LIEF: Library to Instrument Executable Formats Version 1.0.0
Loading...
Searching...
No Matches
OptionalHeader.hpp
Go to the documentation of this file.
1/* Copyright 2017 - 2026 R. Thomas
2 * Copyright 2017 - 2026 Quarkslab
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16#ifndef LIEF_PE_OPTIONAL_HEADER_H
17#define LIEF_PE_OPTIONAL_HEADER_H
18#include <ostream>
19#include <vector>
20#include <cstdint>
21
22#include "LIEF/Object.hpp"
23#include "LIEF/visibility.h"
24
25#include "LIEF/enums.hpp"
26#include "LIEF/PE/enums.hpp"
27
28namespace LIEF {
29namespace PE {
30class Parser;
31class Binary;
32
33namespace details {
34struct pe32_optional_header;
35struct pe64_optional_header;
36}
37
43 friend class Parser;
44 friend class Binary;
45 public:
46
47 enum class DLL_CHARACTERISTICS: size_t {
48 HIGH_ENTROPY_VA = 0x0020,
49 DYNAMIC_BASE = 0x0040,
50 FORCE_INTEGRITY = 0x0080,
51 NX_COMPAT = 0x0100,
52 NO_ISOLATION = 0x0200,
53 NO_SEH = 0x0400,
54 NO_BIND = 0x0800,
55 APPCONTAINER = 0x1000,
56 WDM_DRIVER = 0x2000,
57 GUARD_CF = 0x4000,
59 };
60
78
79 OptionalHeader(const details::pe32_optional_header& header);
80 OptionalHeader(const details::pe64_optional_header& header);
81 ~OptionalHeader() override = default;
82
84 OptionalHeader(const OptionalHeader&) = default;
85
87
89 PE_TYPE magic() const {
90 return magic_;
91 }
92
94 uint8_t major_linker_version() const {
95 return major_linker_version_;
96 }
97
99 uint8_t minor_linker_version() const {
100 return minor_linker_version_;
101 }
102
105 uint32_t sizeof_code() const {
106 return sizeof_code_;
107 }
108
114 uint32_t sizeof_initialized_data() const {
115 return sizeof_initialized_data_;
116 }
117
123 uint32_t sizeof_uninitialized_data() const {
124 return sizeof_uninitialized_data_;
125 }
126
132 uint32_t addressof_entrypoint() const {
133 return entrypoint_;
134 }
135
137 uint32_t baseof_code() const {
138 return baseof_code_;
139 }
140
144 uint32_t baseof_data() const {
145 return baseof_data_;
146 }
147
149 uint64_t imagebase() const {
150 return imagebase_;
151 }
152
157 uint32_t section_alignment() const {
158 return section_align_;
159 }
160
163 uint32_t file_alignment() const {
164 return file_align_;
165 }
166
169 return major_os_version_;
170 }
171
174 return minor_os_version_;
175 }
176
178 uint16_t major_image_version() const {
179 return major_image_version_;
180 }
181
183 uint16_t minor_image_version() const {
184 return minor_image_version_;
185 }
186
188 uint16_t major_subsystem_version() const {
189 return major_subsys_version_;
190 }
191
193 uint16_t minor_subsystem_version() const {
194 return minor_subsys_version_;
195 }
196
199 uint32_t win32_version_value() const {
200 return win32_version_value_;
201 }
202
206 uint32_t sizeof_image() const {
207 return sizeof_image_;
208 }
209
211 uint32_t sizeof_headers() const {
212 return sizeof_headers_;
213 }
214
219 uint32_t checksum() const {
220 return checksum_;
221 }
222
225 return subsystem_;
226 }
227
231 uint32_t dll_characteristics() const {
232 return dll_characteristics_;
233 }
234
239 uint64_t sizeof_stack_reserve() const {
240 return sizeof_stack_reserve_;
241 }
242
244 uint64_t sizeof_stack_commit() const {
245 return sizeof_stack_commit_;
246 }
247
249 uint64_t sizeof_heap_reserve() const {
250 return sizeof_heap_reserve_;
251 }
252
254 uint64_t sizeof_heap_commit() const {
255 return sizeof_heap_commit_;
256 }
257
259 uint32_t loader_flags() const {
260 return loader_flags_;
261 }
262
264 uint32_t numberof_rva_and_size() const {
265 return nb_rva_size_;
266 }
267
269 bool has(DLL_CHARACTERISTICS c) const {
270 return (dll_characteristics() & static_cast<uint32_t>(c)) != 0;
271 }
272
274 std::vector<DLL_CHARACTERISTICS> dll_characteristics_list() const;
275
278 dll_characteristics(dll_characteristics() | static_cast<uint32_t>(c));
279 }
280
283 dll_characteristics(dll_characteristics() & (~ static_cast<uint32_t>(c)));
284 }
285
287 magic_ = magic;
288 }
289
290 void major_linker_version(uint8_t value) {
