LIEF::PE::Symbol Class Reference

Class that represents a PE-COFF symbol. More...

#include <Symbol.hpp>

Inheritance diagram for LIEF::PE::Symbol:

Collaboration diagram for LIEF::PE::Symbol:

Public Types
enum class	STORAGE_CLASS : int32_t {   INVALID = 0xFF , END_OF_FUNCTION = -1 , NONE = 0 , AUTOMATIC = 1 ,   EXTERNAL = 2 , STATIC = 3 , REGISTER = 4 , EXTERNAL_DEF = 5 ,   LABEL = 6 , UNDEFINED_LABEL = 7 , MEMBER_OF_STRUCT = 8 , ARGUMENT = 9 ,   STRUCT_TAG = 10 , MEMBER_OF_UNION = 11 , UNION_TAG = 12 , TYPE_DEFINITION = 13 ,   UNDEFINED_STATIC = 14 , ENUM_TAG = 15 , MEMBER_OF_ENUM = 16 , REGISTER_PARAM = 17 ,   BIT_FIELD = 18 , BLOCK = 100 , FUNCTION = 101 , END_OF_STRUCT = 102 ,   FILE = 103 , SECTION = 104 , WEAK_EXTERNAL = 105 , CLR_TOKEN = 107 }
	Reference: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#storage-class. More...
enum class	BASE_TYPE : uint32_t {   TY_NULL = 0 , TY_VOID = 1 , TY_CHAR = 2 , TY_SHORT = 3 ,   TY_INT = 4 , TY_LONG = 5 , TY_FLOAT = 6 , TY_DOUBLE = 7 ,   TY_STRUCT = 8 , TY_UNION = 9 , TY_ENUM = 10 , TY_MOE = 11 ,   TY_BYTE = 12 , TY_WORD = 13 , TY_UINT = 14 , TY_DWORD = 15 }
enum class	COMPLEX_TYPE : uint32_t { TY_NULL = 0 , TY_POINTER = 1 , TY_FUNCTION = 2 , TY_ARRAY = 3 }
using	auxiliary_symbols_t = std::vector<std::unique_ptr<AuxiliarySymbol>>
using	it_auxiliary_symbols_t = ref_iterator<auxiliary_symbols_t&, AuxiliarySymbol*>
using	it_const_auxiliary_symbols_t = const_ref_iterator<const auxiliary_symbols_t&, AuxiliarySymbol*>
Public Types inherited from LIEF::Object
template<class T >
using	output_t = add_pointer_t<decay_t<T>>
template<class T >
using	output_const_t = add_pointer_t<add_const_t<decay_t<T>>>

Public Member Functions
	Symbol ()
	Symbol (const Symbol &)
Symbol &	operator= (const Symbol &)
	Symbol (Symbol &&)
Symbol &	operator= (Symbol &&)
uint16_t	type () const
	The symbol type. The first byte represents the base type (see: base_type()) while the upper byte represents the complex type, if any (see: complex_type()).
STORAGE_CLASS	storage_class () const
	Storage class of the symbol which indicates what kind of definition a symbol represents.
BASE_TYPE	base_type () const
	The simple (base) data type.
COMPLEX_TYPE	complex_type () const
	The complex type (if any)
int16_t	section_idx () const
	The signed integer that identifies the section, using a one-based index into the section table. Some values have special meaning:
bool	is_external () const
bool	is_weak_external () const
bool	is_undefined () const
bool	is_function_line_info () const
bool	is_file_record () const
it_auxiliary_symbols_t	auxiliary_symbols ()
	Auxiliary symbols associated with this symbol.
it_const_auxiliary_symbols_t	auxiliary_symbols () const
const std::string &	name () const override
	Name of the symbol. If the symbol does not use a short name, it returns the string pointed by the COFF string offset.
std::string &	name () override
const COFFString *	coff_name () const
	COFF string used to represents the (long) symbol name.
COFFString *	coff_name ()
Symbol &	type (uint16_t ty)
Symbol &	storage_class (uint8_t value)
Symbol &	section_idx (int16_t idx)
AuxiliarySymbol &	add_aux (std::unique_ptr< AuxiliarySymbol > sym)
	Add a new auxiliary record.
void	accept (Visitor &visitor) const override
	~Symbol () override
Public Member Functions inherited from LIEF::Symbol
	Symbol ()=default
	Symbol (std::string name)
	Symbol (std::string name, uint64_t value)
	Symbol (std::string name, uint64_t value, uint64_t size)
	Symbol (const Symbol &)=default
Symbol &	operator= (const Symbol &)=default
	Symbol (Symbol &&)=default
Symbol &	operator= (Symbol &&)=default
	~Symbol () override=default
void	swap (Symbol &other) noexcept
virtual void	name (std::string name)
	Set symbol name.
virtual uint64_t	value () const
virtual void	value (uint64_t value)
virtual uint64_t	size () const
	This size of the symbol (when applicable)
virtual void	size (uint64_t value)
void	accept (Visitor &visitor) const override
	Method so that the visitor can visit us.
Public Member Functions inherited from LIEF::Object
	Object ()
	Object (const Object &other)
Object &	operator= (const Object &other)
template<class T >
output_t< T >	as ()
template<class T >
output_const_t< T >	as () const
virtual bool	operator== (const Object &other) const
virtual bool	operator!= (const Object &other) const
virtual	~Object ()

Static Public Member Functions
static std::unique_ptr< Symbol >	parse (Parser &ctx, BinaryStream &stream, size_t *idx)
static constexpr bool	is_reversed_sec_idx (int16_t idx)
	Check if the given section index is a reserved value.

