LoadConfiguration.hpp

Go to the documentation of this file.

/* Copyright 2017 - 2025 R. Thomas
 * Copyright 2017 - 2025 Quarkslab
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#ifndef LIEF_PE_LOAD_CONFIGURATION_H
#define LIEF_PE_LOAD_CONFIGURATION_H
#include <ostream>
#include <cstdint>
 
#include <memory>
 
#include "LIEF/Object.hpp"
#include "LIEF/visibility.h"
#include "LIEF/optional.hpp"
#include "LIEF/iterators.hpp"
 
#include "LIEF/PE/CodeIntegrity.hpp"
 
namespace LIEF {
class BinaryStream;
 
namespace PE {
class Parser;
class CHPEMetadata;
class DynamicRelocation;
class EnclaveConfiguration;
class VolatileMetadata;

class LIEF_API LoadConfiguration : public Object {
  public:
  friend class Parser;
 
  enum class IMAGE_GUARD : uint32_t {
    NONE = 0x00000000,
    CF_INSTRUMENTED = 0x100,

    CFW_INSTRUMENTED = 0x200,

    CF_FUNCTION_TABLE_PRESENT = 0x400,

    SECURITY_COOKIE_UNUSED = 0x800,

    PROTECT_DELAYLOAD_IAT = 0x1000,

    DELAYLOAD_IAT_IN_ITS_OWN_SECTION = 0x2000,

    CF_EXPORT_SUPPRESSION_INFO_PRESENT = 0x4000,

    CF_ENABLE_EXPORT_SUPPRESSION = 0x8000,

    CF_LONGJUMP_TABLE_PRESENT = 0x10000,

    RF_INSTRUMENTED = 0x00020000,

    RF_ENABLE = 0x00040000,

    RF_STRICT = 0x00080000,

    RETPOLINE_PRESENT = 0x00100000,

    EH_CONTINUATION_TABLE_PRESENT = 0x400000,

    XFG_ENABLED = 0x00800000,

    CASTGUARD_PRESENT = 0x01000000,

    MEMCPY_PRESENT = 0x02000000,
  };
 
  struct guard_function_t {
    uint32_t rva = 0;
    uint32_t extra = 0;
  };
 
  using guard_functions_t = std::vector<guard_function_t>;
  using it_guard_functions = ref_iterator<guard_functions_t&>;
  using it_const_guard_functions = const_ref_iterator<const guard_functions_t&>;
 
  using dynamic_relocations_t = std::vector<std::unique_ptr<DynamicRelocation>>;
  using it_dynamic_relocations_t = ref_iterator<dynamic_relocations_t&, DynamicRelocation*>;
  using it_const_dynamic_relocations_t = const_ref_iterator<const dynamic_relocations_t&, const DynamicRelocation*>;
 
  template<class PE_T>
  static LIEF_LOCAL
    std::unique_ptr<LoadConfiguration> parse(Parser& ctx, BinaryStream& stream);
 
  LoadConfiguration();
 
  LoadConfiguration& operator=(const LoadConfiguration&);
  LoadConfiguration(const LoadConfiguration&);
 
  LoadConfiguration(LoadConfiguration&&);
  LoadConfiguration& operator=(LoadConfiguration&&);

  uint32_t characteristics() const {
    return characteristics_;
  }

  uint32_t size() const {
    return characteristics_;
  }

  uint32_t timedatestamp() const {
    return timedatestamp_;
  }

  uint16_t major_version() const {
    return major_version_;
  }

  uint16_t minor_version() const {
    return minor_version_;
  }

  uint32_t global_flags_clear() const {
    return global_flags_clear_;
  }

  uint32_t global_flags_set() const {
    return global_flags_set_;
  }

  uint32_t critical_section_default_timeout() const {
    return critical_section_default_timeout_;
  }

  uint64_t decommit_free_block_threshold() const {
    return decommit_free_block_threshold_;
  }

  uint64_t decommit_total_free_threshold() const {
    return decommit_total_free_threshold_;
  }

