LIEF: Library to Instrument Executable Formats Version 0.15.0
Loading...
Searching...
No Matches
OptionalHeader.hpp
1/* Copyright 2017 - 2024 R. Thomas
2 * Copyright 2017 - 2024 Quarkslab
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16#ifndef LIEF_PE_OPTIONAL_HEADER_H
17#define LIEF_PE_OPTIONAL_HEADER_H
18#include <ostream>
19#include <vector>
20#include <cstdint>
21
22#include "LIEF/Object.hpp"
23#include "LIEF/visibility.h"
24
25#include "LIEF/enums.hpp"
26#include "LIEF/PE/enums.hpp"
27
28namespace LIEF {
29namespace PE {
30class Parser;
31
32namespace details {
33struct pe32_optional_header;
34struct pe64_optional_header;
35}
36
38class LIEF_API OptionalHeader : public Object {
39 friend class Parser;
40 public:
41
42 enum class DLL_CHARACTERISTICS: size_t {
43 HIGH_ENTROPY_VA = 0x0020,
44 DYNAMIC_BASE = 0x0040,
45 FORCE_INTEGRITY = 0x0080,
46 NX_COMPAT = 0x0100,
47 NO_ISOLATION = 0x0200,
48 NO_SEH = 0x0400,
49 NO_BIND = 0x0800,
50 APPCONTAINER = 0x1000,
51 WDM_DRIVER = 0x2000,
52 GUARD_CF = 0x4000,
53 TERMINAL_SERVER_AWARE = 0x8000
54 };
55
56 enum class SUBSYSTEM: size_t {
57 UNKNOWN = 0,
58 NATIVE = 1,
59 WINDOWS_GUI = 2,
60 WINDOWS_CUI = 3,
61 OS2_CUI = 5,
62 POSIX_CUI = 7,
63 NATIVE_WINDOWS = 8,
64 WINDOWS_CE_GUI = 9,
65 EFI_APPLICATION = 10,
66 EFI_BOOT_SERVICE_DRIVER = 11,
67 EFI_RUNTIME_DRIVER = 12,
68 EFI_ROM = 13,
69 XBOX = 14,
70 WINDOWS_BOOT_APPLICATION = 16
71 };
72
73 OptionalHeader(const details::pe32_optional_header& header);
74 OptionalHeader(const details::pe64_optional_header& header);
75 ~OptionalHeader() override;
76
77 OptionalHeader& operator=(const OptionalHeader&);
79
80 static OptionalHeader create(PE_TYPE type);
81
83 PE_TYPE magic() const {
84 return magic_;
85 }
86
88 uint8_t major_linker_version() const {
89 return major_linker_version_;
90 }
91
93 uint8_t minor_linker_version() const {
94 return minor_linker_version_;
95 }
96
99 uint32_t sizeof_code() const {
100 return sizeof_code_;
101 }
102
108 uint32_t sizeof_initialized_data() const {
109 return sizeof_initialized_data_;
110 }
111
117 uint32_t sizeof_uninitialized_data() const {
118 return sizeof_uninitialized_data_;
119 }
120
126 uint32_t addressof_entrypoint() const {
127 return entrypoint_;
128 }
129
131 uint32_t baseof_code() const {
132 return baseof_code_;
133 }
134
138 uint32_t baseof_data() const {
139 return baseof_data_;
140 }
141
143 uint64_t imagebase() const {
144 return imagebase_;
145 }
146
151 uint32_t section_alignment() const {
152 return section_align_;
153 }
154
157 uint32_t file_alignment() const {
158 return file_align_;
159 }
160
163 return major_os_version_;
164 }
165
168 return minor_os_version_;
169 }
170
172 uint16_t major_image_version() const {
173 return major_image_version_;
174 }
175
177 uint16_t minor_image_version() const {
178 return minor_image_version_;
179 }
180
182 uint16_t major_subsystem_version() const {
183 return major_subsys_version_;
184 }
185
187 uint16_t minor_subsystem_version() const {
188 return minor_subsys_version_;
189 }
190
193 uint32_t win32_version_value() const {
194 return win32_version_value_;
195 }
196
200 uint32_t sizeof_image() const {
