Class which represents a PE binary This is the main interface to manage and modify a PE executable. More...

#include <Binary.hpp>

Inheritance diagram for LIEF::PE::Binary:

[legend]

Collaboration diagram for LIEF::PE::Binary:

[legend]

Public Types
using	sections_t = std::vector<std::unique_ptr<Section>>
	Internal container for storing PE's Section.

using	it_sections = ref_iterator<sections_t&, Section*>
	Iterator that outputs Section& object.

using	it_const_sections = const_ref_iterator<const sections_t&, const Section*>
	Iterator that outputs const Section& object.

using	data_directories_t = std::vector<std::unique_ptr<DataDirectory>>
	Internal container for storing PE's DataDirectory.

using	it_data_directories = ref_iterator<data_directories_t&, DataDirectory*>
	Iterator that outputs DataDirectory&.

using	it_const_data_directories = const_ref_iterator<const data_directories_t&, const DataDirectory*>
	Iterator that outputs const DataDirectory&.

using	relocations_t = std::vector<std::unique_ptr<Relocation>>
	Internal container for storing PE's Relocation.

using	it_relocations = ref_iterator<relocations_t&, Relocation*>
	Iterator that outputs Relocation&.

using	it_const_relocations = const_ref_iterator<const relocations_t&, const Relocation*>
	Iterator that outputs const Relocation&.

using	imports_t = std::vector<Import>
	Internal container for storing PE's Import.

using	it_imports = ref_iterator<imports_t&>
	Iterator that output Import&.

using	it_const_imports = const_ref_iterator<const imports_t&>
	Iterator that outputs const Import&.

using	delay_imports_t = std::vector<DelayImport>
	Internal container for storing PE's DelayImport.

using	it_delay_imports = ref_iterator<delay_imports_t&>
	Iterator that output DelayImport&.

using	it_const_delay_imports = const_ref_iterator<const delay_imports_t&>
	Iterator that outputs const DelayImport&.

using	debug_entries_t = std::vector<std::unique_ptr<Debug>>
	Internal container for storing Debug information.

using	it_debug_entries = ref_iterator<debug_entries_t&, Debug*>
	Iterator that outputs Debug&.

using	it_const_debug_entries = const_ref_iterator<const debug_entries_t&, const Debug*>
	Iterator that outputs const Debug&.

using	symbols_t = std::vector<Symbol>
	Internal container for storing COFF Symbols.

using	it_symbols = ref_iterator<symbols_t&>
	Iterator that outputs Symbol&.

using	it_const_symbols = const_ref_iterator<const symbols_t&>
	Iterator that outputs const Symbol&.

using	strings_table_t = std::vector<std::string>
	Internal container for storing strings.

using	it_strings_table = ref_iterator<strings_table_t&>
	Iterator that outputs std::string&.

using	it_const_strings_table = const_ref_iterator<const strings_table_t&>
	Iterator that outputs const std::string&.

using	signatures_t = std::vector<Signature>
	Internal container for storing PE's authenticode Signature.

using	it_signatures = ref_iterator<signatures_t&>
	Iterator that outputs Signature&.

using	it_const_signatures = const_ref_iterator<const signatures_t&>
	Iterator that outputs const Signature&.

Public Types inherited from LIEF::Binary
enum class	VA_TYPES { AUTO = 0 , RVA = 1 , VA = 2 }
	Type of a virtual address. More...

enum	FORMATS { UNKNOWN = 0 , ELF , PE , MACHO , OAT }

using	functions_t = std::vector<Function>

using	sections_t = std::vector<Section*>
	Internal container.

using	it_sections = ref_iterator<sections_t>
	Iterator that outputs LIEF::Section&.

using	it_const_sections = const_ref_iterator<sections_t>
	Iterator that outputs const LIEF::Section&.

using	symbols_t = std::vector<Symbol*>
	Internal container.

using	it_symbols = ref_iterator<symbols_t>
	Iterator that outputs LIEF::Symbol&.

using	it_const_symbols = const_ref_iterator<symbols_t>
	Iterator that outputs const LIEF::Symbol&.

using	relocations_t = std::vector<Relocation*>
	Internal container.

using	it_relocations = ref_iterator<relocations_t>
	Iterator that outputs LIEF::Relocation&.

using	it_const_relocations = const_ref_iterator<relocations_t>
	Iterator that outputs const LIEF::Relocation&.

using	instructions_it = iterator_range<assembly::Instruction::Iterator>
	Instruction iterator.

Public Types inherited from LIEF::Object
template<class T >
using	output_t = add_pointer_t<decay_t<T>>

template<class T >
using	output_const_t = add_pointer_t<add_const_t<decay_t<T>>>

Public Member Functions
	Binary (PE_TYPE type)

	~Binary () override

PE_TYPE	type () const
	Return `PE32` or `PE32+`

uint64_t	rva_to_offset (uint64_t RVA) const
	Convert a Relative Virtual Address into an offset.

uint64_t	va_to_offset (uint64_t VA) const
	Convert the absolute virtual address into an offset.

result< uint64_t >	offset_to_virtual_address (uint64_t offset, uint64_t slide=0) const override
	Convert the given offset into a virtual address.

uint64_t	imagebase () const override
	Return binary's imagebase. `0` if not relevant.

