Package ghidra.app.util.bin.format.pe
Class OptionalHeaderImpl
java.lang.Object
ghidra.app.util.bin.format.pe.OptionalHeaderImpl
- All Implemented Interfaces:
OptionalHeader
,StructConverter
typedef struct _IMAGE_OPTIONAL_HEADER { WORD Magic; // MANDATORY BYTE MajorLinkerVersion; BYTE MinorLinkerVersion; DWORD SizeOfCode; DWORD SizeOfInitializedData; DWORD SizeOfUninitializedData; DWORD AddressOfEntryPoint; // MANDATORY DWORD BaseOfCode; DWORD BaseOfData; DWORD ImageBase; // MANDATORY DWORD SectionAlignment; // MANDATORY DWORD FileAlignment; // MANDATORY WORD MajorOperatingSystemVersion; // MANDATORY WORD MinorOperatingSystemVersion; WORD MajorImageVersion; WORD MinorImageVersion; WORD MajorSubsystemVersion; WORD MinorSubsystemVersion; DWORD Win32VersionValue; DWORD SizeOfImage; // MANDATORY DWORD SizeOfHeaders; // MANDATORY DWORD CheckSum; WORD Subsystem; // MANDATORY WORD DllCharacteristics; DWORD SizeOfStackReserve; DWORD SizeOfStackCommit; DWORD SizeOfHeapReserve; DWORD SizeOfHeapCommit; DWORD LoaderFlags; DWORD NumberOfRvaAndSizes; // USED IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; };
typedef struct _IMAGE_OPTIONAL_HEADER64 { WORD Magic; BYTE MajorLinkerVersion; BYTE MinorLinkerVersion; DWORD SizeOfCode; DWORD SizeOfInitializedData; DWORD SizeOfUninitializedData; DWORD AddressOfEntryPoint; DWORD BaseOfCode; ULONGLONG ImageBase; DWORD SectionAlignment; DWORD FileAlignment; WORD MajorOperatingSystemVersion; WORD MinorOperatingSystemVersion; WORD MajorImageVersion; WORD MinorImageVersion; WORD MajorSubsystemVersion; WORD MinorSubsystemVersion; DWORD Win32VersionValue; DWORD SizeOfImage; DWORD SizeOfHeaders; DWORD CheckSum; WORD Subsystem; WORD DllCharacteristics; ULONGLONG SizeOfStackReserve; ULONGLONG SizeOfStackCommit; ULONGLONG SizeOfHeapReserve; ULONGLONG SizeOfHeapCommit; DWORD LoaderFlags; DWORD NumberOfRvaAndSizes; IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; };
-
Field Summary
Modifier and TypeFieldDescriptionprotected int
protected int
protected int
protected int
protected DataDirectory[]
protected short
protected int
protected long
protected int
protected short
protected short
protected byte
protected short
protected short
protected short
protected byte
protected short
protected short
protected NTHeader
protected int
protected BinaryReader
protected int
protected int
protected int
protected long
protected long
protected int
protected int
protected long
protected long
protected int
protected int
protected short
protected int
Fields inherited from interface ghidra.app.util.bin.format.pe.OptionalHeader
IMAGE_DIRECTORY_ENTRY_ARCHITECTURE, IMAGE_DIRECTORY_ENTRY_BASERELOC, IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT, IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR, IMAGE_DIRECTORY_ENTRY_COMHEADER, IMAGE_DIRECTORY_ENTRY_DEBUG, IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT, IMAGE_DIRECTORY_ENTRY_EXCEPTION, IMAGE_DIRECTORY_ENTRY_EXPORT, IMAGE_DIRECTORY_ENTRY_GLOBALPTR, IMAGE_DIRECTORY_ENTRY_IAT, IMAGE_DIRECTORY_ENTRY_IMPORT, IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG, IMAGE_DIRECTORY_ENTRY_RESOURCE, IMAGE_DIRECTORY_ENTRY_SECURITY, IMAGE_DIRECTORY_ENTRY_TLS, IMAGE_DLLCHARACTERISTICS_APPCONTAINER, IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE, IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY, IMAGE_DLLCHARACTERISTICS_GUARD_CF, IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA, IMAGE_DLLCHARACTERISTICS_NO_BIND, IMAGE_DLLCHARACTERISTICS_NO_ISOLATION, IMAGE_DLLCHARACTERISTICS_NO_SEH, IMAGE_DLLCHARACTERISTICS_NX_COMPAT, IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE, IMAGE_DLLCHARACTERISTICS_WDM_DRIVER, IMAGE_NUMBEROF_DIRECTORY_ENTRIES
-
Method Summary
Modifier and TypeMethodDescriptionlong
long
Returns the RVA of the first byte of code when loaded in memory.long
int
Get the image file checksum.Returns the array of data directories.short
Return flags that describe properties of and features of this binary.int
long
int
Return the flags passed to the loader.short
Get the major version number of the image.byte
Return the major version number of the linker that built this binary.short
