Class which represents a PE section. More...

#include <Section.hpp>

Inheritance diagram for LIEF::PE::Section:

[legend]

Collaboration diagram for LIEF::PE::Section:

[legend]

Public Types
enum class	CHARACTERISTICS : size_t { TYPE_NO_PAD = 0x00000008 , CNT_CODE = 0x00000020 , CNT_INITIALIZED_DATA = 0x00000040 , CNT_UNINITIALIZED_DATA = 0x00000080 , LNK_OTHER = 0x00000100 , LNK_INFO = 0x00000200 , LNK_REMOVE = 0x00000800 , LNK_COMDAT = 0x00001000 , GPREL = 0x00008000 , MEM_PURGEABLE = 0x00010000 , MEM_16BIT = 0x00020000 , MEM_LOCKED = 0x00040000 , MEM_PRELOAD = 0x00080000 , ALIGN_1BYTES = 0x00100000 , ALIGN_2BYTES = 0x00200000 , ALIGN_4BYTES = 0x00300000 , ALIGN_8BYTES = 0x00400000 , ALIGN_16BYTES = 0x00500000 , ALIGN_32BYTES = 0x00600000 , ALIGN_64BYTES = 0x00700000 , ALIGN_128BYTES = 0x00800000 , ALIGN_256BYTES = 0x00900000 , ALIGN_512BYTES = 0x00A00000 , ALIGN_1024BYTES = 0x00B00000 , ALIGN_2048BYTES = 0x00C00000 , ALIGN_4096BYTES = 0x00D00000 , ALIGN_8192BYTES = 0x00E00000 , LNK_NRELOC_OVFL = 0x01000000 , MEM_DISCARDABLE = 0x02000000 , MEM_NOT_CACHED = 0x04000000 , MEM_NOT_PAGED = 0x08000000 , MEM_SHARED = 0x10000000 , MEM_EXECUTE = 0x20000000 , MEM_READ = 0x40000000 , MEM_WRITE = 0x80000000 }

Public Types inherited from LIEF::Object
template<class T >
using	output_t = add_pointer_t<decay_t<T>>

template<class T >
using	output_const_t = add_pointer_t<add_const_t<decay_t<T>>>

Public Member Functions
	Section (const details::pe_section &header)

	Section (const std::vector< uint8_t > &data, const std::string &name="", uint32_t characteristics=0)

	Section (const std::string &name)

Section &	operator= (const Section &)

	Section (const Section &)

uint32_t	sizeof_raw_data () const
	Return the size of the data in the section.

uint32_t	virtual_size () const
	Return the size of the data when mapped in memory.

span< const uint8_t >	content () const override
	The actual content of the section.

span< const uint8_t >	padding () const
	Content of the section's padding area.

uint32_t	pointerto_raw_data () const
	The offset of the section data in the PE file.

uint32_t	pointerto_relocation () const
	The file pointer to the beginning of the COFF relocation entries for the section. This is set to zero for executable images or if there are no relocations.

uint32_t	pointerto_line_numbers () const
	The file pointer to the beginning of line-number entries for the section. This is set to zero if there are no COFF line numbers. This value should be zero for an image because COFF debugging information is deprecated and modern debug information relies on the PDB files.

uint16_t	numberof_relocations () const
	No longer used in recent PE binaries produced by Visual Studio.

uint16_t	numberof_line_numbers () const
	No longer used in recent PE binaries produced by Visual Studio.

uint32_t	characteristics () const
	Characteristics of the section: it gives information about the permissions of the section when mapped. It can also provides information about the purpose of the section (contain code, BSS-like, ...)

bool	is_type (PE_SECTION_TYPES type) const
	Deprecated do not use. It will likely change in a future release of LIEF.

const std::set< PE_SECTION_TYPES > &	types () const
	Deprecated do not use. It will likely change in a future release of LIEF.

bool	has_characteristic (CHARACTERISTICS c) const
	Check if the section has the given CHARACTERISTICS.

std::vector< CHARACTERISTICS >	characteristics_list () const
	List of the section characteristics as a std::set.

void	clear (uint8_t c)
	Fill the content of the section with the given `char`

void	content (const std::vector< uint8_t > &data) override
	Change section content.