291 major_linker_version_ = value;
292 }
293
294 void minor_linker_version(uint8_t value) {
295 minor_linker_version_ = value;
296 }
297
298 void sizeof_code(uint32_t value) {
299 sizeof_code_ = value;
300 }
301
302 void sizeof_initialized_data(uint32_t value) {
303 sizeof_initialized_data_ = value;
304 }
305
306 void sizeof_uninitialized_data(uint32_t value) {
307 sizeof_uninitialized_data_ = value;
308 }
309
310 void addressof_entrypoint(uint32_t value) {
311 entrypoint_ = value;
312 }
313
314 void baseof_code(uint32_t value) {
315 baseof_code_ = value;
316 }
317
318 void baseof_data(uint32_t value) {
319 baseof_data_ = value;
320 }
321
322 void imagebase(uint64_t value) {
323 imagebase_ = value;
324 }
325
326 void section_alignment(uint32_t value) {
327 section_align_ = value;
328 }
329
330 void file_alignment(uint32_t value) {
331 file_align_ = value;
332 }
333
334 void major_operating_system_version(uint16_t value) {
335 major_os_version_ = value;
336 }
337
338 void minor_operating_system_version(uint16_t value) {
339 minor_os_version_ = value;
340 }
341
342 void major_image_version(uint16_t value) {
343 major_image_version_ = value;
344 }
345
346 void minor_image_version(uint16_t value) {
347 minor_image_version_ = value;
348 }
349
350 void major_subsystem_version(uint16_t value) {
351 major_subsys_version_ = value;
352 }
353
354 void minor_subsystem_version(uint16_t value) {
355 minor_subsys_version_ = value;
356 }
357
358 void win32_version_value(uint32_t value) {
359 win32_version_value_ = value;
360 }
361
362 void sizeof_image(uint32_t value) {
363 sizeof_image_ = value;
364 }
365
366 void sizeof_headers(uint32_t value) {
367 sizeof_headers_ = value;
368 }
369
370 void checksum(uint32_t value) {
371 checksum_ = value;
372 }
373
374 void subsystem(SUBSYSTEM value) {
375 subsystem_ = value;
376 }
377
378 void dll_characteristics(uint32_t value) {
379 dll_characteristics_ = value;
380 }
381
382 void sizeof_stack_reserve(uint64_t value) {
383 sizeof_stack_reserve_ = value;
384 }
385
386 void sizeof_stack_commit(uint64_t value) {
387 sizeof_stack_commit_ = value;
388 }
389
390 void sizeof_heap_reserve(uint64_t value) {
391 sizeof_heap_reserve_ = value;
392 }
393
394 void sizeof_heap_commit(uint64_t value) {
395 sizeof_heap_commit_ = value;
396 }
397
398 void loader_flags(uint32_t value) {
399 loader_flags_ = value;
400 }
401
402 void numberof_rva_and_size(uint32_t value) {
403 nb_rva_size_ = value;
404 }
405
406 void accept(Visitor& visitor) const override;
407
409 add(c);
410 return *this;
411 }
413 remove(c);
414 return *this;
415 }
416
417 LIEF_API friend std::ostream& operator<<(std::ostream& os, const OptionalHeader& entry);
418
419 private:
420 OptionalHeader() = default;
421
422 PE_TYPE magic_ = PE_TYPE::PE32;
423 uint8_t major_linker_version_ = 0;
424 uint8_t minor_linker_version_ = 0;
425 uint32_t sizeof_code_ = 0;
426 uint32_t sizeof_initialized_data_ = 0;
427 uint32_t sizeof_uninitialized_data_ = 0;
428 uint32_t entrypoint_ = 0;
429 uint32_t baseof_code_ = 0;
430 uint32_t baseof_data_ = 0;
431 uint64_t imagebase_ = 0;
432 uint32_t section_align_ = 0;
433 uint32_t file_align_ = 0;
434 uint16_t major_os_version_ = 0;
435 uint16_t minor_os_version_ = 0;
436 uint16_t major_image_version_ = 0;
437 uint16_t minor_image_version_ = 0;
438 uint16_t major_subsys_version_ = 0;
439 uint16_t minor_subsys_version_ = 0;
440 uint32_t win32_version_value_ = 0;
441 uint32_t sizeof_image_ = 0;
442 uint32_t sizeof_headers_ = 0;
443 uint32_t checksum_ = 0;
444 SUBSYSTEM subsystem_ = SUBSYSTEM::UNKNOWN;
445 uint32_t dll_characteristics_ = 0;
446 uint64_t sizeof_stack_reserve_ = 0;
447 uint64_t sizeof_stack_commit_ = 0;
448 uint64_t sizeof_heap_reserve_ = 0;
449 uint64_t sizeof_heap_commit_ = 0;
450 uint32_t loader_flags_ = 0;
451 uint32_t nb_rva_size_ = 0;
452};
453
456
457}
458}
459
461
462#endif
Class which represents a PE binary This is the main interface to manage and modify a PE executable.
