LIEF Docs Extended Sponsor

C++

Parser

class Parser : public LIEF::Parser

Main interface to parse PE binaries. In particular, the static Parser::parse functions should be used to get a LIEF::PE::Binary instance.

Public Functions

Parser &operator=(const Parser &copy) = delete
Parser(const Parser &copy) = delete
COFF::String *find_coff_string(uint32_t offset) const
inline ExceptionInfo *find_exception_info(uint32_t rva) const
inline const Binary &bin() const
inline Binary &bin()
inline BinaryStream &stream()
inline const ParserConfig &config() const
void memoize(ExceptionInfo &info)
void memoize(COFF::String str)
inline void add_non_resolved(ExceptionInfo &info, uint32_t target)
std::unique_ptr<SpanStream> stream_from_rva(uint32_t rva, size_t size = 0)
void record_relocation(uint32_t rva, span<const uint8_t> data)
ok_error_t record_delta_relocation(uint32_t rva, int64_t delta, size_t size)

Public Static Functions

static bool is_valid_import_name(const std::string &name)

Check if the given name is a valid import.

This check verifies that:

  1. The name is not too large or empty (cf. https://stackoverflow.com/a/23340781)

  2. All the characters are printable

static bool is_valid_dll_name(const std::string &name)

Check if the given name is a valid DLL name.

This check verifies that:

  1. The name of the DLL is at least 4 characters long

  2. All the characters are printable

static std::unique_ptr<Binary> parse(const std::string &filename, const ParserConfig &conf = ParserConfig::default_conf())

Parse a PE binary from the given filename.

static std::unique_ptr<Binary> parse(std::vector<uint8_t> data, const ParserConfig &conf = ParserConfig::default_conf())

Parse a PE binary from a data buffer.

static std::unique_ptr<Binary> parse(const uint8_t *buffer, size_t size, const ParserConfig &conf = ParserConfig::default_conf())
static std::unique_ptr<Binary> parse(std::unique_ptr<BinaryStream> stream, const ParserConfig &conf = ParserConfig::default_conf())

Parse a PE binary from the given BinaryStream.

static std::unique_ptr<Binary> parse_from_memory(uintptr_t address, const ParserConfig &config = ParserConfig::default_conf())

Parse the PE binary at the given memory address.

static std::unique_ptr<Binary> parse_from_memory(uintptr_t address, size_t size, const ParserConfig &config = ParserConfig::default_conf())

Parse the PE binary at the given memory address and with the given size.

static std::unique_ptr<Binary> parse_from_dump(const std::string &filepath, uint64_t addr, const ParserConfig &config = ParserConfig::default_conf())

Parse a PE binary from a memory dump located on disk.

A dump is a raw capture of the process memory that was mapped starting at the virtual address addr. This is typically used to parse a PE image that has been dumped from memory (e.g. from a debugger or a runtime hook).

Parameters:

  • filepath – [in] Path to the file that contains the memory dump

  • addr – [in] Virtual address at which the dump was mapped

  • config – [in] Optional configuration for the parser

static std::unique_ptr<Binary> parse_from_dump(BinaryStream &stream, uint64_t addr, const ParserConfig &config = ParserConfig::default_conf())

Same as parse_from_dump(const std::string&, uint64_t, const ParserConfig&) but the dump is wrapped in the given non-owned stream.

static std::unique_ptr<Binary> parse_from_dump(std::unique_ptr<BinaryStream> stream, uint64_t addr, const ParserConfig &config = ParserConfig::default_conf())

Same as parse_from_dump(const std::string&, uint64_t, const ParserConfig&) but the dump is wrapped in the given owned stream.

Public Static Attributes

static size_t MAX_DATA_SIZE = 3_GB

Maximum size of the data read.

static size_t MAX_TLS_CALLBACKS = 3000
static size_t MAX_IMPORT_ENTRIES = 0x10000
static size_t MAX_IMPORT_NAME_SIZE = 0x1000
static size_t MAX_DLL_NAME_SIZE = 255
static size_t MAX_PADDING_SIZE = 1_GB

Max size of the padding section.

struct ParserConfig

This structure is used to configure the behavior of the PE Parser (PE::Parser).

Public Functions

std::string to_string() const

Public Members

bool parse_signature = true

Whether to parse the PE Authenticode signature.

bool parse_exports = true

Whether to parse the PE Export Directory.

bool parse_imports = true

Whether to parse the PE Import Directory.

bool parse_rsrc = true

Whether to parse the PE resources tree.

bool parse_reloc = true

Whether to parse PE relocations.

bool parse_exceptions = false

Whether to parse in-depth exception metadata.

This option is disabled by default because it can introduce significant parsing overhead.

bool parse_arm64x_binary = false

Whether to parse nested ARM64X binaries.

This option is disabled by default because it can introduce significant parsing overhead.

std::optional<uint64_t> rebase

If set, this value holds the original image base from which the binary should be rebased. This is used to undo relocations and IAT bindings when parsing a PE loaded in memory.

Public Static Functions

static inline const ParserConfig &default_conf()

Returns the default configuration for the PE Parser.

static inline ParserConfig all()

Returns a configuration that enables all optional parsing features.

Friends

inline friend std::ostream &operator<<(std::ostream &os, const ParserConfig &config)

Binary

class Binary : public LIEF::Binary

Class which represents a PE binary This is the main interface to manage and modify a PE executable.

Public Types

using sections_t = std::vector<std::unique_ptr<Section>>

Internal container for storing PE’s Section.

using it_sections = ref_iterator<sections_t&, Section*>

Iterator that outputs Section& object.

using it_const_sections = const_ref_iterator<const sections_t&, const Section*>

Iterator that outputs const Section& object.

using data_directories_t = std::vector<std::unique_ptr<DataDirectory>>

Internal container for storing PE’s DataDirectory.

using it_data_directories = ref_iterator<data_directories_t&, DataDirectory*>

Iterator that outputs DataDirectory&.

using it_const_data_directories = const_ref_iterator<const data_directories_t&, const DataDirectory*>

Iterator that outputs const DataDirectory&.

using relocations_t = std::vector<std::unique_ptr<Relocation>>

Internal container for storing PE’s Relocation.

using it_relocations = ref_iterator<relocations_t&, Relocation*>

Iterator that outputs Relocation&.

using it_const_relocations = const_ref_iterator<const relocations_t&, const Relocation*>

Iterator that outputs const Relocation&.

using imports_t = std::vector<std::unique_ptr<Import>>

Internal container for storing PE’s Import.

using it_imports = ref_iterator<imports_t&, Import*>

Iterator that outputs Import&.

using it_const_imports = const_ref_iterator<const imports_t&, const Import*>

Iterator that outputs const Import&.

using delay_imports_t = std::vector<std::unique_ptr<DelayImport>>

Internal container for storing PE’s DelayImport.

using it_delay_imports = ref_iterator<delay_imports_t&, DelayImport*>

Iterator that outputs DelayImport&.

using it_const_delay_imports = const_ref_iterator<const delay_imports_t&, const DelayImport*>

Iterator that outputs const DelayImport&.

using debug_entries_t = std::vector<std::unique_ptr<Debug>>

Internal container for storing Debug information.

using it_debug_entries = ref_iterator<debug_entries_t&, Debug*>

Iterator that outputs Debug&.

using it_const_debug_entries = const_ref_iterator<const debug_entries_t&, const Debug*>

Iterator that outputs const Debug&.

using symbols_t = std::vector<std::unique_ptr<COFF::Symbol>>

Internal container for storing COFF Symbols.

using it_symbols = ref_iterator<symbols_t&, COFF::Symbol*>

Iterator that outputs Symbol&.

using it_const_symbols = const_ref_iterator<const symbols_t&, const COFF::Symbol*>

Iterator that outputs const Symbol&.

using strings_table_t = std::vector<COFF::String>

Internal container for storing strings.

using it_strings_table = ref_iterator<strings_table_t&>

Iterator that outputs COFF::String&.

using it_const_strings_table = const_ref_iterator<const strings_table_t&>

Iterator that outputs const COFF::String&.

using signatures_t = std::vector<Signature>

Internal container for storing PE’s authenticode Signature.

using it_signatures = ref_iterator<signatures_t&>

Iterator that outputs Signature&.

using it_const_signatures = const_ref_iterator<const signatures_t&>

Iterator that outputs const Signature&.

using exceptions_t = std::vector<std::unique_ptr<ExceptionInfo>>

Internal container for storing runtime function associated with exceptions.

using it_exceptions = ref_iterator<exceptions_t&, ExceptionInfo*>

Iterator that outputs ExceptionInfo&.

using it_const_exceptions = const_ref_iterator<const exceptions_t&, const ExceptionInfo*>

Iterator that outputs const ExceptionInfo&.

Public Functions

Binary()
~Binary() override
inline PE_TYPE type() const

Return PE32 or PE32+.

uint64_t rva_to_offset(uint64_t RVA) const

Convert a Relative Virtual Address into an offset.

The conversion is performed by looking for the section that encompasses the provided RVA.

inline uint64_t va_to_offset(uint64_t VA) const

Convert the absolute virtual address into an offset.

See also

rva_to_offset

virtual result<uint64_t> offset_to_virtual_address(uint64_t offset, uint64_t slide = 0) const override

Convert the given offset into an absolute virtual address.

Parameters:

  • offset – [in] The offset to convert.

  • slide – [in] If not 0, it will replace the default base address (if any)

uint64_t offset_to_rva(uint64_t offset) const

Convert the given offset into a relative virtual address (RVA).

inline virtual uint64_t imagebase() const override

Return binary’s imagebase. 0 if not relevant.

The value is the same as those returned by OptionalHeader::imagebase

inline Section *section_from_offset(uint64_t offset)

Find the section that encompasses the given offset.

If no section can be found, return a nullptr

const Section *section_from_offset(uint64_t offset) const
inline Section *section_from_rva(uint64_t virtual_address)

Find the section that encompasses the given RVA.

If no section can be found, return a nullptr

const Section *section_from_rva(uint64_t virtual_address) const
inline it_sections sections()

Return an iterator over the PE’s Section.

inline it_const_sections sections() const
inline DosHeader &dos_header()

Return a reference to the PE::DosHeader object.

inline const DosHeader &dos_header() const
inline Header &header()

Return a reference to the PE::Header object.

inline const Header &header() const
inline OptionalHeader &optional_header()

Header that follows the header(). It is named optional from the COFF specification but it is mandatory in a PE file.

inline const OptionalHeader &optional_header() const
uint32_t compute_checksum() const

Re-compute the value of OptionalHeader::checksum. If both values do not match, it could mean that the binary has been modified after the compilation.

This value is computed by LIEF for the current binary object.

virtual uint64_t virtual_size() const override

Compute the binary’s virtual size. It should match OptionalHeader::sizeof_image.

uint32_t sizeof_headers() const

Compute the size of all the headers.

inline TLS *tls()

Return a reference to the TLS object.

inline const TLS *tls() const
TLS &tls(const TLS &tls)

Set a TLS object in the current Binary.

inline bool has_tls() const

Check if the current binary has a TLS object.

void remove_tls()

Remove the TLS from the binary.

inline bool has_imports() const

Check if the current binary contains imports.

See also

Import

inline bool has_signatures() const

Check if the current binary contains signatures.

See also

signatures

inline bool has_exports() const

Check if the current binary has exports.

See also

Export

inline bool has_resources() const

Check if the current binary has resources.

inline bool has_exceptions() const

Check if the current binary has exceptions.

inline bool has_relocations() const

Check if the current binary has relocations.

See also

Relocation

inline bool has_debug() const

Check if the current binary contains debug information.

inline bool has_configuration() const

Check if the current binary has a load configuration.

bool is_reproducible_build() const

Check if the current binary is reproducible build, replacing timestamps by a compile hash.

See also

Repro

inline it_const_signatures signatures() const

Return an iterator over the Signature object(s) if the binary is signed.

inline it_signatures signatures()
Signature::VERIFICATION_FLAGS verify_signature(Signature::VERIFICATION_CHECKS checks = Signature::VERIFICATION_CHECKS::DEFAULT) const

Verify the binary against the embedded signature(s) (if any) First, it checks that the embedded signatures are correct (c.f. Signature::check) and then, it checks that the authentihash matches ContentInfo::digest.

One can tweak the verification process with the Signature::VERIFICATION_CHECKS flags

See also

LIEF::PE::Signature::check

Signature::VERIFICATION_FLAGS verify_signature(const Signature &sig, Signature::VERIFICATION_CHECKS checks = Signature::VERIFICATION_CHECKS::DEFAULT) const

Verify the binary with the Signature object provided in the first parameter. It can be used to verify a detached signature:

result<Signature> detached = LIEF::PE::SignatureParser::parse("sig.pkcs7")
if (detached) {
  binary->verify_signature(detached.value());
}
std::vector<uint8_t> authentihash(ALGORITHMS algo) const

Compute the authentihash according to the algorithm provided in the first parameter.

inline Export *get_export()

Return the Export object.

inline const Export *get_export() const
Export &set_export(const Export &export_table)
inline it_symbols symbols()

Return binary Symbols.

inline it_const_symbols symbols() const
inline it_const_strings_table coff_string_table() const

Iterator over the strings located in the COFF string table.

inline it_strings_table coff_string_table()
inline COFF::String *find_coff_string(uint32_t offset)

Try to find the COFF string at the given offset in the COFF string table.

Warning

This offset must include the first 4 bytes holding the size of the table. Hence, the first string starts at the offset 4.

inline const COFF::String *find_coff_string(uint32_t offset) const
inline ResourceNode *resources()

Return resources as a tree or a nullptr if there is no resources.

inline const ResourceNode *resources() const
ResourceNode *set_resources(const ResourceNode &root)

Change or set the current resource tree with the new one provided in parameter.

ResourceNode *set_resources(std::unique_ptr<ResourceNode> root)
result<ResourcesManager> resources_manager() const

Return the ResourcesManager (class to manage resources more easily than the tree one).

inline Section *get_section(const std::string &name)

Return binary’s section from its name. If the section can’t be found, return a nullptr.

Parameters:

name – [in] Name of the Section

const Section *get_section(const std::string &name) const
const Section *import_section() const

Return the section associated with import table or a nullptr if the binary does not have an import table.

inline Section *import_section()
virtual void remove_section(const std::string &name, bool clear = false) override

Delete the section with the given name.

Parameters:

  • name – [in] Name of section to delete

  • clear – [in] if true clear the section’s content with 0 before removing (default: false)

void remove(const Section &section, bool clear = false)

Remove the given section.

See also

remove_section

Section *add_section(const Section &section)

Add a section to the binary and return the section added.

inline it_relocations relocations()

Return an iterator over the PE’s Relocation.

inline it_const_relocations relocations() const
Relocation &add_relocation(const Relocation &relocation)

Add a new PE Relocation.

void remove_all_relocations()

Remove all the relocations.

inline it_data_directories data_directories()

Return an iterator over the DataDirectory present in the Binary.

inline it_const_data_directories data_directories() const
inline DataDirectory *data_directory(DataDirectory::TYPES type)

Return the DataDirectory with the given type (or index).

const DataDirectory *data_directory(DataDirectory::TYPES type) const
inline bool has(DataDirectory::TYPES type) const

Check if the current binary has the given DataDirectory::TYPES.

inline it_debug_entries debug()

Return an iterator over the Debug entries.

inline it_const_debug_entries debug() const
Debug *add_debug_info(const Debug &entry)

Add a new debug entry.

bool remove_debug(const Debug &entry)

Remove a specific debug entry.

bool clear_debug()

Remove all debug info from the binary.

const CodeViewPDB *codeview_pdb() const

Return the CodeViewPDB object if present.

inline CodeViewPDB *codeview_pdb()
inline const LoadConfiguration *load_configuration() const

Return the LoadConfiguration object or a nullptr if the binary does not use the LoadConfiguration.

inline LoadConfiguration *load_configuration()
inline span<const uint8_t> overlay() const

Return the overlay content.

inline span<uint8_t> overlay()
inline uint64_t overlay_offset() const

Return the original overlay offset.

inline span<const uint8_t> dos_stub() const

Return the DOS stub content.

inline span<uint8_t> dos_stub()
inline void dos_stub(std::vector<uint8_t> content)

Update the DOS stub content.

inline RichHeader *rich_header()

Return a reference to the RichHeader object.

inline const RichHeader *rich_header() const
void rich_header(const RichHeader &rich_header)

Set a RichHeader object in the current Binary.

inline bool has_rich_header() const

Check if the current binary has a RichHeader object.

inline it_imports imports()

Return an iterator over the binary imports.

inline it_const_imports imports() const
inline Import *get_import(const std::string &import_name)

Return the Import matching the provided name (case sensitive).

If the import can’t be found, it returns a nullptr

const Import *get_import(const std::string &import_name) const
inline bool has_import(const std::string &import_name) const

True if the binary imports the given library name

inline bool has_delay_imports() const

Check if the current binary contains delay imports.

inline it_delay_imports delay_imports()

Return an iterator over the binary’s delay imports.

inline it_const_delay_imports delay_imports() const
inline DelayImport *get_delay_import(const std::string &import_name)

Returns the DelayImport matching the given name. If it can’t be found, it returns a nullptr.

const DelayImport *get_delay_import(const std::string &import_name) const
inline bool has_delay_import(const std::string &import_name) const

True if the binary delay-imports the given library name

inline Import &add_import(const std::string &name, int32_t pos = -1)

Add an imported library (i.e. DLL) to the binary.

The second parameter pos defines where to insert the import. If negative (default), the import is appended to the end of the list.

bool remove_import(const std::string &name)

Remove the imported library with the given name.

Return true if the deletion succeeded, false otherwise.

inline void remove_all_imports()

Remove all libraries in the binary.

inline std::unique_ptr<Builder> write(const std::string &filename)

Reconstruct the binary object and write the raw PE in filename.

std::unique_ptr<Builder> write(const std::string &filename, const Builder::config_t &config)

Reconstruct the binary object with the given configuration and write it in filename.

inline std::unique_ptr<Builder> write(std::ostream &os)

Reconstruct the binary object and write the raw PE in os stream.

Rebuild a PE binary from the current Binary object. When rebuilding, import table and relocations are not rebuilt.

std::unique_ptr<Builder> write(std::ostream &os, const Builder::config_t &config)
virtual void accept(Visitor &visitor) const override

Method so that a visitor can visit us.

virtual void patch_address(uint64_t address, const std::vector<uint8_t> &patch_value, VA_TYPES addr_type = VA_TYPES::AUTO) override

Patch the content at virtual address address with patch_value.

Parameters:

  • address – [in] Address to patch

  • patch_value – [in] Patch to apply

  • addr_type – [in] Type of the Virtual address: VA or RVA. Default: Auto

virtual void patch_address(uint64_t address, uint64_t patch_value, size_t size = sizeof(uint64_t), VA_TYPES addr_type = VA_TYPES::AUTO) override

Patch the address with the given value.

Parameters:

  • address – [in] Address to patch

  • patch_value – [in] Patch to apply

  • size – [in] Size of the value in bytes (1, 2, … 8)

  • addr_type – [in] Type of the Virtual address: VA or RVA. Default: Auto

void fill_address(uint64_t address, size_t size, uint8_t value = 0, VA_TYPES addr_type = VA_TYPES::AUTO)

Fill the content at the provided address with a fixed value.

virtual span<const uint8_t> get_content_from_virtual_address(uint64_t virtual_address, uint64_t size, Binary::VA_TYPES addr_type = Binary::VA_TYPES::AUTO) const override

Return the content located at the provided virtual address.

Parameters:

  • virtual_address – [in] Virtual address of the data to retrieve

  • size – [in] Size in bytes of the data to retrieve

  • addr_type – [in] Type of the Virtual address: VA or RVA. Default: Auto

inline virtual uint64_t entrypoint() const override

Return the binary’s entrypoint (it is the same value as OptionalHeader::addressof_entrypoint).

inline virtual bool is_pie() const override

Check if the binary is position independent.

inline virtual bool has_nx() const override

Check if the binary uses NX protection.

uint64_t last_section_offset() const
inline DataDirectory *export_dir()

Return the data directory associated with the export table.

inline const DataDirectory *export_dir() const
inline DataDirectory *import_dir()

Return the data directory associated with the import table.

inline const DataDirectory *import_dir() const
inline DataDirectory *rsrc_dir()

Return the data directory associated with the resources tree.

inline const DataDirectory *rsrc_dir() const
inline DataDirectory *exceptions_dir()

Return the data directory associated with the exceptions.

inline const DataDirectory *exceptions_dir() const
inline DataDirectory *cert_dir()

Return the data directory associated with the certificate table (authenticode).

inline const DataDirectory *cert_dir() const
inline DataDirectory *relocation_dir()

Return the data directory associated with the relocation table.

inline const DataDirectory *relocation_dir() const
inline DataDirectory *debug_dir()

Return the data directory associated with the debug table.

inline const DataDirectory *debug_dir() const
inline DataDirectory *tls_dir()

Return the data directory associated with TLS.

inline const DataDirectory *tls_dir() const
inline DataDirectory *load_config_dir()

Return the data directory associated with the load config.

inline const DataDirectory *load_config_dir() const
inline DataDirectory *iat_dir()

Return the data directory associated with the IAT.

inline const DataDirectory *iat_dir() const
inline DataDirectory *delay_dir()

Return the data directory associated with delayed imports.

inline const DataDirectory *delay_dir() const
virtual LIEF::Binary::functions_t ctor_functions() const override

Return the list of the binary constructors.

In a PE file, we consider a constructors as a callback in the TLS object

LIEF::Binary::functions_t functions() const

All functions found in the binary

LIEF::Binary::functions_t exception_functions() const

Functions found in the Exception table directory.

inline it_exceptions exceptions()

Iterator over the exception (_RUNTIME_FUNCTION) functions.

Warning

This function requires that the option LIEF::PE::ParserConfig::parse_exceptions was turned on (default is false) when parsing the binary

inline it_const_exceptions exceptions() const
ExceptionInfo *find_exception_at(uint32_t rva)

Try to find the exception info at the given RVA.

Warning

This function requires that the option LIEF::PE::ParserConfig::parse_exceptions was turned on (default is false) when parsing the binary

inline const ExceptionInfo *find_exception_at(uint32_t rva) const
bool is_arm64ec() const

True if this binary is compiled in ARM64EC mode (emulation compatible).

bool is_arm64x() const

True if this binary is compiled in ARM64X mode (contains both ARM64 and ARM64EC code).

inline const Binary *nested_pe_binary() const

If the current binary contains dynamic relocations (e.g. LIEF::PE::DynamicFixupARM64X), this function returns the relocated view of the current PE.

This can be used to get the alternative PE binary, targeting a different architectures.

Warning

This function requires that the option LIEF::PE::ParserConfig::parse_arm64x_binary was turned on (default is false) when parsing the binary

inline Binary *nested_pe_binary()
virtual result<uint64_t> get_function_address(const std::string &name) const override

Attempt to resolve the address of the function specified by name.

virtual std::ostream &print(std::ostream &os) const override

Public Static Functions

static inline bool classof(const LIEF::Binary *bin)

Dos Header

class DosHeader : public LIEF::Object

Class which represents the DosHeader, the first structure present at the beginning of a PE file.

Most of the attributes of this structures are no longer relevant.

Public Types

using reserved_t = std::array<uint16_t, 4>
using reserved2_t = std::array<uint16_t, 10>

Public Functions

DosHeader(const details::pe_dos_header &header)
DosHeader(const DosHeader&) = default
DosHeader &operator=(const DosHeader&) = default
DosHeader(DosHeader&&) = default
DosHeader &operator=(DosHeader&&) = default
~DosHeader() override = default
inline uint16_t magic() const

Magic bytes identifying a DOS/PE binary.

inline uint16_t used_bytes_in_last_page() const
inline uint16_t file_size_in_pages() const
inline uint16_t numberof_relocation() const
inline uint16_t header_size_in_paragraphs() const
inline uint16_t minimum_extra_paragraphs() const
inline uint16_t maximum_extra_paragraphs() const
inline uint16_t initial_relative_ss() const
inline uint16_t initial_sp() const
inline uint16_t checksum() const
inline uint16_t initial_ip() const
inline uint16_t initial_relative_cs() const
inline uint16_t addressof_relocation_table() const
inline uint16_t overlay_number() const
inline const reserved_t &reserved() const
inline uint16_t oem_id() const
inline uint16_t oem_info() const
inline const reserved2_t &reserved2() const
inline uint32_t addressof_new_exeheader() const

Return the offset to the PE::Header structure.

inline void magic(uint16_t magic)
inline void used_bytes_in_last_page(uint16_t value)
inline void file_size_in_pages(uint16_t value)
inline void numberof_relocation(uint16_t value)
inline void header_size_in_paragraphs(uint16_t value)
inline void minimum_extra_paragraphs(uint16_t value)
inline void maximum_extra_paragraphs(uint16_t value)
inline void initial_relative_ss(uint16_t value)
inline void initial_sp(uint16_t value)
inline void checksum(uint16_t value)
inline void initial_ip(uint16_t value)
inline void initial_relative_cs(uint16_t value)
inline void addressof_relocation_table(uint16_t value)
inline void overlay_number(uint16_t value)
inline void reserved(const reserved_t &reserved)
inline void oem_id(uint16_t value)
inline void oem_info(uint16_t value)
inline void reserved2(const reserved2_t &reserved2)
inline void addressof_new_exeheader(uint32_t value)
virtual void accept(Visitor &visitor) const override

Public Static Functions

static DosHeader create(PE_TYPE type)

Public Static Attributes

static uint16_t MAGIC = 0x5a4d

Friends

friend std::ostream &operator<<(std::ostream &os, const DosHeader &entry)

Optional Header

class OptionalHeader : public LIEF::Object

Class which represents the PE OptionalHeader structure.

Note that the term optional comes from the COFF specifications but this header is mandatory for a PE binary.

Public Types

enum class DLL_CHARACTERISTICS : size_t

Values:

enumerator HIGH_ENTROPY_VA = 0x0020

ASLR with 64 bit address space.

enumerator DYNAMIC_BASE = 0x0040

DLL can be relocated at load time.

enumerator FORCE_INTEGRITY = 0x0080

Code integrity checks are enforced.

enumerator NX_COMPAT = 0x0100

Image is NX compatible.

enumerator NO_ISOLATION = 0x0200

Isolation aware, but do not isolate the image.

enumerator NO_SEH = 0x0400

Does not use structured exception handling (SEH). No SEH handler may be called in this image.

enumerator NO_BIND = 0x0800

Do not bind the image.

enumerator APPCONTAINER = 0x1000

Image should execute in an AppContainer.

enumerator WDM_DRIVER = 0x2000

A WDM driver.

enumerator GUARD_CF = 0x4000

Image supports Control Flow Guard.

enumerator TERMINAL_SERVER_AWARE = 0x8000

Terminal Server aware.

enum class SUBSYSTEM : size_t

Values:

enumerator UNKNOWN = 0

An unknown subsystem.

enumerator NATIVE = 1

Device drivers and native Windows processes.

enumerator WINDOWS_GUI = 2

The Windows GUI subsystem.

enumerator WINDOWS_CUI = 3

The Windows character subsystem.

enumerator OS2_CUI = 5

The OS/2 character subsystem.

enumerator POSIX_CUI = 7

The POSIX character subsystem.

enumerator NATIVE_WINDOWS = 8

Native Windows 9x driver.

enumerator WINDOWS_CE_GUI = 9

Windows CE.

enumerator EFI_APPLICATION = 10

An EFI application.

enumerator EFI_BOOT_SERVICE_DRIVER = 11

An EFI driver with boot services.

enumerator EFI_RUNTIME_DRIVER = 12

An EFI driver with run-time services.

enumerator EFI_ROM = 13

An EFI ROM image.

enumerator XBOX = 14

XBOX.

enumerator WINDOWS_BOOT_APPLICATION = 16

A BCD application.

enumerator XBOX_CODE_CATALOG = 17

Security Metadata Containers.

Public Functions

OptionalHeader(const details::pe32_optional_header &header)
OptionalHeader(const details::pe64_optional_header &header)
~OptionalHeader() override = default
OptionalHeader &operator=(const OptionalHeader&) = default
OptionalHeader(const OptionalHeader&) = default
inline PE_TYPE magic() const

Magic bytes: either PE32 or PE32+ for 64-bits PE files.

inline uint8_t major_linker_version() const

The linker major version.

inline uint8_t minor_linker_version() const

The linker minor version.

inline uint32_t sizeof_code() const

The size of the code .text section or the sum of all the sections that contain code (i.e. PE::Section with the flag Section::CHARACTERISTICS::CNT_CODE).

inline uint32_t sizeof_initialized_data() const

The size of the initialized data which are usually located in the .data section. If the initialized data are split across multiple sections, it is the sum of the sections.

The sections associated with the initialized data are usually identified with the flag Section::CHARACTERISTICS::CNT_INITIALIZED_DATA

inline uint32_t sizeof_uninitialized_data() const

The size of the uninitialized data which are usually located in the .bss section. If the uninitialized data are split across multiple sections, it is the sum of the sections.

The sections associated with the uninitialized data are usually identified with the flag Section::CHARACTERISTICS::CNT_UNINITIALIZED_DATA

inline uint32_t addressof_entrypoint() const

The address of the entry point relative to the image base when the executable file is loaded into memory. For program images, this is the starting address. For device drivers, this is the address of the initialization function.

An entry point is optional for DLLs. When no entry point is present, this field must be zero.

inline uint32_t baseof_code() const

Address relative to the imagebase where the binary’s code starts.

inline uint32_t baseof_data() const

Address relative to the imagebase where the binary’s data starts.

Warning

This value is not present for PE64 files

inline uint64_t imagebase() const

The preferred base address when mapping the binary in memory.

inline uint32_t section_alignment() const

The alignment (in bytes) of sections when they are loaded into memory.

It must be greater than or equal to file_alignment and the default is the page size for the architecture.

inline uint32_t file_alignment() const

The section’s file alignment. This value must be a power of 2 between 512 and 64K. The default value is usually 512.

inline uint16_t major_operating_system_version() const

The major version number of the required operating system.

inline uint16_t minor_operating_system_version() const

The minor version number of the required operating system.

inline uint16_t major_image_version() const

The major version number of the image.

inline uint16_t minor_image_version() const

The minor version number of the image.

inline uint16_t major_subsystem_version() const

The major version number of the subsystem.

inline uint16_t minor_subsystem_version() const

The minor version number of the subsystem.

inline uint32_t win32_version_value() const

According to the official PE specifications, this value is reserved and should be 0.

inline uint32_t sizeof_image() const

The size (in bytes) of the image, including all headers, as the image is loaded in memory.

It must be a multiple of section_alignment and should match Binary::virtual_size

inline uint32_t sizeof_headers() const

Size of the DosHeader + PE Header + Section headers rounded up to a multiple of the file_alignment.

inline uint32_t checksum() const

The image file checksum. The algorithm for computing the checksum is incorporated into IMAGHELP.DLL.

The following are checked for validation at load time all drivers, any DLL loaded at boot time, and any DLL that is loaded into a critical Windows process.

inline SUBSYSTEM subsystem() const

Target subsystem like Driver, XBox, Windows GUI, …

inline uint32_t dll_characteristics() const

Some characteristics of the underlying binary like the support of the PIE. The prefix dll comes from the official PE specifications but these characteristics are also used for executables.

inline uint64_t sizeof_stack_reserve() const

Size of the stack to reserve when loading the PE binary.

