Class which represents a PE section. More...

#include <Section.hpp>

Inheritance diagram for LIEF::PE::Section:

[legend]

Collaboration diagram for LIEF::PE::Section:

[legend]

Public Types
enum class	CHARACTERISTICS : uint64_t { TYPE_NO_PAD = 0x00000008 , CNT_CODE = 0x00000020 , CNT_INITIALIZED_DATA = 0x00000040 , CNT_UNINITIALIZED_DATA = 0x00000080 , LNK_OTHER = 0x00000100 , LNK_INFO = 0x00000200 , LNK_REMOVE = 0x00000800 , LNK_COMDAT = 0x00001000 , GPREL = 0x00008000 , MEM_PURGEABLE = 0x00010000 , MEM_16BIT = 0x00020000 , MEM_LOCKED = 0x00040000 , MEM_PRELOAD = 0x00080000 , ALIGN_1BYTES = 0x00100000 , ALIGN_2BYTES = 0x00200000 , ALIGN_4BYTES = 0x00300000 , ALIGN_8BYTES = 0x00400000 , ALIGN_16BYTES = 0x00500000 , ALIGN_32BYTES = 0x00600000 , ALIGN_64BYTES = 0x00700000 , ALIGN_128BYTES = 0x00800000 , ALIGN_256BYTES = 0x00900000 , ALIGN_512BYTES = 0x00A00000 , ALIGN_1024BYTES = 0x00B00000 , ALIGN_2048BYTES = 0x00C00000 , ALIGN_4096BYTES = 0x00D00000 , ALIGN_8192BYTES = 0x00E00000 , LNK_NRELOC_OVFL = 0x01000000 , MEM_DISCARDABLE = 0x02000000 , MEM_NOT_CACHED = 0x04000000 , MEM_NOT_PAGED = 0x08000000 , MEM_SHARED = 0x10000000 , MEM_EXECUTE = 0x20000000 , MEM_READ = 0x40000000 , MEM_WRITE = 0x80000000 }

Public Types inherited from LIEF::Object
template<class T >
using	output_t = add_pointer_t<decay_t<T>>

template<class T >
using	output_const_t = add_pointer_t<add_const_t<decay_t<T>>>

Public Member Functions
	Section (const details::pe_section &header)

	Section ()=default

	Section (std::string name)

	Section (std::string name, std::vector< uint8_t > content)

Section &	operator= (const Section &)=default

	Section (const Section &)=default

	~Section () override=default

uint32_t	sizeof_raw_data () const
	Return the size of the data in the section.

uint32_t	virtual_size () const
	Return the size of the data when mapped in memory.

span< const uint8_t >	content () const override
	The actual content of the section.

span< const uint8_t >	padding () const
	Content of the section's padding area.

uint32_t	pointerto_raw_data () const
	The offset of the section data in the PE file.

uint32_t	pointerto_relocation () const
	The file pointer to the beginning of the COFF relocation entries for the section. This is set to zero for executable images or if there are no relocations.

uint32_t	pointerto_line_numbers () const
	The file pointer to the beginning of line-number entries for the section. This is set to zero if there are no COFF line numbers. This value should be zero for an image because COFF debugging information is deprecated and modern debug information relies on the PDB files.

uint16_t	numberof_relocations () const
	No longer used in recent PE binaries produced by Visual Studio.

uint16_t	numberof_line_numbers () const
	No longer used in recent PE binaries produced by Visual Studio.

uint32_t	characteristics () const
	Characteristics of the section: it provides information about the permissions of the section when mapped. It can also provide information about the purpose of the section (contain code, BSS-like, ...)

bool	has_characteristic (CHARACTERISTICS c) const
	Check if the section has the given CHARACTERISTICS.

std::vector< CHARACTERISTICS >	characteristics_list () const
	List of the section characteristics.

bool	is_discardable () const
	True if the section can be discarded as needed.

void	clear (uint8_t c)
	Fill the content of the section with the given `char`

void	content (const std::vector< uint8_t > &data) override
	Change section content.