Section *	section_from_offset (uint64_t offset)
	Find the section associated that encompasses the given offset.

const Section *	section_from_offset (uint64_t offset) const

Section *	section_from_rva (uint64_t virtual_address)
	Find the section associated that encompasses the given RVA.

const Section *	section_from_rva (uint64_t virtual_address) const

it_sections	sections ()
	Return an iterator over the PE's Section.

it_const_sections	sections () const

DosHeader &	dos_header ()
	Return a reference to the PE::DosHeader object.

const DosHeader &	dos_header () const

Header &	header ()
	Return a reference to the PE::Header object.

const Header &	header () const

OptionalHeader &	optional_header ()
	Header that follows the header(). It is named optional from the COFF specfication but it is mandatory in a PE file.

const OptionalHeader &	optional_header () const

uint32_t	compute_checksum () const
	Re-compute the value of OptionalHeader::checksum. If both values do not match, it could mean that the binary has been modified after the compilation.

uint64_t	virtual_size () const
	Compute the binary's virtual size. It should match OptionalHeader::sizeof_image.

uint32_t	sizeof_headers () const
	Compute the size of all the headers.

TLS *	tls ()
	Return a reference to the TLS object.

const TLS *	tls () const

void	tls (const TLS &tls)
	Set a TLS object in the current Binary.

bool	has_tls () const
	Check if the current binary has a TLS object.

bool	has_imports () const
	Check if the current binary contains imports.

bool	has_signatures () const
	Check if the current binary contains signatures.

bool	has_exports () const
	Check if the current binary has exports.

bool	has_resources () const
	Check if the current binary has resources.

bool	has_exceptions () const
	Check if the current binary has exceptions.

bool	has_relocations () const
	Check if the current binary has relocations.

bool	has_debug () const
	Check if the current binary contains debug information.

bool	has_configuration () const
	Check if the current binary has a load configuration.

bool	is_reproducible_build () const
	Check if the current binary is reproducible build, replacing timestamps by a compile hash.

it_const_signatures	signatures () const
	Return an iterator over the Signature object(s) if the binary is signed.

it_signatures	signatures ()

Signature::VERIFICATION_FLAGS	verify_signature (Signature::VERIFICATION_CHECKS checks=Signature::VERIFICATION_CHECKS::DEFAULT) const
	Verify the binary against the embedded signature(s) (if any) First, it checks that the embedded signatures are correct (c.f. Signature::check) and then, it checks that the authentihash matches ContentInfo::digest.

Signature::VERIFICATION_FLAGS	verify_signature (const Signature &sig, Signature::VERIFICATION_CHECKS checks=Signature::VERIFICATION_CHECKS::DEFAULT) const
	Verify the binary with the Signature object provided in the first parameter. It can be used to verify a detached signature:

std::vector< uint8_t >	authentihash (ALGORITHMS algo) const
	Compute the authentihash according to the algorithm provided in the first parameter.

uint32_t	predict_function_rva (const std::string &library, const std::string &function)
	Try to predict the RVA of the function `function` in the import library `library`

Export *	get_export ()
	Return the Export object.

const Export *	get_export () const

std::vector< Symbol > &	symbols ()
	Return binary Symbols.

const std::vector< Symbol > &	symbols () const

ResourceNode *	resources ()
	Return resources as a tree or a nullptr if there is no resources.

const ResourceNode *	resources () const

void	set_resources (const ResourceDirectory &resource)
	Set a new resource tree.

void	set_resources (const ResourceData &resource)
	Set a new resource tree.

result< ResourcesManager >	resources_manager () const
	Return the ResourcesManager (class to manage resources more easily than the tree one)

Section *	get_section (const std::string &name)
	Return binary's section from its name. If the secion can't be found, return a nullptr.

const Section *	get_section (const std::string &name) const

const Section *	import_section () const
	Return the section associated with import table or a nullptr if the binary does not have an import table.

Section *	import_section ()

void	remove_section (const std::string &name, bool clear=false) override
	Delete the section with the given name.

void	remove (const Section &section, bool clear=false)
	Remove the given section.

Section *	add_section (const Section &section, PE_SECTION_TYPES type=PE_SECTION_TYPES::UNKNOWN)
	Add a section to the binary and return the section added.

it_relocations	relocations ()
	Return an iterator over the PE's Relocation.

it_const_relocations	relocations () const

Relocation &	add_relocation (const Relocation &relocation)
	Add a PE::Relocation.

void	remove_all_relocations ()
	Remove all the relocations.

it_data_directories	data_directories ()
	Return an iterator over the DataDirectory present in the Binary.

it_const_data_directories	data_directories () const

DataDirectory *	data_directory (DataDirectory::TYPES type)
	Return the DataDirectory with the given type (or index)

const DataDirectory *	data_directory (DataDirectory::TYPES type) const

bool	has (DataDirectory::TYPES type) const
	Check if the current binary has the given DataDirectory::TYPES.

it_debug_entries	debug ()
	Return an iterator over the Debug entries.

it_const_debug_entries	debug () const

const CodeViewPDB *	codeview_pdb () const
	Return the CodeViewPDB object if present.

const LoadConfiguration *	load_configuration () const
	Retrun the LoadConfiguration object or a nullptr if the binary does not use the LoadConfiguration.

LoadConfiguration *	load_configuration ()

span< const uint8_t >	overlay () const
	Return the overlay content.

span< uint8_t >	overlay ()

uint64_t	overlay_offset () const
	Return the original overlay offset.

span< const uint8_t >	dos_stub () const
	Return the DOS stub content.

span< uint8_t >	dos_stub ()

void	dos_stub (std::vector< uint8_t > content)
	Update the DOS stub content.

