LIEF: Library to Instrument Executable Formats Version 2.0.0
Loading...
Searching...
No Matches
OptionalHeader.hpp
Go to the documentation of this file.
1/* Copyright 2017 - 2026 R. Thomas
2 * Copyright 2017 - 2026 Quarkslab
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16#ifndef LIEF_PE_OPTIONAL_HEADER_H
17#define LIEF_PE_OPTIONAL_HEADER_H
18#include <cstdint>
19#include <optional>
20#include <ostream>
21#include <vector>
22
23#include "LIEF/Object.hpp"
25#include "LIEF/visibility.h"
26
27#include "LIEF/PE/enums.hpp"
28#include "LIEF/enums.hpp"
29
30namespace LIEF {
31class vector_iostream;
32}
33
34namespace LIEF::PE {
35class Parser;
36class Binary;
37
38namespace details {
39struct pe32_optional_header;
40struct pe64_optional_header;
41}
42
48 friend class Parser;
49 friend class Binary;
50
51 public:
52 enum class DLL_CHARACTERISTICS : size_t {
54 HIGH_ENTROPY_VA = 0x0020,
55
57 DYNAMIC_BASE = 0x0040,
58
60 FORCE_INTEGRITY = 0x0080,
61
63 NX_COMPAT = 0x0100,
64
66 NO_ISOLATION = 0x0200,
67
70 NO_SEH = 0x0400,
71
73 NO_BIND = 0x0800,
74
76 APPCONTAINER = 0x1000,
77
79 WDM_DRIVER = 0x2000,
80
82 GUARD_CF = 0x4000,
83
85 TERMINAL_SERVER_AWARE = 0x8000,
86 };
87
88 enum class SUBSYSTEM : size_t {
89 UNKNOWN = 0,
90 NATIVE = 1,
91 WINDOWS_GUI = 2,
92 WINDOWS_CUI = 3,
93 OS2_CUI = 5,
94 POSIX_CUI = 7,
95 NATIVE_WINDOWS = 8,
96 WINDOWS_CE_GUI = 9,
97 EFI_APPLICATION = 10,
98 EFI_BOOT_SERVICE_DRIVER = 11,
99 EFI_RUNTIME_DRIVER = 12,
100 EFI_ROM = 13,
101 XBOX = 14,
102 WINDOWS_BOOT_APPLICATION = 16,
103 XBOX_CODE_CATALOG = 17,
104 };
105
106 OptionalHeader(const details::pe32_optional_header& header);
107 OptionalHeader(const details::pe64_optional_header& header);
108 ~OptionalHeader() override = default;
109
112
114
116 PE_TYPE magic() const {
117 return magic_;
118 }
119
121 uint8_t major_linker_version() const {
122 return major_linker_version_;
123 }
124
126 uint8_t minor_linker_version() const {
127 return minor_linker_version_;
128 }
129
133 uint32_t sizeof_code() const {
134 return sizeof_code_;
135 }
136
143 uint32_t sizeof_initialized_data() const {
144 return sizeof_initialized_data_;
145 }
146
153 uint32_t sizeof_uninitialized_data() const {
154 return sizeof_uninitialized_data_;
155 }
156
163 uint32_t addressof_entrypoint() const {
164 return entrypoint_;
165 }
166
168 uint32_t baseof_code() const {
169 return baseof_code_;
170 }
171
175 uint32_t baseof_data() const {
176 return baseof_data_;
177 }
178
180 uint64_t imagebase() const {
181 return imagebase_;
182 }
183
188 uint32_t section_alignment() const {
189 return section_align_;
190 }
191
194 uint32_t file_alignment() const {
195 return file_align_;
196 }
197
200 return major_os_version_;
201 }
202
205 return minor_os_version_;
206 }
207
209 uint16_t major_image_version() const {
210 return major_image_version_;
211 }
212
214 uint16_t minor_image_version() const {
215 return minor_image_version_;
216 }
217
219 uint16_t major_subsystem_version() const {
220 return major_subsys_version_;
221 }
222
224 uint16_t minor_subsystem_version() const {
225 return minor_subsys_version_;
226 }
227
230 uint32_t win32_version_value() const {