void	name (std::string name) override
	Change the section's name.

void	virtual_size (uint32_t virtual_sz)

void	pointerto_raw_data (uint32_t ptr)

void	pointerto_relocation (uint32_t ptr)

void	pointerto_line_numbers (uint32_t ptr)

void	numberof_relocations (uint16_t nb)

void	numberof_line_numbers (uint16_t nb)

void	sizeof_raw_data (uint32_t size)

void	characteristics (uint32_t characteristics)

COFF::String *	coff_string ()
	Return the COFF string associated with the section's name (or a nullptr)

const COFF::String *	coff_string () const

Section &	remove_characteristic (CHARACTERISTICS characteristic)

Section &	add_characteristic (CHARACTERISTICS characteristic)

std::unique_ptr< SpanStream >	stream () const

span< uint8_t >	writable_content ()

void	accept (Visitor &visitor) const override

virtual std::string	name () const
	section's name

Public Member Functions inherited from LIEF::Section
	Section ()=default

	Section (std::string name)

	~Section () override=default

Section &	operator= (const Section &)=default

	Section (const Section &)=default

virtual const std::string &	fullname () const
	Return the complete section's name which might trailing (`0`) bytes.

virtual void	size (uint64_t size)
	Change the section size.

virtual uint64_t	size () const
	section's size (size in the binary, not the virtual size)

virtual uint64_t	offset () const
	Offset in the binary.

virtual uint64_t	virtual_address () const
	Address where the section should be mapped.

virtual void	virtual_address (uint64_t virtual_address)

virtual void	offset (uint64_t offset)

double	entropy () const
	Section's entropy.

size_t	search (uint64_t integer, size_t pos, size_t size) const

size_t	search (const std::vector< uint8_t > &pattern, size_t pos=0) const

size_t	search (const std::string &pattern, size_t pos=0) const

size_t	search (uint64_t integer, size_t pos=0) const

std::vector< size_t >	search_all (uint64_t v, size_t size) const

std::vector< size_t >	search_all (uint64_t v) const

std::vector< size_t >	search_all (const std::string &v) const

void	accept (Visitor &visitor) const override
	Method so that the `visitor` can visit us.

Public Member Functions inherited from LIEF::Object
	Object ()

	Object (const Object &other)

Object &	operator= (const Object &other)

template<class T >
output_t< T >	as ()

template<class T >
output_const_t< T >	as () const

virtual bool	operator== (const Object &other) const

virtual bool	operator!= (const Object &other) const

virtual	~Object ()

Static Public Member Functions
static std::vector< CHARACTERISTICS >	characteristics_to_list (uint32_t value)

Static Public Attributes
static constexpr size_t	MAX_SECTION_NAME = 8

Static Public Attributes inherited from LIEF::Section
static constexpr size_t	npos = -1

Detailed Description

Class which represents a PE section.

Member Enumeration Documentation

◆ CHARACTERISTICS

enum class LIEF::PE::Section::CHARACTERISTICS : uint64_t

strong

Enumerator
TYPE_NO_PAD
CNT_CODE
CNT_INITIALIZED_DATA
CNT_UNINITIALIZED_DATA
LNK_OTHER
LNK_INFO
LNK_REMOVE
LNK_COMDAT
GPREL
MEM_PURGEABLE
MEM_16BIT
MEM_LOCKED
MEM_PRELOAD
ALIGN_1BYTES
ALIGN_2BYTES
ALIGN_4BYTES
ALIGN_8BYTES
ALIGN_16BYTES
ALIGN_32BYTES
ALIGN_64BYTES
ALIGN_128BYTES
ALIGN_256BYTES
ALIGN_512BYTES
ALIGN_1024BYTES
ALIGN_2048BYTES
ALIGN_4096BYTES
ALIGN_8192BYTES
LNK_NRELOC_OVFL
MEM_DISCARDABLE
MEM_NOT_CACHED
MEM_NOT_PAGED
MEM_SHARED
MEM_EXECUTE
MEM_READ
MEM_WRITE