RichHeader *	rich_header ()
	Return a reference to the RichHeader object.

const RichHeader *	rich_header () const

void	rich_header (const RichHeader &rich_header)
	Set a RichHeader object in the current Binary.

bool	has_rich_header () const
	Check if the current binary has a RichHeader object.

it_imports	imports ()
	Return an iterator over the binary imports.

it_const_imports	imports () const

Import *	get_import (const std::string &import_name)
	Returns the PE::Import from the given name. If it can't be found, return a nullptr.

const Import *	get_import (const std::string &import_name) const

bool	has_import (const std::string &import_name) const
	`True` if the binary imports the given library name

bool	has_delay_imports () const
	Check if the current binary contains delay imports.

it_delay_imports	delay_imports ()
	Return an iterator over the binary's delay imports.

it_const_delay_imports	delay_imports () const

DelayImport *	get_delay_import (const std::string &import_name)
	Returns the PE::DelayImport from the given name. If it can't be found, return a nullptr.

const DelayImport *	get_delay_import (const std::string &import_name) const

bool	has_delay_import (const std::string &import_name) const
	`True` if the binary delay-imports the given library name

ImportEntry *	add_import_function (const std::string &library, const std::string &function)
	Add the function `function` of the library `library`. If the function fails, it returns a nullptr.

Import &	add_library (const std::string &name)
	Add an imported library (i.e. `DLL`) to the binary.

void	remove_library (const std::string &name)
	Remove the library with the given `name`

void	remove_all_libraries ()
	Remove all libraries in the binary.

void	write (const std::string &filename) override
	Reconstruct the binary object and write the raw PE in `filename`

void	write (std::ostream &os) override
	Reconstruct the binary object and write the raw PE in `os` stream.

void	accept (Visitor &visitor) const override
	Method so that a `visitor` can visit us.

void	patch_address (uint64_t address, const std::vector< uint8_t > &patch_value, LIEF::Binary::VA_TYPES addr_type=LIEF::Binary::VA_TYPES::AUTO) override
	Patch the content at virtual address `address` with `patch_value`.

void	patch_address (uint64_t address, uint64_t patch_value, size_t size=sizeof(uint64_t), LIEF::Binary::VA_TYPES addr_type=LIEF::Binary::VA_TYPES::AUTO) override
	Patch the address with the given value.

span< const uint8_t >	get_content_from_virtual_address (uint64_t virtual_address, uint64_t size, Binary::VA_TYPES addr_type=Binary::VA_TYPES::AUTO) const override
	Return the content located at the provided virtual address.

uint64_t	entrypoint () const override
	Return the binary's entrypoint (It is the same value as OptionalHeader::addressof_entrypoint.

bool	is_pie () const override
	Check if the binary is position independent.

bool	has_nx () const override
	Check if the binary uses `NX` protection.

LIEF::Binary::functions_t	ctor_functions () const override
	Return the list of the binary constructors.

LIEF::Binary::functions_t	functions () const
	All functions found in the binary

LIEF::Binary::functions_t	exception_functions () const
	Functions found in the Exception table directory.

std::ostream &	print (std::ostream &os) const override

Public Member Functions inherited from LIEF::Binary
	Binary ()

	Binary (FORMATS fmt)

	~Binary () override

Binary &	operator= (const Binary &)=delete

	Binary (const Binary &)=delete

FORMATS	format () const
	Executable format (ELF, PE, Mach-O) of the underlying binary.

Header	header () const
	Return the abstract header of the binary.

it_symbols	symbols ()
	Return an iterator over the abstracted symbols in which the elements can be modified.

it_const_symbols	symbols () const
	Return an iterator over the abstracted symbols in which the elements can't be modified.

bool	has_symbol (const std::string &name) const
	Check if a Symbol with the given name exists.

const Symbol *	get_symbol (const std::string &name) const
	Return the Symbol with the given name If the symbol does not exist, return a nullptr.

Symbol *	get_symbol (const std::string &name)

it_sections	sections ()
	Return an iterator over the binary's sections (LIEF::Section)

it_const_sections	sections () const

it_relocations	relocations ()
	Return an iterator over the binary relocation (LIEF::Relocation)

it_const_relocations	relocations () const

uint64_t	original_size () const
	Binary's original size.

functions_t	exported_functions () const
	Return the functions exported by the binary.

std::vector< std::string >	imported_libraries () const
	Return libraries which are imported by the binary.

functions_t	imported_functions () const
	Return functions imported by the binary.

virtual result< uint64_t >	get_function_address (const std::string &func_name) const
	Return the address of the given function name.

std::vector< uint64_t >	xref (uint64_t address) const

template<class T >
LIEF::result< T >	get_int_from_virtual_address (uint64_t va, VA_TYPES addr_type=VA_TYPES::AUTO) const
	Get the integer value at the given virtual address.

void	original_size (uint64_t size)
	Change binary's original size.

DebugInfo *	debug_info () const
	Return the debug info if present. It can be either a LIEF::dwarf::DebugInfo or a LIEF::pdb::DebugInfo.

instructions_it	disassemble (uint64_t address, size_t size) const
	Disassemble code starting a the given virtual address and with the given size.

instructions_it	disassemble (uint64_t address) const
	Disassemble code starting a the given virtual address.

instructions_it	disassemble (const std::string &function) const
	Disassemble code for the given symbol name.

instructions_it	disassemble (const uint8_t *buffer, size_t size, uint64_t address=0) const
	Disassemble code provided by the given buffer at the specified `address` parameter.

instructions_it	disassemble (const std::vector< uint8_t > &buffer, uint64_t address=0) const
	Disassemble code provided by the given vector of bytes at the specified `address` parameter.

instructions_it	disassemble (LIEF::span< const uint8_t > buffer, uint64_t address=0) const

instructions_it	disassemble (LIEF::span< uint8_t > buffer, uint64_t address=0) const

std::vector< uint8_t >	assemble (uint64_t address, const std::string &Asm)
	Assemble and patch the provided assembly code at the specified address.