231 return win32_version_value_;
232 }
233
239 uint32_t sizeof_image() const {
240 return sizeof_image_;
241 }
242
245 uint32_t sizeof_headers() const {
246 return sizeof_headers_;
247 }
248
255 uint32_t checksum() const {
256 return checksum_;
257 }
258
261 return subsystem_;
262 }
263
267 uint32_t dll_characteristics() const {
268 return dll_characteristics_;
269 }
270
275 uint64_t sizeof_stack_reserve() const {
276 return sizeof_stack_reserve_;
277 }
278
280 uint64_t sizeof_stack_commit() const {
281 return sizeof_stack_commit_;
282 }
283
285 uint64_t sizeof_heap_reserve() const {
286 return sizeof_heap_reserve_;
287 }
288
290 uint64_t sizeof_heap_commit() const {
291 return sizeof_heap_commit_;
292 }
293
296 uint32_t loader_flags() const {
297 return loader_flags_;
298 }
299
301 uint32_t numberof_rva_and_size() const {
302 return nb_rva_size_;
303 }
304
306 bool has(DLL_CHARACTERISTICS c) const {
307 return (dll_characteristics() & static_cast<uint32_t>(c)) != 0;
308 }
309
312 std::vector<DLL_CHARACTERISTICS> dll_characteristics_list() const;
313
316 dll_characteristics(dll_characteristics() | static_cast<uint32_t>(c));
317 }
318
321 dll_characteristics(dll_characteristics() & (~static_cast<uint32_t>(c)));
322 }
323
325 magic_ = magic;
326 }
327
328 void major_linker_version(uint8_t value) {
329 major_linker_version_ = value;
330 }
331
332 void minor_linker_version(uint8_t value) {
333 minor_linker_version_ = value;
334 }
335
336 void sizeof_code(uint32_t value) {
337 sizeof_code_ = value;
338 }
339
340 void sizeof_initialized_data(uint32_t value) {
341 sizeof_initialized_data_ = value;
342 }
343
344 void sizeof_uninitialized_data(uint32_t value) {
345 sizeof_uninitialized_data_ = value;
346 }
347
348 void addressof_entrypoint(uint32_t value) {
349 entrypoint_ = value;
350 }
351
352 void baseof_code(uint32_t value) {
353 baseof_code_ = value;
354 }
355
356 void baseof_data(uint32_t value) {
357 baseof_data_ = value;
358 }
359
360 void imagebase(uint64_t value) {
361 imagebase_ = value;
362 }
363
364 void section_alignment(uint32_t value) {
365 section_align_ = value;
366 }
367
368 void file_alignment(uint32_t value) {
369 file_align_ = value;
370 }
371
372 void major_operating_system_version(uint16_t value) {
373 major_os_version_ = value;
374 }
375
376 void minor_operating_system_version(uint16_t value) {
377 minor_os_version_ = value;
378 }
379
380 void major_image_version(uint16_t value) {
381 major_image_version_ = value;
382 }
383
384 void minor_image_version(uint16_t value) {
385 minor_image_version_ = value;
386 }
387
388 void major_subsystem_version(uint16_t value) {
389 major_subsys_version_ = value;
390 }
391
392 void minor_subsystem_version(uint16_t value) {
393 minor_subsys_version_ = value;
394 }
395
396 void win32_version_value(uint32_t value) {
397 win32_version_value_ = value;
398 }
399
400 void sizeof_image(uint32_t value) {
401 sizeof_image_ = value;
402 }
403
404 void sizeof_headers(uint32_t value) {
405 sizeof_headers_ = value;
406 }
407
408 void checksum(uint32_t value) {
409 checksum_ = value;
410 }
411
412 void subsystem(SUBSYSTEM value) {
413 subsystem_ = value;
414 }
415
416 void dll_characteristics(uint32_t value) {
417 dll_characteristics_ = value;
418 }
419
420 void sizeof_stack_reserve(uint64_t value) {
421 sizeof_stack_reserve_ = value;
422 }
423
424 void sizeof_stack_commit(uint64_t value) {
425 sizeof_stack_commit_ = value;
426 }
427
428 void sizeof_heap_reserve(uint64_t value) {
429 sizeof_heap_reserve_ = value;
430 }
431
432 void sizeof_heap_commit(uint64_t value) {
433 sizeof_heap_commit_ = value;
434 }
435
436 void loader_flags(uint32_t value) {
437 loader_flags_ = value;
438 }
439
440 void numberof_rva_and_size(uint32_t value) {
441 nb_rva_size_ = value;
442 }
443
444 void accept(Visitor& visitor) const override;
445
454
455 LIEF_API friend std::ostream& operator<<(std::ostream& os,
456 const OptionalHeader& entry);
457
459 template<typename PE_T>
460 LIEF_LOCAL size_t
461 serialize(vector_iostream& ios,
462 std::optional<uint64_t> imagebase = std::nullopt) const;
463
464 LIEF_LOCAL size_t
466 std::optional<uint64_t> imagebase = std::nullopt) const;
467
468
469 private:
470 OptionalHeader() = default;
471
472 PE_TYPE magic_ = PE_TYPE::PE32;
473 uint8_t major_linker_version_ = 0;
474 uint8_t minor_linker_version_ = 0;
475 uint32_t sizeof_code_ = 0;
476 uint32_t sizeof_initialized_data_ = 0;
477 uint32_t sizeof_uninitialized_data_ = 0;
478 uint32_t entrypoint_ = 0;
479 uint32_t baseof_code_ = 0;
480 uint32_t baseof_data_ = 0;
481 uint64_t imagebase_ = 0;
482 uint32_t section_align_ = 0;
483 uint32_t file_align_ = 0;
484 uint16_t major_os_version_ = 0;
485 uint16_t minor_os_version_ = 0;
486 uint16_t major_image_version_ = 0;
487 uint16_t minor_image_version_ = 0;
488 uint16_t major_subsys_version_ = 0;
489 uint16_t minor_subsys_version_ = 0;
490 uint32_t win32_version_value_ = 0;
491 uint32_t sizeof_image_ = 0;
492 uint32_t sizeof_headers_ = 0;
493 uint32_t checksum_ = 0;
494 SUBSYSTEM subsystem_ = SUBSYSTEM::UNKNOWN;
495 uint32_t dll_characteristics_ = 0;
496 uint64_t sizeof_stack_reserve_ = 0;
497 uint64_t sizeof_stack_commit_ = 0;
498 uint64_t sizeof_heap_reserve_ = 0;
499 uint64_t sizeof_heap_commit_ = 0;
500 uint32_t loader_flags_ = 0;
501 uint32_t nb_rva_size_ = 0;
502};
503
506
507}
508
509
511
512#endif
Class which represents a PE binary This is the main interface to manage and modify a PE executable.
Definition PE/Binary.hpp:59
DLL_CHARACTERISTICS
Definition OptionalHeader.hpp:52
uint16_t major_image_version() const
The major version number of the image.
Definition OptionalHeader.hpp:209
void baseof_data(uint32_t value)
Definition OptionalHeader.hpp:356
uint16_t minor_subsystem_version() const
The minor version number of the subsystem.
Definition OptionalHeader.hpp:224
void sizeof_code(uint32_t value)
Definition OptionalHeader.hpp:336
SUBSYSTEM
Definition OptionalHeader.hpp:88
@ UNKNOWN
An unknown subsystem.
Definition OptionalHeader.hpp:89
uint32_t numberof_rva_and_size() const
The number of DataDirectory that follow this header.
Definition OptionalHeader.hpp:301
friend std::ostream & operator<<(std::ostream &os, const OptionalHeader &entry)
uint32_t sizeof_uninitialized_data() const
The size of the uninitialized data which are usually located in the .bss section. If the uninitialize...
