16#ifndef LIEF_PE_BINARY_H
17#define LIEF_PE_BINARY_H
21#include "LIEF/PE/Header.hpp"
22#include "LIEF/PE/OptionalHeader.hpp"
23#include "LIEF/PE/DosHeader.hpp"
24#include "LIEF/PE/Import.hpp"
25#include "LIEF/PE/DelayImport.hpp"
26#include "LIEF/PE/Symbol.hpp"
27#include "LIEF/PE/DataDirectory.hpp"
28#include "LIEF/PE/ResourcesManager.hpp"
29#include "LIEF/PE/signature/Signature.hpp"
31#include "LIEF/Abstract/Binary.hpp"
33#include "LIEF/visibility.h"
43class LoadConfiguration;
47class ResourceDirectory;
60 using sections_t = std::vector<std::unique_ptr<Section>>;
169 return optional_header().imagebase();
176 const Section* section_from_offset(uint64_t offset)
const;
182 const Section* section_from_rva(uint64_t virtual_address)
const;
189 it_const_sections sections()
const {
207 const Header& header()
const {
213 return optional_header_;
217 return optional_header_;
232 const TLS* tls()
const {
241 return tls_ !=
nullptr;
248 return !imports_.empty();
255 return !signatures_.empty();
262 return export_ !=
nullptr;
267 return resources_ !=
nullptr;
277 return !relocations_.empty();
282 return !debug_.empty();
287 return load_configuration_ !=
nullptr;
300 it_signatures signatures() {
346 return export_.get();
349 const Export* get_export()
const {
350 return export_.get();
355 const std::vector<Symbol>& symbols()
const;
359 return resources_.get();
363 return resources_.get();
380 const Section* get_section(
const std::string& name)
const;
408 it_const_relocations relocations()
const {
420 return data_directories_;
423 it_const_data_directories data_directories()
const {
424 return data_directories_;
429 const DataDirectory* data_directory(DataDirectory::TYPES type)
const;
432 bool has(DataDirectory::TYPES type)
const {
433 return data_directory(type) !=
nullptr;
441 it_const_debug_entries debug()
const {
451 return load_configuration_.get();
455 return load_configuration_.get();
463 span<uint8_t> overlay() {
469 return overlay_offset_;
477 span<uint8_t> dos_stub() {
482 void dos_stub(
const std::vector<uint8_t>& content);
489 return rich_header_.get();
493 return rich_header_.get();
501 return rich_header_ !=
nullptr;
509 it_const_imports imports()
const {
518 const Import* get_import(
const std::string& import_name)
const;
524 return get_import(import_name) !=
nullptr;
532 return !delay_imports_.empty();
537 return delay_imports_;
540 it_const_delay_imports delay_imports()
const {
541 return delay_imports_;
549 const DelayImport* get_delay_import(
const std::string& import_name)
const;
556 return get_delay_import(import_name) !=
nullptr;
580 void write(
const std::string& filename)
override;
586 void write(std::ostream& os)
override;
595 void patch_address(uint64_t address,
const std::vector<uint8_t>& patch_value,
605 void patch_address(uint64_t address, uint64_t patch_value,
size_t size =
sizeof(uint64_t),
614 uint64_t virtual_address, uint64_t size,
638 return bin->
format() == Binary::FORMATS::PE;
641 std::ostream& print(std::ostream& os)
const override;
648 void make_space_for_new_section();
660 LIEF::Binary::functions_t get_abstract_exported_functions()
const override;
661 LIEF::Binary::functions_t get_abstract_imported_functions()
const override;
662 std::vector<std::string> get_abstract_imported_libraries()
const override;
664 void update_lookup_address_table_offset();
667 PE_TYPE type_ = PE_TYPE::PE32_PLUS;
672 int32_t available_sections_space_ = 0;
674 signatures_t signatures_;
675 sections_t sections_;
676 data_directories_t data_directories_;
678 strings_table_t strings_table_;
679 relocations_t relocations_;
681 delay_imports_t delay_imports_;
682 debug_entries_t debug_;
683 uint64_t overlay_offset_ = 0;
684 std::vector<uint8_t> overlay_;
685 std::vector<uint8_t> dos_stub_;
686 std::vector<uint8_t> section_offset_padding_;
688 std::unique_ptr<RichHeader> rich_header_;
689 std::unique_ptr<Export> export_;
690 std::unique_ptr<ResourceNode> resources_;
691 std::unique_ptr<TLS> tls_;
692 std::unique_ptr<LoadConfiguration> load_configuration_;
Abstract binary that exposes an uniform API for the different executable file formats.
