LIEF: Library to Instrument Executable Formats Version 0.13.0
Public Types | Public Member Functions | List of all members
LIEF::PE::Binary Class Reference

Class which represents a PE binary This is the main interface to manage and modify a PE executable. More...

#include <Binary.hpp>

Inheritance diagram for LIEF::PE::Binary:
Inheritance graph
[legend]
Collaboration diagram for LIEF::PE::Binary:
Collaboration graph
[legend]

Public Types

using sections_t = std::vector< std::unique_ptr< Section > >
 Internal container for storing PE's Section.
 
using it_sections = ref_iterator< sections_t &, Section * >
 Iterator that outputs Section& object.
 
using it_const_sections = const_ref_iterator< const sections_t &, const Section * >
 Iterator that outputs const Section& object.
 
using data_directories_t = std::vector< std::unique_ptr< DataDirectory > >
 Internal container for storing PE's DataDirectory.
 
using it_data_directories = ref_iterator< data_directories_t &, DataDirectory * >
 Iterator that outputs DataDirectory&.
 
using it_const_data_directories = const_ref_iterator< const data_directories_t &, const DataDirectory * >
 Iterator that outputs const DataDirectory&.
 
using relocations_t = std::vector< std::unique_ptr< Relocation > >
 Internal container for storing PE's Relocation.
 
using it_relocations = ref_iterator< relocations_t &, Relocation * >
 Iterator that outputs Relocation&.
 
using it_const_relocations = const_ref_iterator< const relocations_t &, const Relocation * >
 Iterator that outputs const Relocation&.
 
using imports_t = std::vector< Import >
 Internal container for storing PE's Import.
 
using it_imports = ref_iterator< imports_t & >
 Iterator that output Import&.
 
using it_const_imports = const_ref_iterator< const imports_t & >
 Iterator that outputs const Import&.
 
using delay_imports_t = std::vector< DelayImport >
 Internal container for storing PE's DelayImport.
 
using it_delay_imports = ref_iterator< delay_imports_t & >
 Iterator that output DelayImport&.
 
using it_const_delay_imports = const_ref_iterator< const delay_imports_t & >
 Iterator that outputs const DelayImport&.
 
using debug_entries_t = std::vector< Debug >
 Internal container for storing Debug information.
 
using it_debug_entries = ref_iterator< debug_entries_t & >
 Iterator that outputs Debug&.
 
using it_const_debug_entries = const_ref_iterator< const debug_entries_t & >
 Iterator that outputs const Debug&.
 
using symbols_t = std::vector< Symbol >
 Internal container for storing COFF Symbols.
 
using it_symbols = ref_iterator< symbols_t & >
 Iterator that outputs Symbol&.
 
using it_const_symbols = const_ref_iterator< const symbols_t & >
 Iterator that outputs const Symbol&.
 
using strings_table_t = std::vector< std::string >
 Internal container for storing strings.
 
using it_strings_table = ref_iterator< strings_table_t & >
 Iterator that outputs std::string&.
 
using it_const_strings_table = const_ref_iterator< const strings_table_t & >
 Iterator that outputs const std::string&.
 
using signatures_t = std::vector< Signature >
 Internal container for storing PE's authenticode Signature.
 
using it_signatures = ref_iterator< signatures_t & >
 Iterator that outputs Signature&.
 
using it_const_signatures = const_ref_iterator< const signatures_t & >
 Iterator that outputs const Signature&.
 
