Package ghidra.app.util.bin.format.pe.cli.blobs

Class CliBlob

java.lang.Object
ghidra.app.util.bin.format.pe.cli.blobs.CliBlob
All Implemented Interfaces:
StructConverter
Direct Known Subclasses:
CliAbstractSig, CliBlobCustomAttrib, CliBlobMarshalSpec
public class CliBlob extends Object implements StructConverter
Describes a blob in the #Blob heap. Format is a coded size then the blob contents.

Paraphrasing from ISO 23271:2012 11.24.2.4 (p272): - If the first one byte of the 'blob' is 0bbbbbbb_2: size is bbbbbbb_2 bytes. - If the first two bytes are 10bbbbbb_2 and x: size is (bbbbbb_2 << 8 + x) bytes. - If the first four bytes are 110bbbbb_2, x, y, and z: size is (bbbbb_2<<24 + x<<16 + y<<8 + z) bytes. The first entry in the heap is the empty 'blob' consisting of a single zero byte.

  • Field Details Link icon

    • PATH Link icon

      public static final String PATH
      See Also:

    • blobOffset Link icon

      protected long blobOffset

    • contentsOffset Link icon

      protected long contentsOffset

    • contentsSize Link icon

      protected int contentsSize

  • Constructor Details Link icon

    • CliBlob Link icon

      public CliBlob(int streamIndex, BinaryReader reader) throws IOException
      Creates a new blob from the given reader, which should be positioned at the start of the blob. The reader will be positioned directly after the blob upon completion of the constructor.
      Parameters:
      streamIndex - The blob's stream index.
      reader - The reader to use to read the blob.
      Throws:
      IOException - if there was a problem reading the blob.

    • CliBlob Link icon

      protected CliBlob(CliBlob blob)
      Creates a new blob that is a copy of the given blob.
      Parameters:
      blob - The blob to copy.

    • CliBlob Link icon

      protected CliBlob(CliBlob blob, BinaryReader reader)
      Creates a new blob that is a copy of the given blob but with a new reader. The provided reader must be positioned to the start of the new blob.
      Parameters:
      blob - The blob to copy.
      reader - The reader to use to read the new blob. It must be positioned to the start of the new blob.

  • Method Details Link icon

    • getSize Link icon

      public int getSize()
      Gets the blob's size in bytes (includes all fields).
      Returns:
      The blob's size in bytes.

    • getContentsReader Link icon

      public BinaryReader getContentsReader()
      Gets a new binary reader positioned at the start of this blob's contents.
      Returns:
      A new binary reader positioned at the start of this blob's contents.

    • getContentsSize Link icon

      public int getContentsSize()
      Gets the blob's contents size in bytes.
      Returns:
      The blob's contents size in bytes.

    • getContents Link icon

      public byte[] getContents()
      Gets the blob's contents.
      Returns:
      the blob's contents. Could be null if there was a problem reading the contents.

    • getRepresentation Link icon

      public String getRepresentation()
      Gets the string representation of this blob.
      Returns:
      The string representation of this blob.

    • isLittleEndian Link icon

      public boolean isLittleEndian()
      Checks to see whether or not this blob is little endian.
      Returns:
      True if this blob is little endian; false if big endian.

    • toDataType Link icon

      public DataType toDataType()
      Description copied from interface: StructConverter
      Returns a structure datatype representing the contents of the implementor of this interface.

      For example, given: 

       class A {
     int foo;
     double bar;
 }

      The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.

      Specified by:
      toDataType in interface StructConverter
      Returns:
      returns a structure datatype representing the implementor of this interface
      See Also:

    • toDataType Link icon

      public DataType toDataType(DataTypeManager dtm)
      Create CLI Blob structure. NOTE: This form is provided to reduce resolution time when target datatype manager is known.
      Parameters:
      dtm - datatype manager or null if target datatype manager is unknown.
      Returns:
      blob structure

    • getStreamIndex Link icon

      public int getStreamIndex()
      Gets the index into the blob stream of this blob.
      Returns:
      The index into the blob stream of this blob.

    • getName Link icon

      public String getName()
      Gets the name of this blob.
      Returns:
      The name of this blob.

    • getContentsName Link icon

      public String getContentsName()
      Gets the name associated with this blob's contents.
      Returns:
      The name associated with this blob's contents.

    • getContentsDataType Link icon

      public DataType getContentsDataType()
      Gets the data type associated with this blob's contents.
      Returns:
      The data type associated with this blob's contents.

    • getContentsComment Link icon

      public String getContentsComment()
      Gets the comment associated with this blob's contents.
      Returns:
      The comment associated with this blob's contents.

    • getSizeDataType Link icon

      public DataType getSizeDataType()
      Gets the proper data type for the blob's size field.
      Returns:
      The proper data type for the blob's size field.

    • testSizeDecoding Link icon

      public static void testSizeDecoding()

    • decodeCompressedSigned Link icon

      public static int decodeCompressedSigned(byte codedSize)

    • decodeCompressedSigned Link icon

      public static int decodeCompressedSigned(short codedSize)

    • decodeCompressedSigned Link icon

      public static int decodeCompressedSigned(int codedSize)

    • decodeCompressedUnsigned Link icon

      public static int decodeCompressedUnsigned(byte codedSize)

    • decodeCompressedUnsigned Link icon

      public static int decodeCompressedUnsigned(short codedSize)

    • decodeCompressedUnsigned Link icon

      public static int decodeCompressedUnsigned(int codedSize)

    • decodeCompressedSignedInt Link icon

      public static int decodeCompressedSignedInt(BinaryReader reader) throws IOException
      Throws:
      IOException

    • decodeCompressedUnsignedInt Link icon

      public static int decodeCompressedUnsignedInt(BinaryReader reader) throws IOException
      Throws:
      IOException

    • getDataTypeForBytes Link icon

      public static DataType getDataTypeForBytes(int numBytes)