Definition OptionalHeader.hpp:153
void win32_version_value(uint32_t value)
Definition OptionalHeader.hpp:396
OptionalHeader(const details::pe64_optional_header &header)
std::vector< DLL_CHARACTERISTICS > dll_characteristics_list() const
Return the list of the dll_characteristics as an std::set of DLL_CHARACTERISTICS.
uint64_t sizeof_stack_commit() const
Size of the stack to commit.
Definition OptionalHeader.hpp:280
void major_subsystem_version(uint16_t value)
Definition OptionalHeader.hpp:388
void major_operating_system_version(uint16_t value)
Definition OptionalHeader.hpp:372
OptionalHeader & operator=(const OptionalHeader &)=default
void dll_characteristics(uint32_t value)
Definition OptionalHeader.hpp:416
bool has(DLL_CHARACTERISTICS c) const
Check if the given DLL_CHARACTERISTICS is included in the dll_characteristics.
Definition OptionalHeader.hpp:306
void sizeof_initialized_data(uint32_t value)
Definition OptionalHeader.hpp:340
void addressof_entrypoint(uint32_t value)
Definition OptionalHeader.hpp:348
void magic(PE_TYPE magic)
Definition OptionalHeader.hpp:324
uint8_t minor_linker_version() const
The linker minor version.
Definition OptionalHeader.hpp:126
uint8_t major_linker_version() const
The linker major version.
Definition OptionalHeader.hpp:121
uint32_t sizeof_headers() const
Size of the DosHeader + PE Header + Section headers rounded up to a multiple of the file_alignment.
Definition OptionalHeader.hpp:245
void remove(DLL_CHARACTERISTICS c)
Remove a DLL_CHARACTERISTICS from the current characteristics.
Definition OptionalHeader.hpp:320
uint16_t major_operating_system_version() const
The major version number of the required operating system.
Definition OptionalHeader.hpp:199
~OptionalHeader() override=default
void minor_linker_version(uint8_t value)
Definition OptionalHeader.hpp:332
void sizeof_image(uint32_t value)
Definition OptionalHeader.hpp:400
void minor_operating_system_version(uint16_t value)
Definition OptionalHeader.hpp:376
uint32_t win32_version_value() const
According to the official PE specifications, this value is reserved and should be 0.
Definition OptionalHeader.hpp:230
void loader_flags(uint32_t value)
Definition OptionalHeader.hpp:436
void sizeof_headers(uint32_t value)
Definition OptionalHeader.hpp:404
uint64_t sizeof_heap_commit() const
Size of the heap to commit.
Definition OptionalHeader.hpp:290
uint32_t sizeof_image() const
The size (in bytes) of the image, including all headers, as the image is loaded in memory.
Definition OptionalHeader.hpp:239
uint64_t imagebase() const
The preferred base address when mapping the binary in memory.
Definition OptionalHeader.hpp:180
uint32_t baseof_data() const
Address relative to the imagebase where the binary's data starts.
Definition OptionalHeader.hpp:175
void imagebase(uint64_t value)
Definition OptionalHeader.hpp:360
friend class Binary
Definition OptionalHeader.hpp:49
uint32_t section_alignment() const
The alignment (in bytes) of sections when they are loaded into memory.
Definition OptionalHeader.hpp:188
size_t serialize(LIEF::PE::PE_TYPE type, vector_iostream &ios, std::optional< uint64_t > imagebase=std::nullopt) const
uint32_t sizeof_code() const
The size of the code .text section or the sum of all the sections that contain code (i....
Definition OptionalHeader.hpp:133
uint16_t minor_operating_system_version() const
The minor version number of the required operating system.
Definition OptionalHeader.hpp:204
uint16_t major_subsystem_version() const
The major version number of the subsystem.
Definition OptionalHeader.hpp:219
friend class Parser
Definition OptionalHeader.hpp:48
void subsystem(SUBSYSTEM value)
Definition OptionalHeader.hpp:412
uint32_t loader_flags() const
According to the PE specifications, this value is reserved and should be 0.
Definition OptionalHeader.hpp:296
SUBSYSTEM subsystem() const
Target subsystem like Driver, XBox, Windows GUI, ...
