From 3011e80397eab676673f6fcfa3970d6d412cd6e1 Mon Sep 17 00:00:00 2001 From: hasherezade Date: Tue, 21 Feb 2023 22:26:36 +0100 Subject: [PATCH] [REFACT] Moved exporting disasm to PeHandler (Issue #19) --- pe-bear/PEDockedWidget.cpp | 50 ++------------------------------ pe-bear/base/PeHandler.cpp | 59 ++++++++++++++++++++++++++++++++++++++ pe-bear/base/PeHandler.h | 3 ++ 3 files changed, 64 insertions(+), 48 deletions(-) diff --git a/pe-bear/PEDockedWidget.cpp b/pe-bear/PEDockedWidget.cpp index db2575d..8e03ebb 100644 --- a/pe-bear/PEDockedWidget.cpp +++ b/pe-bear/PEDockedWidget.cpp @@ -341,10 +341,7 @@ void SectionMenu::dumpSelectedSection() void SectionMenu::exportSectionDisasm() { - if (!peHndl) return; - PEFile *pe = peHndl->getPe(); - if (!pe) return; - if (!selectedSection) return; + if (!peHndl || !selectedSection) return; QString outDir = mainSettings.dirDump; if (outDir == "") outDir = peHndl->getDirPath(); @@ -356,53 +353,10 @@ void SectionMenu::exportSectionDisasm() const offset_t startOff = selectedSection->getContentOffset(Executable::RAW, true); const size_t previewSize = selectedSection->getContentSize(Executable::RAW, true); - pe_bear::PeDisasm myDisasm(pe, previewSize); - myDisasm.init(startOff, pe->getBitMode()); - myDisasm.fillTable(); - - QFile fOut(path); - if (fOut.open(QFile::WriteOnly | QFile::Text) == false) { + if (!peHndl->exportDisasm(path, startOff, previewSize)) { QMessageBox::warning(this, "Error", "Dumping section failed!"); return; } - QTextStream disasmStream(&fOut); - for (int index = 0; index < myDisasm.chunksCount(); ++index ) { - QString str = myDisasm.mnemStr(index); - if (myDisasm.isBranching(index)) { - str = myDisasm.translateBranching(index); - } - - //resolve target functions: - bool isOk = false; - const offset_t tRva = myDisasm.getTargetRVA(index, isOk); - QString funcName = ""; - QString refStr = ""; - if (isOk) { - funcName = peHndl->importDirWrapper.thunkToFuncName(tRva, false); - if (funcName.length() == 0 ) { - funcName = peHndl->delayImpDirWrapper.thunkToFuncName(tRva, false); - } - refStr = myDisasm.getStringAt(tRva); - } - - offset_t VA = pe->rvaToVa(myDisasm.getRvaAt(index)); - QString vaStr = QString::number(VA, 16); - - // stream to the file: - disasmStream << vaStr << " : " << str; - if (funcName.length()) { - disasmStream << " : " << funcName; - } - else if (refStr.length()) { - disasmStream << " : " << refStr; - } - disasmStream << "\n"; - if (myDisasm.isBranching(index)) { - disasmStream << "\n"; // add a separator line - } - } - fOut.close(); - QMessageBox::information(this, "Done!", "Dumped section disasembly: "+ selectedSection->mappedName +"\ninto: " + path); return; } diff --git a/pe-bear/base/PeHandler.cpp b/pe-bear/base/PeHandler.cpp index 3002bca..2713bee 100644 --- a/pe-bear/base/PeHandler.cpp +++ b/pe-bear/base/PeHandler.cpp @@ -3,6 +3,7 @@ #include "../base/PeHandlersManager.h" #include +#include "../disasm/PeDisasm.h" using namespace sig_ma; using namespace pe; @@ -1194,3 +1195,61 @@ bool PeHandler::markedBranching(offset_t cRva, offset_t tRva) emit marked(); return true; } + +bool PeHandler::exportDisasm(const QString &path, const offset_t startOff, const size_t previewSize) +{ + PEFile *pe = this->getPe(); + if (!pe) return false; + + if (!pe->getContentAt(startOff, previewSize)) { + return false; + } + + QFile fOut(path); + if (fOut.open(QFile::WriteOnly | QFile::Text) == false) { + return false; + } + + pe_bear::PeDisasm myDisasm(pe, previewSize); + myDisasm.init(startOff, pe->getBitMode()); + myDisasm.fillTable(); + + QTextStream disasmStream(&fOut); + for (int index = 0; index < myDisasm.chunksCount(); ++index ) { + QString str = myDisasm.mnemStr(index); + if (myDisasm.isBranching(index)) { + str = myDisasm.translateBranching(index); + } + + //resolve target functions: + bool isOk = false; + const offset_t tRva = myDisasm.getTargetRVA(index, isOk); + QString funcName = ""; + QString refStr = ""; + if (isOk) { + funcName = importDirWrapper.thunkToFuncName(tRva, false); + if (funcName.length() == 0 ) { + funcName = delayImpDirWrapper.thunkToFuncName(tRva, false); + } + refStr = myDisasm.getStringAt(tRva); + } + + offset_t VA = pe->rvaToVa(myDisasm.getRvaAt(index)); + QString vaStr = QString::number(VA, 16); + + // stream to the file: + disasmStream << vaStr << " : " << str; + if (funcName.length()) { + disasmStream << " : " << funcName; + } + else if (refStr.length()) { + disasmStream << " : " << refStr; + } + disasmStream << "\n"; + if (myDisasm.isBranching(index)) { + disasmStream << "\n"; // add a separator line + } + } + fOut.close(); + return true; +} \ No newline at end of file diff --git a/pe-bear/base/PeHandler.h b/pe-bear/base/PeHandler.h index ad6fa8d..4d2f3ff 100644 --- a/pe-bear/base/PeHandler.h +++ b/pe-bear/base/PeHandler.h @@ -188,6 +188,8 @@ class PeHandler : public QObject, public Releasable bool setDisplayedEP(); void undoDisplayOffset(); + bool exportDisasm(const QString &path, const offset_t startOff, const size_t previewSize); + /* File name wrappers */ QString getFullName() { return this->m_fileBuffer->getFileName(); } @@ -204,6 +206,7 @@ class PeHandler : public QObject, public Releasable QFileInfo fileInfo(path); return fileInfo.absoluteDir().absolutePath(); } + //-------- /* wrappers for PE structures */ DosHdrWrapper dosHdrWrapper;