LIEF: Library to Instrument Executable Formats Version 1.0.0
Loading...
Searching...
No Matches
OptionalHeader.hpp
Go to the documentation of this file.
1/* Copyright 2017 - 2026 R. Thomas
2 * Copyright 2017 - 2026 Quarkslab
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16#ifndef LIEF_PE_OPTIONAL_HEADER_H
17#define LIEF_PE_OPTIONAL_HEADER_H
18#include <ostream>
19#include <vector>
20#include <cstdint>
21
22#include "LIEF/Object.hpp"
23#include "LIEF/visibility.h"
24
25#include "LIEF/enums.hpp"
26#include "LIEF/PE/enums.hpp"
27
28namespace LIEF {
29namespace PE {
30class Parser;
31class Binary;
32
33namespace details {
34struct pe32_optional_header;
35struct pe64_optional_header;
36}
37
43 friend class Parser;
44 friend class Binary;
45
46 public:
47 enum class DLL_CHARACTERISTICS : size_t {
48 HIGH_ENTROPY_VA = 0x0020,
49 DYNAMIC_BASE = 0x0040,
50 FORCE_INTEGRITY = 0x0080,
51 NX_COMPAT = 0x0100,
52 NO_ISOLATION = 0x0200,
53 NO_SEH = 0x0400,
55 NO_BIND = 0x0800,
56 APPCONTAINER = 0x1000,
57 WDM_DRIVER = 0x2000,
58 GUARD_CF = 0x4000,
59 TERMINAL_SERVER_AWARE = 0x8000,
60 };
61
62 enum class SUBSYSTEM : size_t {
63 UNKNOWN = 0,
64 NATIVE = 1,
65 WINDOWS_GUI = 2,
66 WINDOWS_CUI = 3,
67 OS2_CUI = 5,
68 POSIX_CUI = 7,
69 NATIVE_WINDOWS = 8,
70 WINDOWS_CE_GUI = 9,
71 EFI_APPLICATION = 10,
72 EFI_BOOT_SERVICE_DRIVER = 11,
73 EFI_RUNTIME_DRIVER = 12,
74 EFI_ROM = 13,
75 XBOX = 14,
76 WINDOWS_BOOT_APPLICATION = 16,
77 XBOX_CODE_CATALOG = 17,
78 };
79
80 OptionalHeader(const details::pe32_optional_header& header);
81 OptionalHeader(const details::pe64_optional_header& header);
82 ~OptionalHeader() override = default;
83
85 OptionalHeader(const OptionalHeader&) = default;
86
88
90 PE_TYPE magic() const {
91 return magic_;
92 }
93
95 uint8_t major_linker_version() const {
96 return major_linker_version_;
97 }
98
100 uint8_t minor_linker_version() const {
101 return minor_linker_version_;
102 }
103
107 uint32_t sizeof_code() const {
108 return sizeof_code_;
109 }
110
117 uint32_t sizeof_initialized_data() const {
118 return sizeof_initialized_data_;
119 }
120
127 uint32_t sizeof_uninitialized_data() const {
128 return sizeof_uninitialized_data_;
129 }
130
137 uint32_t addressof_entrypoint() const {
138 return entrypoint_;
139 }
140
142 uint32_t baseof_code() const {
143 return baseof_code_;
144 }
145
149 uint32_t baseof_data() const {
150 return baseof_data_;
151 }
152
154 uint64_t imagebase() const {
155 return imagebase_;
156 }
157
162 uint32_t section_alignment() const {
163 return section_align_;
164 }
165
168 uint32_t file_alignment() const {
169 return file_align_;
170 }
171
174 return major_os_version_;
175 }
176
179 return minor_os_version_;
180 }
181
183 uint16_t major_image_version() const {
184 return major_image_version_;
185 }
186
188 uint16_t minor_image_version() const {
189 return minor_image_version_;
190 }
191
193 uint16_t major_subsystem_version() const {
194 return major_subsys_version_;
195 }
196
198 uint16_t minor_subsystem_version() const {
199 return minor_subsys_version_;
200 }
201
204 uint32_t win32_version_value() const {