Public Member Functions inherited from LIEF::Object
	Object ()

	Object (const Object &other)

Object &	operator= (const Object &other)

template<class T >
output_t< T >	as ()

template<class T >
output_const_t< T >	as () const

virtual bool	operator== (const Object &other) const

virtual bool	operator!= (const Object &other) const

virtual	~Object ()

Static Public Member Functions
static bool	classof (const LIEF::Binary *bin)

Detailed Description

Class which represents a PE binary This is the main interface to manage and modify a PE executable.

Member Typedef Documentation

◆ data_directories_t

using LIEF::PE::Binary::data_directories_t = std::vector<std::unique_ptr<DataDirectory>>

Internal container for storing PE's DataDirectory.

◆ debug_entries_t

using LIEF::PE::Binary::debug_entries_t = std::vector<std::unique_ptr<Debug>>

Internal container for storing Debug information.

◆ delay_imports_t

using LIEF::PE::Binary::delay_imports_t = std::vector<DelayImport>

Internal container for storing PE's DelayImport.

◆ imports_t

using LIEF::PE::Binary::imports_t = std::vector<Import>

Internal container for storing PE's Import.

◆ it_const_data_directories

using LIEF::PE::Binary::it_const_data_directories = const_ref_iterator<const data_directories_t&, const DataDirectory*>

Iterator that outputs const DataDirectory&.

◆ it_const_debug_entries

using LIEF::PE::Binary::it_const_debug_entries = const_ref_iterator<const debug_entries_t&, const Debug*>

Iterator that outputs const Debug&.

◆ it_const_delay_imports

using LIEF::PE::Binary::it_const_delay_imports = const_ref_iterator<const delay_imports_t&>

Iterator that outputs const DelayImport&.

◆ it_const_imports

using LIEF::PE::Binary::it_const_imports = const_ref_iterator<const imports_t&>

Iterator that outputs const Import&.

◆ it_const_relocations

using LIEF::PE::Binary::it_const_relocations = const_ref_iterator<const relocations_t&, const Relocation*>

Iterator that outputs const Relocation&.

◆ it_const_sections

using LIEF::PE::Binary::it_const_sections = const_ref_iterator<const sections_t&, const Section*>

Iterator that outputs const Section& object.

◆ it_const_signatures

using LIEF::PE::Binary::it_const_signatures = const_ref_iterator<const signatures_t&>

Iterator that outputs const Signature&.

◆ it_const_strings_table

using LIEF::PE::Binary::it_const_strings_table = const_ref_iterator<const strings_table_t&>

Iterator that outputs const std::string&.

◆ it_const_symbols

using LIEF::PE::Binary::it_const_symbols = const_ref_iterator<const symbols_t&>

Iterator that outputs const Symbol&.

◆ it_data_directories

using LIEF::PE::Binary::it_data_directories = ref_iterator<data_directories_t&, DataDirectory*>

Iterator that outputs DataDirectory&.

◆ it_debug_entries

using LIEF::PE::Binary::it_debug_entries = ref_iterator<debug_entries_t&, Debug*>

Iterator that outputs Debug&.

◆ it_delay_imports

using LIEF::PE::Binary::it_delay_imports = ref_iterator<delay_imports_t&>

Iterator that output DelayImport&.

◆ it_imports

using LIEF::PE::Binary::it_imports = ref_iterator<imports_t&>

Iterator that output Import&.

◆ it_relocations

using LIEF::PE::Binary::it_relocations = ref_iterator<relocations_t&, Relocation*>

Iterator that outputs Relocation&.

◆ it_sections

using LIEF::PE::Binary::it_sections = ref_iterator<sections_t&, Section*>

Iterator that outputs Section& object.

◆ it_signatures

using LIEF::PE::Binary::it_signatures = ref_iterator<signatures_t&>

Iterator that outputs Signature&.

◆ it_strings_table

using LIEF::PE::Binary::it_strings_table = ref_iterator<strings_table_t&>

Iterator that outputs std::string&.

◆ it_symbols

using LIEF::PE::Binary::it_symbols = ref_iterator<symbols_t&>

Iterator that outputs Symbol&.

◆ relocations_t

using LIEF::PE::Binary::relocations_t = std::vector<std::unique_ptr<Relocation>>

Internal container for storing PE's Relocation.

◆ sections_t

using LIEF::PE::Binary::sections_t = std::vector<std::unique_ptr<Section>>

Internal container for storing PE's Section.

◆ signatures_t

using LIEF::PE::Binary::signatures_t = std::vector<Signature>

Internal container for storing PE's authenticode Signature.

◆ strings_table_t

using LIEF::PE::Binary::strings_table_t = std::vector<std::string>

Internal container for storing strings.

◆ symbols_t

using LIEF::PE::Binary::symbols_t = std::vector<Symbol>

Internal container for storing COFF Symbols.