  uint64_t lock_prefix_table() const {
    return lock_prefix_table_;
  }

  uint64_t maximum_allocation_size() const {
    return maximum_allocation_size_;
  }

  uint64_t virtual_memory_threshold() const {
    return virtual_memory_threshold_;
  }

  uint64_t process_affinity_mask() const {
    return process_affinity_mask_;
  }

  uint32_t process_heap_flags() const {
    return process_heap_flags_;
  }

  uint16_t csd_version() const {
    return csd_version_;
  }

  uint16_t reserved1() const {
    return reserved1_;
  }

  uint16_t dependent_load_flags() const {
    return reserved1_;
  }

  uint64_t editlist() const {
    return editlist_;
  }

  uint64_t security_cookie() const {
    return security_cookie_;
  }

  optional<uint64_t> se_handler_table() const {
    return se_handler_table_;
  }

  optional<uint64_t> se_handler_count() const {
    return se_handler_count_;
  }

  const std::vector<uint32_t>& seh_functions() const {
    return seh_rva_;
  }

  optional<uint64_t> guard_cf_check_function_pointer() const {
    return guard_cf_check_function_pointer_;
  }

  optional<uint64_t> guard_cf_dispatch_function_pointer() const {
    return guard_cf_dispatch_function_pointer_;
  }

  optional<uint64_t> guard_cf_function_table() const {
    return guard_cf_function_table_;
  }

  optional<uint64_t> guard_cf_function_count() const {
    return guard_cf_function_count_;
  }

  it_const_guard_functions guard_cf_functions() const {
    return guard_cf_functions_;
  }
 
  it_guard_functions guard_cf_functions() {
    return guard_cf_functions_;
  }

  optional<uint32_t> guard_flags() const {
    return flags_;
  }

  bool has(IMAGE_GUARD flag) const {
    if (!flags_) {
      return false;
    }
    return (*flags_ & (uint32_t)flag) != 0;
  }

  std::vector<IMAGE_GUARD> guard_cf_flags_list() const;

  const CodeIntegrity* code_integrity() const {
    return code_integrity_ ? &*code_integrity_ : nullptr;
  }
 
  CodeIntegrity* code_integrity() {
    return code_integrity_ ? &*code_integrity_ : nullptr;
  }

  optional<uint64_t> guard_address_taken_iat_entry_table() const {
    return guard_address_taken_iat_entry_table_;
  }

  optional<uint64_t> guard_address_taken_iat_entry_count() const {
    return guard_address_taken_iat_entry_count_;
  }

  it_const_guard_functions guard_address_taken_iat_entries() const {
    return guard_address_taken_iat_entries_;
  }
 
  it_guard_functions guard_address_taken_iat_entries() {
    return guard_address_taken_iat_entries_;
  }

  optional<uint64_t> guard_long_jump_target_table() const {
    return guard_long_jump_target_table_;
  }

  optional<uint64_t> guard_long_jump_target_count() const {
    return guard_long_jump_target_count_;
  }

  it_const_guard_functions guard_long_jump_targets() const {
    return guard_long_jump_targets_;
  }
 
  it_guard_functions guard_long_jump_targets() {
    return guard_long_jump_targets_;
  }

  optional<uint64_t> dynamic_value_reloc_table() const {
    return dynamic_value_reloc_table_;
  }

  it_dynamic_relocations_t dynamic_relocations() {
    return dynamic_relocs_;
  }
 
  it_const_dynamic_relocations_t dynamic_relocations() const {
    return dynamic_relocs_;
  }

  optional<uint64_t> hybrid_metadata_pointer() const {
    return hybrid_metadata_pointer_;
  }

  optional<uint64_t> chpe_metadata_pointer() const {
    return hybrid_metadata_pointer();
  }

  const CHPEMetadata* chpe_metadata() const {
    return chpe_.get();
  }
 
  CHPEMetadata* chpe_metadata() {
    return chpe_.get();
  }

  optional<uint64_t> guard_rf_failure_routine() const {
    return guard_rf_failure_routine_;
  }