Static Public Attributes
static constexpr auto	SYM_SEC_IDX_DEBUG = -2
	The symbol provides general type or debugging information but does not correspond to a section. Microsoft tools use this setting along with .file records.
static constexpr auto	SYM_SEC_IDX_ABS = -1
	The symbol has an absolute (non-relocatable) value and is not an address.
static constexpr auto	SYM_SEC_IDX_UNDEF = 0
	The symbol record is not yet assigned a section. A value of zero indicates that a reference to an external symbol is defined elsewhere. A value of non-zero is a common symbol with a size that is specified by the value.
static constexpr auto	SYM_COMPLEX_TYPE_SHIFT = 4

Detailed Description

Class that represents a PE-COFF symbol.

Usually PE debug information (including symbols) are wrapped in a PDB file referenced by the CodeViewPDB object.

The PE format allows to define (by COFF inheritance) a symbol table that is different from the regular PDB symbols. This table contains COFF(16) symbols which can reference auxiliary symbols.

Warning

The LIEF::Symbol::value() should be interpreted in perspective of the Symbol::storage_class().

Reference: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#coff-symbol-table

Member Typedef Documentation

auxiliary_symbols_t

using LIEF::PE::Symbol::auxiliary_symbols_t = std::vector<std::unique_ptr<AuxiliarySymbol>>

it_auxiliary_symbols_t

using LIEF::PE::Symbol::it_auxiliary_symbols_t = ref_iterator<auxiliary_symbols_t&, AuxiliarySymbol*>

it_const_auxiliary_symbols_t

using LIEF::PE::Symbol::it_const_auxiliary_symbols_t = const_ref_iterator<const auxiliary_symbols_t&, AuxiliarySymbol*>

Member Enumeration Documentation

BASE_TYPE

enum class LIEF::PE::Symbol::BASE_TYPE : uint32_t

strong

Enumerator
TY_NULL	No type information or unknown base type.
TY_VOID	Used with void pointers and functions.
TY_CHAR	A character (signed byte).
TY_SHORT	A 2-byte signed integer.
TY_INT	A natural integer type on the target.
TY_LONG	A 4-byte signed integer.
TY_FLOAT	A 4-byte floating-point number.
TY_DOUBLE	An 8-byte floating-point number.
TY_STRUCT	A structure.
TY_UNION	An union.
TY_ENUM	An enumerated type.
TY_MOE	A member of enumeration (a specific value).
TY_BYTE	A byte; unsigned 1-byte integer.
TY_WORD	A word; unsigned 2-byte integer.
TY_UINT	An unsigned integer of natural size.
TY_DWORD	An unsigned 4-byte integer.

COMPLEX_TYPE

enum class LIEF::PE::Symbol::COMPLEX_TYPE : uint32_t

strong

Enumerator
TY_NULL	No complex type; simple scalar variable.
TY_POINTER	A pointer to base type.
TY_FUNCTION	A function that returns a base type.
TY_ARRAY	An array of base type.

STORAGE_CLASS

enum class LIEF::PE::Symbol::STORAGE_CLASS : int32_t

strong

Reference: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#storage-class.

Enumerator
INVALID
END_OF_FUNCTION	Physical end of function.
NONE	No symbol.
AUTOMATIC	Stack variable.
EXTERNAL	External symbol.
STATIC	Static.
REGISTER	Register variable.
EXTERNAL_DEF	External definition.
LABEL	Label.
UNDEFINED_LABEL	Undefined label.
MEMBER_OF_STRUCT	Member of structure.
ARGUMENT	Function argument.
STRUCT_TAG	Structure tag.
MEMBER_OF_UNION	Member of union.
UNION_TAG	Union tag.
TYPE_DEFINITION	Type definition.
UNDEFINED_STATIC	Undefined static.
ENUM_TAG	Enumeration tag.
MEMBER_OF_ENUM	Member of enumeration.
REGISTER_PARAM	Register parameter.
BIT_FIELD	Bit field.
BLOCK
FUNCTION
END_OF_STRUCT	End of structure.
FILE	File name.
SECTION
WEAK_EXTERNAL	Duplicate tag.
CLR_TOKEN

Constructor & Destructor Documentation

Symbol() [1/3]

LIEF::PE::Symbol::Symbol

(

)

Symbol() [2/3]

LIEF::PE::Symbol::Symbol

(

const Symbol &

)

Symbol() [3/3]

LIEF::PE::Symbol::Symbol

(

Symbol &&

)

