Skip to content

Commit 432e144

Browse files
committed
Parse and display PE resource information in triage view. Fix #4052, fix #5607
1 parent 3520262 commit 432e144

File tree

5 files changed

+1171
-79
lines changed

5 files changed

+1171
-79
lines changed

examples/triage/headers.cpp

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -306,8 +306,19 @@ PEHeaders::PEHeaders(BinaryViewRef data)
306306
AddField("Compiler(s) Used", compilersUsed);
307307
}
308308

309+
auto versionInfo = data->QueryMetadata("PEVersionInfo");
310+
if (versionInfo && versionInfo->IsKeyValueStore())
311+
{
312+
for (const auto& [key, value] : versionInfo->GetKeyValueStore())
313+
{
314+
if (value->IsString() && !value->GetString().empty())
315+
AddField(QString::fromStdString(key), QString::fromStdString(value->GetString()));
316+
}
317+
}
318+
309319
SetColumns(3);
310-
SetRowsPerColumn(9);
320+
size_t numFields = GetFields().size();
321+
SetRowsPerColumn((numFields + 2) / 3);
311322
}
312323

313324

0 commit comments

Comments
 (0)