Definition PE/Binary.hpp:57
DLL_CHARACTERISTICS
Definition OptionalHeader.hpp:47
@ TERMINAL_SERVER_AWARE
Terminal Server aware.
Definition OptionalHeader.hpp:58
@ NO_SEH
Does not use structured exception handling (SEH). No SEH handler may be called in this image.
Definition OptionalHeader.hpp:53
@ NO_ISOLATION
Isolation aware, but do not isolate the image.
Definition OptionalHeader.hpp:52
@ DYNAMIC_BASE
DLL can be relocated at load time.
Definition OptionalHeader.hpp:49
@ NO_BIND
Do not bind the image.
Definition OptionalHeader.hpp:54
@ WDM_DRIVER
A WDM driver.
Definition OptionalHeader.hpp:56
@ APPCONTAINER
Image should execute in an AppContainer.
Definition OptionalHeader.hpp:55
@ GUARD_CF
Image supports Control Flow Guard.
Definition OptionalHeader.hpp:57
@ NX_COMPAT
Image is NX compatible.
Definition OptionalHeader.hpp:51
@ HIGH_ENTROPY_VA
ASLR with 64 bit address space.
Definition OptionalHeader.hpp:48
@ FORCE_INTEGRITY
Code integrity checks are enforced.
Definition OptionalHeader.hpp:50
uint16_t major_image_version() const
The major version number of the image.
Definition OptionalHeader.hpp:178
void baseof_data(uint32_t value)
Definition OptionalHeader.hpp:318
uint16_t minor_subsystem_version() const
The minor version number of the subsystem.
Definition OptionalHeader.hpp:193
void sizeof_code(uint32_t value)
Definition OptionalHeader.hpp:298
SUBSYSTEM
Definition OptionalHeader.hpp:61
@ WINDOWS_BOOT_APPLICATION
A BCD application.
Definition OptionalHeader.hpp:75
@ NATIVE_WINDOWS
Native Windows 9x driver.
Definition OptionalHeader.hpp:68
@ EFI_RUNTIME_DRIVER
An EFI driver with run-time services.
Definition OptionalHeader.hpp:72
@ OS2_CUI
The OS/2 character subsytem.
Definition OptionalHeader.hpp:66
@ UNKNOWN
An unknown subsystem.
Definition OptionalHeader.hpp:62
@ XBOX_CODE_CATALOG
Security Metadata Containers.
Definition OptionalHeader.hpp:76
@ WINDOWS_CE_GUI
Windows CE.
Definition OptionalHeader.hpp:69
@ POSIX_CUI
The POSIX character subsystem.
Definition OptionalHeader.hpp:67
@ EFI_BOOT_SERVICE_DRIVER
An EFI driver with boot services.
Definition OptionalHeader.hpp:71
@ EFI_ROM
An EFI ROM image.
Definition OptionalHeader.hpp:73
@ EFI_APPLICATION
An EFI application.
Definition OptionalHeader.hpp:70
@ WINDOWS_CUI
The Windows character subsystem.