- Public Types inherited from LIEF::Binary
enum class  VA_TYPES { AUTO = 0 , RVA = 1 , VA = 2 }
 Type of a virtual address. More...
 
using functions_t = std::vector< Function >
 
using sections_t = std::vector< Section * >
 Internal container.
 
using it_sections = ref_iterator< sections_t >
 Iterator that outputs LIEF::Section&.
 
using it_const_sections = const_ref_iterator< sections_t >
 Iterator that outputs const LIEF::Section&.
 
using symbols_t = std::vector< Symbol * >
 Internal container.
 
using it_symbols = ref_iterator< symbols_t >
 Iterator that outputs LIEF::Symbol&.
 
using it_const_symbols = const_ref_iterator< symbols_t >
 Iterator that outputs const LIEF::Symbol&.
 
using relocations_t = std::vector< Relocation * >
 Internal container.
 
using it_relocations = ref_iterator< relocations_t >
 Iterator that outputs LIEF::Relocation&.
 
using it_const_relocations = const_ref_iterator< relocations_t >
 Iterator that outputs const LIEF::Relocation&.
 
- Public Types inherited from LIEF::Object
template<class T >
using output_t = add_pointer_t< decay_t< T > >
 
template<class T >
using output_const_t = add_pointer_t< add_const_t< decay_t< T > > >
 

Public Member Functions

 Binary (const std::string &name, PE_TYPE type)
 
PE_TYPE type () const
 Return PE32 or PE32+
 
uint64_t rva_to_offset (uint64_t RVA)
 Convert a Relative Virtual Address into an offset. More...
 
uint64_t va_to_offset (uint64_t VA)
 Convert the absolute virtual address into an offset. More...
 
result< uint64_t > offset_to_virtual_address (uint64_t offset, uint64_t slide=0) const override
 Convert the given offset into a virtual address. More...
 
uint64_t imagebase () const override
 Return binary's imagebase. 0 if not relevant. More...
 
Sectionsection_from_offset (uint64_t offset)
 Find the section associated that encompasses the given offset. More...
 
const Sectionsection_from_offset (uint64_t offset) const
 
Sectionsection_from_rva (uint64_t virtual_address)
 Find the section associated that encompasses the given RVA. More...
 
const Sectionsection_from_rva (uint64_t virtual_address) const
 
it_sections sections ()
 Return an iterator over the PE's Section.
 
it_const_sections sections () const
 
DosHeaderdos_header ()
 Return a reference to the PE::DosHeader object.
 
const DosHeaderdos_header () const
 
Headerheader ()
 Return a reference to the PE::Header object.
 
const Headerheader () const
 
OptionalHeaderoptional_header ()
 Return a reference to the OptionalHeader object.
 
const OptionalHeaderoptional_header () const
 
uint64_t virtual_size () const
 Compute the binary's virtual size. It should match OptionalHeader::sizeof_image.
 
uint32_t sizeof_headers () const
 Compute the size of all the headers.
 
TLStls ()
 Return a reference to the TLS object.
 
const TLStls () const
 
void tls (const TLS &tls)
 Set a TLS object in the current Binary.
 
bool has_tls () const
 Check if the current binary has a TLS object.
 
bool has_imports () const
 Check if the current binary contains imports. More...
 
bool has_signatures () const
 Check if the current binary contains signatures. More...
 
bool has_exports () const
 Check if the current binary has exports. More...
 
bool has_resources () const
 Check if the current binary has resources.
 
bool has_exceptions () const
 Check if the current binary has exceptions.
 
bool has_relocations () const
 Check if the current binary has relocations. More...
 
bool has_debug () const
 Check if the current binary has debugs.
 
bool has_configuration () const
 Check if the current binary has a load configuration.
 
bool is_reproducible_build () const
 Check if the current binary is reproducible build, replacing timestamps by a compile hash. More...
 
it_const_signatures signatures () const
 Return an iterator over the Signature object(s) if the binary is signed.
 
Signature::VERIFICATION_FLAGS verify_signature (Signature::VERIFICATION_CHECKS checks=Signature::VERIFICATION_CHECKS::DEFAULT) const
 Verify the binary against the embedded signature(s) (if any) First, it checks that the embedded signatures are correct (c.f. Signature::check) and then, it checks that the authentihash matches ContentInfo::digest. More...
 
