Package ghidra.app.util.bin.format.pe

Class PortableExecutable

java.lang.Object

ghidra.app.util.bin.format.pe.PortableExecutable

public class PortableExecutable
extends Object

A class to manage loading Portable Executables (PE).

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static enum	PortableExecutable.SectionLayout	Indicates how sections of this PE are laid out in the underlying ByteProvider.

Field Summary

Fields

Modifier and Type	Field	Description
static boolean	DEBUG
static final String	NAME

Constructor Summary

Constructors

Constructor	Description
PortableExecutable(ByteProvider bp, PortableExecutable.SectionLayout layout)	Constructs a new Portable Executable using the specified byte provider and layout.
PortableExecutable(ByteProvider bp, PortableExecutable.SectionLayout layout, boolean advancedProcess, boolean parseCliHeaders)	Constructs a new Portable Executable using the specified byte provider and layout.

Method Summary

Modifier and Type	Method	Description
static int	computeAlignment(int value, int alignment)
DOSHeader	getDOSHeader()	Returns the DOS header from the PE image.
long	getFileLength()
NTHeader	getNTHeader()	Returns the NT header from the PE image.
RichHeader	getRichHeader()	Returns the Rich header from the PE image.
void	writeHeader(RandomAccessFile raf, DataConverter dc)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

NAME

public static final String NAME

See Also:

• Constant Field Values

DEBUG

public static boolean DEBUG

Constructor Details

PortableExecutable

public PortableExecutable(ByteProvider bp,
 PortableExecutable.SectionLayout layout)
                   throws IOException

Constructs a new Portable Executable using the specified byte provider and layout.

Same as calling createFileAlignedPortableExecutable(factory, bp, layout, true, false)

Parameters:

bp - the byte provider

layout - specifies the layout of the underlying provider and governs RVA resolution

Throws:

IOException - if an I/O error occurs.

See Also:

• PortableExecutable(ByteProvider, SectionLayout, boolean, boolean)

PortableExecutable

public PortableExecutable(ByteProvider bp,
 PortableExecutable.SectionLayout layout,
 boolean advancedProcess,
 boolean parseCliHeaders)
                   throws IOException

Constructs a new Portable Executable using the specified byte provider and layout.

Parameters:

bp - the byte provider

layout - specifies the layout of the underlying provider and governs RVA resolution

advancedProcess - if true, the data directories are also processed

parseCliHeaders - if true, CLI headers are parsed (if present)

Throws:

IOException - if an I/O error occurs.

Method Details

getDOSHeader

public DOSHeader getDOSHeader()

Returns the DOS header from the PE image.

Returns:

the DOS header from the PE image

getRichHeader

public RichHeader getRichHeader()

Returns the Rich header from the PE image.

Returns:

the Rich header from the PE image

getNTHeader

public NTHeader getNTHeader()

Returns the NT header from the PE image.

Returns:

the NT header from the PE image

writeHeader

public void writeHeader(RandomAccessFile raf,
 DataConverter dc)
                 throws IOException

Throws:

IOException

computeAlignment

public static int computeAlignment(int value,
 int alignment)

getFileLength

public long getFileLength()