Constructor & Destructor Documentation

◆ Section() [1/5]

LIEF::PE::Section::Section ( const details::pe_section & header )

◆ Section() [2/5]

LIEF::PE::Section::Section ( )

default

◆ Section() [3/5]

LIEF::PE::Section::Section ( std::string name )

inline

◆ Section() [4/5]

LIEF::PE::Section::Section	(	std::string	name,
		std::vector< uint8_t >	content )

inline

◆ Section() [5/5]

LIEF::PE::Section::Section ( const Section & )

default

◆ ~Section()

LIEF::PE::Section::~Section ( )

overridedefault

Member Function Documentation

◆ accept()

void LIEF::PE::Section::accept ( Visitor & visitor ) const

overridevirtual

Implements LIEF::Object.

◆ add_characteristic()

Section & LIEF::PE::Section::add_characteristic ( CHARACTERISTICS characteristic )

inline

◆ characteristics() [1/2]

uint32_t LIEF::PE::Section::characteristics ( ) const

inline

Characteristics of the section: it provides information about the permissions of the section when mapped. It can also provide information about the purpose of the section (contain code, BSS-like, ...)

◆ characteristics() [2/2]

void LIEF::PE::Section::characteristics ( uint32_t characteristics )

inline

◆ characteristics_list()

std::vector< CHARACTERISTICS > LIEF::PE::Section::characteristics_list ( ) const

inline

List of the section characteristics.

◆ characteristics_to_list()

static std::vector< CHARACTERISTICS > LIEF::PE::Section::characteristics_to_list ( uint32_t value )

static

Referenced by LIEF::COFF::Section::characteristics_list().

◆ clear()

void LIEF::PE::Section::clear ( uint8_t c )

Fill the content of the section with the given char

◆ coff_string() [1/2]

COFF::String * LIEF::PE::Section::coff_string ( )

inline

Return the COFF string associated with the section's name (or a nullptr)

This coff string is usually present for long section names whose length does not fit in the 8 bytes allocated by the PE format.

◆ coff_string() [2/2]

const COFF::String * LIEF::PE::Section::coff_string ( ) const

inline

◆ content() [1/2]

span< const uint8_t > LIEF::PE::Section::content ( ) const

inlineoverridevirtual

The actual content of the section.

Reimplemented from LIEF::Section.

◆ content() [2/2]

void LIEF::PE::Section::content ( const std::vector< uint8_t > & )

overridevirtual

Change section content.

Reimplemented from LIEF::Section.

◆ has_characteristic()

bool LIEF::PE::Section::has_characteristic ( CHARACTERISTICS c ) const

inline

Check if the section has the given CHARACTERISTICS.

◆ is_discardable()

bool LIEF::PE::Section::is_discardable ( ) const

inline

True if the section can be discarded as needed.

This is typically the case for debug-related sections

◆ name() [1/2]

virtual std::string LIEF::Section::name ( ) const

inlinevirtual

section's name

Reimplemented from LIEF::Section.

◆ name() [2/2]

void LIEF::PE::Section::name ( std::string name )

overridevirtual

Change the section's name.

Reimplemented from LIEF::Section.

◆ numberof_line_numbers() [1/2]

uint16_t LIEF::PE::Section::numberof_line_numbers ( ) const

inline

No longer used in recent PE binaries produced by Visual Studio.

◆ numberof_line_numbers() [2/2]

void LIEF::PE::Section::numberof_line_numbers ( uint16_t nb )

inline

◆ numberof_relocations() [1/2]

uint16_t LIEF::PE::Section::numberof_relocations ( ) const

inline

No longer used in recent PE binaries produced by Visual Studio.

◆ numberof_relocations() [2/2]

void LIEF::PE::Section::numberof_relocations ( uint16_t nb )

inline

◆ operator=()

Section & LIEF::PE::Section::operator= ( const Section & )

default

◆ padding()

span< const uint8_t > LIEF::PE::Section::padding ( ) const

inline

Content of the section's padding area.