Signature::VERIFICATION_FLAGS verify_signature (const Signature &sig, Signature::VERIFICATION_CHECKS checks=Signature::VERIFICATION_CHECKS::DEFAULT) const
 Verify the binary with the Signature object provided in the first parameter It can be used to verify a detached signature: More...
 
std::vector< uint8_t > authentihash (ALGORITHMS algo) const
 Compute the authentihash according to the algorithm provided in the first parameter.
 
uint32_t predict_function_rva (const std::string &library, const std::string &function)
 Try to predict the RVA of the function function in the import library library More...
 
Exportget_export ()
 Return the Export object.
 
const Exportget_export () const
 
std::vector< Symbol > & symbols ()
 Return binary Symbols.
 
const std::vector< Symbol > & symbols () const
 
ResourceNoderesources ()
 Return resources as a tree or a nullptr if there is no resources.
 
const ResourceNoderesources () const
 
void set_resources (const ResourceDirectory &resource)
 Set a new resource tree.
 
void set_resources (const ResourceData &resource)
 Set a new resource tree.
 
result< ResourcesManagerresources_manager () const
 Return the ResourcesManager (class to manage resources more easily than the tree one)
 
Sectionget_section (const std::string &name)
 Return binary's section from its name. If the secion can't be found, return a nullptr. More...
 
const Sectionget_section (const std::string &name) const
 
const Sectionimport_section () const
 Return the section associated with import table or a nullptr if the binary does not have an import table.
 
Sectionimport_section ()
 
void remove_section (const std::string &name, bool clear=false) override
 Delete the section with the given name. More...
 
void remove (const Section &section, bool clear=false)
 Remove the given section. More...
 
Sectionadd_section (const Section &section, PE_SECTION_TYPES type=PE_SECTION_TYPES::UNKNOWN)
 Add a section to the binary and return the section added.
 
it_relocations relocations ()
 Return an iterator over the PE's Relocation.
 
it_const_relocations relocations () const
 
Relocationadd_relocation (const Relocation &relocation)
 Add a PE::Relocation.
 
void remove_all_relocations ()
 Remove all the relocations.
 
it_data_directories data_directories ()
 Return an iterator over the DataDirectory present in the Binary.
 
it_const_data_directories data_directories () const
 
DataDirectorydata_directory (DATA_DIRECTORY index)
 Return the DataDirectory with the given type (or index)
 
const DataDirectorydata_directory (DATA_DIRECTORY index) const
 
bool has (DATA_DIRECTORY index) const
 Check if the current binary has the given DATA_DIRECTORY.
 
debug_entries_tdebug ()
 Return the debug_entries_t object.
 
const debug_entries_tdebug () const
 
const LoadConfigurationload_configuration () const
 Retrun the LoadConfiguration object or a nullptr if the binary does not use the LoadConfiguration.
 
LoadConfigurationload_configuration ()
 
const std::vector< uint8_t > & overlay () const
 Return the overlay content.
 
std::vector< uint8_t > & overlay ()
 
const std::vector< uint8_t > & dos_stub () const
 Return the DOS stub content.
 
std::vector< uint8_t > & dos_stub ()
 
void dos_stub (const std::vector< uint8_t > &content)
 Update the DOS stub content.
 
RichHeaderrich_header ()
 Return a reference to the RichHeader object.
 
const RichHeaderrich_header () const
 
void rich_header (const RichHeader &rich_header)
 Set a RichHeader object in the current Binary.
 
bool has_rich_header () const
 Check if the current binary has a RichHeader object.
 
it_imports imports ()
 Return an iterator over the binary imports.
 
it_const_imports imports () const
 
Importget_import (const std::string &import_name)
 Returns the PE::Import from the given name. If it can't be found, return a nullptr. More...
 
const Importget_import (const std::string &import_name) const
 
bool has_import (const std::string &import_name) const
 True if the binary imports the given library name More...
 
bool has_delay_imports () const
 Check if the current binary contains delay imports. More...
 
it_delay_imports delay_imports ()
 Return an iterator over the binary's delay imports.
 
it_const_delay_imports delay_imports () const
 
DelayImportget_delay_import (const std::string &import_name)
 Returns the PE::DelayImport from the given name. If it can't be found, return a nullptr. More...
 
const DelayImportget_delay_import (const std::string &import_name) const
 
bool has_delay_import (const std::string &import_name) const
 True if the binary delay-imports the given library name More...
 