Definition Abstract/Binary.hpp:39
FORMATS format() const
Executable format (ELF, PE, Mach-O) of the underlying binary.
Definition Abstract/Binary.hpp:98
std::vector< Symbol * > symbols_t
Internal container.
Definition Abstract/Binary.hpp:69
VA_TYPES
Type of a virtual address.
Definition Abstract/Binary.hpp:43
@ AUTO
Try to guess if it's relative or not.
std::vector< Section * > sections_t
Internal container.
Definition Abstract/Binary.hpp:60
std::vector< Relocation * > relocations_t
Internal container.
Definition Abstract/Binary.hpp:78
Class which represents a PE binary This is the main interface to manage and modify a PE executable.
Definition PE/Binary.hpp:54
OptionalHeader & optional_header()
Return a reference to the OptionalHeader object.
Definition PE/Binary.hpp:212
void remove_all_relocations()
Remove all the relocations.
std::vector< DelayImport > delay_imports_t
Internal container for storing PE's DelayImport.
Definition PE/Binary.hpp:96
std::vector< uint8_t > authentihash(ALGORITHMS algo) const
Compute the authentihash according to the algorithm provided in the first parameter.
const LoadConfiguration * load_configuration() const
Retrun the LoadConfiguration object or a nullptr if the binary does not use the LoadConfiguration.
Definition PE/Binary.hpp:450
void remove_section(const std::string &name, bool clear=false) override
Delete the section with the given name.
bool is_pie() const override
Check if the binary is position independent.
LIEF::Binary::functions_t ctor_functions() const override
Return the list of the binary constructors.
std::vector< std::unique_ptr< Section > > sections_t
Internal container for storing PE's Section.
Definition PE/Binary.hpp:60
void set_resources(const ResourceDirectory &resource)
Set a new resource tree.
uint64_t va_to_offset(uint64_t VA)
Convert the absolute virtual address into an offset.
it_imports imports()
Return an iterator over the binary imports.
Definition PE/Binary.hpp:505
bool has_resources() const
Check if the current binary has resources.
Definition PE/Binary.hpp:266
uint32_t predict_function_rva(const std::string &library, const std::string &function)
Try to predict the RVA of the function function in the import library library
std::vector< Symbol > & symbols()
Return binary Symbols.
bool has_debug() const
Check if the current binary contains debug information.
Definition PE/Binary.hpp:281
DelayImport * get_delay_import(const std::string &import_name)
Returns the PE::DelayImport from the given name. If it can't be found, return a nullptr.
bool has_relocations() const
Check if the current binary has relocations.
Definition PE/Binary.hpp:276
ImportEntry * add_import_function(const std::string &library, const std::string &function)
Add the function function of the library library. If the function fails, it returns a nullptr.
bool has_exports() const
Check if the current binary has exports.
Definition PE/Binary.hpp:261
uint64_t virtual_size() const
Compute the binary's virtual size. It should match OptionalHeader::sizeof_image.
std::vector< std::unique_ptr< Relocation > > relocations_t
Internal container for storing PE's Relocation.
Definition PE/Binary.hpp:78
result< ResourcesManager > resources_manager() const
Return the ResourcesManager (class to manage resources more easily than the tree one)
result< uint64_t > offset_to_virtual_address(uint64_t offset, uint64_t slide=0) const override
Convert the given offset into a virtual address.
void patch_address(uint64_t address, uint64_t patch_value, size_t size=sizeof(uint64_t), LIEF::Binary::VA_TYPES addr_type=LIEF::Binary::VA_TYPES::AUTO) override
Patch the address with the given value.
Signature::VERIFICATION_FLAGS verify_signature(const Signature &sig, Signature::VERIFICATION_CHECKS checks=Signature::VERIFICATION_CHECKS::DEFAULT) const
Verify the binary with the Signature object provided in the first parameter It can be used to verify ...
span< const uint8_t > overlay() const
Return the overlay content.
