Package ghidra.app.util.bin.format.pe
Class OptionalHeaderImpl
java.lang.Object
ghidra.app.util.bin.format.pe.OptionalHeaderImpl
- All Implemented Interfaces:
OptionalHeader,StructConverter
typedef struct _IMAGE_OPTIONAL_HEADER {
WORD Magic; // MANDATORY
BYTE MajorLinkerVersion;
BYTE MinorLinkerVersion;
DWORD SizeOfCode;
DWORD SizeOfInitializedData;
DWORD SizeOfUninitializedData;
DWORD AddressOfEntryPoint; // MANDATORY
DWORD BaseOfCode;
DWORD BaseOfData;
DWORD ImageBase; // MANDATORY
DWORD SectionAlignment; // MANDATORY
DWORD FileAlignment; // MANDATORY
WORD MajorOperatingSystemVersion; // MANDATORY
WORD MinorOperatingSystemVersion;
WORD MajorImageVersion;
WORD MinorImageVersion;
WORD MajorSubsystemVersion;
WORD MinorSubsystemVersion;
DWORD Win32VersionValue;
DWORD SizeOfImage; // MANDATORY
DWORD SizeOfHeaders; // MANDATORY
DWORD CheckSum;
WORD Subsystem; // MANDATORY
WORD DllCharacteristics;
DWORD SizeOfStackReserve;
DWORD SizeOfStackCommit;
DWORD SizeOfHeapReserve;
DWORD SizeOfHeapCommit;
DWORD LoaderFlags;
DWORD NumberOfRvaAndSizes; // USED
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
};
typedef struct _IMAGE_OPTIONAL_HEADER64 {
WORD Magic;
BYTE MajorLinkerVersion;
BYTE MinorLinkerVersion;
DWORD SizeOfCode;
DWORD SizeOfInitializedData;
DWORD SizeOfUninitializedData;
DWORD AddressOfEntryPoint;
DWORD BaseOfCode;
ULONGLONG ImageBase;
DWORD SectionAlignment;
DWORD FileAlignment;
WORD MajorOperatingSystemVersion;
WORD MinorOperatingSystemVersion;
WORD MajorImageVersion;
WORD MinorImageVersion;
WORD MajorSubsystemVersion;
WORD MinorSubsystemVersion;
DWORD Win32VersionValue;
DWORD SizeOfImage;
DWORD SizeOfHeaders;
DWORD CheckSum;
WORD Subsystem;
WORD DllCharacteristics;
ULONGLONG SizeOfStackReserve;
ULONGLONG SizeOfStackCommit;
ULONGLONG SizeOfHeapReserve;
ULONGLONG SizeOfHeapCommit;
DWORD LoaderFlags;
DWORD NumberOfRvaAndSizes;
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
};
-
Field Summary
FieldsModifier and TypeFieldDescriptionprotected intprotected intprotected intprotected intprotected DataDirectory[]protected shortprotected intprotected longprotected intprotected shortprotected shortprotected byteprotected shortprotected shortprotected shortprotected byteprotected shortprotected shortprotected NTHeaderprotected intprotected BinaryReaderprotected intprotected intprotected intprotected longprotected longprotected intprotected intprotected longprotected longprotected intprotected intprotected shortprotected intFields inherited from interface ghidra.app.util.bin.format.pe.OptionalHeader
IMAGE_DIRECTORY_ENTRY_ARCHITECTURE, IMAGE_DIRECTORY_ENTRY_BASERELOC, IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT, IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR, IMAGE_DIRECTORY_ENTRY_COMHEADER, IMAGE_DIRECTORY_ENTRY_DEBUG, IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT, IMAGE_DIRECTORY_ENTRY_EXCEPTION, IMAGE_DIRECTORY_ENTRY_EXPORT, IMAGE_DIRECTORY_ENTRY_GLOBALPTR, IMAGE_DIRECTORY_ENTRY_IAT, IMAGE_DIRECTORY_ENTRY_IMPORT, IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG, IMAGE_DIRECTORY_ENTRY_RESOURCE, IMAGE_DIRECTORY_ENTRY_SECURITY, IMAGE_DIRECTORY_ENTRY_TLS, IMAGE_DLLCHARACTERISTICS_APPCONTAINER, IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE, IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY, IMAGE_DLLCHARACTERISTICS_GUARD_CF, IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA, IMAGE_DLLCHARACTERISTICS_NO_BIND, IMAGE_DLLCHARACTERISTICS_NO_ISOLATION, IMAGE_DLLCHARACTERISTICS_NO_SEH, IMAGE_DLLCHARACTERISTICS_NX_COMPAT, IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE, IMAGE_DLLCHARACTERISTICS_WDM_DRIVER, IMAGE_NUMBEROF_DIRECTORY_ENTRIES -
Method Summary
