--- documentID: "022ea70514310c02b0dca00aca48908628e5f3ae01f867a7242d83eb9fa9953e" docname: "formats/pe/cpp" title: "PE C++ API - LIEF Documentation" description: "PE C++ API reference documentation for LIEF, including APIs and examples for parsing, inspecting, modifying, and writing executable formats." canonical: "https://lief.re/doc/latest/formats/pe/cpp.html" markdownURL: "https://lief.re/doc/latest/formats/pe/cpp.md" documentationVersion: "2.0.0" documentationChannel: "latest" language: "en" contentHash: "58de60546f782310df4050f4f47b0d0aba0f5b04a1b01949e50ab60a72b82757" --- # [C++]() ## [Parser]() ### [` Parser `]() class Parser : public LIEF::[Parser]( "LIEF::Parser") Main interface to parse PE binaries. In particular, the **static** [Parser::parse]() functions should be used to get a [LIEF::PE::Binary]() instance. Public Functions #### [` operator= `]() [Parser]( "LIEF::PE::Parser") &operator=(const [Parser]( "LIEF::PE::Parser") &copy) = delete #### [` Parser `]() Parser(const [Parser]( "LIEF::PE::Parser::Parser") &copy) = delete #### [` find_coff_string `]() COFF::[String]( "LIEF::COFF::String") \*find\_coff\_string(uint32\_t offset) const #### [` find_exception_info `]() inline [ExceptionInfo]( "LIEF::PE::ExceptionInfo") \*find\_exception\_info(uint32\_t rva) const #### [` bin `]() inline const [Binary]( "LIEF::PE::Binary") &bin() const #### [` bin `]() inline [Binary]( "LIEF::PE::Binary") &bin() #### [` stream `]() inline [BinaryStream]( "LIEF::BinaryStream") &stream() #### [` config `]() inline const [ParserConfig]( "LIEF::PE::ParserConfig") &config() const #### [` memoize `]() void memoize([ExceptionInfo]( "LIEF::PE::ExceptionInfo") &info) #### [` memoize `]() void memoize(COFF::[String]( "LIEF::COFF::String") str) #### [` add_non_resolved `]() inline void add\_non\_resolved([ExceptionInfo]( "LIEF::PE::ExceptionInfo") &info, uint32\_t target) #### [` stream_from_rva `]() std::unique\_ptr<[SpanStream]( "LIEF::SpanStream")> stream\_from\_rva(uint32\_t rva, size\_t size = 0) #### [` record_relocation `]() void record\_relocation(uint32\_t rva, span<const uint8\_t> data) #### [` record_delta_relocation `]() [ok\_error\_t]( "LIEF::ok_error_t") record\_delta\_relocation(uint32\_t rva, int64\_t delta, size\_t size) Public Static Functions #### [` is_valid_import_name `]() static bool is\_valid\_import\_name(std::string\_view name) Check if the given name is a valid import. This check verifies that: 1. The name is not too large or empty (cf. [https://stackoverflow.com/a/23340781]()) 2. All the characters are printable #### [` is_valid_dll_name `]() static bool is\_valid\_dll\_name(std::string\_view name) Check if the given name is a valid DLL name. This check verifies that: 1. The name of the DLL is at least 4 characters long 2. All the characters are printable #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse(std::string\_view filename, const [ParserConfig]( "LIEF::PE::ParserConfig") &conf = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) Parse a PE binary from the given filename. #### [` PathTparse `]() template<class PathT, enable\_if\_path\_t<[PathT]( "LIEF::PE::Parser::parse::PathT")> = 0> static inline std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse(const [PathT]( "LIEF::PE::Parser::parse::PathT") &filename, const [ParserConfig]( "LIEF::PE::ParserConfig") &conf = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) Same as [parse(std::string\_view, const ParserConfig&)]() but the file is given as a `std::filesystem::path`. #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse(std::vector<uint8\_t> data, const [ParserConfig]( "LIEF::PE::ParserConfig") &conf = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) Parse a PE binary from a data buffer. #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse(const uint8\_t \*buffer, size\_t size, const [ParserConfig]( "LIEF::PE::ParserConfig") &conf = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) #### [` parse `]() static std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse(std::unique\_ptr<[BinaryStream]( "LIEF::BinaryStream")> stream, const [ParserConfig]( "LIEF::PE::ParserConfig") &conf = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) Parse a PE binary from the given [BinaryStream](). #### [` parse_from_memory `]() static std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse\_from\_memory(uintptr\_t address, const [ParserConfig]( "LIEF::PE::ParserConfig") &config = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) Parse the PE binary at the given memory address. #### [` parse_from_memory `]() static std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse\_from\_memory(uintptr\_t address, size\_t size, const [ParserConfig]( "LIEF::PE::ParserConfig") &config = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) Parse the PE binary at the given memory address and with the given size. #### [` parse_from_dump `]() static std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse\_from\_dump(std::string\_view filepath, uint64\_t addr, const [ParserConfig]( "LIEF::PE::ParserConfig") &config = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) Parse a PE binary from a memory dump located on disk. A dump is a raw capture of the process memory that was mapped starting at the virtual address `addr`. This is typically used to parse a PE image that has been dumped from memory (e.g. from a debugger or a runtime hook). **Parameters:** - **filepath** – **[in]** Path to the file that contains the memory dump - **addr** – **[in]** Virtual address at which the dump was mapped - **config** – **[in]** Optional configuration for the parser #### [` PathTparse_from_dump `]() template<class PathT, enable\_if\_path\_t<[PathT]( "LIEF::PE::Parser::parse_from_dump::PathT")> = 0> static inline std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse\_from\_dump(const [PathT]( "LIEF::PE::Parser::parse_from_dump::PathT") &filepath, uint64\_t addr, const [ParserConfig]( "LIEF::PE::ParserConfig") &config = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) Same as [parse\_from\_dump(std::string\_view, uint64\_t, const ParserConfig&)]() but the dump file is given as a `std::filesystem::path`. #### [` parse_from_dump `]() static std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse\_from\_dump([BinaryStream]( "LIEF::BinaryStream") &stream, uint64\_t addr, const [ParserConfig]( "LIEF::PE::ParserConfig") &config = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) Same as [parse\_from\_dump(std::string\_view, uint64\_t, const ParserConfig&)]() but the dump is wrapped in the given **non-owned** stream. #### [` parse_from_dump `]() static std::unique\_ptr<[Binary]( "LIEF::PE::Binary")> parse\_from\_dump(std::unique\_ptr<[BinaryStream]( "LIEF::BinaryStream")> stream, uint64\_t addr, const [ParserConfig]( "LIEF::PE::ParserConfig") &config = [ParserConfig]( "LIEF::PE::ParserConfig")::[default\_conf]( "LIEF::PE::ParserConfig::default_conf")()) Same as [parse\_from\_dump(std::string\_view, uint64\_t, const ParserConfig&)]() but the dump is wrapped in the given **owned** stream. Public Static Attributes #### [` MAX_DATA_SIZE `]() static size\_t MAX\_DATA\_SIZE = 3\_GB Maximum size of the data read. #### [` MAX_TLS_CALLBACKS `]() static size\_t MAX\_TLS\_CALLBACKS = 3000 #### [` MAX_IMPORT_ENTRIES `]() static size\_t MAX\_IMPORT\_ENTRIES = 0x10000 #### [` MAX_IMPORT_NAME_SIZE `]() static size\_t MAX\_IMPORT\_NAME\_SIZE = 0x1000 #### [` MAX_DLL_NAME_SIZE `]() static size\_t MAX\_DLL\_NAME\_SIZE = 255 #### [` MAX_PADDING_SIZE `]() static size\_t MAX\_PADDING\_SIZE = 1\_GB Max size of the padding section. ### [` ParserConfig `]() struct ParserConfig This structure is used to configure the behavior of the PE [Parser]() ([PE::Parser]()). Public Functions #### [` to_string `]() std::string to\_string() const Public Members #### [` parse_signature `]() bool parse\_signature = true Whether to parse the PE Authenticode signature. #### [` parse_exports `]() bool parse\_exports = true Whether to parse the PE [Export]() Directory. #### [` parse_imports `]() bool parse\_imports = true Whether to parse the PE [Import]() Directory. #### [` parse_rsrc `]() bool parse\_rsrc = true Whether to parse the PE resources tree. #### [` parse_reloc `]() bool parse\_reloc = true Whether to parse PE relocations. #### [` parse_exceptions `]() bool parse\_exceptions = false Whether to parse in-depth exception metadata. This option is disabled by default because it can introduce significant parsing overhead. #### [` parse_arm64x_binary `]() bool parse\_arm64x\_binary = false Whether to parse nested ARM64X binaries. This option is disabled by default because it can introduce significant parsing overhead. #### [` rebase `]() std::optional<uint64\_t> rebase If set, this value holds the original image base from which the binary should be rebased. This is used to *undo* relocations and IAT bindings when parsing a PE loaded in memory. Public Static Functions #### [` default_conf `]() static inline const [ParserConfig]( "LIEF::PE::ParserConfig") &default\_conf() Returns the default configuration for the PE [Parser](). #### [` all `]() static inline [ParserConfig]( "LIEF::PE::ParserConfig") all() Returns a configuration that enables all optional parsing features. Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [ParserConfig]( "LIEF::PE::ParserConfig") &config) --- ## [Binary]() ### [` Binary `]() class Binary : public LIEF::[Binary]( "LIEF::Binary") Class which represents a PE binary This is the main interface to manage and modify a PE executable. Public Types #### [` sections_t `]() using sections\_t = std::vector<std::unique\_ptr<[Section]( "LIEF::PE::Section")>> Internal container for storing PE’s [Section](). #### [` it_sections `]() using it\_sections = [ref\_iterator]( "LIEF::ref_iterator")<[sections\_t]( "LIEF::PE::Binary::sections_t")&, [Section]( "LIEF::PE::Section")\*> Iterator that outputs [Section]()& object. #### [` it_const_sections `]() using it\_const\_sections = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [sections\_t]( "LIEF::PE::Binary::sections_t")&, const [Section]( "LIEF::PE::Section")\*> Iterator that outputs const [Section]()& object. #### [` data_directories_t `]() using data\_directories\_t = std::vector<std::unique\_ptr<[DataDirectory]( "LIEF::PE::DataDirectory")>> Internal container for storing PE’s [DataDirectory](). #### [` it_data_directories `]() using it\_data\_directories = [ref\_iterator]( "LIEF::ref_iterator")<[data\_directories\_t]( "LIEF::PE::Binary::data_directories_t")&, [DataDirectory]( "LIEF::PE::DataDirectory")\*> Iterator that outputs [DataDirectory]()&. #### [` it_const_data_directories `]() using it\_const\_data\_directories = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [data\_directories\_t]( "LIEF::PE::Binary::data_directories_t")&, const [DataDirectory]( "LIEF::PE::DataDirectory")\*> Iterator that outputs const [DataDirectory]()&. #### [` relocations_t `]() using relocations\_t = std::vector<std::unique\_ptr<[Relocation]( "LIEF::PE::Relocation")>> Internal container for storing PE’s [Relocation](). #### [` it_relocations `]() using it\_relocations = [ref\_iterator]( "LIEF::ref_iterator")<[relocations\_t]( "LIEF::PE::Binary::relocations_t")&, [Relocation]( "LIEF::PE::Relocation")\*> Iterator that outputs [Relocation]()&. #### [` it_const_relocations `]() using it\_const\_relocations = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [relocations\_t]( "LIEF::PE::Binary::relocations_t")&, const [Relocation]( "LIEF::PE::Relocation")\*> Iterator that outputs const [Relocation]()&. #### [` imports_t `]() using imports\_t = std::vector<std::unique\_ptr<[Import]( "LIEF::PE::Import")>> Internal container for storing PE’s [Import](). #### [` it_imports `]() using it\_imports = [ref\_iterator]( "LIEF::ref_iterator")<[imports\_t]( "LIEF::PE::Binary::imports_t")&, [Import]( "LIEF::PE::Import")\*> Iterator that outputs [Import]()&. #### [` it_const_imports `]() using it\_const\_imports = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [imports\_t]( "LIEF::PE::Binary::imports_t")&, const [Import]( "LIEF::PE::Import")\*> Iterator that outputs const [Import]()&. #### [` delay_imports_t `]() using delay\_imports\_t = std::vector<std::unique\_ptr<[DelayImport]( "LIEF::PE::DelayImport")>> Internal container for storing PE’s [DelayImport](). #### [` it_delay_imports `]() using it\_delay\_imports = [ref\_iterator]( "LIEF::ref_iterator")<[delay\_imports\_t]( "LIEF::PE::Binary::delay_imports_t")&, [DelayImport]( "LIEF::PE::DelayImport")\*> Iterator that outputs [DelayImport]()&. #### [` it_const_delay_imports `]() using it\_const\_delay\_imports = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [delay\_imports\_t]( "LIEF::PE::Binary::delay_imports_t")&, const [DelayImport]( "LIEF::PE::DelayImport")\*> Iterator that outputs const [DelayImport]()&. #### [` debug_entries_t `]() using debug\_entries\_t = std::vector<std::unique\_ptr<[Debug]( "LIEF::PE::Debug")>> Internal container for storing [Debug]() information. #### [` it_debug_entries `]() using it\_debug\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[debug\_entries\_t]( "LIEF::PE::Binary::debug_entries_t")&, [Debug]( "LIEF::PE::Debug")\*> Iterator that outputs [Debug]()&. #### [` it_const_debug_entries `]() using it\_const\_debug\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [debug\_entries\_t]( "LIEF::PE::Binary::debug_entries_t")&, const [Debug]( "LIEF::PE::Debug")\*> Iterator that outputs const [Debug]()&. #### [` symbols_t `]() using symbols\_t = std::vector<std::unique\_ptr<COFF::[Symbol]( "LIEF::COFF::Symbol")>> Internal container for storing COFF Symbols. #### [` it_symbols `]() using it\_symbols = [ref\_iterator]( "LIEF::ref_iterator")<[symbols\_t]( "LIEF::PE::Binary::symbols_t")&, COFF::[Symbol]( "LIEF::COFF::Symbol")\*> Iterator that outputs [Symbol]()&. #### [` it_const_symbols `]() using it\_const\_symbols = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [symbols\_t]( "LIEF::PE::Binary::symbols_t")&, const COFF::[Symbol]( "LIEF::COFF::Symbol")\*> Iterator that outputs const [Symbol]()&. #### [` strings_table_t `]() using strings\_table\_t = std::vector<COFF::[String]( "LIEF::COFF::String")> Internal container for storing strings. #### [` it_strings_table `]() using it\_strings\_table = [ref\_iterator]( "LIEF::ref_iterator")<[strings\_table\_t]( "LIEF::PE::Binary::strings_table_t")&> Iterator that outputs [COFF::String]()&. #### [` it_const_strings_table `]() using it\_const\_strings\_table = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [strings\_table\_t]( "LIEF::PE::Binary::strings_table_t")&> Iterator that outputs const [COFF::String]()&. #### [` signatures_t `]() using signatures\_t = std::vector<[Signature]( "LIEF::PE::Signature")> Internal container for storing PE’s authenticode [Signature](). #### [` it_signatures `]() using it\_signatures = [ref\_iterator]( "LIEF::ref_iterator")<[signatures\_t]( "LIEF::PE::Binary::signatures_t")&> Iterator that outputs [Signature]()&. #### [` it_const_signatures `]() using it\_const\_signatures = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [signatures\_t]( "LIEF::PE::Binary::signatures_t")&> Iterator that outputs const [Signature]()&. #### [` exceptions_t `]() using exceptions\_t = std::vector<std::unique\_ptr<[ExceptionInfo]( "LIEF::PE::ExceptionInfo")>> Internal container for storing runtime function associated with exceptions. #### [` it_exceptions `]() using it\_exceptions = [ref\_iterator]( "LIEF::ref_iterator")<[exceptions\_t]( "LIEF::PE::Binary::exceptions_t")&, [ExceptionInfo]( "LIEF::PE::ExceptionInfo")\*> Iterator that outputs [ExceptionInfo]()&. #### [` it_const_exceptions `]() using it\_const\_exceptions = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [exceptions\_t]( "LIEF::PE::Binary::exceptions_t")&, const [ExceptionInfo]( "LIEF::PE::ExceptionInfo")\*> Iterator that outputs const [ExceptionInfo]()&. Public Functions #### [` Binary `]() Binary() #### [` ~Binary `]() ~Binary() override #### [` type `]() inline [PE\_TYPE]( "LIEF::PE::PE_TYPE") type() const Return `PE32` or `PE32+`. #### [` rva_to_offset `]() uint64\_t rva\_to\_offset(uint64\_t RVA) const Convert a Relative Virtual Address into an offset. The conversion is performed by looking for the section that encompasses the provided RVA. #### [` va_to_offset `]() inline uint64\_t va\_to\_offset(uint64\_t VA) const Convert the **absolute** virtual address into an offset. > **See also** > > [rva\_to\_offset]() #### [` offset_to_virtual_address `]() virtual [result]( "LIEF::result")<uint64\_t> offset\_to\_virtual\_address(uint64\_t offset, uint64\_t slide = 0) const override Convert the given offset into an absolute virtual