Definition PE/Binary.hpp:459
span< const uint8_t > get_content_from_virtual_address(uint64_t virtual_address, uint64_t size, Binary::VA_TYPES addr_type=Binary::VA_TYPES::AUTO) const override
Return the content located at the provided virtual address.
std::vector< Symbol > symbols_t
Internal container for storing COFF Symbols.
Definition PE/Binary.hpp:114
Section * add_section(const Section §ion, PE_SECTION_TYPES type=PE_SECTION_TYPES::UNKNOWN)
Add a section to the binary and return the section added.
bool has_rich_header() const
Check if the current binary has a RichHeader object.
Definition PE/Binary.hpp:500
bool has_signatures() const
Check if the current binary contains signatures.
Definition PE/Binary.hpp:254
bool has_delay_imports() const
Check if the current binary contains delay imports.
Definition PE/Binary.hpp:531
void set_resources(const ResourceData &resource)
Set a new resource tree.
void write(std::ostream &os) override
Reconstruct the binary object and write the raw PE in os stream.
void rich_header(const RichHeader &rich_header)
Set a RichHeader object in the current Binary.
TLS * tls()
Return a reference to the TLS object.
Definition PE/Binary.hpp:228
uint64_t entrypoint() const override
Return the binary's entrypoint (It is the same value as OptionalHeader::addressof_entrypoint.
std::vector< Signature > signatures_t
Internal container for storing PE's authenticode Signature.
Definition PE/Binary.hpp:132
Signature::VERIFICATION_FLAGS verify_signature(Signature::VERIFICATION_CHECKS checks=Signature::VERIFICATION_CHECKS::DEFAULT) const
Verify the binary against the embedded signature(s) (if any) First, it checks that the embedded signa...
void remove_all_libraries()
Remove all libraries in the binary.
void accept(Visitor &visitor) const override
Method so that a visitor can visit us.
LIEF::Binary::functions_t functions() const
All functions found in the binary
LIEF::Binary::functions_t exception_functions() const
Functions found in the Exception table directory.
Import & add_library(const std::string &name)
Add an imported library (i.e. DLL) to the binary.
uint64_t overlay_offset() const
Return the original overlay offset.
Definition PE/Binary.hpp:468
Section * section_from_rva(uint64_t virtual_address)
Find the section associated that encompasses the given RVA.
const Section * import_section() const
Return the section associated with import table or a nullptr if the binary does not have an import ta...
PE_TYPE type() const
Return PE32 or PE32+
Definition PE/Binary.hpp:145
bool has_tls() const
Check if the current binary has a TLS object.
Definition PE/Binary.hpp:240
DataDirectory * data_directory(DataDirectory::TYPES type)
Return the DataDirectory with the given type (or index)
void remove_library(const std::string &name)
Remove the library with the given name
Section * section_from_offset(uint64_t offset)
Find the section associated that encompasses the given offset.
bool has_exceptions() const
Check if the current binary has exceptions.
it_delay_imports delay_imports()
Return an iterator over the binary's delay imports.
Definition PE/Binary.hpp:536
bool is_reproducible_build() const
Check if the current binary is reproducible build, replacing timestamps by a compile hash.
std::vector< std::unique_ptr< DataDirectory > > data_directories_t
Internal container for storing PE's DataDirectory.
Definition PE/Binary.hpp:69
DosHeader & dos_header()
Return a reference to the PE::DosHeader object.
Definition PE/Binary.hpp:194
std::vector< Import > imports_t
Internal container for storing PE's Import.
Definition PE/Binary.hpp:87
bool has_nx() const override
Check if the binary uses NX protection.
span< const uint8_t > dos_stub() const
Return the DOS stub content.
Definition PE/Binary.hpp:473
Header & header()
Return a reference to the PE::Header object.
Definition PE/Binary.hpp:203
it_relocations relocations()
Return an iterator over the PE's Relocation.
Definition PE/Binary.hpp:404
uint64_t imagebase() const override
Return binary's imagebase. 0 if not relevant.
Definition PE/Binary.hpp:168
bool has_configuration() const
Check if the current binary has a load configuration.
Definition PE/Binary.hpp:286
const CodeViewPDB * codeview_pdb() const
Return the CodeViewPDB object if present.
ResourceNode * resources()
Return resources as a tree or a nullptr if there is no resources.
Definition PE/Binary.hpp:358
bool has(DataDirectory::TYPES type) const
Check if the current binary has the given DataDirectory::TYPES.
