.github.io/bearparser/_sect_hdrs_wrapper_8cpp_source.html

Returns a pointer to a specific field within the section header based on the provided field ID.

```cpp
131void* SectionHdrWrapper::getFieldPtr(size_t fieldId, size_t subField)
132{
133 IMAGE_SECTION_HEADER* sec = (IMAGE_SECTION_HEADER*) getPtr();
134 if (!sec) return NULL;
135 if (!this->name) return NULL;
136 switch (fieldId)
137 {
138 case NAME: return (void*) &sec->Name;
139 case VSIZE: return (void*) &sec->Misc.VirtualSize;
140 case VPTR: return (void*) &sec->VirtualAddress;
141 case RSIZE: return (void*) &sec->SizeOfRawData;
142 case RPTR: return(void*) &sec->PointerToRawData;
143
144 case RELOC_PTR: return (void*) &sec->PointerToRelocations;
145 case RELOC_NUM: return (void*) &sec->NumberOfRelocations;
146 case LINENUM_PTR: return (void*) &sec->PointerToLinenumbers;
147 case LINENUM_NUM: return (void*) &sec->NumberOfLinenumbers;
148
149 case CHARACT: return (void*) &sec->Characteristics;
150 }
151 return this->getPtr();
152}
```

--------------------------------

### DelayImpEntryWrapper::getName - Get entry name

Source: https://hasherezade.github.io/bearparser/_delay_imp_dir_wrapper_8cpp_source.html

Returns the library name as a QString, or an empty string if the library name is not available.

```cpp
QString DelayImpEntryWrapper::getName()
{
char* name = getLibraryName();
if (!name) return "";
return QString(name);
}

```

--------------------------------

### DebugDirWrapper::loadNextEntry Method Implementation

Source: https://hasherezade.github.io/bearparser/_debug_dir_wrapper_8cpp_source.html

Loads the next debug directory entry by index, creating a DebugDirEntryWrapper. Returns false if the index is out of bounds or if the wrapper cannot be created. Includes the header include and using namespace directive from the source.

```C++
#include "pe/DebugDirWrapper.h"
#include <QtGlobal>

using namespace pe;
/*
typedef struct _IMAGE_DEBUG_DIRECTORY {
 DWORD Characteristics;
 DWORD TimeDateStamp;
 WORD MajorVersion;
 WORD MinorVersion;
 DWORD Type;
 DWORD SizeOfData;
 DWORD AddressOfRawData;
 DWORD PointerToRawData;
} IMAGE_DEBUG_DIRECTORY, *PIMAGE_DEBUG_DIRECTORY;

*/

bool DebugDirWrapper::loadNextEntry(size_t cntr)
{
 const size_t dirSize = this->getSize();
 const size_t entriesCount = dirSize / sizeof(IMAGE_DEBUG_DIRECTORY);
 if (cntr >= entriesCount) {
 return false;
 }

 DebugDirEntryWrapper* dbgEntry = new DebugDirEntryWrapper(m_PE, this, cntr);
 if (!dbgEntry || !dbgEntry->getPtr()) {
 delete dbgEntry;
 return false;
 }
 entries.push_back(dbgEntry);
 return true;
}
```

--------------------------------

### PEFile::initDirEntries

Source: https://hasherezade.github.io/bearparser/_p_e_file_8cpp_source.html

Initializes the dataDirEntries array to NULL for all directory entries.

```cpp
void PEFile::initDirEntries()
{
for (size_t i = 0 ; i < pe::DIR_ENTRIES_COUNT; i++) {
dataDirEntries[i] = NULL;
}
}
```
Tokens:
Raw