address. **Parameters:** - **offset** – **[in]** The offset to convert. - **slide** – **[in]** If not 0, it will replace the default base address (if any) #### [` offset_to_rva `]() uint64\_t offset\_to\_rva(uint64\_t offset) const Convert the given offset into a relative virtual address (RVA). #### [` imagebase `]() inline virtual uint64\_t imagebase() const override Return binary’s imagebase. `0` if not relevant. The value is the same as those returned by [OptionalHeader::imagebase]() #### [` section_from_offset `]() inline [Section]( "LIEF::PE::Section") \*section\_from\_offset(uint64\_t offset) Find the section that encompasses the given offset. If no section can be found, return a nullptr #### [` section_from_offset `]() const [Section]( "LIEF::PE::Section") \*section\_from\_offset(uint64\_t offset) const #### [` section_from_rva `]() inline [Section]( "LIEF::PE::Section") \*section\_from\_rva(uint64\_t virtual\_address) Find the section that encompasses the given RVA. If no section can be found, return a nullptr #### [` section_from_rva `]() const [Section]( "LIEF::PE::Section") \*section\_from\_rva(uint64\_t virtual\_address) const #### [` sections `]() inline [it\_sections]( "LIEF::PE::Binary::it_sections") sections() Return an iterator over the PE’s [Section](). #### [` sections `]() inline [it\_const\_sections]( "LIEF::PE::Binary::it_const_sections") sections() const #### [` dos_header `]() inline [DosHeader]( "LIEF::PE::DosHeader") &dos\_header() Return a reference to the [PE::DosHeader]() object. #### [` dos_header `]() inline const [DosHeader]( "LIEF::PE::DosHeader") &dos\_header() const #### [` header `]() inline [Header]( "LIEF::PE::Header") &header() Return a reference to the [PE::Header]() object. #### [` header `]() inline const [Header]( "LIEF::PE::Header") &header() const #### [` optional_header `]() inline [OptionalHeader]( "LIEF::PE::OptionalHeader") &optional\_header() [Header]() that follows the [header()](). It is named optional from the COFF specification but it is mandatory in a PE file. #### [` optional_header `]() inline const [OptionalHeader]( "LIEF::PE::OptionalHeader") &optional\_header() const #### [` compute_checksum `]() uint32\_t compute\_checksum() const Re-compute the value of [OptionalHeader::checksum](). If both values do not match, it could mean that the binary has been modified after the compilation. This value is computed by LIEF for the current binary object. #### [` virtual_size `]() virtual uint64\_t virtual\_size() const override Compute the binary’s virtual size. It should match [OptionalHeader::sizeof\_image](). #### [` sizeof_headers `]() uint32\_t sizeof\_headers() const Compute the size of all the headers. #### [` tls `]() inline [TLS]( "LIEF::PE::TLS") \*tls() Return a reference to the [TLS]() object. #### [` tls `]() inline const [TLS]( "LIEF::PE::TLS") \*tls() const #### [` tls `]() [TLS]( "LIEF::PE::TLS") &tls(const [TLS]( "LIEF::PE::TLS") &tls) Set a [TLS]() object in the current [Binary](). #### [` has_tls `]() inline bool has\_tls() const Check if the current binary has a [TLS]() object. #### [` remove_tls `]() void remove\_tls() Remove the [TLS]() from the binary. #### [` has_imports `]() inline bool has\_imports() const Check if the current binary contains imports. > **See also** > > [Import]() #### [` has_signatures `]() inline bool has\_signatures() const Check if the current binary contains signatures. > **See also** > > [signatures]() #### [` has_exports `]() inline bool has\_exports() const Check if the current binary has exports. > **See also** > > [Export]() #### [` has_resources `]() inline bool has\_resources() const Check if the current binary has resources. #### [` has_exceptions `]() inline bool has\_exceptions() const Check if the current binary has exceptions. #### [` has_relocations `]() inline bool has\_relocations() const Check if the current binary has relocations. > **See also** > > [Relocation]() #### [` has_debug `]() inline bool has\_debug() const Check if the current binary contains debug information. #### [` has_configuration `]() inline bool has\_configuration() const Check if the current binary has a load configuration. #### [` is_reproducible_build `]() bool is\_reproducible\_build() const Check if the current binary is *reproducible build*, replacing timestamps by a compile hash. > **See also** > > [Repro]() #### [` signatures `]() inline [it\_const\_signatures]( "LIEF::PE::Binary::it_const_signatures") signatures() const Return an iterator over the [Signature]() object(s) if the binary is signed. #### [` signatures `]() inline [it\_signatures]( "LIEF::PE::Binary::it_signatures") signatures() #### [` verify_signature `]() [Signature]( "LIEF::PE::Signature")::[VERIFICATION\_FLAGS]( "LIEF::PE::Signature::VERIFICATION_FLAGS") verify\_signature([Signature]( "LIEF::PE::Signature")::[VERIFICATION\_CHECKS]( "LIEF::PE::Signature::VERIFICATION_CHECKS") checks = [Signature]( "LIEF::PE::Signature")::[VERIFICATION\_CHECKS]( "LIEF::PE::Signature::VERIFICATION_CHECKS")::[DEFAULT]( "LIEF::PE::Signature::VERIFICATION_CHECKS::DEFAULT")) const Verify the binary against the embedded signature(s) (if any) First, it checks that the embedded signatures are correct (c.f. [Signature::check]()) and then, it checks that the authentihash matches [ContentInfo::digest](). One can tweak the verification process with the [Signature::VERIFICATION\_CHECKS]() flags > **See also** > > [LIEF::PE::Signature::check]() #### [` verify_signature `]() [Signature]( "LIEF::PE::Signature")::[VERIFICATION\_FLAGS]( "LIEF::PE::Signature::VERIFICATION_FLAGS") verify\_signature(const [Signature]( "LIEF::PE::Signature") &sig, [Signature]( "LIEF::PE::Signature")::[VERIFICATION\_CHECKS]( "LIEF::PE::Signature::VERIFICATION_CHECKS") checks = [Signature]( "LIEF::PE::Signature")::[VERIFICATION\_CHECKS]( "LIEF::PE::Signature::VERIFICATION_CHECKS")::[DEFAULT]( "LIEF::PE::Signature::VERIFICATION_CHECKS::DEFAULT")) const Verify the binary with the [Signature]() object provided in the first parameter. It can be used to verify a detached signature: ```cpp result detached = LIEF::PE::SignatureParser::parse("sig.pkcs7") if (detached) { binary->verify_signature(detached.value()); } ``` #### [` authentihash `]() std::vector<uint8\_t> authentihash([ALGORITHMS]( "LIEF::PE::ALGORITHMS") algo) const Compute the authentihash according to the algorithm provided in the first parameter. #### [` get_export `]() inline [Export]( "LIEF::PE::Export") \*get\_export() Return the [Export]() object. #### [` get_export `]() inline const [Export]( "LIEF::PE::Export") \*get\_export() const #### [` set_export `]() [Export]( "LIEF::PE::Export") &set\_export(const [Export]( "LIEF::PE::Export") &export\_table) #### [` symbols `]() inline [it\_symbols]( "LIEF::PE::Binary::it_symbols") symbols() Return binary Symbols. #### [` symbols `]() inline [it\_const\_symbols]( "LIEF::PE::Binary::it_const_symbols") symbols() const #### [` coff_string_table `]() inline [it\_const\_strings\_table]( "LIEF::PE::Binary::it_const_strings_table") coff\_string\_table() const Iterator over the strings located in the COFF string table. #### [` coff_string_table `]() inline [it\_strings\_table]( "LIEF::PE::Binary::it_strings_table") coff\_string\_table() #### [` find_coff_string `]() inline COFF::[String]( "LIEF::COFF::String") \*find\_coff\_string(uint32\_t offset) Try to find the COFF string at the given offset in the COFF string table. > **Warning** > > This offset must include the first 4 bytes holding the size of the table. Hence, the first string starts at the offset 4. #### [` find_coff_string `]() inline const COFF::[String]( "LIEF::COFF::String") \*find\_coff\_string(uint32\_t offset) const #### [` resources `]() inline [ResourceNode]( "LIEF::PE::ResourceNode") \*resources() Return resources as a tree or a nullptr if there is no resources. #### [` resources `]() inline const [ResourceNode]( "LIEF::PE::ResourceNode") \*resources() const #### [` set_resources `]() [ResourceNode]( "LIEF::PE::ResourceNode") \*set\_resources(const [ResourceNode]( "LIEF::PE::ResourceNode") &root) Change or set the current resource tree with the new one provided in parameter. #### [` set_resources `]() [ResourceNode]( "LIEF::PE::ResourceNode") \*set\_resources(std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> root) #### [` resources_manager `]() [result]( "LIEF::result")<[ResourcesManager]( "LIEF::PE::ResourcesManager")> resources\_manager() const Return the [ResourcesManager]() (class to manage resources more easily than the tree one). #### [` get_section `]() inline [Section]( "LIEF::PE::Section") \*get\_section(const std::string &name) Return binary’s section from its name. If the section can’t be found, return a nullptr. **Parameters:** **name** – **[in]** Name of the [Section]() #### [` get_section `]() const [Section]( "LIEF::PE::Section") \*get\_section(const std::string &name) const #### [` import_section `]() const [Section]( "LIEF::PE::Section") \*import\_section() const Return the section associated with import table or a nullptr if the binary does not have an import table. #### [` import_section `]() inline [Section]( "LIEF::PE::Section") \*import\_section() #### [` remove_section `]() virtual void remove\_section(const std::string &name, bool clear = false) override Delete the section with the given name. **Parameters:** - **name** – **[in]** Name of section to delete - **clear** – **[in]** if `true` clear the section’s content with 0 before removing (default: `false`) #### [` remove `]() void remove(const [Section]( "LIEF::PE::Section") &section, bool clear = false) Remove the given section. > **See also** > > [remove\_section]() #### [` add_section `]() [Section]( "LIEF::PE::Section") \*add\_section(const [Section]( "LIEF::PE::Section") &section) Add a section to the binary and return the section added. #### [` relocations `]() inline [it\_relocations]( "LIEF::PE::Binary::it_relocations") relocations() Return an iterator over the PE’s [Relocation](). #### [` relocations `]() inline [it\_const\_relocations]( "LIEF::PE::Binary::it_const_relocations") relocations() const #### [` add_relocation `]() [Relocation]( "LIEF::PE::Relocation") &add\_relocation(const [Relocation]( "LIEF::PE::Relocation") &relocation) Add a new PE [Relocation](). #### [` remove_all_relocations `]() void remove\_all\_relocations() Remove all the relocations. #### [` data_directories `]() inline [it\_data\_directories]( "LIEF::PE::Binary::it_data_directories") data\_directories() Return an iterator over the [DataDirectory]() present in the [Binary](). #### [` data_directories `]() inline [it\_const\_data\_directories]( "LIEF::PE::Binary::it_const_data_directories") data\_directories() const #### [` data_directory `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*data\_directory([DataDirectory]( "LIEF::PE::DataDirectory")::[TYPES]( "LIEF::PE::DataDirectory::TYPES") type) Return the [DataDirectory]() with the given type (or index). #### [` data_directory `]() const [DataDirectory]( "LIEF::PE::DataDirectory") \*data\_directory([DataDirectory]( "LIEF::PE::DataDirectory")::[TYPES]( "LIEF::PE::DataDirectory::TYPES") type) const #### [` has `]() inline bool has([DataDirectory]( "LIEF::PE::DataDirectory")::[TYPES]( "LIEF::PE::DataDirectory::TYPES") type) const Check if the current binary has the given [DataDirectory::TYPES](). #### [` debug `]() inline [it\_debug\_entries]( "LIEF::PE::Binary::it_debug_entries") debug() Return an iterator over the [Debug]() entries. #### [` debug `]() inline [it\_const\_debug\_entries]( "LIEF::PE::Binary::it_const_debug_entries") debug() const #### [` add_debug_info `]() [Debug]( "LIEF::PE::Debug") \*add\_debug\_info(const [Debug]( "LIEF::PE::Debug") &entry) Add a new debug entry. #### [` remove_debug `]() bool remove\_debug(const [Debug]( "LIEF::PE::Debug") &entry) Remove a specific debug entry. #### [` clear_debug `]() bool clear\_debug() Remove all debug info from the binary. #### [` codeview_pdb `]() const [CodeViewPDB]( "LIEF::PE::CodeViewPDB") \*codeview\_pdb() const Return the [CodeViewPDB]() object if present. #### [` codeview_pdb `]() inline [CodeViewPDB]( "LIEF::PE::CodeViewPDB") \*codeview\_pdb() #### [` load_configuration `]() inline const [LoadConfiguration]( "LIEF::PE::LoadConfiguration") \*load\_configuration() const Return the [LoadConfiguration]() object or a nullptr if the binary does not use the [LoadConfiguration](). #### [` load_configuration `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") \*load\_configuration() #### [` overlay `]() inline span<const uint8\_t> overlay() const Return the overlay content. #### [` overlay `]() inline span<uint8\_t> overlay() #### [` overlay_offset `]() inline uint64\_t overlay\_offset() const Return the original overlay offset. #### [` dos_stub `]() inline span<const uint8\_t> dos\_stub() const Return the DOS stub content. #### [` dos_stub `]() inline span<uint8\_t> dos\_stub() #### [` dos_stub `]() inline void dos\_stub(std::vector<uint8\_t> content) Update the DOS stub content. #### [` rich_header `]() inline [RichHeader]( "LIEF::PE::RichHeader") \*rich\_header() Return a reference to the [RichHeader]() object. #### [` rich_header `]() inline const [RichHeader]( "LIEF::PE::RichHeader") \*rich\_header() const #### [` rich_header `]() void rich\_header(const [RichHeader]( "LIEF::PE::RichHeader") &rich\_header) Set a [RichHeader]() object in the current [Binary](). #### [` has_rich_header `]() inline bool has\_rich\_header() const Check if the current binary has a [RichHeader]() object. #### [` imports `]() inline [it\_imports]( "LIEF::PE::Binary::it_imports") imports() Return an iterator over the binary imports. #### [` imports `]() inline [it\_const\_imports]( "LIEF::PE::Binary::it_const_imports") imports() const #### [` get_import `]() inline [Import]( "LIEF::PE::Import") \*get\_import(const std::string &import\_name) Return the [Import]() matching the provided name (case-sensitive). If the import can’t be found, it returns a nullptr #### [` get_import `]() const [Import]( "LIEF::PE::Import") \*get\_import(const std::string &import\_name) const #### [` has_import `]() inline bool has\_import(const std::string &import\_name) const `True` if the binary imports the given library name #### [` has_delay_imports `]() inline bool has\_delay\_imports() const Check if the current binary contains delay imports. #### [` delay_imports `]() inline [it\_delay\_imports]( "LIEF::PE::Binary::it_delay_imports") delay\_imports() Return an iterator over the binary’s delay imports. #### [` delay_imports `]() inline [it\_const\_delay\_imports]( "LIEF::PE::Binary::it_const_delay_imports") delay\_imports() const #### [` get_delay_import `]() inline [DelayImport]( "LIEF::PE::DelayImport") \*get\_delay\_import(const std::string &import\_name) Returns the [DelayImport]() matching the given name. If it can’t be found, it returns a nullptr. #### [` get_delay_import `]() const [DelayImport]( "LIEF::PE::DelayImport") \*get\_delay\_import(const std::string &import\_name) const #### [` has_delay_import `]() inline bool has\_delay\_import(const std::string &import\_name) const `True` if the binary delay-imports the given library name #### [` add_import `]() inline [Import]( "LIEF::PE::Import") &add\_import(const std::string &name, int32\_t pos = -1) Add an imported library (i.e. `DLL`) to the binary. The second parameter `pos` defines where to insert the import. If negative (default), the import is appended to the end of the list. #### [` remove_import `]() bool remove\_import(const std::string &name) Remove the imported library with the given `name`. Return true if the deletion succeeded, false otherwise. #### [` remove_all_imports `]() inline void remove\_all\_imports() Remove all libraries in the binary. #### [` write `]() inline std::unique\_ptr<[Builder]( "LIEF::PE::Builder")> write(const std::string &filename) Reconstruct the binary object and write the raw PE in `filename`. #### [` write `]() std::unique\_ptr<[Builder]( "LIEF::PE::Builder")> write(const std::string &filename, const [Builder]( "LIEF::PE::Builder")::[config\_t]( "LIEF::PE::Builder::config_t") &config) Reconstruct the binary object with the given configuration and write it in `filename`. #### [` write `]() inline std::unique\_ptr<[Builder]( "LIEF::PE::Builder")> write(std::ostream &os) Reconstruct the binary object and write the raw PE in `os` stream. Rebuild a PE binary from the current [Binary]() object. When rebuilding, import table and relocations are not rebuilt. #### [` write `]() std::unique\_ptr<[Builder]( "LIEF::PE::Builder")> write(std::ostream &os, const [Builder]( "LIEF::PE::Builder")::[config\_t]( "LIEF::PE::Builder::config_t") &config) #### [` accept `]() virtual