Modifier and TypeMethodDescriptionlonglongReturns the RVA of the first byte of code when loaded in memory.longintGet the image file checksum.Returns the array of data directories.shortReturn flags that describe properties of and features of this binary.intlongintReturn the flags passed to the loader.shortGet the major version number of the image.byteReturn the major version number of the linker that built this binary.shortReturn the major version number of the required operating system.shortGet the major version number of the subsystem.shortGet the minor version number of the image.byteReturn the minor version number of the linker that built this binary.shortReturn the minor version number of the required operating system.shortGet the minor version number of the subsystem.longintlongReturns the combined total size of all sections with theIMAGE_SCN_CNT_CODEattribute.longlongReturn the size of the heap to commitlongReturn the size of the heap reservationlonglongReturns the combined size of all initialized data sections.longReturn the size of the stack to commitlongReturn the size of the stack reservationlongReturns the size of all sections with the uninitialized data attributes.intGet the subsystem that is required to run this image.intThis value is reserved, and must be 0booleanis64bit()Returns true of this optional header is 64-bit.booleanisCLI()protected voidparse()voidprocessDataDirectories(TaskMonitor monitor) This methods tells this optional header to process its data directories.voidsetSizeOfCode(long size) voidsetSizeOfHeaders(long size) voidsetSizeOfImage(long size) voidsetSizeOfInitializedData(long size) voidsetSizeOfUninitializedData(long size) Returns a structure datatype representing the contents of the implementor of this interface.voidvalidateDataDirectories(Program program) voidwriteHeader(RandomAccessFile raf, DataConverter dc) Writes this optional header to the specified random access file.
-
Field Details
-
magic
protected short magic -
majorLinkerVersion
protected byte majorLinkerVersion -
minorLinkerVersion
protected byte minorLinkerVersion -
sizeOfCode
protected int sizeOfCode -
sizeOfInitializedData
protected int sizeOfInitializedData -
sizeOfUninitializedData
protected int sizeOfUninitializedData -
addressOfEntryPoint
protected int addressOfEntryPoint -
baseOfCode
protected int baseOfCode -
baseOfData
protected int baseOfData -
imageBase
protected long imageBase -
sectionAlignment
protected int sectionAlignment -
fileAlignment
protected int fileAlignment -
majorOperatingSystemVersion
protected short majorOperatingSystemVersion -
minorOperatingSystemVersion
protected short minorOperatingSystemVersion -
majorImageVersion
protected short majorImageVersion -
minorImageVersion
protected short minorImageVersion -
majorSubsystemVersion
protected short majorSubsystemVersion -
minorSubsystemVersion
protected short minorSubsystemVersion -
win32VersionValue
protected int win32VersionValue -
sizeOfImage
protected int sizeOfImage -
sizeOfHeaders
protected int sizeOfHeaders -
checkSum
protected int checkSum -
subsystem
protected short subsystem -
dllCharacteristics
protected short dllCharacteristics -
sizeOfStackReserve
protected long sizeOfStackReserve -
sizeOfStackCommit
protected long sizeOfStackCommit -
sizeOfHeapReserve
protected long sizeOfHeapReserve -
sizeOfHeapCommit
protected long sizeOfHeapCommit -
loaderFlags
protected int loaderFlags -
numberOfRvaAndSizes
protected int numberOfRvaAndSizes -
dataDirectory
-
ntHeader
-
reader
-
startIndex
protected int startIndex
-
-
Method Details
-
is64bit
public boolean is64bit()Description copied from interface:OptionalHeaderReturns true of this optional header is 64-bit.- Specified by:
is64bitin interfaceOptionalHeader- Returns:
- true of this optional header is 64-bit
-
getImageBase
public long getImageBase()- Specified by:
getImageBasein interfaceOptionalHeader- Returns:
- the preferred load address of this file in memory
-
getAddressOfEntryPoint
public long getAddressOfEntryPoint()- Specified by:
getAddressOfEntryPointin interfaceOptionalHeader- Returns:
- the RVA of the first code byte in the file that will be executed
-
getSizeOfCode
public long getSizeOfCode()Description copied from interface:OptionalHeaderReturns the combined total size of all sections with theIMAGE_SCN_CNT_CODEattribute.- Specified by:
getSizeOfCodein interfaceOptionalHeader- Returns:
- the combined total size of all sections with
the
IMAGE_SCN_CNT_CODEattribute.