Only OptionalHeader::sizeof_stack_commit is committed, the rest is made available one page at a time until the reserve size is reached.

inline uint64_t sizeof_stack_commit() const

Size of the stack to commit.

inline uint64_t sizeof_heap_reserve() const

Size of the heap to reserve when loading the PE binary.

inline uint64_t sizeof_heap_commit() const

Size of the heap to commit.

inline uint32_t loader_flags() const

According to the PE specifications, this value is reserved and should be 0.

inline uint32_t numberof_rva_and_size() const

The number of DataDirectory that follow this header.

inline bool has(DLL_CHARACTERISTICS c) const

Check if the given DLL_CHARACTERISTICS is included in the dll_characteristics.

std::vector<DLL_CHARACTERISTICS> dll_characteristics_list() const

Return the list of the dll_characteristics as an std::set of DLL_CHARACTERISTICS.

inline void add(DLL_CHARACTERISTICS c)

Add a DLL_CHARACTERISTICS to the current characteristics.

inline void remove(DLL_CHARACTERISTICS c)

Remove a DLL_CHARACTERISTICS from the current characteristics.

inline void magic(PE_TYPE magic)
inline void major_linker_version(uint8_t value)
inline void minor_linker_version(uint8_t value)
inline void sizeof_code(uint32_t value)
inline void sizeof_initialized_data(uint32_t value)
inline void sizeof_uninitialized_data(uint32_t value)
inline void addressof_entrypoint(uint32_t value)
inline void baseof_code(uint32_t value)
inline void baseof_data(uint32_t value)
inline void imagebase(uint64_t value)
inline void section_alignment(uint32_t value)
inline void file_alignment(uint32_t value)
inline void major_operating_system_version(uint16_t value)
inline void minor_operating_system_version(uint16_t value)
inline void major_image_version(uint16_t value)
inline void minor_image_version(uint16_t value)
inline void major_subsystem_version(uint16_t value)
inline void minor_subsystem_version(uint16_t value)
inline void win32_version_value(uint32_t value)
inline void sizeof_image(uint32_t value)
inline void sizeof_headers(uint32_t value)
inline void checksum(uint32_t value)
inline void subsystem(SUBSYSTEM value)
inline void dll_characteristics(uint32_t value)
inline void sizeof_stack_reserve(uint64_t value)
inline void sizeof_stack_commit(uint64_t value)
inline void sizeof_heap_reserve(uint64_t value)
inline void sizeof_heap_commit(uint64_t value)
inline void loader_flags(uint32_t value)
inline void numberof_rva_and_size(uint32_t value)
virtual void accept(Visitor &visitor) const override
inline OptionalHeader &operator+=(DLL_CHARACTERISTICS c)
inline OptionalHeader &operator-=(DLL_CHARACTERISTICS c)

Public Static Functions

static OptionalHeader create(PE_TYPE type)

Friends

friend std::ostream &operator<<(std::ostream &os, const OptionalHeader &entry)

Data Directory

class DataDirectory : public LIEF::Object

Class that represents a PE data directory entry.

Public Types

enum class TYPES : uint32_t

Values:

enumerator EXPORT_TABLE = 0
enumerator IMPORT_TABLE
enumerator RESOURCE_TABLE
enumerator EXCEPTION_TABLE
enumerator CERTIFICATE_TABLE
enumerator BASE_RELOCATION_TABLE
enumerator DEBUG_DIR
enumerator ARCHITECTURE
enumerator GLOBAL_PTR
enumerator TLS_TABLE
enumerator LOAD_CONFIG_TABLE
enumerator BOUND_IMPORT
enumerator IAT
enumerator DELAY_IMPORT_DESCRIPTOR
enumerator CLR_RUNTIME_HEADER
enumerator RESERVED
enumerator UNKNOWN

Public Functions

DataDirectory() = default
inline DataDirectory(TYPES type)
DataDirectory(const details::pe_data_directory &header, TYPES type)
DataDirectory(const DataDirectory &other) = default
DataDirectory &operator=(const DataDirectory &other) = default
DataDirectory(DataDirectory &&other) noexcept = default
DataDirectory &operator=(DataDirectory &&other) noexcept = default
~DataDirectory() override = default
inline uint32_t RVA() const

The relative virtual address of the content of this data directory.

inline uint32_t size() const

The size of the content.

inline bool has_section() const

Check if the content of this data directory is associated with a PE Section.

inline span<const uint8_t> content() const

Raw content (bytes) referenced by this data directory.

span<uint8_t> content()
inline Section *section()

Section associated with the DataDirectory.

inline const Section *section() const
inline TYPES type() const

Type of the data directory.

inline void size(uint32_t size)
inline void RVA(uint32_t rva)
virtual void accept(Visitor &visitor) const override

Public Static Attributes

static size_t DEFAULT_NB = 16

Friends

friend std::ostream &operator<<(std::ostream &os, const DataDirectory &entry)

Section

class Section : public LIEF::Section

Class which represents a PE section.

Public Types

enum class CHARACTERISTICS : uint64_t

Values:

enumerator TYPE_NO_PAD = 0x00000008
enumerator CNT_CODE = 0x00000020
enumerator CNT_INITIALIZED_DATA = 0x00000040
enumerator CNT_UNINITIALIZED_DATA = 0x00000080
enumerator LNK_OTHER = 0x00000100
enumerator LNK_INFO = 0x00000200
enumerator LNK_REMOVE = 0x00000800
enumerator LNK_COMDAT = 0x00001000
enumerator GPREL = 0x00008000
enumerator MEM_PURGEABLE = 0x00010000
enumerator MEM_16BIT = 0x00020000
enumerator MEM_LOCKED = 0x00040000
enumerator MEM_PRELOAD = 0x00080000
enumerator ALIGN_1BYTES = 0x00100000
enumerator ALIGN_2BYTES = 0x00200000
enumerator ALIGN_4BYTES = 0x00300000
enumerator ALIGN_8BYTES = 0x00400000
enumerator ALIGN_16BYTES = 0x00500000
enumerator ALIGN_32BYTES = 0x00600000
enumerator ALIGN_64BYTES = 0x00700000
enumerator ALIGN_128BYTES = 0x00800000
enumerator ALIGN_256BYTES = 0x00900000
enumerator ALIGN_512BYTES = 0x00A00000
enumerator ALIGN_1024BYTES = 0x00B00000
enumerator ALIGN_2048BYTES = 0x00C00000
enumerator ALIGN_4096BYTES = 0x00D00000
enumerator ALIGN_8192BYTES = 0x00E00000
enumerator LNK_NRELOC_OVFL = 0x01000000
enumerator MEM_DISCARDABLE = 0x02000000
enumerator MEM_NOT_CACHED = 0x04000000
enumerator MEM_NOT_PAGED = 0x08000000
enumerator MEM_SHARED = 0x10000000
enumerator MEM_EXECUTE = 0x20000000
enumerator MEM_READ = 0x40000000
enumerator MEM_WRITE = 0x80000000

Public Functions

Section(const details::pe_section &header)
Section() = default
inline Section(std::string name)
inline Section(std::string name, std::vector<uint8_t> content)
Section &operator=(const Section&) = default
Section(const Section&) = default
~Section() override = default
uint32_t sizeof_raw_data() const

Return the size of the data in the section.

inline uint32_t virtual_size() const

Return the size of the data when mapped in memory.

If this value is greater than sizeof_raw_data, the section is zero-padded.

inline virtual span<const uint8_t> content() const override

The actual content of the section.

inline span<const uint8_t> padding() const

Content of the section’s padding area.

uint32_t pointerto_raw_data() const

The offset of the section data in the PE file.

inline uint32_t pointerto_relocation() const

The file pointer to the beginning of the COFF relocation entries for the section. This is set to zero for executable images or if there are no relocations.

For modern PE binaries, this value is usually set to 0 as the relocations are managed by PE::Relocation.

inline uint32_t pointerto_line_numbers() const

The file pointer to the beginning of line-number entries for the section. This is set to zero if there are no COFF line numbers. This value should be zero for an image because COFF debugging information is deprecated and modern debug information relies on the PDB files.

inline uint16_t numberof_relocations() const

No longer used in recent PE binaries produced by Visual Studio.

inline uint16_t numberof_line_numbers() const

No longer used in recent PE binaries produced by Visual Studio.

inline uint32_t characteristics() const

Characteristics of the section: it provides information about the permissions of the section when mapped. It can also provide information about the purpose of the section (contain code, BSS-like, …).

inline bool has_characteristic(CHARACTERISTICS c) const

Check if the section has the given CHARACTERISTICS.

inline std::vector<CHARACTERISTICS> characteristics_list() const

List of the section characteristics.

inline bool is_discardable() const

True if the section can be discarded as needed.

This is typically the case for debug-related sections

void clear(uint8_t c)

Fill the content of the section with the given char.

virtual void content(const std::vector<uint8_t> &data) override

Change section content.

virtual void name(std::string name) override

Change the section’s name.

inline void virtual_size(uint32_t virtual_sz)
inline void pointerto_raw_data(uint32_t ptr)
inline void pointerto_relocation(uint32_t ptr)
inline void pointerto_line_numbers(uint32_t ptr)
inline void numberof_relocations(uint16_t nb)
inline void numberof_line_numbers(uint16_t nb)
inline void sizeof_raw_data(uint32_t size)
inline void characteristics(uint32_t characteristics)
inline COFF::String *coff_string()

Return the COFF string associated with the section’s name (or a nullptr).

This coff string is usually present for long section names whose length does not fit in the 8 bytes allocated by the PE format.

inline const COFF::String *coff_string() const
inline Section &remove_characteristic(CHARACTERISTICS characteristic)
inline Section &add_characteristic(CHARACTERISTICS characteristic)
std::unique_ptr<SpanStream> stream() const
inline span<uint8_t> writable_content()
virtual void accept(Visitor &visitor) const override
inline virtual std::string_view name() const

Section’s name.

Public Static Functions

static std::vector<CHARACTERISTICS> characteristics_to_list(uint32_t value)

Public Static Attributes

static size_t MAX_SECTION_NAME = 8

Friends

friend std::ostream &operator<<(std::ostream &os, const Section &section)

Import

class Import : public LIEF::Object

Class that represents a PE import.

Public Types

using entries_t = std::vector<std::unique_ptr<ImportEntry>>
using it_entries = ref_iterator<entries_t&, ImportEntry*>
using it_const_entries = const_ref_iterator<const entries_t&, const ImportEntry*>

Public Functions

Import(const details::pe_import &import)
inline Import(std::string name)
Import() = default
~Import() override = default
Import(const Import &other)
Import &operator=(const Import &other)
Import(Import &&other) noexcept = default
Import &operator=(Import &&other) noexcept = default
inline uint32_t forwarder_chain() const

The index of the first forwarder reference.

inline uint32_t timedatestamp() const

The stamp that is set to zero until the image is bound. After the image is bound, this field is set to the time/data stamp of the DLL.

inline it_const_entries entries() const

Iterator over the PE::ImportEntry.

inline it_entries entries()
inline uint32_t import_address_table_rva() const

The RVA of the import address table (IAT). The content of this table is identical to the content of the Import Lookup Table (ILT) until the image is bound.

Warning

This address could change when re-building the binary

inline uint32_t import_lookup_table_rva() const

Return the relative virtual address of the import lookup table.

Warning

This address could change when re-building the binary

result<uint32_t> get_function_rva_from_iat(const std::string &function) const

Return the Function’s RVA from the import address table (IAT).

Warning

This address could change when re-building the binary

inline ImportEntry *get_entry(const std::string &name)

Return the imported function with the given name.

const ImportEntry *get_entry(const std::string &name) const
inline std::string_view name() const

Return the library’s name (e.g. kernel32.dll).

inline void name(std::string name)

Change the current import name.

inline uint32_t name_rva() const

The original name rva.

inline DataDirectory *directory()

Return the PE::DataDirectory associated with this import. It should be the one at index PE::DataDirectory::TYPES::IMPORT_TABLE.

If the data directory can’t be found, return a nullptr

inline const DataDirectory *directory() const
inline DataDirectory *iat_directory()

Return the PE::DataDirectory associated with the IAT. It should be the one at index PE::DataDirectory::TYPES::IAT.

If the data directory can’t be found, return a nullptr

inline const DataDirectory *iat_directory() const
inline ImportEntry &add_entry(const ImportEntry &entry)

Add a new import entry (i.e. an imported function).

inline ImportEntry &add_entry(const std::string &name)

Add a new import entry with the given name (i.e. an imported function).

bool remove_entry(const std::string &name)

Remove the import entry with the given name.

Return true if the deletion succeeded, false otherwise

bool remove_entry(uint32_t ordinal)

Remove the import entry with the given ordinal number.

Return true if the deletion succeeded, false otherwise

inline void import_lookup_table_rva(uint32_t rva)
inline void import_address_table_rva(uint32_t rva)
virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const Import &entry)

Import Entry

class ImportEntry : public LIEF::Symbol

Class that represents an entry (i.e. an import) in the import table (Import).

It extends the LIEF::Symbol generic class that exposes the LIEF::Symbol::name and LIEF::Symbol::value API

Public Functions

ImportEntry() = default
inline ImportEntry(uint64_t data, PE_TYPE type)
inline ImportEntry(std::string name)
ImportEntry(const ImportEntry&) = default
ImportEntry &operator=(const ImportEntry&) = default
~ImportEntry() override = default
std::string demangled_name() const

Demangled representation of the symbol or an empty string if it can’t be demangled.

bool is_ordinal() const

True if it is an import by ordinal

inline uint16_t ordinal() const

The ordinal value.

inline uint64_t hint_name_rva() const

See also

ImportEntry::data

inline uint16_t hint() const

Index into the Export::entries that is used to speed-up the symbol resolution.

inline uint64_t iat_value() const

Value of the current entry in the Import Address Table. It should match the lookup table value.

inline void iat_value(uint64_t value)
inline uint64_t ilt_value() const

Original value in the import lookup table. This value should match the iat_value().

inline void ilt_value(uint64_t value)
inline uint64_t data() const

Raw value.

inline uint64_t iat_address() const

Original address of the entry in the Import Address Table

inline void data(uint64_t data)
virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const ImportEntry &entry)

Delay Import

class DelayImport : public LIEF::Object

Class that represents a PE delayed import.

Public Types

using entries_t = std::vector<std::unique_ptr<DelayImportEntry>>
using it_entries = ref_iterator<entries_t&, DelayImportEntry*>
using it_const_entries = const_ref_iterator<const entries_t&, const DelayImportEntry*>

Public Functions

DelayImport() = default
DelayImport(const details::delay_imports &import, PE_TYPE type)
inline DelayImport(std::string name)
~DelayImport() override = default
DelayImport(const DelayImport &other)
inline DelayImport &operator=(DelayImport other)
DelayImport(DelayImport&&) noexcept = default
DelayImport &operator=(DelayImport&&) noexcept = default
void swap(DelayImport &other)
inline uint32_t attribute() const

According to the official PE specifications, this value is reserved and should be set to 0.

inline void attribute(uint32_t hdl)
inline std::string_view name() const

Return the library’s name (e.g. kernel32.dll).

inline void name(std::string name)
inline uint32_t handle() const

The RVA of the module handle (in the .data section) It is used for storage by the routine that is supplied to manage delay-loading.

inline void handle(uint32_t hdl)
inline uint32_t iat() const

RVA of the delay-load import address table.

inline void iat(uint32_t iat)
inline uint32_t names_table() const

RVA of the delay-load import names table. The content of this table has the layout as the Import lookup table.

inline void names_table(uint32_t value)
inline uint32_t biat() const

RVA of the bound delay-load import address table or 0 if the table does not exist.

inline void biat(uint32_t value)
inline uint32_t uiat() const

RVA of the unload delay-load import address table or 0 if the table does not exist.

According to the PE specifications, this table is an exact copy of the delay import address table that can be used to restore the original IAT in the case of unloading.

inline void uiat(uint32_t value)
inline uint32_t timestamp() const

The timestamp of the DLL to which this image has been bound.

inline void timestamp(uint32_t value)
inline it_entries entries()

Iterator over the DelayImport’s entries (DelayImportEntry).

inline it_const_entries entries() const

Iterator over the DelayImport’s entries (DelayImportEntry).

virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const DelayImport &entry)

Delay Import Entry

class DelayImportEntry : public LIEF::Symbol

Class that represents an entry (i.e. an import) in the delay import table (DelayImport).

It extends the LIEF::Symbol generic class that exposes the LIEF::Symbol::name and LIEF::Symbol::value API.

The meaning of LIEF::Symbol::value for this PE object is the address (as an RVA) in the IAT where the resolution should take place.

Public Functions

DelayImportEntry() = default
inline DelayImportEntry(uint64_t data, PE_TYPE type)
DelayImportEntry(const DelayImportEntry&) = default
DelayImportEntry &operator=(const DelayImportEntry&) = default
DelayImportEntry(DelayImportEntry&&) noexcept = default
DelayImportEntry &operator=(DelayImportEntry&&) noexcept = default
~DelayImportEntry() override = default
std::string demangled_name() const

Demangled representation of the symbol or an empty string if it can’t be demangled.

bool is_ordinal() const

True if it is an import by ordinal

inline uint16_t ordinal() const

The ordinal value.

inline uint64_t hint_name_rva() const

See also

DelayImportEntry::data

inline uint16_t hint() const

Index into the Export::entries that is used to speed-up the symbol resolution.

inline uint64_t iat_value() const

Value of the current entry in the Import Address Table.

inline uint64_t data() const

Raw value.

inline void data(uint64_t data)
virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const DelayImportEntry &entry)

TLS

class TLS : public LIEF::Object

Class which represents the PE Thread Local Storage.

This PE structure is also used to implement binary/library constructors.

Public Functions

TLS() = default
TLS(const details::pe32_tls &header)
TLS(const details::pe64_tls &header)
~TLS() override = default
TLS(const TLS &copy) = default
TLS &operator=(const TLS &copy) = default
TLS(TLS &&other) noexcept = default
TLS &operator=(TLS &&other) noexcept = default
inline const std::vector<uint64_t> &callbacks() const

List of the callbacks associated with the current TLS.

These functions are called before any other functions.

inline TLS &add_callback(uint64_t addr)

Add a new TLS callback.

inline const std::pair<uint64_t, uint64_t> &addressof_raw_data() const

Pair (start address, end address) of the TLS template. The template is a block of data that is used to initialize TLS data. The system copies all of this data each time a thread is created, so it must not be corrupted.

Note

These addresses are not RVA. They are addresses for which there should be a rebase relocation in the .reloc section.

inline uint64_t addressof_index() const

The location to receive the TLS index assigned by the loader. This location should be located in a writable section like .data.

inline uint64_t addressof_callbacks() const

Pointer to an array of TLS callback functions.

The array is null-terminated, so if there is no callback function this field points to 4 bytes set to zero.

inline uint32_t sizeof_zero_fill() const

Size in bytes of the zero to be padded after the data specified by data_template.

inline uint32_t characteristics() const

The four bits [23:20] describe alignment info. Possible values are those defined as IMAGE_SCN_ALIGN_*, which are also used to describe alignment of section in object files. The other 28 bits are reserved for future use.

inline span<const uint8_t> data_template() const

The initial content used to initialize TLS data.

inline bool has_data_directory() const

True if there is a data directory associated with this entry.

inline DataDirectory *directory()

Return the DataDirectory associated with this object or a nullptr If it exists, its type should be DataDirectory::TYPES::TLS_TABLE.

inline const DataDirectory *directory() const
inline bool has_section() const

Check if there is a section associated with this entry.

inline Section *section()

The section associated with the entry (or a nullptr).

inline const Section *section() const
inline void callbacks(std::vector<uint64_t> callbacks)
inline void addressof_raw_data(std::pair<uint64_t, uint64_t> addresses)
inline void addressof_index(uint64_t addr_idx)
inline void addressof_callbacks(uint64_t addr)
inline void sizeof_zero_fill(uint32_t size)
inline void characteristics(uint32_t characteristics)
inline void data_template(std::vector<uint8_t> data_template)
virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const TLS &entry)

Debug

class Debug : public LIEF::Object

This class represents a generic entry in the debug data directory. For known types, this class is extended to provide a dedicated API (see: CodeView).

Subclassed by LIEF::PE::CodeView, LIEF::PE::ExDllCharacteristics, LIEF::PE::FPO, LIEF::PE::PDBChecksum, LIEF::PE::Pogo, LIEF::PE::Repro, LIEF::PE::VCFeature

Public Types

enum class TYPES

The entry types.

Values:

enumerator UNKNOWN = 0
enumerator COFF = 1

COFF Debug information.

enumerator CODEVIEW = 2

CodeView debug information that is used to store PDB info.

enumerator FPO = 3

Frame pointer omission information.

enumerator MISC = 4

Miscellaneous debug information.

enumerator EXCEPTION = 5

Debug information that is a copy of the .pdata section.

enumerator FIXUP = 6

(Reserved) Debug information used for fixup relocations

enumerator OMAP_TO_SRC = 7

The mapping from an RVA in image to an RVA in source image.

enumerator OMAP_FROM_SRC = 8

The mapping from an RVA in source image to an RVA in image.

enumerator BORLAND = 9

Reserved for Borland.

enumerator RESERVED10 = 10

Reserved.

enumerator CLSID = 11

Reserved.

enumerator VC_FEATURE = 12

Visual C++ feature information.

enumerator POGO = 13

Profile Guided Optimization metadata.

enumerator ILTCG = 14

Incremental Link Time Code Generation metadata.

enumerator MPX = 15
enumerator REPRO = 16

PE determinism or reproducibility information.

enumerator PDBCHECKSUM = 19

Checksum of the PDB file.

enumerator EX_DLLCHARACTERISTICS = 20

Extended DLL characteristics.

Public Functions

Debug() = default
inline Debug(TYPES type)
Debug(const details::pe_debug &debug_s, Section *section)
Debug(const Debug &other) = default
Debug &operator=(const Debug &other) = default
Debug(Debug&&) = default
Debug &operator=(Debug&&) = default
~Debug() override = default
inline virtual std::unique_ptr<Debug> clone() const
inline uint32_t characteristics() const

Reserved should be 0.

inline uint32_t timestamp() const

The time and date when the debug data was created.

inline uint16_t major_version() const

The major version number of the debug data format.

inline uint16_t minor_version() const

The minor version number of the debug data format.

inline TYPES type() const

The format DEBUG_TYPES of the debugging information.

inline uint32_t sizeof_data() const

Size of the debug data.

inline uint32_t addressof_rawdata() const

Address of the debug data relative to the image base.

inline uint32_t pointerto_rawdata() const

File offset of the debug data.

inline const Section *section() const

The section where debug data is located.

inline Section *section()
span<uint8_t> payload()

Debug data associated with this entry.

inline span<const uint8_t> payload() const
inline void characteristics(uint32_t characteristics)
inline void timestamp(uint32_t timestamp)
inline void major_version(uint16_t major_version)
inline void minor_version(uint16_t minor_version)
inline void sizeof_data(uint32_t sizeof_data)
inline void addressof_rawdata(uint32_t addressof_rawdata)
inline void pointerto_rawdata(uint32_t pointerto_rawdata)
template<class T>
inline const T *as() const
template<class T>
inline T *as()
virtual void accept(Visitor &visitor) const override
virtual std::string to_string() const

Public Static Functions

static span<uint8_t> get_payload(Section &section, uint32_t rva, uint32_t offset, uint32_t size)
static span<uint8_t> get_payload(Section &section, const details::pe_debug &hdr)
static inline span<uint8_t> get_payload(Section &section, const Debug &dbg)

Friends

inline friend std::ostream &operator<<(std::ostream &os, const Debug &entry)

Code View

class CodeView : public LIEF::PE::Debug

Interface for the (generic) Debug CodeView (IMAGE_DEBUG_TYPE_CODEVIEW).

Subclassed by LIEF::PE::CodeViewPDB

Public Types

enum class SIGNATURES

Code view signatures.

See also

: http://llvm.org/doxygen/CVDebugRecord_8h_source.html

Values:

enumerator UNKNOWN = 0
enumerator PDB_70 = 0x53445352
enumerator PDB_20 = 0x3031424e
enumerator CV_50 = 0x3131424e
enumerator CV_41 = 0x3930424e

Public Functions

inline CodeView()
inline CodeView(SIGNATURES sig)
inline CodeView(const details::pe_debug &debug, SIGNATURES sig, Section *sec)
CodeView(const CodeView &other) = default
CodeView &operator=(const CodeView &other) = default
CodeView(CodeView &&other) = default
CodeView &operator=(CodeView &&other) = default
~CodeView() override = default
inline SIGNATURES signature() const

The signature that defines the underlying type of the payload.

inline virtual std::unique_ptr<Debug> clone() const override
virtual std::string to_string() const override
virtual void accept(Visitor &visitor) const override

Public Static Functions

static inline bool classof(const Debug *debug)

Code View PDB

class CodeViewPDB : public LIEF::PE::CodeView

CodeView PDB specialization.

Public Types

using signature_t = std::array<uint8_t, 16>

Public Functions

inline CodeViewPDB()
inline CodeViewPDB(std::string filename)
CodeViewPDB(const details::pe_debug &debug_info, const details::pe_pdb_70 &pdb_70, Section *sec)
CodeViewPDB(const details::pe_debug &debug_info, const details::pe_pdb_20 &pdb_70, Section *sec)
CodeViewPDB(const CodeViewPDB &other) = default
CodeViewPDB &operator=(const CodeViewPDB &other) = default
CodeViewPDB(CodeViewPDB &&other) = default
CodeViewPDB &operator=(CodeViewPDB &&other) = default
std::string guid() const

The GUID signature to verify against the .pdb file signature. This attribute might be used to lookup remote PDB file on a symbol server.

inline uint32_t age() const

Age value to verify. The age does not necessarily correspond to any known time value, it is used to determine if a .pdb file is out of sync with corresponding .exe file.

inline const signature_t &signature() const

The 32-bit signature to verify against the .pdb file signature.

inline std::string_view filename() const

The path to the .pdb file.

inline void age(uint32_t age)
inline void signature(const signature_t &sig)
inline void filename(std::string filename)
inline virtual std::unique_ptr<Debug> clone() const override
virtual void accept(Visitor &visitor) const override
virtual std::string to_string() const override
~CodeViewPDB() override = default

Public Static Functions

static inline bool classof(const Debug *debug)

Relocation

class Relocation : public LIEF::Object

Class which represents the Base Relocation Block We usually find this structure in the .reloc section.

Public Types

using entries_t = std::vector<std::unique_ptr<RelocationEntry>>
using it_entries = ref_iterator<entries_t&, RelocationEntry*>
using it_const_entries = const_ref_iterator<const entries_t&, RelocationEntry*>
using relocations_t = std::vector<std::unique_ptr<Relocation>>

Public Functions

Relocation()
Relocation(uint32_t base, uint32_t block_size)
Relocation(uint32_t base)
Relocation(const Relocation &other)
Relocation &operator=(Relocation other)
Relocation(Relocation&&)
Relocation &operator=(Relocation &&other)
Relocation(const details::pe_base_relocation_block &header)
~Relocation() override
void swap(Relocation &other)
inline uint32_t virtual_address() const

The RVA for which the offset of the relocation entries (RelocationEntry) is added.

inline uint32_t block_size() const

The total number of bytes in the base relocation block.

block_size = sizeof(BaseRelocationBlock) +
             nb_of_relocs * sizeof(uint16_t = RelocationEntry)
inline it_const_entries entries() const

Iterator over the RelocationEntry.

inline it_entries entries()
inline void virtual_address(uint32_t virtual_address)
inline void block_size(uint32_t block_size)
RelocationEntry &add_entry(const RelocationEntry &entry)
virtual void accept(Visitor &visitor) const override

Public Static Functions

static relocations_t parse(Parser &ctx, BinaryStream &stream)

Friends

friend std::ostream &operator<<(std::ostream &os, const Relocation &relocation)

Relocation Entry

class RelocationEntry : public LIEF::Relocation

Class which represents an entry of the PE relocation table.

It extends the LIEF::Relocation object to provide an uniform API across the file formats

Public Types

enum class BASE_TYPES

Relocation type as described in https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#base-relocation-types.

Values:

enumerator UNKNOWN = -1
enumerator ABS = 0

This value matches: IMAGE_REL_BASED_ABSOLUTE The base relocation is skipped. This type can be used to pad a block.

enumerator HIGH = 1

This value matches: IMAGE_REL_BASED_HIGH The base relocation adds the high 16 bits of the difference to the 16-bit field at offset. The 16-bit field represents the high value of a 32-bit word.

Operation:

write<int16_t>(ADDR, ((read<int16_t>(ADDR) << 16) + DELTA) >> 16)
enumerator LOW = 2

The base relocation adds the low 16 bits of the difference to the 16-bit field at offset. The 16-bit field represents the low half of a 32-bit word.

Operation:

write<int16_t>(ADDR, ((int32_t_t)read<int16_t>(ADDR) + DELTA))
enumerator HIGHLOW = 3

This value matches IMAGE_REL_BASED_HIGHLOW.

The base relocation applies all 32 bits of the difference to the 32-bit field at offset.

Operation:

write<int32_t_t>(ADDR, read<int32_t_t>(ADDR) + DELTA)
enumerator HIGHADJ = 4

This value matches IMAGE_REL_BASED_HIGHADJ.

The base relocation adds the high 16 bits of the difference to the 16-bit field at offset. The 16-bit field represents the high value of a 32-bit word. The low 16 bits of the 32-bit value are stored in the 16-bit word that follows this base relocation. This means that this base relocation occupies two slots.

enumerator MIPS_JMPADDR = 5 | (1 << 8)
enumerator ARM_MOV32 = 5 | (1 << 9)
enumerator RISCV_HI20 = 5 | (1 << 10)
enumerator SECTION = 6
enumerator THUMB_MOV32 = 7 | (1 << 11)
enumerator RISCV_LOW12I = 7 | (1 << 12)
enumerator RISCV_LOW12S = 8 | (1 << 13)
enumerator LOONARCH_MARK_LA = 8 | (1 << 14)
enumerator MIPS_JMPADDR16 = 9
enumerator DIR64 = 10

This value matches IMAGE_REL_BASED_DIR64.

The base relocation applies the difference to the 64-bit field at offset.

Operation:

write<int64_t_t>(ADDR, read<int64_t_t>(ADDR) + DELTA)
enumerator HIGH3ADJ = 11

Public Functions

RelocationEntry() = default
inline RelocationEntry(const RelocationEntry &other)
inline RelocationEntry &operator=(RelocationEntry other)
RelocationEntry(RelocationEntry &&other) = default
RelocationEntry &operator=(RelocationEntry &&other) = default
inline RelocationEntry(uint16_t position, BASE_TYPES type)
~RelocationEntry() override = default
inline void swap(RelocationEntry &other)
virtual uint64_t address() const override

The address of the relocation.

virtual void address(uint64_t address) override
virtual size_t size() const override

The size of the relocatable pointer.

virtual void size(size_t size) override
inline uint16_t data() const

Raw data of the relocation:

  • The high 4 bits store the relocation type

  • The low 12 bits store the relocation offset

inline uint16_t position() const

Offset relative to Relocation::virtual_address where the relocation occurs.

inline BASE_TYPES type() const

Type of the relocation.

inline void position(uint16_t position)
inline void type(BASE_TYPES type)
virtual void accept(Visitor &visitor) const override

Method so that the visitor can visit us.

Public Static Functions

static inline uint16_t get_position(uint16_t data)
static inline uint16_t get_type(uint16_t data)
static BASE_TYPES type_from_data(Header::MACHINE_TYPES arch, uint16_t data)

Public Static Attributes

static auto MAX_ADDR = 1 << 12

Friends

friend class PE::Relocation
friend std::ostream &operator<<(std::ostream &os, const RelocationEntry &entry)

Export

class Export : public LIEF::Object

Class which represents a PE Export.

Public Types

using entries_t = std::vector<std::unique_ptr<ExportEntry>>
using it_entries = ref_iterator<entries_t&, ExportEntry*>
using it_const_entries = const_ref_iterator<const entries_t&, const ExportEntry*>

Public Functions

Export() = default
inline Export(std::string name, const std::vector<ExportEntry> &entries)
inline Export(std::string name)
Export(const details::pe_export_directory_table &header)
Export(const Export&)
Export &operator=(const Export&)
Export(Export&&) = default
Export &operator=(Export&&) = default
~Export() override = default
inline uint32_t export_flags() const

According to the PE specifications this value is reserved and should be set to 0.

inline uint32_t timestamp() const

The time and date that the export data was created.

inline uint16_t major_version() const

The major version number (can be user-defined).

inline uint16_t minor_version() const

The minor version number (can be user-defined).

inline uint32_t ordinal_base() const

The starting number for the exports. Usually this value is set to 1.

inline std::string_view name() const

The name of the library exported (e.g. KERNEL32.dll).

inline it_entries entries()

Iterator over the ExportEntry.

inline it_const_entries entries() const
inline uint32_t name_rva() const

Address of the ASCII DLL’s name (RVA).

inline uint32_t export_addr_table_rva() const

RVA of the export address table.

inline uint32_t export_addr_table_cnt() const

Number of entries in the export address table.

inline uint32_t names_addr_table_rva() const

RVA to the list of exported names.

inline uint32_t names_addr_table_cnt() const

Number of exports by name.

inline uint32_t ord_addr_table_rva() const

RVA to the list of exported ordinals.

inline void export_flags(uint32_t flags)
inline void timestamp(uint32_t timestamp)
inline void major_version(uint16_t major_version)
inline void minor_version(uint16_t minor_version)
inline void ordinal_base(uint32_t ordinal_base)
inline void name(std::string name)
const ExportEntry *find_entry(const std::string &name) const

Find the export entry with the given name.

inline ExportEntry *find_entry(const std::string &name)
const ExportEntry *find_entry(uint32_t ordinal) const

Find the export entry with the given ordinal number.

inline ExportEntry *find_entry(uint32_t ordinal)
const ExportEntry *find_entry_at(uint32_t rva) const

Find the export entry at the provided RVA.

inline ExportEntry *find_entry_at(uint32_t rva)
ExportEntry &add_entry(const ExportEntry &exp)

Add the given export and return the newly created and added export.

inline ExportEntry &add_entry(std::string name, uint32_t rva)
bool remove_entry(const ExportEntry &exp)

Remove the given export entry.

inline bool remove_entry(const std::string &name)

Remove the export entry with the given name.

inline bool remove_entry(uint32_t rva)

Remove the export entry with the given RVA.

virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const Export &exp)

Export Entry

class ExportEntry : public LIEF::Symbol

Class which represents a PE Export entry (cf. PE::Export).