void accept(Visitor &visitor) const override Method so that a `visitor` can visit us. #### [` patch_address `]() virtual void patch\_address(uint64\_t address, const std::vector<uint8\_t> &patch\_value, VA\_TYPES addr\_type = VA\_TYPES::AUTO) override Patch the content at virtual address `address` with `patch_value`. **Parameters:** - **address** – **[in]** Address to patch - **patch\_value** – **[in]** Patch to apply - **addr\_type** – **[in]** Type of the Virtual address: VA or RVA. Default: Auto #### [` patch_address `]() virtual void patch\_address(uint64\_t address, uint64\_t patch\_value, size\_t size = sizeof(uint64\_t), VA\_TYPES addr\_type = VA\_TYPES::AUTO) override Patch the address with the given value. **Parameters:** - **address** – **[in]** Address to patch - **patch\_value** – **[in]** Patch to apply - **size** – **[in]** Size of the value in **bytes** (1, 2, … 8) - **addr\_type** – **[in]** Type of the Virtual address: VA or RVA. Default: Auto #### [` fill_address `]() void fill\_address(uint64\_t address, size\_t size, uint8\_t value = 0, VA\_TYPES addr\_type = VA\_TYPES::AUTO) Fill the content at the provided address with a fixed value. #### [` get_content_from_virtual_address `]() virtual span<const uint8\_t> get\_content\_from\_virtual\_address(uint64\_t virtual\_address, uint64\_t size, [Binary]( "LIEF::PE::Binary")::VA\_TYPES addr\_type = [Binary]( "LIEF::PE::Binary")::VA\_TYPES::AUTO) const override Return the content located at the provided virtual address. **Parameters:** - **virtual\_address** – **[in]** Virtual address of the data to retrieve - **size** – **[in]** Size in bytes of the data to retrieve - **addr\_type** – **[in]** Type of the Virtual address: VA or RVA. Default: Auto #### [` entrypoint `]() inline virtual uint64\_t entrypoint() const override Return the binary’s entrypoint (it is the same value as [OptionalHeader::addressof\_entrypoint]()). #### [` is_pie `]() inline virtual bool is\_pie() const override Check if the binary is position independent. #### [` has_nx `]() inline virtual bool has\_nx() const override Check if the binary uses `NX` protection. #### [` last_section_offset `]() uint64\_t last\_section\_offset() const #### [` export_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*export\_dir() Return the data directory associated with the export table. #### [` export_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*export\_dir() const #### [` import_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*import\_dir() Return the data directory associated with the import table. #### [` import_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*import\_dir() const #### [` rsrc_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*rsrc\_dir() Return the data directory associated with the resources tree. #### [` rsrc_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*rsrc\_dir() const #### [` exceptions_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*exceptions\_dir() Return the data directory associated with the exceptions. #### [` exceptions_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*exceptions\_dir() const #### [` cert_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*cert\_dir() Return the data directory associated with the certificate table (authenticode). #### [` cert_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*cert\_dir() const #### [` relocation_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*relocation\_dir() Return the data directory associated with the relocation table. #### [` relocation_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*relocation\_dir() const #### [` debug_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*debug\_dir() Return the data directory associated with the debug table. #### [` debug_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*debug\_dir() const #### [` tls_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*tls\_dir() Return the data directory associated with [TLS](). #### [` tls_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*tls\_dir() const #### [` load_config_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*load\_config\_dir() Return the data directory associated with the load config. #### [` load_config_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*load\_config\_dir() const #### [` iat_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*iat\_dir() Return the data directory associated with the IAT. #### [` iat_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*iat\_dir() const #### [` delay_dir `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*delay\_dir() Return the data directory associated with delayed imports. #### [` delay_dir `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*delay\_dir() const #### [` ctor_functions `]() virtual LIEF::[Binary]( "LIEF::Binary")::[functions\_t]( "LIEF::Binary::functions_t") ctor\_functions() const override Return the list of the binary constructors. In a PE file, we consider a constructors as a callback in the [TLS]() object #### [` functions `]() LIEF::[Binary]( "LIEF::Binary")::[functions\_t]( "LIEF::Binary::functions_t") functions() const **All** functions found in the binary #### [` exception_functions `]() LIEF::[Binary]( "LIEF::Binary")::[functions\_t]( "LIEF::Binary::functions_t") exception\_functions() const Functions found in the Exception table directory. #### [` exceptions `]() inline [it\_exceptions]( "LIEF::PE::Binary::it_exceptions") exceptions() Iterator over the exception (`_RUNTIME_FUNCTION`) functions. > **Warning** > > This function requires that the option [LIEF::PE::ParserConfig::parse\_exceptions]() was turned on (default is false) when parsing the binary #### [` exceptions `]() inline [it\_const\_exceptions]( "LIEF::PE::Binary::it_const_exceptions") exceptions() const #### [` find_exception_at `]() [ExceptionInfo]( "LIEF::PE::ExceptionInfo") \*find\_exception\_at(uint32\_t rva) Try to find the exception info at the given RVA. > **Warning** > > This function requires that the option [LIEF::PE::ParserConfig::parse\_exceptions]() was turned on (default is false) when parsing the binary #### [` find_exception_at `]() inline const [ExceptionInfo]( "LIEF::PE::ExceptionInfo") \*find\_exception\_at(uint32\_t rva) const #### [` is_arm64ec `]() bool is\_arm64ec() const True if this binary is compiled in ARM64EC mode (emulation compatible). #### [` is_arm64x `]() bool is\_arm64x() const True if this binary is compiled in ARM64X mode (contains both ARM64 and ARM64EC code). #### [` nested_pe_binary `]() inline const [Binary]( "LIEF::PE::Binary") \*nested\_pe\_binary() const If the current binary contains dynamic relocations (e.g. [LIEF::PE::DynamicFixupARM64X]()), this function returns the **relocated** view of the current PE. This can be used to get the alternative PE binary, targeting a different architectures. > **Warning** > > This function requires that the option [LIEF::PE::ParserConfig::parse\_arm64x\_binary]() was turned on (default is false) when parsing the binary #### [` nested_pe_binary `]() inline [Binary]( "LIEF::PE::Binary") \*nested\_pe\_binary() #### [` get_function_address `]() virtual [result]( "LIEF::result")<uint64\_t> get\_function\_address(const std::string &name) const override Attempt to resolve the address of the function specified by `name`. #### [` print `]() virtual std::ostream &print(std::ostream &os) const override Public Static Functions #### [` classof `]() static inline bool classof(const LIEF::[Binary]( "LIEF::Binary") \*bin) --- ## [Dos Header]() ### [` DosHeader `]() class DosHeader : public LIEF::Object Class which represents the [DosHeader](), the **first** structure present at the beginning of a PE file. Most of the attributes of this structures are no longer relevant. Public Types #### [` reserved_t `]() using reserved\_t = std::array<uint16\_t, 4> #### [` reserved2_t `]() using reserved2\_t = std::array<uint16\_t, 10> Public Functions #### [` DosHeader `]() DosHeader(const details::pe\_dos\_header &header) #### [` DosHeader `]() DosHeader(const [DosHeader]( "LIEF::PE::DosHeader::DosHeader")&) = default #### [` operator= `]() [DosHeader]( "LIEF::PE::DosHeader") &operator=(const [DosHeader]( "LIEF::PE::DosHeader")&) = default #### [` DosHeader `]() DosHeader([DosHeader]( "LIEF::PE::DosHeader::DosHeader")&&) = default #### [` operator= `]() [DosHeader]( "LIEF::PE::DosHeader") &operator=([DosHeader]( "LIEF::PE::DosHeader")&&) = default #### [` ~DosHeader `]() ~DosHeader() override = default #### [` magic `]() inline uint16\_t magic() const Magic bytes identifying a DOS/PE binary. #### [` used_bytes_in_last_page `]() inline uint16\_t used\_bytes\_in\_last\_page() const #### [` file_size_in_pages `]() inline uint16\_t file\_size\_in\_pages() const #### [` numberof_relocation `]() inline uint16\_t numberof\_relocation() const #### [` header_size_in_paragraphs `]() inline uint16\_t header\_size\_in\_paragraphs() const #### [` minimum_extra_paragraphs `]() inline uint16\_t minimum\_extra\_paragraphs() const #### [` maximum_extra_paragraphs `]() inline uint16\_t maximum\_extra\_paragraphs() const #### [` initial_relative_ss `]() inline uint16\_t initial\_relative\_ss() const #### [` initial_sp `]() inline uint16\_t initial\_sp() const #### [` checksum `]() inline uint16\_t checksum() const #### [` initial_ip `]() inline uint16\_t initial\_ip() const #### [` initial_relative_cs `]() inline uint16\_t initial\_relative\_cs() const #### [` addressof_relocation_table `]() inline uint16\_t addressof\_relocation\_table() const #### [` overlay_number `]() inline uint16\_t overlay\_number() const #### [` reserved `]() inline const [reserved\_t]( "LIEF::PE::DosHeader::reserved_t") &reserved() const #### [` oem_id `]() inline uint16\_t oem\_id() const #### [` oem_info `]() inline uint16\_t oem\_info() const #### [` reserved2 `]() inline const [reserved2\_t]( "LIEF::PE::DosHeader::reserved2_t") &reserved2() const #### [` addressof_new_exeheader `]() inline uint32\_t addressof\_new\_exeheader() const Return the offset to the [PE::Header]() structure. #### [` magic `]() inline void magic(uint16\_t magic) #### [` used_bytes_in_last_page `]() inline void used\_bytes\_in\_last\_page(uint16\_t value) #### [` file_size_in_pages `]() inline void file\_size\_in\_pages(uint16\_t value) #### [` numberof_relocation `]() inline void numberof\_relocation(uint16\_t value) #### [` header_size_in_paragraphs `]() inline void header\_size\_in\_paragraphs(uint16\_t value) #### [` minimum_extra_paragraphs `]() inline void minimum\_extra\_paragraphs(uint16\_t value) #### [` maximum_extra_paragraphs `]() inline void maximum\_extra\_paragraphs(uint16\_t value) #### [` initial_relative_ss `]() inline void initial\_relative\_ss(uint16\_t value) #### [` initial_sp `]() inline void initial\_sp(uint16\_t value) #### [` checksum `]() inline void checksum(uint16\_t value) #### [` initial_ip `]() inline void initial\_ip(uint16\_t value) #### [` initial_relative_cs `]() inline void initial\_relative\_cs(uint16\_t value) #### [` addressof_relocation_table `]() inline void addressof\_relocation\_table(uint16\_t value) #### [` overlay_number `]() inline void overlay\_number(uint16\_t value) #### [` reserved `]() inline void reserved(const [reserved\_t]( "LIEF::PE::DosHeader::reserved_t") &reserved) #### [` oem_id `]() inline void oem\_id(uint16\_t value) #### [` oem_info `]() inline void oem\_info(uint16\_t value) #### [` reserved2 `]() inline void reserved2(const [reserved2\_t]( "LIEF::PE::DosHeader::reserved2_t") &reserved2) #### [` addressof_new_exeheader `]() inline void addressof\_new\_exeheader(uint32\_t value) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` create `]() static [DosHeader]( "LIEF::PE::DosHeader") create([PE\_TYPE]( "LIEF::PE::PE_TYPE") type) Public Static Attributes #### [` MAGIC `]() static uint16\_t MAGIC = 0x5a4d Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [DosHeader]( "LIEF::PE::DosHeader") &entry) --- ## [Header]() ### [` Header `]() class Header : public LIEF::Object Class that represents the PE header (which follows the [DosHeader]()). Public Types #### [` MACHINE_TYPES `]() enum class MACHINE\_TYPES *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0x0 ##### [` ALPHA `]() enumerator ALPHA = 0x184 Alpha AXP, 32-bit address space ##### [` ALPHA64 `]() enumerator ALPHA64 = 0x284 Alpha AXP, 64-bit address space ##### [` AM33 `]() enumerator AM33 = 0x1D3 Matsushita AM33 ##### [` AMD64 `]() enumerator AMD64 = 0x8664 AMD x64 ##### [` ARM `]() enumerator ARM = 0x1C0 ARM little endian ##### [` ARMNT `]() enumerator ARMNT = 0x1C4 ARMv7 Thumb mode only ##### [` ARM64 `]() enumerator ARM64 = 0xAA64 ARMv8 in 64-bits mode ##### [` EBC `]() enumerator EBC = 0xEBC EFI byte code ##### [` I386 `]() enumerator I386 = 0x14C Intel 386 or later ##### [` IA64 `]() enumerator IA64 = 0x200 Intel Itanium processor family ##### [` LOONGARCH32 `]() enumerator LOONGARCH32 = 0x6232 LoongArch 32-bit processor family ##### [` LOONGARCH64 `]() enumerator LOONGARCH64 = 0x6264 LoongArch 64-bit processor family ##### [` M32R `]() enumerator M32R = 0x9041 Mitsubishi M32R little endian ##### [` MIPS16 `]() enumerator MIPS16 = 0x266 MIPS16 ##### [` MIPSFPU `]() enumerator MIPSFPU = 0x366 MIPS with FPU ##### [` MIPSFPU16 `]() enumerator MIPSFPU16 = 0x466 MIPS16 with FPU ##### [` POWERPC `]() enumerator POWERPC = 0x1F0 Power PC little endian ##### [` POWERPCFP `]() enumerator POWERPCFP = 0x1F1 Power PC with floating point ##### [` POWERPCBE `]() enumerator POWERPCBE = 0x1F2 Power PC big endian ##### [` R4000 `]() enumerator R4000 = 0x166 MIPS with little endian ##### [` RISCV32 `]() enumerator RISCV32 = 0x5032 RISC-V 32-bit address space ##### [` RISCV64 `]() enumerator RISCV64 = 0x5064 RISC-V 64-bit address space ##### [` RISCV128 `]() enumerator RISCV128 = 0x5128 RISC-V 128-bit address space ##### [` SH3 `]() enumerator SH3 = 0x1A2 Hitachi SH3 ##### [` SH3DSP `]() enumerator SH3DSP = 0x1A3 Hitachi SH3 DSP ##### [` SH4 `]() enumerator SH4 = 0x1A6 Hitachi SH4 ##### [` SH5 `]() enumerator SH5 = 0x1A8 Hitachi SH5 ##### [` THUMB `]() enumerator THUMB = 0x1C2 ARM or Thumb ##### [` WCEMIPSV2 `]() enumerator WCEMIPSV2 = 0x169 MIPS little-endian WCE v2 ##### [` ARM64EC `]() enumerator ARM64EC = 0xa641 ##### [` ARM64X `]() enumerator ARM64X = 0xa64e ##### [` CHPE_X86 `]() enumerator CHPE\_X86 = 0x3a64 #### [` CHARACTERISTICS `]() enum class CHARACTERISTICS *Values:* ##### [` NONE `]() enumerator NONE = 0x0000 ##### [` RELOCS_STRIPPED `]() enumerator RELOCS\_STRIPPED = 0x0001 The file does not contain base relocations and must be loaded at its preferred base. If this cannot be done, the loader will error. ##### [` EXECUTABLE_IMAGE `]() enumerator EXECUTABLE\_IMAGE = 0x0002 File is executable (i.e. no unresolved external references). ##### [` LINE_NUMS_STRIPPED `]() enumerator LINE\_NUMS\_STRIPPED = 0x0004 COFF line numbers have been stripped. This is deprecated and should be 0. ##### [` LOCAL_SYMS_STRIPPED `]() enumerator LOCAL\_SYMS\_STRIPPED = 0x0008 COFF symbol table entries for local symbols have been removed. This is deprecated and should be 0. ##### [` AGGRESSIVE_WS_TRIM `]() enumerator AGGRESSIVE\_WS\_TRIM = 0x0010 Aggressively trim working set. This is deprecated and must be 0. ##### [` LARGE_ADDRESS_AWARE `]() enumerator LARGE\_ADDRESS\_AWARE = 0x0020 Image can handle > 2GiB addresses. ##### [` BYTES_REVERSED_LO `]() enumerator BYTES\_REVERSED\_LO = 0x0080 Little endian: the LSB precedes the MSB in memory. This is deprecated and should be 0. ##### [` NEED_32BIT_MACHINE `]() enumerator NEED\_32BIT\_MACHINE = 0x0100 Machine is based on a 32bit word architecture. ##### [` DEBUG_STRIPPED `]() enumerator DEBUG\_STRIPPED = 0x0200 Debugging info has been removed. ##### [` REMOVABLE_RUN_FROM_SWAP `]() enumerator REMOVABLE\_RUN\_FROM\_SWAP = 0x0400 If the image is on removable media, fully load it and copy it to swap. ##### [` NET_RUN_FROM_SWAP `]() enumerator NET\_RUN\_FROM\_SWAP = 0x0800 If the image is on network media, fully load it and copy it to swap. ##### [` SYSTEM `]() enumerator SYSTEM = 0x1000 The image file is a system file, not a user program. ##### [` DLL `]() enumerator DLL = 0x2000 The image file is a DLL. ##### [` UP_SYSTEM_ONLY `]() enumerator UP\_SYSTEM\_ONLY = 0x4000 This file should only be run on a uniprocessor machine. ##### [` BYTES_REVERSED_HI `]() enumerator BYTES\_REVERSED\_HI = 0x8000 Big endian: the MSB precedes the LSB in memory. This is deprecated. #### [` signature_t `]() using signature\_t = std::array<uint8\_t, 4> Public Functions #### [` Header `]() Header(const details::pe\_header &header) #### [` ~Header `]() ~Header() override = default #### [` operator= `]() [Header]( "LIEF::PE::Header") &operator=(const [Header]( "LIEF::PE::Header")&) = default #### [` Header `]() Header(const [Header]( "LIEF::PE::Header::Header")&) = default #### [` signature `]() inline const [signature\_t]( "LIEF::PE::Header::signature_t") &signature() const [Signature]() (or magic byte) of the header. It must be: `PE\0\0`. #### [` machine `]() inline [MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") machine() const The targeted machine architecture like ARM, x86, AMD64, … #### [` numberof_sections `]() inline uint16\_t numberof\_sections() const The number of sections in the binary. #### [` time_date_stamp `]() inline uint32\_t time\_date\_stamp() const The low 32 bits of the number of seconds since January 1, 1970. It **indicates** when the file was created. #### [` pointerto_symbol_table `]() inline uint32\_t pointerto\_symbol\_table() const The offset of the **COFF** symbol table. This value should be zero for an image because COFF debugging information is deprecated. #### [` numberof_symbols `]() inline uint32\_t numberof\_symbols() const The number of entries in the symbol table. This data can be used to locate the string table which immediately follows the symbol table. This value should be zero for an image because COFF debugging information is deprecated. #### [` sizeof_optional_header `]() inline uint16\_t sizeof\_optional\_header() const Size of the [OptionalHeader]() **AND** the data directories which follows this header. This value is equivalent to: `sizeof(pe_optional_header) + NB_DATA_DIR * sizeof(data_directory)` This size **should** be either: - 0xE0 (224) for a PE32 (32 bits) - 0xF0 (240) for a PE32+ (64 bits) #### [` characteristics `]() inline uint32\_t characteristics() const Characteristics of the binary like whether it is a DLL or an executable. #### [` has_characteristic `]() inline bool has\_characteristic([CHARACTERISTICS]( "LIEF::PE::Header::CHARACTERISTICS") c) const Check if the given [CHARACTERISTICS]() is present. #### [` characteristics_list `]() std::vector<[CHARACTERISTICS]( "LIEF::PE::Header::CHARACTERISTICS")> characteristics\_list() const The list of the [CHARACTERISTICS](). #### [` machine `]() inline void machine([MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") type) #### [` numberof_sections `]() inline void numberof\_sections(uint16\_t nb) #### [` time_date_stamp `]() inline void time\_date\_stamp(uint32\_t timestamp) #### [` pointerto_symbol_table `]() inline void pointerto\_symbol\_table(uint32\_t ptr) #### [` numberof_symbols `]() inline void numberof\_symbols(uint32\_t nb) #### [` sizeof_optional_header `]() inline void sizeof\_optional\_header(uint16\_t size) #### [` characteristics `]() inline void characteristics(uint32\_t characteristics) #### [` signature `]() inline void signature(const [signature\_t]( "LIEF::PE::Header::signature_t") &sig) #### [` add_characteristic `]() inline void add\_characteristic([CHARACTERISTICS]( "LIEF::PE::Header::CHARACTERISTICS") c) #### [` remove_characteristic `]() inline void remove\_characteristic([CHARACTERISTICS]( "LIEF::PE::Header::CHARACTERISTICS") c) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` is_known_machine `]() static bool is\_known\_machine(uint16\_t machine) #### [` is_arm `]() static inline bool is\_arm([MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") ty) #### [` is_riscv `]() static inline bool is\_riscv([MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") ty) #### [` is_loonarch `]() static inline bool is\_loonarch([MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") ty) #### [` is_arm64 `]() static inline bool is\_arm64([MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") ty) #### [` is_thumb `]() static inline bool is\_thumb([MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") ty) #### [` x86 `]() static inline bool x86([MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") ty) #### [` x86_64 `]() static inline bool x86\_64([MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") ty) #### [` is_mips `]() static inline bool is\_mips([MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") ty) #### [` is_ppc `]() static inline bool is\_ppc([MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") ty) #### [` create `]() static [Header]( "LIEF::PE::Header") create([PE\_TYPE]( "LIEF::PE::PE_TYPE") type) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Header]( "LIEF::PE::Header") &entry) --- ## [Optional Header]() ### [` OptionalHeader `]() class OptionalHeader : public LIEF::Object Class which represents the PE [OptionalHeader]() structure. Note that the term *optional* comes from the COFF specifications but this header is **mandatory** for a PE binary. Public Types #### [` DLL_CHARACTERISTICS `]() enum class DLL\_CHARACTERISTICS : size\_t *Values:* ##### [` HIGH_ENTROPY_VA `]() enumerator HIGH\_ENTROPY\_VA = 0x0020 ASLR with 64 bit address space. ##### [` DYNAMIC_BASE `]() enumerator DYNAMIC\_BASE = 0x0040 DLL can be relocated at load time. ##### [` FORCE_INTEGRITY `]() enumerator FORCE\_INTEGRITY = 0x0080 Code integrity checks are enforced. ##### [` NX_COMPAT `]() enumerator NX\_COMPAT = 0x0100 Image is NX compatible. ##### [` NO_ISOLATION `]() enumerator NO\_ISOLATION = 0x0200 Isolation aware, but do not isolate the image. ##### [` NO_SEH `]() enumerator NO\_SEH = 0x0400 Does not use structured exception handling (SEH). No SEH handler may be called in this image. ##### [` NO_BIND `]() enumerator NO\_BIND = 0x0800 Do not bind the image. ##### [` APPCONTAINER `]() enumerator APPCONTAINER = 0x1000 Image should execute in an AppContainer. ##### [` WDM_DRIVER `]() enumerator WDM\_DRIVER = 0x2000 A WDM driver. ##### [` GUARD_CF `]() enumerator GUARD\_CF = 0x4000 Image supports Control Flow Guard. ##### [` TERMINAL_SERVER_AWARE `]() enumerator TERMINAL\_SERVER\_AWARE = 0x8000 Terminal Server aware. #### [` SUBSYSTEM `]() enum class SUBSYSTEM : size\_t *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 An unknown subsystem. ##### [` NATIVE `]() enumerator NATIVE = 1 Device drivers and native Windows processes. ##### [` WINDOWS_GUI `]() enumerator WINDOWS\_GUI = 2 The Windows GUI subsystem. ##### [` WINDOWS_CUI `]() enumerator WINDOWS\_CUI = 3 The Windows character subsystem. ##### [` OS2_CUI `]() enumerator OS2\_CUI = 5 The OS/2 character subsystem. ##### [` POSIX_CUI `]() enumerator POSIX\_CUI = 7 The POSIX character subsystem. ##### [` NATIVE_WINDOWS `]() enumerator NATIVE\_WINDOWS = 8 Native Windows 9x driver. ##### [` WINDOWS_CE_GUI `]() enumerator WINDOWS\_CE\_GUI = 9 Windows CE. ##### [` EFI_APPLICATION `]() enumerator EFI\_APPLICATION = 10 An EFI application. ##### [` EFI_BOOT_SERVICE_DRIVER `]() enumerator EFI\_BOOT\_SERVICE\_DRIVER = 11 An EFI driver with boot services. ##### [` EFI_RUNTIME_DRIVER `]() enumerator EFI\_RUNTIME\_DRIVER = 12 An EFI driver with run-time services. ##### [` EFI_ROM `]() enumerator EFI\_ROM = 13 An EFI ROM image. ##### [` XBOX `]() enumerator XBOX = 14 XBOX. ##### [` WINDOWS_BOOT_APPLICATION `]() enumerator WINDOWS\_BOOT\_APPLICATION = 16 A BCD application. ##### [` XBOX_CODE_CATALOG `]() enumerator XBOX\_CODE\_CATALOG = 17 Security Metadata Containers. Public Functions #### [` OptionalHeader `]() OptionalHeader(const details::pe32\_optional\_header &header) #### [` OptionalHeader `]() OptionalHeader(const details::pe64\_optional\_header &header) #### [` ~OptionalHeader `]() ~OptionalHeader() override = default #### [` operator= `]() [OptionalHeader]( "LIEF::PE::OptionalHeader") &operator=(const [OptionalHeader]( "LIEF::PE::OptionalHeader")&) = default #### [` OptionalHeader `]() OptionalHeader(const [OptionalHeader]( "LIEF::PE::OptionalHeader::OptionalHeader")&) = default #### [` magic `]() inline [PE\_TYPE]( "LIEF::PE::PE_TYPE") magic() const Magic bytes: either `PE32` or `PE32+` for 64-bits PE files. #### [` major_linker_version `]() inline uint8\_t major\_linker\_version() const The linker major version. #### [` minor_linker_version `]() inline uint8\_t minor\_linker\_version() const The linker minor version. #### [` sizeof_code `]() inline uint32\_t sizeof\_code() const The size of the code `.text` section or the sum of all the sections that contain code (i.e. [PE::Section]() with the flag [Section::CHARACTERISTICS::CNT\_CODE]()). #### [` sizeof_initialized_data `]() inline uint32\_t sizeof\_initialized\_data() const The size of the initialized data which are usually located in the `.data` section. If the initialized data are split across multiple sections, it is the sum of the sections. The sections associated with the initialized data are usually identified with the flag [Section::CHARACTERISTICS::CNT\_INITIALIZED\_DATA]() #### [` sizeof_uninitialized_data `]() inline uint32\_t sizeof\_uninitialized\_data() const The size of the uninitialized data which are usually located in the `.bss` section. If the uninitialized data are split across multiple sections, it is the sum of the sections. The sections associated with the uninitialized data are usually identified with the flag [Section::CHARACTERISTICS::CNT\_UNINITIALIZED\_DATA]() #### [` addressof_entrypoint `]() inline uint32\_t addressof\_entrypoint() const The address of the entry point relative to the image base when the executable file is loaded into memory. For program images, this is the starting address. For device drivers, this is the address of the initialization function. An entry point is optional for DLLs. When no entry point is present, this field must be zero. #### [` baseof_code `]() inline uint32\_t baseof\_code() const Address relative to the imagebase where the binary’s code starts. #### [` baseof_data `]() inline uint32\_t baseof\_data() const Address relative to the imagebase where the binary’s data starts. > **Warning** > > This value is not present for PE64 files #### [` imagebase `]() inline uint64\_t imagebase() const The preferred base address when mapping the binary in memory. #### [` section_alignment `]() inline uint32\_t section\_alignment() const The alignment (in bytes) of sections when they are loaded into memory. It must be greater than or equal to file\_alignment and the default is the page size for the architecture. #### [` file_alignment `]() inline uint32\_t file\_alignment() const The section’s file alignment. This value must be a power of 2 between 512 and 64K. The default value is usually 512. #### [` major_operating_system_version `]() inline uint16\_t major\_operating\_system\_version() const The **major** version number of the required operating system. #### [` minor_operating_system_version `]() inline uint16\_t minor\_operating\_system\_version() const The **minor** version number of the required operating system. #### [` major_image_version `]() inline uint16\_t major\_image\_version() const The major version number of the image. #### [` minor_image_version `]() inline uint16\_t minor\_image\_version() const The minor version number of the image. #### [` major_subsystem_version `]() inline uint16\_t major\_subsystem\_version() const The major version number of the subsystem. #### [` minor_subsystem_version `]() inline uint16\_t minor\_subsystem\_version() const The minor version number of the subsystem. #### [` win32_version_value `]() inline uint32\_t win32\_version\_value() const According to the official PE specifications, this value is reserved and **should** be 0. #### [` sizeof_image `]() inline uint32\_t sizeof\_image() const The size (in bytes) of the image, including all headers, as the image is loaded in memory. It must be a multiple of section\_alignment and should match [Binary::virtual\_size]() #### [` sizeof_headers `]() inline uint32\_t sizeof\_headers() const Size of the [DosHeader]() + PE [Header]() + [Section]() headers rounded up to a multiple of the file\_alignment. #### [` checksum `]() inline uint32\_t checksum() const The image file checksum. The algorithm for computing the checksum is incorporated into `IMAGHELP.DLL`. The following are checked for validation at load time all **drivers**, any **DLL loaded at boot** time, and any **DLL** that is loaded into a **critical** Windows process. #### [` subsystem `]() inline [SUBSYSTEM]( "LIEF::PE::OptionalHeader::SUBSYSTEM") subsystem() const Target subsystem like Driver, XBox, Windows GUI, … #### [` dll_characteristics `]() inline uint32\_t dll\_characteristics() const Some characteristics of the underlying binary like the support of the PIE. The prefix `dll` comes from the official PE specifications but these characteristics are also used for **executables**. #### [` sizeof_stack_reserve `]() inline uint64\_t sizeof\_stack\_reserve() const Size of the stack to reserve when loading the PE binary. Only [OptionalHeader::sizeof\_stack\_commit]() is committed, the rest is made available one page at a time until the reserve size is reached. #### [` sizeof_stack_commit `]() inline uint64\_t sizeof\_stack\_commit() const Size of the stack to commit. #### [` sizeof_heap_reserve `]() inline uint64\_t sizeof\_heap\_reserve() const Size of the heap to reserve when loading the PE binary. #### [` sizeof_heap_commit `]() inline uint64\_t sizeof\_heap\_commit() const Size of the heap to commit. #### [` loader_flags `]() inline uint32\_t loader\_flags() const According to the PE specifications, this value is *reserved* and **should** be 0. #### [` numberof_rva_and_size `]() inline uint32\_t numberof\_rva\_and\_size() const The number of [DataDirectory]() that follow this header. #### [` has `]() inline bool has([DLL\_CHARACTERISTICS]( "LIEF::PE::OptionalHeader::DLL_CHARACTERISTICS") c) const Check if the given [DLL\_CHARACTERISTICS]() is included in the dll\_characteristics. #### [` dll_characteristics_list `]() std::vector<[DLL\_CHARACTERISTICS]( "LIEF::PE::OptionalHeader::DLL_CHARACTERISTICS")> dll\_characteristics\_list() const Return the list of the dll\_characteristics as an std::set of [DLL\_CHARACTERISTICS](). #### [` add `]() inline void add([DLL\_CHARACTERISTICS]( "LIEF::PE::OptionalHeader::DLL_CHARACTERISTICS") c) Add a [DLL\_CHARACTERISTICS]() to the current characteristics. #### [` remove `]() inline void remove([DLL\_CHARACTERISTICS]( "LIEF::PE::OptionalHeader::DLL_CHARACTERISTICS") c) Remove a [DLL\_CHARACTERISTICS]() from the current characteristics. #### [` magic `]() inline void magic([PE\_TYPE]( "LIEF::PE::PE_TYPE") magic) #### [` major_linker_version `]() inline void major\_linker\_version(uint8\_t value) #### [` minor_linker_version `]() inline void minor\_linker\_version(uint8\_t value) #### [` sizeof_code `]() inline void sizeof\_code(uint32\_t value) #### [` sizeof_initialized_data `]() inline void sizeof\_initialized\_data(uint32\_t value) #### [` sizeof_uninitialized_data `]() inline void sizeof\_uninitialized\_data(uint32\_t value) #### [` addressof_entrypoint `]() inline void addressof\_entrypoint(uint32\_t value) #### [` baseof_code `]() inline void baseof\_code(uint32\_t value) #### [` baseof_data `]() inline void baseof\_data(uint32\_t value) #### [` imagebase `]() inline void imagebase(uint64\_t value) #### [` section_alignment `]() inline void section\_alignment(uint32\_t value) #### [` file_alignment `]() inline void file\_alignment(uint32\_t value) #### [` major_operating_system_version `]() inline void major\_operating\_system\_version(uint16\_t value) #### [` minor_operating_system_version `]() inline void minor\_operating\_system\_version(uint16\_t value) #### [` major_image_version `]() inline void major\_image\_version(uint16\_t value) #### [` minor_image_version `]() inline void minor\_image\_version(uint16\_t value) #### [` major_subsystem_version `]() inline void major\_subsystem\_version(uint16\_t value) #### [` minor_subsystem_version `]() inline void minor\_subsystem\_version(uint16\_t value) #### [` win32_version_value `]() inline void win32\_version\_value(uint32\_t value) #### [` sizeof_image `]() inline void sizeof\_image(uint32\_t value) #### [` sizeof_headers `]() inline void sizeof\_headers(uint32\_t value) #### [` checksum `]() inline void checksum(uint32\_t value) #### [` subsystem `]() inline void subsystem([SUBSYSTEM]( "LIEF::PE::OptionalHeader::SUBSYSTEM") value) #### [` dll_characteristics `]() inline void dll\_characteristics(uint32\_t value) #### [` sizeof_stack_reserve `]() inline void sizeof\_stack\_reserve(uint64\_t value) #### [` sizeof_stack_commit `]() inline void sizeof\_stack\_commit(uint64\_t value) #### [` sizeof_heap_reserve `]() inline void sizeof\_heap\_reserve(uint64\_t value) #### [` sizeof_heap_commit `]() inline void sizeof\_heap\_commit(uint64\_t value) #### [` loader_flags `]() inline void loader\_flags(uint32\_t value) #### [` numberof_rva_and_size `]() inline void numberof\_rva\_and\_size(uint32\_t value) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` operator+= `]() inline [OptionalHeader]( "LIEF::PE::OptionalHeader") &operator+=([DLL\_CHARACTERISTICS]( "LIEF::PE::OptionalHeader::DLL_CHARACTERISTICS") c) #### [` operator-= `]() inline [OptionalHeader]( "LIEF::PE::OptionalHeader") &operator-=([DLL\_CHARACTERISTICS]( "LIEF::PE::OptionalHeader::DLL_CHARACTERISTICS") c) Public Static Functions #### [` create `]() static [OptionalHeader]( "LIEF::PE::OptionalHeader") create([PE\_TYPE]( "LIEF::PE::PE_TYPE") type) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [OptionalHeader]( "LIEF::PE::OptionalHeader") &entry) --- ## [Data Directory]() ### [` DataDirectory `]() class DataDirectory : public LIEF::Object Class that represents a PE data directory entry. Public Types #### [` TYPES `]() enum class TYPES : uint32\_t *Values:* ##### [` EXPORT_TABLE `]() enumerator EXPORT\_TABLE = 0 ##### [` IMPORT_TABLE `]() enumerator IMPORT\_TABLE ##### [` RESOURCE_TABLE `]() enumerator RESOURCE\_TABLE ##### [` EXCEPTION_TABLE `]() enumerator EXCEPTION\_TABLE ##### [` CERTIFICATE_TABLE `]() enumerator CERTIFICATE\_TABLE ##### [` BASE_RELOCATION_TABLE `]() enumerator BASE\_RELOCATION\_TABLE ##### [` DEBUG_DIR `]() enumerator DEBUG\_DIR ##### [` ARCHITECTURE `]() enumerator ARCHITECTURE ##### [` GLOBAL_PTR `]() enumerator GLOBAL\_PTR ##### [` TLS_TABLE `]() enumerator TLS\_TABLE ##### [` LOAD_CONFIG_TABLE `]() enumerator LOAD\_CONFIG\_TABLE ##### [` BOUND_IMPORT `]() enumerator BOUND\_IMPORT ##### [` IAT `]() enumerator IAT ##### [` DELAY_IMPORT_DESCRIPTOR `]() enumerator DELAY\_IMPORT\_DESCRIPTOR ##### [` CLR_RUNTIME_HEADER `]() enumerator CLR\_RUNTIME\_HEADER ##### [` RESERVED `]() enumerator RESERVED ##### [` UNKNOWN `]() enumerator UNKNOWN Public Functions #### [` DataDirectory `]() DataDirectory() = default #### [` DataDirectory `]() inline DataDirectory([TYPES]( "LIEF::PE::DataDirectory::TYPES") type) #### [` DataDirectory `]() DataDirectory(const details::pe\_data\_directory &header, [TYPES]( "LIEF::PE::DataDirectory::TYPES") type) #### [` DataDirectory `]() DataDirectory(const [DataDirectory]( "LIEF::PE::DataDirectory::DataDirectory") &other) = default #### [` operator= `]() [DataDirectory]( "LIEF::PE::DataDirectory") &operator=(const [DataDirectory]( "LIEF::PE::DataDirectory") &other) = default #### [` DataDirectory `]() DataDirectory([DataDirectory]( "LIEF::PE::DataDirectory::DataDirectory") &&other) noexcept = default #### [` operator= `]() [DataDirectory]( "LIEF::PE::DataDirectory") &operator=([DataDirectory]( "LIEF::PE::DataDirectory") &&other) noexcept = default #### [` ~DataDirectory `]() ~DataDirectory() override = default #### [` RVA `]() inline uint32\_t RVA() const The relative virtual address of the content of this data directory. #### [` size `]() inline uint32\_t size() const The size of the content. #### [` has_section `]() inline bool has\_section() const Check if the content of this data directory is associated with a PE [Section](). #### [` content `]() inline span<const uint8\_t> content() const Raw content (bytes) referenced by this data directory. #### [` content `]() span<uint8\_t> content() #### [` section `]() inline [Section]( "LIEF::PE::Section") \*section() [Section]() associated with the [DataDirectory](). #### [` section `]() inline const [Section]( "LIEF::PE::Section") \*section() const #### [` type `]() inline [TYPES]( "LIEF::PE::DataDirectory::TYPES") type() const Type of the data directory. #### [` size `]() inline void size(uint32\_t size) #### [` RVA `]() inline void RVA(uint32\_t rva) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Attributes #### [` DEFAULT_NB `]() static size\_t DEFAULT\_NB = 16 Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [DataDirectory]( "LIEF::PE::DataDirectory") &entry) --- ## [Section]() ### [` Section `]() class Section : public LIEF::[Section]( "LIEF::Section") Class which represents a PE section. Public Types #### [` CHARACTERISTICS `]() enum class CHARACTERISTICS : uint64\_t *Values:* ##### [` TYPE_NO_PAD `]() enumerator TYPE\_NO\_PAD = 0x00000008 ##### [` CNT_CODE `]() enumerator CNT\_CODE = 0x00000020 ##### [` CNT_INITIALIZED_DATA `]() enumerator CNT\_INITIALIZED\_DATA = 0x00000040 ##### [` CNT_UNINITIALIZED_DATA `]() enumerator CNT\_UNINITIALIZED\_DATA = 0x00000080 ##### [` LNK_OTHER `]() enumerator LNK\_OTHER = 0x00000100 ##### [` LNK_INFO `]() enumerator LNK\_INFO = 0x00000200 ##### [` LNK_REMOVE `]() enumerator LNK\_REMOVE = 0x00000800 ##### [` LNK_COMDAT `]() enumerator LNK\_COMDAT = 0x00001000 ##### [` GPREL `]() enumerator GPREL = 0x00008000 ##### [` MEM_PURGEABLE `]() enumerator MEM\_PURGEABLE = 0x00010000 ##### [` MEM_16BIT `]() enumerator MEM\_16BIT = 0x00020000 ##### [` MEM_LOCKED `]() enumerator MEM\_LOCKED = 0x00040000 ##### [` MEM_PRELOAD `]() enumerator MEM\_PRELOAD = 0x00080000 ##### [` ALIGN_1BYTES `]() enumerator ALIGN\_1BYTES = 0x00100000 ##### [` ALIGN_2BYTES `]() enumerator ALIGN\_2BYTES = 0x00200000 ##### [` ALIGN_4BYTES `]() enumerator ALIGN\_4BYTES = 0x00300000 ##### [` ALIGN_8BYTES `]() enumerator ALIGN\_8BYTES = 0x00400000 ##### [` ALIGN_16BYTES `]() enumerator ALIGN\_16BYTES = 0x00500000 ##### [` ALIGN_32BYTES `]() enumerator ALIGN\_32BYTES = 0x00600000 ##### [` ALIGN_64BYTES `]() enumerator ALIGN\_64BYTES = 0x00700000 ##### [` ALIGN_128BYTES `]() enumerator ALIGN\_128BYTES = 0x00800000 ##### [` ALIGN_256BYTES `]() enumerator ALIGN\_256BYTES = 0x00900000 ##### [` ALIGN_512BYTES `]() enumerator ALIGN\_512BYTES = 0x00A00000 ##### [` ALIGN_1024BYTES `]() enumerator ALIGN\_1024BYTES = 0x00B00000 ##### [` ALIGN_2048BYTES `]() enumerator ALIGN\_2048BYTES = 0x00C00000 ##### [` ALIGN_4096BYTES `]() enumerator ALIGN\_4096BYTES = 0x00D00000 ##### [` ALIGN_8192BYTES `]() enumerator ALIGN\_8192BYTES = 0x00E00000 ##### [` LNK_NRELOC_OVFL `]() enumerator LNK\_NRELOC\_OVFL = 0x01000000 ##### [` MEM_DISCARDABLE `]() enumerator MEM\_DISCARDABLE = 0x02000000 ##### [` MEM_NOT_CACHED `]() enumerator MEM\_NOT\_CACHED = 0x04000000 ##### [` MEM_NOT_PAGED `]() enumerator MEM\_NOT\_PAGED = 0x08000000 ##### [` MEM_SHARED `]() enumerator MEM\_SHARED = 0x10000000 ##### [` MEM_EXECUTE `]() enumerator MEM\_EXECUTE = 0x20000000 ##### [` MEM_READ `]() enumerator MEM\_READ = 0x40000000 ##### [` MEM_WRITE `]() enumerator MEM\_WRITE = 0x80000000 Public Functions #### [` Section `]() Section(const details::pe\_section &header) #### [` Section `]() Section() = default #### [` Section `]() inline Section(std::string name) #### [` Section `]() inline Section(std::string name, std::vector<uint8\_t> content) #### [` operator= `]() [Section]( "LIEF::PE::Section") &operator=(const [Section]( "LIEF::PE::Section")&) = default #### [` Section `]() Section(const [Section]( "LIEF::PE::Section::Section")&) = default #### [` ~Section `]() ~Section() override = default #### [` sizeof_raw_data `]() uint32\_t sizeof\_raw\_data() const Return the size of the data in the section. #### [` virtual_size `]() inline uint32\_t virtual\_size() const Return the size of the data when mapped in memory. If this value is greater than sizeof\_raw\_data, the section is zero-padded. #### [` content `]() inline virtual span<const uint8\_t> content() const override The actual content of the section. #### [` padding `]() inline span<const uint8\_t> padding() const Content of the section’s padding area. #### [` pointerto_raw_data `]() uint32\_t pointerto\_raw\_data() const The offset of the section data in the PE file. #### [` pointerto_relocation `]() inline uint32\_t pointerto\_relocation() const The file pointer to the beginning of the COFF relocation entries for the section. This is set to zero for executable images or if there are no relocations. For modern PE binaries, this value is usually set to 0 as the relocations are managed by [PE::Relocation](). #### [` pointerto_line_numbers `]() inline uint32\_t pointerto\_line\_numbers() const The file pointer to the beginning of line-number entries for the section. This is set to zero if there are no COFF line numbers. This value should be zero for an image because COFF debugging information is deprecated and modern debug information relies on the PDB files. #### [` numberof_relocations `]() inline uint16\_t numberof\_relocations() const No longer used in recent PE binaries produced by Visual Studio. #### [` numberof_line_numbers `]() inline uint16\_t numberof\_line\_numbers() const No longer used in recent PE binaries produced by Visual Studio. #### [` characteristics `]() inline uint32\_t characteristics() const Characteristics of the section: it provides information about the permissions of the section when mapped. It can also provide information about the *purpose* of the section (contain code, BSS-like, …). #### [` has_characteristic `]() inline bool has\_characteristic([CHARACTERISTICS]( "LIEF::PE::Section::CHARACTERISTICS") c) const Check if the section has the given [CHARACTERISTICS](). #### [` characteristics_list `]() inline std::vector<[CHARACTERISTICS]( "LIEF::PE::Section::CHARACTERISTICS")> characteristics\_list() const List of the section characteristics. #### [` is_discardable `]() inline bool is\_discardable() const True if the section can be discarded as needed. This is typically the case for debug-related sections #### [` clear `]() void clear(uint8\_t c) Fill the content of the section with the given `char`. #### [` content `]() virtual void content(const std::vector<uint8\_t> &data) override Change section content. #### [` name `]() virtual void name(std::string name) override Change the section’s name. #### [` virtual_size `]() inline void virtual\_size(uint32\_t virtual\_sz) #### [` pointerto_raw_data `]() inline void pointerto\_raw\_data(uint32\_t ptr) #### [` pointerto_relocation `]() inline void pointerto\_relocation(uint32\_t ptr) #### [` pointerto_line_numbers `]() inline void pointerto\_line\_numbers(uint32\_t ptr) #### [` numberof_relocations `]() inline void numberof\_relocations(uint16\_t nb) #### [` numberof_line_numbers `]() inline void numberof\_line\_numbers(uint16\_t nb) #### [` sizeof_raw_data `]() inline void sizeof\_raw\_data(uint32\_t size) #### [` characteristics `]() inline void characteristics(uint32\_t characteristics) #### [` coff_string `]() inline COFF::[String]( "LIEF::COFF::String") \*coff\_string() Return the COFF string associated with the section’s name (or a nullptr). This coff string is usually present for long section names whose length does not fit in the 8 bytes allocated by the PE format. #### [` coff_string `]() inline const COFF::[String]( "LIEF::COFF::String") \*coff\_string() const #### [` remove_characteristic `]() inline [Section]( "LIEF::PE::Section") &remove\_characteristic([CHARACTERISTICS]( "LIEF::PE::Section::CHARACTERISTICS") characteristic) #### [` add_characteristic `]() inline [Section]( "LIEF::PE::Section") &add\_characteristic([CHARACTERISTICS]( "LIEF::PE::Section::CHARACTERISTICS") characteristic) #### [` stream `]() std::unique\_ptr<[SpanStream]( "LIEF::SpanStream")> stream() const #### [` writable_content `]() inline span<uint8\_t> writable\_content() #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` name `]() inline virtual std::string\_view name() const [Section]()’s name. Public Static Functions #### [` characteristics_to_list `]() static std::vector<[CHARACTERISTICS]( "LIEF::PE::Section::CHARACTERISTICS")> characteristics\_to\_list(uint32\_t value) Public Static Attributes #### [` MAX_SECTION_NAME `]() static size\_t MAX\_SECTION\_NAME = 8 Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Section]( "LIEF::PE::Section") &section) --- ## [Import]() ### [` Import `]() class Import : public LIEF::Object Class that represents a PE import. Public Types #### [` entries_t `]() using entries\_t = std::vector<std::unique\_ptr<[ImportEntry]( "LIEF::PE::ImportEntry")>> #### [` it_entries `]() using it\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[entries\_t]( "LIEF::PE::Import::entries_t")&, [ImportEntry]( "LIEF::PE::ImportEntry")\*> #### [` it_const_entries `]() using it\_const\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [entries\_t]( "LIEF::PE::Import::entries_t")&, const [ImportEntry]( "LIEF::PE::ImportEntry")\*> Public Functions #### [` Import `]() Import(const details::pe\_import &import) #### [` Import `]() inline Import(std::string name) #### [` Import `]() Import() = default #### [` ~Import `]() ~Import() override = default #### [` Import `]() Import(const [Import]( "LIEF::PE::Import::Import") &other) #### [` operator= `]() [Import]( "LIEF::PE::Import") &operator=(const [Import]( "LIEF::PE::Import") &other) #### [` Import `]() Import([Import]( "LIEF::PE::Import::Import") &&other) noexcept = default #### [` operator= `]() [Import]( "LIEF::PE::Import") &operator=([Import]( "LIEF::PE::Import") &&other) noexcept = default #### [` forwarder_chain `]() inline uint32\_t forwarder\_chain() const The index of the first forwarder reference. #### [` timedatestamp `]() inline uint32\_t timedatestamp() const The stamp that is set to zero until the image is bound. After the image is bound, this field is set to the time/data stamp of the DLL. #### [` entries `]() inline [it\_const\_entries]( "LIEF::PE::Import::it_const_entries") entries() const Iterator over the [PE::ImportEntry](). #### [` entries `]() inline [it\_entries]( "LIEF::PE::Import::it_entries") entries() #### [` import_address_table_rva `]() inline uint32\_t import\_address\_table\_rva() const The RVA of the import address table (`IAT`). The content of this table is **identical** to the content of the [Import]() Lookup Table (`ILT`) until the image is bound. > **Warning** > > This address could change when re-building the binary #### [` import_lookup_table_rva `]() inline uint32\_t import\_lookup\_table\_rva() const Return the relative virtual address of the import lookup table. > **Warning** > > This address could change when re-building the binary #### [` get_function_rva_from_iat `]() [result]( "LIEF::result")<uint32\_t> get\_function\_rva\_from\_iat(const std::string &function) const Return the [Function]()’s RVA from the import address table (`IAT`). > **Warning** > > This address could change when re-building the binary #### [` get_entry `]() inline [ImportEntry]( "LIEF::PE::ImportEntry") \*get\_entry(const std::string &name) Return the imported function with the given name. #### [` get_entry `]() const [ImportEntry]( "LIEF::PE::ImportEntry") \*get\_entry(const std::string &name) const #### [` name `]() inline std::string\_view name() const Return the library’s name (e.g. `kernel32.dll`). #### [` name `]() inline void name(std::string name) Change the current import name. #### [` name_rva `]() inline uint32\_t name\_rva() const The original name rva. #### [` directory `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*directory() Return the [PE::DataDirectory]() associated with this import. It should be the one at index [PE::DataDirectory::TYPES::IMPORT\_TABLE](). If the data directory can’t be found, return a nullptr #### [` directory `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*directory() const #### [` iat_directory `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*iat\_directory() Return the [PE::DataDirectory]() associated with the IAT. It should be the one at index [PE::DataDirectory::TYPES::IAT](). If the data directory can’t be found, return a nullptr #### [` iat_directory `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*iat\_directory() const #### [` add_entry `]() inline [ImportEntry]( "LIEF::PE::ImportEntry") &add\_entry(const [ImportEntry]( "LIEF::PE::ImportEntry") &entry) Add a new import entry (i.e. an imported function). #### [` add_entry `]() inline [ImportEntry]( "LIEF::PE::ImportEntry") &add\_entry(const std::string &name) Add a new import entry with the given name (i.e. an imported function). #### [` remove_entry `]() bool remove\_entry(const std::string &name) Remove the import entry with the given name. Return true if the deletion succeeded, false otherwise #### [` remove_entry `]() bool remove\_entry(uint32\_t ordinal) Remove the import entry with the given ordinal number. Return true if the deletion succeeded, false otherwise #### [` import_lookup_table_rva `]() inline void import\_lookup\_table\_rva(uint32\_t rva) #### [` import_address_table_rva `]() inline void import\_address\_table\_rva(uint32\_t rva) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Import]( "LIEF::PE::Import") &entry) --- ## [Import Entry]() ### [` ImportEntry `]() class ImportEntry : public LIEF::[Symbol]( "LIEF::Symbol") Class that represents an entry (i.e. an import) in the import table ([Import]()). It extends the [LIEF::Symbol]() generic class that exposes the [LIEF::Symbol::name]() and [LIEF::Symbol::value]() API