Return the major version number of the required operating system.short
Get the major version number of the subsystem.short
Get the minor version number of the image.byte
Return the minor version number of the linker that built this binary.short
Return the minor version number of the required operating system.short
Get the minor version number of the subsystem.long
int
long
Returns the combined total size of all sections with theIMAGE_SCN_CNT_CODE
attribute.long
long
Return the size of the heap to commitlong
Return the size of the heap reservationlong
long
Returns the combined size of all initialized data sections.long
Return the size of the stack to commitlong
Return the size of the stack reservationlong
Returns the size of all sections with the uninitialized data attributes.int
Get the subsystem that is required to run this image.int
This value is reserved, and must be 0boolean
is64bit()
Returns true of this optional header is 64-bit.boolean
isCLI()
protected void
parse()
void
processDataDirectories
(TaskMonitor monitor) This methods tells this optional header to process its data directories.void
setSizeOfCode
(long size) void
setSizeOfHeaders
(long size) void
setSizeOfImage
(long size) void
setSizeOfInitializedData
(long size) void
setSizeOfUninitializedData
(long size) Returns a structure datatype representing the contents of the implementor of this interface.void
validateDataDirectories
(Program program) void
writeHeader
(RandomAccessFile raf, DataConverter dc) Writes this optional header to the specified random access file.
-
Field Details
-
magic
protected short magic -
majorLinkerVersion
protected byte majorLinkerVersion -
minorLinkerVersion
protected byte minorLinkerVersion -
sizeOfCode
protected int sizeOfCode -
sizeOfInitializedData
protected int sizeOfInitializedData -
sizeOfUninitializedData
protected int sizeOfUninitializedData -
addressOfEntryPoint
protected int addressOfEntryPoint -
baseOfCode
protected int baseOfCode -
baseOfData
protected int baseOfData -
imageBase
protected long imageBase -
sectionAlignment
protected int sectionAlignment -
fileAlignment
protected int fileAlignment -
majorOperatingSystemVersion
protected short majorOperatingSystemVersion -
minorOperatingSystemVersion
protected short minorOperatingSystemVersion -
majorImageVersion
protected short majorImageVersion -
minorImageVersion
protected short minorImageVersion -
majorSubsystemVersion
protected short majorSubsystemVersion -
minorSubsystemVersion
protected short minorSubsystemVersion -
win32VersionValue
protected int win32VersionValue -
sizeOfImage
protected int sizeOfImage -
sizeOfHeaders
protected int sizeOfHeaders -
checkSum
protected int checkSum -
subsystem
protected short subsystem -
dllCharacteristics
protected short dllCharacteristics -
sizeOfStackReserve
protected long sizeOfStackReserve -
sizeOfStackCommit
protected long sizeOfStackCommit -
sizeOfHeapReserve
protected long sizeOfHeapReserve -
sizeOfHeapCommit
protected long sizeOfHeapCommit -
loaderFlags
protected int loaderFlags -
numberOfRvaAndSizes
protected int numberOfRvaAndSizes -
dataDirectory
-
ntHeader
-
reader
-
startIndex
protected int startIndex
-
-
Method Details
-
is64bit
public boolean is64bit()Description copied from interface:OptionalHeader
Returns true of this optional header is 64-bit.- Specified by:
is64bit
in interfaceOptionalHeader
- Returns:
- true of this optional header is 64-bit
-
getImageBase
public long getImageBase()- Specified by:
getImageBase
in interfaceOptionalHeader
- Returns:
- the preferred load address of this file in memory
-
getAddressOfEntryPoint
public long getAddressOfEntryPoint()- Specified by:
getAddressOfEntryPoint
in interfaceOptionalHeader
- Returns:
- the RVA of the first code byte in the file that will be executed
-
getSizeOfCode
public long getSizeOfCode()Description copied from interface:OptionalHeader
Returns the combined total size of all sections with theIMAGE_SCN_CNT_CODE
attribute.- Specified by:
getSizeOfCode
in interfaceOptionalHeader
- Returns:
- the combined total size of all sections with
the
IMAGE_SCN_CNT_CODE
attribute.
