Class: PEdump::NE::VS_VERSIONINFO

Inherits:
Object
  • Object
show all
Defined in:
lib/pedump/ne/version_info.rb

Class Method Summary collapse

Class Method Details

.read(f, size = SIZE) ⇒ Object 



14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
 
# File 'lib/pedump/ne/version_info.rb', line 14

def self.read f, size = SIZE
  super.tap do |vi|
    vi.szKey.chomp!("\x00")
    vi.Padding1 = f.tell%4 > 0 ? f.read(4 - f.tell%4) : nil
    vi.Value = VS_FIXEDFILEINFO.read(f,vi.wValueLength)
    # As many zero words as necessary to align the Children member on a 32-bit boundary.
    # These bytes are not included in wValueLength. This member is optional.
    vi.Padding2 = f.tell%4 > 0 ? f.read(4 - f.tell%4) : nil
    vi.Children = [] # An array of zero or one StringFileInfo structures,
                     # and zero or one VarFileInfo structures

    2.times do
      pos = f.tell
      f.seek(pos+4)  # seek 4 bytes forward
      t = f.read(3)
      f.seek(pos)    # return back
      case t
      when "Var"
        vi.Children << VarFileInfo.read(f)
      when "Str"
        vi.Children << StringFileInfo.read(f)
      else
        PEdump.logger.warn "[?] invalid VS_VERSIONINFO child type #{t.inspect}"
        break
      end
    end
  end
end