Constructor & Destructor Documentation

◆ Binary()

LIEF::PE::Binary::Binary ( PE_TYPE type )

◆ ~Binary()

LIEF::PE::Binary::~Binary ( )

override

Member Function Documentation

◆ accept()

void LIEF::PE::Binary::accept ( Visitor & visitor ) const

overridevirtual

Method so that a visitor can visit us.

Reimplemented from LIEF::Binary.

◆ add_import_function()

ImportEntry * LIEF::PE::Binary::add_import_function	(	const std::string &	library,
		const std::string &	function )

Add the function function of the library library. If the function fails, it returns a nullptr.

Parameters

[in]	library	Library name of the function
[in]	function	Function's name from the library to import

◆ add_library()

Import & LIEF::PE::Binary::add_library ( const std::string & name )

inline

Add an imported library (i.e. DLL) to the binary.

◆ add_relocation()

Relocation & LIEF::PE::Binary::add_relocation ( const Relocation & relocation )

Add a PE::Relocation.

◆ add_section()

Section * LIEF::PE::Binary::add_section	(	const Section &	section,
		PE_SECTION_TYPES	type = PE_SECTION_TYPES::UNKNOWN )

Add a section to the binary and return the section added.

◆ authentihash()

std::vector< uint8_t > LIEF::PE::Binary::authentihash ( ALGORITHMS algo ) const

Compute the authentihash according to the algorithm provided in the first parameter.

◆ classof()

static bool LIEF::PE::Binary::classof ( const LIEF::Binary * bin )

inlinestatic

References LIEF::Binary::format().

◆ codeview_pdb()

const CodeViewPDB * LIEF::PE::Binary::codeview_pdb ( ) const

Return the CodeViewPDB object if present.

◆ compute_checksum()

uint32_t LIEF::PE::Binary::compute_checksum ( ) const

Re-compute the value of OptionalHeader::checksum. If both values do not match, it could mean that the binary has been modified after the compilation.

This value is computed by LIEF for the current binary object.

◆ ctor_functions()

LIEF::Binary::functions_t LIEF::PE::Binary::ctor_functions ( ) const

overridevirtual

Return the list of the binary constructors.

In a PE file, we consider a constructors as a callback in the TLS object

Implements LIEF::Binary.

◆ data_directories() [1/2]

it_data_directories LIEF::PE::Binary::data_directories ( )

inline

Return an iterator over the DataDirectory present in the Binary.

◆ data_directories() [2/2]

it_const_data_directories LIEF::PE::Binary::data_directories ( ) const

inline

◆ data_directory() [1/2]

DataDirectory * LIEF::PE::Binary::data_directory ( DataDirectory::TYPES type )

inline

Return the DataDirectory with the given type (or index)

◆ data_directory() [2/2]

const DataDirectory * LIEF::PE::Binary::data_directory ( DataDirectory::TYPES type ) const

◆ debug() [1/2]

it_debug_entries LIEF::PE::Binary::debug ( )

inline

Return an iterator over the Debug entries.

◆ debug() [2/2]

it_const_debug_entries LIEF::PE::Binary::debug ( ) const

inline

◆ delay_imports() [1/2]

it_delay_imports LIEF::PE::Binary::delay_imports ( )

inline

Return an iterator over the binary's delay imports.

◆ delay_imports() [2/2]

it_const_delay_imports LIEF::PE::Binary::delay_imports ( ) const

inline

◆ dos_header() [1/2]

DosHeader & LIEF::PE::Binary::dos_header ( )

inline

Return a reference to the PE::DosHeader object.

◆ dos_header() [2/2]

const DosHeader & LIEF::PE::Binary::dos_header ( ) const

inline

◆ dos_stub() [1/3]

span< uint8_t > LIEF::PE::Binary::dos_stub ( )

inline

◆ dos_stub() [2/3]

span< const uint8_t > LIEF::PE::Binary::dos_stub ( ) const

inline

Return the DOS stub content.

◆ dos_stub() [3/3]

void LIEF::PE::Binary::dos_stub ( std::vector< uint8_t > content )

inline

Update the DOS stub content.

◆ entrypoint()

uint64_t LIEF::PE::Binary::entrypoint ( ) const

inlineoverridevirtual

Return the binary's entrypoint (It is the same value as OptionalHeader::addressof_entrypoint.

Implements LIEF::Binary.

◆ exception_functions()

LIEF::Binary::functions_t LIEF::PE::Binary::exception_functions ( ) const

Functions found in the Exception table directory.

◆ functions()

LIEF::Binary::functions_t LIEF::PE::Binary::functions ( ) const

All functions found in the binary

◆ get_content_from_virtual_address()

span< const uint8_t > LIEF::PE::Binary::get_content_from_virtual_address	(	uint64_t	virtual_address,
		uint64_t	size,
		Binary::VA_TYPES	addr_type = Binary::VA_TYPES::AUTO ) const

overridevirtual

Return the content located at the provided virtual address.

Parameters

[in]	virtual_address	Virtual address of the data to retrieve
[in]	size	Size in bytes of the data to retrieve
[in]	addr_type	Type of the Virtual address: VA or RVA. Default: Auto

Implements LIEF::Binary.

◆ get_delay_import() [1/2]

DelayImport * LIEF::PE::Binary::get_delay_import ( const std::string & import_name )

inline

Returns the PE::DelayImport from the given name. If it can't be found, return a nullptr.

Parameters

[in] import_name Name of the delay import

◆ get_delay_import() [2/2]

const DelayImport * LIEF::PE::Binary::get_delay_import ( const std::string & import_name ) const

◆ get_export() [1/2]

Export * LIEF::PE::Binary::get_export ( )

inline

Return the Export object.