Definition PE/Binary.hpp:432
uint32_t sizeof_headers() const
Compute the size of all the headers.
void tls(const TLS &tls)
Set a TLS object in the current Binary.
std::vector< std::string > strings_table_t
Internal container for storing strings.
Definition PE/Binary.hpp:123
std::vector< std::unique_ptr< Debug > > debug_entries_t
Internal container for storing Debug information.
Definition PE/Binary.hpp:105
Import * get_import(const std::string &import_name)
Returns the PE::Import from the given name. If it can't be found, return a nullptr.
it_const_signatures signatures() const
Return an iterator over the Signature object(s) if the binary is signed.
Definition PE/Binary.hpp:296
it_debug_entries debug()
Return an iterator over the Debug entries.
Definition PE/Binary.hpp:437
void patch_address(uint64_t address, const std::vector< uint8_t > &patch_value, LIEF::Binary::VA_TYPES addr_type=LIEF::Binary::VA_TYPES::AUTO) override
Patch the content at virtual address address with patch_value.
void dos_stub(const std::vector< uint8_t > &content)
Update the DOS stub content.
bool has_delay_import(const std::string &import_name) const
True if the binary delay-imports the given library name
Definition PE/Binary.hpp:555
bool has_imports() const
Check if the current binary contains imports.
Definition PE/Binary.hpp:247
void remove(const Section §ion, bool clear=false)
Remove the given section.
it_data_directories data_directories()
Return an iterator over the DataDirectory present in the Binary.
Definition PE/Binary.hpp:419
it_sections sections()
Return an iterator over the PE's Section.
Definition PE/Binary.hpp:185
Export * get_export()
Return the Export object.
Definition PE/Binary.hpp:345
void write(const std::string &filename) override
Reconstruct the binary object and write the raw PE in filename
bool has_import(const std::string &import_name) const
True if the binary imports the given library name
Definition PE/Binary.hpp:523
Relocation & add_relocation(const Relocation &relocation)
Add a PE::Relocation.
Section * get_section(const std::string &name)
Return binary's section from its name. If the secion can't be found, return a nullptr.
RichHeader * rich_header()
Return a reference to the RichHeader object.
Definition PE/Binary.hpp:488
uint64_t rva_to_offset(uint64_t RVA)
Convert a Relative Virtual Address into an offset.
Class that is used to rebuild a raw PE binary from a PE::Binary object.
Definition PE/Builder.hpp:45
CodeView PDB specialization.
Definition CodeViewPDB.hpp:34
Class that represents a PE data directory entry.
Definition DataDirectory.hpp:38
Class that represents a PE delayed import.
Definition DelayImport.hpp:37
Class which represents a PE Export.
Definition Export.hpp:38
Class that represents an entry (i.e. an import) in the import table (Import).
Definition ImportEntry.hpp:36
Class that represents a PE import.
Definition Import.hpp:40
Class that represents the default PE's LoadConfiguration
Definition LoadConfiguration.hpp:35
Main interface to parse PE binaries. In particular the static functions: Parser::parse should be used...
Definition PE/Parser.hpp:47
Class which represents the Base Relocation Block We usually find this structure in the ....
Definition PE/Relocation.hpp:37
Class which represents a Data Node in the PE resources tree.
Definition ResourceData.hpp:32
Definition ResourceDirectory.hpp:37
Class which represents a Node in the resource tree.
Definition ResourceNode.hpp:38
Class which represents a PE section.
Definition PE/Section.hpp:41
Main interface for the PKCS #7 signature scheme.
Definition Signature.hpp:40
VERIFICATION_CHECKS
Flags to tweak the verification process of the signature.
Definition Signature.hpp:91
VERIFICATION_FLAGS
Flags returned by the verification functions.
Definition Signature.hpp:68
Class which represents the PE Thread Local Storage.
Definition TLS.hpp:45
Definition Visitor.hpp:219
Iterator which returns reference on container's values.
Definition iterators.hpp:48
PE_SECTION_TYPES
Common section type.
Definition PE/enums.hpp:666
ALGORITHMS
Cryptography algorithms.
Definition PE/enums.hpp:686
PE_TYPE
Definition PE/enums.hpp:680
LIEF namespace.
Definition Abstract/Binary.hpp:32
tl::expected< T, lief_errors > result
Wrapper that contains an Object (T) or an error.
Definition errors.hpp:72