Definition OptionalHeader.hpp:65
@ WINDOWS_GUI
The Windows GUI subsystem.
Definition OptionalHeader.hpp:64
@ NATIVE
Device drivers and native Windows processes.
Definition OptionalHeader.hpp:63
@ XBOX
XBOX.
Definition OptionalHeader.hpp:74
uint32_t numberof_rva_and_size() const
The number of DataDirectory that follow this header.
Definition OptionalHeader.hpp:264
friend std::ostream & operator<<(std::ostream &os, const OptionalHeader &entry)
uint32_t sizeof_uninitialized_data() const
The size of the uninitialized data which are usually located in the .bss section. If the uninitialize...
Definition OptionalHeader.hpp:123
void win32_version_value(uint32_t value)
Definition OptionalHeader.hpp:358
OptionalHeader(const details::pe64_optional_header &header)
std::vector< DLL_CHARACTERISTICS > dll_characteristics_list() const
Return the list of the dll_characteristics as an std::set of DLL_CHARACTERISTICS.
uint64_t sizeof_stack_commit() const
Size of the stack to commit.
Definition OptionalHeader.hpp:244
void major_subsystem_version(uint16_t value)
Definition OptionalHeader.hpp:350
void major_operating_system_version(uint16_t value)
Definition OptionalHeader.hpp:334
OptionalHeader & operator=(const OptionalHeader &)=default
void dll_characteristics(uint32_t value)
Definition OptionalHeader.hpp:378
bool has(DLL_CHARACTERISTICS c) const
Check if the given DLL_CHARACTERISTICS is included in the dll_characteristics.
Definition OptionalHeader.hpp:269
void sizeof_initialized_data(uint32_t value)
Definition OptionalHeader.hpp:302
void addressof_entrypoint(uint32_t value)
Definition OptionalHeader.hpp:310
void magic(PE_TYPE magic)
Definition OptionalHeader.hpp:286
uint8_t minor_linker_version() const
The linker minor version.
Definition OptionalHeader.hpp:99
uint8_t major_linker_version() const
The linker major version.
Definition OptionalHeader.hpp:94
uint32_t sizeof_headers() const
Size of the DosHeader + PE Header + Section headers rounded up to a multiple of the file_alignment.
Definition OptionalHeader.hpp:211
void remove(DLL_CHARACTERISTICS c)
Remove a DLL_CHARACTERISTICS from the current characteristics.
Definition OptionalHeader.hpp:282
uint16_t major_operating_system_version() const
The major version number of the required operating system.
Definition OptionalHeader.hpp:168
~OptionalHeader() override=default
void minor_linker_version(uint8_t value)
Definition OptionalHeader.hpp:294
void sizeof_image(uint32_t value)
Definition OptionalHeader.hpp:362
void minor_operating_system_version(uint16_t value)
Definition OptionalHeader.hpp:338
uint32_t win32_version_value() const
According to the official PE specifications, this value is reserved and should be 0.
Definition OptionalHeader.hpp:199
void loader_flags(uint32_t value)
Definition OptionalHeader.hpp:398
void sizeof_headers(uint32_t value)
Definition OptionalHeader.hpp:366
uint64_t sizeof_heap_commit() const
Size of the heap to commit.
Definition OptionalHeader.hpp:254
uint32_t sizeof_image() const
The size (in bytes) of the image, including all headers, as the image is loaded in memory.
Definition OptionalHeader.hpp:206
uint64_t imagebase() const
The preferred base address when mapping the binary in memory.
Definition OptionalHeader.hpp:149
uint32_t baseof_data() const
Address relative to the imagebase where the binary's data starts.
Definition OptionalHeader.hpp:144
void imagebase(uint64_t value)
Definition OptionalHeader.hpp:322
friend class Binary
Definition OptionalHeader.hpp:44
uint32_t section_alignment() const
The alignment (in bytes) of sections when they are loaded into memory.
Definition OptionalHeader.hpp:157
uint32_t sizeof_code() const
The size of the code .text section or the sum of all the sections that contain code (i....
Definition OptionalHeader.hpp:105
uint16_t minor_operating_system_version() const
The minor version number of the required operating system.
Definition OptionalHeader.hpp:173
uint16_t major_subsystem_version() const
The major version number of the subsystem.
