Class: PEdump::VS_VERSIONINFO

Inherits:
Object
  • Object
show all
Defined in:
lib/pedump/version_info.rb

Class Method Summary collapse

Class Method Details

.read(f, size = SIZE) ⇒ Object 



13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
 
# File 'lib/pedump/version_info.rb', line 13

def self.read f, size = SIZE
  super.tap do |vi|
    vi.szKey.force_encoding('UTF-16LE').encode!('UTF-8').sub!(/\u0000$/,'') rescue nil
    vi.Padding1 = f.tell%4 > 0 ? f.read(4 - f.tell%4) : nil
    vi.Value = VS_FIXEDFILEINFO.read(f,vi.wValueLength)
    # As many zero words as necessary to align the Children member on a 32-bit boundary.
    # These bytes are not included in wValueLength. This member is optional.
    vi.Padding2 = f.tell%4 > 0 ? f.read(4 - f.tell%4) : nil
    vi.Children = [] # An array of zero or one StringFileInfo structures,
                     # and zero or one VarFileInfo structures

    2.times do
      pos = f.tell
      f.seek(pos+6)  # seek 6 bytes forward
      t = f.read(6)
      f.seek(pos)    # return back
      case t
      when "V\x00a\x00r\x00"
        vi.Children << VarFileInfo.read(f)
      when "S\x00t\x00r\x00"
        vi.Children << StringFileInfo.read(f)
      else
        PEdump.logger.warn "[?] invalid VS_VERSIONINFO child type #{t.inspect}"
        break
      end
    end
  end
end