PE/Header.hpp

Go to the documentation of this file.

/* Copyright 2017 - 2026 R. Thomas
 * Copyright 2017 - 2026 Quarkslab
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#ifndef LIEF_PE_HEADER_H
#define LIEF_PE_HEADER_H
#include <array>
#include <vector>
#include <ostream>
#include <cstdint>
 
#include "LIEF/Object.hpp"
#include "LIEF/visibility.h"
#include "LIEF/enums.hpp"
#include "LIEF/PE/enums.hpp"
 
namespace LIEF {
namespace PE {
 
namespace details {
struct pe_header;
}

class LIEF_API Header : public Object {
  public:
  using signature_t = std::array<uint8_t, /* PE Magic */ 4>;
 
  enum class MACHINE_TYPES {
    UNKNOWN     = 0x0,
    ALPHA       = 0x184 , 
    ALPHA64     = 0x284 , 
    AM33        = 0x1D3,  
    AMD64       = 0x8664, 
    ARM         = 0x1C0,  
    ARMNT       = 0x1C4,  
    ARM64       = 0xAA64, 
    EBC         = 0xEBC,  
    I386        = 0x14C,  
    IA64        = 0x200,  
    LOONGARCH32 = 0x6232, 
    LOONGARCH64 = 0x6264, 
    M32R        = 0x9041, 
    MIPS16      = 0x266,  
    MIPSFPU     = 0x366,  
    MIPSFPU16   = 0x466,  
    POWERPC     = 0x1F0,  
    POWERPCFP   = 0x1F1,  
    POWERPCBE   = 0x1F2,  
    R4000       = 0x166,  
    RISCV32     = 0x5032, 
    RISCV64     = 0x5064, 
    RISCV128    = 0x5128, 
    SH3         = 0x1A2,  
    SH3DSP      = 0x1A3,  
    SH4         = 0x1A6,  
    SH5         = 0x1A8,  
    THUMB       = 0x1C2,  
    WCEMIPSV2   = 0x169,   
    ARM64EC     = 0xa641,
    ARM64X      = 0xa64e,
    CHPE_X86    = 0x3a64,
  };
 
  static bool is_known_machine(uint16_t machine);
 
  static bool is_arm(MACHINE_TYPES ty) {
    switch (ty) {
      default:
        return false;
      case MACHINE_TYPES::ARM:
      case MACHINE_TYPES::THUMB:
      case MACHINE_TYPES::ARMNT:
        return true;
    }
    return false;
  }
 
  static bool is_riscv(MACHINE_TYPES ty) {
    switch (ty) {
      default:
        return false;
      case MACHINE_TYPES::RISCV32:
      case MACHINE_TYPES::RISCV64:
      case MACHINE_TYPES::RISCV128:
        return true;
    }
    return false;
  }
 
  static bool is_loonarch(MACHINE_TYPES ty) {
    switch (ty) {
      default:
        return false;
      case MACHINE_TYPES::LOONGARCH32:
      case MACHINE_TYPES::LOONGARCH64:
        return true;
    }
    return false;
  }
 
 
  static bool is_arm64(MACHINE_TYPES ty) {
    return ty == MACHINE_TYPES::ARM64;
  }
 
  static bool is_thumb(MACHINE_TYPES ty) {
    return ty == MACHINE_TYPES::THUMB;
  }
 
  static bool x86(MACHINE_TYPES ty) {
    return ty == MACHINE_TYPES::I386;
  }
 
  static bool x86_64(MACHINE_TYPES ty) {
    return ty == MACHINE_TYPES::AMD64;
  }
 
  static bool is_mips(MACHINE_TYPES ty) {
    switch (ty) {
      default:
        return false;
      case MACHINE_TYPES::MIPS16:
      case MACHINE_TYPES::MIPSFPU:
      case MACHINE_TYPES::MIPSFPU16:
      case MACHINE_TYPES::R4000:
      case MACHINE_TYPES::WCEMIPSV2:
        return true;
    }
    return false;
  }
 