◆ get_export() [2/2]

const Export * LIEF::PE::Binary::get_export ( ) const

inline

◆ get_import() [1/2]

Import * LIEF::PE::Binary::get_import ( const std::string & import_name )

inline

Returns the PE::Import from the given name. If it can't be found, return a nullptr.

Parameters

[in] import_name Name of the import

◆ get_import() [2/2]

const Import * LIEF::PE::Binary::get_import ( const std::string & import_name ) const

◆ get_section() [1/2]

Section * LIEF::PE::Binary::get_section ( const std::string & name )

inline

Return binary's section from its name. If the secion can't be found, return a nullptr.

Parameters

[in] name Name of the Section

◆ get_section() [2/2]

const Section * LIEF::PE::Binary::get_section ( const std::string & name ) const

◆ has()

bool LIEF::PE::Binary::has ( DataDirectory::TYPES type ) const

inline

Check if the current binary has the given DataDirectory::TYPES.

◆ has_configuration()

bool LIEF::PE::Binary::has_configuration ( ) const

inline

Check if the current binary has a load configuration.

◆ has_debug()

bool LIEF::PE::Binary::has_debug ( ) const

inline

Check if the current binary contains debug information.

◆ has_delay_import()

bool LIEF::PE::Binary::has_delay_import ( const std::string & import_name ) const

inline

True if the binary delay-imports the given library name

Parameters

[in] import_name Name of the delay import

◆ has_delay_imports()

bool LIEF::PE::Binary::has_delay_imports ( ) const

inline

Check if the current binary contains delay imports.

See also: DelayImport; has_import

◆ has_exceptions()

bool LIEF::PE::Binary::has_exceptions ( ) const

inline

Check if the current binary has exceptions.

◆ has_exports()

bool LIEF::PE::Binary::has_exports ( ) const

inline

Check if the current binary has exports.

See also: Export

◆ has_import()

bool LIEF::PE::Binary::has_import ( const std::string & import_name ) const

inline

True if the binary imports the given library name

Parameters

[in] import_name Name of the import

◆ has_imports()

bool LIEF::PE::Binary::has_imports ( ) const

inline

Check if the current binary contains imports.

See also: Import

◆ has_nx()

bool LIEF::PE::Binary::has_nx ( ) const

inlineoverridevirtual

Check if the binary uses NX protection.

Implements LIEF::Binary.

◆ has_relocations()

bool LIEF::PE::Binary::has_relocations ( ) const

inline

Check if the current binary has relocations.

See also: Relocation

◆ has_resources()

bool LIEF::PE::Binary::has_resources ( ) const

inline

Check if the current binary has resources.

◆ has_rich_header()

bool LIEF::PE::Binary::has_rich_header ( ) const

inline

Check if the current binary has a RichHeader object.

◆ has_signatures()

bool LIEF::PE::Binary::has_signatures ( ) const

inline

Check if the current binary contains signatures.

See also: signatures

◆ has_tls()

bool LIEF::PE::Binary::has_tls ( ) const

inline

Check if the current binary has a TLS object.

◆ header() [1/2]

Header & LIEF::PE::Binary::header ( )

inline

Return a reference to the PE::Header object.

◆ header() [2/2]

const Header & LIEF::PE::Binary::header ( ) const

inline

◆ imagebase()

uint64_t LIEF::PE::Binary::imagebase ( ) const

inlineoverridevirtual

Return binary's imagebase. 0 if not relevant.

The value is the same as those returned by OptionalHeader::imagebase

Implements LIEF::Binary.

◆ import_section() [1/2]

Section * LIEF::PE::Binary::import_section ( )

inline

◆ import_section() [2/2]

const Section * LIEF::PE::Binary::import_section ( ) const

Return the section associated with import table or a nullptr if the binary does not have an import table.

◆ imports() [1/2]

it_imports LIEF::PE::Binary::imports ( )

inline

Return an iterator over the binary imports.

◆ imports() [2/2]

it_const_imports LIEF::PE::Binary::imports ( ) const

inline

◆ is_pie()

bool LIEF::PE::Binary::is_pie ( ) const

inlineoverridevirtual

Check if the binary is position independent.

Implements LIEF::Binary.

◆ is_reproducible_build()

bool LIEF::PE::Binary::is_reproducible_build ( ) const

Check if the current binary is reproducible build, replacing timestamps by a compile hash.

See also: Repro

◆ load_configuration() [1/2]

LoadConfiguration * LIEF::PE::Binary::load_configuration ( )

inline

◆ load_configuration() [2/2]

const LoadConfiguration * LIEF::PE::Binary::load_configuration ( ) const

inline

Retrun the LoadConfiguration object or a nullptr if the binary does not use the LoadConfiguration.

◆ offset_to_virtual_address()

result< uint64_t > LIEF::PE::Binary::offset_to_virtual_address	(	uint64_t	offset,
		uint64_t	slide = 0 ) const

overridevirtual

Convert the given offset into a virtual address.

Parameters

[in]	offset	The offset to convert.
[in]	slide	If not 0, it will replace the default base address (if any)

Implements LIEF::Binary.

◆ optional_header() [1/2]

OptionalHeader & LIEF::PE::Binary::optional_header ( )

inline

Header that follows the header(). It is named optional from the COFF specfication but it is mandatory in a PE file.