-
setSizeOfCode
public void setSizeOfCode(long size) - Specified by:
setSizeOfCode
in interfaceOptionalHeader
- See Also:
-
getSizeOfInitializedData
public long getSizeOfInitializedData()Description copied from interface:OptionalHeader
Returns the combined size of all initialized data sections.- Specified by:
getSizeOfInitializedData
in interfaceOptionalHeader
- Returns:
- the combined size of all initialized data sections
-
setSizeOfInitializedData
public void setSizeOfInitializedData(long size) - Specified by:
setSizeOfInitializedData
in interfaceOptionalHeader
- See Also:
-
getSizeOfUninitializedData
public long getSizeOfUninitializedData()Description copied from interface:OptionalHeader
Returns the size of all sections with the uninitialized data attributes.- Specified by:
getSizeOfUninitializedData
in interfaceOptionalHeader
- Returns:
- the size of all sections with the uninitialized data attributes
-
setSizeOfUninitializedData
public void setSizeOfUninitializedData(long size) - Specified by:
setSizeOfUninitializedData
in interfaceOptionalHeader
- See Also:
-
getBaseOfCode
public long getBaseOfCode()Description copied from interface:OptionalHeader
Returns the RVA of the first byte of code when loaded in memory.- Specified by:
getBaseOfCode
in interfaceOptionalHeader
- Returns:
- the RVA of the first byte of code when loaded in memory
-
getBaseOfData
public long getBaseOfData()- Specified by:
getBaseOfData
in interfaceOptionalHeader
- Returns:
- the RVA of the first byte of data when loaded into memory
-
getSizeOfImage
public long getSizeOfImage()- Specified by:
getSizeOfImage
in interfaceOptionalHeader
- Returns:
- the RVA that would be assigned to the next section following the last section
-
setSizeOfImage
public void setSizeOfImage(long size) - Specified by:
setSizeOfImage
in interfaceOptionalHeader
- See Also:
-
getSizeOfHeaders
public long getSizeOfHeaders()- Specified by:
getSizeOfHeaders
in interfaceOptionalHeader
- Returns:
- the combined size of all headers
-
setSizeOfHeaders
public void setSizeOfHeaders(long size) - Specified by:
setSizeOfHeaders
in interfaceOptionalHeader
- See Also:
-
getNumberOfRvaAndSizes
public long getNumberOfRvaAndSizes()- Specified by:
getNumberOfRvaAndSizes
in interfaceOptionalHeader
-
getMajorOperatingSystemVersion
public short getMajorOperatingSystemVersion()Description copied from interface:OptionalHeader
Return the major version number of the required operating system.- Specified by:
getMajorOperatingSystemVersion
in interfaceOptionalHeader
- Returns:
-
getMinorOperatingSystemVersion
public short getMinorOperatingSystemVersion()Description copied from interface:OptionalHeader
Return the minor version number of the required operating system.- Specified by:
getMinorOperatingSystemVersion
in interfaceOptionalHeader
- Returns:
-
processDataDirectories
Description copied from interface:OptionalHeader
This methods tells this optional header to process its data directories.- Specified by:
processDataDirectories
in interfaceOptionalHeader
- Throws:
IOException
-
getDataDirectories
Description copied from interface:OptionalHeader
Returns the array of data directories.- Specified by:
getDataDirectories
in interfaceOptionalHeader
- Returns:
- the array of data directories
-
getSectionAlignment
public int getSectionAlignment()- Specified by:
getSectionAlignment
in interfaceOptionalHeader
- Returns:
- the section alignment
-
getFileAlignment
public int getFileAlignment()- Specified by:
getFileAlignment
in interfaceOptionalHeader
- Returns:
- the file alignment
-
parse
- Throws:
IOException
-
toDataType
Description copied from interface:StructConverter
Returns a structure datatype representing the contents of the implementor of this interface.For example, given:
class A { int foo; double bar; }
The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.