-
setSizeOfCode
public void setSizeOfCode(long size) - Specified by:
setSizeOfCodein interfaceOptionalHeader- See Also:
-
getSizeOfInitializedData
public long getSizeOfInitializedData()Description copied from interface:OptionalHeaderReturns the combined size of all initialized data sections.- Specified by:
getSizeOfInitializedDatain interfaceOptionalHeader- Returns:
- the combined size of all initialized data sections
-
setSizeOfInitializedData
public void setSizeOfInitializedData(long size) - Specified by:
setSizeOfInitializedDatain interfaceOptionalHeader- See Also:
-
getSizeOfUninitializedData
public long getSizeOfUninitializedData()Description copied from interface:OptionalHeaderReturns the size of all sections with the uninitialized data attributes.- Specified by:
getSizeOfUninitializedDatain interfaceOptionalHeader- Returns:
- the size of all sections with the uninitialized data attributes
-
setSizeOfUninitializedData
public void setSizeOfUninitializedData(long size) - Specified by:
setSizeOfUninitializedDatain interfaceOptionalHeader- See Also:
-
getBaseOfCode
public long getBaseOfCode()Description copied from interface:OptionalHeaderReturns the RVA of the first byte of code when loaded in memory.- Specified by:
getBaseOfCodein interfaceOptionalHeader- Returns:
- the RVA of the first byte of code when loaded in memory
-
getBaseOfData
public long getBaseOfData()- Specified by:
getBaseOfDatain interfaceOptionalHeader- Returns:
- the RVA of the first byte of data when loaded into memory
-
getSizeOfImage
public long getSizeOfImage()- Specified by:
getSizeOfImagein interfaceOptionalHeader- Returns:
- the RVA that would be assigned to the next section following the last section
-
setSizeOfImage
public void setSizeOfImage(long size) - Specified by:
setSizeOfImagein interfaceOptionalHeader- See Also:
-
getSizeOfHeaders
public long getSizeOfHeaders()- Specified by:
getSizeOfHeadersin interfaceOptionalHeader- Returns:
- the combined size of all headers
-
setSizeOfHeaders
public void setSizeOfHeaders(long size) - Specified by:
setSizeOfHeadersin interfaceOptionalHeader- See Also:
-
getNumberOfRvaAndSizes
public long getNumberOfRvaAndSizes()- Specified by:
getNumberOfRvaAndSizesin interfaceOptionalHeader
-
getMajorOperatingSystemVersion
public short getMajorOperatingSystemVersion()Description copied from interface:OptionalHeaderReturn the major version number of the required operating system.- Specified by:
getMajorOperatingSystemVersionin interfaceOptionalHeader- Returns:
-
getMinorOperatingSystemVersion
public short getMinorOperatingSystemVersion()Description copied from interface:OptionalHeaderReturn the minor version number of the required operating system.- Specified by:
getMinorOperatingSystemVersionin interfaceOptionalHeader- Returns:
-
processDataDirectories
Description copied from interface:OptionalHeaderThis methods tells this optional header to process its data directories.- Specified by:
processDataDirectoriesin interfaceOptionalHeader- Throws:
IOException
-
getDataDirectories
Description copied from interface:OptionalHeaderReturns the array of data directories.- Specified by:
getDataDirectoriesin interfaceOptionalHeader- Returns:
- the array of data directories
-
getSectionAlignment
public int getSectionAlignment()- Specified by:
getSectionAlignmentin interfaceOptionalHeader- Returns:
- the section alignment
-
getFileAlignment
public int getFileAlignment()- Specified by:
getFileAlignmentin interfaceOptionalHeader- Returns:
- the file alignment
-
parse
- Throws:
IOException
-
toDataType
Description copied from interface:StructConverterReturns a structure datatype representing the contents of the implementor of this interface.For example, given:
class A { int foo; double bar; }The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.