ImportEntryadd_import_function (const std::string &library, const std::string &function)
 Add the function function of the library library. If the function fails, it returns a nullptr. More...
 
Importadd_library (const std::string &name)
 Add an imported library (i.e. DLL) to the binary.
 
void remove_library (const std::string &name)
 Remove the library with the given name
 
void remove_all_libraries ()
 Remove all libraries in the binary.
 
void hook_function (const std::string &function, uint64_t address)
 
void hook_function (const std::string &library, const std::string &function, uint64_t address)
 
void write (const std::string &filename) override
 Reconstruct the binary object and write the raw PE in filename More...
 
void write (std::ostream &os) override
 Reconstruct the binary object and write the raw PE in os stream. More...
 
void accept (Visitor &visitor) const override
 Method so that a visitor can visit us. More...
 
void patch_address (uint64_t address, const std::vector< uint8_t > &patch_value, LIEF::Binary::VA_TYPES addr_type=LIEF::Binary::VA_TYPES::AUTO) override
 Patch the content at virtual address address with patch_value. More...
 
void patch_address (uint64_t address, uint64_t patch_value, size_t size=sizeof(uint64_t), LIEF::Binary::VA_TYPES addr_type=LIEF::Binary::VA_TYPES::AUTO) override
 Patch the address with the given value. More...
 
std::vector< uint8_t > get_content_from_virtual_address (uint64_t virtual_address, uint64_t size, LIEF::Binary::VA_TYPES addr_type=LIEF::Binary::VA_TYPES::AUTO) const override
 Return the content located at the provided virtual address. More...
 
uint64_t entrypoint () const override
 Return the binary's entrypoint (It is the same value as OptionalHeader::addressof_entrypoint. More...
 
bool is_pie () const override
 Check if the binary is position independent. More...
 
bool has_nx () const override
 Check if the binary uses NX protection. More...
 
LIEF::Binary::functions_t ctor_functions () const override
 Return the list of the binary constructors. More...
 
LIEF::Binary::functions_t functions () const
 All functions found in the binary
 
LIEF::Binary::functions_t exception_functions () const
 Functions found in the Exception table directory.
 
bool operator== (const Binary &rhs) const
 
bool operator!= (const Binary &rhs) const
 
std::ostream & print (std::ostream &os) const override
 
- Public Member Functions inherited from LIEF::Binary
Binaryoperator= (const Binary &)
 
 Binary (const Binary &)
 
EXE_FORMATS format () const
 Executable format (ELF, PE, Mach-O) of the underlying binary.
 
Header header () const
 Return the abstract header of the binary.
 
it_symbols symbols ()
 Return an iterator over the abstracted symbols in which the elements can be modified.
 
it_const_symbols symbols () const
 Return an iterator over the abstracted symbols in which the elements can't be modified.
 
bool has_symbol (const std::string &name) const
 Check if a Symbol with the given name exists.
 
const Symbolget_symbol (const std::string &name) const
 Return the Symbol with the given name If the symbol does not exist, return a nullptr.
 