Public Functions

ExportEntry() = default
inline ExportEntry(uint32_t address, bool is_extern, uint16_t ordinal, uint32_t function_rva)
inline ExportEntry(std::string name, uint32_t rva)
ExportEntry(const ExportEntry&) = default
ExportEntry &operator=(const ExportEntry&) = default
ExportEntry(ExportEntry&&) = default
ExportEntry &operator=(ExportEntry&&) = default
~ExportEntry() override = default
std::string demangled_name() const

Demangled representation of the symbol or an empty string if it can’t be demangled.

inline uint16_t ordinal() const

Ordinal value associated with this exported entry.

This value is computed as the index of this entry in the address table plus the ordinal base (Export::ordinal_base)

inline uint32_t address() const

Address of the current exported function in the DLL.

Warning

If this entry is external to the DLL then it returns 0 and the external address is returned by function_rva()

inline bool is_extern() const
inline bool is_forwarded() const
inline forward_information_t forward_information() const
inline uint32_t function_rva() const
inline void ordinal(uint16_t ordinal)
inline void address(uint32_t address)
inline void is_extern(bool is_extern)
inline virtual uint64_t value() const override

Symbol’s value which is usually the address of the symbol.

inline virtual void value(uint64_t value) override
inline void set_forward_info(std::string lib, std::string function)
virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const ExportEntry &exportEntry)
struct forward_information_t

Public Functions

inline operator bool() const
inline std::string key() const

Public Members

std::string library
std::string function

Friends

inline friend std::ostream &operator<<(std::ostream &os, const forward_information_t &info)

Signature

class Signature : public LIEF::Object

Main interface for the PKCS #7 signature scheme.

Public Types

enum class VERIFICATION_FLAGS : uint32_t

Flags returned by the verification functions.

Values:

enumerator OK = 0
enumerator INVALID_SIGNER = 1 << 0
enumerator UNSUPPORTED_ALGORITHM = 1 << 1
enumerator INCONSISTENT_DIGEST_ALGORITHM = 1 << 2
enumerator CERT_NOT_FOUND = 1 << 3
enumerator CORRUPTED_CONTENT_INFO = 1 << 4
enumerator CORRUPTED_AUTH_DATA = 1 << 5
enumerator MISSING_PKCS9_MESSAGE_DIGEST = 1 << 6
enumerator BAD_DIGEST = 1 << 7
enumerator BAD_SIGNATURE = 1 << 8
enumerator NO_SIGNATURE = 1 << 9
enumerator CERT_EXPIRED = 1 << 10
enumerator CERT_FUTURE = 1 << 11
enum class VERIFICATION_CHECKS : uint32_t

Flags to tweak the verification process of the signature.

See Signature::check and LIEF::PE::Binary::verify_signature

Values:

enumerator DEFAULT = 1 << 0

Default behavior that tries to follow the Microsoft verification process as close as possible.

enumerator HASH_ONLY = 1 << 1

Only check that Binary::authentihash matches ContentInfo::digest regardless of the signature’s validity.

enumerator LIFETIME_SIGNING = 1 << 2

Same semantic as WTD_LIFETIME_SIGNING_FLAG.

enumerator SKIP_CERT_TIME = 1 << 3

Skip the verification of the certificates time validities so that even though a certificate expired, it returns VERIFICATION_FLAGS::OK.

using it_const_crt = const_ref_iterator<const std::vector<x509>&>

Iterator which outputs const x509& certificates.

using it_crt = ref_iterator<std::vector<x509>&>

Iterator which outputs x509& certificates.

using it_const_signers_t = const_ref_iterator<const std::vector<SignerInfo>&>

Iterator which outputs const SignerInfo&.

using it_signers_t = ref_iterator<std::vector<SignerInfo>&>

Iterator which outputs SignerInfo&.

Public Functions

Signature()
Signature(const Signature&)
Signature &operator=(const Signature&)
Signature(Signature&&)
Signature &operator=(Signature&&)
inline uint32_t version() const

Should be 1.

inline ALGORITHMS digest_algorithm() const

Algorithm used to digest the file.

It should match SignerInfo::digest_algorithm

inline const ContentInfo &content_info() const

Return the ContentInfo.

inline it_const_crt certificates() const

Return an iterator over x509 certificates.

inline it_crt certificates()
inline it_const_signers_t signers() const

Return an iterator over the signers (SignerInfo) defined in the PKCS #7 signature.

inline it_signers_t signers()
inline span<const uint8_t> raw_der() const

Return the raw original PKCS7 signature.

const x509 *find_crt(const std::vector<uint8_t> &serialno) const

Find x509 certificate according to its serial number.

const x509 *find_crt_subject(std::string_view subject) const

Find x509 certificate according to its subject.

const x509 *find_crt_subject(std::string_view subject, const std::vector<uint8_t> &serialno) const

Find x509 certificate according to its subject AND serial number.

const x509 *find_crt_issuer(std::string_view issuer) const

Find x509 certificate according to its issuer.

const x509 *find_crt_issuer(std::string_view issuer, const std::vector<uint8_t> &serialno) const

Find x509 certificate according to its issuer AND serial number.

VERIFICATION_FLAGS check(VERIFICATION_CHECKS checks = VERIFICATION_CHECKS::DEFAULT) const

Check if this signature is valid according to the Authenticode/PKCS #7 verification scheme.

By default, it performs the following verifications:

  1. It must contain only one signer info

  2. Signature::digest_algorithm must match:

  3. The x509 certificate specified by SignerInfo::serial_number and SignerInfo::issuer must exist within Signature::certificates

  4. Given the x509 certificate, compare SignerInfo::encrypted_digest against either:

    • hash of authenticated attributes if present

    • hash of ContentInfo

  5. If authenticated attributes are present, check that a PKCS9_MESSAGE_DIGEST attribute exists and that its value matches hash of ContentInfo

  6. Check the validity of the PKCS #9 counter signature if present

  7. If the signature doesn’t embed a signing-time in the counter signature, check the certificate validity. (See LIEF::PE::Signature::VERIFICATION_CHECKS::LIFETIME_SIGNING and LIEF::PE::Signature::VERIFICATION_CHECKS::SKIP_CERT_TIME)

See: LIEF::PE::Signature::VERIFICATION_CHECKS to tweak the behavior

virtual void accept(Visitor &visitor) const override
~Signature() override

Public Static Functions

static inline std::vector<uint8_t> hash(const std::vector<uint8_t> &input, ALGORITHMS algo)

Hash the input given the algorithm.

static std::vector<uint8_t> hash(const uint8_t *buffer, size_t size, ALGORITHMS algo)
static std::string flag_to_string(VERIFICATION_FLAGS flag)

Convert a verification flag into a human-readable representation. e.g VERIFICATION_FLAGS.BAD_DIGEST | VERIFICATION_FLAGS.BAD_SIGNATURE | VERIFICATION_FLAGS.CERT_EXPIRED.

Friends

friend std::ostream &operator<<(std::ostream &os, const Signature &signature)

Signature Attribute

class Attribute : public LIEF::Object

Interface over PKCS #7 attribute.

Subclassed by LIEF::PE::ContentType, LIEF::PE::GenericType, LIEF::PE::MsCounterSign, LIEF::PE::MsManifestBinaryID, LIEF::PE::MsSpcNestedSignature, LIEF::PE::MsSpcStatementType, LIEF::PE::PKCS9AtSequenceNumber, LIEF::PE::PKCS9CounterSignature, LIEF::PE::PKCS9MessageDigest, LIEF::PE::PKCS9SigningTime, LIEF::PE::SigningCertificateV2, LIEF::PE::SpcRelaxedPeMarkerCheck, LIEF::PE::SpcSpOpusInfo

Public Types

enum class TYPE

Values:

enumerator UNKNOWN = 0
enumerator CONTENT_TYPE
enumerator GENERIC_TYPE
enumerator SIGNING_CERTIFICATE_V2
enumerator SPC_SP_OPUS_INFO
enumerator SPC_RELAXED_PE_MARKER_CHECK
enumerator MS_COUNTER_SIGN
enumerator MS_SPC_NESTED_SIGN
enumerator MS_SPC_STATEMENT_TYPE
enumerator MS_PLATFORM_MANIFEST_BINARY_ID
enumerator PKCS9_AT_SEQUENCE_NUMBER
enumerator PKCS9_COUNTER_SIGNATURE
enumerator PKCS9_MESSAGE_DIGEST
enumerator PKCS9_SIGNING_TIME

Public Functions

Attribute() = delete
Attribute(const Attribute&) = default
Attribute &operator=(const Attribute&) = default
virtual std::unique_ptr<Attribute> clone() const = 0
inline virtual TYPE type() const

Concrete type of the attribute.

virtual std::string print() const = 0

Print information about the underlying attribute.

virtual void accept(Visitor &visitor) const override
~Attribute() override = default
template<class T>
inline const T *cast() const
template<class T>
inline T *cast()

Friends

inline friend std::ostream &operator<<(std::ostream &os, const Attribute &attribute)

Signature ContentType

class ContentType : public LIEF::PE::Attribute

Interface over the structure described by the OID 1.2.840.113549.1.9.3 (PKCS #9).

The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0

ContentType ::= OBJECT IDENTIFIER

Public Functions

inline ContentType()
inline ContentType(oid_t oid)
ContentType(const ContentType&) = default
ContentType &operator=(const ContentType&) = default
inline const oid_t &oid() const

OID as described in RFC #2985.

virtual std::string print() const override

Print information about the attribute.

inline virtual std::unique_ptr<Attribute> clone() const override
virtual void accept(Visitor &visitor) const override
~ContentType() override = default

Public Static Functions

static inline bool classof(const Attribute *attr)

Signature GenericType

class GenericType : public LIEF::PE::Attribute

Interface over an attribute for which the internal structure is not supported by LIEF.

Public Functions

inline GenericType()
inline GenericType(oid_t oid, std::vector<uint8_t> raw)
GenericType(const GenericType&) = default
GenericType &operator=(const GenericType&) = default
inline virtual std::unique_ptr<Attribute> clone() const override
inline const oid_t &oid() const

OID of the original attribute.

inline span<const uint8_t> raw_content() const

Original DER blob of the attribute.

virtual std::string print() const override

Print information about the attribute.

virtual void accept(Visitor &visitor) const override
~GenericType() override = default

Public Static Functions

static inline bool classof(const Attribute *attr)

Signature MsSpcNestedSignature

class MsSpcNestedSignature : public LIEF::PE::Attribute

Interface over the structure described by the OID 1.3.6.1.4.1.311.2.4.1.

The internal structure is not documented but we can infer the following structure:

MsSpcNestedSignature ::= SET OF SignedData

SignedData is the structure described in PKCS #7 RFC (LIEF::PE::Signature)

Public Functions

MsSpcNestedSignature() = delete
inline MsSpcNestedSignature(Signature sig)
MsSpcNestedSignature(const MsSpcNestedSignature&) = default
MsSpcNestedSignature &operator=(const MsSpcNestedSignature&) = default
inline virtual std::unique_ptr<Attribute> clone() const override
inline const Signature &sig() const

Underlying Signature object.

virtual std::string print() const override

Print information about the attribute.

virtual void accept(Visitor &visitor) const override
~MsSpcNestedSignature() override = default

Public Static Functions

static inline bool classof(const Attribute *attr)

Signature MsSpcStatementType

class MsSpcStatementType : public LIEF::PE::Attribute

Interface over the structure described by the OID 1.3.6.1.4.1.311.2.1.11.

The internal structure is described in the official document: Windows Authenticode Portable Executable Signature Format

SpcStatementType ::= SEQUENCE of OBJECT IDENTIFIER

Public Functions

MsSpcStatementType() = delete
inline MsSpcStatementType(oid_t oid)
MsSpcStatementType(const MsSpcStatementType&) = default
MsSpcStatementType &operator=(const MsSpcStatementType&) = default
inline virtual std::unique_ptr<Attribute> clone() const override
inline const oid_t &oid() const

According to the documentation:

The SpcStatementType MUST contain one Object Identifier with either the value 1.3.6.1.4.1.311.2.1.21 (SPC_INDIVIDUAL_SP_KEY_PURPOSE_OBJID) or > 1.3.6.1.4.1.311.2.1.22 (SPC_COMMERCIAL_SP_KEY_PURPOSE_OBJID).

virtual std::string print() const override

Print information about the attribute.

virtual void accept(Visitor &visitor) const override
~MsSpcStatementType() override = default

Public Static Functions

static inline bool classof(const Attribute *attr)

Signature PKCS9AtSequenceNumber

class PKCS9AtSequenceNumber : public LIEF::PE::Attribute

Interface over the structure described by the OID 1.2.840.113549.1.9.25.4 (PKCS #9).

The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0

sequenceNumber ATTRIBUTE ::= {
  WITH SYNTAX SequenceNumber
  EQUALITY MATCHING RULE integerMatch
  SINGLE VALUE TRUE
  ID pkcs-9-at-sequenceNumber
}

SequenceNumber ::= INTEGER (1..MAX)

Public Functions

PKCS9AtSequenceNumber() = delete
inline PKCS9AtSequenceNumber(uint32_t num)
PKCS9AtSequenceNumber(const PKCS9AtSequenceNumber&) = default
PKCS9AtSequenceNumber &operator=(const PKCS9AtSequenceNumber&) = default
inline virtual std::unique_ptr<Attribute> clone() const override
inline uint32_t number() const

Number as described in the RFC.

virtual std::string print() const override

Print information about the attribute.

virtual void accept(Visitor &visitor) const override
~PKCS9AtSequenceNumber() override = default

Public Static Functions

static inline bool classof(const Attribute *attr)

Signature PKCS9CounterSignature

class PKCS9CounterSignature : public LIEF::PE::Attribute

Interface over the structure described by the OID 1.2.840.113549.1.9.6 (PKCS #9).

The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0

counterSignature ATTRIBUTE ::= {
  WITH SYNTAX SignerInfo
  ID pkcs-9-at-counterSignature
}

Public Functions

PKCS9CounterSignature() = delete
inline PKCS9CounterSignature(SignerInfo signer)
PKCS9CounterSignature(const PKCS9CounterSignature&) = default
PKCS9CounterSignature &operator=(const PKCS9CounterSignature&) = default
inline virtual std::unique_ptr<Attribute> clone() const override
inline const SignerInfo &signer() const

SignerInfo as described in the RFC #2985.

virtual std::string print() const override

Print information about the attribute.

virtual void accept(Visitor &visitor) const override
~PKCS9CounterSignature() override = default

Public Static Functions

static inline bool classof(const Attribute *attr)

Signature PKCS9MessageDigest

class PKCS9MessageDigest : public LIEF::PE::Attribute

Interface over the structure described by the OID 1.2.840.113549.1.9.4 (PKCS #9).

The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0

messageDigest ATTRIBUTE ::= {
  WITH SYNTAX MessageDigest
  EQUALITY MATCHING RULE octetStringMatch
  SINGLE VALUE TRUE
  ID pkcs-9-at-messageDigest
}

MessageDigest ::= OCTET STRING

Public Functions

PKCS9MessageDigest() = delete
inline PKCS9MessageDigest(std::vector<uint8_t> digest)
PKCS9MessageDigest(const PKCS9MessageDigest&) = default
PKCS9MessageDigest &operator=(const PKCS9MessageDigest&) = default
inline virtual std::unique_ptr<Attribute> clone() const override
inline span<const uint8_t> digest() const

Message digeset as a blob of bytes as described in the RFC.

virtual std::string print() const override

Print information about the attribute.

virtual void accept(Visitor &visitor) const override
~PKCS9MessageDigest() override = default

Public Static Functions

static inline bool classof(const Attribute *attr)

Signature PKCS9SigningTime

class PKCS9SigningTime : public LIEF::PE::Attribute

Interface over the structure described by the OID 1.2.840.113549.1.9.5 (PKCS #9).

The internal structure is described in the RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0

signingTime ATTRIBUTE ::= {
        WITH SYNTAX SigningTime
        EQUALITY MATCHING RULE signingTimeMatch
        SINGLE VALUE TRUE
        ID pkcs-9-at-signingTime
}

SigningTime ::= Time -- imported from ISO/IEC 9594-8

Public Types

using time_t = std::array<int32_t, 6>

Time as an array [year, month, day, hour, min, sec].

Public Functions

PKCS9SigningTime() = delete
inline PKCS9SigningTime(time_t time)
PKCS9SigningTime(const PKCS9SigningTime&) = default
PKCS9SigningTime &operator=(const PKCS9SigningTime&) = default
inline const time_t &time() const

Time as an array [year, month, day, hour, min, sec].

virtual std::string print() const override

Print information about the attribute.

inline virtual std::unique_ptr<Attribute> clone() const override
virtual void accept(Visitor &visitor) const override
~PKCS9SigningTime() override = default

Public Static Functions

static inline bool classof(const Attribute *attr)

Signature SpcSpOpusInfo

class SpcSpOpusInfo : public LIEF::PE::Attribute

Interface over the structure described by the OID 1.3.6.1.4.1.311.2.1.12.

The internal structure is described in the official document: Windows Authenticode Portable Executable Signature Format

SpcSpOpusInfo ::= SEQUENCE {
    programName  [0] EXPLICIT SpcString OPTIONAL,
    moreInfo     [1] EXPLICIT SpcLink OPTIONAL
}

Public Functions

inline SpcSpOpusInfo(std::string program_name, std::string more_info)
inline SpcSpOpusInfo()
SpcSpOpusInfo(const SpcSpOpusInfo&) = default
SpcSpOpusInfo &operator=(const SpcSpOpusInfo&) = default
inline virtual std::unique_ptr<Attribute> clone() const override
inline std::string_view program_name() const

Program description provided by the publisher.

inline std::string_view more_info() const

Other information such as an url.

virtual std::string print() const override

Print information about the attribute.

virtual void accept(Visitor &visitor) const override
~SpcSpOpusInfo() override = default

Public Static Functions

static inline bool classof(const Attribute *attr)

Signature SpcIndirectData

class SpcIndirectData : public LIEF::PE::ContentInfo::Content

Public Functions

inline SpcIndirectData()
SpcIndirectData(const SpcIndirectData&) = default
SpcIndirectData &operator=(const SpcIndirectData&) = default
inline virtual std::unique_ptr<Content> clone() const override
inline ALGORITHMS digest_algorithm() const

Digest used to hash the file.

It should match LIEF::PE::SignerInfo::digest_algorithm

inline span<const uint8_t> digest() const

PE’s authentihash.

See also

LIEF::PE::Binary::authentihash

inline std::string_view file() const
inline std::string_view url() const
virtual void print(std::ostream &os) const override
virtual void accept(Visitor &visitor) const override
~SpcIndirectData() override = default

Public Static Functions

static inline bool classof(const ContentInfo::Content *content)

Public Static Attributes

static auto SPC_INDIRECT_DATA_OBJID = "1.3.6.1.4.1.311.2.1.4"

Friends

inline friend std::ostream &operator<<(std::ostream &os, const SpcIndirectData &content)

Signature GenericContent

class GenericContent : public LIEF::PE::ContentInfo::Content

Public Functions

GenericContent()
GenericContent(oid_t oid)
GenericContent(const GenericContent&) = default
GenericContent &operator=(const GenericContent&) = default
inline virtual std::unique_ptr<Content> clone() const override
inline const oid_t &oid() const
inline span<const uint8_t> raw() const
inline span<uint8_t> raw()
~GenericContent() override
virtual void print(std::ostream &os) const override
virtual void accept(Visitor &visitor) const override

Public Static Functions

static bool classof(const ContentInfo::Content *content)

Friends

inline friend std::ostream &operator<<(std::ostream &os, const GenericContent &content)

RsaInfo

class RsaInfo

Object that wraps a RSA key.

Public Types

using rsa_ctx_handle = void*
using bignum_wrapper_t = std::vector<uint8_t>

Container for BigInt.

Public Functions

RsaInfo(const RsaInfo &other)
RsaInfo(RsaInfo &&other)
RsaInfo &operator=(RsaInfo other)
bool has_public_key() const

True if it embeds a public key.

bool has_private_key() const

True if it embeds a private key.

bignum_wrapper_t N() const

RSA public modulus.

bignum_wrapper_t E() const

RSA public exponent.

bignum_wrapper_t D() const

RSA private exponent.

bignum_wrapper_t P() const

First prime factor.

bignum_wrapper_t Q() const

Second prime factor.

size_t key_size() const

Size of the public modulus (in bits).

void swap(RsaInfo &other)
operator bool() const
~RsaInfo()

Friends

friend std::ostream &operator<<(std::ostream &os, const RsaInfo &info)

x509

class x509 : public LIEF::Object

Interface over a x509 certificate.

Public Types

enum class KEY_TYPES : uint32_t

Public key scheme.

Values:

enumerator NONE = 0

Unknown scheme.

enumerator RSA

RSA Scheme.

enumerator ECKEY

Elliptic-curve scheme.

enumerator ECKEY_DH

Elliptic-curve Diffie-Hellman.

enumerator ECDSA

Elliptic-curve Digital Signature Algorithm.

enumerator RSA_ALT

RSA scheme with an alternative implementation for signing and decrypting.

enumerator RSASSA_PSS

RSA Probabilistic signature scheme.

enum class VERIFICATION_FLAGS : uint32_t

Mirror of mbedtls’s X509 Verify codes: MBEDTLS_X509_XX.

It must be sync with include/mbedtls/x509.h

Values:

enumerator OK = 0

The verification succeed.

enumerator BADCERT_EXPIRED = 1 << 0

The certificate validity has expired.

enumerator BADCERT_REVOKED = 1 << 1

The certificate has been revoked (is on a CRL).

enumerator BADCERT_CN_MISMATCH = 1 << 2

The certificate Common Name (CN) does not match with the expected CN.

enumerator BADCERT_NOT_TRUSTED = 1 << 3

The certificate is not correctly signed by the trusted CA.

enumerator BADCRL_NOT_TRUSTED = 1 << 4

The CRL is not correctly signed by the trusted CA.

enumerator BADCRL_EXPIRED = 1 << 5

The CRL is expired.

enumerator BADCERT_MISSING = 1 << 6

Certificate was missing.

enumerator BADCERT_SKIP_VERIFY = 1 << 7

Certificate verification was skipped.

enumerator BADCERT_OTHER = 1 << 8

Other reason (can be used by verify callback).

enumerator BADCERT_FUTURE = 1 << 9

The certificate validity starts in the future.

enumerator BADCRL_FUTURE = 1 << 10

The CRL is from the future.

enumerator BADCERT_KEY_USAGE = 1 << 11

Usage does not match the keyUsage extension.

enumerator BADCERT_EXT_KEY_USAGE = 1 << 12

Usage does not match the extendedKeyUsage extension.

enumerator BADCERT_NS_CERT_TYPE = 1 << 13

Usage does not match the nsCertType extension.

enumerator BADCERT_BAD_MD = 1 << 14

The certificate is signed with an unacceptable hash.

enumerator BADCERT_BAD_PK = 1 << 15

The certificate is signed with an unacceptable PK alg (eg RSA vs ECDSA).

enumerator BADCERT_BAD_KEY = 1 << 16

The certificate is signed with an unacceptable key (eg bad curve, RSA too short).

enumerator BADCRL_BAD_MD = 1 << 17

The CRL is signed with an unacceptable hash.

enumerator BADCRL_BAD_PK = 1 << 18

The CRL is signed with an unacceptable PK alg (eg RSA vs ECDSA).

enumerator BADCRL_BAD_KEY = 1 << 19

The CRL is signed with an unacceptable key (eg bad curve, RSA too short).

enum class KEY_USAGE : uint32_t

Key usage as defined in RFC #5280 - section-4.2.1.3.

Values:

enumerator DIGITAL_SIGNATURE = 0

The key is used for digital signature.

enumerator NON_REPUDIATION

The key is used for digital signature AND to protect against falsely denying some action.

enumerator KEY_ENCIPHERMENT

The key is used for enciphering private or secret keys.

enumerator DATA_ENCIPHERMENT

The key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher.

enumerator KEY_AGREEMENT

The Key is used for key agreement. (e.g. with Diffie-Hellman).

enumerator KEY_CERT_SIGN

The key is used for verifying signatures on public key certificates.

enumerator CRL_SIGN

The key is used for verifying signatures on certificate revocation lists.

enumerator ENCIPHER_ONLY

In association with KEY_AGREEMENT (otherwise the meaning is undefined), the key is only used for enciphering data while performing key agreement.

enumerator DECIPHER_ONLY

In association with KEY_AGREEMENT (otherwise the meaning is undefined), the key is only used for deciphering data while performing key agreement.

using date_t = std::array<int32_t, 6>

Tuple (Year, Month, Day, Hour, Minute, Second).

using certificates_t = std::vector<x509>

Public Functions

x509(mbedtls_x509_crt *ca)
x509(const x509 &other)
x509 &operator=(x509 other)
void swap(x509 &other)
uint32_t version() const

X.509 version. (1=v1, 2=v2, 3=v3).

std::vector<uint8_t> serial_number() const

Unique id for certificate issued by a specific CA.

oid_t signature_algorithm() const

Signature algorithm (OID).

date_t valid_from() const

Start time of certificate validity.

date_t valid_to() const

End time of certificate validity.

std::string issuer() const

Issuer information.

std::string subject() const

Subject information.

bool check_signature(const std::vector<uint8_t> &hash, const std::vector<uint8_t> &signature, ALGORITHMS digest) const

Try to decrypt the given signature and check if it matches the given hash according to the hash algorithm provided.

std::vector<uint8_t> raw() const

The raw x509 bytes (DER encoded).

KEY_TYPES key_type() const

Return the underlying public-key scheme.

std::unique_ptr<RsaInfo> rsa_info() const

If the underlying public-key scheme is RSA, return the RSA information. Otherwise, return a nullptr

VERIFICATION_FLAGS verify(const x509 &ca) const

Verify that this certificate has been used to trust the given certificate.

VERIFICATION_FLAGS is_trusted_by(const std::vector<x509> &ca) const

Verify that this certificate is trusted by the given CA list.

std::vector<oid_t> certificate_policies() const

Policy information terms as OID (see RFC #5280).

std::vector<KEY_USAGE> key_usage() const

Purpose of the key contained in the certificate.

std::vector<oid_t> ext_key_usage() const

Indicates one or more purposes for which the certified public key may be used (OID types).

bool is_ca() const
std::vector<uint8_t> signature() const

The signature of the certificate.

virtual void accept(Visitor &visitor) const override
~x509() override

Public Static Functions

static certificates_t parse(const std::string &path)

Parse x509 certificate(s) from file path.

static certificates_t parse(const std::vector<uint8_t> &content)

Parse x509 certificate(s) from raw blob.

static bool check_time(const date_t &before, const date_t &after)

Return True if before is before than after. False otherwise.

static bool time_is_past(const date_t &to)

True if the given time is in the past according to the clock’s system.

static bool time_is_future(const date_t &from)

True if the given time is in the future according to the clock’s system.

Friends

friend std::ostream &operator<<(std::ostream &os, const x509 &x509_cert)

ContentInfo

class ContentInfo : public LIEF::Object

ContentInfo as described in the RFC2315 (https://tools.ietf.org/html/rfc2315#section-7)

ContentInfo ::= SEQUENCE {
  contentType ContentType,
  content     [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL
}

ContentType ::= OBJECT IDENTIFIER

In the case of PE signature, ContentType must be set to SPC_INDIRECT_DATA_OBJID OID: 1.3.6.1.4.1.311.2.1.4 and content is defined by the structure: SpcIndirectDataContent

SpcIndirectDataContent ::= SEQUENCE {
 data          SpcAttributeTypeAndOptionalValue,
 messageDigest DigestInfo
}

SpcAttributeTypeAndOptionalValue ::= SEQUENCE {
 type  ObjectID,
 value [0] EXPLICIT ANY OPTIONAL
}

For PE signature, SpcAttributeTypeAndOptionalValue.type is set to SPC_PE_IMAGE_DATAOBJ (OID: 1.3.6.1.4.1.311.2.1.15) and the value is defined by SpcPeImageData

DigestInfo ::= SEQUENCE {
 digestAlgorithm  AlgorithmIdentifier,
 digest           OCTETSTRING
}

AlgorithmIdentifier ::= SEQUENCE {
 algorithm  ObjectID,
 parameters [0] EXPLICIT ANY OPTIONAL
}

Public Functions

ContentInfo()
ContentInfo(const ContentInfo &other)
ContentInfo(ContentInfo &&other) noexcept = default
ContentInfo &operator=(ContentInfo other)
void swap(ContentInfo &other) noexcept
inline oid_t content_type() const

Return the OID that describes the content wrapped by this object. It should match SPC_INDIRECT_DATA_OBJID (1.3.6.1.4.1.311.2.1.4).

inline Content &value()
inline const Content &value() const
std::vector<uint8_t> digest() const

Return the digest (authentihash) if the underlying content type is SPC_INDIRECT_DATA_OBJID Otherwise, return an empty vector.

ALGORITHMS digest_algorithm() const

Return the digest used to hash the file.

virtual void accept(Visitor &visitor) const override
~ContentInfo() override = default

Friends

friend std::ostream &operator<<(std::ostream &os, const ContentInfo &content_info)
class Content : public LIEF::Object

Subclassed by LIEF::PE::GenericContent, LIEF::PE::PKCS9TSTInfo, LIEF::PE::SpcIndirectData

Public Functions

inline Content(oid_t oid)
inline const oid_t &content_type() const
virtual std::unique_ptr<Content> clone() const = 0
virtual void print(std::ostream &os) const = 0
template<class T>
inline const T *cast() const
template<class T>
inline T *cast()
~Content() override = default

Friends

inline friend std::ostream &operator<<(std::ostream &os, const Content &content)

SignerInfo

class SignerInfo : public LIEF::Object

SignerInfo as described in the RFC 2315

SignerInfo ::= SEQUENCE {
 version Version,
 issuerAndSerialNumber     IssuerAndSerialNumber,
 digestAlgorithm           DigestAlgorithmIdentifier,
 authenticatedAttributes   [0] IMPLICIT Attributes OPTIONAL,
 digestEncryptionAlgorithm DigestEncryptionAlgorithmIdentifier,
 encryptedDigest           EncryptedDigest,
 unauthenticatedAttributes [1] IMPLICIT Attributes OPTIONAL
}

EncryptedDigest ::= OCTET STRING

Public Types

using encrypted_digest_t = std::vector<uint8_t>
using attributes_t = std::vector<std::unique_ptr<Attribute>>

Internal container used to store both authenticated and unauthenticated attributes.

using it_const_attributes_t = const_ref_iterator<const attributes_t&, const Attribute*>

Iterator which outputs const Attribute&.

Public Functions

SignerInfo()
SignerInfo(const SignerInfo &other)
SignerInfo &operator=(SignerInfo other)
SignerInfo(SignerInfo&&)
SignerInfo &operator=(SignerInfo&&)
void swap(SignerInfo &other)
inline uint32_t version() const

Should be 1.

inline span<const uint8_t> serial_number() const

Return the serial number associated with the x509 certificate used by this signer.

See also

LIEF::PE::x509::serial_number SignerInfo::issuer

inline std::string_view issuer() const

Return the x509::issuer used by this signer.

inline ALGORITHMS digest_algorithm() const

Algorithm (OID) used to hash the file.

This value should match LIEF::PE::ContentInfo::digest_algorithm and LIEF::PE::Signature::digest_algorithm

inline ALGORITHMS encryption_algorithm() const

Return the (public-key) algorithm used to encrypt the signature.

inline const encrypted_digest_t &encrypted_digest() const

Return the signature created by the signing certificate’s private key.

inline it_const_attributes_t authenticated_attributes() const

Iterator over LIEF::PE::Attribute for authenticated attributes.

inline it_const_attributes_t unauthenticated_attributes() const

Iterator over LIEF::PE::Attribute for unauthenticated attributes.

const Attribute *get_attribute(Attribute::TYPE type) const

Return the authenticated or un-authenticated attribute matching the given PE::SIG_ATTRIBUTE_TYPES.

It returns the first entry that matches the given type. If it can’t be found, it returns a nullptr.

const Attribute *get_auth_attribute(Attribute::TYPE type) const

Return the authenticated attribute matching the given PE::SIG_ATTRIBUTE_TYPES.

It returns the first entry that matches the given type. If it can’t be found, it returns a nullptr.

const Attribute *get_unauth_attribute(Attribute::TYPE type) const

Return the un-authenticated attribute matching the given PE::SIG_ATTRIBUTE_TYPES.

It returns the first entry that matches the given type. If it can’t be found, it returns a nullptr.

inline const x509 *cert() const

x509 certificate used by this signer. If it can’t be found, it returns a nullptr

inline x509 *cert()

x509 certificate used by this signer. If it can’t be found, it returns a nullptr

inline span<const uint8_t> raw_auth_data() const

Raw blob that is signed by the signer certificate.

virtual void accept(Visitor &visitor) const override
~SignerInfo() override

Friends

friend std::ostream &operator<<(std::ostream &os, const SignerInfo &signer_info)

MsCounterSign

class MsCounterSign : public LIEF::PE::Attribute

This class exposes the MS Counter Signature attribute.

Public Types

using certificates_t = std::vector<x509>
using it_const_certificates = const_ref_iterator<const certificates_t&>
using it_certificates = ref_iterator<certificates_t&>
using signers_t = std::vector<SignerInfo>
using it_const_signers = const_ref_iterator<const signers_t&>
using it_signers = ref_iterator<signers_t&>

Public Functions

inline MsCounterSign()
MsCounterSign(const MsCounterSign&) = default
MsCounterSign &operator=(const MsCounterSign&) = default
inline virtual std::unique_ptr<Attribute> clone() const override
inline uint32_t version() const
inline it_const_certificates certificates() const

Iterator over the LIEF::PE::x509 certificates of this counter signature.

inline it_certificates certificates()
inline it_const_signers signers() const

Signer iterator (same as LIEF::PE::SignerInfo).

inline it_signers signers()
inline ALGORITHMS digest_algorithm() const
inline const ContentInfo &content_info() const
virtual std::string print() const override

Print information about the underlying attribute.

virtual void accept(Visitor &visitor) const override
~MsCounterSign() override = default

Public Static Functions

static inline bool classof(const Attribute *attr)

PKCS9TSTInfo

class PKCS9TSTInfo : public LIEF::PE::ContentInfo::Content

Interface over the structure described by the OID 1.2.840.113549.1.9.16.1.4 (PKCS #9).

The internal structure is described in the RFC #3161

TSTInfo ::= SEQUENCE  {
 version        INTEGER  { v1(1) },
 policy         TSAPolicyId,
 messageImprint MessageImprint,
 serialNumber   INTEGER,
 genTime        GeneralizedTime,
 accuracy       Accuracy                OPTIONAL,
 ordering       BOOLEAN                 DEFAULT FALSE,
 nonce          INTEGER                 OPTIONAL,
 tsa            [0] GeneralName         OPTIONAL,
 extensions     [1] IMPLICIT Extensions OPTIONAL
}

TSAPolicyId    ::= OBJECT IDENTIFIER
MessageImprint ::= SEQUENCE {
  hashAlgorithm  AlgorithmIdentifier,
  hashedMessage  OCTET STRING
}

Accuracy ::= SEQUENCE {
  seconds        INTEGER           OPTIONAL,
  millis     [0] INTEGER  (1..999) OPTIONAL,
  micros     [1] INTEGER  (1..999) OPTIONAL
}

Public Functions

inline PKCS9TSTInfo()
PKCS9TSTInfo(const PKCS9TSTInfo&) = default
PKCS9TSTInfo &operator=(const PKCS9TSTInfo&) = default
inline virtual std::unique_ptr<Content> clone() const override
inline virtual void print(std::ostream&) const override
virtual void accept(Visitor &visitor) const override
~PKCS9TSTInfo() override = default

Public Static Functions

static inline bool classof(const ContentInfo::Content *content)

Public Static Attributes

static auto PKCS9_TSTINFO_OBJID = "1.2.840.113549.1.9.16.1.4"

MsManifestBinaryID

class MsManifestBinaryID : public LIEF::PE::Attribute

Interface over the structure described by the OID 1.3.6.1.4.1.311.10.3.28 (szOID_PLATFORM_MANIFEST_BINARY_ID).

The internal structure is not documented but we can infer the following structure:

szOID_PLATFORM_MANIFEST_BINARY_ID ::= SET OF BinaryID

BinaryID being an alias of UTF8STRING

Public Functions

MsManifestBinaryID() = delete
inline MsManifestBinaryID(std::string binid)
MsManifestBinaryID(const MsManifestBinaryID&) = default
MsManifestBinaryID &operator=(const MsManifestBinaryID&) = default
inline virtual std::string print() const override

Print information about the attribute.

inline std::string_view manifest_id() const

The manifest id as a string.

inline void manifest_id(const std::string &id)
inline virtual std::unique_ptr<Attribute> clone() const override
virtual void accept(Visitor &visitor) const override
~MsManifestBinaryID() override = default

Public Static Functions

static inline bool classof(const Attribute *attr)

SpcRelaxedPeMarkerCheck

class SpcRelaxedPeMarkerCheck : public LIEF::PE::Attribute

Public Functions

inline SpcRelaxedPeMarkerCheck()
inline SpcRelaxedPeMarkerCheck(uint32_t value)
SpcRelaxedPeMarkerCheck(const SpcRelaxedPeMarkerCheck&) = default
SpcRelaxedPeMarkerCheck &operator=(const SpcRelaxedPeMarkerCheck&) = default
inline uint32_t value() const
inline void value(uint32_t v)
inline virtual std::unique_ptr<Attribute> clone() const override
inline virtual std::string print() const override

Print information about the underlying attribute.

virtual void accept(Visitor &visitor) const override
~SpcRelaxedPeMarkerCheck() override = default

Public Static Functions

static inline bool classof(const Attribute *attr)

SigningCertificateV2

class SigningCertificateV2 : public LIEF::PE::Attribute

SigningCertificateV2 ::= SEQUENCE { certs SEQUENCE OF ESSCertIDv2, policies SEQUENCE OF PolicyInformation OPTIONAL }.

ESSCertIDv2 ::= SEQUENCE { hashAlgorithm AlgorithmIdentifier DEFAULT {algorithm id-sha256}, certHash OCTET STRING, issuerSerial IssuerSerial OPTIONAL }

IssuerSerial ::= SEQUENCE { issuer GeneralNames, serialNumber CertificateSerialNumber }

PolicyInformation ::= SEQUENCE { policyIdentifier OBJECT IDENTIFIER, policyQualifiers SEQUENCE SIZE (1..MAX) OF PolicyQualifierInfo OPTIONAL }

Public Functions

inline SigningCertificateV2()
SigningCertificateV2(const SigningCertificateV2&) = default
SigningCertificateV2 &operator=(const SigningCertificateV2&) = default
inline virtual std::unique_ptr<Attribute> clone() const override
virtual std::string print() const override

Print information about the underlying attribute.

virtual void accept(Visitor &visitor) const override
~SigningCertificateV2() override = default

Public Static Functions

static inline bool classof(const Attribute *attr)

Builder

class Builder

Class that is used to rebuild a raw PE binary from a PE::Binary object.

Public Functions

Builder() = delete
inline Builder(Binary &binary, config_t config)
~Builder()
ok_error_t build()

Perform the build process.

inline const std::vector<uint8_t> &get_build()

Return the build result.

void write(const std::string &filename) const

Write the build result into the output file.

void write(std::ostream &os) const

Write the build result into the os stream.

ok_error_t build(const DosHeader &dos_header)
ok_error_t build(const Header &header)
ok_error_t build(const OptionalHeader &optional_header)
ok_error_t build(const DataDirectory &data_directory)
ok_error_t build(const Section &section)
ok_error_t build_overlay()
ok_error_t build_relocations()
ok_error_t build_resources()
ok_error_t build_debug_info()
ok_error_t build_exports()
template<typename PE_T>
ok_error_t build_imports()
template<typename PE_T>
ok_error_t build_tls()
template<typename PE_T>
ok_error_t build_load_config()
inline const std::vector<uint8_t> &rsrc_data() const
struct config_t

This structure is used to configure the build operation.

The default value of these attributes is set to false if the operation modifies the binary layout even though nothing changed. For instance, building the import table always requires relocating the table to another place. Thus, the default value is false and must be explicitly set to true.

Public Types

using resolved_iat_cbk_t = std::function<void(Binary*, const Import*, const ImportEntry*, uint32_t)>

Public Members

bool imports = false

Whether the builder should reconstruct the imports table. This option should be turned on if you modify imports.

Please check LIEF website for more details

bool exports = false

Whether the builder should reconstruct the export table This option should be turned on if you modify exports.

Please check LIEF website for more details

bool resources = true

Whether the builder should regenerate the resources tree.

bool relocations = true

Whether the builder should regenerate relocations.

bool load_configuration = true

Whether the builder should regenerate the load config.

bool tls = true

Whether the builder should regenerate the TLS info.

bool overlay = true

Whether the builder should write back any overlay data.

bool debug = true

Whether the builder should regenerate debug entries.

bool dos_stub = true

Whether the builder should write back dos stub (including the rich header).

std::string rsrc_section = ".rsrc"

If the resources tree needs to be relocated, this defines the name of the new section that contains the relocated tree.

std::string idata_section = ".idata"

Section that holds the relocated import table (IAT/ILT).

std::string tls_section = ".tls"

Section that holds the relocated TLS info.

std::string reloc_section = ".reloc"

Section that holds the relocated relocations.

std::string export_section = ".edata"

Section that holds the export table.

std::string debug_section = ".debug"

Section that holds the debug entries.

resolved_iat_cbk_t resolved_iat_cbk = nullptr

Resources Manager

class ResourcesManager : public LIEF::Object

The Resource Manager provides an enhanced API to manipulate the resource tree.

Public Types

enum class TYPE

The different types of resources From https://learn.microsoft.com/en-us/windows/win32/menurc/resource-types.

Values:

enumerator CURSOR = 1
enumerator BITMAP = 2
enumerator ICON = 3
enumerator MENU = 4
enumerator DIALOG = 5
enumerator STRING = 6
enumerator FONTDIR = 7
enumerator FONT = 8
enumerator ACCELERATOR = 9
enumerator RCDATA = 10
enumerator MESSAGETABLE = 11
enumerator GROUP_CURSOR = 12
enumerator GROUP_ICON = 14
enumerator VERSION = 16
enumerator DLGINCLUDE = 17
enumerator PLUGPLAY = 19
enumerator VXD = 20
enumerator ANICURSOR = 21
enumerator ANIICON = 22
enumerator HTML = 23
enumerator MANIFEST = 24
using dialogs_t = ResourceDialog::dialogs_t
using it_const_dialogs = const_ref_iterator<const dialogs_t&, const ResourceDialog*>
using icons_t = std::vector<ResourceIcon>
using it_const_icons = const_ref_iterator<icons_t>
using accelerators_t = std::vector<ResourceAccelerator>
using it_const_accelerators = const_ref_iterator<accelerators_t>
using strings_table_t = std::vector<string_entry_t>

Public Functions

ResourcesManager() = delete
inline ResourcesManager(ResourceNode &rsrc)
inline ResourcesManager(const ResourcesManager &other)
inline ResourcesManager &operator=(const ResourcesManager &other)
ResourcesManager(ResourcesManager&&) = default
ResourcesManager &operator=(ResourcesManager&&) = default
~ResourcesManager() override = default
inline ResourceNode *get_node_type(TYPE type)

Return the ResourceNode associated with the given TYPE or a nullptr if not found;.

const ResourceNode *get_node_type(TYPE type) const
std::vector<TYPE> get_types() const

List of TYPE present in the resources.

inline bool has_type(TYPE type) const

true if the resource has the given TYPE node

inline bool has_manifest() const

true if resources contain the Manifest element

std::string manifest() const

Return the manifest as a std::string or an empty string if not found or corrupted.

void manifest(const std::string &manifest)

Change or set the manifest. If the manifest node path does not exist, all required nodes are created.

inline bool has_version() const

true if resources contain a LIEF::PE::ResourceVersion

std::vector<ResourceVersion> version() const

Return a list of version info (VS_VERSIONINFO).

inline bool has_icons() const

true if resources contain a LIEF::PE::ResourceIcon

it_const_icons icons() const

Return the list of the icons present in the resources.

void add_icon(const ResourceIcon &icon)

Add an icon to the resources.

void change_icon(const ResourceIcon &original, const ResourceIcon &newone)
inline bool has_dialogs() const

true if resources contain dialogs

it_const_dialogs dialogs() const

Return the list of the dialogs present in the resource.

inline bool has_string_table() const

true if the resources contain a string table

strings_table_t string_table() const

Return the list of the strings embedded in the string table (RT_STRING).

inline bool has_html() const

true if the resources contain html

std::vector<std::string> html() const

Return the list of the html resources.

inline bool has_accelerator() const

true if the resources contain accelerator info

it_const_accelerators accelerator() const

Return the list of the accelerator in the resource.

std::string print(uint32_t depth = 0) const

Print the resource tree to the given depth.

virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const ResourcesManager &m)
struct string_entry_t

This structure represent an entry in the string table (RT_STRING).

Public Functions

std::string string_u8() const
inline bool is_defined() const
inline operator bool() const

Public Members

std::u16string string
uint32_t id = 0

Friends

inline friend std::ostream &operator<<(std::ostream &os, const string_entry_t &str)

Resource Node

class ResourceNode : public LIEF::Object

Class which represents a Node in the resource tree.

Subclassed by LIEF::PE::ResourceData, LIEF::PE::ResourceDirectory

Public Types

enum class TYPE

Enum that identifies the type of a node in the resource tree.

Values:

enumerator UNKNOWN = 0
enumerator DATA
enumerator DIRECTORY
using childs_t = std::vector<std::unique_ptr<ResourceNode>>
using it_childs = ref_iterator<childs_t&, ResourceNode*>
using it_const_childs = const_ref_iterator<const childs_t&, ResourceNode*>

Public Functions

ResourceNode(const ResourceNode &other)
ResourceNode &operator=(const ResourceNode &other)
ResourceNode(ResourceNode &&other) = default
ResourceNode &operator=(ResourceNode &&other) = default
void swap(ResourceNode &other)
~ResourceNode() override
virtual std::unique_ptr<ResourceNode> clone() const = 0
inline uint32_t id() const

Integer that identifies the Type, Name, or Language ID of the entry depending on its depth in the tree.

inline const std::u16string &name() const

Name of the entry (if any).

std::string utf8_name() const

UTF-8 representation of the name().

inline it_childs childs()

Iterator on node’s children.

inline it_const_childs childs() const
inline bool has_name() const

True if the entry uses a name as ID

inline uint32_t depth() const

Current depth of the Node in the resource tree.

inline bool is_directory() const

True if the current entry is a ResourceDirectory.

It can be safely casted with:

const auto* dir_node = node.cast<ResourceDirectory>();
inline bool is_data() const

True if the current entry is a ResourceData.

It can be safely casted with:

const auto* data_node = node.cast<ResourceData>();
inline void id(uint32_t id)
void name(const std::string &name)
inline void name(std::u16string name)
ResourceNode &add_child(std::unique_ptr<ResourceNode> child)

Add a new child to the current node, taking the ownership of the provided unique_ptr.

inline ResourceNode &add_child(const ResourceNode &child)

Add a new child to the current node.

void delete_child(uint32_t id)

Delete the node with the given id.

void delete_child(const ResourceNode &node)

Delete the given node from the node’s children.

virtual void accept(Visitor &visitor) const override
template<class T>
inline const T *cast() const
template<class T>
inline T *cast()
inline std::string to_string() const
inline void push_child(std::unique_ptr<ResourceNode> node)

Public Static Functions

static std::unique_ptr<ResourceNode> parse(BinaryStream &stream, uint64_t rva)

Parse the resource tree from the provided BinaryStream stream and with the original RVA provided in the second parameter.

The RVA value should come from the DataDirectory::RVA associated with the resource tree.

static std::unique_ptr<ResourceNode> parse(const uint8_t *buffer, size_t size, uint64_t rva)

Parse the resource tree from the provided buffer referenced by a pointer and the size. The second parameter is the RVA where the resource is (or was) located.

static inline std::unique_ptr<ResourceNode> parse(const std::vector<uint8_t> &buffer, uint64_t rva)

See doc from other parse functions.

static inline std::unique_ptr<ResourceNode> parse(span<const uint8_t> buffer, uint64_t rva)

See doc from other parse functions.

static std::unique_ptr<ResourceNode> parse(BinaryStream &stream, const Binary &bin)

Friends

friend std::ostream &operator<<(std::ostream &os, const ResourceNode &node)
friend bool operator==(const ResourceNode &LHS, const ResourceNode &RHS)
inline friend bool operator!=(const ResourceNode &LHS, const ResourceNode &RHS)

Resource Directory

class ResourceDirectory : public LIEF::PE::ResourceNode

Public Functions

inline ResourceDirectory()
inline ResourceDirectory(uint32_t id)
ResourceDirectory(const details::pe_resource_directory_table &header)
ResourceDirectory(const ResourceDirectory &other) = default
ResourceDirectory &operator=(const ResourceDirectory &other) = default
void swap(ResourceDirectory &other) noexcept
~ResourceDirectory() override = default
inline virtual std::unique_ptr<ResourceNode> clone() const override
inline uint32_t characteristics() const

Resource characteristics. This field is reserved for future use. It is currently set to zero.

inline uint32_t time_date_stamp() const

The time that the resource data was created by the resource compiler.

inline uint16_t major_version() const

The major version number, set by the user.

inline uint16_t minor_version() const

The minor version number, set by the user.

inline uint16_t numberof_name_entries() const

The number of directory entries immediately following the table that use strings to identify Type, Name, or Language entries (depending on the level of the table).

inline uint16_t numberof_id_entries() const

The number of directory entries immediately following the Name entries that use numeric IDs for Type, Name, or Language entries.

inline void characteristics(uint32_t characteristics)
inline void time_date_stamp(uint32_t time_date_stamp)
inline void major_version(uint16_t major_version)
inline void minor_version(uint16_t minor_version)
inline void numberof_name_entries(uint16_t numberof_name_entries)
inline void numberof_id_entries(uint16_t numberof_id_entries)
virtual void accept(Visitor &visitor) const override

Public Static Functions

static inline bool classof(const ResourceNode *node)

Resource Data

class ResourceData : public LIEF::PE::ResourceNode

Class which represents a Data Node in the PE resources tree.

Public Functions

inline ResourceData()
inline ResourceData(std::vector<uint8_t> content, uint32_t code_page = 0)
inline ResourceData(const std::string &str, uint32_t code_page = 0)
ResourceData(const ResourceData &other) = default
ResourceData &operator=(const ResourceData &other) = default
void swap(ResourceData &other) noexcept
~ResourceData() override = default
inline virtual std::unique_ptr<ResourceNode> clone() const override
inline uint32_t code_page() const

Return the code page that is used to decode code point values within the resource data. Typically, the code page is the unicode code page.

inline span<const uint8_t> content() const

Resource content.

inline span<uint8_t> content()
inline uint32_t reserved() const

Reserved value. Should be 0.

inline uint32_t offset() const

Offset of the content within the resource.

Warning

This value may change when rebuilding resource table

inline void code_page(uint32_t code_page)
inline void content(std::vector<uint8_t> content)
inline void content(const std::string &string)
inline void content(const uint8_t *buffer, size_t size)
inline void reserved(uint32_t value)
virtual void accept(Visitor &visitor) const override

Public Static Functions

static inline bool classof(const ResourceNode *node)

Resource Icon

class ResourceIcon : public LIEF::Object

Public Functions

ResourceIcon() = default
ResourceIcon(const details::pe_resource_icon_group &header)
ResourceIcon(const details::pe_icon_header &header)
ResourceIcon(const ResourceIcon&) = default
ResourceIcon &operator=(const ResourceIcon&) = default
ResourceIcon(ResourceIcon&&) = default
ResourceIcon &operator=(ResourceIcon&&) = default
~ResourceIcon() override = default
inline uint32_t id() const

Id associated with the icon.

inline uint32_t lang() const

Language associated with the icon.

inline uint32_t sublang() const

Sub language associated with the icon.

inline uint8_t width() const

Width in pixels of the image.

inline uint8_t height() const

Height in pixels of the image.

inline uint8_t color_count() const

Number of colors in image (0 if >=8bpp).

inline uint8_t reserved() const

Reserved (must be 0).

inline uint16_t planes() const

Color Planes.

inline uint16_t bit_count() const

Bits per pixel.

inline uint32_t size() const

Size in bytes of the image.

inline span<const uint8_t> pixels() const

Pixels of the image (as bytes).

inline void id(uint32_t id)
inline void lang(uint32_t lang)
inline void sublang(uint32_t sublang)
inline void width(uint8_t width)
inline void height(uint8_t height)
inline void color_count(uint8_t color_count)
inline void reserved(uint8_t reserved)
inline void planes(uint16_t planes)
inline void bit_count(uint16_t bit_count)
inline void pixels(std::vector<uint8_t> pixels)
void save(const std::string &filename) const

Save the icon to the given filename.

Parameters:

filename – [in] Path to file in which the icon will be saved

std::vector<uint8_t> serialize() const
virtual void accept(Visitor &visitor) const override

Public Static Functions

static result<ResourceIcon> from_serialization(const uint8_t *buffer, size_t size)
static inline result<ResourceIcon> from_serialization(const std::vector<uint8_t> &bytes)
static inline result<ResourceIcon> from_bytes(LIEF::span<const uint8_t> bytes)

Friends

friend std::ostream &operator<<(std::ostream &os, const ResourceIcon &entry)

Resource Dialog

class ResourceDialog : public LIEF::Object

This class is the base class for either a regular (legacy) Dialog or an extended Dialog. These different kinds of Dialogs are documented by MS at the following addresses:

Subclassed by LIEF::PE::ResourceDialogExtended, LIEF::PE::ResourceDialogRegular

Public Types

enum class TYPE

Enum for discriminating the kind of the Dialog (regular vs extended).

Values:

enumerator UNKNOWN = 0
enumerator REGULAR
enumerator EXTENDED
enum class DIALOG_STYLES : uint32_t

From: https://learn.microsoft.com/en-us/windows/win32/dlgbox/dialog-box-styles.

Values:

enumerator ABSALIGN = 0x0001
enumerator SYSMODAL = 0x0002
enumerator LOCALEDIT = 0x0020
enumerator SETFONT = 0x0040
enumerator MODALFRAME = 0x0080
enumerator NOIDLEMSG = 0x0100
enumerator SETFOREGROUND = 0x0200
enumerator S3DLOOK = 0x0004
enumerator FIXEDSYS = 0x0008
enumerator NOFAILCREATE = 0x0010
enumerator CONTROL = 0x0400
enumerator CENTER = 0x0800
enumerator CENTERMOUSE = 0x1000
enumerator CONTEXTHELP = 0x2000
enumerator SHELLFONT = SETFONT | FIXEDSYS
enum class WINDOW_STYLES : uint32_t

From: https://docs.microsoft.com/en-us/windows/win32/winmsg/window-styles.

Values:

enumerator OVERLAPPED = 0x00000000
enumerator POPUP = 0x80000000
enumerator CHILD = 0x40000000
enumerator MINIMIZE = 0x20000000
enumerator VISIBLE = 0x10000000
enumerator DISABLED = 0x08000000
enumerator CLIPSIBLINGS = 0x04000000
enumerator CLIPCHILDREN = 0x02000000
enumerator MAXIMIZE = 0x01000000
enumerator CAPTION = 0x00C00000
enumerator BORDER = 0x00800000
enumerator DLGFRAME = 0x00400000
enumerator VSCROLL = 0x00200000
enumerator HSCROLL = 0x00100000
enumerator SYSMENU = 0x00080000
enumerator THICKFRAME = 0x00040000
enumerator GROUP = 0x00020000
enumerator TABSTOP = 0x00010000
enum class WINDOW_EXTENDED_STYLES : uint32_t

From https://docs.microsoft.com/en-us/windows/win32/winmsg/extended-window-styles.

Values:

enumerator DLGMODALFRAME = 0x00000001
enumerator NOPARENTNOTIFY = 0x00000004
enumerator TOPMOST = 0x00000008
enumerator ACCEPTFILES = 0x00000010
enumerator TRANSPARENT_STY = 0x00000020
enumerator MDICHILD = 0x00000040
enumerator TOOLWINDOW = 0x00000080
enumerator WINDOWEDGE = 0x00000100
enumerator CLIENTEDGE = 0x00000200
enumerator CONTEXTHELP = 0x00000400
enumerator RIGHT = 0x00001000
enumerator LEFT = 0x00000000
enumerator RTLREADING = 0x00002000
enumerator LEFTSCROLLBAR = 0x00004000
enumerator CONTROLPARENT = 0x00010000
enumerator STATICEDGE = 0x00020000
enumerator APPWINDOW = 0x00040000
enum class CONTROL_STYLES : uint32_t

From: https://learn.microsoft.com/en-us/windows/win32/controls/common-control-styles.

Values:

enumerator TOP = 0x00000001
enumerator NOMOVEY = 0x00000002
enumerator BOTTOM = 0x00000003
enumerator NORESIZE = 0x00000004
enumerator NOPARENTALIGN = 0x00000008
enumerator ADJUSTABLE = 0x00000020
enumerator NODIVIDER = 0x00000040
enumerator VERT = 0x00000080
enumerator LEFT = VERT | TOP
enumerator RIGHT = VERT | BOTTOM
enumerator NOMOVEX = VERT | NOMOVEY
using dialogs_t = std::vector<std::unique_ptr<ResourceDialog>>

Public Functions

ResourceDialog() = default
ResourceDialog(const ResourceDialog&) = default
ResourceDialog &operator=(const ResourceDialog&) = default
ResourceDialog(ResourceDialog&&) = default
ResourceDialog &operator=(ResourceDialog&&) = default
inline ResourceDialog(TYPE ty)
virtual std::unique_ptr<ResourceDialog> clone() const = 0
inline TYPE type() const
inline uint32_t style() const

The style of the dialog box. This member can be a combination of window style values (such as WINDOW_STYLES::CAPTION and WINDOW_STYLES::SYSMENU) and dialog box style values (such as DIALOG_STYLES::CENTER).

inline uint32_t extended_style() const

The extended styles for a window. This member is not used to create dialog boxes, but applications that use dialog box templates can use it to create other types of windows. For a list of values, see WINDOW_EXTENDED_STYLES.

inline int16_t x() const

The x-coordinate, in dialog box units, of the upper-left corner of the dialog box.

inline int16_t y() const

The y-coordinate, in dialog box units, of the upper-left corner of the dialog box.

inline int16_t cx() const

The width, in dialog box units, of the dialog box.

inline int16_t cy() const

The height, in dialog box units, of the dialog box.

inline ResourceDialog &style(uint32_t value)
inline ResourceDialog &extended_style(uint32_t value)
inline ResourceDialog &x(int16_t value)
inline ResourceDialog &y(int16_t value)
inline ResourceDialog &cx(int16_t value)
inline ResourceDialog &cy(int16_t value)
inline ResourceDialog &menu(std::u16string title)
inline ResourceDialog &menu(uint16_t ord)
inline ResourceDialog &window_class(std::u16string title)
inline ResourceDialog &window_class(uint16_t ord)
inline ResourceDialog &title(std::u16string value)
ResourceDialog &title(const std::string &title)
inline bool has(DIALOG_STYLES style) const

Check if the dialog uses the given dialog style.

inline bool has(WINDOW_STYLES style) const

Check if the dialog uses the given window style.

inline bool has(WINDOW_EXTENDED_STYLES style) const

Check if the dialog uses the given extended window style.

std::vector<DIALOG_STYLES> styles_list() const

List of DIALOG_STYLES used by this dialog.

std::vector<WINDOW_STYLES> windows_styles_list() const

List of WINDOW_STYLES used by this dialog.

std::vector<WINDOW_EXTENDED_STYLES> windows_ext_styles_list() const

List of WINDOW_EXTENDED_STYLES used by this dialog.

inline const std::u16string &title() const

title of the dialog box

std::string title_utf8() const

title of the dialog box

inline const ordinal_or_str_t &menu() const

ordinal or name value of a menu resource.

inline const ordinal_or_str_t &window_class() const

ordinal of a predefined system window class or name of a registered window class

virtual std::string to_string() const = 0
virtual ~ResourceDialog() = default
template<class T>
inline const T *as() const

Helper to downcast a ResourceDialog into a ResourceDialogRegular or a ResourceDialogExtended.

Public Static Functions

static dialogs_t parse(const ResourceData &node)

Parse dialogs from the given resource data node.

static dialogs_t parse(const uint8_t *buffer, size_t size)

Friends

inline friend std::ostream &operator<<(std::ostream &os, const ResourceDialog &dialog)
struct ordinal_or_str_t

This structure wraps either an ordinal value (uint16_t) or a string. The ordinal value should refer to an existing resource id in the resource tree.

Public Functions

inline bool is_defined() const
inline operator bool() const
std::string to_string() const

Public Members

result<uint16_t> ordinal = make_error_code(lief_errors::not_found)
std::u16string string
class Item

This class represents an element of the dialog. It can be for instance, a button, or a caption.

This class is inherited by the regular or extended dialog’s item:

Subclassed by LIEF::PE::ResourceDialogExtended::Item, LIEF::PE::ResourceDialogRegular::Item

Public Types

enum class WINDOW_CLASS : uint32_t

Values:

enumerator BUTTON = 0x0080
enumerator EDIT = 0x0081
enumerator STATIC = 0x0082
enumerator LIST_BOX = 0x0083
enumerator SCROLL_BAR = 0x0084
enumerator COMBO_BOX = 0x0085

Public Functions

Item() = default
Item(const Item&) = default
Item &operator=(const Item&) = default
Item(Item&&) = default
Item &operator=(Item&&) = default
inline uint32_t style() const

The style of the control. This can be a combination of WINDOW_STYLES or CONTROL_STYLES.

inline uint32_t extended_style() const

The extended styles for a window. This member is not used to create controls in dialog boxes, but applications that use dialog box templates can use it to create other types of windows.

It can take a combination of WINDOW_EXTENDED_STYLES

inline int32_t id() const

The control identifier.

inline bool has(WINDOW_STYLES style) const

Check if this item has the given WINDOW_STYLES.

inline bool has(CONTROL_STYLES style) const

Check if this item has the given CONTROL_STYLES.

std::vector<WINDOW_STYLES> window_styles() const

List of WINDOW_STYLES used by this item.

std::vector<CONTROL_STYLES> control_styles() const

List of CONTROL_STYLES used by this item.

inline int16_t x() const

The x-coordinate, in dialog box units, of the upper-left corner of the control. This coordinate is always relative to the upper-left corner of the dialog box’s client area.

inline int16_t y() const

The y-coordinate, in dialog box units, of the upper-left corner of the control. This coordinate is always relative to the upper-left corner of the dialog box’s client area.

inline int16_t cx() const

The width, in dialog box units, of the control.

inline int16_t cy() const

The height, in dialog box units, of the control.

inline Item &style(uint32_t value)
inline Item &extended_style(uint32_t value)
inline Item &x(int16_t value)
inline Item &y(int16_t value)
inline Item &cx(int16_t value)
inline Item &cy(int16_t value)
inline Item &id(int32_t value)
inline Item &data(std::vector<uint8_t> creation_data)
inline Item &clazz(std::u16string title)
inline Item &clazz(uint16_t ord)
inline Item &title(std::u16string value)
inline Item &title(uint16_t ord)
inline const ordinal_or_str_t &clazz() const

Window class of the control. This can be either: a string that specifies the name of a registered window class or an ordinal value of a predefined system class.

inline const ordinal_or_str_t &title() const

Title of the item which can be either: a string that specifies the initial text or an ordinal value of a resource, such as an icon, in an executable file.

inline span<const uint8_t> creation_data() const

Creation data that is passed to the control’s window procedure.

inline span<uint8_t> creation_data()
virtual ~Item() = default
virtual std::string to_string() const = 0

Friends

inline friend std::ostream &operator<<(std::ostream &os, const Item &item)

Resource Dialog – Regular

class ResourceDialogRegular : public LIEF::PE::ResourceDialog

Implementation for a regular/legacy dialog box.

See: https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgtemplate

Public Types

using items_t = std::vector<Item>
using it_items = ref_iterator<items_t&>
using it_const_items = const_ref_iterator<const items_t&>

Public Functions

inline ResourceDialogRegular()
ResourceDialogRegular(const ResourceDialogRegular&) = default
ResourceDialogRegular &operator=(const ResourceDialogRegular&) = default
ResourceDialogRegular(ResourceDialogRegular&&) = default
ResourceDialogRegular &operator=(ResourceDialogRegular&&) = default
inline virtual std::unique_ptr<ResourceDialog> clone() const override
virtual std::string to_string() const override
inline uint32_t nb_items() const

Number of control items.

inline it_items items()

Iterator over the different control items.

inline it_const_items items() const
inline void add_item(const Item &item)

Add a new control item to the dialog.

inline const font_t &font() const

Additional font information.

inline ResourceDialogRegular &font(uint16_t pointsize, std::u16string name)
inline ResourceDialogRegular &font(font_t f)
virtual void accept(Visitor &visitor) const override
~ResourceDialogRegular() override = default

Public Static Functions

static std::unique_ptr<ResourceDialogRegular> create(BinaryStream &stream)
static inline bool classof(const ResourceDialog *dialog)
class Item : public LIEF::PE::ResourceDialog::Item

This class represents a DLGTEMPLATE item: DLGITEMTEMPLATE.

See: https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgitemtemplate

Public Functions

Item() = default
Item(const Item&) = default
Item &operator=(const Item&) = default
Item(Item&&) = default
Item &operator=(Item&&) = default
virtual std::string to_string() const override
virtual ~Item() override = default

Public Static Functions

static result<Item> parse(BinaryStream &stream)
struct font_t

This structure represents additional font information that might be embedded at the end of the DLGTEMPLATE stream.

Public Functions

inline bool is_defined() const
inline operator bool() const
std::string to_string() const

Public Members

uint16_t point_size = 0
std::u16string name

Friends

inline friend std::ostream &operator<<(std::ostream &os, const font_t &font)

Resource Dialog – Extended

class ResourceDialogExtended : public LIEF::PE::ResourceDialog

Implementation for the new extended dialogbox format.

See: https://learn.microsoft.com/en-us/windows/win32/dlgbox/dlgtemplateex

Public Types

using items_t = std::vector<Item>
using it_items = ref_iterator<items_t&>
using it_const_items = const_ref_iterator<const items_t&>

Public Functions

inline ResourceDialogExtended()
ResourceDialogExtended(const ResourceDialogExtended&) = default
ResourceDialogExtended &operator=(const ResourceDialogExtended&) = default
ResourceDialogExtended(ResourceDialogExtended&&) = default
ResourceDialogExtended &operator=(ResourceDialogExtended&&) = default
inline virtual std::unique_ptr<ResourceDialog> clone() const override
virtual void accept(Visitor &visitor) const override
virtual std::string to_string() const override
~ResourceDialogExtended() override = default
inline uint16_t version() const

The version number of the extended dialog box template. This member must be set to 1.

inline uint16_t signature() const

Indicates whether a template is an extended dialog box template. If signature is 0xFFFF, this is an extended dialog box template. In this case, the dlgVer member specifies the template version number.

inline uint32_t help_id() const

The help context identifier for the dialog box window. When the system sends a WM_HELP message, it passes the helpID value in the dwContextId member of the HELPINFO structure.

inline it_items items()

Iterator over the control items of this dialog box.

inline it_const_items items() const
inline void add_item(const Item &item)

Add a new control item to the dialog.

inline ResourceDialogExtended &version(uint16_t value)
inline ResourceDialogExtended &signature(uint16_t value)
inline ResourceDialogExtended &help_id(uint32_t value)
inline const font_t &font() const

Additional font information.

inline ResourceDialogExtended &font(uint16_t point_size, uint16_t weight, bool italic, uint8_t charset, std::u16string typeface)
inline ResourceDialogExtended &font(font_t f)

Public Static Functions

static std::unique_ptr<ResourceDialogExtended> create(BinaryStream &stream)
static inline bool classof(const ResourceDialog *dialog)
class Item : public LIEF::PE::ResourceDialog::Item

This class represents a DLGTEMPLATEEX item (DLGITEMTEMPLATEEX).

See: https://learn.microsoft.com/en-us/windows/win32/dlgbox/dlgitemtemplateex

Public Functions

Item() = default
Item(const Item&) = default
Item &operator=(const Item&) = default
Item(Item&&) = default
Item &operator=(Item&&) = default
virtual std::string to_string() const override
inline uint32_t help_id() const

The help context identifier for the control. When the system sends a WM_HELP message, it passes the helpID value in the dwContextId member of the HELPINFO structure.

inline Item &help_id(uint32_t value)
virtual ~Item() override = default

Public Static Functions

static result<Item> parse(BinaryStream &stream)
struct font_t

Font information for the font to use for the text in the dialog box and its controls.

Public Functions

inline bool is_defined() const
inline operator bool() const
std::string to_string() const

Public Members

uint16_t point_size = 0

The point size of the font.

uint16_t weight = 0

The weight of the font.

bool italic = false

Indicates whether the font is italic.

uint8_t charset = false

The character set to be used.

std::u16string typeface

The name of the typeface for the font.

Friends

inline friend std::ostream &operator<<(std::ostream &os, const font_t &font)

Resource Version

class ResourceVersion : public LIEF::Object

Representation of the data associated with the RT_VERSION entry.

See: VS_VERSIONINFO at https://learn.microsoft.com/en-us/windows/win32/menurc/vs-versioninfo

Public Functions

ResourceVersion(const ResourceVersion&) = default
ResourceVersion &operator=(const ResourceVersion&) = default
ResourceVersion(ResourceVersion&&) = default
ResourceVersion &operator=(ResourceVersion&&) = default
~ResourceVersion() override = default
inline const fixed_file_info_t &file_info() const

Return the fixed file info (VS_FIXEDFILEINFO).

inline fixed_file_info_t &file_info()
inline ResourceStringFileInfo *string_file_info()

Return the StringFileInfo element.

inline const ResourceStringFileInfo *string_file_info() const
inline ResourceVarFileInfo *var_file_info()

Return the VarFileInfo element.

inline uint16_t type() const

The type of data in the version resource.

  • 1 if it contains text data

  • 0 if it contains binary data

inline const std::u16string &key() const

The Unicode string L"VS_VERSION_INFO".

std::string key_u8() const

The key as an utf8 string.

inline ResourceVersion &type(uint16_t value)
inline ResourceVersion &key(std::u16string value)
inline const ResourceVarFileInfo *var_file_info() const
inline ResourceVersion &var_file_info(ResourceVarFileInfo info)
inline ResourceVersion &string_file_info(ResourceStringFileInfo info)
virtual void accept(Visitor &visitor) const override

Public Static Functions

static result<ResourceVersion> parse(const ResourceData &node)
static result<ResourceVersion> parse(const uint8_t *p, size_t sz)
static result<ResourceVersion> parse(BinaryStream &stream)

Friends

friend std::ostream &operator<<(std::ostream &os, const ResourceVersion &version)
struct fixed_file_info_t

This structure represents the VS_FIXEDFILEINFO structure defined in verrsrc.h.

Public Types

enum class VERSION_OS : uint32_t

Values:

enumerator UNKNOWN = 0x00000000

The operating system for which the file was designed is unknown to the system.

enumerator DOS = 0x00010000

The file was designed for MS-DOS.

enumerator OS216 = 0x00020000

The file was designed for 16-bit OS/2.

enumerator OS232 = 0x00030000

The file was designed for 32-bit OS/2.

enumerator NT = 0x00040000

The file was designed for Windows NT.

enumerator WINCE = 0x00050000

The file was designed for Windows CE (Windows Embedded Compact).

enumerator WINDOWS16 = 0x00000001

The file was designed for 16-bit Windows.

enumerator PM16 = 0x00000002

The file was designed for 16-bit Presentation Manager.

enumerator PM32 = 0x00000003

The file was designed for 32-bit Presentation Manager.

enumerator WINDOWS32 = 0x00000004

The file was designed for 32-bit Windows.

enumerator DOS_WINDOWS16 = DOS | WINDOWS16

The file was designed for 16-bit Windows running on MS-DOS.

enumerator DOS_WINDOWS32 = DOS | WINDOWS32

The file was designed for 32-bit Windows running on MS-DOS.

enumerator OS216_PM16 = OS216 | PM16

The file was designed for 16-bit Presentation Manager running on 16-bit OS/2.

enumerator OS232_PM32 = OS232 | PM32

The file was designed for 32-bit Presentation Manager running on 32-bit OS/2.

enumerator NT_WINDOWS32 = NT | WINDOWS32

The file was designed for Windows NT.

enum class FILE_TYPE : uint32_t

Values:

enumerator UNKNOWN = 0x00000000

The file type is unknown to the system.

enumerator APP = 0x00000001

The file contains an application.

enumerator DLL = 0x00000002

The file contains a DLL.

enumerator DRV = 0x00000003

The file contains a device driver. If dwFileType is VFT_DRV, dwFileSubtype contains a more specific description of the driver.

enumerator FONT = 0x00000004

The file contains a font. If dwFileType is VFT_FONT, dwFileSubtype contains a more specific description of the font file.

enumerator VXD = 0x00000005

The file contains a virtual device.

enumerator STATIC_LIB = 0x00000007

The file contains a static-link library.

enum class FILE_TYPE_DETAILS : uint64_t

Values:

enumerator UNKNOWN = 0x00000000

The type is unknown by the system.

enumerator DRV_PRINTER = 0x00000001 | DRV_K

The file contains a printer driver.

enumerator DRV_KEYBOARD = 0x00000002 | DRV_K

The file contains a keyboard driver.

enumerator DRV_LANGUAGE = 0x00000003 | DRV_K

The file contains a language driver.

enumerator DRV_DISPLAY = 0x00000004 | DRV_K

The file contains a display driver.

enumerator DRV_MOUSE = 0x00000005 | DRV_K

The file contains a mouse driver.

enumerator DRV_NETWORK = 0x00000006 | DRV_K

The file contains a network driver.

enumerator DRV_SYSTEM = 0x00000007 | DRV_K

The file contains a system driver.

enumerator DRV_INSTALLABLE = 0x00000008 | DRV_K

The file contains an installable driver.

enumerator DRV_SOUND = 0x00000009 | DRV_K

The file contains a sound driver.

enumerator DRV_COMM = 0x0000000A | DRV_K

The file contains a communications driver.

enumerator DRV_INPUTMETHOD = 0x0000000B | DRV_K
enumerator DRV_VERSIONED_PRINTER = 0x0000000C

The file contains a versioned printer driver.

enumerator FONT_RASTER = 0x00000001 | FONT_K

The file contains a raster font.

enumerator FONT_VECTOR = 0x00000002 | FONT_K

The file contains a vector font.

enumerator FONT_TRUETYPE = 0x00000003 | FONT_K

The file contains a TrueType font.

enum class FILE_FLAGS : uint32_t

Values:

enumerator DEBUG = 0x00000001

The file contains debugging information or is compiled with debugging features enabled.

enumerator INFO_INFERRED = 0x00000010

The file’s version structure was created dynamically; therefore, some of the members in this structure may be empty or incorrect. This flag should never be set in a file’s VS_VERSIONINFO data.

enumerator PATCHED = 0x00000004

The file has been modified and is not identical to the original shipping file of the same version number.

enumerator PRERELEASE = 0x00000002

The file is a development version, not a commercially released product.

enumerator PRIVATEBUILD = 0x00000008

The file was not built using standard release procedures. If this flag is set, the StringFileInfo structure should contain a PrivateBuild entry.

enumerator SPECIALBUILD = 0x00000020

The file was built by the original company using standard release procedures but is a variation of the normal file of the same version number. If this flag is set, the StringFileInfo structure should contain a SpecialBuild entry.

Public Functions

inline bool has(FILE_FLAGS f) const

Check if the given FILE_FLAGS is present.

std::vector<FILE_FLAGS> flags() const

List of FILE_FLAGS.

inline FILE_TYPE_DETAILS file_type_details() const
std::string to_string() const

Public Members

uint32_t signature = 0

Contains the value 0xFEEF04BD. This is used with the szKey member of the VS_VERSIONINFO structure when searching a file for the VS_FIXEDFILEINFO structure.

uint32_t struct_version = 0

The binary version number of this structure. The high-order word of this member contains the major version number, and the low-order word contains the minor version number.

uint32_t file_version_ms = 0

The most significant 32 bits of the file’s binary version number. This member is used with file_version_ls to form a 64-bit value used for numeric comparisons.

uint32_t file_version_ls = 0

The least significant 32 bits of the file’s binary version number. This member is used with file_version_ms to form a 64-bit value used for numeric comparisons.

uint32_t product_version_ms = 0

The most significant 32 bits of the binary version number of the product with which this file was distributed. This member is used with product_version_ls to form a 64-bit value used for numeric comparisons.

uint32_t product_version_ls = 0

The least significant 32 bits of the binary version number of the product with which this file was distributed. This member is used with product_version_ms to form a 64-bit value used for numeric comparisons.

uint32_t file_flags_mask = 0

Contains a bitmask that specifies the valid bits in file_flags. A bit is valid only if it was defined when the file was created.

uint32_t file_flags = 0

Contains a bitmask that specifies the Boolean attributes of the file. This member can include one or more of the values specified in FILE_FLAGS.

uint32_t file_os = 0

The operating system for which this file was designed. This member can be one of the values specified in VERSION_OS.

uint32_t file_type = 0

The general type of file. This member can be one of the values specified in FILE_TYPE. All other values are reserved.

uint32_t file_subtype = 0

The function of the file. The possible values depend on the value of file_type.

uint32_t file_date_ms = 0

The most significant 32 bits of the file’s 64-bit binary creation date and time stamp.

uint32_t file_date_ls = 0

The least significant 32 bits of the file’s 64-bit binary creation date and time stamp.

Public Static Attributes

static auto DRV_K = uint64_t(1) << 33
static auto FONT_K = uint64_t(1) << 34
static auto SIGNATURE_VALUE = 0xFEEF04BD

Friends

inline friend std::ostream &operator<<(std::ostream &os, const fixed_file_info_t &info)

Resource Var File Info

class ResourceVarFileInfo : public LIEF::Object

Representation of the VarFileInfo structure.

This structure represents the organization of data in a file-version resource. It contains version information not dependent on a particular language and code page combination.

See: https://learn.microsoft.com/en-us/windows/win32/menurc/varfileinfo

Public Types

using vars_t = std::vector<ResourceVar>
using it_vars = ref_iterator<vars_t&>
using it_const_vars = const_ref_iterator<const vars_t&>

Public Functions

ResourceVarFileInfo() = default
ResourceVarFileInfo(const ResourceVarFileInfo&) = default
ResourceVarFileInfo &operator=(const ResourceVarFileInfo&) = default
ResourceVarFileInfo(ResourceVarFileInfo&&) = default
ResourceVarFileInfo &operator=(ResourceVarFileInfo&&) = default
~ResourceVarFileInfo() override = default
inline uint16_t type() const

The type of data in the version resource.

  • 1 if it contains text data

  • 0 if it contains binary data

inline const std::u16string &key() const

Signature of the structure. Must be the unicode string “VarFileInfo”.

std::string key_u8() const

Key as an utf8 string.

inline it_vars vars()

Iterator over the embedded variables associated to the structure.

inline it_const_vars vars() const
inline ResourceVarFileInfo &type(uint16_t type)
inline ResourceVarFileInfo &key(std::u16string key)
inline void add_var(ResourceVar var)
virtual void accept(Visitor &visitor) const override

Public Static Functions

static result<ResourceVarFileInfo> parse(BinaryStream &stream)

Friends

friend std::ostream &operator<<(std::ostream &os, const ResourceVarFileInfo &entry)

Resource Var

class ResourceVar

This class represents an element of the ResourceVarFileInfo structure It typically contains a list of language and code page identifier pairs that the version of the application or DLL supports.

See: https://learn.microsoft.com/en-us/windows/win32/menurc/var-str

Public Types

using values_t = std::vector<uint32_t>

Translation values as a vector of uint32_t.

Public Functions

ResourceVar() = default
ResourceVar(const ResourceVar&) = default
ResourceVar &operator=(const ResourceVar&) = default
ResourceVar(ResourceVar&&) = default
ResourceVar &operator=(ResourceVar&&) = default
~ResourceVar() = default
inline const std::u16string &key() const

The Unicode string L"Translation".

inline uint16_t type() const

The type of data in the version resource:

  • 1 if it contains text data

  • 0 if it contains binary

std::string key_u8() const

The key as an utf8 string.

inline const values_t &values() const

Return the translation values.

The low-order word of each uint32_t must contain a Microsoft language identifier, and the high-order word must contain the IBM code page number. Either high-order or low-order word can be zero, indicating that the file is language or code page independent

inline values_t &values()
inline ResourceVar &key(std::u16string key)
inline ResourceVar &type(uint16_t ty)
inline void add_value(uint32_t val)

Public Static Functions

static result<ResourceVar> parse(BinaryStream &stream)

Friends

friend std::ostream &operator<<(std::ostream &os, const ResourceVar &entry)

Resource String File Info

class ResourceStringFileInfo : public LIEF::Object

Representation of the StringFileInfo structure.

It contains version information that can be displayed for a particular language and code page.

See: https://learn.microsoft.com/en-us/windows/win32/menurc/stringfileinfo

Public Types

using elements_t = std::vector<ResourceStringTable>
using it_const_elements = const_ref_iterator<const elements_t&>
using it_elements = ref_iterator<elements_t&>

Public Functions

ResourceStringFileInfo() = default
ResourceStringFileInfo(const ResourceStringFileInfo&) = default
ResourceStringFileInfo &operator=(const ResourceStringFileInfo&) = default
ResourceStringFileInfo(ResourceStringFileInfo&&) = default
ResourceStringFileInfo &operator=(ResourceStringFileInfo&&) = default
~ResourceStringFileInfo() override = default
inline uint16_t type() const

The type of data in the version resource.

  • 1 if it contains text data

  • 0 if it contains binary data

inline const std::u16string &key() const

Signature of the structure. Must be the unicode string “StringFileInfo”.

inline it_const_elements children() const

Iterator over the children values.

inline it_elements children()
std::string key_u8() const

The key as an utf8 string.

inline ResourceStringFileInfo &type(uint16_t type)
inline ResourceStringFileInfo &key(std::u16string key)
inline void add_child(ResourceStringTable table)
virtual void accept(Visitor &visitor) const override

Public Static Functions

static result<ResourceStringFileInfo> parse(BinaryStream &stream)

Friends

friend std::ostream &operator<<(std::ostream &os, const ResourceStringFileInfo &info)

Resource String Table

class ResourceStringTable : public LIEF::Object

This class represents the StringTable structure. This structure can be seen as a dictionary of key-value pairs with keys and values defined as UTF-16 strings.

Public Types

using entries_t = std::vector<entry_t>
using it_entries = ref_iterator<entries_t&>
using it_const_entries = const_ref_iterator<const entries_t&>

Public Functions

ResourceStringTable() = default
ResourceStringTable(const ResourceStringTable&) = default
ResourceStringTable &operator=(const ResourceStringTable&) = default
ResourceStringTable(ResourceStringTable&&) = default
ResourceStringTable &operator=(ResourceStringTable&&) = default
~ResourceStringTable() override = default
inline const std::u16string &key() const

An 8-digit hexadecimal number stored as a Unicode string. The four most significant digits represent the language identifier. The four least significant digits represent the code page for which the data is formatted. Each Microsoft Standard Language identifier contains two parts: the low-order 10 bits specify the major language, and the high-order 6 bits specify the sublanguage.

inline uint16_t type() const

The type of data in the version resource:

  • 1 if it contains text data

  • 0 if it contains binary

std::string key_u8() const

The key as an utf8 string.

inline it_entries entries()

Iterator over the different entry_t element of this table.

inline it_const_entries entries() const
inline std::optional<std::u16string> get(const std::u16string &key) const
std::optional<std::string> get(const std::string &key) const
inline ResourceStringTable &key(std::u16string value)
inline ResourceStringTable &type(uint16_t value)
inline void add_entry(entry_t entry)
inline void add_entry(std::u16string key, std::u16string value)
virtual void accept(Visitor &visitor) const override
inline std::optional<std::string> operator[](const std::string &str) const
inline std::optional<std::u16string> operator[](const std::u16string &str) const

Public Static Functions

static result<ResourceStringTable> parse(BinaryStream &stream)

Friends

friend std::ostream &operator<<(std::ostream &os, const ResourceStringTable &table)
struct entry_t

An entry in this table which is composed of an UTF-16 key and an UTF-16 value.

Public Functions

std::string key_u8() const

Key in utf8 representation.

std::string value_u8() const

Value in utf8 representation.

inline bool is_defined() const
inline operator bool() const
inline std::string to_string() const

Public Members

std::u16string key
std::u16string value

Friends

inline friend std::ostream &operator<<(std::ostream &os, const entry_t &entry)

Resource Accelerator

class ResourceAccelerator : public LIEF::Object

Public Types

enum class FLAGS : uint32_t

From: https://docs.microsoft.com/en-us/windows/win32/menurc/acceltableentry.

Values:

enumerator VIRTKEY = 0x01

The accelerator key is a virtual-key code. If this flag is not specified, the accelerator key is assumed to specify an ASCII character code.

enumerator NOINVERT = 0x02

A menu item on the menu bar is not highlighted when an accelerator is used. This attribute is obsolete and retained only for backward compatibility with resource files designed for 16-bit Windows.

enumerator SHIFT = 0x04

The accelerator is activated only if the user presses the SHIFT key. This flag applies only to virtual keys.

enumerator CONTROL = 0x08

The accelerator is activated only if the user presses the CTRL key. This flag applies only to virtual keys.

enumerator ALT = 0x10

The accelerator is activated only if the user presses the ALT key. This flag applies only to virtual keys.

enumerator END = 0x80

The entry is last in an accelerator table.

Public Functions

ResourceAccelerator() = default
explicit ResourceAccelerator(const details::pe_resource_acceltableentry&)
ResourceAccelerator(const ResourceAccelerator&) = default
ResourceAccelerator &operator=(const ResourceAccelerator&) = default
ResourceAccelerator(ResourceAccelerator&&) = default
ResourceAccelerator &operator=(ResourceAccelerator&&) = default
~ResourceAccelerator() override = default
std::vector<FLAGS> flags_list() const
inline const char *ansi_str() const
inline int16_t flags() const

Describe the keyboard accelerator characteristics.

inline int16_t ansi() const

An ANSI character value or a virtual-key code that identifies the accelerator key.

inline uint16_t id() const

An identifier for the keyboard accelerator.

inline int16_t padding() const

The number of bytes inserted to ensure that the structure is aligned on a DWORD boundary.

inline bool has(FLAGS flag) const

Whether the entry has the given flag.

inline ResourceAccelerator &add(FLAGS flag)
inline ResourceAccelerator &remove(FLAGS flag)
virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const ResourceAccelerator &acc)

Rich Header

class RichHeader : public LIEF::Object

Class which represents the not-so-documented rich header.

This structure is usually located at the end of the Binary::dos_stub and contains information about the build environment. It is generated by the Microsoft linker link.exe and there are no options to disable or remove this information.

Public Types

using entries_t = std::vector<RichEntry>
using it_entries = ref_iterator<entries_t&>
using it_const_entries = const_ref_iterator<const entries_t&>

Public Functions

RichHeader() = default
RichHeader(const RichHeader&) = default
RichHeader &operator=(const RichHeader&) = default
~RichHeader() override = default
inline uint32_t key() const

Key used to encode the header (xor operation).

inline it_entries entries()

Return an iterator over the PE::RichEntry within the header.

inline it_const_entries entries() const
inline void key(uint32_t key)
inline void add_entry(RichEntry entry)

Add a new PE::RichEntry.

inline void add_entry(uint16_t id, uint16_t build_id, uint32_t count)

Add a new entry given the id, build_id and count.

inline std::vector<uint8_t> raw() const

The raw structure of the Rich header without xor-encoding.

This function is equivalent as calling RichHeader::raw(uint32_t) with a xor_key set to 0

std::vector<uint8_t> raw(uint32_t xor_key) const

Given this rich header, this function re-computes the raw bytes of the structure with the provided xor-key.

You can access the decoded data’s structure with the xor_key set to 0

Parameters:

xor_key – [in] The key to use for the xor-encoding (can be 0)

inline std::vector<uint8_t> hash(ALGORITHMS algo) const

Compute the hash of the decoded rich header structure with the given hash algorithm.

std::vector<uint8_t> hash(ALGORITHMS algo, uint32_t xor_key) const

Compute the hash of the rich header structure encoded with the provided key.

virtual void accept(Visitor &visitor) const override

Public Static Attributes

static uint8_t RICH_MAGIC[] = {'R', 'i', 'c', 'h'}
static uint32_t RICH_MAGIC_INT = 0x68636952
static uint32_t DANS_MAGIC_NUMBER = 0x536E6144

Friends

friend std::ostream &operator<<(std::ostream &os, const RichHeader &rich_header)

Rich Entry

class RichEntry : public LIEF::Object

Class which represents an entry associated to the RichHeader.

Public Functions

RichEntry() = default
inline RichEntry(uint16_t id, uint16_t build_id, uint32_t count)
RichEntry(const RichEntry&) = default
RichEntry &operator=(const RichEntry&) = default
~RichEntry() override = default
inline uint16_t id() const

Entry type.

inline uint16_t build_id() const

Build number of the tool (if any).

inline uint32_t count() const

Occurrence count.

inline void id(uint16_t id)
inline void build_id(uint16_t build_id)
inline void count(uint32_t count)
virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const RichEntry &rich_entry)

Code Integrity

class CodeIntegrity : public LIEF::Object

Public Functions

CodeIntegrity() = default
~CodeIntegrity() override = default
CodeIntegrity &operator=(const CodeIntegrity&) = default
CodeIntegrity(const CodeIntegrity&) = default
CodeIntegrity &operator=(CodeIntegrity&&) = default
CodeIntegrity(CodeIntegrity&&) = default
inline uint16_t flags() const

Flags to indicate if CI information is available, etc.

inline uint16_t catalog() const

0xFFFF means not available

inline uint32_t catalog_offset() const
inline uint32_t reserved() const

Additional bitmask to be defined later.

inline CodeIntegrity &flags(uint16_t flags)
inline CodeIntegrity &catalog(uint16_t catalog)
inline CodeIntegrity &catalog_offset(uint32_t catalog_offset)
inline CodeIntegrity &reserved(uint32_t reserved)
virtual void accept(Visitor &visitor) const override

Public Static Functions

static result<CodeIntegrity> parse(Parser &ctx, BinaryStream &stream)

Friends

friend std::ostream &operator<<(std::ostream &os, const CodeIntegrity &entry)

Pogo

class Pogo : public LIEF::PE::Debug

This class represents a Profile Guided Optimization entry from the debug directory (IMAGE_DEBUG_TYPE_POGO).

Public Types

enum class SIGNATURES

Values:

enumerator UNKNOWN = 0x0fffffff
enumerator ZERO = 0x00000000
enumerator LCTG = 0x4C544347
enumerator PGI = 0x50474900
enumerator PGO = 0x50474F00
enumerator PGU = 0x50475500
enumerator SPGO = 0x5350474f
using entries_t = std::vector<PogoEntry>
using it_entries = ref_iterator<entries_t&>
using it_const_entries = const_ref_iterator<const entries_t&>

Public Functions

inline Pogo()
inline Pogo(SIGNATURES sig)
inline Pogo(const details::pe_debug &debug, SIGNATURES sig, Section *sec)
Pogo(const Pogo&) = default
Pogo &operator=(const Pogo&) = default
Pogo(Pogo&&) = default
Pogo &operator=(Pogo&&) = default
inline virtual std::unique_ptr<Debug> clone() const override
inline SIGNATURES signature() const
inline it_entries entries()

An iterator over the different POGO elements.

inline it_const_entries entries() const
inline void add(PogoEntry entry)
virtual void accept(Visitor &visitor) const override
virtual std::string to_string() const override
~Pogo() override = default

Public Static Functions

static inline bool classof(const Debug *debug)

Pogo Entry

class PogoEntry : public LIEF::Object

Public Functions

PogoEntry() = default
PogoEntry(PogoEntry &&other) = default
PogoEntry &operator=(PogoEntry &&other) = default
PogoEntry(const PogoEntry&) = default
inline PogoEntry(uint32_t start_rva, uint32_t size, std::string name)
inline PogoEntry(uint32_t start_rva, uint32_t size)
PogoEntry &operator=(const PogoEntry&) = default
~PogoEntry() override = default
inline uint32_t start_rva() const
inline uint32_t size() const
inline std::string_view name() const
inline void start_rva(uint32_t start_rva)
inline void size(uint32_t size)
inline void name(std::string name)
virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const PogoEntry &entry)

Repro

class Repro : public LIEF::PE::Debug

This class represents a reproducible build entry from the debug directory. (IMAGE_DEBUG_TYPE_REPRO). This entry is usually generated with the undocumented /Brepro linker flag.

See: https://nikhilism.com/post/2020/windows-deterministic-builds/

Public Functions

inline Repro()
inline Repro(std::vector<uint8_t> hash)
inline Repro(const details::pe_debug &dbg, std::vector<uint8_t> hash, Section *sec)
inline Repro(const details::pe_debug &dbg, Section *sec)
Repro(const Repro &other) = default
Repro &operator=(const Repro &other) = default
Repro(Repro&&) = default
Repro &operator=(Repro &&other) = default
inline span<const uint8_t> hash() const

The hash associated with the reproducible build.

inline span<uint8_t> hash()
inline void hash(std::vector<uint8_t> h)
inline virtual std::unique_ptr<Debug> clone() const override
virtual void accept(Visitor &visitor) const override
virtual std::string to_string() const override
~Repro() override = default

Public Static Functions

static inline bool classof(const Debug *debug)

PDBChecksum

class PDBChecksum : public LIEF::PE::Debug

This class represents the PDB Checksum debug entry which is essentially an array of bytes representing the checksum of the PDB content.

Public Types

enum class HASH_ALGO : uint32_t

Values:

enumerator UNKNOWN = 0
enumerator SHA256

Public Functions

inline PDBChecksum(HASH_ALGO algo, std::vector<uint8_t> hash)
inline PDBChecksum(const details::pe_debug &dbg, Section *sec, HASH_ALGO algo, std::vector<uint8_t> hash)
PDBChecksum(const PDBChecksum &other) = default
PDBChecksum &operator=(const PDBChecksum &other) = default
PDBChecksum(PDBChecksum&&) = default
PDBChecksum &operator=(PDBChecksum &&other) = default
inline virtual std::unique_ptr<Debug> clone() const override
inline span<const uint8_t> hash() const

Hash of the PDB content.

inline span<uint8_t> hash()
inline void hash(std::vector<uint8_t> h)
inline HASH_ALGO algorithm() const

Algorithm used for hashing the PDB content.

inline void algorithm(HASH_ALGO algo)
~PDBChecksum() override = default
virtual std::string to_string() const override

Public Static Functions

static std::unique_ptr<PDBChecksum> parse(const details::pe_debug &hdr, Section *section, span<uint8_t> payload)
static inline bool classof(const Debug *debug)

VCFeature

class VCFeature : public LIEF::PE::Debug

This class represents the IMAGE_DEBUG_TYPE_VC_FEATURE debug entry.

Public Functions

inline VCFeature(const details::pe_debug &debug, Section *sec, uint32_t pre_vc, uint32_t c_cpp, uint32_t gs, uint32_t sdl, uint32_t guards)
VCFeature(const VCFeature &other) = default
VCFeature &operator=(const VCFeature &other) = default
VCFeature(VCFeature&&) = default
VCFeature &operator=(VCFeature &&other) = default
inline virtual std::unique_ptr<Debug> clone() const override
inline uint32_t pre_vcpp() const

Count for Pre-VC++ 11.00.

inline uint32_t c_cpp() const

Count for C/C++.

inline uint32_t gs() const

Count for /GS (number of guard stack).

inline uint32_t sdl() const

Whether /sdl was enabled for this binary.

sdl stands for Security Development Lifecycle and provides enhanced security features like changing security-relevant warnings into errors or enforcing guard stack.

inline uint32_t guards() const

Count for /guardN.

inline VCFeature &pre_vcpp(uint32_t value)
inline VCFeature &c_cpp(uint32_t value)
inline VCFeature &gs(uint32_t value)
inline VCFeature &sdl(uint32_t value)
inline VCFeature &guards(uint32_t value)
~VCFeature() override = default
virtual std::string to_string() const override

Public Static Functions

static std::unique_ptr<VCFeature> parse(const details::pe_debug &hdr, Section *section, span<uint8_t> payload)
static inline bool classof(const Debug *debug)

ExDllCharacteristics

class ExDllCharacteristics : public LIEF::PE::Debug

This class represents the IMAGE_DEBUG_TYPE_EX_DLLCHARACTERISTICS debug entry.

