payload analysis

include/objects.h

@@ -0,0 +1,57 @@
+#pragma once
+#include <cstdint>
+#include <memory>
+#include <span>
+#include <string>
+
+template <typename T>
+struct ObjectInfo {
+  std::size_t GetSize() const { return sizeof(T); }
+  T data;
+};
+
+template <>
+struct ObjectInfo<std::string> {
+  std::size_t GetSize() const { return data.size(); }
+  std::size_t SetSize(std::size_t size) {
+    data.resize(size);
+    return data.size();
+  }
+
+  std::string data;
+};
+
+template <>
+struct ObjectInfo<std::vector<std::uint8_t>> {
+  std::size_t GetSize() const { return data.size(); }
+  std::size_t SetSize(std::size_t size) {
+    data.resize(size);
+    return data.size();
+  }
+
+  std::vector<std::uint8_t> data;
+};
+
+struct OLEObjectHeader {
+  ObjectInfo<std::uint32_t> OLEVersion;
+  ObjectInfo<std::uint32_t> FormatID;
+  ObjectInfo<std::string> ClassName;
+  ObjectInfo<std::string> TopicName;
+  ObjectInfo<std::string> ItemName;
+};
+
+struct EmbededObject {
+  OLEObjectHeader Header;
+  ObjectInfo<std::vector<std::uint8_t>> NativeData;
+};
+
+struct LinkedObject {};
+
+struct OLEObject {
+  OLEObjectHeader Header;
+
+  std::unique_ptr<EmbededObject> EObject = nullptr;
+  std::unique_ptr<LinkedObject> LOobject = nullptr;
+};
+
+OLEObject OLEObjectParser(std::span<const std::uint8_t> data);