Symbolget_symbol (const std::string &name)
 
it_sections sections ()
 Return an iterator over the binary's sections (LIEF::Section)
 
it_const_sections sections () const
 
virtual void remove_section (const std::string &name, bool clear=false)=0
 Remove all the sections in the underlying binary. More...
 
it_relocations relocations ()
 Return an iterator over the binary relocation (LIEF::Relocation)
 
it_const_relocations relocations () const
 
virtual uint64_t entrypoint () const =0
 Binary's entrypoint (if any) More...
 
const std::string & name () const
 Binary's name.
 
uint64_t original_size () const
 Binary's original size.
 
functions_t exported_functions () const
 Return the functions exported by the binary.
 
std::vector< std::string > imported_libraries () const
 Return libraries which are imported by the binary.
 
functions_t imported_functions () const
 Return functions imported by the binary.
 
virtual result< uint64_t > get_function_address (const std::string &func_name) const
 Return the address of the given function name. More...
 
void accept (Visitor &visitor) const override
 Method so that a visitor can visit us. More...
 
std::vector< uint64_t > xref (uint64_t address) const
 
virtual void patch_address (uint64_t address, const std::vector< uint8_t > &patch_value, VA_TYPES addr_type=VA_TYPES::AUTO)=0
 Patch the content at virtual address address with patch_value. More...
 
virtual void patch_address (uint64_t address, uint64_t patch_value, size_t size=sizeof(uint64_t), VA_TYPES addr_type=VA_TYPES::AUTO)=0
 Patch the address with the given value. More...
 
virtual std::vector< uint8_t > get_content_from_virtual_address (uint64_t virtual_address, uint64_t size, VA_TYPES addr_type=VA_TYPES::AUTO) const =0
 Return the content located at the given virtual address. More...
 
void name (const std::string &name)
 Change the binary's name.
 
void original_size (uint64_t size)
 Change binary's original size. More...
 
virtual bool is_pie () const =0
 Check if the binary is position independent. More...
 
virtual bool has_nx () const =0
 Check if the binary uses NX protection. More...
 
virtual uint64_t imagebase () const =0
 Default image base address if the ASLR is not enabled. More...
 
virtual functions_t ctor_functions () const =0
 Constructor functions that are called prior any other functions. More...
 
virtual result< uint64_t > offset_to_virtual_address (uint64_t offset, uint64_t slide=0) const =0
 Convert the given offset into a virtual address. More...
 
virtual std::ostream & print (std::ostream &os) const
 
virtual void write (const std::string &name)=0
 Build & transform the Binary object representation into a real executable. More...
 
virtual void write (std::ostream &os)=0
 
- Public Member Functions inherited from LIEF::Object
 Object (const Object &other)
 
Objectoperator= (const Object &other)
 
template<class T >
output_t< T > as ()
 
template<class T >
output_const_t< T > as () const
 
virtual void accept (Visitor &visitor) const =0
 

Detailed Description

Class which represents a PE binary This is the main interface to manage and modify a PE executable.

Constructor & Destructor Documentation

◆ ~Binary()

LIEF::PE::Binary::~Binary ( )
overridevirtual

Reimplemented from LIEF::Binary.

Member Function Documentation

◆ accept()

void LIEF::PE::Binary::accept ( Visitor visitor) const
overridevirtual

Method so that a visitor can visit us.

Reimplemented from LIEF::Binary.

◆ add_import_function()

ImportEntry * LIEF::PE::Binary::add_import_function ( const std::string &  library,
const std::string &  function 
)

Add the function function of the library library. If the function fails, it returns a nullptr.

Parameters
[in]libraryLibrary name of the function
[in]functionFunction's name from the library to import

◆ ctor_functions()

LIEF::Binary::functions_t LIEF::PE::Binary::ctor_functions ( ) const
overridevirtual

Return the list of the binary constructors.

In a PE file, we consider a constructors as a callback in the TLS object

Implements LIEF::Binary.

◆ entrypoint()

uint64_t LIEF::PE::Binary::entrypoint ( ) const
overridevirtual

Return the binary's entrypoint (It is the same value as OptionalHeader::addressof_entrypoint.

Implements LIEF::Binary.

◆ get_content_from_virtual_address()

std::vector< uint8_t > LIEF::PE::Binary::get_content_from_virtual_address ( uint64_t  virtual_address,
uint64_t  size,
LIEF::Binary::VA_TYPES  addr_type = LIEF::Binary::VA_TYPES::AUTO 
) const
overridevirtual

Return the content located at the provided virtual address.