~Symbol()

LIEF::PE::Symbol::~Symbol ( )

override

Member Function Documentation

accept()

void LIEF::PE::Symbol::accept ( Visitor & visitor ) const

overridevirtual

Implements LIEF::Object.

add_aux()

AuxiliarySymbol & LIEF::PE::Symbol::add_aux

(

std::unique_ptr< AuxiliarySymbol >

sym

)

Add a new auxiliary record.

auxiliary_symbols() [1/2]

it_auxiliary_symbols_t LIEF::PE::Symbol::auxiliary_symbols ( )

inline

Auxiliary symbols associated with this symbol.

auxiliary_symbols() [2/2]

it_const_auxiliary_symbols_t LIEF::PE::Symbol::auxiliary_symbols ( ) const

inline

base_type()

BASE_TYPE LIEF::PE::Symbol::base_type ( ) const

inline

The simple (base) data type.

coff_name() [1/2]

COFFString * LIEF::PE::Symbol::coff_name ( )

inline

coff_name() [2/2]

const COFFString * LIEF::PE::Symbol::coff_name ( ) const

inline

COFF string used to represents the (long) symbol name.

complex_type()

COMPLEX_TYPE LIEF::PE::Symbol::complex_type ( ) const

inline

The complex type (if any)

is_external()

bool LIEF::PE::Symbol::is_external ( ) const

inline

is_file_record()

bool LIEF::PE::Symbol::is_file_record ( ) const

inline

is_function_line_info()

bool LIEF::PE::Symbol::is_function_line_info ( ) const

inline

is_reversed_sec_idx()

static constexpr bool LIEF::PE::Symbol::is_reversed_sec_idx ( int16_t idx )

inlinestaticconstexpr

Check if the given section index is a reserved value.

is_undefined()

bool LIEF::PE::Symbol::is_undefined ( ) const

inline

is_weak_external()

bool LIEF::PE::Symbol::is_weak_external ( ) const

inline

name() [1/2]

const std::string & LIEF::PE::Symbol::name ( ) const

overridevirtual

Name of the symbol. If the symbol does not use a short name, it returns the string pointed by the COFF string offset.

Reimplemented from LIEF::Symbol.

name() [2/2]

std::string & LIEF::PE::Symbol::name ( )

overridevirtual

Reimplemented from LIEF::Symbol.

operator=() [1/2]

Symbol & LIEF::PE::Symbol::operator=

(

const Symbol &

)

operator=() [2/2]

Symbol & LIEF::PE::Symbol::operator=

(

Symbol &&

)

parse()

static std::unique_ptr< Symbol > LIEF::PE::Symbol::parse ( Parser & ctx, BinaryStream & stream, size_t * idx )

static

section_idx() [1/2]

int16_t LIEF::PE::Symbol::section_idx ( ) const

inline

The signed integer that identifies the section, using a one-based index into the section table. Some values have special meaning:

• 0: The symbol record is not yet assigned a section. A value of zero indicates that a reference to an external symbol is defined elsewhere. A value of non-zero is a common symbol with a size that is specified by the value.
• -1: The symbol has an absolute (non-relocatable) value and is not an address.
• -2: The symbol provides general type or debugging information but does not correspond to a section. Microsoft tools use this setting along with .file records

section_idx() [2/2]

Symbol & LIEF::PE::Symbol::section_idx ( int16_t idx )

inline

storage_class() [1/2]

STORAGE_CLASS LIEF::PE::Symbol::storage_class ( ) const

inline

Storage class of the symbol which indicates what kind of definition a symbol represents.

storage_class() [2/2]

Symbol & LIEF::PE::Symbol::storage_class ( uint8_t value )

inline

type() [1/2]

uint16_t LIEF::PE::Symbol::type ( ) const

inline

The symbol type. The first byte represents the base type (see: base_type()) while the upper byte represents the complex type, if any (see: complex_type()).

type() [2/2]

Symbol & LIEF::PE::Symbol::type ( uint16_t ty )

inline

Member Data Documentation

SYM_COMPLEX_TYPE_SHIFT

auto LIEF::PE::Symbol::SYM_COMPLEX_TYPE_SHIFT = 4

staticconstexpr

SYM_SEC_IDX_ABS

auto LIEF::PE::Symbol::SYM_SEC_IDX_ABS = -1

staticconstexpr

The symbol has an absolute (non-relocatable) value and is not an address.

SYM_SEC_IDX_DEBUG

auto LIEF::PE::Symbol::SYM_SEC_IDX_DEBUG = -2

staticconstexpr

The symbol provides general type or debugging information but does not correspond to a section. Microsoft tools use this setting along with .file records.

SYM_SEC_IDX_UNDEF

auto LIEF::PE::Symbol::SYM_SEC_IDX_UNDEF = 0

staticconstexpr

The symbol record is not yet assigned a section. A value of zero indicates that a reference to an external symbol is defined elsewhere. A value of non-zero is a common symbol with a size that is specified by the value.

---

The documentation for this class was generated from the following file:

• PE/Symbol.hpp