void	name (const std::string &name) override
	Change the section's name.

void	virtual_size (uint32_t virtual_sz)

void	pointerto_raw_data (uint32_t ptr)

void	pointerto_relocation (uint32_t ptr)

void	pointerto_line_numbers (uint32_t ptr)

void	numberof_relocations (uint16_t nb)

void	numberof_line_numbers (uint16_t nb)

void	sizeof_raw_data (uint32_t sizeOfRawData)

void	characteristics (uint32_t characteristics)

void	type (PE_SECTION_TYPES type)

void	add_type (PE_SECTION_TYPES type)

void	remove_type (PE_SECTION_TYPES type)

void	remove_characteristic (Section::CHARACTERISTICS characteristic)

void	add_characteristic (Section::CHARACTERISTICS characteristic)

void	accept (Visitor &visitor) const override

Public Member Functions inherited from LIEF::Section
	Section (std::string name)

Section &	operator= (const Section &)

	Section (const Section &)

virtual std::string	name () const
	section's name

virtual const std::string &	fullname () const
	Return the complete section's name which might trailing (`0`) bytes.

virtual void	size (uint64_t size)
	Change the section size.

virtual uint64_t	size () const
	section's size (size in the binary, not the virtual size)

virtual uint64_t	offset () const
	Offset in the binary.

virtual uint64_t	virtual_address () const
	Address where the section should be mapped.

virtual void	virtual_address (uint64_t virtual_address)

virtual void	offset (uint64_t offset)

double	entropy () const
	Section's entropy.

size_t	search (uint64_t integer, size_t pos, size_t size) const

size_t	search (const std::vector< uint8_t > &pattern, size_t pos=0) const

size_t	search (const std::string &pattern, size_t pos=0) const

size_t	search (uint64_t integer, size_t pos=0) const

std::vector< size_t >	search_all (uint64_t v, size_t size) const

std::vector< size_t >	search_all (uint64_t v) const

std::vector< size_t >	search_all (const std::string &v) const

void	accept (Visitor &visitor) const override
	Method so that the `visitor` can visit us.

Public Member Functions inherited from LIEF::Object
	Object (const Object &other)

Object &	operator= (const Object &other)

template<class T >
output_t< T >	as ()

template<class T >
output_const_t< T >	as () const

virtual bool	operator== (const Object &other) const

virtual bool	operator!= (const Object &other) const

Static Public Attributes
static constexpr size_t	MAX_SECTION_NAME = 8

Static Public Attributes inherited from LIEF::Section
static constexpr size_t	npos = -1

Detailed Description

Class which represents a PE section.

Member Function Documentation

◆ accept()

void LIEF::PE::Section::accept ( Visitor & visitor ) const

overridevirtual

Implements LIEF::Object.

◆ content() [1/2]

span< const uint8_t > LIEF::PE::Section::content ( ) const

inlineoverridevirtual

The actual content of the section.

Reimplemented from LIEF::Section.

◆ content() [2/2]

void LIEF::PE::Section::content ( const std::vector< uint8_t > & data )

overridevirtual

Change section content.

Reimplemented from LIEF::Section.

◆ name()

void LIEF::PE::Section::name ( const std::string & name )

overridevirtual

Change the section's name.

Reimplemented from LIEF::Section.

◆ pointerto_relocation()

uint32_t LIEF::PE::Section::pointerto_relocation ( ) const

inline

The file pointer to the beginning of the COFF relocation entries for the section. This is set to zero for executable images or if there are no relocations.

For modern PE binaries, this value is usually set to 0 as the relocations are managed by PE::Relocation.

◆ virtual_size()

uint32_t LIEF::PE::Section::virtual_size ( ) const

inline

Return the size of the data when mapped in memory.

If this value is greater than sizeof_raw_data, the section is zero-padded.

The documentation for this class was generated from the following file:

PE/Section.hpp

Public Types

Public Member Functions

Static Public Attributes

Detailed Description

Member Function Documentation

◆ accept()

◆ content() [1/2]

◆ content() [2/2]

◆ name()

◆ pointerto_relocation()

◆ virtual_size()