Parameters
[in]virtual_addressVirtual address of the data to retrieve
[in]sizeSize in bytes of the data to retrieve
[in]addr_typeType of the Virtual address: VA or RVA. Default: Auto

Implements LIEF::Binary.

◆ get_delay_import()

DelayImport * LIEF::PE::Binary::get_delay_import ( const std::string &  import_name)

Returns the PE::DelayImport from the given name. If it can't be found, return a nullptr.

Parameters
[in]import_nameName of the delay import

◆ get_import()

Import * LIEF::PE::Binary::get_import ( const std::string &  import_name)

Returns the PE::Import from the given name. If it can't be found, return a nullptr.

Parameters
[in]import_nameName of the import

◆ get_section()

Section * LIEF::PE::Binary::get_section ( const std::string &  name)

Return binary's section from its name. If the secion can't be found, return a nullptr.

Parameters
[in]nameName of the Section

◆ has_delay_import()

bool LIEF::PE::Binary::has_delay_import ( const std::string &  import_name) const

True if the binary delay-imports the given library name

Parameters
[in]import_nameName of the delay import

◆ has_delay_imports()

bool LIEF::PE::Binary::has_delay_imports ( ) const

Check if the current binary contains delay imports.

See also
DelayImport
has_import

◆ has_exports()

bool LIEF::PE::Binary::has_exports ( ) const

Check if the current binary has exports.

See also
Export

◆ has_import()

bool LIEF::PE::Binary::has_import ( const std::string &  import_name) const

True if the binary imports the given library name

Parameters
[in]import_nameName of the import

◆ has_imports()

bool LIEF::PE::Binary::has_imports ( ) const

Check if the current binary contains imports.

See also
Import

◆ has_nx()

bool LIEF::PE::Binary::has_nx ( ) const
overridevirtual

Check if the binary uses NX protection.

Implements LIEF::Binary.

◆ has_relocations()

bool LIEF::PE::Binary::has_relocations ( ) const

Check if the current binary has relocations.

See also
Relocation

◆ has_signatures()

bool LIEF::PE::Binary::has_signatures ( ) const

Check if the current binary contains signatures.

See also
signatures

◆ imagebase()

uint64_t LIEF::PE::Binary::imagebase ( ) const
overridevirtual

Return binary's imagebase. 0 if not relevant.

The value is the same as those returned by OptionalHeader::imagebase

Implements LIEF::Binary.

◆ is_pie()

bool LIEF::PE::Binary::is_pie ( ) const
overridevirtual

Check if the binary is position independent.

Implements LIEF::Binary.

◆ is_reproducible_build()

bool LIEF::PE::Binary::is_reproducible_build ( ) const

Check if the current binary is reproducible build, replacing timestamps by a compile hash.

See also
Debug

◆ offset_to_virtual_address()

result< uint64_t > LIEF::PE::Binary::offset_to_virtual_address ( uint64_t  offset,
uint64_t  slide = 0 
) const
overridevirtual

Convert the given offset into a virtual address.

Parameters
[in]offsetThe offset to convert.
[in]slideIf not 0, it will replace the default base address (if any)

Implements LIEF::Binary.

◆ patch_address() [1/2]

void LIEF::PE::Binary::patch_address ( uint64_t  address,
const std::vector< uint8_t > &  patch_value,
LIEF::Binary::VA_TYPES  addr_type = LIEF::Binary::VA_TYPES::AUTO 
)
overridevirtual

Patch the content at virtual address address with patch_value.

Parameters
[in]addressAddress to patch
[in]patch_valuePatch to apply
[in]addr_typeType of the Virtual address: VA or RVA. Default: Auto

Implements LIEF::Binary.