201 return sizeof_image_;
202 }
203
205 uint32_t sizeof_headers() const {
206 return sizeof_headers_;
207 }
208
213 uint32_t checksum() const {
214 return checksum_;
215 }
216
222 uint32_t computed_checksum() const {
223 return computed_checksum_;
224 }
225
228 return subsystem_;
229 }
230
231
235 uint32_t dll_characteristics() const {
236 return dll_characteristics_;
237 }
238
243 uint64_t sizeof_stack_reserve() const {
244 return sizeof_stack_reserve_;
245 }
246
248 uint64_t sizeof_stack_commit() const {
249 return sizeof_stack_commit_;
250 }
251
253 uint64_t sizeof_heap_reserve() const {
254 return sizeof_heap_reserve_;
255 }
256
258 uint64_t sizeof_heap_commit() const {
259 return sizeof_heap_commit_;
260 }
261
263 uint32_t loader_flags() const {
264 return loader_flags_;
265 }
266
268 uint32_t numberof_rva_and_size() const {
269 return nb_rva_size_;
270 }
271
274
276 std::vector<DLL_CHARACTERISTICS> dll_characteristics_list() const;
277
280
283
284 void magic(PE_TYPE magic) {
285 magic_ = magic;
286 }
287
288 void major_linker_version(uint8_t value) {
289 major_linker_version_ = value;
290 }
291
292 void minor_linker_version(uint8_t value) {
293 minor_linker_version_ = value;
294 }
295
296 void sizeof_code(uint32_t value) {
297 sizeof_code_ = value;
298 }
299
300 void sizeof_initialized_data(uint32_t value) {
301 sizeof_initialized_data_ = value;
302 }
303
304 void sizeof_uninitialized_data(uint32_t value) {
305 sizeof_uninitialized_data_ = value;
306 }
307
308 void addressof_entrypoint(uint32_t value) {
309 entrypoint_ = value;
310 }
311
312 void baseof_code(uint32_t value) {
313 baseof_code_ = value;
314 }
315
316 void baseof_data(uint32_t value) {
317 baseof_data_ = value;
318 }
319
320 void imagebase(uint64_t value) {
321 imagebase_ = value;
322 }
323
324 void section_alignment(uint32_t value) {
325 section_align_ = value;
326 }
327
328 void file_alignment(uint32_t value) {
329 file_align_ = value;
330 }
331
332 void major_operating_system_version(uint16_t value) {
333 major_os_version_ = value;
334 }
335
336 void minor_operating_system_version(uint16_t value) {
337 minor_os_version_ = value;
338 }
339
340 void major_image_version(uint16_t value) {
341 major_image_version_ = value;
342 }
343
344 void minor_image_version(uint16_t value) {
345 minor_image_version_ = value;
346 }
347
348 void major_subsystem_version(uint16_t value) {
349 major_subsys_version_ = value;
350 }
351
352 void minor_subsystem_version(uint16_t value) {
353 minor_subsys_version_ = value;
354 }
355
356 void win32_version_value(uint32_t value) {
357 win32_version_value_ = value;
358 }
359
360 void sizeof_image(uint32_t value) {
361 sizeof_image_ = value;
362 }
363
364 void sizeof_headers(uint32_t value) {
365 sizeof_headers_ = value;
366 }
367
368 void checksum(uint32_t value) {
369 checksum_ = value;
370 }
371
372 void subsystem(SUBSYSTEM value) {
373 subsystem_ = value;
374 }
375
376 void dll_characteristics(uint32_t value) {
377 dll_characteristics_ = value;
378 }
379
380 void sizeof_stack_reserve(uint64_t value) {
381 sizeof_stack_reserve_ = value;
382 }
383
384 void sizeof_stack_commit(uint64_t value) {
