Package ghidra.app.util.bin.format.pe
package ghidra.app.util.bin.format.pe
-
ClassDescriptionA class to represent the
IMAGE_BASE_RELOCATIONdata structure defined inwinnt.h.Points to the base relocation information.Points to an array of IMAGE_BOUND_IMPORT_DESCRIPTORs.A class to represent theIMAGE_BOUND_IMPORT_DESCRIPTORdata structure defined inwinnt.h.A class to represent theIMAGE_BOUND_FORWARDER_REFdata structure defined inwinnt.h.This value has been renamed to IMAGE_DIRECTORY_ENTRY_COMHEADER.Constants used in the data structures of the PE.ControlFlowGuard is a platform security feature that was created to combat memory corruption vulnerabilities.An abstract base class to represent theIMAGE_DATA_DIRECTORYdata structure defined inwinnt.h.Points to an array of IMAGE_DEBUG_DIRECTORY structures.Points to the delayload information.A class to represent theImgDelayDescrdata structure defined inDELAYIMP.H.A class to represent theIMAGE_EXPORT_DIRECTORYdata structure defined inwinnt.h.A class to hold the information extracted from a export data directory.A class to represent the IMAGE_FILE_HEADER struct as defined inwinnt.h.typedef struct IMAGE_COR20_HEADER { // Header versioning DWORD cb; // Size of the structure WORD MajorRuntimeVersion; // Version of the CLR Runtime WORD MinorRuntimeVersion; // Version of the CLR Runtime // Symbol table and startup information IMAGE_DATA_DIRECTORY MetaData; // A Data Directory giving RVA and Size of MetaData DWORD Flags; union { DWORD EntryPointRVA; // Points to the .NET native EntryPoint method DWORD EntryPointToken; // Points to the .NET IL EntryPoint method }; // Binding information IMAGE_DATA_DIRECTORY Resources; // A Data Directory for Resources, which are referenced in the MetaData IMAGE_DATA_DIRECTORY StrongNameSignature; // A Data Directory for unique .NET assembly signatures // Regular fixup and binding information IMAGE_DATA_DIRECTORY CodeManagerTable; // Always 0 IMAGE_DATA_DIRECTORY VTableFixups; // Not well documented VTable used by languages who don't follow the common type system runtime model IMAGE_DATA_DIRECTORY ExportAddressTableJumps; // Always 0 in normal .NET assemblies, only present in native images // Precompiled image info (internal use only - set to zero) IMAGE_DATA_DIRECTORY ManagedNativeHeader; };Data type forImageCor20Header.flags.An interface for working with function table entries used for exception handling, which are found in the .pdata section.typedef struct _IMAGE_ARM_RUNTIME_FUNCTION_ENTRY { DWORD BeginAddress; union { DWORD UnwindData; struct { DWORD Flag : 2; DWORD FunctionLength : 11; DWORD Ret : 2; DWORD H : 1; DWORD Reg : 3; DWORD R : 1; DWORD L : 1; DWORD C : 1; DWORD StackAdjust : 10; } DUMMYSTRUCTNAME; } DUMMYUNIONNAME; } IMAGE_ARM_RUNTIME_FUNCTION_ENTRY, * PIMAGE_ARM_RUNTIME_FUNCTION_ENTRY;typedef struct _IMAGE_RUNTIME_FUNCTION_ENTRY { DWORD BeginAddress; DWORD EndAddress; union { DWORD UnwindInfoAddress; DWORD UnwindData; } DUMMYUNIONNAME; } RUNTIME_FUNCTION, *PRUNTIME_FUNCTION, _IMAGE_RUNTIME_FUNCTION_ENTRY, *_PIMAGE_RUNTIME_FUNCTION_ENTRY; #define UNW_FLAG_NHANDLER 0x0 #define UNW_FLAG_EHANDLER 0x1 #define UNW_FLAG_UHANDLER 0x2 #define UNW_FLAG_CHAININFO 0x4 typedef struct _UNWIND_INFO { UCHAR Version : 3; UCHAR Flags : 5; UCHAR SizeOfProlog; UCHAR CountOfUnwindCodes; UCHAR FrameRegister : 4; UCHAR FrameOffset : 4; UNWIND_CODE UnwindCode[1]; // // The unwind codes are followed by an optional DWORD aligned field that // contains the exception handler address or the address of chained unwind // information.A class to represent theIMAGE_IMPORT_BY_NAMEdata structure defined inwinnt.h.Points to the imports (an array of IMAGE_IMPORT_DESCRIPTOR structures).typedef struct _IMAGE_IMPORT_DESCRIPTOR { union { DWORD Characteristics; // 0 for terminating null import descriptor DWORD OriginalFirstThunk; // RVA to original unbound IAT (PIMAGE_THUNK_DATA) }; DWORD TimeDateStamp; DWORD ForwarderChain; // -1 if no forwarders DWORD Name; DWORD FirstThunk; // RVA to IAT (if bound this IAT has actual addresses) }An exception class to handle encountering invalid NT Headers.A class to represent theIMAGE_LOAD_CONFIG_DIRECTORYdata structure which is defined inwinnt.h.PE machine ID constants defined by standard header file 'ntimage.h'A class to represent theIMAGE_NT_HEADERS32and IMAGE_NT_HEADERS64 structs as defined inwinnt.h.typedef struct _IMAGE_OPTIONAL_HEADER { WORD Magic; // MANDATORY BYTE MajorLinkerVersion; BYTE MinorLinkerVersion; DWORD SizeOfCode; DWORD SizeOfInitializedData; DWORD SizeOfUninitializedData; DWORD AddressOfEntryPoint; // MANDATORY DWORD BaseOfCode; DWORD BaseOfData; DWORD ImageBase; // MANDATORY DWORD SectionAlignment; // MANDATORY DWORD FileAlignment; // MANDATORY WORD MajorOperatingSystemVersion; // MANDATORY WORD MinorOperatingSystemVersion; WORD MajorImageVersion; WORD MinorImageVersion; WORD MajorSubsystemVersion; WORD MinorSubsystemVersion; DWORD Win32VersionValue; DWORD SizeOfImage; // MANDATORY DWORD SizeOfHeaders; // MANDATORY DWORD CheckSum; WORD Subsystem; // MANDATORY WORD DllCharacteristics; DWORD SizeOfStackReserve; DWORD SizeOfStackCommit; DWORD SizeOfHeapReserve; DWORD SizeOfHeapCommit; DWORD LoaderFlags; DWORD NumberOfRvaAndSizes; // USED IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; };A class to represent the IMAGE_ROM_OPTIONAL_HEADER data structure.Common interface for standardizing the markup of a PE structure.A class to manage loading Portable Executables (PE).Indicates how sections of this PE are laid out in the underlying ByteProvider.Points to the root resource directory.The "Rich" header contains encoded metadata about the tool chain used to generate the binary.Top level object model of theRichHeader.A class to the represent the IMAGE_SECTION_HEADER struct as defined inwinnt.h.A class to represent theWIN_CERTIFICATEstruct as defined inwinbase.h.typedef struct _IMAGE_SEPARATE_DEBUG_HEADER { WORD Signature; WORD Flags; WORD Machine; WORD Characteristics; DWORD TimeDateStamp; DWORD CheckSum; DWORD ImageBase; DWORD SizeOfImage; DWORD NumberOfSections; DWORD ExportedNamesSize; DWORD DebugDirectorySize; DWORD SectionAlignment; DWORD Reserved[2]; } IMAGE_SEPARATE_DEBUG_HEADER, *PIMAGE_SEPARATE_DEBUG_HEADER;A class to represent theIMAGE_THUNK_DATA32 structas defined inwinnt.h.Points to the Thread Local Storage initialization section.A class to represent the IMAGE_TLS_DIRECTORY32 and IMAGE_TLS_DIRECTORY64 data structures.