- Specified by:
toDataType
in interfaceStructConverter
- Returns:
- returns a structure datatype representing the implementor of this interface
- Throws:
DuplicateNameException
- when a datatype of the same name already exists- See Also:
-
writeHeader
Description copied from interface:OptionalHeader
Writes this optional header to the specified random access file.- Specified by:
writeHeader
in interfaceOptionalHeader
- Parameters:
raf
- the random access filedc
- the data converter- Throws:
IOException
-
validateDataDirectories
- Specified by:
validateDataDirectories
in interfaceOptionalHeader
-
isCLI
- Specified by:
isCLI
in interfaceOptionalHeader
- Returns:
- true if the PE uses predominantly CLI code; otherwise, false.
- Throws:
IOException
-
getMajorLinkerVersion
public byte getMajorLinkerVersion()Description copied from interface:OptionalHeader
Return the major version number of the linker that built this binary.- Specified by:
getMajorLinkerVersion
in interfaceOptionalHeader
- Returns:
-
getMinorLinkerVersion
public byte getMinorLinkerVersion()Description copied from interface:OptionalHeader
Return the minor version number of the linker that built this binary.- Specified by:
getMinorLinkerVersion
in interfaceOptionalHeader
- Returns:
-
getMajorImageVersion
public short getMajorImageVersion()Description copied from interface:OptionalHeader
Get the major version number of the image.- Specified by:
getMajorImageVersion
in interfaceOptionalHeader
- Returns:
-
getMinorImageVersion
public short getMinorImageVersion()Description copied from interface:OptionalHeader
Get the minor version number of the image.- Specified by:
getMinorImageVersion
in interfaceOptionalHeader
- Returns:
-
getMajorSubsystemVersion
public short getMajorSubsystemVersion()Description copied from interface:OptionalHeader
Get the major version number of the subsystem.- Specified by:
getMajorSubsystemVersion
in interfaceOptionalHeader
-
getMinorSubsystemVersion
public short getMinorSubsystemVersion()Description copied from interface:OptionalHeader
Get the minor version number of the subsystem.- Specified by:
getMinorSubsystemVersion
in interfaceOptionalHeader
- Returns:
-
getWin32VersionValue
public int getWin32VersionValue()Description copied from interface:OptionalHeader
This value is reserved, and must be 0- Specified by:
getWin32VersionValue
in interfaceOptionalHeader
-
getChecksum
public int getChecksum()Description copied from interface:OptionalHeader
Get the image file checksum.- Specified by:
getChecksum
in interfaceOptionalHeader
- Returns:
-
getSubsystem
public int getSubsystem()Description copied from interface:OptionalHeader
Get the subsystem that is required to run this image.- Specified by:
getSubsystem
in interfaceOptionalHeader
- Returns:
-
getDllCharacteristics
public short getDllCharacteristics()Description copied from interface:OptionalHeader
Return flags that describe properties of and features of this binary.- Specified by:
getDllCharacteristics
in interfaceOptionalHeader
- Returns:
- See Also:
-
getSizeOfStackReserve
public long getSizeOfStackReserve()Description copied from interface:OptionalHeader
Return the size of the stack reservation- Specified by:
getSizeOfStackReserve
in interfaceOptionalHeader
- Returns:
-
getSizeOfStackCommit
public long getSizeOfStackCommit()Description copied from interface:OptionalHeader
Return the size of the stack to commit- Specified by:
getSizeOfStackCommit
in interfaceOptionalHeader
- Returns:
-
getSizeOfHeapReserve
public long getSizeOfHeapReserve()Description copied from interface:OptionalHeader
Return the size of the heap reservation- Specified by:
getSizeOfHeapReserve
in interfaceOptionalHeader
- Returns:
-
getSizeOfHeapCommit
public long getSizeOfHeapCommit()Description copied from interface:OptionalHeader
Return the size of the heap to commit- Specified by:
getSizeOfHeapCommit
in interfaceOptionalHeader
- Returns:
-
getLoaderFlags
public int getLoaderFlags()Description copied from interface:OptionalHeader
Return the flags passed to the loader. Obsolete.- Specified by:
getLoaderFlags
in interfaceOptionalHeader
- Returns:
-