Package ghidra.app.util.bin.format.pe

Class ThunkData

java.lang.Object
ghidra.app.util.bin.format.pe.ThunkData
All Implemented Interfaces:
ByteArrayConverter, StructConverter
public class ThunkData extends Object implements StructConverter, ByteArrayConverter
A class to represent the IMAGE_THUNK_DATA32 struct as defined in winnt.h. 
 typedef struct _IMAGE_THUNK_DATA32 {
     union {
         DWORD ForwarderString;  // PBYTE
         DWORD Function;         // PDWORD
         DWORD Ordinal;
         DWORD AddressOfData;    // PIMAGE_IMPORT_BY_NAME
     } u1;
 } IMAGE_THUNK_DATA32;
 typedef IMAGE_THUNK_DATA32 * PIMAGE_THUNK_DATA32;
 
 typedef struct _IMAGE_THUNK_DATA64 {
     union {
         PBYTE  ForwarderString;
         PDWORD Function;
         ULONGLONG Ordinal;
         PIMAGE_IMPORT_BY_NAME  AddressOfData;
     } u1;
 } IMAGE_THUNK_DATA64;
 typedef IMAGE_THUNK_DATA64 * PIMAGE_THUNK_DATA64;

  • Constructor Details

    • ThunkData

      public ThunkData(int value)
      Constructs a new thunk data with the specified value
      Parameters:
      value - the new thunk value

  • Method Details

    • getStructSize

      public int getStructSize()
      Returns the size of the thunk (in bytes) based on the size of the executable (32 vs 64 bit).
      Returns:
      the size of the thunk (in bytes)

    • getStructName

      public String getStructName()
      Returns the struct name.
      Returns:
      the struct name

    • setValue

      public void setValue(int value)
      Sets the value of the thunk.
      Parameters:
      value - the new thunk value

    • getForwarderString

      public long getForwarderString()
      Returns the forward string pointer.
      Returns:
      the forward string pointer

    • getFunction

      public long getFunction()
      Returns the function pointer.
      Returns:
      the function pointer

    • getOrdinal

      public long getOrdinal()
      Returns the ordinal.
      Returns:
      the ordinal

    • isOrdinal

      public boolean isOrdinal()

    • getAddressOfData

      public long getAddressOfData()
      Returns the address of the data.
      Returns:
      the address of the data

    • getImportByName

      public ImportByName getImportByName()
      Returns the underlying import by name structure.
      Returns:
      the underlying import by name structure

    • toDataType

      public DataType toDataType() throws DuplicateNameException
      Description copied from interface: StructConverter
      Returns a structure datatype representing the contents of the implementor of this interface.

      For example, given: 

       class A {
     int foo;
     double bar;
 }

      The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.

      Specified by:
      toDataType in interface StructConverter
      Returns:
      returns a structure datatype representing the implementor of this interface
      Throws:
      DuplicateNameException - when a datatype of the same name already exists
      See Also:

    • toBytes

      public byte[] toBytes(DataConverter dc)
      Description copied from interface: ByteArrayConverter
      Returns a byte array representing this implementor of this interface.
      Specified by:
      toBytes in interface ByteArrayConverter
      Parameters:
      dc - the data converter to use
      Returns:
      a byte array representing this object