  optional<uint64_t> guard_rf_failure_routine_function_pointer() const {
    return guard_rf_failure_routine_function_pointer_;
  }

  optional<uint32_t> dynamic_value_reloctable_offset() const {
    return dynamic_value_reloctable_offset_;
  }

  optional<uint16_t> dynamic_value_reloctable_section() const {
    return dynamic_value_reloctable_section_;
  }

  optional<uint16_t> reserved2() const {
    return reserved2_;
  }

  optional<uint64_t> guard_rf_verify_stackpointer_function_pointer() const {
    return guardrf_verify_stackpointer_function_pointer_;
  }

  optional<uint32_t> hotpatch_table_offset() const {
    return hotpatch_table_offset_;
  }
 
  optional<uint32_t> reserved3() const {
    return reserved3_;
  }
 
  optional<uint64_t> enclave_configuration_ptr() const {
    return enclave_configuration_ptr_;
  }
 
  const EnclaveConfiguration* enclave_config() const {
    return enclave_config_.get();
  }
 
  EnclaveConfiguration* enclave_config() {
    return enclave_config_.get();
  }
 
  optional<uint64_t> volatile_metadata_pointer() const {
    return volatile_metadata_pointer_;
  }
 
  const VolatileMetadata* volatile_metadata() const {
    return volatile_metadata_.get();
  }
 
  VolatileMetadata* volatile_metadata() {
    return volatile_metadata_.get();
  }
 
  optional<uint64_t> guard_eh_continuation_table() const {
    return guard_eh_continuation_table_;
  }
 
  optional<uint64_t> guard_eh_continuation_count() const {
    return guard_eh_continuation_count_;
  }
 
  it_const_guard_functions guard_eh_continuation_functions() const {
    return guard_eh_continuation_functions_;
  }
 
  it_guard_functions guard_eh_continuation_functions() {
    return guard_eh_continuation_functions_;
  }
 
  optional<uint64_t> guard_xfg_check_function_pointer() const {
    return guard_xfg_check_function_pointer_;
  }
 
  optional<uint64_t> guard_xfg_dispatch_function_pointer() const {
    return guard_xfg_dispatch_function_pointer_;
  }
 
  optional<uint64_t> guard_xfg_table_dispatch_function_pointer() const {
    return guard_xfg_table_dispatch_function_pointer_;
  }
 
  optional<uint64_t> cast_guard_os_determined_failure_mode() const {
    return cast_guard_os_determined_failure_mode_;
  }
 
  optional<uint64_t> guard_memcpy_function_pointer() const {
    return guard_memcpy_function_pointer_;
  }
 
  optional<uint64_t> uma_function_pointers() const {
    return uma_function_pointers_;
  }
 
  LoadConfiguration& characteristics(uint32_t characteristics) {
    characteristics_ = characteristics;
    return *this;
  }
 
  LoadConfiguration& size(uint32_t value) {
    return characteristics(value);
  }
 
  LoadConfiguration& timedatestamp(uint32_t timedatestamp) {
    timedatestamp_ = timedatestamp;
    return *this;
  }
 
  LoadConfiguration& major_version(uint16_t major_version) {
    major_version_ = major_version;
    return *this;
  }
 
  LoadConfiguration& minor_version(uint16_t minor_version) {
    minor_version_ = minor_version;
    return *this;
  }
 
  LoadConfiguration& global_flags_clear(uint32_t global_flags_clear) {
    global_flags_clear_ = global_flags_clear;
    return *this;
  }
 
  LoadConfiguration& global_flags_set(uint32_t global_flags_set) {
    global_flags_set_ = global_flags_set;
    return *this;
  }
 
  LoadConfiguration& critical_section_default_timeout(uint32_t critical_section_default_timeout) {
    critical_section_default_timeout_ = critical_section_default_timeout;
    return *this;
  }
 
  LoadConfiguration& decommit_free_block_threshold(uint64_t decommit_free_block_threshold) {
    decommit_free_block_threshold_ = decommit_free_block_threshold;
    return *this;
  }
 
  LoadConfiguration& decommit_total_free_threshold(uint64_t decommit_total_free_threshold) {
    decommit_total_free_threshold_ = decommit_total_free_threshold;
    return *this;
  }
 
  LoadConfiguration& lock_prefix_table(uint64_t lock_prefix_table) {
    lock_prefix_table_ = lock_prefix_table;
    return *this;
  }
 
  LoadConfiguration& maximum_allocation_size(uint64_t maximum_allocation_size) {
    maximum_allocation_size_ = maximum_allocation_size;
    return *this;
  }
 
  LoadConfiguration& virtual_memory_threshold(uint64_t virtual_memory_threshold) {
    virtual_memory_threshold_ = virtual_memory_threshold;
    return *this;
  }
 
  LoadConfiguration& process_affinity_mask(uint64_t process_affinity_mask) {
    process_affinity_mask_ = process_affinity_mask;
    return *this;
  }
 
  LoadConfiguration& process_heap_flags(uint32_t process_heap_flagsid) {
    process_heap_flags_ = process_heap_flagsid;
    return *this;
  }
 
  LoadConfiguration& csd_version(uint16_t csd_version) {
    csd_version_ = csd_version;
    return *this;
  }
 
  LoadConfiguration& reserved1(uint16_t reserved1) {
    reserved1_ = reserved1;
    return *this;
  }
 
  LoadConfiguration& dependent_load_flags(uint16_t flags) {
    reserved1(flags);
    return *this;
  }
 
  LoadConfiguration& editlist(uint64_t editlist) {
    editlist_ = editlist;
    return *this;
  }
 
  LoadConfiguration& security_cookie(uint64_t security_cookie) {
    security_cookie_ = security_cookie;
    return *this;
  }
 
  LoadConfiguration& se_handler_table(uint64_t se_handler_table) {
    se_handler_table_ = se_handler_table;
    return *this;
  }
 
  LoadConfiguration& se_handler_count(uint64_t se_handler_count) {
    se_handler_count_ = se_handler_count;
    return *this;
  }
 
  LoadConfiguration& guard_cf_check_function_pointer(uint64_t check_pointer) {
    guard_cf_check_function_pointer_ = check_pointer;
    return *this;
  }
 
  LoadConfiguration& guard_cf_dispatch_function_pointer(uint64_t dispatch_pointer) {
    guard_cf_dispatch_function_pointer_ = dispatch_pointer;
    return *this;
  }
 
  LoadConfiguration& guard_cf_function_table(uint64_t guard_cf_function_table) {
    guard_cf_function_table_ = guard_cf_function_table;
    return *this;
  }
 
  LoadConfiguration& guard_cf_function_count(uint64_t guard_cf_function_count) {
    guard_cf_function_count_ = guard_cf_function_count;
    return *this;
  }
 
  LoadConfiguration& guard_flags(IMAGE_GUARD flags) {
    flags_ = (uint32_t)flags;
    return *this;
  }
 
  LoadConfiguration& guard_flags(uint32_t flags) {
    flags_ = flags;
    return *this;
  }
 
  LoadConfiguration& code_integrity(CodeIntegrity CI) {
    code_integrity_ = std::move(CI);
    return *this;
  }
 
  LoadConfiguration& guard_address_taken_iat_entry_table(uint64_t value) {
    guard_address_taken_iat_entry_table_ = value;
    return *this;
  }
 
  LoadConfiguration& guard_address_taken_iat_entry_count(uint64_t value) {
    guard_address_taken_iat_entry_count_ = value;
    return *this;
  }
 
  LoadConfiguration& guard_long_jump_target_table(uint64_t value) {
    guard_long_jump_target_table_ = value;
    return *this;
  }
 
  LoadConfiguration& guard_long_jump_target_count(uint64_t value) {
    guard_long_jump_target_count_ = value;
    return *this;
  }
 
  LoadConfiguration& dynamic_value_reloc_table(uint64_t value) {
    dynamic_value_reloc_table_ = value;
    return *this;
  }
 
  LoadConfiguration& hybrid_metadata_pointer(uint64_t value) {
    hybrid_metadata_pointer_ = value;
    return *this;
  }
 
  LoadConfiguration& guard_rf_failure_routine(uint64_t value) {
    guard_rf_failure_routine_ = value;
    return *this;
  }
 
  LoadConfiguration& guard_rf_failure_routine_function_pointer(uint64_t value) {
    guard_rf_failure_routine_function_pointer_ = value;
    return *this;
  }
 
  LoadConfiguration& dynamic_value_reloctable_offset(uint32_t value) {
    dynamic_value_reloctable_offset_ = value;
    return *this;
  }
 
  LoadConfiguration& dynamic_value_reloctable_section(uint16_t value) {
    dynamic_value_reloctable_section_ = value;
    return *this;
  }
 
  LoadConfiguration& reserved2(uint16_t value) {
    reserved2_ = value;
    return *this;
  }
 
  LoadConfiguration& guard_rf_verify_stackpointer_function_pointer(uint64_t value) {
    guardrf_verify_stackpointer_function_pointer_ = value;
    return *this;
  }
 
  LoadConfiguration& hotpatch_table_offset(uint32_t value) {
    hotpatch_table_offset_ = value;
    return *this;
  }
 
  LoadConfiguration& reserved3(uint32_t value) {
    reserved3_ = value;
    return *this;
  }
 
  LoadConfiguration& enclave_configuration_ptr(uint64_t value) {
    enclave_configuration_ptr_ = value;
    return *this;
  }
 
  LoadConfiguration& volatile_metadata_pointer(uint64_t value) {
    volatile_metadata_pointer_ = value;
    return *this;
  }
 
  LoadConfiguration& guard_eh_continuation_table(uint64_t value) {
    guard_eh_continuation_table_ = value;
    return *this;
  }
 
  LoadConfiguration& guard_eh_continuation_count(uint64_t value) {
    guard_eh_continuation_count_ = value;
    return *this;
  }
 
  LoadConfiguration& guard_xfg_check_function_pointer(uint64_t value) {
    guard_xfg_check_function_pointer_ = value;
    return *this;
  }
 
  LoadConfiguration& guard_xfg_dispatch_function_pointer(uint64_t value) {
    guard_xfg_dispatch_function_pointer_ = value;
    return *this;
  }
 
  LoadConfiguration& guard_xfg_table_dispatch_function_pointer(uint64_t value) {
    guard_xfg_table_dispatch_function_pointer_ = value;
    return *this;
  }
 
  LoadConfiguration& cast_guard_os_determined_failure_mode(uint64_t value) {
    cast_guard_os_determined_failure_mode_ = value;
    return *this;
  }
 
  LoadConfiguration& guard_memcpy_function_pointer(uint64_t value) {
    guard_memcpy_function_pointer_ = value;
    return *this;
  }
 
  LoadConfiguration& uma_function_pointers(uint64_t value) {
    uma_function_pointers_ = value;
    return *this;
  }
 
  ~LoadConfiguration() override;
 
  void accept(Visitor& visitor) const override;
 
  std::string to_string() const;
 
  LIEF_API friend
    std::ostream& operator<<(std::ostream& os, const LoadConfiguration& config)
  {
    os << config.to_string();
    return os;
  }

  LIEF_LOCAL static ok_error_t parse_seh_table(
    Parser& ctx, BinaryStream& stream, LoadConfiguration& config);

  LIEF_LOCAL static ok_error_t parse_guard_functions(
    Parser& ctx, BinaryStream& stream, LoadConfiguration& config,
    size_t count, guard_functions_t LoadConfiguration::* dst);

  LIEF_LOCAL static ok_error_t parse_dyn_relocs(
    Parser& ctx, LoadConfiguration& config);

  template<uint8_t version, class PE_T>
  LIEF_LOCAL static ok_error_t parse_dyn_relocs_entries(
    Parser& ctx, BinaryStream& stream, LoadConfiguration& config,
    size_t size);

  template<class PE_T>
  LIEF_LOCAL static ok_error_t parse_enclave_config(
    Parser& ctx, LoadConfiguration& config);