◆ patch_address() [2/2]

void LIEF::PE::Binary::patch_address ( uint64_t  address,
uint64_t  patch_value,
size_t  size = sizeof(uint64_t),
LIEF::Binary::VA_TYPES  addr_type = LIEF::Binary::VA_TYPES::AUTO 
)
overridevirtual

Patch the address with the given value.

Parameters
[in]addressAddress to patch
[in]patch_valuePatch to apply
[in]sizeSize of the value in bytes (1, 2, ... 8)
[in]addr_typeType of the Virtual address: VA or RVA. Default: Auto

Implements LIEF::Binary.

◆ predict_function_rva()

uint32_t LIEF::PE::Binary::predict_function_rva ( const std::string &  library,
const std::string &  function 
)

Try to predict the RVA of the function function in the import library library

Warning
The value could be chang if imports change
Note
It should be used with: LIEF::PE::Builder::build_imports set to true
Parameters
[in]libraryLibrary name in which the function is located
[in]functionFunction name
Returns
The address of the function (IAT) in the new import table

◆ print()

std::ostream & LIEF::PE::Binary::print ( std::ostream &  os) const
overridevirtual

Reimplemented from LIEF::Binary.

◆ remove()

void LIEF::PE::Binary::remove ( const Section section,
bool  clear = false 
)

Remove the given section.

See also
remove_section

◆ remove_section()

void LIEF::PE::Binary::remove_section ( const std::string &  name,
bool  clear = false 
)
overridevirtual

Delete the section with the given name.

Parameters
[in]nameName of section to delete
[in]clearif true clear the section's content with 0 before removing (default: false)

Implements LIEF::Binary.

◆ rva_to_offset()

uint64_t LIEF::PE::Binary::rva_to_offset ( uint64_t  RVA)

Convert a Relative Virtual Address into an offset.

The conversion is performed by looking for the section that encompasses the provided RVA.

◆ section_from_offset()

Section * LIEF::PE::Binary::section_from_offset ( uint64_t  offset)

Find the section associated that encompasses the given offset.

If no section can be found, return a nullptr

◆ section_from_rva()

Section * LIEF::PE::Binary::section_from_rva ( uint64_t  virtual_address)

Find the section associated that encompasses the given RVA.

If no section can be found, return a nullptr

◆ va_to_offset()

uint64_t LIEF::PE::Binary::va_to_offset ( uint64_t  VA)

Convert the absolute virtual address into an offset.

See also
rva_to_offset

◆ verify_signature() [1/2]

Signature::VERIFICATION_FLAGS LIEF::PE::Binary::verify_signature ( const Signature sig,
Signature::VERIFICATION_CHECKS  checks = Signature::VERIFICATION_CHECKS::DEFAULT 
) const

Verify the binary with the Signature object provided in the first parameter It can be used to verify a detached signature:

result<Signature> detached = LIEF::PE::SignatureParser::parse("sig.pkcs7")
if (detached) {
binary->verify_signature(detached.value());
}
static result< Signature > parse(std::vector< uint8_t > data, bool skip_header=false)
Parse a PKCS #7 signature given a raw blob.

◆ verify_signature() [2/2]

Verify the binary against the embedded signature(s) (if any) First, it checks that the embedded signatures are correct (c.f. Signature::check) and then, it checks that the authentihash matches ContentInfo::digest.

One can tweak the verification process with the Signature::VERIFICATION_CHECKS flags

See also
LIEF::PE::Signature::check

◆ write() [1/2]

void LIEF::PE::Binary::write ( const std::string &  filename)
overridevirtual

Reconstruct the binary object and write the raw PE in filename

Rebuild a PE binary from the current Binary object. When rebuilding, import table and relocations are not rebuilt.

Implements LIEF::Binary.

◆ write() [2/2]

void LIEF::PE::Binary::write ( std::ostream &  os)
overridevirtual

Reconstruct the binary object and write the raw PE in os stream.

Rebuild a PE binary from the current Binary object. When rebuilding, import table and relocations are not rebuilt.

Implements LIEF::Binary.


The documentation for this class was generated from the following file: