PE/Binary.hpp

Go to the documentation of this file.

/* Copyright 2017 - 2026 R. Thomas
 * Copyright 2017 - 2026 Quarkslab
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#ifndef LIEF_PE_BINARY_H
#define LIEF_PE_BINARY_H
 
#include "LIEF/PE/Header.hpp"
#include "LIEF/PE/OptionalHeader.hpp"
#include "LIEF/PE/DosHeader.hpp"
#include "LIEF/PE/Import.hpp"
#include "LIEF/PE/DelayImport.hpp"
#include "LIEF/PE/DataDirectory.hpp"
#include "LIEF/PE/Builder.hpp"
#include "LIEF/PE/ResourcesManager.hpp"
#include "LIEF/PE/signature/Signature.hpp"
 
#include "LIEF/COFF/Symbol.hpp"
#include "LIEF/COFF/String.hpp"
 
#include "LIEF/Abstract/Binary.hpp"
 
#include "LIEF/visibility.h"
 
namespace LIEF {

namespace PE {
class ExceptionInfo;
class CodeViewPDB;
class Debug;
class Export;
class LoadConfiguration;
class Parser;
class Relocation;
class ResourceData;
class ResourceDirectory;
class ResourceNode;
class RichHeader;
class TLS;
class Factory;

class LIEF_API Binary : public LIEF::Binary {
  friend class Parser;
  friend class Builder;
  friend class Factory;
 
  public:
  using sections_t = std::vector<std::unique_ptr<Section>>;

  using it_sections = ref_iterator<sections_t&, Section*>;

  using it_const_sections = const_ref_iterator<const sections_t&, const Section*>;

  using data_directories_t = std::vector<std::unique_ptr<DataDirectory>>;

  using it_data_directories = ref_iterator<data_directories_t&, DataDirectory*>;

  using it_const_data_directories =
      const_ref_iterator<const data_directories_t&, const DataDirectory*>;

  using relocations_t = std::vector<std::unique_ptr<Relocation>>;

  using it_relocations = ref_iterator<relocations_t&, Relocation*>;

  using it_const_relocations =
      const_ref_iterator<const relocations_t&, const Relocation*>;

  using imports_t = std::vector<std::unique_ptr<Import>>;

  using it_imports = ref_iterator<imports_t&, Import*>;

  using it_const_imports = const_ref_iterator<const imports_t&, const Import*>;

  using delay_imports_t = std::vector<std::unique_ptr<DelayImport>>;

  using it_delay_imports = ref_iterator<delay_imports_t&, DelayImport*>;

  using it_const_delay_imports =
      const_ref_iterator<const delay_imports_t&, const DelayImport*>;

  using debug_entries_t = std::vector<std::unique_ptr<Debug>>;

  using it_debug_entries = ref_iterator<debug_entries_t&, Debug*>;

  using it_const_debug_entries =
      const_ref_iterator<const debug_entries_t&, const Debug*>;

  using symbols_t = std::vector<std::unique_ptr<COFF::Symbol>>;

  using it_symbols = ref_iterator<symbols_t&, COFF::Symbol*>;

  using it_const_symbols =
      const_ref_iterator<const symbols_t&, const COFF::Symbol*>;

  using strings_table_t = std::vector<COFF::String>;

  using it_strings_table = ref_iterator<strings_table_t&>;

  using it_const_strings_table = const_ref_iterator<const strings_table_t&>;

  using signatures_t = std::vector<Signature>;

  using it_signatures = ref_iterator<signatures_t&>;

  using it_const_signatures = const_ref_iterator<const signatures_t&>;

  using exceptions_t = std::vector<std::unique_ptr<ExceptionInfo>>;

  using it_exceptions = ref_iterator<exceptions_t&, ExceptionInfo*>;

  using it_const_exceptions =
      const_ref_iterator<const exceptions_t&, const ExceptionInfo*>;
 
  Binary();
  ~Binary() override;

  PE_TYPE type() const {
    return type_;
  }

  uint64_t rva_to_offset(uint64_t RVA) const;

  uint64_t va_to_offset(uint64_t VA) const {
    uint64_t rva = VA - optional_header().imagebase();
    return rva_to_offset(rva);
  }

  result<uint64_t> offset_to_virtual_address(uint64_t offset,
                                             uint64_t slide = 0) const override;

  uint64_t offset_to_rva(uint64_t offset) const;

  uint64_t imagebase() const override {
    return optional_header().imagebase();
  }

