Public Types
<=> std::unordered_multimap<section index, Symbol*>
Public Functions
Public Static Functions
Parse the COFF binary referenced by the stream argument with the given config.
Parse the COFF binary pointed by the file argument with the given config.
Class used to configure the COFF parser.
Public Static Functions
Class that represents a COFF Binary.
Public Types
Internal container used to store COFF’s section.
Iterator that outputs Section& object.
Iterator that outputs const Section& object.
Internal container used to store COFF’s relocations.
Iterator that outputs Relocation& object.
Iterator that outputs const Relocation& object.
Iterator that outputs String& object.
Iterator that outputs const String& object.
Internal container used to store COFF’s symbols.
Iterator that outputs Symbol& object.
Iterator that outputs Symbol& object.
Instruction iterator.
Iterator which outputs COFF symbols representing functions.
Iterator which outputs COFF symbols representing functions.
Public Functions
Iterator over the different sections located in this COFF binary.
Iterator over all the relocations used by this COFF binary.
Iterator over the COFF’s symbols.
Iterator over the COFF’s strings.
Try to find the COFF string at the given offset in the COFF string table.
Warning
This offset must include the first 4 bytes holding the size of the table. Hence, the first string starts a the offset 4.
Iterator over the functions implemented in this COFF.
Try to find the function (symbol) with the given name.
Try to find the function (symbol) with the given demangled name.
Disassemble code for the given symbol.
const Symbol* func = binary->find_demangled_function("int __cdecl my_function(int, int)");
auto insts = binary->disassemble(*func);
for (std::unique_ptr<assembly::Instruction> inst : insts) {
std::cout << inst->to_string() << '\n';
}
See also
Disassemble code for the given symbol name.
auto insts = binary->disassemble("main");
for (std::unique_ptr<assembly::Instruction> inst : insts) {
std::cout << inst->to_string() << '\n';
}
See also
Disassemble code provided by the given buffer at the specified address parameter.
See also
Disassemble code provided by the given vector of bytes at the specified address parameter.
See also
Class that represents the COFF header. It is subclassed by LIEF::COFF::RegularHeader and LIEF::COFF::BigObjHeader for normal vs /bigobj files.
Subclassed by LIEF::COFF::BigObjHeader, LIEF::COFF::RegularHeader
Public Types
The different architectures (mirrored from PE)
Public Functions
The type of this header: whether it is regular or using the /bigobj format.
The machine type targeted by this COFF.
The number of sections.
Offset of the symbols table.
Number of symbols (including auxiliary symbols)
Timestamp when the COFF has been generated.
Public Static Functions
Create a header from the given stream.
This class represents the COFF header for non-bigobj.
Public Functions
The size of the optional header that follows this header (should be 0)
Characteristics.
Public Static Functions
Create a RegularHeader from the given stream.
This class represents the header for a COFF object compiled with /bigobj support (i.e. the number of sections can exceed 65536).
The raw definition of the bigobj header is located in winnt.h and named ANON_OBJECT_HEADER_BIGOBJ
Public Functions
The version of this header which must be >= 2.
Originally named ClassID, this uuid should match: {D1BAA1C7-BAEE-4ba9-AF20-FAF66AA4DCB8}
Size of data that follows the header.
1 means that it contains metadata
Size of CLR metadata.
Offset of CLR metadata.
Public Static Functions
Public Static Attributes
This class represents a COFF section.
Public Types
Mirror Characteristics from PE.
Container for the relocations in this section (owned by the Binary object)
Iterator that outputs Relocation&.
Iterator that outputs const Relocation&.
Container for the symbols associated with this section (owned by the Binary object)
Iterator that outputs Symbol&.
Iterator that outputs const Symbol&.
Public Functions
Return the size of the data in the section.
Virtual size of the section (should be 0)
Content wrapped by this section.
Offset to the section’s content.
Offset to the relocation table.
The file pointer to the beginning of line-number entries for the section.
This is set to zero if there are no COFF line numbers. This value should be zero for an image because COFF debugging information is deprecated and modern debug information relies on the PDB files.
Number of relocations.
Warning
If the number of relocations is greater than 0xFFFF (maximum value for 16-bits integer), then the number of relocations is stored in the virtual address of the first relocation.
Number of line number entries (if any).
Characteristics of the section: it provides information about the permissions of the section when mapped. It can also provide information about the purpose of the section (contain code, BSS-like, …)
Check if the section has the given CHARACTERISTICS.
List of the section characteristics.
True if the section can be discarded as needed.
This is typically the case for debug-related sections
Iterator over the relocations associated with this section.
Iterator over the symbols associated with this section.
Return comdat infomration (only if the section has the CHARACTERISTICS::LNK_COMDAT characteristic)
Whether there is a large number of relocations whose number need to be stored in the virtual address attribute.
Change section content.
Change the section’s name.
section’s name
Public Static Functions
Parse a section from the given stream.
Friends
This structure wraps comdat information which is composed of the symbol associated with the comdat section and its selection flag.
This class represents a COFF relocation.
Public Types
Public Static Functions
Create a relocation type from its raw value and the architecture.
Create a relocation from the given stream.
Public Static Attributes
Friends
This class represents a string located in the COFF string table.
Some of these strings can be used for section names that are greater than 8 bytes. See: LIEF::PE::Section::coff_string()
Reference: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#coff-string-table
Public Functions
The actual string.
The offset of this string the in the COFF string table. This offset includes the first 4-bytes that holds the table size.
This class represents a COFF symbol.
Public Types
Reference: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#storage-class.
Values:
Physical end of function.
No symbol.
Stack variable.
External symbol.
Static.
Register variable.
External definition.
Label.
Undefined label.
Member of structure.
Structure tag.
Member of union.
Union tag.
Type definition.
Undefined static.
Enumeration tag.
Member of enumeration.
Register parameter.
Bit field.
End of structure.
File name.
Duplicate tag.
Values:
No type information or unknown base type.
Used with void pointers and functions.
A character (signed byte).
A 2-byte signed integer.
A natural integer type on the target.
A 4-byte signed integer.
A 4-byte floating-point number.
An 8-byte floating-point number.
A structure.
An union.
An enumerated type.
A member of enumeration (a specific value).
A byte; unsigned 1-byte integer.
A word; unsigned 2-byte integer.
An unsigned integer of natural size.
An unsigned 4-byte integer.
Values:
No complex type; simple scalar variable.
A pointer to base type.
A function that returns a base type.
An array of base type.
Public Functions
The symbol type. The first byte represents the base type (see: base_type()) while the upper byte represents the complex type, if any (see: complex_type()).
Storage class of the symbol which indicates what kind of definition a symbol represents.
The complex type (if any)
The signed integer that identifies the section, using a one-based index into the section table. Some values have special meaning:
0: The symbol record is not yet assigned a section. A value of zero indicates that a reference to an external symbol is defined elsewhere. A value of non-zero is a common symbol with a size that is specified by the value.
-1: The symbol has an absolute (non-relocatable) value and is not an address.
-2: The symbol provides general type or debugging information but does not correspond to a section. Microsoft tools use this setting along with .file records
Auxiliary symbols associated with this symbol.
Name of the symbol. If the symbol does not use a short name, it returns the string pointed by the COFF string offset.
Demangled representation of the symbol or an empty string if it can’t be demangled.
Add a new auxiliary record.
Public Static Functions
Check if the given section index is a reserved value.
Public Static Attributes
The symbol provides general type or debugging information but does not correspond to a section. Microsoft tools use this setting along with .file records.
The symbol has an absolute (non-relocatable) value and is not an address.
The symbol record is not yet assigned a section. A value of zero indicates that a reference to an external symbol is defined elsewhere. A value of non-zero is a common symbol with a size that is specified by the value.
Friends
Class that represents an auxiliary symbol.
An auxiliary symbol has the same size as a regular LIEF::PE::Symbol (18 bytes) but its content depends on the the parent symbol.
Subclassed by LIEF::COFF::AuxiliaryCLRToken, LIEF::COFF::AuxiliaryFile, LIEF::COFF::AuxiliaryFunctionDefinition, LIEF::COFF::AuxiliarySectionDefinition, LIEF::COFF::AuxiliaryWeakExternal, LIEF::COFF::AuxiliarybfAndefSymbol
Public Types
Type discriminator for the subclasses.
Values:
Auxiliary Format 1 from the PE-COFF documentation.
Auxiliary Format 2: .bf and .ef Symbols from the PE-COFF documentation.
Auxiliary Format 3: Weak Externals from the PE-COFF documentation.
Auxiliary Format 4: Files from the PE-COFF documentation.
Public Functions
For unknown type only, return the raw representation of this symbol.
Helper to downcast a AuxiliarySymbol into a concrete implementation.
Public Static Functions
Friends
Auxiliary symbol associated with the CLR_TOKEN storage class.
Public Functions
IMAGE_AUX_SYMBOL_TYPE which should be IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF (1)
Reserved value (should be 0)
Index in the symbol table.
Symbol referenced by symbol_idx() (if resolved)
Reserved (padding) values. Should be 0.
Public Static Functions
Friends
This auxiliary symbols marks the beginning of a function definition.
Public Functions
The symbol-table index of the corresponding .bf (begin function) symbol record.
The size of the executable code for the function itself.
If the function is in its own section, the SizeOfRawData in the section header is greater or equal to this field, depending on alignment considerations.
The file offset of the first COFF line-number entry for the function, or zero if none exists (deprecated)
The symbol-table index of the record for the next function. If the function is the last in the symbol table, this field is set to zero.
Padding value (should be 0)
Public Static Functions
“Weak externals” are a mechanism for object files that allows flexibility at link time. A module can contain an unresolved external symbol (sym1), but it can also include an auxiliary record that indicates that if sym1 is not present at link time, another external symbol (sym2) is used to resolve references instead.
If a definition of sym1 is linked, then an external reference to the symbol is resolved normally. If a definition of sym1 is not linked, then all references to the weak external for sym1 refer to sym2 instead. The external symbol, sym2, must always be linked; typically, it is defined in the module that contains the weak reference to sym1.
Reference: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#auxiliary-format-3-weak-externals
Public Types
Public Functions
The symbol-table index of sym2, the symbol to be linked if sym1 is not found.
Public Static Functions
Public Functions
Public Static Functions
This auxiliary symbol exposes information about the associated section.
It duplicates some information that are provided in the section header
Public Types
Values for the AuxiliarySectionDefinition::selection attribute.
See: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#comdat-sections-object-only
Values:
If this symbol is already defined, the linker issues a multiply defined symbol error.
Any section that defines the same COMDAT symbol can be linked; the rest are removed.
The linker chooses an arbitrary section among the definitions for this symbol. If all definitions are not the same size, a multiply defined symbol error is issued.
The linker chooses an arbitrary section among the definitions for this symbol. If all definitions do not match exactly, a multiply defined symbol error is issued.
The section is linked if a certain other COMDAT section is linked. This other section is indicated by the Number field of the auxiliary symbol record for the section definition. This setting is useful for definitions that have components in multiple sections (for example, code in one and data in another), but where all must be linked or discarded as a set. The other section this section is associated with must be a COMDAT section, which can be another associative COMDAT section. An associative COMDAT section’s section association chain can’t form a loop. The section association chain must eventually come to a COMDAT section that doesn’t have COMDAT_SELECTION::ASSOCIATIVE set.
The linker chooses the largest definition from among all of the definitions for this symbol. If multiple definitions have this size, the choice between them is arbitrary.
Public Functions
The size of section data. The same as SizeOfRawData in the section header.
The number of relocation entries for the section.
The number of line-number entries for the section.
The checksum for communal data. It is applicable if the IMAGE_SCN_LNK_COMDAT flag is set in the section header.
One-based index into the section table for the associated section. This is used when the COMDAT selection setting is 5.
The COMDAT selection number. This is applicable if the section is a COMDAT section.
Reserved value (should be 0)
Public Static Functions
This auxiliary symbol represents a filename (auxiliary format 4)
The Symbol::name itself should start with .file, and this auxiliary record gives the name of a source-code file.
Reference: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#auxiliary-format-4-files
Public Functions
The associated filename.
Public Static Functions
This function determines if the given stream wraps a COFF binary and if so, whether it’s a regular or bigobj COFF.
Check if the given stream wraps a COFF file.
Check if the file is a COFF.
Check if the given buffer points to a COFF file.
Check if the given buffer points to a COFF file.
Check if the COFF file wrapped by the given stream is a bigobj
Check if the COFF file wrapped by the given stream is regular (i.e. not a bigobj)