  LIEF_LOCAL static ok_error_t parse_volatile_metadata(
    Parser& ctx, LoadConfiguration& config);
 
  protected:
  uint32_t characteristics_ = 0;
  uint32_t timedatestamp_ = 0;
 
  uint16_t major_version_ = 0;
  uint16_t minor_version_ = 0;
 
  uint32_t global_flags_clear_ = 0;
  uint32_t global_flags_set_ = 0;
 
  uint32_t critical_section_default_timeout_ = 0;
 
  uint64_t decommit_free_block_threshold_ = 0;
  uint64_t decommit_total_free_threshold_ = 0;
 
  uint64_t lock_prefix_table_ = 0;
  uint64_t maximum_allocation_size_ = 0;
  uint64_t virtual_memory_threshold_ = 0;
  uint64_t process_affinity_mask_ = 0;
  uint32_t process_heap_flags_ = 0;
  uint16_t csd_version_ = 0;
  uint16_t reserved1_ = 0;  // named DependentLoadFlags in recent headers
  uint64_t editlist_ = 0;
  uint64_t security_cookie_ = 0;
 
  optional<uint64_t> se_handler_table_;
  optional<uint64_t> se_handler_count_;
 
  optional<uint64_t> guard_cf_check_function_pointer_;
  optional<uint64_t> guard_cf_dispatch_function_pointer_;
  optional<uint64_t> guard_cf_function_table_;
  optional<uint64_t> guard_cf_function_count_;
  optional<uint32_t> flags_;
 
  optional<CodeIntegrity> code_integrity_;
 
  optional<uint64_t> guard_address_taken_iat_entry_table_;
  optional<uint64_t> guard_address_taken_iat_entry_count_;
  optional<uint64_t> guard_long_jump_target_table_;
  optional<uint64_t> guard_long_jump_target_count_;
 
  optional<uint64_t> dynamic_value_reloc_table_;
  optional<uint64_t> hybrid_metadata_pointer_;
 
  optional<uint64_t> guard_rf_failure_routine_;
  optional<uint64_t> guard_rf_failure_routine_function_pointer_;
  optional<uint32_t> dynamic_value_reloctable_offset_;
  optional<uint16_t> dynamic_value_reloctable_section_;
  optional<uint16_t> reserved2_;
 
  optional<uint64_t> guardrf_verify_stackpointer_function_pointer_;
  optional<uint32_t> hotpatch_table_offset_;
 
  optional<uint32_t> reserved3_;
  optional<uint64_t> enclave_configuration_ptr_;
 
  optional<uint64_t> volatile_metadata_pointer_;
 
  optional<uint64_t> guard_eh_continuation_table_;
  optional<uint64_t> guard_eh_continuation_count_;
 
  optional<uint64_t> guard_xfg_check_function_pointer_;
  optional<uint64_t> guard_xfg_dispatch_function_pointer_;
  optional<uint64_t> guard_xfg_table_dispatch_function_pointer_;
 
  optional<uint64_t> cast_guard_os_determined_failure_mode_;
 
  optional<uint64_t> guard_memcpy_function_pointer_;
 
  optional<uint64_t> uma_function_pointers_;
 
  std::unique_ptr<CHPEMetadata> chpe_;
  std::vector<uint32_t> seh_rva_;
  guard_functions_t guard_cf_functions_;
  guard_functions_t guard_address_taken_iat_entries_;
  guard_functions_t guard_long_jump_targets_;
  guard_functions_t guard_eh_continuation_functions_;
  dynamic_relocations_t dynamic_relocs_;
  std::unique_ptr<EnclaveConfiguration> enclave_config_;
  std::unique_ptr<VolatileMetadata> volatile_metadata_;
};
 
LIEF_API const char* to_string(LoadConfiguration::IMAGE_GUARD e);
 
}
}
 
#endif