Definition OptionalHeader.hpp:260
void section_alignment(uint32_t value)
Definition OptionalHeader.hpp:364
uint32_t file_alignment() const
The section's file alignment. This value must be a power of 2 between 512 and 64K....
Definition OptionalHeader.hpp:194
void sizeof_stack_reserve(uint64_t value)
Definition OptionalHeader.hpp:420
void baseof_code(uint32_t value)
Definition OptionalHeader.hpp:352
void file_alignment(uint32_t value)
Definition OptionalHeader.hpp:368
OptionalHeader & operator+=(DLL_CHARACTERISTICS c)
Definition OptionalHeader.hpp:446
void accept(Visitor &visitor) const override
static OptionalHeader create(PE_TYPE type)
uint32_t baseof_code() const
Address relative to the imagebase where the binary's code starts.
Definition OptionalHeader.hpp:168
uint64_t sizeof_stack_reserve() const
Size of the stack to reserve when loading the PE binary.
Definition OptionalHeader.hpp:275
uint32_t sizeof_initialized_data() const
The size of the initialized data which are usually located in the .data section. If the initialized d...
Definition OptionalHeader.hpp:143
uint32_t dll_characteristics() const
Some characteristics of the underlying binary like the support of the PIE. The prefix dll comes from ...
Definition OptionalHeader.hpp:267
uint32_t checksum() const
The image file checksum. The algorithm for computing the checksum is incorporated into IMAGHELP....
Definition OptionalHeader.hpp:255
void major_image_version(uint16_t value)
Definition OptionalHeader.hpp:380
void sizeof_uninitialized_data(uint32_t value)
Definition OptionalHeader.hpp:344
OptionalHeader & operator-=(DLL_CHARACTERISTICS c)
Definition OptionalHeader.hpp:450
void minor_image_version(uint16_t value)
Definition OptionalHeader.hpp:384
uint16_t minor_image_version() const
The minor version number of the image.
Definition OptionalHeader.hpp:214
void major_linker_version(uint8_t value)
Definition OptionalHeader.hpp:328
OptionalHeader(const OptionalHeader &)=default
OptionalHeader(const details::pe32_optional_header &header)
uint32_t addressof_entrypoint() const
The address of the entry point relative to the image base when the executable file is loaded into mem...
Definition OptionalHeader.hpp:163
void minor_subsystem_version(uint16_t value)
Definition OptionalHeader.hpp:392
void add(DLL_CHARACTERISTICS c)
Add a DLL_CHARACTERISTICS to the current characteristics.
Definition OptionalHeader.hpp:315
void checksum(uint32_t value)
Definition OptionalHeader.hpp:408
void numberof_rva_and_size(uint32_t value)
Definition OptionalHeader.hpp:440
void sizeof_stack_commit(uint64_t value)
Definition OptionalHeader.hpp:424
uint64_t sizeof_heap_reserve() const
Size of the heap to reserve when loading the PE binary.
Definition OptionalHeader.hpp:285
PE_TYPE magic() const
Magic bytes: either PE32 or PE32+ for 64-bits PE files.
Definition OptionalHeader.hpp:116
void sizeof_heap_reserve(uint64_t value)
Definition OptionalHeader.hpp:428
void sizeof_heap_commit(uint64_t value)
Definition OptionalHeader.hpp:432
Main interface to parse PE binaries. In particular, the static Parser::parse functions should be used...
Definition PE/Parser.hpp:54
Definition Visitor.hpp:212
Definition iostream.hpp:34
#define LIEF_LIFETIMEBOUND
Definition compiler_attributes.hpp:72
#define ENABLE_BITMASK_OPERATORS(X)
Definition enums.hpp:24
Definition DataDirectory.hpp:38
Namespace related to the LIEF's PE module.
Definition Abstract/Header.hpp:32
const char * to_string(CODE_PAGES e)
PE_TYPE
Definition PE/enums.hpp:22
@ PE32
32bits
Definition PE/enums.hpp:23
LIEF namespace.
Definition Abstract/Binary.hpp:42
#define LIEF_API
Definition visibility.h:45
#define LIEF_LOCAL
Definition visibility.h:46