◆ optional_header() [2/2]

const OptionalHeader & LIEF::PE::Binary::optional_header ( ) const

inline

◆ overlay() [1/2]

span< uint8_t > LIEF::PE::Binary::overlay ( )

inline

◆ overlay() [2/2]

span< const uint8_t > LIEF::PE::Binary::overlay ( ) const

inline

Return the overlay content.

◆ overlay_offset()

uint64_t LIEF::PE::Binary::overlay_offset ( ) const

inline

Return the original overlay offset.

◆ patch_address() [1/2]

void LIEF::PE::Binary::patch_address	(	uint64_t	address,
		const std::vector< uint8_t > &	patch_value,
		LIEF::Binary::VA_TYPES	addr_type = LIEF::Binary::VA_TYPES::AUTO )

overridevirtual

Patch the content at virtual address address with patch_value.

Parameters

[in]	address	Address to patch
[in]	patch_value	Patch to apply
[in]	addr_type	Type of the Virtual address: VA or RVA. Default: Auto

Implements LIEF::Binary.

◆ patch_address() [2/2]

void LIEF::PE::Binary::patch_address	(	uint64_t	address,
		uint64_t	patch_value,
		size_t	size = sizeof(uint64_t),
		LIEF::Binary::VA_TYPES	addr_type = LIEF::Binary::VA_TYPES::AUTO )

overridevirtual

Patch the address with the given value.

Parameters

[in]	address	Address to patch
[in]	patch_value	Patch to apply
[in]	size	Size of the value in bytes (1, 2, ... 8)
[in]	addr_type	Type of the Virtual address: VA or RVA. Default: Auto

Implements LIEF::Binary.

◆ predict_function_rva()

uint32_t LIEF::PE::Binary::predict_function_rva	(	const std::string &	library,
		const std::string &	function )

Try to predict the RVA of the function function in the import library library

Warning: The value could be chang if imports change

Note: It should be used with: LIEF::PE::Builder::build_imports set to true

Parameters

[in]	library	Library name in which the function is located
[in]	function	Function name

Returns: The address of the function (IAT) in the new import table

◆ print()

std::ostream & LIEF::PE::Binary::print ( std::ostream & os ) const

overridevirtual

Reimplemented from LIEF::Binary.

◆ relocations() [1/2]

it_relocations LIEF::PE::Binary::relocations ( )

inline

Return an iterator over the PE's Relocation.

◆ relocations() [2/2]

it_const_relocations LIEF::PE::Binary::relocations ( ) const

inline

◆ remove()

void LIEF::PE::Binary::remove	(	const Section &	section,
		bool	clear = false )

Remove the given section.

See also: remove_section

◆ remove_all_libraries()

void LIEF::PE::Binary::remove_all_libraries ( )

inline

Remove all libraries in the binary.

◆ remove_all_relocations()

void LIEF::PE::Binary::remove_all_relocations ( )

Remove all the relocations.

◆ remove_library()

void LIEF::PE::Binary::remove_library ( const std::string & name )

Remove the library with the given name

◆ remove_section()

void LIEF::PE::Binary::remove_section	(	const std::string &	name,
		bool	clear = false )

overridevirtual

Delete the section with the given name.

Parameters

[in]	name	Name of section to delete
[in]	clear	if `true` clear the section's content with 0 before removing (default: `false`)

Implements LIEF::Binary.

◆ resources() [1/2]

ResourceNode * LIEF::PE::Binary::resources ( )

inline

Return resources as a tree or a nullptr if there is no resources.

◆ resources() [2/2]

const ResourceNode * LIEF::PE::Binary::resources ( ) const

inline

◆ resources_manager()

result< ResourcesManager > LIEF::PE::Binary::resources_manager ( ) const

Return the ResourcesManager (class to manage resources more easily than the tree one)

◆ rich_header() [1/3]

RichHeader * LIEF::PE::Binary::rich_header ( )

inline

Return a reference to the RichHeader object.

◆ rich_header() [2/3]

const RichHeader * LIEF::PE::Binary::rich_header ( ) const

inline

◆ rich_header() [3/3]

void LIEF::PE::Binary::rich_header ( const RichHeader & rich_header )

Set a RichHeader object in the current Binary.

◆ rva_to_offset()

uint64_t LIEF::PE::Binary::rva_to_offset ( uint64_t RVA ) const

Convert a Relative Virtual Address into an offset.

The conversion is performed by looking for the section that encompasses the provided RVA.

◆ section_from_offset() [1/2]

Section * LIEF::PE::Binary::section_from_offset ( uint64_t offset )

inline

Find the section associated that encompasses the given offset.

If no section can be found, return a nullptr

◆ section_from_offset() [2/2]

const Section * LIEF::PE::Binary::section_from_offset ( uint64_t offset ) const

◆ section_from_rva() [1/2]

Section * LIEF::PE::Binary::section_from_rva ( uint64_t virtual_address )

inline

Find the section associated that encompasses the given RVA.

If no section can be found, return a nullptr

◆ section_from_rva() [2/2]

const Section * LIEF::PE::Binary::section_from_rva ( uint64_t virtual_address ) const

◆ sections() [1/2]

it_sections LIEF::PE::Binary::sections ( )

inline

Return an iterator over the PE's Section.

◆ sections() [2/2]

it_const_sections LIEF::PE::Binary::sections ( ) const

inline

◆ set_resources() [1/2]

void LIEF::PE::Binary::set_resources ( const ResourceData & resource )

Set a new resource tree.

◆ set_resources() [2/2]

void LIEF::PE::Binary::set_resources ( const ResourceDirectory & resource )

Set a new resource tree.