◆ pointerto_line_numbers() [1/2]

uint32_t LIEF::PE::Section::pointerto_line_numbers ( ) const

inline

The file pointer to the beginning of line-number entries for the section. This is set to zero if there are no COFF line numbers. This value should be zero for an image because COFF debugging information is deprecated and modern debug information relies on the PDB files.

◆ pointerto_line_numbers() [2/2]

void LIEF::PE::Section::pointerto_line_numbers ( uint32_t ptr )

inline

◆ pointerto_raw_data() [1/2]

uint32_t LIEF::PE::Section::pointerto_raw_data ( ) const

The offset of the section data in the PE file.

◆ pointerto_raw_data() [2/2]

void LIEF::PE::Section::pointerto_raw_data ( uint32_t ptr )

inline

◆ pointerto_relocation() [1/2]

uint32_t LIEF::PE::Section::pointerto_relocation ( ) const

inline

The file pointer to the beginning of the COFF relocation entries for the section. This is set to zero for executable images or if there are no relocations.

For modern PE binaries, this value is usually set to 0 as the relocations are managed by PE::Relocation.

◆ pointerto_relocation() [2/2]

void LIEF::PE::Section::pointerto_relocation ( uint32_t ptr )

inline

◆ remove_characteristic()

Section & LIEF::PE::Section::remove_characteristic ( CHARACTERISTICS characteristic )

inline

◆ sizeof_raw_data() [1/2]

uint32_t LIEF::PE::Section::sizeof_raw_data ( ) const

Return the size of the data in the section.

◆ sizeof_raw_data() [2/2]

void LIEF::PE::Section::sizeof_raw_data ( uint32_t size )

inline

◆ stream()

std::unique_ptr< SpanStream > LIEF::PE::Section::stream ( ) const

◆ virtual_size() [1/2]

uint32_t LIEF::PE::Section::virtual_size ( ) const

inline

Return the size of the data when mapped in memory.

If this value is greater than sizeof_raw_data, the section is zero-padded.

◆ virtual_size() [2/2]

void LIEF::PE::Section::virtual_size ( uint32_t virtual_sz )

inline

◆ writable_content()

span< uint8_t > LIEF::PE::Section::writable_content ( )

inline

Member Data Documentation

◆ MAX_SECTION_NAME

size_t LIEF::PE::Section::MAX_SECTION_NAME = 8

staticconstexpr

The documentation for this class was generated from the following file:

PE/Section.hpp

Public Types

Public Member Functions

Static Public Member Functions

Static Public Attributes

Detailed Description

Member Enumeration Documentation

◆ CHARACTERISTICS

Constructor & Destructor Documentation

◆ Section() [1/5]

◆ Section() [2/5]

◆ Section() [3/5]

◆ Section() [4/5]

◆ Section() [5/5]

◆ ~Section()

Member Function Documentation

◆ accept()

◆ add_characteristic()

◆ characteristics() [1/2]

◆ characteristics() [2/2]

◆ characteristics_list()

◆ characteristics_to_list()

◆ clear()

◆ coff_string() [1/2]

◆ coff_string() [2/2]

◆ content() [1/2]

◆ content() [2/2]

◆ has_characteristic()

◆ is_discardable()

◆ name() [1/2]

◆ name() [2/2]

◆ numberof_line_numbers() [1/2]

◆ numberof_line_numbers() [2/2]

◆ numberof_relocations() [1/2]

◆ numberof_relocations() [2/2]

◆ operator=()

◆ padding()

◆ pointerto_line_numbers() [1/2]

◆ pointerto_line_numbers() [2/2]

◆ pointerto_raw_data() [1/2]

◆ pointerto_raw_data() [2/2]

◆ pointerto_relocation() [1/2]

◆ pointerto_relocation() [2/2]

◆ remove_characteristic()

◆ sizeof_raw_data() [1/2]

◆ sizeof_raw_data() [2/2]

◆ stream()

◆ virtual_size() [1/2]

◆ virtual_size() [2/2]

◆ writable_content()

Member Data Documentation

◆ MAX_SECTION_NAME