Package ghidra.app.util.bin.format.pe
Class NTHeader
java.lang.Object
ghidra.app.util.bin.format.pe.NTHeader
- All Implemented Interfaces:
OffsetValidator
,StructConverter
A class to represent the
IMAGE_NT_HEADERS32
and
IMAGE_NT_HEADERS64 structs as defined in
winnt.h
.
typedef struct _IMAGE_NT_HEADERS { DWORD Signature; IMAGE_FILE_HEADER FileHeader; IMAGE_OPTIONAL_HEADER32 OptionalHeader; };
-
Field Summary
Modifier and TypeFieldDescriptionstatic final int
static final int
The size of the NT header signature. -
Constructor Summary
ConstructorDescriptionNTHeader
(BinaryReader reader, int index, PortableExecutable.SectionLayout layout, boolean advancedProcess, boolean parseCliHeaders) Constructs a new NT header. -
Method Summary
Modifier and TypeMethodDescriptionboolean
checkPointer
(long ptr) boolean
checkRVA
(long rva) Returns the file header.getName()
Returns the name to use when converting into a structure data type.Returns the optional header.boolean
int
rvaToPointer
(int rva) Converts a relative virtual address (RVA) into a pointer.long
rvaToPointer
(long rva) Converts a relative virtual address (RVA) into a pointer.Returns a structure datatype representing the contents of the implementor of this interface.int
vaToPointer
(int va) Converts a virtual address (VA) into a pointer.long
vaToPointer
(long va) Converts a virtual address (VA) into a pointer.
-
Field Details
-
SIZEOF_SIGNATURE
public static final int SIZEOF_SIGNATUREThe size of the NT header signature.- See Also:
-
MAX_SANE_COUNT
public static final int MAX_SANE_COUNT- See Also:
-
-
Constructor Details
-
NTHeader
public NTHeader(BinaryReader reader, int index, PortableExecutable.SectionLayout layout, boolean advancedProcess, boolean parseCliHeaders) throws InvalidNTHeaderException, IOException Constructs a new NT header.- Parameters:
reader
- the binary readerindex
- the index into the reader to the start of the NT headerlayout
- ThePortableExecutable.SectionLayout
advancedProcess
- if true, information outside of the base header will be processedparseCliHeaders
- if true, CLI headers are parsed (if present)- Throws:
InvalidNTHeaderException
- if the bytes the specified indexIOException
- if an IO-related exception occurred do not constitute an accurate NT header.
-
-
Method Details
-
getName
Returns the name to use when converting into a structure data type.- Returns:
- the name to use when converting into a structure data type
-
isRVAResoltionSectionAligned
public boolean isRVAResoltionSectionAligned() -
getFileHeader
Returns the file header.- Returns:
- the file header
-
getOptionalHeader
Returns the optional header.- Returns:
- the optional header
-
toDataType
Description copied from interface:StructConverter
Returns a structure datatype representing the contents of the implementor of this interface.For example, given:
class A { int foo; double bar; }
The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.
- Specified by:
toDataType
in interfaceStructConverter
- Returns:
- returns a structure datatype representing the implementor of this interface
- Throws:
DuplicateNameException
- when a datatype of the same name already existsIOException
- if an IO-related error occurs- See Also:
-
rvaToPointer
public int rvaToPointer(int rva) Converts a relative virtual address (RVA) into a pointer.- Parameters:
rva
- the relative virtual address- Returns:
- the pointer into binary image, 0 if not valid
-
rvaToPointer
public long rvaToPointer(long rva) Converts a relative virtual address (RVA) into a pointer.- Parameters:
rva
- the relative virtual address- Returns:
- the pointer into binary image, -1 if not valid
-
checkPointer
public boolean checkPointer(long ptr) - Specified by:
checkPointer
in interfaceOffsetValidator
-
checkRVA
public boolean checkRVA(long rva) - Specified by:
checkRVA
in interfaceOffsetValidator
-
vaToPointer
public int vaToPointer(int va) Converts a virtual address (VA) into a pointer.- Parameters:
va
- the virtual address- Returns:
- the pointer into binary image, 0 if not valid
-
vaToPointer
public long vaToPointer(long va) Converts a virtual address (VA) into a pointer.- Parameters:
va
- the virtual address- Returns:
- the pointer into binary image, 0 if not valid
-