  Section* section_from_offset(uint64_t offset) LIEF_LIFETIMEBOUND {
    return const_cast<Section*>(
        static_cast<const Binary*>(this)->section_from_offset(offset)
    );
  }
  const Section* section_from_offset(uint64_t offset) const LIEF_LIFETIMEBOUND;

  Section* section_from_rva(uint64_t virtual_address) LIEF_LIFETIMEBOUND {
    return const_cast<Section*>(
        static_cast<const Binary*>(this)->section_from_rva(virtual_address)
    );
  }
  const Section*
      section_from_rva(uint64_t virtual_address) const LIEF_LIFETIMEBOUND;

  it_sections sections() LIEF_LIFETIMEBOUND {
    return sections_;
  }
 
  it_const_sections sections() const LIEF_LIFETIMEBOUND {
    return sections_;
  }

  DosHeader& dos_header() LIEF_LIFETIMEBOUND {
    return dos_header_;
  }
 
  const DosHeader& dos_header() const LIEF_LIFETIMEBOUND {
    return dos_header_;
  }

  Header& header() LIEF_LIFETIMEBOUND {
    return header_;
  }
 
  const Header& header() const LIEF_LIFETIMEBOUND {
    return header_;
  }

  OptionalHeader& optional_header() LIEF_LIFETIMEBOUND {
    return optional_header_;
  }
 
  const OptionalHeader& optional_header() const LIEF_LIFETIMEBOUND {
    return optional_header_;
  }

  uint32_t compute_checksum() const;

  uint64_t virtual_size() const override;

  uint32_t sizeof_headers() const;

  TLS* tls() LIEF_LIFETIMEBOUND {
    return tls_.get();
  }
 
  const TLS* tls() const LIEF_LIFETIMEBOUND {
    return tls_.get();
  }

  TLS& tls(const TLS& tls) LIEF_LIFETIMEBOUND;

  bool has_tls() const {
    return tls_ != nullptr;
  }

  void remove_tls();

  bool has_imports() const {
    return !imports_.empty();
  }

  bool has_signatures() const {
    return !signatures_.empty();
  }

  bool has_exports() const {
    return export_ != nullptr;
  }

  bool has_resources() const {
    return resources_ != nullptr;
  }

  bool has_exceptions() const {
    if (const DataDirectory* dir = exceptions_dir()) {
      return dir->size() > 0;
    }
    return false;
  }

  bool has_relocations() const {
    return !relocations_.empty();
  }

  bool has_debug() const {
    return !debug_.empty();
  }

  bool has_configuration() const {
    return loadconfig_ != nullptr;
  }

  bool is_reproducible_build() const;

  it_const_signatures signatures() const LIEF_LIFETIMEBOUND {
    return signatures_;
  }
 
  it_signatures signatures() LIEF_LIFETIMEBOUND {
    return signatures_;
  }

  Signature::VERIFICATION_FLAGS
      verify_signature(Signature::VERIFICATION_CHECKS checks =
                           Signature::VERIFICATION_CHECKS::DEFAULT) const;

  Signature::VERIFICATION_FLAGS
      verify_signature(const Signature& sig,
                       Signature::VERIFICATION_CHECKS checks =
                           Signature::VERIFICATION_CHECKS::DEFAULT) const;

  std::vector<uint8_t> authentihash(ALGORITHMS algo) const;

  Export* get_export() LIEF_LIFETIMEBOUND {
    return export_.get();
  }
 
  const Export* get_export() const LIEF_LIFETIMEBOUND {
    return export_.get();
  }
 
  Export& set_export(const Export& export_table) LIEF_LIFETIMEBOUND;

  it_symbols symbols() LIEF_LIFETIMEBOUND {
    return symbols_;
  }
 
  it_const_symbols symbols() const LIEF_LIFETIMEBOUND {
    return symbols_;
  }

  it_const_strings_table coff_string_table() const LIEF_LIFETIMEBOUND {
    return strings_table_;
  }
 
  it_strings_table coff_string_table() LIEF_LIFETIMEBOUND {
    return strings_table_;
  }

  COFF::String* find_coff_string(uint32_t offset) LIEF_LIFETIMEBOUND {
    auto it = std::find_if(strings_table_.begin(), strings_table_.end(),
                           [offset](const COFF::String& item) {
                             return offset == item.offset();
                           });
    return it == strings_table_.end() ? nullptr : &*it;
  }
 
  const COFF::String* find_coff_string(uint32_t offset) const LIEF_LIFETIMEBOUND {
    return const_cast<Binary*>(this)->find_coff_string(offset);
  }