Public Types

enum class CHARACTERISTICS : uint32_t

Extended DLL Characteristics.

Values:

enumerator CET_COMPAT = 0x01
enumerator CET_COMPAT_STRICT_MODE = 0x02
enumerator CET_SET_CONTEXT_IP_VALIDATION_RELAXED_MODE = 0x04
enumerator CET_DYNAMIC_APIS_ALLOW_IN_PROC = 0x08
enumerator CET_RESERVED_1 = 0x10
enumerator CET_RESERVED_2 = 0x20
enumerator FORWARD_CFI_COMPAT = 0x40
enumerator HOTPATCH_COMPATIBLE = 0x80

Public Functions

inline ExDllCharacteristics(const details::pe_debug &debug, Section *sec, uint32_t characteristics)
ExDllCharacteristics(const ExDllCharacteristics &other) = default
ExDllCharacteristics &operator=(const ExDllCharacteristics &other) = default
ExDllCharacteristics(ExDllCharacteristics&&) = default
ExDllCharacteristics &operator=(ExDllCharacteristics &&other) = default
inline virtual std::unique_ptr<Debug> clone() const override
inline CHARACTERISTICS characteristics() const

Return the characteristics.

std::vector<CHARACTERISTICS> characteristics_list() const

Characteristics as a vector.

inline bool has(CHARACTERISTICS c) const

Check if the given CHARACTERISTICS is used.

~ExDllCharacteristics() override = default
virtual std::string to_string() const override

Public Static Functions

static std::unique_ptr<ExDllCharacteristics> parse(const details::pe_debug &hdr, Section *section, span<uint8_t> payload)
static inline bool classof(const Debug *debug)

Frame Pointer Omission (FPO)

class FPO : public LIEF::PE::Debug

This class represents the IMAGE_DEBUG_TYPE_FPO debug entry.

Public Types

enum class FRAME_TYPE

Values:

enumerator FPO = 0
enumerator TRAP = 1
enumerator TSS = 2
enumerator NON_FPO = 3
using entries_t = std::vector<entry_t>
using it_entries = ref_iterator<entries_t&>
using it_const_entries = const_ref_iterator<const entries_t&>

Public Functions

inline FPO(const details::pe_debug &hdr, Section *section)
FPO(const FPO &other) = default
FPO &operator=(const FPO &other) = default
FPO(FPO&&) = default
FPO &operator=(FPO &&other) = default
inline virtual std::unique_ptr<Debug> clone() const override
inline it_const_entries entries() const

Iterator over the FPO entries.

inline it_entries entries()
~FPO() override = default
virtual std::string to_string() const override

Public Static Functions

static std::unique_ptr<FPO> parse(const details::pe_debug &hdr, Section *section, span<uint8_t> payload)
static inline bool classof(const Debug *debug)
struct entry_t

Represents the stack frame layout for a x86 function when frame pointer omission (FPO) optimization is used.

Public Functions

std::string to_string() const

Public Members

uint32_t rva = 0

The function RVA.

uint32_t proc_size = 0

The number of bytes in the function.

uint32_t nb_locals = 0

The number of local variables.

uint32_t parameters_size = 0

The size of the parameters.

uint16_t prolog_size = 0

The number of bytes in the function prologue code.

uint16_t nb_saved_regs = 0

Number of registers saved.

bool use_seh = false

Whether the function uses structured exception handling.

bool use_bp = false

Whether the EBP register has been allocated.

uint16_t reserved = 0

Reserved for future use.

FRAME_TYPE type = FRAME_TYPE::FPO

Variable that indicates the frame type.

Friends

inline friend std::ostream &operator<<(std::ostream &os, const entry_t &entry)

Exception Info

class ExceptionInfo

This class is the base class for any exception or runtime function entry.

Subclassed by LIEF::PE::RuntimeFunctionAArch64, LIEF::PE::RuntimeFunctionX64

Public Types

enum class ARCH

Arch discriminator for the subclasses.

Values:

enumerator UNKNOWN = 0
enumerator ARM64
enumerator X86_64

Public Functions

ExceptionInfo() = delete
ExceptionInfo(const ExceptionInfo&) = default
ExceptionInfo &operator=(const ExceptionInfo&) = default
ExceptionInfo(ExceptionInfo&&) = default
ExceptionInfo &operator=(ExceptionInfo&&) = default
virtual std::unique_ptr<ExceptionInfo> clone() const = 0
inline ExceptionInfo(ARCH arch, uint64_t rva)
inline ExceptionInfo(ARCH arch)
inline ARCH arch() const

Target architecture of this exception.

inline uint32_t rva_start() const

Function start address.

inline uint64_t offset() const

Offset in the binary where the raw exception information associated with this entry is defined.

virtual std::string to_string() const = 0
virtual ~ExceptionInfo() = default
template<class T>
inline T *as()

Helper to downcast an ExceptionInfo into a concrete implementation.

template<class T>
inline const T *as() const

Public Static Functions

static std::unique_ptr<ExceptionInfo> parse(Parser &ctx, BinaryStream &strm)
static std::unique_ptr<ExceptionInfo> parse(Parser &ctx, BinaryStream &strm, Header::MACHINE_TYPES arch)

Friends

inline friend std::ostream &operator<<(std::ostream &os, const ExceptionInfo &info)

RuntimeFunctionX64

class RuntimeFunctionX64 : public LIEF::PE::ExceptionInfo

This class represents an entry in the exception table (.pdata section) for the x86-64 architecture.

Reference: https://learn.microsoft.com/en-us/cpp/build/exception-handling-x64

Public Types

enum class UNWIND_FLAGS : uint8_t

Values:

enumerator EXCEPTION_HANDLER = 1

The function has an exception handler that should be called when looking for functions that need to examine exceptions.

enumerator TERMINATE_HANDLER = 2

The function has a termination handler that should be called when unwinding an exception.

enumerator CHAIN_INFO = 4

The chained info payload references a previous RUNTIME_FUNCTION.

enum class UNWIND_OPCODES : uint32_t

Values:

enumerator PUSH_NONVOL = 0

Push a nonvolatile integer register, decrementing RSP by 8. The operation info is the number of the register. Because of the constraints on epilogs, PUSH_NONVOL unwind codes must appear first in the prolog and correspondingly, last in the unwind code array. This relative ordering applies to all other unwind codes except UNWIND_OPCODES::PUSH_MACHFRAME.

enumerator ALLOC_LARGE = 1

Allocate a large-sized area on the stack. There are two forms. If the operation info equals 0, then the size of the allocation divided by 8 is recorded in the next slot, allowing an allocation up to 512K - 8. If the operation info equals 1, then the unscaled size of the allocation is recorded in the next two slots in little-endian format, allowing allocations up to 4GB - 8.

enumerator ALLOC_SMALL = 2

Allocate a small-sized area on the stack. The size of the allocation is the operation info field * 8 + 8, allowing allocations from 8 to 128 bytes.

enumerator SET_FPREG = 3

Establish the frame pointer register by setting the register to some offset of the current RSP. The offset is equal to the Frame Register offset (scaled) field in the UNWIND_INFO * 16, allowing offsets from 0 to 240. The use of an offset permits establishing a frame pointer that points to the middle of the fixed stack allocation, helping code density by allowing more accesses to use short instruction forms. The operation info field is reserved and shouldn’t be used.

enumerator SAVE_NONVOL = 4

Save a nonvolatile integer register on the stack using a MOV instead of a PUSH. This code is primarily used for shrink-wrapping, where a nonvolatile register is saved to the stack in a position that was previously allocated. The operation info is the number of the register. The scaled-by-8 stack offset is recorded in the next unwind operation code slot, as described in the note above.

enumerator SAVE_NONVOL_FAR = 5

Save a nonvolatile integer register on the stack with a long offset, using a MOV instead of a PUSH. This code is primarily used for shrink-wrapping, where a nonvolatile register is saved to the stack in a position that was previously allocated. The operation info is the number of the register. The unscaled stack offset is recorded in the next two unwind operation code slots, as described in the note above.

enumerator EPILOG = 6

This entry is only revelant for version 2. It describes the function epilog.

enumerator SPARE = 7

Reserved Originally SAVE_XMM128_FAR in version 1, but deprecated and removed.

enumerator SAVE_XMM128 = 8

Save all 128 bits of a nonvolatile XMM register on the stack. The operation info is the number of the register. The scaled-by-16 stack offset is recorded in the next slot.

enumerator SAVE_XMM128_FAR = 9

Save all 128 bits of a nonvolatile XMM register on the stack with a long offset. The operation info is the number of the register. The unscaled stack offset is recorded in the next two slots.

enumerator PUSH_MACHFRAME = 10

Push a machine frame. This unwind code is used to record the effect of a hardware interrupt or exception.

enum class UNWIND_REG : uint32_t

Values:

enumerator RAX = 0
enumerator RCX
enumerator RDX
enumerator RBX
enumerator RSP
enumerator RBP
enumerator RSI
enumerator RDI
enumerator R8
enumerator R9
enumerator R10
enumerator R11
enumerator R12
enumerator R13
enumerator R14
enumerator R15

Public Functions

inline RuntimeFunctionX64(uint32_t rva_start, uint32_t rva_end, uint32_t unwind_rva)
RuntimeFunctionX64(const RuntimeFunctionX64&) = default
RuntimeFunctionX64 &operator=(const RuntimeFunctionX64&) = default
RuntimeFunctionX64(RuntimeFunctionX64&&) = default
RuntimeFunctionX64 &operator=(RuntimeFunctionX64&&) = default
inline virtual std::unique_ptr<ExceptionInfo> clone() const override
virtual std::string to_string() const override
inline uint32_t rva_end() const

Function end address.

inline uint32_t unwind_rva() const

Unwind info address.

inline uint32_t size() const

Size of the function (in bytes).

inline const unwind_info_t *unwind_info() const

Detailed unwind information.

inline unwind_info_t *unwind_info()
inline void unwind_info(unwind_info_t info)
~RuntimeFunctionX64() = default

Public Static Functions

static inline bool classof(const ExceptionInfo *info)
struct unwind_info_t

This structure represents the UNWIND_INFO which records the effects a function has on the stack pointer, and where the nonvolatile registers are saved on the stack.

Public Types

using opcodes_t = std::vector<std::unique_ptr<unwind_x64::Code>>

Public Functions

inline bool has(UNWIND_FLAGS flag) const

Check if the given flag is used.

opcodes_t opcodes() const

Enhanced representation of the unwind code.

std::string to_string() const

Pretty representation of this structure as a string.

Public Members

uint8_t version = 0

Version number of the unwind data, currently 1 or 2.

uint8_t flags = 0

See: UNWIND_FLAGS.

uint8_t sizeof_prologue = 0

Length of the function prolog in bytes.

uint8_t count_opcodes = 0

The number of slots in the unwind codes array. Some unwind codes, for example, UNWIND_OPCODES::SAVE_NONVOL, require more than one slot in the array.

uint8_t frame_reg = 0

If nonzero, then the function uses a frame pointer (FP), and this field is the number of the nonvolatile register used as the frame pointer, using the same encoding for the operation info field of UNWIND_OPCODES nodes.

uint8_t frame_reg_offset = 0

If the frame register field is nonzero, this field is the scaled offset from RSP that is applied to the FP register when it’s established.

std::vector<uint8_t> raw_opcodes

An array of items that explains the effect of the prolog on the nonvolatile registers and RSP.

std::optional<uint32_t> handler

An image-relative pointer to either the function’s language-specific exception or termination handler. This value is set if one of these flags is set: UNWIND_FLAGS::EXCEPTION_HANDLER, UNWIND_FLAGS::TERMINATE_HANDLER.

RuntimeFunctionX64 *chained = nullptr

If UNWIND_FLAGS::CHAIN_INFO is set, this attributes references the chained runtime function.

Friends

inline friend std::ostream &operator<<(std::ostream &os, const unwind_info_t &info)

unwind_x64 - Code

class Code

Base class for all unwind operations.

Subclassed by LIEF::PE::unwind_x64::Alloc, LIEF::PE::unwind_x64::Epilog, LIEF::PE::unwind_x64::PushMachFrame, LIEF::PE::unwind_x64::PushNonVol, LIEF::PE::unwind_x64::SaveNonVolatile, LIEF::PE::unwind_x64::SaveXMM128, LIEF::PE::unwind_x64::SetFPReg, LIEF::PE::unwind_x64::Spare

Public Types

using OPCODE = RuntimeFunctionX64::UNWIND_OPCODES
using REG = RuntimeFunctionX64::UNWIND_REG

Public Functions

Code() = delete
Code(const Code&) = default
Code &operator=(const Code&) = default
Code(Code&&) = default
Code &operator=(Code&&) = default
virtual ~Code() = default
inline Code(OPCODE opcode, uint32_t pos)
inline Code(OPCODE opcode)
inline OPCODE opcode() const

The original opcode.

inline uint32_t position() const

Offset in the prolog.

virtual std::string to_string() const

Pretty representation.

Friends

inline friend std::ostream &operator<<(std::ostream &os, const Code &code)

unwind_x64 - Alloc

class Alloc : public LIEF::PE::unwind_x64::Code

This class represents a stack-allocation operation (UNWIND_OPCODES::ALLOC_SMALL or UNWIND_OPCODES::ALLOC_LARGE).

Public Functions

inline Alloc(OPCODE op, size_t pos, uint32_t size)
inline uint32_t size() const

The size allocated.

virtual std::string to_string() const override

Pretty representation.

~Alloc() override = default

Public Static Functions

static inline bool classof(const Code *code)

unwind_x64 - PushNonVol

class PushNonVol : public LIEF::PE::unwind_x64::Code

Push a nonvolatile integer register, decrementing RSP by 8.

Public Functions

PushNonVol() = delete
inline PushNonVol(REG reg, size_t pos)
virtual std::string to_string() const override

Pretty representation.

inline REG reg() const

The register pushed.

~PushNonVol() override = default

Public Static Functions

static inline bool classof(const Code *code)

unwind_x64 - PushMachFrame

class PushMachFrame : public LIEF::PE::unwind_x64::Code

Push a machine frame.

Public Functions

PushMachFrame() = delete
inline PushMachFrame(uint8_t value, size_t pos)
inline uint8_t value() const

0 or 1

virtual std::string to_string() const override

Pretty representation.

~PushMachFrame() override = default

Public Static Functions

static inline bool classof(const Code *code)

unwind_x64 - SetFPReg

class SetFPReg : public LIEF::PE::unwind_x64::Code

Establish the frame pointer register by setting the register to some offset of the current RSP.

Public Functions

SetFPReg() = delete
inline SetFPReg(REG value, size_t pos)
inline REG reg() const

Frame pointer register.

virtual std::string to_string() const override

Pretty representation.

~SetFPReg() override = default

Public Static Functions

static inline bool classof(const Code *code)

unwind_x64 - SaveNonVolatile

class SaveNonVolatile : public LIEF::PE::unwind_x64::Code

Save a nonvolatile integer register on the stack using a MOV instead of a PUSH.

Public Functions

SaveNonVolatile() = delete
inline SaveNonVolatile(OPCODE op, REG value, size_t pos, uint32_t offset)
inline REG reg() const
inline uint32_t offset() const
virtual std::string to_string() const override

Pretty representation.

~SaveNonVolatile() override = default

Public Static Functions

static inline bool classof(const Code *code)

unwind_x64 - SaveXMM128

class SaveXMM128 : public LIEF::PE::unwind_x64::Code

Public Functions

SaveXMM128() = delete
inline SaveXMM128(OPCODE op, uint8_t num, size_t pos, uint32_t offset)
inline uint8_t num() const
inline uint32_t offset() const
virtual std::string to_string() const override

Pretty representation.

~SaveXMM128() override = default

Public Static Functions

static inline bool classof(const Code *code)

unwind_x64 - Epilog

class Epilog : public LIEF::PE::unwind_x64::Code

Describes the function’s epilog.

Public Functions

Epilog() = delete
inline Epilog(uint8_t flags, uint8_t size)
inline uint8_t flags() const
inline uint32_t size() const

Size of the epilog.

virtual std::string to_string() const override

Pretty representation.

~Epilog() override = default

Public Static Functions

static inline bool classof(const Code *code)

unwind_x64 - Spare

class Spare : public LIEF::PE::unwind_x64::Code

Public Functions

inline Spare()
inline virtual std::string to_string() const override

Pretty representation.

~Spare() override = default

Public Static Functions

static inline bool classof(const Code *code)

RuntimeFunctionAArch64

class RuntimeFunctionAArch64 : public LIEF::PE::ExceptionInfo

This class represents an entry in the exception table (.pdata section) for the AArch64 architecture.

Since the ARM64 unwinding info can be encoded in a packed and unpacked format, this class is inherited by LIEF::PE::unwind_aarch64::PackedFunction and LIEF::PE::unwind_aarch64::UnpackedFunction

Reference: https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling#arm64-exception-handling-information

Subclassed by LIEF::PE::unwind_aarch64::PackedFunction, LIEF::PE::unwind_aarch64::UnpackedFunction

Public Types

enum class PACKED_FLAGS

Values:

enumerator UNPACKED = 0
enumerator PACKED = 1
enumerator PACKED_FRAGMENT = 2
enumerator RESERVED = 3

Public Functions

inline RuntimeFunctionAArch64(uint64_t RVA, uint32_t length, PACKED_FLAGS flag)
RuntimeFunctionAArch64(const RuntimeFunctionAArch64&) = default
RuntimeFunctionAArch64 &operator=(const RuntimeFunctionAArch64&) = default
RuntimeFunctionAArch64(RuntimeFunctionAArch64&&) = default
RuntimeFunctionAArch64 &operator=(RuntimeFunctionAArch64&&) = default
inline virtual std::unique_ptr<ExceptionInfo> clone() const override
inline uint32_t length() const

Length of the function in bytes.

inline PACKED_FLAGS flag() const

Flag describing the format the unwind data.

inline uint32_t rva_end() const

Function end address.

virtual std::string to_string() const override
~RuntimeFunctionAArch64() override = default

Public Static Functions

static std::unique_ptr<RuntimeFunctionAArch64> parse(Parser &ctx, BinaryStream &strm)
static inline bool classof(const ExceptionInfo *info)

Runtime AArch64 (Packed) Function

class PackedFunction : public LIEF::PE::RuntimeFunctionAArch64

This class represents a packed AArch64 exception entry.

An excepted entry can be packed if the unwind data fit in 30 bits

Reference: https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling?view=msvc-170#packed-unwind-data

Public Functions

PackedFunction(const PackedFunction&) = default
PackedFunction &operator=(const PackedFunction&) = default
PackedFunction(PackedFunction&&) = default
PackedFunction &operator=(PackedFunction&&) = default
~PackedFunction() override = default
inline virtual std::unique_ptr<ExceptionInfo> clone() const override
virtual std::string to_string() const override
inline uint8_t frame_size() const

Size of the allocated stack.

inline uint8_t reg_I() const

Number of non-volatile INT registers (x19-x28) saved in the canonical stack location.

inline uint8_t reg_F() const

Number of non-volatile FP registers (d8-d15) saved in the canonical stack location.

inline uint8_t H() const

1-bit flag indicating whether the function homes the integer parameter registers (x0-x7) by storing them at the very start of the function. (0 = doesn’t home registers, 1 = homes registers).

inline uint8_t CR() const

Flag indicating whether the function includes extra instructions to set up a frame chain and return link.

inline PackedFunction &frame_size(uint8_t value)
inline PackedFunction &reg_I(uint8_t value)
inline PackedFunction &reg_F(uint8_t value)
inline PackedFunction &H(uint8_t value)
inline PackedFunction &CR(uint8_t value)
inline RuntimeFunctionAArch64(uint64_t RVA, uint32_t length, PACKED_FLAGS flag)
RuntimeFunctionAArch64(const RuntimeFunctionAArch64&) = default
RuntimeFunctionAArch64(RuntimeFunctionAArch64&&) = default

Public Static Functions

static std::unique_ptr<PackedFunction> parse(Parser &ctx, BinaryStream &strm, uint32_t rva, uint32_t unwind_data)
static inline bool classof(const ExceptionInfo *info)

Runtime AArch64 (UnpackedFunction) Function

class UnpackedFunction : public LIEF::PE::RuntimeFunctionAArch64

This class represents an unpacked AArch64 exception entry.

Reference: https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling?view=msvc-170#xdata-records

Public Types

using epilog_scopes_t = std::vector<epilog_scope_t>
using it_epilog_scopes = ref_iterator<epilog_scopes_t&>
using it_const_epilog_scopes = const_ref_iterator<const epilog_scopes_t&>

Public Functions

inline UnpackedFunction(uint32_t rva, uint32_t length)
UnpackedFunction(const UnpackedFunction&) = default
UnpackedFunction &operator=(const UnpackedFunction&) = default
UnpackedFunction(UnpackedFunction&&) = default
UnpackedFunction &operator=(UnpackedFunction&&) = default
~UnpackedFunction() override = default
inline virtual std::unique_ptr<ExceptionInfo> clone() const override
virtual std::string to_string() const override
inline uint32_t xdata_rva() const

RVA where this unpacked data is located (usually pointing in .xdata).

inline uint32_t version() const

Describes the version of the remaining .xdata.

Currently (2025-01-04), only version 0 is defined, so values of 1-3 aren’t permitted.

inline uint8_t X() const

1-bit field that indicates the presence (1) or absence (0) of exception data.

inline uint8_t E() const

1-bit field that indicates that information describing a single epilog is packed into the header (1) rather than requiring more scope words later (0).

inline uint16_t epilog_count() const

If E() == 0, specifies the count of the total number of epilog scopes. Otherwise, return 0

inline uint16_t epilog_offset() const

If E() == 1, index of the first unwind code that describes the one and only epilog.

inline uint32_t code_words() const

Number of 32-bit words needed to contain all of the unwind codes.

inline uint32_t exception_handler() const

Exception handler RVA (if any).

inline span<const uint8_t> unwind_code() const

Bytes that contain the unwind codes.

inline span<uint8_t> unwind_code()
inline bool is_extended() const

Whether it uses 2-words encoding.

inline uint64_t epilog_scopes_offset() const
inline uint64_t unwind_code_offset() const
inline uint64_t exception_handler_offset() const
inline it_epilog_scopes epilog_scopes()

Iterator over the epilog scopes.

inline it_const_epilog_scopes epilog_scopes() const
inline UnpackedFunction &xdata_rva(uint32_t value)
inline UnpackedFunction &version(uint32_t value)
inline UnpackedFunction &X(uint8_t value)
inline UnpackedFunction &E(uint8_t value)
inline UnpackedFunction &epilog_cnt_offset(uint16_t value)
inline UnpackedFunction &code_words(uint32_t value)
inline UnpackedFunction &exception_handler(uint32_t value)
inline UnpackedFunction &epilog_scopes(epilog_scopes_t scopes)
inline UnpackedFunction &unwind_code(std::vector<uint8_t> code)
inline UnpackedFunction &is_extended(bool value)

Public Members

uint32_t epilog_count_
uint32_t epilog_offset_ = 0

Public Static Functions

static std::unique_ptr<UnpackedFunction> parse(Parser &ctx, BinaryStream &strm, uint32_t xdata_rva, uint32_t rva)
static inline bool classof(const ExceptionInfo *info)
struct epilog_scope_t

This structure describes an epilog scope.

Public Members

uint32_t start_offset = 0

Offset of the epilog relatives to the start of the function.

uint16_t start_index = 0

Byte index of the first unwind code that describes this epilog.

uint8_t reserved = 0

Reserved for future expansion. Should be 0.

Public Static Functions

static epilog_scope_t from_raw(uint32_t raw)

Load Configuration

class LoadConfiguration : public LIEF::Object

This class represents the load configuration data associated with the IMAGE_LOAD_CONFIG_DIRECTORY.

This structure is frequently updated by Microsoft to add new metadata.

Reference: https://github.com/MicrosoftDocs/sdk-api/blob/cbeab4d371e8bc7e352c4d3a4c5819caa08c6a1c/sdk-api-src/content/winnt/ns-winnt-image_load_config_directory64.md#L2

Public Types

enum class IMAGE_GUARD : uint32_t

Values:

enumerator NONE = 0x00000000
enumerator CF_INSTRUMENTED = 0x100

Module performs control flow integrity checks using system-supplied support.

enumerator CFW_INSTRUMENTED = 0x200

Module performs control flow and write integrity checks.

enumerator CF_FUNCTION_TABLE_PRESENT = 0x400

Module contains valid control flow target metadata.

enumerator SECURITY_COOKIE_UNUSED = 0x800

Module does not make use of the /GS security cookie.

enumerator PROTECT_DELAYLOAD_IAT = 0x1000

Module supports read only delay load IAT.

enumerator DELAYLOAD_IAT_IN_ITS_OWN_SECTION = 0x2000

Delayload import table in its own .didat section (with nothing else in it) that can be freely reprotected.

enumerator CF_EXPORT_SUPPRESSION_INFO_PRESENT = 0x4000

Module contains suppressed export information. This also infers that the address taken IAT table is also present in the load config.

enumerator CF_ENABLE_EXPORT_SUPPRESSION = 0x8000

Module enables suppression of exports.

enumerator CF_LONGJUMP_TABLE_PRESENT = 0x10000

Module contains longjmp target information.

enumerator RF_INSTRUMENTED = 0x00020000

Module contains return flow instrumentation and metadata.

enumerator RF_ENABLE = 0x00040000

Module requests that the OS enable return flow protection.

enumerator RF_STRICT = 0x00080000

Module requests that the OS enable return flow protection in strict mode.

enumerator RETPOLINE_PRESENT = 0x00100000

Module was built with retpoline support.

enumerator EH_CONTINUATION_TABLE_PRESENT = 0x400000

Module contains EH continuation target information.

enumerator XFG_ENABLED = 0x00800000

Module was built with xfg (deprecated).

enumerator CASTGUARD_PRESENT = 0x01000000

Module has CastGuard instrumentation present.

enumerator MEMCPY_PRESENT = 0x02000000

Module has Guarded Memcpy instrumentation present.

using guard_functions_t = std::vector<guard_function_t>
using it_guard_functions = ref_iterator<guard_functions_t&>
using it_const_guard_functions = const_ref_iterator<const guard_functions_t&>
using dynamic_relocations_t = std::vector<std::unique_ptr<DynamicRelocation>>
using it_dynamic_relocations_t = ref_iterator<dynamic_relocations_t&, DynamicRelocation*>
using it_const_dynamic_relocations_t = const_ref_iterator<const dynamic_relocations_t&, const DynamicRelocation*>

Public Functions

LoadConfiguration()
LoadConfiguration &operator=(const LoadConfiguration&)
LoadConfiguration(const LoadConfiguration&)
LoadConfiguration(LoadConfiguration&&)
LoadConfiguration &operator=(LoadConfiguration&&)
inline uint32_t characteristics() const

Characteristics of the structure which is defined by its size.

inline uint32_t size() const

Size of the current structure.

inline uint32_t timedatestamp() const

The date and time stamp value.

inline uint16_t major_version() const

Major version.

inline uint16_t minor_version() const

Minor version.

inline uint32_t global_flags_clear() const

The global flags that control system behavior. For more information, see Gflags.exe.

inline uint32_t global_flags_set() const

The global flags that control system behavior. For more information, see Gflags.exe.

inline uint32_t critical_section_default_timeout() const

The critical section default time-out value.

inline uint64_t decommit_free_block_threshold() const

The size of the minimum block that must be freed before it is freed (de-committed), in bytes. This value is advisory.

inline uint64_t decommit_total_free_threshold() const

The size of the minimum total memory that must be freed in the process heap before it is freed (de-committed), in bytes. This value is advisory.

inline uint64_t lock_prefix_table() const

The VA of a list of addresses where the LOCK prefix is used. These will be replaced by NOP on single-processor systems. This member is available only for x86.

inline uint64_t maximum_allocation_size() const

The maximum allocation size, in bytes. This member is obsolete and is used only for debugging purposes.

inline uint64_t virtual_memory_threshold() const

The maximum block size that can be allocated from heap segments, in bytes.

inline uint64_t process_affinity_mask() const

The process affinity mask. For more information, see GetProcessAffinityMask. This member is available only for .exe files.

inline uint32_t process_heap_flags() const

The process heap flags. For more information, see HeapCreate.

inline uint16_t csd_version() const

The service pack version.

inline uint16_t reserved1() const

See: dependent_load_flags().

inline uint16_t dependent_load_flags() const

Alias for reserved1().