  static bool is_ppc(MACHINE_TYPES ty) {
    switch (ty) {
      default:
        return false;
      case MACHINE_TYPES::POWERPC:
      case MACHINE_TYPES::POWERPCFP:
      case MACHINE_TYPES::POWERPCBE:
        return true;
    }
    return false;
  }
 
  enum class CHARACTERISTICS {
    NONE                    = 0x0000,
    RELOCS_STRIPPED         = 0x0001, 
    EXECUTABLE_IMAGE        = 0x0002, 
    LINE_NUMS_STRIPPED      = 0x0004, 
    LOCAL_SYMS_STRIPPED     = 0x0008, 
    AGGRESSIVE_WS_TRIM      = 0x0010, 
    LARGE_ADDRESS_AWARE     = 0x0020, 
    BYTES_REVERSED_LO       = 0x0080, 
    NEED_32BIT_MACHINE      = 0x0100, 
    DEBUG_STRIPPED          = 0x0200, 
    REMOVABLE_RUN_FROM_SWAP = 0x0400, 
    NET_RUN_FROM_SWAP       = 0x0800, 
    SYSTEM                  = 0x1000, 
    DLL                     = 0x2000, 
    UP_SYSTEM_ONLY          = 0x4000, 
    BYTES_REVERSED_HI       = 0x8000  
  };
  static Header create(PE_TYPE type);
 
  Header(const details::pe_header& header);
  ~Header() override = default;
 
  Header& operator=(const Header&) = default;
  Header(const Header&) = default;

  const signature_t& signature() const {
    return signature_;
  }

  MACHINE_TYPES machine() const {
    return machine_;
  }

  uint16_t numberof_sections() const {
    return nb_sections_;
  }

  uint32_t time_date_stamp() const {
    return timedatestamp_;
  }

  uint32_t pointerto_symbol_table() const {
    return pointerto_symtab_;
  }

  uint32_t numberof_symbols() const {
    return nb_symbols_;
  }

  uint16_t sizeof_optional_header() const {
    return sizeof_opt_header_;
  }

  uint32_t characteristics() const {
    return characteristics_;
  }

  bool has_characteristic(CHARACTERISTICS c) const {
    return (characteristics() & static_cast<uint32_t>(c)) > 0;
  }

  std::vector<CHARACTERISTICS> characteristics_list() const;
 
  void machine(MACHINE_TYPES type) {
    machine_ = type;
  }
 
  void numberof_sections(uint16_t nb) {
    nb_sections_ = nb;
  }
 
  void time_date_stamp(uint32_t timestamp) {
    timedatestamp_ = timestamp;
  }
 
  void pointerto_symbol_table(uint32_t ptr) {
    pointerto_symtab_ = ptr;
  }
 
  void numberof_symbols(uint32_t nb) {
    nb_symbols_ = nb;
  }
 
  void sizeof_optional_header(uint16_t size) {
    sizeof_opt_header_ = size;
  }
 
  void characteristics(uint32_t characteristics) {
    characteristics_ = characteristics;
  }
 
  void signature(const signature_t& sig) {
    signature_ = sig;
  }
 
  void add_characteristic(CHARACTERISTICS c) {
    characteristics_ |= static_cast<uint32_t>(c);
  }
 
  void remove_characteristic(CHARACTERISTICS c) {
    characteristics_ &= ~static_cast<uint32_t>(c);
  }
 
  void accept(Visitor& visitor) const override;
 
  LIEF_API friend std::ostream& operator<<(std::ostream& os, const Header& entry);

  LIEF_LOCAL Header() = default;
 
  private:
  signature_t signature_;
  MACHINE_TYPES machine_ = MACHINE_TYPES::UNKNOWN;
  uint16_t nb_sections_ = 0;
  uint32_t timedatestamp_ = 0;
  uint32_t pointerto_symtab_ = 0;
  uint32_t nb_symbols_ = 0;
  uint16_t sizeof_opt_header_ = 0;
  uint32_t characteristics_ = 0;
};
 
LIEF_API const char* to_string(Header::CHARACTERISTICS c);
LIEF_API const char* to_string(Header::MACHINE_TYPES c);
}
}
 
ENABLE_BITMASK_OPERATORS(LIEF::PE::Header::CHARACTERISTICS);
#endif