Class: PEdump::NE::Bundle

Inherits:
Object show all
Defined in:
lib/pedump/ne.rb

Overview

The entry-table data is organized by bundle, each of which begins with a 2-byte header. The first byte of the header specifies the number of entries in the bundle ( 0 = end of the table). The second byte specifies whether the corresponding segment is movable or fixed.

0xFF = the segment is movable.
0xFE = the entry does not refer to a segment but refers to a constant defined within the module.
else it is a segment index.

Constant Summary collapse

FixedEntry = 
PEdump.create_struct 'Cv',   :flag, :offset
MovableEntry = 
PEdump.create_struct 'CvCv', :flag, :int3F, :seg_idx, :offset

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.read(io) ⇒ Object 



351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
 
# File 'lib/pedump/ne.rb', line 351

def self.read io
  super.tap do |bundle|
    return nil if bundle.num_entries == 0
    if bundle.num_entries == 0
      @@eob ||= 0
      @@eob += 1
      return nil if @@eob == 2
    end
    bundle.entries = bundle.seg_idx == 0 ? [] :
      if bundle.movable?
        bundle.num_entries.times.map{ MovableEntry.read(io) }
      else
        bundle.num_entries.times.map{ FixedEntry.read(io) }
      end
  end
end

Instance Method Details

#movable? ⇒ Boolean 



347
348
349
 
# File 'lib/pedump/ne.rb', line 347

def movable?
  seg_idx == 0xff
end