The default load flags used when the operating system resolves the statically linked imports of a module. For more information, see LoadLibraryEx.

inline uint64_t editlist() const

Reserved for use by the system.

inline uint64_t security_cookie() const

A pointer to a cookie that is used by Visual C++ or GS implementation.

inline std::optional<uint64_t> se_handler_table() const

The VA of the sorted table of RVAs of each valid, unique handler in the image. This member is available only for x86.

inline std::optional<uint64_t> se_handler_count() const

The count of unique handlers in the table. This member is available only for x86.

inline const std::vector<uint32_t> &seh_functions() const

Return the list of the function RVA in the SEH table (if any).

inline std::optional<uint64_t> guard_cf_check_function_pointer() const

The VA where Control Flow Guard check-function pointer is stored.

inline std::optional<uint64_t> guard_cf_dispatch_function_pointer() const

The VA where Control Flow Guard dispatch-function pointer is stored.

inline std::optional<uint64_t> guard_cf_function_table() const

The VA of the sorted table of RVAs of each Control Flow Guard function in the image.

inline std::optional<uint64_t> guard_cf_function_count() const

The count of unique RVAs in the guard_cf_function_table() table.

inline it_const_guard_functions guard_cf_functions() const

Iterator over the Control Flow Guard functions referenced by guard_cf_function_table().

inline it_guard_functions guard_cf_functions()
inline std::optional<uint32_t> guard_flags() const

Control Flow Guard related flags.

inline bool has(IMAGE_GUARD flag) const

Check if the given flag is present.

std::vector<IMAGE_GUARD> guard_cf_flags_list() const

List of flags.

inline const CodeIntegrity *code_integrity() const

Code integrity information.

inline CodeIntegrity *code_integrity()
inline std::optional<uint64_t> guard_address_taken_iat_entry_table() const

The VA where Control Flow Guard address taken IAT table is stored.

inline std::optional<uint64_t> guard_address_taken_iat_entry_count() const

The count of unique RVAs in the table pointed by guard_address_taken_iat_entry_table().

inline it_const_guard_functions guard_address_taken_iat_entries() const

List of RVA pointed by guard_address_taken_iat_entry_table().

inline it_guard_functions guard_address_taken_iat_entries()
inline std::optional<uint64_t> guard_long_jump_target_table() const

The VA where Control Flow Guard long jump target table is stored.

inline std::optional<uint64_t> guard_long_jump_target_count() const

The count of unique RVAs in the table pointed by guard_long_jump_target_table.

inline it_const_guard_functions guard_long_jump_targets() const

List of RVA pointed by guard_address_taken_iat_entry_table().

inline it_guard_functions guard_long_jump_targets()
inline std::optional<uint64_t> dynamic_value_reloc_table() const

VA pointing to a IMAGE_DYNAMIC_RELOCATION_TABLE.

inline it_dynamic_relocations_t dynamic_relocations()

Return an iterator over the Dynamic relocations (DVRT).

inline it_const_dynamic_relocations_t dynamic_relocations() const
inline std::optional<uint64_t> hybrid_metadata_pointer() const

Alias for chpe_metadata_pointer().

inline std::optional<uint64_t> chpe_metadata_pointer() const

VA to the extra Compiled Hybrid Portable Executable (CHPE) metadata.

inline const CHPEMetadata *chpe_metadata() const

Compiled Hybrid Portable Executable (CHPE) metadata (if any).

inline CHPEMetadata *chpe_metadata()
inline std::optional<uint64_t> guard_rf_failure_routine() const

VA of the failure routine.

inline std::optional<uint64_t> guard_rf_failure_routine_function_pointer() const

VA of the failure routine fptr.

inline std::optional<uint32_t> dynamic_value_reloctable_offset() const

Offset of dynamic relocation table relative to the relocation table.

inline std::optional<uint16_t> dynamic_value_reloctable_section() const

The section index of the dynamic value relocation table.

inline std::optional<uint16_t> reserved2() const

Must be zero.

inline std::optional<uint64_t> guard_rf_verify_stackpointer_function_pointer() const

VA of the Function verifying the stack pointer.

inline std::optional<uint32_t> hotpatch_table_offset() const

Offset to the hotpatch table.

inline std::optional<uint32_t> reserved3() const
inline std::optional<uint64_t> enclave_configuration_ptr() const
inline const EnclaveConfiguration *enclave_config() const
inline EnclaveConfiguration *enclave_config()
inline std::optional<uint64_t> volatile_metadata_pointer() const
inline const VolatileMetadata *volatile_metadata() const
inline VolatileMetadata *volatile_metadata()
inline std::optional<uint64_t> guard_eh_continuation_table() const
inline std::optional<uint64_t> guard_eh_continuation_count() const
inline it_const_guard_functions guard_eh_continuation_functions() const
inline it_guard_functions guard_eh_continuation_functions()
inline std::optional<uint64_t> guard_xfg_check_function_pointer() const
inline std::optional<uint64_t> guard_xfg_dispatch_function_pointer() const
inline std::optional<uint64_t> guard_xfg_table_dispatch_function_pointer() const
inline std::optional<uint64_t> cast_guard_os_determined_failure_mode() const
inline std::optional<uint64_t> guard_memcpy_function_pointer() const
inline std::optional<uint64_t> uma_function_pointers() const
inline LoadConfiguration &characteristics(uint32_t characteristics)
inline LoadConfiguration &size(uint32_t value)
inline LoadConfiguration &timedatestamp(uint32_t timedatestamp)
inline LoadConfiguration &major_version(uint16_t major_version)
inline LoadConfiguration &minor_version(uint16_t minor_version)
inline LoadConfiguration &global_flags_clear(uint32_t global_flags_clear)
inline LoadConfiguration &global_flags_set(uint32_t global_flags_set)
inline LoadConfiguration &critical_section_default_timeout(uint32_t critical_section_default_timeout)
inline LoadConfiguration &decommit_free_block_threshold(uint64_t decommit_free_block_threshold)
inline LoadConfiguration &decommit_total_free_threshold(uint64_t decommit_total_free_threshold)
inline LoadConfiguration &lock_prefix_table(uint64_t lock_prefix_table)
inline LoadConfiguration &maximum_allocation_size(uint64_t maximum_allocation_size)
inline LoadConfiguration &virtual_memory_threshold(uint64_t virtual_memory_threshold)
inline LoadConfiguration &process_affinity_mask(uint64_t process_affinity_mask)
inline LoadConfiguration &process_heap_flags(uint32_t process_heap_flagsid)
inline LoadConfiguration &csd_version(uint16_t csd_version)
inline LoadConfiguration &reserved1(uint16_t reserved1)
inline LoadConfiguration &dependent_load_flags(uint16_t flags)
inline LoadConfiguration &editlist(uint64_t editlist)
inline LoadConfiguration &security_cookie(uint64_t security_cookie)
inline LoadConfiguration &se_handler_table(uint64_t se_handler_table)
inline LoadConfiguration &se_handler_count(uint64_t se_handler_count)
inline LoadConfiguration &guard_cf_check_function_pointer(uint64_t check_pointer)
inline LoadConfiguration &guard_cf_dispatch_function_pointer(uint64_t dispatch_pointer)
inline LoadConfiguration &guard_cf_function_table(uint64_t guard_cf_function_table)
inline LoadConfiguration &guard_cf_function_count(uint64_t guard_cf_function_count)
inline LoadConfiguration &guard_flags(IMAGE_GUARD flags)
inline LoadConfiguration &guard_flags(uint32_t flags)
inline LoadConfiguration &code_integrity(CodeIntegrity CI)
inline LoadConfiguration &guard_address_taken_iat_entry_table(uint64_t value)
inline LoadConfiguration &guard_address_taken_iat_entry_count(uint64_t value)
inline LoadConfiguration &guard_long_jump_target_table(uint64_t value)
inline LoadConfiguration &guard_long_jump_target_count(uint64_t value)
inline LoadConfiguration &dynamic_value_reloc_table(uint64_t value)
inline LoadConfiguration &hybrid_metadata_pointer(uint64_t value)
inline LoadConfiguration &guard_rf_failure_routine(uint64_t value)
inline LoadConfiguration &guard_rf_failure_routine_function_pointer(uint64_t value)
inline LoadConfiguration &dynamic_value_reloctable_offset(uint32_t value)
inline LoadConfiguration &dynamic_value_reloctable_section(uint16_t value)
inline LoadConfiguration &reserved2(uint16_t value)
inline LoadConfiguration &guard_rf_verify_stackpointer_function_pointer(uint64_t value)
inline LoadConfiguration &hotpatch_table_offset(uint32_t value)
inline LoadConfiguration &reserved3(uint32_t value)
inline LoadConfiguration &enclave_configuration_ptr(uint64_t value)
inline LoadConfiguration &volatile_metadata_pointer(uint64_t value)
inline LoadConfiguration &guard_eh_continuation_table(uint64_t value)
inline LoadConfiguration &guard_eh_continuation_count(uint64_t value)
inline LoadConfiguration &guard_xfg_check_function_pointer(uint64_t value)
inline LoadConfiguration &guard_xfg_dispatch_function_pointer(uint64_t value)
inline LoadConfiguration &guard_xfg_table_dispatch_function_pointer(uint64_t value)
inline LoadConfiguration &cast_guard_os_determined_failure_mode(uint64_t value)
inline LoadConfiguration &guard_memcpy_function_pointer(uint64_t value)
inline LoadConfiguration &uma_function_pointers(uint64_t value)
~LoadConfiguration() override
virtual void accept(Visitor &visitor) const override
std::string to_string() const

Public Static Functions

template<class PE_T>
static std::unique_ptr<LoadConfiguration> parse(Parser &ctx, BinaryStream &stream)

Friends

friend class Parser
inline friend std::ostream &operator<<(std::ostream &os, const LoadConfiguration &config)
struct guard_function_t

Public Members

uint32_t rva = 0
uint32_t extra = 0

CHPEMetadata

class CHPEMetadata

Base class for any Compiled Hybrid Portable Executable (CHPE) metadata.

This class is inherited by architecture-specific implementation.

Subclassed by LIEF::PE::CHPEMetadataARM64, LIEF::PE::CHPEMetadataX86

Public Types

enum class KIND

Discriminator for the subclasses.

Values:

enumerator UNKNOWN = 0
enumerator ARM64
enumerator X86

Public Functions

CHPEMetadata() = default
inline CHPEMetadata(KIND kind, uint32_t version)
CHPEMetadata(const CHPEMetadata&) = default
CHPEMetadata &operator=(const CHPEMetadata&) = default
CHPEMetadata(CHPEMetadata&&) = default
CHPEMetadata &operator=(CHPEMetadata&&) = default
inline virtual std::unique_ptr<CHPEMetadata> clone() const
inline KIND kind() const

Determine the type of the concrete implementation.

inline uint32_t version() const

Version of the structure.

inline virtual std::string to_string() const
template<class T>
inline T *as()
template<class T>
inline const T *as() const
virtual ~CHPEMetadata() = default

Public Static Functions

static std::unique_ptr<CHPEMetadata> parse(Parser &ctx, BinaryStream &stream)

Friends

inline friend std::ostream &operator<<(std::ostream &os, const CHPEMetadata &meta)

CHPEMetadata (ARM64)

class CHPEMetadataARM64 : public LIEF::PE::CHPEMetadata

This class represents ARM64-specific metadata used in CHPE (Compatible Hybrid PE) binaries, particularly for hybrid architectures like ARM64EC and ARM64X.

It extends the CHPEMetadata base class and provides access to metadata describing code ranges, redirections, entry points, and other hybrid-specific information relevant for binary analysis or instrumentation.

Public Types

using range_entries_t = std::vector<range_entry_t>
using it_range_entries = ref_iterator<range_entries_t&>
using it_const_range_entries = const_ref_iterator<const range_entries_t&>
using redirection_entries_t = std::vector<redirection_entry_t>
using it_redirection_entries = ref_iterator<redirection_entries_t&>
using it_const_redirection_entries = const_ref_iterator<const redirection_entries_t&>
using code_range_entry_point_entries = std::vector<code_range_entry_point_t>
using it_code_range_entry_point = ref_iterator<code_range_entry_point_entries&>
using it_const_code_range_entry_point = const_ref_iterator<const code_range_entry_point_entries&>

Public Functions

inline CHPEMetadataARM64(uint32_t version)
CHPEMetadataARM64(const CHPEMetadataARM64&) = default
CHPEMetadataARM64 &operator=(const CHPEMetadataARM64&) = default
CHPEMetadataARM64(CHPEMetadataARM64&&) = default
CHPEMetadataARM64 &operator=(CHPEMetadataARM64&&) = default
inline virtual std::unique_ptr<CHPEMetadata> clone() const override
inline uint32_t code_map() const

RVA to the array that describes architecture-specific ranges.

inline uint32_t code_map_count() const

Number of entries in the code map.

inline uint32_t code_ranges_to_entrypoints() const
inline uint32_t redirection_metadata() const
inline uint32_t os_arm64x_dispatch_call_no_redirect() const
inline uint32_t os_arm64x_dispatch_ret() const
inline uint32_t os_arm64x_dispatch_call() const
inline uint32_t os_arm64x_dispatch_icall() const
inline uint32_t os_arm64x_dispatch_icall_cfg() const
inline uint32_t alternate_entry_point() const
inline uint32_t auxiliary_iat() const
inline uint32_t code_ranges_to_entry_points_count() const
inline uint32_t redirection_metadata_count() const
inline uint32_t get_x64_information_function_pointer() const
inline uint32_t set_x64_information_function_pointer() const
inline uint32_t extra_rfe_table() const

RVA to this architecture-specific exception table.

inline uint32_t extra_rfe_table_size() const

architecture-specific exception table size

inline uint32_t os_arm64x_dispatch_fptr() const
inline uint32_t auxiliary_iat_copy() const
inline uint32_t auxiliary_delay_import() const
inline uint32_t auxiliary_delay_import_copy() const
inline uint32_t bitfield_info() const
inline it_range_entries code_ranges()
inline it_const_range_entries code_ranges() const
inline it_redirection_entries redirections()
inline it_const_redirection_entries redirections() const
inline it_code_range_entry_point code_range_entry_point()
inline it_const_code_range_entry_point code_range_entry_point() const
inline CHPEMetadataARM64 &code_map(uint32_t value)
inline CHPEMetadataARM64 &code_map_count(uint32_t value)
inline CHPEMetadataARM64 &code_ranges_to_entrypoints(uint32_t value)
inline CHPEMetadataARM64 &redirection_metadata(uint32_t value)
inline CHPEMetadataARM64 &os_arm64x_dispatch_call_no_redirect(uint32_t value)
inline CHPEMetadataARM64 &os_arm64x_dispatch_ret(uint32_t value)
inline CHPEMetadataARM64 &os_arm64x_dispatch_call(uint32_t value)
inline CHPEMetadataARM64 &os_arm64x_dispatch_icall(uint32_t value)
inline CHPEMetadataARM64 &os_arm64x_dispatch_icall_cfg(uint32_t value)
inline CHPEMetadataARM64 &alternate_entry_point(uint32_t value)
inline CHPEMetadataARM64 &auxiliary_iat(uint32_t value)
inline CHPEMetadataARM64 &code_ranges_to_entry_points_count(uint32_t value)
inline CHPEMetadataARM64 &redirection_metadata_count(uint32_t value)
inline CHPEMetadataARM64 &get_x64_information_function_pointer(uint32_t value)
inline CHPEMetadataARM64 &set_x64_information_function_pointer(uint32_t value)
inline CHPEMetadataARM64 &extra_rfe_table(uint32_t value)
inline CHPEMetadataARM64 &extra_rfe_table_size(uint32_t value)
inline CHPEMetadataARM64 &os_arm64x_dispatch_fptr(uint32_t value)
inline CHPEMetadataARM64 &auxiliary_iat_copy(uint32_t value)
inline CHPEMetadataARM64 &auxiliary_delay_import(uint32_t value)
inline CHPEMetadataARM64 &auxiliary_delay_import_copy(uint32_t value)
inline CHPEMetadataARM64 &bitfield_info(uint32_t value)
virtual std::string to_string() const override
~CHPEMetadataARM64() override = default

Public Static Functions

static std::unique_ptr<CHPEMetadataARM64> parse(Parser &ctx, BinaryStream &stream, uint32_t version)
static ok_error_t parse_code_map(Parser &ctx, CHPEMetadataARM64 &metadata)
static ok_error_t parse_redirections(Parser &ctx, CHPEMetadataARM64 &metadata)
static ok_error_t parse_code_ranges_to_entry_points(Parser &ctx, CHPEMetadataARM64 &metadata)
static inline bool classof(const CHPEMetadata *meta)
struct range_entry_t

Structure that describes architecture-specific ranges.

Public Types

enum class TYPE

Values:

enumerator ARM64 = 0

Pure ARM64 code.

enumerator ARM64EC = 1

ARM64EC hybrid code (compatible with x64).

enumerator AMD64 = 2

x64 code.

Public Functions

inline uint32_t start() const

Start of the range (RVA).

inline TYPE type() const

Architecture for this range.

inline uint32_t end() const

End of the range (RVA).

Public Members

uint32_t start_offset = 0

Raw data (include start RVA and type).

uint32_t length = 0

Range’s length.

Public Static Attributes

static uint32_t TYPE_MASK = 3
struct redirection_entry_t

Structure that describes a redirection.

Public Members

uint32_t src = 0
uint32_t dst = 0
struct code_range_entry_point_t

Mirror of IMAGE_ARM64EC_CODE_RANGE_ENTRY_POINT: Represents a mapping between code range and its entry point.

Public Members

uint32_t start_rva = 0

Start of the code range.

uint32_t end_rva = 0

End of the code range (RVA).

uint32_t entrypoint = 0

RVA of the entry point for this range.

CHPEMetadata (X86)

class CHPEMetadataX86 : public LIEF::PE::CHPEMetadata

This class represents hybrid metadata for X86.

Public Functions

inline CHPEMetadataX86(uint32_t version)
CHPEMetadataX86(const CHPEMetadataX86&) = default
CHPEMetadataX86 &operator=(const CHPEMetadataX86&) = default
CHPEMetadataX86(CHPEMetadataX86&&) = default
CHPEMetadataX86 &operator=(CHPEMetadataX86&&) = default
inline virtual std::unique_ptr<CHPEMetadata> clone() const override
inline uint32_t chpe_code_address_range_offset() const
inline uint32_t chpe_code_address_range_count() const
inline uint32_t wowa64_exception_handler_function_pointer() const
inline uint32_t wowa64_dispatch_call_function_pointer() const
inline uint32_t wowa64_dispatch_indirect_call_function_pointer() const
inline uint32_t wowa64_dispatch_indirect_call_cfg_function_pointer() const
inline uint32_t wowa64_dispatch_ret_function_pointer() const
inline uint32_t wowa64_dispatch_ret_leaf_function_pointer() const
inline uint32_t wowa64_dispatch_jump_function_pointer() const
inline std::optional<uint32_t> compiler_iat_pointer() const
inline std::optional<uint32_t> wowa64_rdtsc_function_pointer() const
inline CHPEMetadataX86 &chpe_code_address_range_offset(uint32_t value)
inline CHPEMetadataX86 &chpe_code_address_range_count(uint32_t value)
inline CHPEMetadataX86 &wowa64_exception_handler_function_pointer(uint32_t value)
inline CHPEMetadataX86 &wowa64_dispatch_call_function_pointer(uint32_t value)
inline CHPEMetadataX86 &wowa64_dispatch_indirect_call_function_pointer(uint32_t value)
inline CHPEMetadataX86 &wowa64_dispatch_indirect_call_cfg_function_pointer(uint32_t value)
inline CHPEMetadataX86 &wowa64_dispatch_ret_function_pointer(uint32_t value)
inline CHPEMetadataX86 &wowa64_dispatch_ret_leaf_function_pointer(uint32_t value)
inline CHPEMetadataX86 &wowa64_dispatch_jump_function_pointer(uint32_t value)
inline CHPEMetadataX86 &compiler_iat_pointer(uint32_t value)
inline CHPEMetadataX86 &wowa64_rdtsc_function_pointer(uint32_t value)
virtual std::string to_string() const override
~CHPEMetadataX86() override = default

Public Static Functions

static std::unique_ptr<CHPEMetadataX86> parse(Parser &ctx, BinaryStream &stream, uint32_t version)
static inline bool classof(const CHPEMetadata *meta)

DynamicRelocation

class DynamicRelocation

This is the base class for any IMAGE_DYNAMIC_RELOCATION32, IMAGE_DYNAMIC_RELOCATION32_V2, IMAGE_DYNAMIC_RELOCATION64, IMAGE_DYNAMIC_RELOCATION64_V2 dynamic relocations.

Subclassed by LIEF::PE::DynamicRelocationV1, LIEF::PE::DynamicRelocationV2

Public Types

enum IMAGE_DYNAMIC_RELOCATION

Special symbol values as defined in link.exe - GetDVRTSpecialSymbolName.

Values:

enumerator RELOCATION_GUARD_RF_PROLOGUE = 1

Mirror IMAGE_DYNAMIC_RELOCATION_GUARD_RF_PROLOGUE.

enumerator RELOCATION_GUARD_RF_EPILOGUE = 2

Mirror IMAGE_DYNAMIC_RELOCATION_GUARD_RF_EPILOGUE.

enumerator RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER = 3

Mirror IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER.

enumerator RELOCATION_GUARD_INDIR_CONTROL_TRANSFER = 4

Mirror IMAGE_DYNAMIC_RELOCATION_GUARD_INDIR_CONTROL_TRANSFER.

enumerator RELOCATION_GUARD_SWITCHTABLE_BRANCH = 5

Mirror IMAGE_DYNAMIC_RELOCATION_GUARD_SWITCHTABLE_BRANCH.

enumerator RELOCATION_ARM64X = 6

Mirror IMAGE_DYNAMIC_RELOCATION_ARM64X.

enumerator RELOCATION_FUNCTION_OVERRIDE = 7

Mirror IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE.

enumerator RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER = 8

Mirror IMAGE_DYNAMIC_RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER.

enumerator _RELOC_LAST_ENTRY

Public Functions

DynamicRelocation() = delete
DynamicRelocation(uint32_t version)
DynamicRelocation(const DynamicRelocation&)
DynamicRelocation &operator=(const DynamicRelocation&)
DynamicRelocation(DynamicRelocation&&)
DynamicRelocation &operator=(DynamicRelocation&&)
virtual std::unique_ptr<DynamicRelocation> clone() const = 0
inline uint32_t version() const

Version of the structure.

inline uint64_t symbol() const

Symbol address. Some values have a special meaning (c.f. IMAGE_DYNAMIC_RELOCATION) and define how fixups are encoded.

inline const DynamicFixup *fixups() const
inline DynamicFixup *fixups()

Return fixups information, where the interpretation may depend on the symbol’s value.

inline DynamicRelocation &symbol(uint64_t value)
DynamicRelocation &fixups(std::unique_ptr<DynamicFixup> F)
virtual std::string to_string() const = 0
template<class T>
inline T *as()
template<class T>
inline const T *as() const
virtual ~DynamicRelocation()

Friends

inline friend std::ostream &operator<<(std::ostream &os, const DynamicRelocation &reloc)

DynamicRelocationV1

class DynamicRelocationV1 : public LIEF::PE::DynamicRelocation

This class represents a dynamic relocation (IMAGE_DYNAMIC_RELOCATION32 or IMAGE_DYNAMIC_RELOCATION64).

Public Functions

inline DynamicRelocationV1()
DynamicRelocationV1(const DynamicRelocationV1&) = default
DynamicRelocationV1 &operator=(const DynamicRelocationV1&) = default
DynamicRelocationV1(DynamicRelocationV1&&) = default
DynamicRelocationV1 &operator=(DynamicRelocationV1&&) = default
inline virtual std::unique_ptr<DynamicRelocation> clone() const override
virtual std::string to_string() const override
~DynamicRelocationV1() override = default

Public Static Functions

static inline bool classof(const DynamicRelocation *reloc)

DynamicRelocationV2

class DynamicRelocationV2 : public LIEF::PE::DynamicRelocation

This class represents a dynamic relocation (IMAGE_DYNAMIC_RELOCATION64_V2 or IMAGE_DYNAMIC_RELOCATION32_V2).

Public Functions

inline DynamicRelocationV2()
DynamicRelocationV2(const DynamicRelocationV2&) = default
DynamicRelocationV2 &operator=(const DynamicRelocationV2&) = default
DynamicRelocationV2(DynamicRelocationV2&&) = default
DynamicRelocationV2 &operator=(DynamicRelocationV2&&) = default
inline virtual std::unique_ptr<DynamicRelocation> clone() const override
virtual std::string to_string() const override
~DynamicRelocationV2() override = default

Public Static Functions

static inline bool classof(const DynamicRelocation *reloc)

DynamicFixup

class DynamicFixup

This is the base class for any fixups located in DynamicRelocation.

Subclassed by LIEF::PE::DynamicFixupARM64Kernel, LIEF::PE::DynamicFixupARM64X, LIEF::PE::DynamicFixupControlTransfer, LIEF::PE::DynamicFixupGeneric, LIEF::PE::DynamicFixupUnknown, LIEF::PE::FunctionOverride

Public Types

enum KIND

Values:

enumerator UNKNOWN = 0

If DynamicRelocation::symbol is a special value that is not supported by LIEF.

enumerator GENERIC

If DynamicRelocation::symbol is not a special value.

enumerator ARM64X

If DynamicRelocation::symbol is set to IMAGE_DYNAMIC_RELOCATION_ARM64X.

enumerator FUNCTION_OVERRIDE

If DynamicRelocation::symbol is set to IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE.

enumerator ARM64_KERNEL_IMPORT_CALL_TRANSFER

If DynamicRelocation::symbol is set to IMAGE_DYNAMIC_RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER.

enumerator GUARD_IMPORT_CONTROL_TRANSFER

If DynamicRelocation::symbol is set to IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER.

Public Functions

DynamicFixup() = delete
inline DynamicFixup(KIND kind)
DynamicFixup(const DynamicFixup&) = default
DynamicFixup &operator=(const DynamicFixup&) = default
DynamicFixup(DynamicFixup&&) = default
DynamicFixup &operator=(DynamicFixup&&) = default
virtual std::unique_ptr<DynamicFixup> clone() const = 0
virtual std::string to_string() const = 0
inline KIND kind() const

Encoding of the fixups.

template<class T>
inline T *as()
template<class T>
inline const T *as() const
virtual ~DynamicFixup() = default

Friends

inline friend std::ostream &operator<<(std::ostream &os, const DynamicFixup &fixup)

DynamicFixupControlTransfer

class DynamicFixupControlTransfer : public LIEF::PE::DynamicFixup

This class wraps fixups associated with the (special) symbol value: IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER (3).

Public Types

using reloc_entries_t = std::vector<reloc_entry_t>
using it_relocations = ref_iterator<reloc_entries_t&>
using it_const_relocations = const_ref_iterator<const reloc_entries_t&>

Public Functions

inline DynamicFixupControlTransfer()
DynamicFixupControlTransfer(const DynamicFixupControlTransfer&) = default
DynamicFixupControlTransfer &operator=(const DynamicFixupControlTransfer&) = default
DynamicFixupControlTransfer(DynamicFixupControlTransfer&&) = default
DynamicFixupControlTransfer &operator=(DynamicFixupControlTransfer&&) = default
inline virtual std::unique_ptr<DynamicFixup> clone() const override
virtual std::string to_string() const override
inline it_relocations relocations()

Iterator over the relocations.

inline it_const_relocations relocations() const
~DynamicFixupControlTransfer() override = default

Public Static Functions

static inline bool classof(const DynamicFixup *fixup)

Public Static Attributes

static auto NO_IAT_INDEX = 0x7fff
struct reloc_entry_t

Mirror IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION.

Public Functions

std::string to_string() const

Public Members

uint32_t rva = 0

RVA to the call instruction.

bool is_call = false

True if target instruction is a call, false otherwise.

uint16_t iat_index = NO_IAT_INDEX

IAT index of the corresponding import. 0x7FFF is a special value indicating no index.

Friends

inline friend std::ostream &operator<<(std::ostream &os, const reloc_entry_t &entry)

DynamicFixupARM64Kernel

class DynamicFixupARM64Kernel : public LIEF::PE::DynamicFixup

This class wraps fixups associated with the (special) symbol value: IMAGE_DYNAMIC_RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER (8).

Public Types

enum class IMPORT_TYPE : uint8_t

Values:

enumerator STATIC = 0
enumerator DELAYED = 1
using reloc_entries_t = std::vector<reloc_entry_t>
using it_relocations = ref_iterator<reloc_entries_t&>
using it_const_relocations = const_ref_iterator<const reloc_entries_t&>

Public Functions

inline DynamicFixupARM64Kernel()
DynamicFixupARM64Kernel(const DynamicFixupARM64Kernel&) = default
DynamicFixupARM64Kernel &operator=(const DynamicFixupARM64Kernel&) = default
DynamicFixupARM64Kernel(DynamicFixupARM64Kernel&&) = default
DynamicFixupARM64Kernel &operator=(DynamicFixupARM64Kernel&&) = default
inline virtual std::unique_ptr<DynamicFixup> clone() const override
virtual std::string to_string() const override
inline it_relocations relocations()

Iterator over the relocations.

inline it_const_relocations relocations() const
~DynamicFixupARM64Kernel() override = default

Public Static Functions

static inline bool classof(const DynamicFixup *fixup)

Public Static Attributes

static auto NO_IAT_INDEX = 0x7fff
struct reloc_entry_t

Mirror IMAGE_IMPORT_CONTROL_TRANSFER_ARM64_RELOCATION.

Public Functions

std::string to_string() const

Public Members

uint32_t rva = 0

RVA to the call instruction.

bool indirect_call = false

True if target instruction is a blr, false if it’s a br.

uint8_t register_index = 0

Register index used for the indirect call/jump. For instance, if the instruction is br x3, this index is set to 3.

IMPORT_TYPE import_type = IMPORT_TYPE::STATIC

See IMPORT_TYPE.

uint16_t iat_index = NO_IAT_INDEX

IAT index of the corresponding import. 0x7FFF is a special value indicating no index.

Friends

inline friend std::ostream &operator<<(std::ostream &os, const reloc_entry_t &entry)

DynamicFixupARM64X

class DynamicFixupARM64X : public LIEF::PE::DynamicFixup

This class represents IMAGE_DYNAMIC_RELOCATION_ARM64X.

Public Types

enum class FIXUP_TYPE

Values:

enumerator ZEROFILL = 0
enumerator VALUE = 1
enumerator DELTA = 2
using reloc_entries_t = std::vector<reloc_entry_t>
using it_relocations = ref_iterator<reloc_entries_t&>
using it_const_relocations = const_ref_iterator<const reloc_entries_t&>

Public Functions

inline DynamicFixupARM64X()
DynamicFixupARM64X(const DynamicFixupARM64X&) = default
DynamicFixupARM64X &operator=(const DynamicFixupARM64X&) = default
DynamicFixupARM64X(DynamicFixupARM64X&&) = default
DynamicFixupARM64X &operator=(DynamicFixupARM64X&&) = default
inline virtual std::unique_ptr<DynamicFixup> clone() const override
virtual std::string to_string() const override
inline it_relocations relocations()

Iterator over the different fixup entries.

inline it_const_relocations relocations() const
~DynamicFixupARM64X() override = default

Public Static Functions

static inline bool classof(const DynamicFixup *fixup)
struct reloc_entry_t

Public Functions

std::string to_string() const

Public Members

uint32_t rva = 0

RVA where the fixup takes place.

FIXUP_TYPE type = FIXUP_TYPE::ZEROFILL

Fixup’s kind.

size_t size = 0

Size of the value to patch.

std::vector<uint8_t> bytes

If the type is FIXUP_TYPE::VALUE, the bytes associated to the fixup entry.

int64_t value = 0

If the type is FIXUP_TYPE::DELTA, the (signed) value.

Friends

inline friend std::ostream &operator<<(std::ostream &os, const reloc_entry_t &entry)

DynamicFixupGeneric

class DynamicFixupGeneric : public LIEF::PE::DynamicFixup

This class represents a generic entry where fixups are regular relocations (LIEF::PE::Relocation).

Public Types

using relocations_t = std::vector<std::unique_ptr<Relocation>>
using it_relocations = ref_iterator<relocations_t&, Relocation*>
using it_const_relocations = const_ref_iterator<const relocations_t&, Relocation*>

Public Functions

DynamicFixupGeneric()
DynamicFixupGeneric(const DynamicFixupGeneric&)
DynamicFixupGeneric &operator=(const DynamicFixupGeneric&)
DynamicFixupGeneric(DynamicFixupGeneric&&)
DynamicFixupGeneric &operator=(DynamicFixupGeneric&&)
inline virtual std::unique_ptr<DynamicFixup> clone() const override
inline it_relocations relocations()

Iterator over the relocations.

inline it_const_relocations relocations() const
virtual std::string to_string() const override
~DynamicFixupGeneric() override

Public Static Functions

static inline bool classof(const DynamicFixup *fixup)

DynamicFixupUnknown

class DynamicFixupUnknown : public LIEF::PE::DynamicFixup

This class represents a special dynamic relocation where the format of the fixups is not supported by LIEF.

Public Functions

inline DynamicFixupUnknown(std::vector<uint8_t> payload)
DynamicFixupUnknown(const DynamicFixupUnknown&) = default
DynamicFixupUnknown &operator=(const DynamicFixupUnknown&) = default
DynamicFixupUnknown(DynamicFixupUnknown&&) = default
DynamicFixupUnknown &operator=(DynamicFixupUnknown&&) = default
inline virtual std::unique_ptr<DynamicFixup> clone() const override
inline virtual std::string to_string() const override
inline span<const uint8_t> payload() const

Raw fixups.

inline span<uint8_t> payload()
~DynamicFixupUnknown() override = default

Public Static Functions

static inline bool classof(const DynamicFixup *fixup)

FunctionOverride

class FunctionOverride : public LIEF::PE::DynamicFixup

This class represents IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE.

Public Types

using func_overriding_info_t = std::vector<std::unique_ptr<FunctionOverrideInfo>>
using it_func_overriding_info = ref_iterator<func_overriding_info_t&, FunctionOverrideInfo*>
using it_const_func_overriding_info = const_ref_iterator<const func_overriding_info_t&, const FunctionOverrideInfo*>
using bdd_info_list_t = std::vector<image_bdd_info_t>
using it_bdd_info = ref_iterator<bdd_info_list_t&>
using it_const_bdd_info = const_ref_iterator<const bdd_info_list_t&>

Public Functions

FunctionOverride()
FunctionOverride(const FunctionOverride&)
FunctionOverride &operator=(const FunctionOverride&)
FunctionOverride(FunctionOverride&&)
FunctionOverride &operator=(FunctionOverride&&)
inline virtual std::unique_ptr<DynamicFixup> clone() const override
inline it_func_overriding_info func_overriding_info()

Iterator over the overriding info.

inline it_const_func_overriding_info func_overriding_info() const
inline it_bdd_info bdd_info()

Iterator over the BDD info.

inline it_const_bdd_info bdd_info() const
image_bdd_info_t *find_bdd_info(uint32_t offset)

Find the IMAGE_BDD_INFO at the given offset.

image_bdd_info_t *find_bdd_info(const FunctionOverrideInfo &info)

Find the IMAGE_BDD_INFO associated with the given info.

inline const image_bdd_info_t *find_bdd_info(uint32_t offset) const
inline const image_bdd_info_t *find_bdd_info(const FunctionOverrideInfo &info) const
virtual std::string to_string() const override
~FunctionOverride() override

Public Static Functions

static inline bool classof(const DynamicFixup *fixup)
struct image_bdd_dynamic_relocation_t

Mirror IMAGE_BDD_DYNAMIC_RELOCATION.

Public Members

uint16_t left = 0
uint16_t right = 0
uint32_t value = 0
struct image_bdd_info_t

Mirror IMAGE_BDD_INFO.

