LIEF: Library to Instrument Executable Formats Version 2.0.0
Loading...
Searching...
No Matches
PE/utils.hpp
Go to the documentation of this file.
1/* Copyright 2017 - 2026 R. Thomas
2 * Copyright 2017 - 2026 Quarkslab
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16#ifndef LIEF_PE_UTILS_H
17#define LIEF_PE_UTILS_H
18#include <string_view>
19#include <string>
20#include <vector>
21
22#include "LIEF/PE/enums.hpp"
23#include "LIEF/errors.hpp"
24#include "LIEF/visibility.h"
25
26namespace LIEF {
27class BinaryStream;
28
29namespace PE {
30class Binary;
31class Import;
32
34enum class IMPHASH_MODE {
37
40
43
46
47};
48
51
53LIEF_API bool is_pe(std::string_view file);
54
56LIEF_API bool is_pe(const std::vector<uint8_t>& raw);
57
59LIEF_API result<PE_TYPE> get_type(std::string_view file);
60
62LIEF_API result<PE_TYPE> get_type(const std::vector<uint8_t>& raw);
63
64// In this case we assume that stream contains a valid PE stream
66
82LIEF_API std::string get_imphash(const Binary& binary,
84
99LIEF_API result<Import> resolve_ordinals(const Import& import, bool strict = false,
100 bool use_std = false);
101
102LIEF_API ALGORITHMS algo_from_oid(const std::string& oid);
103
106LIEF_API bool check_layout(const Binary& bin, std::string* error_info = nullptr);
107
108}
109}
110#endif
Class that is used to a read stream of data from different sources.
Definition BinaryStream.hpp:35
Class which represents a PE binary This is the main interface to manage and modify a PE executable.
Definition PE/Binary.hpp:58
Class that represents a PE import.
Definition Import.hpp:41
Wrapper that contains an Object (T) or an error.
Definition errors.hpp:79
Namespace related to the LIEF's PE module.
Definition Abstract/Header.hpp:32
ALGORITHMS
Cryptography algorithms.
Definition PE/enums.hpp:28
ALGORITHMS algo_from_oid(const std::string &oid)
result< PE_TYPE > get_type_from_stream(BinaryStream &stream)
std::string get_imphash(const Binary &binary, IMPHASH_MODE mode=IMPHASH_MODE::DEFAULT)
Compute the hash of imported functions.
bool check_layout(const Binary &bin, std::string *error_info=nullptr)
Check that the layout of the given Binary is correct from the Windows loader perspective.
result< Import > resolve_ordinals(const Import &import, bool strict=false, bool use_std=false)
Take a PE::Import as entry and try to resolve imports by ordinal.
result< PE_TYPE > get_type(std::string_view file)
if the input file is a PE one, return PE32 or PE32+
bool is_pe(BinaryStream &stream)
Check if the given stream wraps a PE binary.
IMPHASH_MODE
Enum to define the behavior of LIEF::PE::get_imphash.
Definition PE/utils.hpp:34
@ VT
Same as IMPHASH_MODE::PEFILE since Virus Total is using pefile.
Definition PE/utils.hpp:45
@ DEFAULT
Default implementation.
Definition PE/utils.hpp:36
@ PEFILE
Use pefile algorithm.
Definition PE/utils.hpp:42
LIEF namespace.
Definition Abstract/Binary.hpp:41
#define LIEF_API
Definition visibility.h:45
#define LIEF_LOCAL
Definition visibility.h:46