Package ghidra.app.util.bin.format.pe

Class NTHeader

java.lang.Object

ghidra.app.util.bin.format.pe.NTHeader

All Implemented Interfaces:

OffsetValidator, StructConverter

public class NTHeader
extends Object
implements StructConverter, OffsetValidator

A class to represent the IMAGE_NT_HEADERS32 and IMAGE_NT_HEADERS64 structs as defined in winnt.h.

 typedef struct _IMAGE_NT_HEADERS {
    DWORD Signature;
    IMAGE_FILE_HEADER FileHeader;
    IMAGE_OPTIONAL_HEADER32 OptionalHeader;
 };
 

Field Summary

Fields

Modifier and Type	Field	Description
static final int	MAX_SANE_COUNT
static final int	SIZEOF_SIGNATURE	The size of the NT header signature.

Fields inherited from interface ghidra.app.util.bin.StructConverter

ASCII, BYTE, DWORD, IBO32, IBO64, POINTER, QWORD, SLEB128, STRING, ULEB128, UTF16, UTF8, VOID, WORD

Constructor Summary

Constructors

Constructor	Description
NTHeader(BinaryReader reader, int index, PortableExecutable.SectionLayout layout, boolean advancedProcess, boolean parseCliHeaders)	Constructs a new NT header.

Method Summary

Modifier and Type	Method	Description
boolean	checkPointer(long ptr)
boolean	checkRVA(long rva)
FileHeader	getFileHeader()	Returns the file header.
String	getName()	Returns the name to use when converting into a structure data type.
OptionalHeader	getOptionalHeader()	Returns the optional header.
boolean	isRVAResoltionSectionAligned()
int	rvaToPointer(int rva)	Converts a relative virtual address (RVA) into a pointer.
long	rvaToPointer(long rva)	Converts a relative virtual address (RVA) into a pointer.
DataType	toDataType()	Returns a structure datatype representing the contents of the implementor of this interface.
int	vaToPointer(int va)	Converts a virtual address (VA) into a pointer.
long	vaToPointer(long va)	Converts a virtual address (VA) into a pointer.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

SIZEOF_SIGNATURE

public static final int SIZEOF_SIGNATURE

The size of the NT header signature.

See Also:

• Constant Field Values

MAX_SANE_COUNT

public static final int MAX_SANE_COUNT

See Also:

• Constant Field Values

Constructor Details

NTHeader

public NTHeader(BinaryReader reader,
 int index,
 PortableExecutable.SectionLayout layout,
 boolean advancedProcess,
 boolean parseCliHeaders)
         throws InvalidNTHeaderException,
IOException

Constructs a new NT header.

Parameters:

reader - the binary reader

index - the index into the reader to the start of the NT header

layout - The PortableExecutable.SectionLayout

advancedProcess - if true, information outside of the base header will be processed

parseCliHeaders - if true, CLI headers are parsed (if present)

Throws:

InvalidNTHeaderException - if the bytes the specified index

IOException - if an IO-related exception occurred do not constitute an accurate NT header.

Method Details

getName

public String getName()

Returns the name to use when converting into a structure data type.

Returns:

the name to use when converting into a structure data type

isRVAResoltionSectionAligned

public boolean isRVAResoltionSectionAligned()

getFileHeader

public FileHeader getFileHeader()

Returns the file header.

Returns:

the file header

getOptionalHeader

public OptionalHeader getOptionalHeader()

Returns the optional header.

Returns:

the optional header

toDataType

public DataType toDataType()
                    throws DuplicateNameException,
IOException

Description copied from interface: StructConverter

Returns a structure datatype representing the contents of the implementor of this interface.

For example, given:

 class A {
     int foo;
     double bar;
 }
 

The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.

Specified by:

toDataType in interface StructConverter

Returns:

returns a structure datatype representing the implementor of this interface

Throws:

DuplicateNameException - when a datatype of the same name already exists

IOException

See Also:

• StructConverter.toDataType()

rvaToPointer

public int rvaToPointer(int rva)

Converts a relative virtual address (RVA) into a pointer.

Parameters:

rva - the relative virtual address

Returns:

the pointer into binary image, 0 if not valid

rvaToPointer

public long rvaToPointer(long rva)

Converts a relative virtual address (RVA) into a pointer.

Parameters:

rva - the relative virtual address

Returns:

the pointer into binary image, -1 if not valid

checkPointer

public boolean checkPointer(long ptr)

Specified by:

checkPointer in interface OffsetValidator

checkRVA

public boolean checkRVA(long rva)

Specified by:

checkRVA in interface OffsetValidator

vaToPointer

public int vaToPointer(int va)

Converts a virtual address (VA) into a pointer.

Parameters:

va - the virtual address

Returns:

the pointer into binary image, 0 if not valid

vaToPointer

public long vaToPointer(long va)

Converts a virtual address (VA) into a pointer.

Parameters:

va - the virtual address

Returns:

the pointer into binary image, 0 if not valid