385 sizeof_stack_commit_ = value;
386 }
387
388 void sizeof_heap_reserve(uint64_t value) {
389 sizeof_heap_reserve_ = value;
390 }
391
392 void sizeof_heap_commit(uint64_t value) {
393 sizeof_heap_commit_ = value;
394 }
395
396 void loader_flags(uint32_t value) {
397 loader_flags_ = value;
398 }
399
400 void numberof_rva_and_size(uint32_t value) {
401 nb_rva_size_ = value;
402 }
403
404 void accept(Visitor& visitor) const override;
405
406 OptionalHeader& operator+=(DLL_CHARACTERISTICS c);
407 OptionalHeader& operator-=(DLL_CHARACTERISTICS c);
408
409 LIEF_API friend std::ostream& operator<<(std::ostream& os, const OptionalHeader& entry);
410
411 private:
412 OptionalHeader();
413
414 PE_TYPE magic_ = PE_TYPE::PE32;
415 uint8_t major_linker_version_ = 0;
416 uint8_t minor_linker_version_ = 0;
417 uint32_t sizeof_code_ = 0;
418 uint32_t sizeof_initialized_data_ = 0;
419 uint32_t sizeof_uninitialized_data_ = 0;
420 uint32_t entrypoint_ = 0;
421 uint32_t baseof_code_ = 0;
422 uint32_t baseof_data_ = 0;
423 uint64_t imagebase_ = 0;
424 uint32_t section_align_ = 0;
425 uint32_t file_align_ = 0;
426 uint16_t major_os_version_ = 0;
427 uint16_t minor_os_version_ = 0;
428 uint16_t major_image_version_ = 0;
429 uint16_t minor_image_version_ = 0;
430 uint16_t major_subsys_version_ = 0;
431 uint16_t minor_subsys_version_ = 0;
432 uint32_t win32_version_value_ = 0;
433 uint32_t sizeof_image_ = 0;
434 uint32_t sizeof_headers_ = 0;
435 uint32_t checksum_ = 0;
436 SUBSYSTEM subsystem_ = SUBSYSTEM::UNKNOWN;
437 uint32_t dll_characteristics_ = 0;
438 uint64_t sizeof_stack_reserve_ = 0;
439 uint64_t sizeof_stack_commit_ = 0;
440 uint64_t sizeof_heap_reserve_ = 0;
441 uint64_t sizeof_heap_commit_ = 0;
442 uint32_t loader_flags_ = 0;
443 uint32_t nb_rva_size_ = 0;
444
445 uint32_t computed_checksum_ = 0;
446};
447
448LIEF_API const char* to_string(OptionalHeader::DLL_CHARACTERISTICS);
449LIEF_API const char* to_string(OptionalHeader::SUBSYSTEM);
450
451}
452}
453
455
456#endif
Definition Object.hpp:25
Class which represents the PE OptionalHeader structure.
Definition OptionalHeader.hpp:38
DLL_CHARACTERISTICS
Definition OptionalHeader.hpp:42
uint16_t major_image_version() const
The major version number of the image.
Definition OptionalHeader.hpp:172
uint16_t minor_subsystem_version() const
The minor version number of the subsystem.
Definition OptionalHeader.hpp:187
SUBSYSTEM
Definition OptionalHeader.hpp:56
uint32_t numberof_rva_and_size() const
The number of DataDirectory that follow this header.
Definition OptionalHeader.hpp:268
uint32_t sizeof_uninitialized_data() const
The size of the uninitialized data which are usually located in the .bss section. If the uninitialize...
Definition OptionalHeader.hpp:117
std::vector< DLL_CHARACTERISTICS > dll_characteristics_list() const
Return the list of the dll_characteristics as an std::set of DLL_CHARACTERISTICS.
uint64_t sizeof_stack_commit() const
Size of the stack to commit.
Definition OptionalHeader.hpp:248
bool has(DLL_CHARACTERISTICS c) const
Check if the given DLL_CHARACTERISTICS is included in the dll_characteristics.
uint8_t minor_linker_version() const
The linker minor version.