Public Functions #### [` ImportEntry `]() ImportEntry() = default #### [` ImportEntry `]() inline ImportEntry(uint64\_t data, [PE\_TYPE]( "LIEF::PE::PE_TYPE") type) #### [` ImportEntry `]() inline ImportEntry(std::string name) #### [` ImportEntry `]() ImportEntry(const [ImportEntry]( "LIEF::PE::ImportEntry::ImportEntry")&) = default #### [` operator= `]() [ImportEntry]( "LIEF::PE::ImportEntry") &operator=(const [ImportEntry]( "LIEF::PE::ImportEntry")&) = default #### [` ~ImportEntry `]() ~ImportEntry() override = default #### [` demangled_name `]() std::string demangled\_name() const Demangled representation of the symbol or an empty string if it can’t be demangled. #### [` is_ordinal `]() bool is\_ordinal() const `True` if it is an import by ordinal #### [` ordinal `]() inline uint16\_t ordinal() const The ordinal value. #### [` hint_name_rva `]() inline uint64\_t hint\_name\_rva() const > **See also** > > [ImportEntry::data]() #### [` hint `]() inline uint16\_t hint() const Index into the [Export::entries]() that is used to speed-up the symbol resolution. #### [` iat_value `]() inline uint64\_t iat\_value() const Value of the current entry in the [Import]() Address Table. It should match the lookup table value. #### [` iat_value `]() inline void iat\_value(uint64\_t value) #### [` ilt_value `]() inline uint64\_t ilt\_value() const Original value in the import lookup table. This value should match the [iat\_value()](). #### [` ilt_value `]() inline void ilt\_value(uint64\_t value) #### [` data `]() inline uint64\_t data() const Raw value. #### [` iat_address `]() inline uint64\_t iat\_address() const **Original** address of the entry in the [Import]() Address Table #### [` data `]() inline void data(uint64\_t data) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ImportEntry]( "LIEF::PE::ImportEntry") &entry) --- ## [Delay Import]() ### [` DelayImport `]() class DelayImport : public LIEF::Object Class that represents a PE delayed import. Public Types #### [` entries_t `]() using entries\_t = std::vector<std::unique\_ptr<[DelayImportEntry]( "LIEF::PE::DelayImportEntry")>> #### [` it_entries `]() using it\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[entries\_t]( "LIEF::PE::DelayImport::entries_t")&, [DelayImportEntry]( "LIEF::PE::DelayImportEntry")\*> #### [` it_const_entries `]() using it\_const\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [entries\_t]( "LIEF::PE::DelayImport::entries_t")&, const [DelayImportEntry]( "LIEF::PE::DelayImportEntry")\*> Public Functions #### [` DelayImport `]() DelayImport() = default #### [` DelayImport `]() DelayImport(const details::delay\_imports &import, [PE\_TYPE]( "LIEF::PE::PE_TYPE") type) #### [` DelayImport `]() inline DelayImport(std::string name) #### [` ~DelayImport `]() ~DelayImport() override = default #### [` DelayImport `]() DelayImport(const [DelayImport]( "LIEF::PE::DelayImport::DelayImport") &other) #### [` operator= `]() inline [DelayImport]( "LIEF::PE::DelayImport") &operator=([DelayImport]( "LIEF::PE::DelayImport") other) #### [` DelayImport `]() DelayImport([DelayImport]( "LIEF::PE::DelayImport::DelayImport")&&) noexcept = default #### [` operator= `]() [DelayImport]( "LIEF::PE::DelayImport") &operator=([DelayImport]( "LIEF::PE::DelayImport")&&) noexcept = default #### [` swap `]() void swap([DelayImport]( "LIEF::PE::DelayImport") &other) #### [` attribute `]() inline uint32\_t attribute() const According to the official PE specifications, this value is reserved and should be set to 0. #### [` attribute `]() inline void attribute(uint32\_t hdl) #### [` name `]() inline std::string\_view name() const Return the library’s name (e.g. `kernel32.dll`). #### [` name `]() inline void name(std::string name) #### [` handle `]() inline uint32\_t handle() const The RVA of the module handle (in the `.data` section) It is used for storage by the routine that is supplied to manage delay-loading. #### [` handle `]() inline void handle(uint32\_t hdl) #### [` iat `]() inline uint32\_t iat() const RVA of the delay-load import address table. #### [` iat `]() inline void iat(uint32\_t iat) #### [` names_table `]() inline uint32\_t names\_table() const RVA of the delay-load import names table. The content of this table has the layout as the [Import]() lookup table. #### [` names_table `]() inline void names\_table(uint32\_t value) #### [` biat `]() inline uint32\_t biat() const RVA of the **bound** delay-load import address table or 0 if the table does not exist. #### [` biat `]() inline void biat(uint32\_t value) #### [` uiat `]() inline uint32\_t uiat() const RVA of the **unload** delay-load import address table or 0 if the table does not exist. According to the PE specifications, this table is an exact copy of the delay import address table that can be used to restore the original IAT in the case of unloading. #### [` uiat `]() inline void uiat(uint32\_t value) #### [` timestamp `]() inline uint32\_t timestamp() const The timestamp of the DLL to which this image has been bound. #### [` timestamp `]() inline void timestamp(uint32\_t value) #### [` entries `]() inline [it\_entries]( "LIEF::PE::DelayImport::it_entries") entries() Iterator over the [DelayImport]()’s entries ([DelayImportEntry]()). #### [` entries `]() inline [it\_const\_entries]( "LIEF::PE::DelayImport::it_const_entries") entries() const Iterator over the [DelayImport]()’s entries ([DelayImportEntry]()). #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [DelayImport]( "LIEF::PE::DelayImport") &entry) --- ## [Delay Import Entry]() ### [` DelayImportEntry `]() class DelayImportEntry : public LIEF::[Symbol]( "LIEF::Symbol") Class that represents an entry (i.e. an import) in the delay import table ([DelayImport]()). It extends the [LIEF::Symbol]() generic class that exposes the [LIEF::Symbol::name]() and [LIEF::Symbol::value]() API. The meaning of [LIEF::Symbol::value]() for this PE object is the address (as an RVA) in the IAT where the resolution should take place. Public Functions #### [` DelayImportEntry `]() DelayImportEntry() = default #### [` DelayImportEntry `]() inline DelayImportEntry(uint64\_t data, [PE\_TYPE]( "LIEF::PE::PE_TYPE") type) #### [` DelayImportEntry `]() DelayImportEntry(const [DelayImportEntry]( "LIEF::PE::DelayImportEntry::DelayImportEntry")&) = default #### [` operator= `]() [DelayImportEntry]( "LIEF::PE::DelayImportEntry") &operator=(const [DelayImportEntry]( "LIEF::PE::DelayImportEntry")&) = default #### [` DelayImportEntry `]() DelayImportEntry([DelayImportEntry]( "LIEF::PE::DelayImportEntry::DelayImportEntry")&&) noexcept = default #### [` operator= `]() [DelayImportEntry]( "LIEF::PE::DelayImportEntry") &operator=([DelayImportEntry]( "LIEF::PE::DelayImportEntry")&&) noexcept = default #### [` ~DelayImportEntry `]() ~DelayImportEntry() override = default #### [` demangled_name `]() std::string demangled\_name() const Demangled representation of the symbol or an empty string if it can’t be demangled. #### [` is_ordinal `]() bool is\_ordinal() const `True` if it is an import by ordinal #### [` ordinal `]() inline uint16\_t ordinal() const The ordinal value. #### [` hint_name_rva `]() inline uint64\_t hint\_name\_rva() const > **See also** > > [DelayImportEntry::data]() #### [` hint `]() inline uint16\_t hint() const Index into the [Export::entries]() that is used to speed-up the symbol resolution. #### [` iat_value `]() inline uint64\_t iat\_value() const Value of the current entry in the [Import]() Address Table. #### [` data `]() inline uint64\_t data() const Raw value. #### [` data `]() inline void data(uint64\_t data) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [DelayImportEntry]( "LIEF::PE::DelayImportEntry") &entry) --- ## [TLS]() ### [` TLS `]() class TLS : public LIEF::Object Class which represents the PE Thread Local Storage. This PE structure is also used to implement binary/library constructors. Public Functions #### [` TLS `]() TLS() = default #### [` TLS `]() TLS(const details::pe32\_tls &header) #### [` TLS `]() TLS(const details::pe64\_tls &header) #### [` ~TLS `]() ~TLS() override = default #### [` TLS `]() TLS(const [TLS]( "LIEF::PE::TLS::TLS") &copy) = default #### [` operator= `]() [TLS]( "LIEF::PE::TLS") &operator=(const [TLS]( "LIEF::PE::TLS") &copy) = default #### [` TLS `]() TLS([TLS]( "LIEF::PE::TLS::TLS") &&other) noexcept = default #### [` operator= `]() [TLS]( "LIEF::PE::TLS") &operator=([TLS]( "LIEF::PE::TLS") &&other) noexcept = default #### [` callbacks `]() inline const std::vector<uint64\_t> &callbacks() const List of the callbacks associated with the current [TLS](). These functions are called before any other functions. #### [` add_callback `]() inline [TLS]( "LIEF::PE::TLS") &add\_callback(uint64\_t addr) Add a new [TLS]() callback. #### [` addressof_raw_data `]() inline const std::pair<uint64\_t, uint64\_t> &addressof\_raw\_data() const Pair `(start address, end address)` of the [TLS]() template. The template is a block of data that is used to initialize [TLS]() data. The system copies all of this data each time a thread is created, so it must not be corrupted. > **Note** > > These addresses are not RVA. They are addresses for which there should be a rebase relocation in the `.reloc` section. #### [` addressof_index `]() inline uint64\_t addressof\_index() const The location to receive the [TLS]() index assigned by the loader. This location should be located in a writable section like `.data`. #### [` addressof_callbacks `]() inline uint64\_t addressof\_callbacks() const Pointer to an array of [TLS]() callback functions. The array is null-terminated, so if there is no callback function this field points to **4 bytes** set to zero. #### [` sizeof_zero_fill `]() inline uint32\_t sizeof\_zero\_fill() const Size in bytes of the zero to be *padded* after the data specified by data\_template. #### [` characteristics `]() inline uint32\_t characteristics() const The four bits [23:20] describe alignment info. Possible values are those defined as `IMAGE_SCN_ALIGN_*`, which are also used to describe alignment of section in object files. The other 28 bits are reserved for future use. #### [` data_template `]() inline span<const uint8\_t> data\_template() const The initial content used to initialize [TLS]() data. #### [` has_data_directory `]() inline bool has\_data\_directory() const True if there is a data directory associated with this entry. #### [` directory `]() inline [DataDirectory]( "LIEF::PE::DataDirectory") \*directory() Return the [DataDirectory]() associated with this object or a nullptr If it exists, its type should be [DataDirectory::TYPES::TLS\_TABLE](). #### [` directory `]() inline const [DataDirectory]( "LIEF::PE::DataDirectory") \*directory() const #### [` has_section `]() inline bool has\_section() const Check if there is a section associated with this entry. #### [` section `]() inline [Section]( "LIEF::PE::Section") \*section() The section associated with the entry (or a nullptr). #### [` section `]() inline const [Section]( "LIEF::PE::Section") \*section() const #### [` callbacks `]() inline void callbacks(std::vector<uint64\_t> callbacks) #### [` addressof_raw_data `]() inline void addressof\_raw\_data(std::pair<uint64\_t, uint64\_t> addresses) #### [` addressof_index `]() inline void addressof\_index(uint64\_t addr\_idx) #### [` addressof_callbacks `]() inline void addressof\_callbacks(uint64\_t addr) #### [` sizeof_zero_fill `]() inline void sizeof\_zero\_fill(uint32\_t size) #### [` characteristics `]() inline void characteristics(uint32\_t characteristics) #### [` data_template `]() inline void data\_template(std::vector<uint8\_t> data\_template) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [TLS]( "LIEF::PE::TLS") &entry) --- ## [Debug]() ### [` Debug `]() class Debug : public LIEF::Object This class represents a generic entry in the debug data directory. For known types, this class is extended to provide a dedicated API (see: [CodeView]()). Subclassed by [LIEF::PE::CodeView](), [LIEF::PE::ExDllCharacteristics](), [LIEF::PE::FPO](), [LIEF::PE::PDBChecksum](), [LIEF::PE::Pogo](), [LIEF::PE::Repro](), [LIEF::PE::VCFeature]() Public Types #### [` TYPES `]() enum class TYPES The entry types. *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` COFF `]() enumerator COFF = 1 COFF [Debug]() information. ##### [` CODEVIEW `]() enumerator CODEVIEW = 2 [CodeView]() debug information that is used to store PDB info. ##### [` FPO `]() enumerator FPO = 3 Frame pointer omission information. ##### [` MISC `]() enumerator MISC = 4 Miscellaneous debug information. ##### [` EXCEPTION `]() enumerator EXCEPTION = 5 [Debug]() information that is a *copy* of the `.pdata` section. ##### [` FIXUP `]() enumerator FIXUP = 6 (Reserved) [Debug]() information used for fixup relocations ##### [` OMAP_TO_SRC `]() enumerator OMAP\_TO\_SRC = 7 The mapping from an RVA in image to an RVA in source image. ##### [` OMAP_FROM_SRC `]() enumerator OMAP\_FROM\_SRC = 8 The mapping from an RVA in source image to an RVA in image. ##### [` BORLAND `]() enumerator BORLAND = 9 Reserved for Borland. ##### [` RESERVED10 `]() enumerator RESERVED10 = 10 Reserved. ##### [` CLSID `]() enumerator CLSID = 11 Reserved. ##### [` VC_FEATURE `]() enumerator VC\_FEATURE = 12 Visual C++ feature information. ##### [` POGO `]() enumerator POGO = 13 Profile Guided Optimization metadata. ##### [` ILTCG `]() enumerator ILTCG = 14 Incremental Link Time Code Generation metadata. ##### [` MPX `]() enumerator MPX = 15 ##### [` REPRO `]() enumerator REPRO = 16 PE determinism or reproducibility information. ##### [` PDBCHECKSUM `]() enumerator PDBCHECKSUM = 19 Checksum of the PDB file. ##### [` EX_DLLCHARACTERISTICS `]() enumerator EX\_DLLCHARACTERISTICS = 20 Extended DLL characteristics. Public Functions #### [` Debug `]() Debug() = default #### [` Debug `]() inline Debug([TYPES]( "LIEF::PE::Debug::TYPES") type) #### [` Debug `]() Debug(const details::pe\_debug &debug\_s, [Section]( "LIEF::PE::Section") \*section) #### [` Debug `]() Debug(const [Debug]( "LIEF::PE::Debug::Debug") &other) = default #### [` operator= `]() [Debug]( "LIEF::PE::Debug") &operator=(const [Debug]( "LIEF::PE::Debug") &other) = default #### [` Debug `]() Debug([Debug]( "LIEF::PE::Debug::Debug")&&) = default #### [` operator= `]() [Debug]( "LIEF::PE::Debug") &operator=([Debug]( "LIEF::PE::Debug")&&) = default #### [` ~Debug `]() ~Debug() override = default #### [` clone `]() inline virtual std::unique\_ptr<[Debug]( "LIEF::PE::Debug")> clone() const #### [` characteristics `]() inline uint32\_t characteristics() const Reserved should be 0. #### [` timestamp `]() inline uint32\_t timestamp() const The time and date when the debug data was created. #### [` major_version `]() inline uint16\_t major\_version() const The major version number of the debug data format. #### [` minor_version `]() inline uint16\_t minor\_version() const The minor version number of the debug data format. #### [` type `]() inline [TYPES]( "LIEF::PE::Debug::TYPES") type() const The format DEBUG\_TYPES of the debugging information. #### [` sizeof_data `]() inline uint32\_t sizeof\_data() const Size of the debug data. #### [` addressof_rawdata `]() inline uint32\_t addressof\_rawdata() const Address of the debug data relative to the image base. #### [` pointerto_rawdata `]() inline uint32\_t pointerto\_rawdata() const File offset of the debug data. #### [` section `]() inline const [Section]( "LIEF::PE::Section") \*section() const The section where debug data is located. #### [` section `]() inline [Section]( "LIEF::PE::Section") \*section() #### [` payload `]() span<uint8\_t> payload() [Debug]() data associated with this entry. #### [` payload `]() inline span<const uint8\_t> payload() const #### [` characteristics `]() inline void characteristics(uint32\_t characteristics) #### [` timestamp `]() inline void timestamp(uint32\_t timestamp) #### [` major_version `]() inline void major\_version(uint16\_t major\_version) #### [` minor_version `]() inline void minor\_version(uint16\_t minor\_version) #### [` sizeof_data `]() inline void sizeof\_data(uint32\_t sizeof\_data) #### [` addressof_rawdata `]() inline void addressof\_rawdata(uint32\_t addressof\_rawdata) #### [` pointerto_rawdata `]() inline void pointerto\_rawdata(uint32\_t pointerto\_rawdata) #### [` Tas `]() template<class T> inline const [T]( "LIEF::PE::Debug::as::T") \*as() const #### [` Tas `]() template<class T> inline [T]( "LIEF::PE::Debug::as::T") \*as() #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` to_string `]() virtual std::string to\_string() const Public Static Functions #### [` get_payload `]() static span<uint8\_t> get\_payload([Section]( "LIEF::PE::Section") &section, uint32\_t