  ResourceNode* resources() LIEF_LIFETIMEBOUND {
    return resources_.get();
  }
 
  const ResourceNode* resources() const LIEF_LIFETIMEBOUND {
    return resources_.get();
  }

  ResourceNode* set_resources(const ResourceNode& root) LIEF_LIFETIMEBOUND;
 
  ResourceNode*
      set_resources(std::unique_ptr<ResourceNode> root) LIEF_LIFETIMEBOUND;

  result<ResourcesManager> resources_manager() const LIEF_LIFETIMEBOUND;

  Section* get_section(const std::string& name) LIEF_LIFETIMEBOUND {
    return const_cast<Section*>(
        static_cast<const Binary*>(this)->get_section(name)
    );
  }
  const Section* get_section(const std::string& name) const LIEF_LIFETIMEBOUND;

  const Section* import_section() const;
  Section* import_section() {
    return const_cast<Section*>(
        static_cast<const Binary*>(this)->import_section()
    );
  }

  void remove_section(const std::string& name, bool clear = false) override;

  void remove(const Section& section, bool clear = false);

  Section* add_section(const Section& section) LIEF_LIFETIMEBOUND;

  it_relocations relocations() LIEF_LIFETIMEBOUND {
    return relocations_;
  }
 
  it_const_relocations relocations() const LIEF_LIFETIMEBOUND {
    return relocations_;
  }

  Relocation& add_relocation(const Relocation& relocation) LIEF_LIFETIMEBOUND;

  void remove_all_relocations();

  it_data_directories data_directories() LIEF_LIFETIMEBOUND {
    return data_directories_;
  }
 
  it_const_data_directories data_directories() const LIEF_LIFETIMEBOUND {
    return data_directories_;
  }

  DataDirectory* data_directory(DataDirectory::TYPES type) LIEF_LIFETIMEBOUND {
    return const_cast<DataDirectory*>(
        static_cast<const Binary*>(this)->data_directory(type)
    );
  }
  const DataDirectory*
      data_directory(DataDirectory::TYPES type) const LIEF_LIFETIMEBOUND;

  bool has(DataDirectory::TYPES type) const {
    return data_directory(type) != nullptr;
  }

  it_debug_entries debug() LIEF_LIFETIMEBOUND {
    return debug_;
  }
 
  it_const_debug_entries debug() const LIEF_LIFETIMEBOUND {
    return debug_;
  }

  Debug* add_debug_info(const Debug& entry) LIEF_LIFETIMEBOUND;

  bool remove_debug(const Debug& entry);

  bool clear_debug();

  const CodeViewPDB* codeview_pdb() const LIEF_LIFETIMEBOUND;

  const LoadConfiguration* load_configuration() const LIEF_LIFETIMEBOUND {
    return loadconfig_.get();
  }
 
  LoadConfiguration* load_configuration() LIEF_LIFETIMEBOUND {
    return loadconfig_.get();
  }

  span<const uint8_t> overlay() const LIEF_LIFETIMEBOUND {
    return overlay_;
  }
 
  span<uint8_t> overlay() LIEF_LIFETIMEBOUND {
    return overlay_;
  }

  uint64_t overlay_offset() const {
    return overlay_offset_;
  }

  span<const uint8_t> dos_stub() const {
    return dos_stub_;
  }
 
  span<uint8_t> dos_stub() {
    return dos_stub_;
  }

  void dos_stub(std::vector<uint8_t> content) {
    dos_stub_ = std::move(content);
  }

  RichHeader* rich_header() LIEF_LIFETIMEBOUND {
    return rich_header_.get();
  }
 
  const RichHeader* rich_header() const LIEF_LIFETIMEBOUND {
    return rich_header_.get();
  }

  void rich_header(const RichHeader& rich_header);

  bool has_rich_header() const {
    return rich_header_ != nullptr;
  }

  it_imports imports() LIEF_LIFETIMEBOUND {
    return imports_;
  }
 
  it_const_imports imports() const LIEF_LIFETIMEBOUND {
    return imports_;
  }

  Import* get_import(const std::string& import_name) LIEF_LIFETIMEBOUND {
    return const_cast<Import*>(
        static_cast<const Binary*>(this)->get_import(import_name)
    );
  }
 
  const Import*
      get_import(const std::string& import_name) const LIEF_LIFETIMEBOUND;

  bool has_import(const std::string& import_name) const {
    return get_import(import_name) != nullptr;
  }

  bool has_delay_imports() const {
    return !delay_imports_.empty();
  }

  it_delay_imports delay_imports() {
    return delay_imports_;
  }
 
  it_const_delay_imports delay_imports() const {
    return delay_imports_;
  }

  DelayImport*
      get_delay_import(const std::string& import_name) LIEF_LIFETIMEBOUND {
    return const_cast<DelayImport*>(
        static_cast<const Binary*>(this)->get_delay_import(import_name)
    );
  }
  const DelayImport*
      get_delay_import(const std::string& import_name) const LIEF_LIFETIMEBOUND;
 

  bool has_delay_import(const std::string& import_name) const {
    return get_delay_import(import_name) != nullptr;
  }