Public Members

uint32_t version = 0
uint32_t original_size = 0
uint32_t original_offset = 0
std::vector<image_bdd_dynamic_relocation_t> relocations

If version == 1.

std::vector<uint8_t> payload

If version != 1.

FunctionOverrideInfo

class FunctionOverrideInfo

Public Types

using relocations_t = std::vector<std::unique_ptr<Relocation>>
using it_relocations = ref_iterator<relocations_t&, Relocation*>
using it_const_relocations = const_ref_iterator<const relocations_t&, const Relocation*>

Public Functions

FunctionOverrideInfo() = default
FunctionOverrideInfo(uint32_t original_rva, uint32_t bdd_offset, uint32_t base_reloc_size)
FunctionOverrideInfo(const FunctionOverrideInfo&)
FunctionOverrideInfo &operator=(const FunctionOverrideInfo&)
FunctionOverrideInfo(FunctionOverrideInfo&&)
FunctionOverrideInfo &operator=(FunctionOverrideInfo&&)
std::string to_string() const
inline uint32_t original_rva() const

RVA of the original function.

inline uint32_t bdd_offset() const

Offset into the BDD region.

inline uint32_t rva_size() const

Size in bytes taken by RVAs.

inline uint32_t base_reloc_size() const

Size in bytes taken by BaseRelocs.

inline const std::vector<uint32_t> &functions_rva() const
inline it_relocations relocations()
inline it_const_relocations relocations() const
inline FunctionOverrideInfo &original_rva(uint32_t value)
inline FunctionOverrideInfo &bdd_offset(uint32_t value)
inline FunctionOverrideInfo &base_reloc_size(uint32_t value)
inline FunctionOverrideInfo &overriding_funcs(std::vector<uint32_t> funcs)
~FunctionOverrideInfo()

Friends

inline friend std::ostream &operator<<(std::ostream &os, const FunctionOverrideInfo &info)

EnclaveConfiguration

class EnclaveConfiguration

This class represents the enclave configuration.

Public Types

using id_array_t = std::array<uint8_t, 16>
using imports_t = std::vector<EnclaveImport>
using it_imports = ref_iterator<imports_t&>
using it_const_imports = const_ref_iterator<const imports_t&>

Public Functions

EnclaveConfiguration() = default
EnclaveConfiguration(const EnclaveConfiguration&) = default
EnclaveConfiguration &operator=(const EnclaveConfiguration&) = default
EnclaveConfiguration(EnclaveConfiguration&&) = default
EnclaveConfiguration &operator=(EnclaveConfiguration&&) = default
inline std::unique_ptr<EnclaveConfiguration> clone() const
inline uint32_t size() const

The size of the IMAGE_ENCLAVE_CONFIG64/IMAGE_ENCLAVE_CONFIG32 structure, in bytes.

inline uint32_t min_required_config_size() const

The minimum size of the IMAGE_ENCLAVE_CONFIG(32,64) structure that the image loader must be able to process in order for the enclave to be usable.

This member allows an enclave to inform an earlier version of the image loader that the image loader can safely load the enclave and ignore optional members added to IMAGE_ENCLAVE_CONFIG(32,64) for later versions of the enclave. If the size of IMAGE_ENCLAVE_CONFIG(32,64) that the image loader can process is less than MinimumRequiredConfigSize, the enclave cannot be run securely.

If MinimumRequiredConfigSize is zero, the minimum size of the IMAGE_ENCLAVE_CONFIG(32,64) structure that the image loader must be able to process in order for the enclave to be usable is assumed to be the size of the structure through and including the MinimumRequiredConfigSize member.

inline uint32_t policy_flags() const

A flag that indicates whether the enclave permits debugging.

inline bool is_debuggable() const

Whether this enclave can be debugged.

inline uint32_t import_list_rva() const

The RVA of the array of images that the enclave image may import, with identity information for each image.

inline uint32_t import_entry_size() const

The size of each image in the array of images that the import_list_rva() member points to.

inline size_t nb_imports() const

The number of images in the array of images that the import_list_rva() member points to.

inline it_imports imports()

Return an iterator over the enclave’s imports.

inline it_const_imports imports() const
inline const id_array_t &family_id() const

The family identifier that the author of the enclave assigned to the enclave.

inline const id_array_t &image_id() const

The image identifier that the author of the enclave assigned to the enclave.

inline uint32_t image_version() const

The version number that the author of the enclave assigned to the enclave.

inline uint32_t security_version() const

The security version number that the author of the enclave assigned to the enclave.

inline uint64_t enclave_size() const

The expected virtual size of the private address range for the enclave, in bytes.

inline uint32_t nb_threads() const

The maximum number of threads that can be created within the enclave.

inline uint32_t enclave_flags() const

A flag that indicates whether the image is suitable for use as the primary image in the enclave.

inline EnclaveConfiguration &size(uint32_t value)
inline EnclaveConfiguration &min_required_config_size(uint32_t value)
inline EnclaveConfiguration &policy_flags(uint32_t value)
inline EnclaveConfiguration &import_list_rva(uint32_t value)
inline EnclaveConfiguration &import_entry_size(uint32_t value)
inline EnclaveConfiguration &family_id(const id_array_t &value)
inline EnclaveConfiguration &image_id(const id_array_t &value)
inline EnclaveConfiguration &image_version(uint32_t value)
inline EnclaveConfiguration &security_version(uint32_t value)
inline EnclaveConfiguration &enclave_size(uint64_t value)
inline EnclaveConfiguration &nb_threads(uint32_t value)
inline EnclaveConfiguration &enclave_flags(uint32_t value)
std::string to_string() const

Public Static Attributes

static auto MIN_SIZE = 0x4C
static auto POLICY_DEBUGGABLE = 0x00000001
static auto POLICY_STRICT_MEMORY = 0x00000002

Friends

inline friend std::ostream &operator<<(std::ostream &os, const EnclaveConfiguration &meta)

EnclaveImport

class EnclaveImport

Defines an entry in the array of images that an enclave can import.

Public Types

enum class TYPE : uint32_t

Values:

enumerator NONE = 0x00000000

None of the identifiers of the image need to match the value in the import record.

enumerator UNIQUE_ID = 0x00000001

The value of the enclave unique identifier of the image must match the value in the import record. Otherwise, loading of the image fails.

enumerator AUTHOR_ID = 0x00000002

The value of the enclave author identifier of the image must match the value in the import record. Otherwise, loading of the image fails. If this flag is set and the import record indicates an author identifier of all zeros, the imported image must be part of the Windows installation.

enumerator FAMILY_ID = 0x00000003

The value of the enclave family identifier of the image must match the value in the import record. Otherwise, loading of the image fails.

enumerator IMAGE_ID = 0x00000004

The value of the enclave image identifier of the image must match the value in the import record. Otherwise, loading of the image fails.

using short_id_t = std::array<uint8_t, 16>
using long_id_t = std::array<uint8_t, 32>

Public Functions

EnclaveImport() = default
EnclaveImport(const EnclaveImport&) = default
EnclaveImport &operator=(const EnclaveImport&) = default
EnclaveImport(EnclaveImport&&) = default
EnclaveImport &operator=(EnclaveImport&&) = default
inline TYPE type() const

The type of identifier of the image that must match the value in the import record.

inline uint32_t min_security_version() const

The minimum enclave security version that each image must have for the image to be imported successfully. The image is rejected unless its enclave security version is equal to or greater than the minimum value in the import record. Set the value in the import record to zero to turn off the security version check.

inline const long_id_t &id() const

The unique identifier of the primary module for the enclave, if the type() is TYPE::UNIQUE_ID. Otherwise, the author identifier of the primary module for the enclave.

inline const short_id_t &family_id() const

The family identifier of the primary module for the enclave.

inline const short_id_t &image_id() const

The image identifier of the primary module for the enclave.

inline uint32_t import_name_rva() const

The relative virtual address of a NULL-terminated string that contains the same value found in the import directory for the image.

inline std::string_view import_name() const

Resolved import name.

inline uint32_t reserved() const

Reserved. Should be 0.

inline EnclaveImport &type(TYPE ty)
inline EnclaveImport &min_security_version(uint32_t value)
inline EnclaveImport &id(const long_id_t &value)
inline EnclaveImport &family_id(const short_id_t &value)
inline EnclaveImport &image_id(const short_id_t &value)
inline EnclaveImport &import_name_rva(uint32_t value)
inline EnclaveImport &reserved(uint32_t value)
inline EnclaveImport &import_name(std::string name)
std::string to_string() const

Friends

inline friend std::ostream &operator<<(std::ostream &os, const EnclaveImport &meta)

Volatile Metadata

class VolatileMetadata

This class represents volatile metadata which can be enabled at link time with /volatileMetadata.

This metadata aims to improve performances when running x64 code on ARM64.

Public Types

using access_table_t = std::vector<uint32_t>
using info_ranges_t = std::vector<range_t>
using it_info_ranges_t = ref_iterator<info_ranges_t&>
using it_const_info_ranges_t = const_ref_iterator<const info_ranges_t&>

Public Functions

VolatileMetadata() = default
VolatileMetadata(const VolatileMetadata&) = default
VolatileMetadata &operator=(const VolatileMetadata&) = default
VolatileMetadata(VolatileMetadata&&) = default
VolatileMetadata &operator=(VolatileMetadata&&) = default
inline std::unique_ptr<VolatileMetadata> clone() const
inline uint32_t size() const

Size (in bytes) of the current raw structure.

inline uint16_t min_version() const
inline uint16_t max_version() const
inline uint32_t access_table_rva() const
inline const access_table_t &access_table() const
inline uint32_t access_table_size() const
inline uint32_t info_range_rva() const
inline uint32_t info_ranges_size() const
inline it_const_info_ranges_t info_ranges() const
inline it_info_ranges_t info_ranges()
inline VolatileMetadata &size(uint32_t value)
inline VolatileMetadata &min_version(uint16_t min)
inline VolatileMetadata &max_version(uint16_t max)
inline VolatileMetadata &access_table_rva(uint32_t value)
inline VolatileMetadata &info_range_rva(uint32_t value)
std::string to_string() const

Friends

inline friend std::ostream &operator<<(std::ostream &os, const VolatileMetadata &meta)
struct range_t

Public Functions

inline uint32_t end() const

Public Members

uint32_t start = 0
uint32_t size = 0

Utilities

bool LIEF::PE::check_layout(const Binary &bin, std::string *error_info = nullptr)

Check that the layout of the given Binary is correct from the Windows loader perspective.

result<PE_TYPE> LIEF::PE::get_type(const std::string &file)

if the input file is a PE one, return PE32 or PE32+

result<PE_TYPE> LIEF::PE::get_type(const std::vector<uint8_t> &raw)

Return PE32 or PE32+.

bool LIEF::PE::is_pe(const std::string &file)

check if the file is a PE file

bool LIEF::PE::is_pe(const std::vector<uint8_t> &raw)

check if the raw data is a PE file

std::string LIEF::PE::get_imphash(const Binary &binary, IMPHASH_MODE mode = IMPHASH_MODE::DEFAULT)

Compute the hash of imported functions.

By default, it generates an hash with the following properties:

  • Order agnostic

  • Casse agnostic

  • Ordinal (in some extent) agnostic

If one needs the same output as Virus Total (i.e. pefile), you can pass IMPHASH_MODE::PEFILE as second parameter.

See also

https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html

Warning

The default algorithm used to compute the imphash value has some variations compared to Yara, pefile, VT implementation

enum class LIEF::PE::IMPHASH_MODE

Enum to define the behavior of LIEF::PE::get_imphash.

Values:

enumerator DEFAULT = 0

Default implementation.

enumerator LIEF = DEFAULT

Same as IMPHASH_MODE::DEFAULT.

enumerator PEFILE

Use pefile algorithm.

enumerator VT = PEFILE

Same as IMPHASH_MODE::PEFILE since Virus Total is using pefile.

result<Import> LIEF::PE::resolve_ordinals(const Import &import, bool strict = false, bool use_std = false)

Take a PE::Import as entry and try to resolve imports by ordinal.

The strict boolean parameter enables to throw an LIEF::not_found exception if the ordinal can’t be resolved. Otherwise it skips the entry.

Parameters:

  • import – [in] Import to resolve

  • strict – [in] If set to true, throw an exception if the import can’t be resolved

  • use_std – [in] If true, it will use the pefile look-up table for resolving imports

Returns:

The PE::import resolved with PE::ImportEntry::name set

const char *LIEF::PE::oid_to_string(const oid_t &oid)

Convert an OID to a human-readable string.

Enums

enum class LIEF::PE::PE_TYPE : uint16_t

Values:

enumerator PE32 = 0x10b

32bits

enumerator PE32_PLUS = 0x20b

64 bits

enum class LIEF::PE::CODE_PAGES : uint32_t

Code page from https://docs.microsoft.com/en-us/windows/win32/intl/code-page-identifiers.

Values:

enumerator IBM037 = 37

IBM EBCDIC US-Canada

enumerator IBM437 = 437

OEM United States

enumerator IBM500 = 500

IBM EBCDIC International

enumerator ASMO_708 = 708

Arabic (ASMO 708)

enumerator DOS_720 = 720

Arabic (Transparent ASMO); Arabic (DOS)

enumerator IBM737 = 737

OEM Greek (formerly 437G); Greek (DOS)

enumerator IBM775 = 775

OEM Baltic; Baltic (DOS)

enumerator IBM850 = 850

OEM Multilingual Latin 1; Western European (DOS)

enumerator IBM852 = 852

OEM Latin 2; Central European (DOS)

enumerator IBM855 = 855

OEM Cyrillic (primarily Russian)

enumerator IBM857 = 857

OEM Turkish; Turkish (DOS)

enumerator IBM00858 = 858

OEM Multilingual Latin 1 + Euro symbol

enumerator IBM860 = 860

OEM Portuguese; Portuguese (DOS)

enumerator IBM861 = 861

OEM Icelandic; Icelandic (DOS)

enumerator DOS_862 = 862

OEM Hebrew; Hebrew (DOS)

enumerator IBM863 = 863

OEM French Canadian; French Canadian (DOS)

enumerator IBM864 = 864

OEM Arabic; Arabic (864)

enumerator IBM865 = 865

OEM Nordic; Nordic (DOS)

enumerator CP866 = 866

OEM Russian; Cyrillic (DOS)

enumerator IBM869 = 869

OEM Modern Greek; Greek, Modern (DOS)

enumerator IBM870 = 870

IBM EBCDIC Multilingual/ROECE (Latin 2); IBM EBCDIC Multilingual Latin 2

enumerator WINDOWS_874 = 874

ANSI/OEM Thai (same as 28605, ISO 8859-15); Thai (Windows)

enumerator CP875 = 875

IBM EBCDIC Greek Modern

enumerator SHIFT_JIS = 932

ANSI/OEM Japanese; Japanese (Shift-JIS)

enumerator GB2312 = 936

ANSI/OEM Simplified Chinese (PRC, Singapore); Chinese Simplified (GB2312)

enumerator KS_C_5601_1987 = 949

ANSI/OEM Korean (Unified Hangul Code)

enumerator BIG5 = 950

ANSI/OEM Traditional Chinese (Taiwan; Hong Kong SAR, PRC); Chinese Traditional (Big5)

enumerator IBM1026 = 1026

IBM EBCDIC Turkish (Latin 5)

enumerator IBM01047 = 1047

IBM EBCDIC Latin 1/Open System

enumerator IBM01140 = 1140

IBM EBCDIC US-Canada (037 + Euro symbol); IBM EBCDIC (US-Canada-Euro)

enumerator IBM01141 = 1141

IBM EBCDIC Germany (20273 + Euro symbol); IBM EBCDIC (Germany-Euro)

enumerator IBM01142 = 1142

IBM EBCDIC Denmark-Norway (20277 + Euro symbol); IBM EBCDIC (Denmark-Norway-Euro)

enumerator IBM01143 = 1143

IBM EBCDIC Finland-Sweden (20278 + Euro symbol); IBM EBCDIC (Finland-Sweden-Euro)

enumerator IBM01144 = 1144

IBM EBCDIC Italy (20280 + Euro symbol); IBM EBCDIC (Italy-Euro)

enumerator IBM01145 = 1145

IBM EBCDIC Latin America-Spain (20284 + Euro symbol); IBM EBCDIC (Spain-Euro)

enumerator IBM01146 = 1146

IBM EBCDIC United Kingdom (20285 + Euro symbol); IBM EBCDIC (UK-Euro)

enumerator IBM01147 = 1147

IBM EBCDIC France (20297 + Euro symbol); IBM EBCDIC (France-Euro)

enumerator IBM01148 = 1148

IBM EBCDIC International (500 + Euro symbol); IBM EBCDIC (International-Euro)

enumerator IBM01149 = 1149

IBM EBCDIC Icelandic (20871 + Euro symbol); IBM EBCDIC (Icelandic-Euro)

enumerator UTF_16 = 1200

Unicode UTF-16, little endian byte order (BMP of ISO 10646); available only to managed applications

enumerator UNICODEFFFE = 1201

Unicode UTF-16, big endian byte order; available only to managed applications

enumerator WINDOWS_1250 = 1250

ANSI Central European; Central European (Windows)

enumerator WINDOWS_1251 = 1251

ANSI Cyrillic; Cyrillic (Windows)

enumerator WINDOWS_1252 = 1252

ANSI Latin 1; Western European (Windows)

enumerator WINDOWS_1253 = 1253

ANSI Greek; Greek (Windows)

enumerator WINDOWS_1254 = 1254

ANSI Turkish; Turkish (Windows)

enumerator WINDOWS_1255 = 1255

ANSI Hebrew; Hebrew (Windows)

enumerator WINDOWS_1256 = 1256

ANSI Arabic; Arabic (Windows)

enumerator WINDOWS_1257 = 1257

ANSI Baltic; Baltic (Windows)

enumerator WINDOWS_1258 = 1258

ANSI/OEM Vietnamese; Vietnamese (Windows)

enumerator JOHAB = 1361

Korean (Johab)

enumerator MACINTOSH = 10000

MAC Roman; Western European (Mac)

enumerator X_MAC_JAPANESE = 10001

Japanese (Mac)

enumerator X_MAC_CHINESETRAD = 10002

MAC Traditional Chinese (Big5); Chinese Traditional (Mac)

enumerator X_MAC_KOREAN = 10003

Korean (Mac)

enumerator X_MAC_ARABIC = 10004

Arabic (Mac)

enumerator X_MAC_HEBREW = 10005

Hebrew (Mac)

enumerator X_MAC_GREEK = 10006

Greek (Mac)

enumerator X_MAC_CYRILLIC = 10007

Cyrillic (Mac)

enumerator X_MAC_CHINESESIMP = 10008

MAC Simplified Chinese (GB 2312); Chinese Simplified (Mac)

enumerator X_MAC_ROMANIAN = 10010

Romanian (Mac)

enumerator X_MAC_UKRAINIAN = 10017

Ukrainian (Mac)

enumerator X_MAC_THAI = 10021

Thai (Mac)

enumerator X_MAC_CE = 10029

MAC Latin 2; Central European (Mac)

enumerator X_MAC_ICELANDIC = 10079

Icelandic (Mac)

enumerator X_MAC_TURKISH = 10081

Turkish (Mac)

enumerator X_MAC_CROATIAN = 10082

Croatian (Mac)

enumerator UTF_32 = 12000

Unicode UTF-32, little endian byte order; available only to managed applications

enumerator UTF_32BE = 12001

Unicode UTF-32, big endian byte order; available only to managed applications

enumerator X_CHINESE_CNS = 20000

CNS Taiwan; Chinese Traditional (CNS)

enumerator X_CP20001 = 20001

TCA Taiwan

enumerator X_CHINESE_ETEN = 20002

Eten Taiwan; Chinese Traditional (Eten)

enumerator X_CP20003 = 20003

IBM5550 Taiwan

enumerator X_CP20004 = 20004

TeleText Taiwan

enumerator X_CP20005 = 20005

Wang Taiwan

enumerator X_IA5 = 20105

IA5 (IRV International Alphabet No. 5, 7-bit); Western European (IA5)

enumerator X_IA5_GERMAN = 20106

IA5 German (7-bit)

enumerator X_IA5_SWEDISH = 20107

IA5 Swedish (7-bit)

enumerator X_IA5_NORWEGIAN = 20108

IA5 Norwegian (7-bit)

enumerator US_ASCII = 20127

US-ASCII (7-bit)

enumerator X_CP20261 = 20261

T.61

enumerator X_CP20269 = 20269

ISO 6937 Non-Spacing Accent

enumerator IBM273 = 20273

IBM EBCDIC Germany

enumerator IBM277 = 20277

IBM EBCDIC Denmark-Norway

enumerator IBM278 = 20278

IBM EBCDIC Finland-Sweden

enumerator IBM280 = 20280

IBM EBCDIC Italy

enumerator IBM284 = 20284

IBM EBCDIC Latin America-Spain

enumerator IBM285 = 20285

IBM EBCDIC United Kingdom

enumerator IBM290 = 20290

IBM EBCDIC Japanese Katakana Extended

enumerator IBM297 = 20297

IBM EBCDIC France

enumerator IBM420 = 20420

IBM EBCDIC Arabic

enumerator IBM423 = 20423

IBM EBCDIC Greek

enumerator IBM424 = 20424

IBM EBCDIC Hebrew

enumerator X_EBCDIC_KOREANEXTENDED = 20833

IBM EBCDIC Korean Extended

enumerator IBM_THAI = 20838

IBM EBCDIC Thai

enumerator KOI8_R = 20866

Russian (KOI8-R); Cyrillic (KOI8-R)

enumerator IBM871 = 20871

IBM EBCDIC Icelandic

enumerator IBM880 = 20880

IBM EBCDIC Cyrillic Russian

enumerator IBM905 = 20905

IBM EBCDIC Turkish

enumerator IBM00924 = 20924

IBM EBCDIC Latin 1/Open System (1047 + Euro symbol)

enumerator EUC_JP_JIS = 20932

Japanese (JIS 0208-1990 and 0121-1990)

enumerator X_CP20936 = 20936

Simplified Chinese (GB2312); Chinese Simplified (GB2312-80)

enumerator X_CP20949 = 20949

Korean Wansung

enumerator CP1025 = 21025

IBM EBCDIC Cyrillic Serbian-Bulgarian

enumerator KOI8_U = 21866

Ukrainian (KOI8-U); Cyrillic (KOI8-U)

enumerator ISO_8859_1 = 28591

ISO 8859-1 Latin 1; Western European (ISO)

enumerator ISO_8859_2 = 28592

ISO 8859-2 Central European; Central European (ISO)

enumerator ISO_8859_3 = 28593

ISO 8859-3 Latin 3

enumerator ISO_8859_4 = 28594

ISO 8859-4 Baltic

enumerator ISO_8859_5 = 28595

ISO 8859-5 Cyrillic

enumerator ISO_8859_6 = 28596

ISO 8859-6 Arabic

enumerator ISO_8859_7 = 28597

ISO 8859-7 Greek

enumerator ISO_8859_8 = 28598

ISO 8859-8 Hebrew; Hebrew (ISO-Visual)

enumerator ISO_8859_9 = 28599

ISO 8859-9 Turkish

enumerator ISO_8859_13 = 28603

ISO 8859-13 Estonian

enumerator ISO_8859_15 = 28605

ISO 8859-15 Latin 9

enumerator X_EUROPA = 29001

Europa 3

enumerator ISO_8859_8_I = 38598

ISO 8859-8 Hebrew; Hebrew (ISO-Logical)

enumerator ISO_2022_JP = 50220

ISO 2022 Japanese with no halfwidth Katakana; Japanese (JIS)

enumerator CSISO2022JP = 50221

ISO 2022 Japanese with halfwidth Katakana; Japanese (JIS-Allow 1 byte Kana)

enumerator ISO_2022_JP_JIS = 50222

ISO 2022 Japanese JIS X 0201-1989; Japanese (JIS-Allow 1 byte Kana - SO/SI)

enumerator ISO_2022_KR = 50225

ISO 2022 Korean

enumerator X_CP50227 = 50227

ISO 2022 Simplified Chinese; Chinese Simplified (ISO 2022)

enumerator EUC_JP = 51932

EUC Japanese

enumerator EUC_CN = 51936

EUC Simplified Chinese; Chinese Simplified (EUC)

enumerator EUC_KR = 51949

EUC Korean

enumerator HZ_GB_2312 = 52936

HZ-GB2312 Simplified Chinese; Chinese Simplified (HZ)

enumerator GB18030 = 54936

Windows XP and later: GB18030 Simplified Chinese (4 byte); Chinese Simplified (GB18030)

enumerator X_ISCII_DE = 57002

ISCII Devanagari

enumerator X_ISCII_BE = 57003

ISCII Bengali

enumerator X_ISCII_TA = 57004

ISCII Tamil

enumerator X_ISCII_TE = 57005

ISCII Telugu

enumerator X_ISCII_AS = 57006

ISCII Assamese

enumerator X_ISCII_OR = 57007

ISCII Oriya

enumerator X_ISCII_KA = 57008

ISCII Kannada

enumerator X_ISCII_MA = 57009

ISCII Malayalam

enumerator X_ISCII_GU = 57010

ISCII Gujarati

enumerator X_ISCII_PA = 57011

ISCII Punjabi

enumerator UTF_7 = 65000

Unicode (UTF-7)

enumerator UTF_8 = 65001

Unicode (UTF-8)

enum class LIEF::PE::ALGORITHMS : uint32_t

Cryptography algorithms.

Values:

enumerator UNKNOWN = 0
enumerator SHA_512
enumerator SHA_384
enumerator SHA_256
enumerator SHA_1
enumerator MD5
enumerator MD4
enumerator MD2
enumerator RSA
enumerator EC
enumerator MD5_RSA
enumerator SHA1_DSA
enumerator SHA1_RSA
enumerator SHA_256_RSA
enumerator SHA_384_RSA
enumerator SHA_512_RSA
enumerator SHA1_ECDSA
enumerator SHA_256_ECDSA
enumerator SHA_384_ECDSA
enumerator SHA_512_ECDSA
enum class LIEF::PE::ACCELERATOR_CODES : uint32_t

From https://docs.microsoft.com/en-us/windows/win32/inputdev/virtual-key-codes.

Values:

enumerator LBUTTON = 0x01
enumerator RBUTTON = 0x02
enumerator CANCEL = 0x03
enumerator MBUTTON = 0x04
enumerator XBUTTON1_K = 0x05
enumerator XBUTTON2_K = 0x06
enumerator BACK = 0x08
enumerator TAB = 0x09
enumerator CLEAR = 0x0C
enumerator RETURN = 0x0D
enumerator SHIFT = 0x10
enumerator CONTROL = 0x11
enumerator MENU = 0x12
enumerator PAUSE = 0x13
enumerator CAPITAL = 0x14
enumerator KANA = 0x15
enumerator IME_ON = 0x16
enumerator JUNJA = 0x17
enumerator FINAL = 0x18
enumerator KANJI = 0x19
enumerator IME_OFF = 0x1A
enumerator ESCAPE = 0x1B
enumerator CONVERT = 0x1C
enumerator NONCONVERT = 0x1D
enumerator ACCEPT = 0x1E
enumerator MODECHANGE = 0x1F
enumerator SPACE = 0x20
enumerator PRIOR = 0x21
enumerator NEXT = 0x22
enumerator END = 0x23
enumerator HOME = 0x24
enumerator LEFT = 0x25
enumerator UP = 0x26
enumerator RIGHT = 0x27
enumerator DOWN = 0x28
enumerator SELECT = 0x29
enumerator PRINT = 0x2A
enumerator EXECUTE = 0x2B
enumerator SNAPSHOT = 0x2C
enumerator INSERT = 0x2D
enumerator DELETE_K = 0x2E
enumerator HELP = 0x2F
enumerator NUM_0 = 0x30
enumerator NUM_1 = 0x31
enumerator NUM_2 = 0x32
enumerator NUM_3 = 0x33
enumerator NUM_4 = 0x34
enumerator NUM_5 = 0x35
enumerator NUM_6 = 0x36
enumerator NUM_7 = 0x37
enumerator NUM_8 = 0x38
enumerator NUM_9 = 0x39
enumerator A = 0x41
enumerator B = 0x42
enumerator C = 0x43
enumerator D = 0x44
enumerator E = 0x45
enumerator F = 0x46
enumerator G = 0x47
enumerator H = 0x48
enumerator I = 0x49
enumerator J = 0x4A
enumerator K = 0x4B
enumerator L = 0x4C
enumerator M = 0x4D
enumerator N = 0x4E
enumerator O = 0x4F
enumerator P = 0x50
enumerator Q = 0x51
enumerator R = 0x52
enumerator S = 0x53
enumerator T = 0x54
enumerator U = 0x55
enumerator V = 0x56
enumerator W = 0x57
enumerator X = 0x58
enumerator Y = 0x59
enumerator Z = 0x5A
enumerator LWIN = 0x5B
enumerator RWIN = 0x5C
enumerator APPS = 0x5D
enumerator SLEEP = 0x5F
enumerator NUMPAD0 = 0x60
enumerator NUMPAD1 = 0x61
enumerator NUMPAD2 = 0x62
enumerator NUMPAD3 = 0x63
enumerator NUMPAD4 = 0x64
enumerator NUMPAD5 = 0x65
enumerator NUMPAD6 = 0x66
enumerator NUMPAD7 = 0x67
enumerator NUMPAD8 = 0x68
enumerator NUMPAD9 = 0x69
enumerator MULTIPLY = 0x6A
enumerator ADD = 0x6B
enumerator SEPARATOR = 0x6C
enumerator SUBTRACT = 0x6D
enumerator DECIMAL = 0x6E
enumerator DIVIDE = 0x6F
enumerator F1 = 0x70
enumerator F2 = 0x71
enumerator F3 = 0x72
enumerator F4 = 0x73
enumerator F5 = 0x74
enumerator F6 = 0x75
enumerator F7 = 0x76
enumerator F8 = 0x77
enumerator F9 = 0x78
enumerator F10 = 0x79
enumerator F11 = 0x7A
enumerator F12 = 0x7B
enumerator F13 = 0x7C
enumerator F14 = 0x7D
enumerator F15 = 0x7E
enumerator F16 = 0x7F
enumerator F17 = 0x80
enumerator F18 = 0x81
enumerator F19 = 0x82
enumerator F20 = 0x83
enumerator F21 = 0x84
enumerator F22 = 0x85
enumerator F23 = 0x86
enumerator F24 = 0x87
enumerator NUMLOCK = 0x90
enumerator SCROLL = 0x91
enumerator LSHIFT = 0xA0
enumerator RSHIFT = 0xA1
enumerator LCONTROL = 0xA2
enumerator RCONTROL = 0xA3
enumerator LMENU = 0xA4
enumerator RMENU = 0xA5
enumerator BROWSER_BACK = 0xA6
enumerator BROWSER_FORWARD = 0xA7
enumerator BROWSER_REFRESH = 0xA8
enumerator BROWSER_STOP = 0xA9
enumerator BROWSER_SEARCH = 0xAA
enumerator BROWSER_FAVORITES = 0xAB
enumerator BROWSER_HOME = 0xAC
enumerator VOLUME_MUTE = 0xAD
enumerator VOLUME_DOWN = 0xAE
enumerator VOLUME_UP = 0xAF
enumerator MEDIA_NEXT_TRACK = 0xB0
enumerator MEDIA_PREV_TRACK = 0xB1
enumerator MEDIA_STOP = 0xB2
enumerator MEDIA_PLAY_PAUSE = 0xB3
enumerator LAUNCH_MAIL = 0xB4
enumerator LAUNCH_MEDIA_SELECT = 0xB5
enumerator LAUNCH_APP1 = 0xB6
enumerator LAUNCH_APP2 = 0xB7
enumerator OEM_1 = 0xBA
enumerator OEM_PLUS = 0xBB
enumerator OEM_COMMA = 0xBC
enumerator OEM_MINUS = 0xBD
enumerator OEM_PERIOD = 0xBE
enumerator OEM_2 = 0xBF
enumerator OEM_4 = 0xDB
enumerator OEM_5 = 0xDC
enumerator OEM_6 = 0xDD
enumerator OEM_7 = 0xDE
enumerator OEM_8 = 0xDF
enumerator OEM_102 = 0xE2
enumerator PROCESSKEY = 0xE5
enumerator PACKET = 0xE7
enumerator ATTN = 0xF6
enumerator CRSEL = 0xF7
enumerator EXSEL = 0xF8
enumerator EREOF = 0xF9
enumerator PLAY = 0xFA
enumerator ZOOM = 0xFB
enumerator NONAME = 0xFC
enumerator PA1 = 0xFD
enumerator OEM_CLEAR = 0xFE