Package ghidra.app.util.bin.format.pe.cli.streams

Class CliAbstractStream

java.lang.Object
ghidra.app.util.bin.format.pe.cli.streams.CliAbstractStream
All Implemented Interfaces:
PeMarkupable, StructConverter
Direct Known Subclasses:
CliStreamBlob, CliStreamGuid, CliStreamMetadata, CliStreamStrings
public abstract class CliAbstractStream extends Object implements StructConverter, PeMarkupable
A abstract CLI stream type for convenience. Streams that we support should subclass this class and override the parse(), markup(ghidra.program.model.listing.Program, boolean, ghidra.util.task.TaskMonitor, ghidra.app.util.importer.MessageLog, ghidra.app.util.bin.format.pe.NTHeader), and StructConverter.toDataType() methods appropriately.

When streams are laid down in memory they are referred to as heaps, but we'll just stick with calling them streams because using both terms can get confusing.

  • Field Details

  • Constructor Details

    • CliAbstractStream

      public CliAbstractStream(CliStreamHeader header, long offset, int rva, BinaryReader reader) throws IOException
      Creates a new generic CLI stream type. This is intended to be called by a subclass stream during its creation.
      Parameters:
      header - The stream header associated with this stream.
      offset - The reader offset where this stream starts.
      rva - The relative virtual address where this stream starts.
      reader - A reader that is used to read the stream.
      Throws:
      IOException - if there is a problem reading the stream.

  • Method Details

    • parse

      public abstract boolean parse() throws IOException
      Parses this stream.
      Returns:
      True if parsing completed successfully; otherwise, false.
      Throws:
      IOException - If there was an IO problem while parsing.

    • markup

      public void markup(Program program, boolean isBinary, TaskMonitor monitor, MessageLog log, NTHeader ntHeader) throws DuplicateNameException, IOException
      Does basic markup that all streams will want:
      • Set monitor message
      • Validate addresses
      • Add bookmark
      • Add symbol
      • Create data type
      Subclass should first call this and then provide any custom markup they need.
      Specified by:
      markup in interface PeMarkupable
      Parameters:
      program - The program to markup.
      isBinary - True if the program is binary; otherwise, false.
      monitor - The monitor.
      log - The log.
      ntHeader - The PE's NT Header structure.
      Throws:
      DuplicateNameException
      IOException

    • getStreamHeader

      public CliStreamHeader getStreamHeader()
      Gets this stream's header.
      Returns:
      This stream's header.

    • getStreamMarkupAddress

      public static Address getStreamMarkupAddress(Program program, boolean isBinary, TaskMonitor monitor, MessageLog log, NTHeader ntHeader, CliAbstractStream stream, int streamIndex)
      Gets the markup address of an offset in a given stream.
      Parameters:
      program -
      isBinary -
      monitor -
      log -
      ntHeader -
      stream - The stream to offset into.
      streamIndex - The index into the stream.
      Returns:
      The markup address of the given offset in the provided stream.