  Import& add_import(const std::string& name,
                     int32_t pos = -1) LIEF_LIFETIMEBOUND {
    if (pos < 0) {
      imports_.push_back(std::unique_ptr<Import>(new Import(name)));
      return *imports_.back();
    }
    assert(pos >= 0);
    return **imports_.insert(imports_.begin() + pos,
                             std::unique_ptr<Import>(new Import(name)));
  }

  bool remove_import(const std::string& name);

  void remove_all_imports() {
    imports_.clear();
  }

  std::unique_ptr<Builder> write(const std::string& filename) {
    return write(filename, Builder::config_t());
  }

  std::unique_ptr<Builder> write(const std::string& filename,
                                 const Builder::config_t& config);

  std::unique_ptr<Builder> write(std::ostream& os) {
    return write(os, Builder::config_t());
  }
 
  std::unique_ptr<Builder> write(std::ostream& os,
                                 const Builder::config_t& config);
 
  void accept(Visitor& visitor) const override;

  void patch_address(uint64_t address, const std::vector<uint8_t>& patch_value,
                     VA_TYPES addr_type = VA_TYPES::AUTO) override;
 

  void patch_address(uint64_t address, uint64_t patch_value,
                     size_t size = sizeof(uint64_t),
                     VA_TYPES addr_type = VA_TYPES::AUTO) override;
 

  void fill_address(uint64_t address, size_t size, uint8_t value = 0,
                    VA_TYPES addr_type = VA_TYPES::AUTO);

  span<const uint8_t> get_content_from_virtual_address(
      uint64_t virtual_address, uint64_t size,
      Binary::VA_TYPES addr_type = Binary::VA_TYPES::AUTO
  ) const override;

  uint64_t entrypoint() const override {
    return optional_header_.imagebase() + optional_header_.addressof_entrypoint();
  }

  bool is_pie() const override {
    return optional_header_.has(OptionalHeader::DLL_CHARACTERISTICS::DYNAMIC_BASE);
  }

  bool has_nx() const override {
    return optional_header_.has(OptionalHeader::DLL_CHARACTERISTICS::NX_COMPAT);
  }
 
  uint64_t last_section_offset() const;

  DataDirectory* export_dir() {
    return data_directory(DataDirectory::TYPES::EXPORT_TABLE);
  }
 
  const DataDirectory* export_dir() const {
    return data_directory(DataDirectory::TYPES::EXPORT_TABLE);
  }

  DataDirectory* import_dir() {
    return data_directory(DataDirectory::TYPES::IMPORT_TABLE);
  }
 
  const DataDirectory* import_dir() const {
    return data_directory(DataDirectory::TYPES::IMPORT_TABLE);
  }

  DataDirectory* rsrc_dir() {
    return data_directory(DataDirectory::TYPES::RESOURCE_TABLE);
  }
 
  const DataDirectory* rsrc_dir() const {
    return data_directory(DataDirectory::TYPES::RESOURCE_TABLE);
  }

  DataDirectory* exceptions_dir() {
    return data_directory(DataDirectory::TYPES::EXCEPTION_TABLE);
  }
 
  const DataDirectory* exceptions_dir() const {
    return data_directory(DataDirectory::TYPES::EXCEPTION_TABLE);
  }

  DataDirectory* cert_dir() {
    return data_directory(DataDirectory::TYPES::CERTIFICATE_TABLE);
  }
 
  const DataDirectory* cert_dir() const {
    return data_directory(DataDirectory::TYPES::CERTIFICATE_TABLE);
  }

  DataDirectory* relocation_dir() {
    return data_directory(DataDirectory::TYPES::BASE_RELOCATION_TABLE);
  }
 
  const DataDirectory* relocation_dir() const {
    return data_directory(DataDirectory::TYPES::BASE_RELOCATION_TABLE);
  }

  DataDirectory* debug_dir() {
    return data_directory(DataDirectory::TYPES::DEBUG_DIR);
  }
 
  const DataDirectory* debug_dir() const {
    return data_directory(DataDirectory::TYPES::DEBUG_DIR);
  }