205 return win32_version_value_;
206 }
207
213 uint32_t sizeof_image() const {
214 return sizeof_image_;
215 }
216
219 uint32_t sizeof_headers() const {
220 return sizeof_headers_;
221 }
222
229 uint32_t checksum() const {
230 return checksum_;
231 }
232
235 return subsystem_;
236 }
237
241 uint32_t dll_characteristics() const {
242 return dll_characteristics_;
243 }
244
249 uint64_t sizeof_stack_reserve() const {
250 return sizeof_stack_reserve_;
251 }
252
254 uint64_t sizeof_stack_commit() const {
255 return sizeof_stack_commit_;
256 }
257
259 uint64_t sizeof_heap_reserve() const {
260 return sizeof_heap_reserve_;
261 }
262
264 uint64_t sizeof_heap_commit() const {
265 return sizeof_heap_commit_;
266 }
267
270 uint32_t loader_flags() const {
271 return loader_flags_;
272 }
273
275 uint32_t numberof_rva_and_size() const {
276 return nb_rva_size_;
277 }
278
280 bool has(DLL_CHARACTERISTICS c) const {
281 return (dll_characteristics() & static_cast<uint32_t>(c)) != 0;
282 }
283
286 std::vector<DLL_CHARACTERISTICS> dll_characteristics_list() const;
287
290 dll_characteristics(dll_characteristics() | static_cast<uint32_t>(c));
291 }
292
295 dll_characteristics(dll_characteristics() & (~static_cast<uint32_t>(c)));
296 }
297
299 magic_ = magic;
300 }
301
302 void major_linker_version(uint8_t value) {
303 major_linker_version_ = value;
304 }
305
306 void minor_linker_version(uint8_t value) {
307 minor_linker_version_ = value;
308 }
309
310 void sizeof_code(uint32_t value) {
311 sizeof_code_ = value;
312 }
313
314 void sizeof_initialized_data(uint32_t value) {
315 sizeof_initialized_data_ = value;
316 }
317
318 void sizeof_uninitialized_data(uint32_t value) {
319 sizeof_uninitialized_data_ = value;
320 }
321
322 void addressof_entrypoint(uint32_t value) {
323 entrypoint_ = value;
324 }
325
326 void baseof_code(uint32_t value) {
327 baseof_code_ = value;
328 }
329
330 void baseof_data(uint32_t value) {
331 baseof_data_ = value;
332 }
333
334 void imagebase(uint64_t value) {
335 imagebase_ = value;
336 }
337
338 void section_alignment(uint32_t value) {
339 section_align_ = value;
340 }
341
342 void file_alignment(uint32_t value) {
343 file_align_ = value;
344 }
345
346 void major_operating_system_version(uint16_t value) {
347 major_os_version_ = value;
348 }
349
350 void minor_operating_system_version(uint16_t value) {
351 minor_os_version_ = value;
352 }
353
354 void major_image_version(uint16_t value) {
355 major_image_version_ = value;
356 }
357
358 void minor_image_version(uint16_t value) {
359 minor_image_version_ = value;
360 }
361
362 void major_subsystem_version(uint16_t value) {
363 major_subsys_version_ = value;
364 }
365
366 void minor_subsystem_version(uint16_t value) {
367 minor_subsys_version_ = value;
368 }
369
370 void win32_version_value(uint32_t value) {
371 win32_version_value_ = value;
372 }
373
374 void sizeof_image(uint32_t value) {
375 sizeof_image_ = value;
376 }
377
378 void sizeof_headers(uint32_t value) {
379 sizeof_headers_ = value;
380 }
381
382 void checksum(uint32_t value) {
383 checksum_ = value;
384 }
385
