#include "Common.h" #include "Events.h" #include "Parsing.h" #include "ParsingError.h" #if 0 sc::result ParseSectionHeaders::react( const EvNewData & ev ) { (void) ev; DEBUG_MSG(NOTIFY, "new data to offset: %d", availableOffset()); DEBUG_MSG(NOTIFY, "current offset : %d", currentOffset()); std::size_t numberOfSections = context().numberOfSections(); if (current_ > numberOfSections + 1) { // we already processed all sections, send padding if (availableOffset() > firstSectionDataOffset_) { context().complete( firstSectionDataOffset_ - currentOffset() ); return transit(); } else { context().complete( availableOffset() - currentOffset() ); return discard_event(); } } if (currentOffset() + sizeof(IMAGE_SECTION_HEADER) < availableOffset()) { DEBUG_MSG(NOTIFY, "header %d", current_); if (current_ < numberOfSections ) { // original PE sections PIMAGE_SECTION_HEADER header = (PIMAGE_SECTION_HEADER) context().buffer()->data(); DEBUG_MSG(NOTIFY, "Section %s", string((PCHAR)header->Name)); if (header->PointerToRawData < firstSectionDataOffset_) firstSectionDataOffset_ = header->PointerToRawData; context().addSection(header); } else { // added sections if (current_ == (numberOfSections)) { // dropper DEBUG_MSG(NOTIFY, "Dropper section header."); } else if (current_ == (numberOfSections + 1)) { // rebuilt resources DEBUG_MSG(NOTIFY, "Rebuilt resources section header."); } else { // unknown ... we have a problem throw parsing_error("Unknown non-original section found."); } } context().complete( sizeof(IMAGE_SECTION_HEADER) ); current_++; } DEBUG_MSG(NOTIFY, "number of sections: %d", context().numberOfSections()); DEBUG_MSG(NOTIFY, "file alignment : %d", context().fileAlignment()); // context().complete( availableOffset() - currentOffset() ); return discard_event(); } #endif #if 0 sc::result Defective::react( const EvNewData & ev ) { (void) ev; DEBUG_MSG(NOTIFY, "new data to offset: %d", availableOffset()); DEBUG_MSG(NOTIFY, "current offset : %d", currentOffset()); context().complete( availableOffset() - currentOffset() ); return discard_event(); } ParseNativeSections::ParseNativeSections() : DataState< ParseNativeSections, Parsing >() { } sc::result ParseNativeSections::react( const EvNewData & ev ) { (void) ev; DEBUG_MSG(NOTIFY, "new data to offset: %d", availableOffset()); DEBUG_MSG(NOTIFY, "current offset : %d", currentOffset()); DEBUG_MSG(NOTIFY, "Parsing native section"); context().complete( availableOffset() - currentOffset() ); return discard_event(); } #endif .