rva, uint32\_t offset, uint32\_t size) #### [` get_payload `]() static span<uint8\_t> get\_payload([Section]( "LIEF::PE::Section") &section, const details::pe\_debug &hdr) #### [` get_payload `]() static inline span<uint8\_t> get\_payload([Section]( "LIEF::PE::Section") &section, const [Debug]( "LIEF::PE::Debug") &dbg) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Debug]( "LIEF::PE::Debug") &entry) --- ## [Code View]() ### [` CodeView `]() class CodeView : public LIEF::PE::[Debug]( "LIEF::PE::Debug") Interface for the (generic) [Debug]() [CodeView]() (`IMAGE_DEBUG_TYPE_CODEVIEW`). Subclassed by [LIEF::PE::CodeViewPDB]() Public Types #### [` SIGNATURES `]() enum class SIGNATURES Code view signatures. > **See also** > > : [http://llvm.org/doxygen/CVDebugRecord\_8h\_source.html]() *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` PDB_70 `]() enumerator PDB\_70 = 0x53445352 ##### [` PDB_20 `]() enumerator PDB\_20 = 0x3031424e ##### [` CV_50 `]() enumerator CV\_50 = 0x3131424e ##### [` CV_41 `]() enumerator CV\_41 = 0x3930424e Public Functions #### [` CodeView `]() inline CodeView() #### [` CodeView `]() inline CodeView([SIGNATURES]( "LIEF::PE::CodeView::SIGNATURES") sig) #### [` CodeView `]() inline CodeView(const details::pe\_debug &debug, [SIGNATURES]( "LIEF::PE::CodeView::SIGNATURES") sig, [Section]( "LIEF::PE::Section") \*sec) #### [` CodeView `]() CodeView(const [CodeView]( "LIEF::PE::CodeView::CodeView") &other) = default #### [` operator= `]() [CodeView]( "LIEF::PE::CodeView") &operator=(const [CodeView]( "LIEF::PE::CodeView") &other) = default #### [` CodeView `]() CodeView([CodeView]( "LIEF::PE::CodeView::CodeView") &&other) = default #### [` operator= `]() [CodeView]( "LIEF::PE::CodeView") &operator=([CodeView]( "LIEF::PE::CodeView") &&other) = default #### [` ~CodeView `]() ~CodeView() override = default #### [` signature `]() inline [SIGNATURES]( "LIEF::PE::CodeView::SIGNATURES") signature() const The signature that defines the underlying type of the payload. #### [` clone `]() inline virtual std::unique\_ptr<[Debug]( "LIEF::PE::Debug")> clone() const override #### [` to_string `]() virtual std::string to\_string() const override #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` classof `]() static inline bool classof(const [Debug]( "LIEF::PE::Debug") \*debug) --- ## [Code View PDB]() ### [` CodeViewPDB `]() class CodeViewPDB : public LIEF::PE::[CodeView]( "LIEF::PE::CodeView") [CodeView]() PDB specialization. Public Types #### [` signature_t `]() using signature\_t = std::array<uint8\_t, 16> Public Functions #### [` CodeViewPDB `]() inline CodeViewPDB() #### [` CodeViewPDB `]() inline CodeViewPDB(std::string filename) #### [` CodeViewPDB `]() CodeViewPDB(const details::pe\_debug &debug\_info, const details::pe\_pdb\_70 &pdb\_70, [Section]( "LIEF::PE::Section") \*sec) #### [` CodeViewPDB `]() CodeViewPDB(const details::pe\_debug &debug\_info, const details::pe\_pdb\_20 &pdb\_70, [Section]( "LIEF::PE::Section") \*sec) #### [` CodeViewPDB `]() CodeViewPDB(const [CodeViewPDB]( "LIEF::PE::CodeViewPDB::CodeViewPDB") &other) = default #### [` operator= `]() [CodeViewPDB]( "LIEF::PE::CodeViewPDB") &operator=(const [CodeViewPDB]( "LIEF::PE::CodeViewPDB") &other) = default #### [` CodeViewPDB `]() CodeViewPDB([CodeViewPDB]( "LIEF::PE::CodeViewPDB::CodeViewPDB") &&other) = default #### [` operator= `]() [CodeViewPDB]( "LIEF::PE::CodeViewPDB") &operator=([CodeViewPDB]( "LIEF::PE::CodeViewPDB") &&other) = default #### [` guid `]() std::string guid() const The GUID signature to verify against the `.pdb` file signature. This attribute might be used to lookup remote PDB file on a symbol server. #### [` age `]() inline uint32\_t age() const Age value to verify. The age does not necessarily correspond to any known time value, it is used to determine if a .pdb file is out of sync with corresponding `.exe` file. #### [` signature `]() inline const [signature\_t]( "LIEF::PE::CodeViewPDB::signature_t") &signature() const The 32-bit signature to verify against the .pdb file signature. #### [` filename `]() inline std::string\_view filename() const The path to the `.pdb` file. #### [` age `]() inline void age(uint32\_t age) #### [` signature `]() inline void signature(const [signature\_t]( "LIEF::PE::CodeViewPDB::signature_t") &sig) #### [` filename `]() inline void filename(std::string filename) #### [` clone `]() inline virtual std::unique\_ptr<[Debug]( "LIEF::PE::Debug")> clone() const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` to_string `]() virtual std::string to\_string() const override #### [` ~CodeViewPDB `]() ~CodeViewPDB() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Debug]( "LIEF::PE::Debug") \*debug) --- ## [Relocation]() ### [` Relocation `]() class Relocation : public LIEF::Object Class which represents the *Base [Relocation]() Block* We usually find this structure in the `.reloc` section. Public Types #### [` entries_t `]() using entries\_t = std::vector<std::unique\_ptr<[RelocationEntry]( "LIEF::PE::RelocationEntry")>> #### [` it_entries `]() using it\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[entries\_t]( "LIEF::PE::Relocation::entries_t")&, [RelocationEntry]( "LIEF::PE::RelocationEntry")\*> #### [` it_const_entries `]() using it\_const\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [entries\_t]( "LIEF::PE::Relocation::entries_t")&, [RelocationEntry]( "LIEF::PE::RelocationEntry")\*> #### [` relocations_t `]() using relocations\_t = std::vector<std::unique\_ptr<[Relocation]( "LIEF::PE::Relocation")>> Public Functions #### [` Relocation `]() Relocation() #### [` Relocation `]() Relocation(uint32\_t base, uint32\_t block\_size) #### [` Relocation `]() Relocation(uint32\_t base) #### [` Relocation `]() Relocation(const [Relocation]( "LIEF::PE::Relocation::Relocation") &other) #### [` operator= `]() [Relocation]( "LIEF::PE::Relocation") &operator=([Relocation]( "LIEF::PE::Relocation") other) #### [` Relocation `]() Relocation([Relocation]( "LIEF::PE::Relocation::Relocation")&&) #### [` operator= `]() [Relocation]( "LIEF::PE::Relocation") &operator=([Relocation]( "LIEF::PE::Relocation") &&other) #### [` Relocation `]() Relocation(const details::pe\_base\_relocation\_block &header) #### [` ~Relocation `]() ~Relocation() override #### [` swap `]() void swap([Relocation]( "LIEF::PE::Relocation") &other) #### [` virtual_address `]() inline uint32\_t virtual\_address() const The RVA for which the offset of the relocation entries ([RelocationEntry]()) is added. #### [` block_size `]() inline uint32\_t block\_size() const The total number of bytes in the base relocation block. ```default block_size = sizeof(BaseRelocationBlock) + nb_of_relocs * sizeof(uint16_t = RelocationEntry) ``` #### [` entries `]() inline [it\_const\_entries]( "LIEF::PE::Relocation::it_const_entries") entries() const Iterator over the [RelocationEntry](). #### [` entries `]() inline [it\_entries]( "LIEF::PE::Relocation::it_entries") entries() #### [` virtual_address `]() inline void virtual\_address(uint32\_t virtual\_address) #### [` block_size `]() inline void block\_size(uint32\_t block\_size) #### [` add_entry `]() [RelocationEntry]( "LIEF::PE::RelocationEntry") &add\_entry(const [RelocationEntry]( "LIEF::PE::RelocationEntry") &entry) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` parse `]() static [relocations\_t]( "LIEF::PE::Relocation::relocations_t") parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &stream) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Relocation]( "LIEF::PE::Relocation") &relocation) --- ## [Relocation Entry]() ### [` RelocationEntry `]() class RelocationEntry : public LIEF::[Relocation]( "LIEF::Relocation") Class which represents an entry of the PE relocation table. It extends the [LIEF::Relocation]() object to provide a uniform API across the file formats Public Types #### [` BASE_TYPES `]() enum class BASE\_TYPES [Relocation]() type as described in [https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#base-relocation-types](). *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = -1 ##### [` ABS `]() enumerator ABS = 0 This value matches: `IMAGE_REL_BASED_ABSOLUTE` The base relocation is skipped. This type can be used to pad a block. ##### [` HIGH `]() enumerator HIGH = 1 This value matches: `IMAGE_REL_BASED_HIGH` The base relocation adds the high 16 bits of the difference to the 16-bit field at offset. The 16-bit field represents the high value of a 32-bit word. Operation: ```cpp write(ADDR, ((read(ADDR) << 16) + DELTA) >> 16) ``` ##### [` LOW `]() enumerator LOW = 2 The base relocation adds the low 16 bits of the difference to the 16-bit field at offset. The 16-bit field represents the low half of a 32-bit word. Operation: ```cpp write(ADDR, ((int32_t_t)read(ADDR) + DELTA)) ``` ##### [` HIGHLOW `]() enumerator HIGHLOW = 3 This value matches `IMAGE_REL_BASED_HIGHLOW`. The base relocation applies all 32 bits of the difference to the 32-bit field at offset. Operation: ```cpp write(ADDR, read(ADDR) + DELTA) ``` ##### [` HIGHADJ `]() enumerator HIGHADJ = 4 This value matches `IMAGE_REL_BASED_HIGHADJ`. The base relocation adds the high 16 bits of the difference to the 16-bit field at offset. The 16-bit field represents the high value of a 32-bit word. The low 16 bits of the 32-bit value are stored in the 16-bit word that follows this base relocation. This means that this base relocation occupies two slots. ##### [` MIPS_JMPADDR `]() enumerator MIPS\_JMPADDR = 5 | (1 << 8) ##### [` ARM_MOV32 `]() enumerator ARM\_MOV32 = 5 | (1 << 9) ##### [` RISCV_HI20 `]() enumerator RISCV\_HI20 = 5 | (1 << 10) ##### [` SECTION `]() enumerator SECTION = 6 ##### [` THUMB_MOV32 `]() enumerator THUMB\_MOV32 = 7 | (1 << 11) ##### [` RISCV_LOW12I `]() enumerator RISCV\_LOW12I = 7 | (1 << 12) ##### [` RISCV_LOW12S `]() enumerator RISCV\_LOW12S = 8 | (1 << 13) ##### [` LOONARCH_MARK_LA `]() enumerator LOONARCH\_MARK\_LA = 8 | (1 << 14) ##### [` MIPS_JMPADDR16 `]() enumerator MIPS\_JMPADDR16 = 9 ##### [` DIR64 `]() enumerator DIR64 = 10 This value matches `IMAGE_REL_BASED_DIR64`. The base relocation applies the difference to the 64-bit field at offset. Operation: ```cpp write(ADDR, read(ADDR) + DELTA) ``` ##### [` HIGH3ADJ `]() enumerator HIGH3ADJ = 11 Public Functions #### [` RelocationEntry `]() RelocationEntry() = default #### [` RelocationEntry `]() inline RelocationEntry(const [RelocationEntry]( "LIEF::PE::RelocationEntry::RelocationEntry") &other) #### [` operator= `]() inline [RelocationEntry]( "LIEF::PE::RelocationEntry") &operator=([RelocationEntry]( "LIEF::PE::RelocationEntry") other) #### [` RelocationEntry `]() RelocationEntry([RelocationEntry]( "LIEF::PE::RelocationEntry::RelocationEntry") &&other) = default #### [` operator= `]() [RelocationEntry]( "LIEF::PE::RelocationEntry") &operator=([RelocationEntry]( "LIEF::PE::RelocationEntry") &&other) = default #### [` RelocationEntry `]() inline RelocationEntry(uint16\_t position, [BASE\_TYPES]( "LIEF::PE::RelocationEntry::BASE_TYPES") type) #### [` ~RelocationEntry `]() ~RelocationEntry() override = default #### [` swap `]() inline void swap([RelocationEntry]( "LIEF::PE::RelocationEntry") &other) #### [` address `]() virtual uint64\_t address() const override The address of the relocation. #### [` address `]() virtual void address(uint64\_t address) override #### [` size `]() virtual size\_t size() const override The size of the relocatable pointer. #### [` size `]() virtual void size(size\_t size) override #### [` data `]() inline uint16\_t data() const Raw data of the relocation: - The **high** 4 bits store the relocation type - The **low** 12 bits store the relocation offset #### [` position `]() inline uint16\_t position() const Offset relative to [Relocation::virtual\_address]() where the relocation occurs. #### [` type `]() inline [BASE\_TYPES]( "LIEF::PE::RelocationEntry::BASE_TYPES") type() const Type of the relocation. #### [` position `]() inline void position(uint16\_t position) #### [` type `]() inline void type([BASE\_TYPES]( "LIEF::PE::RelocationEntry::BASE_TYPES") type) #### [` accept `]() virtual void accept(Visitor &visitor) const override Method so that the `visitor` can visit us. Public Static Functions #### [` get_position `]() static inline uint16\_t get\_position(uint16\_t data) #### [` get_type `]() static inline uint16\_t get\_type(uint16\_t data) #### [` type_from_data `]() static [BASE\_TYPES]( "LIEF::PE::RelocationEntry::BASE_TYPES") type\_from\_data([Header]( "LIEF::PE::Header")::[MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") arch, uint16\_t data) Public Static Attributes #### [` MAX_ADDR `]() static auto MAX\_ADDR = 1 << 12 Friends **friend class PE::Relocation** #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [RelocationEntry]( "LIEF::PE::RelocationEntry") &entry) --- ## [Export]() ### [` Export `]() class Export : public LIEF::Object Class which represents a PE [Export](). Public Types #### [` entries_t `]() using entries\_t = std::vector<std::unique\_ptr<[ExportEntry]( "LIEF::PE::ExportEntry")>> #### [` it_entries `]() using it\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[entries\_t]( "LIEF::PE::Export::entries_t")&, [ExportEntry]( "LIEF::PE::ExportEntry")\*> #### [` it_const_entries `]() using it\_const\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [entries\_t]( "LIEF::PE::Export::entries_t")&, const [ExportEntry]( "LIEF::PE::ExportEntry")\*> Public Functions #### [` Export `]() Export() = default #### [` Export `]() inline Export(std::string name, const std::vector<[ExportEntry]( "LIEF::PE::ExportEntry")> &entries) #### [` Export `]() inline Export(std::string name) #### [` Export `]() Export(const details::pe\_export\_directory\_table &header) #### [` Export `]() Export(const [Export]( "LIEF::PE::Export::Export")&) #### [` operator= `]() [Export]( "LIEF::PE::Export") &operator=(const [Export]( "LIEF::PE::Export")&) #### [` Export `]() Export([Export]( "LIEF::PE::Export::Export")&&) = default #### [` operator= `]() [Export]( "LIEF::PE::Export") &operator=([Export]( "LIEF::PE::Export")&&) = default #### [` ~Export `]() ~Export() override = default #### [` export_flags `]() inline uint32\_t export\_flags() const According to the PE specifications this value is reserved and should be set to 0. #### [` timestamp `]() inline uint32\_t timestamp() const The time and date that the export data was created. #### [` major_version `]() inline uint16\_t major\_version() const The major version number (can be user-defined). #### [` minor_version `]() inline uint16\_t minor\_version() const The minor version number (can be user-defined). #### [` ordinal_base `]() inline uint32\_t ordinal\_base() const The starting number for the exports. Usually this value is set to 1. #### [` name `]() inline std::string\_view name() const The name of the library exported (e.g. `KERNEL32.dll`). #### [` entries `]() inline [it\_entries]( "LIEF::PE::Export::it_entries") entries() Iterator over the [ExportEntry](). #### [` entries `]() inline [it\_const\_entries]( "LIEF::PE::Export::it_const_entries") entries() const #### [` name_rva `]() inline uint32\_t name\_rva() const Address of the ASCII DLL’s name (RVA). #### [` export_addr_table_rva `]() inline uint32\_t export\_addr\_table\_rva() const RVA of the export address table. #### [` export_addr_table_cnt `]() inline uint32\_t export\_addr\_table\_cnt() const Number of entries in the export address table. #### [` names_addr_table_rva `]() inline uint32\_t names\_addr\_table\_rva() const RVA to the list of exported names. #### [` names_addr_table_cnt `]() inline uint32\_t names\_addr\_table\_cnt() const Number of exports by name. #### [` ord_addr_table_rva `]() inline uint32\_t ord\_addr\_table\_rva() const RVA to the list of exported ordinals. #### [` export_flags `]() inline void export\_flags(uint32\_t flags) #### [` timestamp `]() inline void timestamp(uint32\_t timestamp) #### [` major_version `]() inline void major\_version(uint16\_t major\_version) #### [` minor_version `]() inline void minor\_version(uint16\_t minor\_version) #### [` ordinal_base `]() inline void ordinal\_base(uint32\_t ordinal\_base) #### [` name `]() inline void name(std::string name) #### [` find_entry `]() const [ExportEntry]( "LIEF::PE::ExportEntry") \*find\_entry(const std::string &name) const Find the export entry with the given name. #### [` find_entry `]() inline [ExportEntry]( "LIEF::PE::ExportEntry") \*find\_entry(const std::string &name) #### [` find_entry `]() const [ExportEntry]( "LIEF::PE::ExportEntry") \*find\_entry(uint32\_t ordinal) const Find the export entry with the given ordinal number. #### [` find_entry `]() inline [ExportEntry]( "LIEF::PE::ExportEntry") \*find\_entry(uint32\_t