  DataDirectory* tls_dir() {
    return data_directory(DataDirectory::TYPES::TLS_TABLE);
  }
 
  const DataDirectory* tls_dir() const {
    return data_directory(DataDirectory::TYPES::TLS_TABLE);
  }

  DataDirectory* load_config_dir() {
    return data_directory(DataDirectory::TYPES::LOAD_CONFIG_TABLE);
  }
 
  const DataDirectory* load_config_dir() const {
    return data_directory(DataDirectory::TYPES::LOAD_CONFIG_TABLE);
  }

  DataDirectory* iat_dir() {
    return data_directory(DataDirectory::TYPES::IAT);
  }
 
  const DataDirectory* iat_dir() const {
    return data_directory(DataDirectory::TYPES::IAT);
  }

  DataDirectory* delay_dir() {
    return data_directory(DataDirectory::TYPES::DELAY_IMPORT_DESCRIPTOR);
  }
 
  const DataDirectory* delay_dir() const {
    return data_directory(DataDirectory::TYPES::DELAY_IMPORT_DESCRIPTOR);
  }

  LIEF::Binary::functions_t ctor_functions() const override;

  LIEF::Binary::functions_t functions() const;

  LIEF::Binary::functions_t exception_functions() const;

  it_exceptions exceptions() LIEF_LIFETIMEBOUND {
    return exceptions_;
  }
 
  it_const_exceptions exceptions() const LIEF_LIFETIMEBOUND {
    return exceptions_;
  }

  ExceptionInfo* find_exception_at(uint32_t rva) LIEF_LIFETIMEBOUND;
 
  const ExceptionInfo* find_exception_at(uint32_t rva) const LIEF_LIFETIMEBOUND {
    return const_cast<Binary*>(this)->find_exception_at(rva);
  }

  bool is_arm64ec() const;

  bool is_arm64x() const;

  const Binary* nested_pe_binary() const {
    return nested_.get();
  }
 
  Binary* nested_pe_binary() {
    return nested_.get();
  }

  result<uint64_t> get_function_address(const std::string& name) const override;
 
  static bool classof(const LIEF::Binary* bin) {
    return bin->format() == Binary::FORMATS::PE;
  }
 
  std::ostream& print(std::ostream& os) const override;
 

  LIEF_LOCAL std::unique_ptr<Binary> move_nested_pe_binary() {
    auto ret = std::move(nested_);
    nested_ = nullptr;
    return ret;
  }
 
  private:
  struct sizing_info_t {
    uint32_t nb_tls_callbacks = 0;
    uint32_t load_config_size = 0;
  };

  result<uint64_t> make_space_for_new_section();

  LIEF::Binary::symbols_t get_abstract_symbols() override;
 
  LIEF::Header get_abstract_header() const override {
    return LIEF::Header::from(*this);
  }

  LIEF::Binary::sections_t get_abstract_sections() override;
 
  LIEF::Binary::relocations_t get_abstract_relocations() override;
 
  LIEF::Binary::functions_t get_abstract_exported_functions() const override;
  LIEF::Binary::functions_t get_abstract_imported_functions() const override;
  std::vector<std::string> get_abstract_imported_libraries() const override;
 
  void update_lookup_address_table_offset();
  void update_iat();
  void shift(uint64_t from, uint64_t by);
 
  PE_TYPE type_ = PE_TYPE::PE32_PLUS;
  DosHeader dos_header_;
  Header header_;
  OptionalHeader optional_header_;
 
  int32_t available_sections_space_ = 0;
 
  signatures_t signatures_;
  sections_t sections_;
  data_directories_t data_directories_;
  symbols_t symbols_;
  strings_table_t strings_table_;
  relocations_t relocations_;
  imports_t imports_;
  delay_imports_t delay_imports_;
  debug_entries_t debug_;
  exceptions_t exceptions_;
  uint64_t overlay_offset_ = 0;
  std::vector<uint8_t> overlay_;
  std::vector<uint8_t> dos_stub_;
  std::vector<uint8_t> section_offset_padding_;
 
  std::unique_ptr<RichHeader> rich_header_;
  std::unique_ptr<Export> export_;
  std::unique_ptr<ResourceNode> resources_;
  std::unique_ptr<TLS> tls_;
  std::unique_ptr<LoadConfiguration> loadconfig_;
  std::unique_ptr<Binary> nested_;
 
  sizing_info_t sizing_info_;
};
 
}
}
#endif