Package ghidra.app.util.bin.format.pe

Class ImageCor20Header

java.lang.Object
ghidra.app.util.bin.format.pe.ImageCor20Header
All Implemented Interfaces:
PeMarkupable, StructConverter
public class ImageCor20Header extends Object implements StructConverter, PeMarkupable
typedef struct IMAGE_COR20_HEADER { // Header versioning DWORD cb; // Size of the structure WORD MajorRuntimeVersion; // Version of the CLR Runtime WORD MinorRuntimeVersion; // Version of the CLR Runtime // Symbol table and startup information IMAGE_DATA_DIRECTORY MetaData; // A Data Directory giving RVA and Size of MetaData DWORD Flags; union { DWORD EntryPointRVA; // Points to the .NET native EntryPoint method DWORD EntryPointToken; // Points to the .NET IL EntryPoint method }; // Binding information IMAGE_DATA_DIRECTORY Resources; // A Data Directory for Resources, which are referenced in the MetaData IMAGE_DATA_DIRECTORY StrongNameSignature; // A Data Directory for unique .NET assembly signatures // Regular fixup and binding information IMAGE_DATA_DIRECTORY CodeManagerTable; // Always 0 IMAGE_DATA_DIRECTORY VTableFixups; // Not well documented VTable used by languages who don't follow the common type system runtime model IMAGE_DATA_DIRECTORY ExportAddressTableJumps; // Always 0 in normal .NET assemblies, only present in native images // Precompiled image info (internal use only - set to zero) IMAGE_DATA_DIRECTORY ManagedNativeHeader; };

  • Method Details

    • parse

      public boolean parse() throws IOException
      Parses this header
      Returns:
      True if parsing completed successfully; otherwise, false.
      Throws:
      IOException - If there was an IO problem while parsing.

    • markup

      public void markup(Program program, boolean isBinary, TaskMonitor monitor, MessageLog log, NTHeader ntHeader) throws DuplicateNameException, CodeUnitInsertionException, IOException, MemoryAccessException
      Description copied from interface: PeMarkupable
      Marks up a PE structure.
      Specified by:
      markup in interface PeMarkupable
      Parameters:
      program - The program to markup.
      isBinary - True if the program is binary; otherwise, false.
      monitor - The monitor.
      log - The log.
      ntHeader - The PE's NT Header structure.
      Throws:
      DuplicateNameException
      CodeUnitInsertionException
      IOException
      MemoryAccessException

    • toDataType

      public DataType toDataType() throws DuplicateNameException, IOException
      Description copied from interface: StructConverter
      Returns a structure datatype representing the contents of the implementor of this interface.

      For example, given: 

       class A {
     int foo;
     double bar;
 }

      The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.

      Specified by:
      toDataType in interface StructConverter
      Returns:
      returns a structure datatype representing the implementor of this interface
      Throws:
      DuplicateNameException - when a datatype of the same name already exists
      IOException
      See Also:

    • getCb

      public int getCb()
      Gets the size of this structure in bytes.
      Returns:
      The size of this structure in bytes.

    • getMajorRuntimeVersion

      public short getMajorRuntimeVersion()
      Gets the major runtime version.
      Returns:
      The major runtime version.

    • getMinorRuntimeVersion

      public short getMinorRuntimeVersion()
      Gets the major runtime version.
      Returns:
      The major runtime version.

    • getMetadata

      public CliMetadataDirectory getMetadata()
      Gets the MetaData directory.
      Returns:
      The MetaData directory.

    • getFlags

      public int getFlags()
      Gets the flags.
      Returns:
      The flags.

    • getEntryPointToken

      public int getEntryPointToken()
      Gets the entry point token.
      Returns:
      The entry point token.

    • getEntryPointVA

      public Address getEntryPointVA()
      Gets the entry point virtual address.
      Returns:
      The entry point address.

    • getResources

      public DefaultDataDirectory getResources()
      Gets the Resources directory.
      Returns:
      The Resources directory.

    • getStrongNameSignature

      public DefaultDataDirectory getStrongNameSignature()
      Gets the StrongNameSignature directory.
      Returns:
      The StrongNameSignature directory.

    • getCodeManagerTable

      public DefaultDataDirectory getCodeManagerTable()
      Gets the CodeManagerTable directory.
      Returns:
      The CodeManagerTable directory.

    • getVTableFixups

      public DefaultDataDirectory getVTableFixups()
      Gets the VTableFixups directory.
      Returns:
      The VTableFixups directory.

    • getExportAddressTableJumps

      public DefaultDataDirectory getExportAddressTableJumps()
      Gets the ExportAddressTableJumps directory.
      Returns:
      The ExportAddressTableJumps directory.

    • getManagedNativeHeader

      public DefaultDataDirectory getManagedNativeHeader()
      Gets the ManagedNativeHeader directory.
      Returns:
      The ManagedNativeHeader directory.