Definition OptionalHeader.hpp:93
uint8_t major_linker_version() const
The linker major version.
Definition OptionalHeader.hpp:88
uint32_t sizeof_headers() const
Size of the DosHeader + PE Header + Section headers rounded up to a multiple of the file_alignment.
Definition OptionalHeader.hpp:205
void remove(DLL_CHARACTERISTICS c)
Remove a DLL_CHARACTERISTICS from the current characteristics.
uint16_t major_operating_system_version() const
The major version number of the required operating system.
Definition OptionalHeader.hpp:162
uint32_t win32_version_value() const
According to the official PE specifications, this value is reserved and should be 0.
Definition OptionalHeader.hpp:193
uint64_t sizeof_heap_commit() const
Size of the heap to commit.
Definition OptionalHeader.hpp:258
uint32_t sizeof_image() const
The size (in bytes) of the image, including all headers, as the image is loaded in memory.
Definition OptionalHeader.hpp:200
uint64_t imagebase() const
The preferred base address when mapping the binary in memory.
Definition OptionalHeader.hpp:143
uint32_t baseof_data() const
Address relative to the imagebase where the binary's data starts.
Definition OptionalHeader.hpp:138
uint32_t section_alignment() const
The alignment (in bytes) of sections when they are loaded into memory.
Definition OptionalHeader.hpp:151
uint32_t sizeof_code() const
The size of the code .text section or the sum of all the sections that contain code (ie....
Definition OptionalHeader.hpp:99
uint16_t minor_operating_system_version() const
The minor version number of the required operating system.
Definition OptionalHeader.hpp:167
uint16_t major_subsystem_version() const
The major version number of the subsystem.
Definition OptionalHeader.hpp:182
uint32_t loader_flags() const
According to the PE specifications, this value is reserved and should be 0.
Definition OptionalHeader.hpp:263
SUBSYSTEM subsystem() const
Target subsystem like Driver, XBox, Windows GUI, ...
Definition OptionalHeader.hpp:227
uint32_t file_alignment() const
The section's file alignment. This value must be a power of 2 between 512 and 64K....
Definition OptionalHeader.hpp:157
uint32_t baseof_code() const
Address relative to the imagebase where the binary's code starts.
Definition OptionalHeader.hpp:131
uint64_t sizeof_stack_reserve() const
Size of the stack to reserve when loading the PE binary.
Definition OptionalHeader.hpp:243
uint32_t sizeof_initialized_data() const
The size of the initialized data which are usually located in the .data section. If the initialized d...
Definition OptionalHeader.hpp:108
uint32_t dll_characteristics() const
Some characteristics of the underlying binary like the support of the PIE. The prefix dll comes from ...
Definition OptionalHeader.hpp:235
uint32_t checksum() const
The image file checksum. The algorithm for computing the checksum is incorporated into IMAGHELP....
Definition OptionalHeader.hpp:213
uint16_t minor_image_version() const
The minor version number of the image.
Definition OptionalHeader.hpp:177
uint32_t addressof_entrypoint() const
The address of the entry point relative to the image base when the executable file is loaded into mem...
Definition OptionalHeader.hpp:126
void add(DLL_CHARACTERISTICS c)
Add a DLL_CHARACTERISTICS to the current characteristics.
uint64_t sizeof_heap_reserve() const
Size of the heap to reserve when loading the PE binary.
Definition OptionalHeader.hpp:253
PE_TYPE magic() const
Magic bytes: either PE32 or PE32+ for 64-bits PE files.
Definition OptionalHeader.hpp:83
uint32_t computed_checksum() const
The re-computed value of the OptionalHeader::checksum. If both values do not match,...
Definition OptionalHeader.hpp:222
Main interface to parse PE binaries. In particular the static functions: Parser::parse should be used...
Definition PE/Parser.hpp:47
PE_TYPE
Definition PE/enums.hpp:680
LIEF namespace.
Definition Abstract/Binary.hpp:32