386 void subsystem(SUBSYSTEM value) {
387 subsystem_ = value;
388 }
389
390 void dll_characteristics(uint32_t value) {
391 dll_characteristics_ = value;
392 }
393
394 void sizeof_stack_reserve(uint64_t value) {
395 sizeof_stack_reserve_ = value;
396 }
397
398 void sizeof_stack_commit(uint64_t value) {
399 sizeof_stack_commit_ = value;
400 }
401
402 void sizeof_heap_reserve(uint64_t value) {
403 sizeof_heap_reserve_ = value;
404 }
405
406 void sizeof_heap_commit(uint64_t value) {
407 sizeof_heap_commit_ = value;
408 }
409
410 void loader_flags(uint32_t value) {
411 loader_flags_ = value;
412 }
413
414 void numberof_rva_and_size(uint32_t value) {
415 nb_rva_size_ = value;
416 }
417
418 void accept(Visitor& visitor) const override;
419
421 add(c);
422 return *this;
423 }
425 remove(c);
426 return *this;
427 }
428
429 LIEF_API friend std::ostream& operator<<(std::ostream& os,
430 const OptionalHeader& entry);
431
432 private:
433 OptionalHeader() = default;
434
435 PE_TYPE magic_ = PE_TYPE::PE32;
436 uint8_t major_linker_version_ = 0;
437 uint8_t minor_linker_version_ = 0;
438 uint32_t sizeof_code_ = 0;
439 uint32_t sizeof_initialized_data_ = 0;
440 uint32_t sizeof_uninitialized_data_ = 0;
441 uint32_t entrypoint_ = 0;
442 uint32_t baseof_code_ = 0;
443 uint32_t baseof_data_ = 0;
444 uint64_t imagebase_ = 0;
445 uint32_t section_align_ = 0;
446 uint32_t file_align_ = 0;
447 uint16_t major_os_version_ = 0;
448 uint16_t minor_os_version_ = 0;
449 uint16_t major_image_version_ = 0;
450 uint16_t minor_image_version_ = 0;
451 uint16_t major_subsys_version_ = 0;
452 uint16_t minor_subsys_version_ = 0;
453 uint32_t win32_version_value_ = 0;
454 uint32_t sizeof_image_ = 0;
455 uint32_t sizeof_headers_ = 0;
456 uint32_t checksum_ = 0;
457 SUBSYSTEM subsystem_ = SUBSYSTEM::UNKNOWN;
458 uint32_t dll_characteristics_ = 0;
459 uint64_t sizeof_stack_reserve_ = 0;
460 uint64_t sizeof_stack_commit_ = 0;
461 uint64_t sizeof_heap_reserve_ = 0;
462 uint64_t sizeof_heap_commit_ = 0;
463 uint32_t loader_flags_ = 0;
464 uint32_t nb_rva_size_ = 0;
465};
466
469
470}
471}
472
474
475#endif
Class which represents a PE binary This is the main interface to manage and modify a PE executable.
Definition PE/Binary.hpp:56
DLL_CHARACTERISTICS
Definition OptionalHeader.hpp:47
uint16_t major_image_version() const
The major version number of the image.
Definition OptionalHeader.hpp:183
void baseof_data(uint32_t value)
Definition OptionalHeader.hpp:330
uint16_t minor_subsystem_version() const
The minor version number of the subsystem.
Definition OptionalHeader.hpp:198
void sizeof_code(uint32_t value)
Definition OptionalHeader.hpp:310
SUBSYSTEM
Definition OptionalHeader.hpp:62
@ UNKNOWN
An unknown subsystem.
Definition OptionalHeader.hpp:63
uint32_t numberof_rva_and_size() const
The number of DataDirectory that follow this header.
Definition OptionalHeader.hpp:275
friend std::ostream & operator<<(std::ostream &os, const OptionalHeader &entry)
uint32_t sizeof_uninitialized_data() const
The size of the uninitialized data which are usually located in the .bss section. If the uninitialize...