◆ signatures() [1/2]

it_signatures LIEF::PE::Binary::signatures ( )

inline

◆ signatures() [2/2]

it_const_signatures LIEF::PE::Binary::signatures ( ) const

inline

Return an iterator over the Signature object(s) if the binary is signed.

◆ sizeof_headers()

uint32_t LIEF::PE::Binary::sizeof_headers ( ) const

Compute the size of all the headers.

◆ symbols() [1/2]

std::vector< Symbol > & LIEF::PE::Binary::symbols ( )

inline

Return binary Symbols.

◆ symbols() [2/2]

const std::vector< Symbol > & LIEF::PE::Binary::symbols ( ) const

inline

◆ tls() [1/3]

TLS * LIEF::PE::Binary::tls ( )

inline

Return a reference to the TLS object.

References LIEF::PE::TLS.

◆ tls() [2/3]

const TLS * LIEF::PE::Binary::tls ( ) const

inline

References LIEF::PE::TLS.

◆ tls() [3/3]

void LIEF::PE::Binary::tls ( const TLS & tls )

Set a TLS object in the current Binary.

◆ type()

PE_TYPE LIEF::PE::Binary::type ( ) const

inline

Return PE32 or PE32+

◆ va_to_offset()

uint64_t LIEF::PE::Binary::va_to_offset ( uint64_t VA ) const

Convert the absolute virtual address into an offset.

See also: rva_to_offset

◆ verify_signature() [1/2]

Signature::VERIFICATION_FLAGS LIEF::PE::Binary::verify_signature	(	const Signature &	sig,
		Signature::VERIFICATION_CHECKS	checks = Signature::VERIFICATION_CHECKS::DEFAULT ) const

Verify the binary with the Signature object provided in the first parameter. It can be used to verify a detached signature:

result<Signature> detached = LIEF::PE::SignatureParser::parse("sig.pkcs7")
if (detached) {
  binary->verify_signature(detached.value());
}

◆ verify_signature() [2/2]

Signature::VERIFICATION_FLAGS LIEF::PE::Binary::verify_signature ( Signature::VERIFICATION_CHECKS checks = Signature::VERIFICATION_CHECKS::DEFAULT ) const

Verify the binary against the embedded signature(s) (if any) First, it checks that the embedded signatures are correct (c.f. Signature::check) and then, it checks that the authentihash matches ContentInfo::digest.

One can tweak the verification process with the Signature::VERIFICATION_CHECKS flags

See also: LIEF::PE::Signature::check

◆ virtual_size()

uint64_t LIEF::PE::Binary::virtual_size ( ) const

Compute the binary's virtual size. It should match OptionalHeader::sizeof_image.

◆ write() [1/2]

void LIEF::PE::Binary::write ( const std::string & filename )

overridevirtual

Reconstruct the binary object and write the raw PE in filename

Rebuild a PE binary from the current Binary object. When rebuilding, import table and relocations are not rebuilt.

Implements LIEF::Binary.

◆ write() [2/2]

void LIEF::PE::Binary::write ( std::ostream & os )

overridevirtual

Reconstruct the binary object and write the raw PE in os stream.

Rebuild a PE binary from the current Binary object. When rebuilding, import table and relocations are not rebuilt.

Implements LIEF::Binary.

The documentation for this class was generated from the following file:

PE/Binary.hpp

Public Types

Public Member Functions

Static Public Member Functions

Detailed Description

Member Typedef Documentation

◆ data_directories_t

◆ debug_entries_t

◆ delay_imports_t

◆ imports_t

◆ it_const_data_directories

◆ it_const_debug_entries

◆ it_const_delay_imports

◆ it_const_imports

◆ it_const_relocations

◆ it_const_sections

◆ it_const_signatures

◆ it_const_strings_table

◆ it_const_symbols

◆ it_data_directories

◆ it_debug_entries

◆ it_delay_imports

◆ it_imports

◆ it_relocations

◆ it_sections

◆ it_signatures

◆ it_strings_table

◆ it_symbols

◆ relocations_t

◆ sections_t

◆ signatures_t

◆ strings_table_t

◆ symbols_t

Constructor & Destructor Documentation

◆ Binary()

◆ ~Binary()

Member Function Documentation

◆ accept()

◆ add_import_function()

◆ add_library()

◆ add_relocation()

◆ add_section()

◆ authentihash()

◆ classof()

◆ codeview_pdb()

◆ compute_checksum()

◆ ctor_functions()

◆ data_directories() [1/2]

◆ data_directories() [2/2]

◆ data_directory() [1/2]

◆ data_directory() [2/2]

◆ debug() [1/2]

◆ debug() [2/2]

◆ delay_imports() [1/2]

◆ delay_imports() [2/2]

◆ dos_header() [1/2]

◆ dos_header() [2/2]

◆ dos_stub() [1/3]

◆ dos_stub() [2/3]

◆ dos_stub() [3/3]

◆ entrypoint()

◆ exception_functions()

◆ functions()

◆ get_content_from_virtual_address()

◆ get_delay_import() [1/2]

◆ get_delay_import() [2/2]

◆ get_export() [1/2]

◆ get_export() [2/2]

◆ get_import() [1/2]

◆ get_import() [2/2]

◆ get_section() [1/2]

◆ get_section() [2/2]

◆ has()

◆ has_configuration()

◆ has_debug()

◆ has_delay_import()

◆ has_delay_imports()

◆ has_exceptions()

◆ has_exports()

◆ has_import()

◆ has_imports()