Definition OptionalHeader.hpp:188
friend class Parser
Definition OptionalHeader.hpp:43
void subsystem(SUBSYSTEM value)
Definition OptionalHeader.hpp:374
uint32_t loader_flags() const
According to the PE specifications, this value is reserved and should be 0.
Definition OptionalHeader.hpp:259
SUBSYSTEM subsystem() const
Target subsystem like Driver, XBox, Windows GUI, ...
Definition OptionalHeader.hpp:224
void section_alignment(uint32_t value)
Definition OptionalHeader.hpp:326
uint32_t file_alignment() const
The section's file alignment. This value must be a power of 2 between 512 and 64K....
Definition OptionalHeader.hpp:163
void sizeof_stack_reserve(uint64_t value)
Definition OptionalHeader.hpp:382
void baseof_code(uint32_t value)
Definition OptionalHeader.hpp:314
void file_alignment(uint32_t value)
Definition OptionalHeader.hpp:330
OptionalHeader & operator+=(DLL_CHARACTERISTICS c)
Definition OptionalHeader.hpp:408
void accept(Visitor &visitor) const override
static OptionalHeader create(PE_TYPE type)
uint32_t baseof_code() const
Address relative to the imagebase where the binary's code starts.
Definition OptionalHeader.hpp:137
uint64_t sizeof_stack_reserve() const
Size of the stack to reserve when loading the PE binary.
Definition OptionalHeader.hpp:239
uint32_t sizeof_initialized_data() const
The size of the initialized data which are usually located in the .data section. If the initialized d...
Definition OptionalHeader.hpp:114
uint32_t dll_characteristics() const
Some characteristics of the underlying binary like the support of the PIE. The prefix dll comes from ...
Definition OptionalHeader.hpp:231
uint32_t checksum() const
The image file checksum. The algorithm for computing the checksum is incorporated into IMAGHELP....
Definition OptionalHeader.hpp:219
void major_image_version(uint16_t value)
Definition OptionalHeader.hpp:342
void sizeof_uninitialized_data(uint32_t value)
Definition OptionalHeader.hpp:306
OptionalHeader & operator-=(DLL_CHARACTERISTICS c)
Definition OptionalHeader.hpp:412
void minor_image_version(uint16_t value)
Definition OptionalHeader.hpp:346
uint16_t minor_image_version() const
The minor version number of the image.
Definition OptionalHeader.hpp:183
void major_linker_version(uint8_t value)
Definition OptionalHeader.hpp:290
OptionalHeader(const OptionalHeader &)=default
OptionalHeader(const details::pe32_optional_header &header)
uint32_t addressof_entrypoint() const
The address of the entry point relative to the image base when the executable file is loaded into mem...
Definition OptionalHeader.hpp:132
void minor_subsystem_version(uint16_t value)
Definition OptionalHeader.hpp:354
void add(DLL_CHARACTERISTICS c)
Add a DLL_CHARACTERISTICS to the current characteristics.
Definition OptionalHeader.hpp:277
void checksum(uint32_t value)
Definition OptionalHeader.hpp:370
void numberof_rva_and_size(uint32_t value)
Definition OptionalHeader.hpp:402
void sizeof_stack_commit(uint64_t value)
Definition OptionalHeader.hpp:386
uint64_t sizeof_heap_reserve() const
Size of the heap to reserve when loading the PE binary.
Definition OptionalHeader.hpp:249
PE_TYPE magic() const
Magic bytes: either PE32 or PE32+ for 64-bits PE files.
Definition OptionalHeader.hpp:89
void sizeof_heap_reserve(uint64_t value)
Definition OptionalHeader.hpp:390
void sizeof_heap_commit(uint64_t value)
Definition OptionalHeader.hpp:394
Main interface to parse PE binaries. In particular the static functions: Parser::parse should be used...
Definition PE/Parser.hpp:52
Definition Visitor.hpp:210
#define ENABLE_BITMASK_OPERATORS(X)
Definition enums.hpp:24
Definition DataDirectory.hpp:37
Namespace related to the LIEF's PE module.
Definition Abstract/Header.hpp:32
const char * to_string(CODE_PAGES e)
PE_TYPE
Definition PE/enums.hpp:22
@ PE32
32bits
Definition PE/enums.hpp:23
LIEF namespace.
Definition Abstract/Binary.hpp:40
#define LIEF_API
Definition visibility.h:41