Definition OptionalHeader.hpp:127
void win32_version_value(uint32_t value)
Definition OptionalHeader.hpp:370
OptionalHeader(const details::pe64_optional_header &header)
std::vector< DLL_CHARACTERISTICS > dll_characteristics_list() const
Return the list of the dll_characteristics as an std::set of DLL_CHARACTERISTICS.
uint64_t sizeof_stack_commit() const
Size of the stack to commit.
Definition OptionalHeader.hpp:254
void major_subsystem_version(uint16_t value)
Definition OptionalHeader.hpp:362
void major_operating_system_version(uint16_t value)
Definition OptionalHeader.hpp:346
OptionalHeader & operator=(const OptionalHeader &)=default
void dll_characteristics(uint32_t value)
Definition OptionalHeader.hpp:390
bool has(DLL_CHARACTERISTICS c) const
Check if the given DLL_CHARACTERISTICS is included in the dll_characteristics.
Definition OptionalHeader.hpp:280
void sizeof_initialized_data(uint32_t value)
Definition OptionalHeader.hpp:314
void addressof_entrypoint(uint32_t value)
Definition OptionalHeader.hpp:322
void magic(PE_TYPE magic)
Definition OptionalHeader.hpp:298
uint8_t minor_linker_version() const
The linker minor version.
Definition OptionalHeader.hpp:100
uint8_t major_linker_version() const
The linker major version.
Definition OptionalHeader.hpp:95
uint32_t sizeof_headers() const
Size of the DosHeader + PE Header + Section headers rounded up to a multiple of the file_alignment.
Definition OptionalHeader.hpp:219
void remove(DLL_CHARACTERISTICS c)
Remove a DLL_CHARACTERISTICS from the current characteristics.
Definition OptionalHeader.hpp:294
uint16_t major_operating_system_version() const
The major version number of the required operating system.
Definition OptionalHeader.hpp:173
~OptionalHeader() override=default
void minor_linker_version(uint8_t value)
Definition OptionalHeader.hpp:306
void sizeof_image(uint32_t value)
Definition OptionalHeader.hpp:374
void minor_operating_system_version(uint16_t value)
Definition OptionalHeader.hpp:350
uint32_t win32_version_value() const
According to the official PE specifications, this value is reserved and should be 0.
Definition OptionalHeader.hpp:204
void loader_flags(uint32_t value)
Definition OptionalHeader.hpp:410
void sizeof_headers(uint32_t value)
Definition OptionalHeader.hpp:378
uint64_t sizeof_heap_commit() const
Size of the heap to commit.
Definition OptionalHeader.hpp:264
uint32_t sizeof_image() const
The size (in bytes) of the image, including all headers, as the image is loaded in memory.
Definition OptionalHeader.hpp:213
uint64_t imagebase() const
The preferred base address when mapping the binary in memory.
Definition OptionalHeader.hpp:154
uint32_t baseof_data() const
Address relative to the imagebase where the binary's data starts.
Definition OptionalHeader.hpp:149
void imagebase(uint64_t value)
Definition OptionalHeader.hpp:334
friend class Binary
Definition OptionalHeader.hpp:44
uint32_t section_alignment() const
The alignment (in bytes) of sections when they are loaded into memory.
Definition OptionalHeader.hpp:162
uint32_t sizeof_code() const
The size of the code .text section or the sum of all the sections that contain code (i....
Definition OptionalHeader.hpp:107
uint16_t minor_operating_system_version() const
The minor version number of the required operating system.
Definition OptionalHeader.hpp:178
uint16_t major_subsystem_version() const
The major version number of the subsystem.
Definition OptionalHeader.hpp:193
friend class Parser
Definition OptionalHeader.hpp:43
void subsystem(SUBSYSTEM value)
Definition OptionalHeader.hpp:386
uint32_t loader_flags() const
According to the PE specifications, this value is reserved and should be 0.
Definition OptionalHeader.hpp:270
SUBSYSTEM subsystem() const
Target subsystem like Driver, XBox, Windows GUI, ...
