class PEdump::NE::VS_VERSIONINFO

Constants

Children
Padding1
Padding2
Value

Public Class Methods

read(f, size = SIZE) click to toggle source
Calls superclass method
# File lib/pedump/ne/version_info.rb, line 14
def self.read f, size = SIZE
  super.tap do |vi|
    vi.szKey.chomp!("\x00")
    vi.Padding1 = f.tell%4 > 0 ? f.read(4 - f.tell%4) : nil
    vi.Value = VS_FIXEDFILEINFO.read(f,vi.wValueLength)
    # As many zero words as necessary to align the Children member on a 32-bit boundary.
    # These bytes are not included in wValueLength. This member is optional.
    vi.Padding2 = f.tell%4 > 0 ? f.read(4 - f.tell%4) : nil
    vi.Children = [] # An array of zero or one StringFileInfo structures,
                     # and zero or one VarFileInfo structures

    2.times do
      pos = f.tell
      f.seek(pos+4)  # seek 4 bytes forward
      t = f.read(3)
      f.seek(pos)    # return back
      case t
      when "Var"
        vi.Children << VarFileInfo.read(f)
      when "Str"
        vi.Children << StringFileInfo.read(f)
      else
        PEdump.logger.warn "[?] invalid VS_VERSIONINFO child type #{t.inspect}"
        break
      end
    end
  end
end