- Specified by:
toDataTypein interfaceStructConverter- Returns:
- returns a structure datatype representing the implementor of this interface
- Throws:
DuplicateNameException- when a datatype of the same name already exists- See Also:
-
writeHeader
Description copied from interface:OptionalHeaderWrites this optional header to the specified random access file.- Specified by:
writeHeaderin interfaceOptionalHeader- Parameters:
raf- the random access filedc- the data converter- Throws:
IOException
-
validateDataDirectories
- Specified by:
validateDataDirectoriesin interfaceOptionalHeader
-
isCLI
- Specified by:
isCLIin interfaceOptionalHeader- Returns:
- true if the PE uses predominantly CLI code; otherwise, false.
- Throws:
IOException
-
getMajorLinkerVersion
public byte getMajorLinkerVersion()Description copied from interface:OptionalHeaderReturn the major version number of the linker that built this binary.- Specified by:
getMajorLinkerVersionin interfaceOptionalHeader- Returns:
-
getMinorLinkerVersion
public byte getMinorLinkerVersion()Description copied from interface:OptionalHeaderReturn the minor version number of the linker that built this binary.- Specified by:
getMinorLinkerVersionin interfaceOptionalHeader- Returns:
-
getMajorImageVersion
public short getMajorImageVersion()Description copied from interface:OptionalHeaderGet the major version number of the image.- Specified by:
getMajorImageVersionin interfaceOptionalHeader- Returns:
-
getMinorImageVersion
public short getMinorImageVersion()Description copied from interface:OptionalHeaderGet the minor version number of the image.- Specified by:
getMinorImageVersionin interfaceOptionalHeader- Returns:
-
getMajorSubsystemVersion
public short getMajorSubsystemVersion()Description copied from interface:OptionalHeaderGet the major version number of the subsystem.- Specified by:
getMajorSubsystemVersionin interfaceOptionalHeader
-
getMinorSubsystemVersion
public short getMinorSubsystemVersion()Description copied from interface:OptionalHeaderGet the minor version number of the subsystem.- Specified by:
getMinorSubsystemVersionin interfaceOptionalHeader- Returns:
-
getWin32VersionValue
public int getWin32VersionValue()Description copied from interface:OptionalHeaderThis value is reserved, and must be 0- Specified by:
getWin32VersionValuein interfaceOptionalHeader
-
getChecksum
public int getChecksum()Description copied from interface:OptionalHeaderGet the image file checksum.- Specified by:
getChecksumin interfaceOptionalHeader- Returns:
-
getSubsystem
public int getSubsystem()Description copied from interface:OptionalHeaderGet the subsystem that is required to run this image.- Specified by:
getSubsystemin interfaceOptionalHeader- Returns:
-
getDllCharacteristics
public short getDllCharacteristics()Description copied from interface:OptionalHeaderReturn flags that describe properties of and features of this binary.- Specified by:
getDllCharacteristicsin interfaceOptionalHeader- Returns:
- See Also:
-
getSizeOfStackReserve
public long getSizeOfStackReserve()Description copied from interface:OptionalHeaderReturn the size of the stack reservation- Specified by:
getSizeOfStackReservein interfaceOptionalHeader- Returns:
-
getSizeOfStackCommit
public long getSizeOfStackCommit()Description copied from interface:OptionalHeaderReturn the size of the stack to commit- Specified by:
getSizeOfStackCommitin interfaceOptionalHeader- Returns:
-
getSizeOfHeapReserve
public long getSizeOfHeapReserve()Description copied from interface:OptionalHeaderReturn the size of the heap reservation- Specified by:
getSizeOfHeapReservein interfaceOptionalHeader- Returns:
-
getSizeOfHeapCommit
public long getSizeOfHeapCommit()Description copied from interface:OptionalHeaderReturn the size of the heap to commit- Specified by:
getSizeOfHeapCommitin interfaceOptionalHeader- Returns:
-
getLoaderFlags
public int getLoaderFlags()Description copied from interface:OptionalHeaderReturn the flags passed to the loader. Obsolete.- Specified by:
getLoaderFlagsin interfaceOptionalHeader- Returns:
-