Definition OptionalHeader.hpp:234
void section_alignment(uint32_t value)
Definition OptionalHeader.hpp:338
uint32_t file_alignment() const
The section's file alignment. This value must be a power of 2 between 512 and 64K....
Definition OptionalHeader.hpp:168
void sizeof_stack_reserve(uint64_t value)
Definition OptionalHeader.hpp:394
void baseof_code(uint32_t value)
Definition OptionalHeader.hpp:326
void file_alignment(uint32_t value)
Definition OptionalHeader.hpp:342
OptionalHeader & operator+=(DLL_CHARACTERISTICS c)
Definition OptionalHeader.hpp:420
void accept(Visitor &visitor) const override
static OptionalHeader create(PE_TYPE type)
uint32_t baseof_code() const
Address relative to the imagebase where the binary's code starts.
Definition OptionalHeader.hpp:142
uint64_t sizeof_stack_reserve() const
Size of the stack to reserve when loading the PE binary.
Definition OptionalHeader.hpp:249
uint32_t sizeof_initialized_data() const
The size of the initialized data which are usually located in the .data section. If the initialized d...
Definition OptionalHeader.hpp:117
uint32_t dll_characteristics() const
Some characteristics of the underlying binary like the support of the PIE. The prefix dll comes from ...
Definition OptionalHeader.hpp:241
uint32_t checksum() const
The image file checksum. The algorithm for computing the checksum is incorporated into IMAGHELP....
Definition OptionalHeader.hpp:229
void major_image_version(uint16_t value)
Definition OptionalHeader.hpp:354
void sizeof_uninitialized_data(uint32_t value)
Definition OptionalHeader.hpp:318
OptionalHeader & operator-=(DLL_CHARACTERISTICS c)
Definition OptionalHeader.hpp:424
void minor_image_version(uint16_t value)
Definition OptionalHeader.hpp:358
uint16_t minor_image_version() const
The minor version number of the image.
Definition OptionalHeader.hpp:188
void major_linker_version(uint8_t value)
Definition OptionalHeader.hpp:302
OptionalHeader(const OptionalHeader &)=default
OptionalHeader(const details::pe32_optional_header &header)
uint32_t addressof_entrypoint() const
The address of the entry point relative to the image base when the executable file is loaded into mem...
Definition OptionalHeader.hpp:137
void minor_subsystem_version(uint16_t value)
Definition OptionalHeader.hpp:366
void add(DLL_CHARACTERISTICS c)
Add a DLL_CHARACTERISTICS to the current characteristics.
Definition OptionalHeader.hpp:289
void checksum(uint32_t value)
Definition OptionalHeader.hpp:382
void numberof_rva_and_size(uint32_t value)
Definition OptionalHeader.hpp:414
void sizeof_stack_commit(uint64_t value)
Definition OptionalHeader.hpp:398
uint64_t sizeof_heap_reserve() const
Size of the heap to reserve when loading the PE binary.
Definition OptionalHeader.hpp:259
PE_TYPE magic() const
Magic bytes: either PE32 or PE32+ for 64-bits PE files.
Definition OptionalHeader.hpp:90
void sizeof_heap_reserve(uint64_t value)
Definition OptionalHeader.hpp:402
void sizeof_heap_commit(uint64_t value)
Definition OptionalHeader.hpp:406
Main interface to parse PE binaries. In particular, the static Parser::parse functions should be used...
Definition PE/Parser.hpp:52
Definition Visitor.hpp:212
#define ENABLE_BITMASK_OPERATORS(X)
Definition enums.hpp:24
Definition DataDirectory.hpp:37
Namespace related to the LIEF's PE module.
Definition Abstract/Header.hpp:32
const char * to_string(CODE_PAGES e)
PE_TYPE
Definition PE/enums.hpp:22
@ PE32
32bits
Definition PE/enums.hpp:23
LIEF namespace.
Definition Abstract/Binary.hpp:40
#define LIEF_API
Definition visibility.h:43