ordinal) #### [` find_entry_at `]() const [ExportEntry]( "LIEF::PE::ExportEntry") \*find\_entry\_at(uint32\_t rva) const Find the export entry at the provided RVA. #### [` find_entry_at `]() inline [ExportEntry]( "LIEF::PE::ExportEntry") \*find\_entry\_at(uint32\_t rva) #### [` add_entry `]() [ExportEntry]( "LIEF::PE::ExportEntry") &add\_entry(const [ExportEntry]( "LIEF::PE::ExportEntry") &exp) Add the given export and return the newly created and added export. #### [` add_entry `]() inline [ExportEntry]( "LIEF::PE::ExportEntry") &add\_entry(std::string name, uint32\_t rva) #### [` remove_entry `]() bool remove\_entry(const [ExportEntry]( "LIEF::PE::ExportEntry") &exp) Remove the given export entry. #### [` remove_entry `]() inline bool remove\_entry(const std::string &name) Remove the export entry with the given name. #### [` remove_entry `]() inline bool remove\_entry(uint32\_t rva) Remove the export entry with the given RVA. #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Export]( "LIEF::PE::Export") &exp) --- ## [Export Entry]() ### [` ExportEntry `]() class ExportEntry : public LIEF::[Symbol]( "LIEF::Symbol") Class which represents a PE [Export]() entry (cf. [PE::Export]()). Public Functions #### [` ExportEntry `]() ExportEntry() = default #### [` ExportEntry `]() inline ExportEntry(uint32\_t address, bool is\_extern, uint16\_t ordinal, uint32\_t function\_rva) #### [` ExportEntry `]() inline ExportEntry(std::string name, uint32\_t rva) #### [` ExportEntry `]() ExportEntry(const [ExportEntry]( "LIEF::PE::ExportEntry::ExportEntry")&) = default #### [` operator= `]() [ExportEntry]( "LIEF::PE::ExportEntry") &operator=(const [ExportEntry]( "LIEF::PE::ExportEntry")&) = default #### [` ExportEntry `]() ExportEntry([ExportEntry]( "LIEF::PE::ExportEntry::ExportEntry")&&) = default #### [` operator= `]() [ExportEntry]( "LIEF::PE::ExportEntry") &operator=([ExportEntry]( "LIEF::PE::ExportEntry")&&) = default #### [` ~ExportEntry `]() ~ExportEntry() override = default #### [` demangled_name `]() std::string demangled\_name() const Demangled representation of the symbol or an empty string if it can’t be demangled. #### [` ordinal `]() inline uint16\_t ordinal() const Ordinal value associated with this exported entry. This value is computed as the index of this entry in the address table plus the ordinal base ([Export::ordinal\_base]()) #### [` address `]() inline uint32\_t address() const Address of the current exported function in the DLL. > **Warning** > > If this entry is **external** to the DLL then it returns 0 and the external address is returned by [function\_rva()]() #### [` is_extern `]() inline bool is\_extern() const #### [` is_forwarded `]() inline bool is\_forwarded() const #### [` forward_information `]() inline [forward\_information\_t]( "LIEF::PE::ExportEntry::forward_information_t") forward\_information() const #### [` function_rva `]() inline uint32\_t function\_rva() const #### [` ordinal `]() inline void ordinal(uint16\_t ordinal) #### [` address `]() inline void address(uint32\_t address) #### [` is_extern `]() inline void is\_extern(bool is\_extern) #### [` value `]() inline virtual uint64\_t value() const override [Symbol]()’s value which is usually the **address** of the symbol. #### [` value `]() inline virtual void value(uint64\_t value) override #### [` set_forward_info `]() inline void set\_forward\_info(std::string lib, std::string function) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ExportEntry]( "LIEF::PE::ExportEntry") &exportEntry) #### [` forward_information_t `]() struct forward\_information\_t Public Functions ##### [` operator bool `]() inline operator bool() const ##### [` key `]() inline std::string key() const Public Members ##### [` library `]() std::string library ##### [` function `]() std::string function Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [forward\_information\_t]( "LIEF::PE::ExportEntry::forward_information_t") &info) --- ## [Signature]() ### [` Signature `]() class Signature : public LIEF::Object Main interface for the PKCS #7 signature scheme. Public Types #### [` VERIFICATION_FLAGS `]() enum class VERIFICATION\_FLAGS : uint32\_t Flags returned by the verification functions. *Values:* ##### [` OK `]() enumerator OK = 0 ##### [` INVALID_SIGNER `]() enumerator INVALID\_SIGNER = 1 << 0 ##### [` UNSUPPORTED_ALGORITHM `]() enumerator UNSUPPORTED\_ALGORITHM = 1 << 1 ##### [` INCONSISTENT_DIGEST_ALGORITHM `]() enumerator INCONSISTENT\_DIGEST\_ALGORITHM = 1 << 2 ##### [` CERT_NOT_FOUND `]() enumerator CERT\_NOT\_FOUND = 1 << 3 ##### [` CORRUPTED_CONTENT_INFO `]() enumerator CORRUPTED\_CONTENT\_INFO = 1 << 4 ##### [` CORRUPTED_AUTH_DATA `]() enumerator CORRUPTED\_AUTH\_DATA = 1 << 5 ##### [` MISSING_PKCS9_MESSAGE_DIGEST `]() enumerator MISSING\_PKCS9\_MESSAGE\_DIGEST = 1 << 6 ##### [` BAD_DIGEST `]() enumerator BAD\_DIGEST = 1 << 7 ##### [` BAD_SIGNATURE `]() enumerator BAD\_SIGNATURE = 1 << 8 ##### [` NO_SIGNATURE `]() enumerator NO\_SIGNATURE = 1 << 9 ##### [` CERT_EXPIRED `]() enumerator CERT\_EXPIRED = 1 << 10 ##### [` CERT_FUTURE `]() enumerator CERT\_FUTURE = 1 << 11 #### [` VERIFICATION_CHECKS `]() enum class VERIFICATION\_CHECKS : uint32\_t Flags to tweak the verification process of the signature. See [Signature::check]() and [LIEF::PE::Binary::verify\_signature]() *Values:* ##### [` DEFAULT `]() enumerator DEFAULT = 1 << 0 Default behavior that tries to follow the Microsoft verification process as close as possible. ##### [` HASH_ONLY `]() enumerator HASH\_ONLY = 1 << 1 Only check that [Binary::authentihash]() matches [ContentInfo::digest]() regardless of the signature’s validity. ##### [` LIFETIME_SIGNING `]() enumerator LIFETIME\_SIGNING = 1 << 2 Same semantic as [WTD\_LIFETIME\_SIGNING\_FLAG](). ##### [` SKIP_CERT_TIME `]() enumerator SKIP\_CERT\_TIME = 1 << 3 Skip the verification of the certificate validity periods so that even though a certificate expired, it returns [VERIFICATION\_FLAGS::OK](). #### [` it_const_crt `]() using it\_const\_crt = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const std::vector<[x509]( "LIEF::PE::x509")>&> Iterator which outputs const [x509]()& certificates. #### [` it_crt `]() using it\_crt = [ref\_iterator]( "LIEF::ref_iterator")<std::vector<[x509]( "LIEF::PE::x509")>&> Iterator which outputs [x509]()& certificates. #### [` it_const_signers_t `]() using it\_const\_signers\_t = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const std::vector<[SignerInfo]( "LIEF::PE::SignerInfo")>&> Iterator which outputs const [SignerInfo]()&. #### [` it_signers_t `]() using it\_signers\_t = [ref\_iterator]( "LIEF::ref_iterator")<std::vector<[SignerInfo]( "LIEF::PE::SignerInfo")>&> Iterator which outputs [SignerInfo]()&. Public Functions #### [` Signature `]() Signature() #### [` Signature `]() Signature(const [Signature]( "LIEF::PE::Signature::Signature")&) #### [` operator= `]() [Signature]( "LIEF::PE::Signature") &operator=(const [Signature]( "LIEF::PE::Signature")&) #### [` Signature `]() Signature([Signature]( "LIEF::PE::Signature::Signature")&&) #### [` operator= `]() [Signature]( "LIEF::PE::Signature") &operator=([Signature]( "LIEF::PE::Signature")&&) #### [` version `]() inline uint32\_t version() const Should be 1. #### [` digest_algorithm `]() inline [ALGORITHMS]( "LIEF::PE::ALGORITHMS") digest\_algorithm() const Algorithm used to *digest* the file. It should match [SignerInfo::digest\_algorithm]() #### [` content_info `]() inline const [ContentInfo]( "LIEF::PE::ContentInfo") &content\_info() const Return the [ContentInfo](). #### [` certificates `]() inline [it\_const\_crt]( "LIEF::PE::Signature::it_const_crt") certificates() const Return an iterator over [x509]() certificates. #### [` certificates `]() inline [it\_crt]( "LIEF::PE::Signature::it_crt") certificates() #### [` signers `]() inline [it\_const\_signers\_t]( "LIEF::PE::Signature::it_const_signers_t") signers() const Return an iterator over the signers ([SignerInfo]()) defined in the PKCS #7 signature. #### [` signers `]() inline [it\_signers\_t]( "LIEF::PE::Signature::it_signers_t") signers() #### [` raw_der `]() inline span<const uint8\_t> raw\_der() const Return the raw original PKCS7 signature. #### [` find_crt `]() const [x509]( "LIEF::PE::x509") \*find\_crt(const std::vector<uint8\_t> &serialno) const Find [x509]() certificate according to its serial number. #### [` find_crt_subject `]() const [x509]( "LIEF::PE::x509") \*find\_crt\_subject(std::string\_view subject) const Find [x509]() certificate according to its subject. #### [` find_crt_subject `]() const [x509]( "LIEF::PE::x509") \*find\_crt\_subject(std::string\_view subject, const std::vector<uint8\_t> &serialno) const Find [x509]() certificate according to its subject **AND** serial number. #### [` find_crt_issuer `]() const [x509]( "LIEF::PE::x509") \*find\_crt\_issuer(std::string\_view issuer) const Find [x509]() certificate according to its issuer. #### [` find_crt_issuer `]() const [x509]( "LIEF::PE::x509") \*find\_crt\_issuer(std::string\_view issuer, const std::vector<uint8\_t> &serialno) const Find [x509]() certificate according to its issuer **AND** serial number. #### [` check `]() [VERIFICATION\_FLAGS]( "LIEF::PE::Signature::VERIFICATION_FLAGS") check([VERIFICATION\_CHECKS]( "LIEF::PE::Signature::VERIFICATION_CHECKS") checks = [VERIFICATION\_CHECKS]( "LIEF::PE::Signature::VERIFICATION_CHECKS")::[DEFAULT]( "LIEF::PE::Signature::VERIFICATION_CHECKS::DEFAULT")) const Check if this signature is valid according to the Authenticode/PKCS #7 verification scheme. By default, it performs the following verifications: 1. It must contain only **one** signer info 2. [Signature::digest\_algorithm]() must match: - [ContentInfo::digest\_algorithm]() - [SignerInfo::digest\_algorithm]() 3. The [x509]() certificate specified by [SignerInfo::serial\_number]() **and** [SignerInfo::issuer]() must exist within [Signature::certificates]() 4. Given the [x509]() certificate, compare [SignerInfo::encrypted\_digest]() against either: - hash of authenticated attributes if present - hash of [ContentInfo]() 5. If authenticated attributes are present, check that a PKCS9\_MESSAGE\_DIGEST attribute exists and that its value matches hash of [ContentInfo]() 6. Check the validity of the PKCS #9 counter signature if present 7. If the signature doesn’t embed a signing-time in the counter signature, check the certificate validity. (See [LIEF::PE::Signature::VERIFICATION\_CHECKS::LIFETIME\_SIGNING]() and [LIEF::PE::Signature::VERIFICATION\_CHECKS::SKIP\_CERT\_TIME]()) See: [LIEF::PE::Signature::VERIFICATION\_CHECKS]() to tweak the behavior #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~Signature `]() ~Signature() override Public Static Functions #### [` hash `]() static inline std::vector<uint8\_t> hash(const std::vector<uint8\_t> &input, [ALGORITHMS]( "LIEF::PE::ALGORITHMS") algo) Hash the input given the algorithm. #### [` hash `]() static std::vector<uint8\_t> hash(const uint8\_t \*buffer, size\_t size, [ALGORITHMS]( "LIEF::PE::ALGORITHMS") algo) #### [` flag_to_string `]() static std::string flag\_to\_string([VERIFICATION\_FLAGS]( "LIEF::PE::Signature::VERIFICATION_FLAGS") flag) Convert a verification flag into a human-readable representation. e.g [VERIFICATION\_FLAGS.BAD\_DIGEST]() | [VERIFICATION\_FLAGS.BAD\_SIGNATURE]() | [VERIFICATION\_FLAGS.CERT\_EXPIRED](). Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [Signature]( "LIEF::PE::Signature") &signature) --- ## [Signature Attribute]() ### [` Attribute `]() class Attribute : public LIEF::Object Interface over PKCS #7 attribute. Subclassed by [LIEF::PE::ContentType](), [LIEF::PE::GenericType](), [LIEF::PE::MsCounterSign](), [LIEF::PE::MsManifestBinaryID](), [LIEF::PE::MsSpcNestedSignature](), [LIEF::PE::MsSpcStatementType](), [LIEF::PE::PKCS9AtSequenceNumber](), [LIEF::PE::PKCS9CounterSignature](), [LIEF::PE::PKCS9MessageDigest](), [LIEF::PE::PKCS9SigningTime](), [LIEF::PE::SigningCertificateV2](), [LIEF::PE::SpcRelaxedPeMarkerCheck](), [LIEF::PE::SpcSpOpusInfo]() Public Types #### [` TYPE `]() enum class TYPE *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` CONTENT_TYPE `]() enumerator CONTENT\_TYPE ##### [` GENERIC_TYPE `]() enumerator GENERIC\_TYPE ##### [` SIGNING_CERTIFICATE_V2 `]() enumerator SIGNING\_CERTIFICATE\_V2 ##### [` SPC_SP_OPUS_INFO `]() enumerator SPC\_SP\_OPUS\_INFO ##### [` SPC_RELAXED_PE_MARKER_CHECK `]() enumerator SPC\_RELAXED\_PE\_MARKER\_CHECK ##### [` MS_COUNTER_SIGN `]() enumerator MS\_COUNTER\_SIGN ##### [` MS_SPC_NESTED_SIGN `]() enumerator MS\_SPC\_NESTED\_SIGN ##### [` MS_SPC_STATEMENT_TYPE `]() enumerator MS\_SPC\_STATEMENT\_TYPE ##### [` MS_PLATFORM_MANIFEST_BINARY_ID `]() enumerator MS\_PLATFORM\_MANIFEST\_BINARY\_ID ##### [` PKCS9_AT_SEQUENCE_NUMBER `]() enumerator PKCS9\_AT\_SEQUENCE\_NUMBER ##### [` PKCS9_COUNTER_SIGNATURE `]() enumerator PKCS9\_COUNTER\_SIGNATURE ##### [` PKCS9_MESSAGE_DIGEST `]() enumerator PKCS9\_MESSAGE\_DIGEST ##### [` PKCS9_SIGNING_TIME `]() enumerator PKCS9\_SIGNING\_TIME Public Functions #### [` Attribute `]() Attribute() = delete #### [` Attribute `]() Attribute(const [Attribute]( "LIEF::PE::Attribute::Attribute")&) = default #### [` operator= `]() [Attribute]( "LIEF::PE::Attribute") &operator=(const [Attribute]( "LIEF::PE::Attribute")&) = default #### [` clone `]() virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const = 0 #### [` type `]() inline virtual [TYPE]( "LIEF::PE::Attribute::TYPE") type() const Concrete type of the attribute. #### [` print `]() virtual std::string print() const = 0 Print information about the underlying attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~Attribute `]() ~Attribute() override = default #### [` Tcast `]() template<class T> inline const [T]( "LIEF::PE::Attribute::cast::T") \*cast() const #### [` Tcast `]() template<class T> inline [T]( "LIEF::PE::Attribute::cast::T") \*cast() Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Attribute]( "LIEF::PE::Attribute") &attribute) --- ## [Signature ContentType]() ### [` ContentType `]() class ContentType : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Interface over the structure described by the OID `1.2.840.113549.1.9.3` (PKCS #9). The internal structure is described in the [RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0]() ```text ContentType ::= OBJECT IDENTIFIER ``` Public Functions #### [` ContentType `]() inline ContentType() #### [` ContentType `]() inline ContentType(oid\_t oid) #### [` ContentType `]() ContentType(const [ContentType]( "LIEF::PE::ContentType::ContentType")&) = default #### [` operator= `]() [ContentType]( "LIEF::PE::ContentType") &operator=(const [ContentType]( "LIEF::PE::ContentType")&) = default #### [` oid `]() inline const oid\_t &oid() const OID as described in RFC #2985. #### [` print `]() virtual std::string print() const override Print information about the attribute. #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~ContentType `]() ~ContentType() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [Signature GenericType]() ### [` GenericType `]() class GenericType : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Interface over an attribute for which the internal structure is not supported by LIEF. Public Functions #### [` GenericType `]() inline GenericType() #### [` GenericType `]() inline GenericType(oid\_t oid, std::vector<uint8\_t> raw) #### [` GenericType `]() GenericType(const [GenericType]( "LIEF::PE::GenericType::GenericType")&) = default #### [` operator= `]() [GenericType]( "LIEF::PE::GenericType") &operator=(const [GenericType]( "LIEF::PE::GenericType")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` oid `]() inline const oid\_t &oid() const OID of the original attribute. #### [` raw_content `]() inline span<const uint8\_t> raw\_content() const Original DER blob of the attribute. #### [` print `]() virtual std::string print() const override Print information about the attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~GenericType `]() ~GenericType() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [Signature MsSpcNestedSignature]() ### [` MsSpcNestedSignature `]() class MsSpcNestedSignature : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Interface over the structure described by the OID `1.3.6.1.4.1.311.2.4.1`. The internal structure is not documented but we can infer the following structure: ```text MsSpcNestedSignature ::= SET OF SignedData ``` `SignedData` is the structure described in PKCS #7 RFC ([LIEF::PE::Signature]()) Public Functions #### [` MsSpcNestedSignature `]() MsSpcNestedSignature() = delete #### [` MsSpcNestedSignature `]() inline MsSpcNestedSignature([Signature]( "LIEF::PE::Signature") sig) #### [` MsSpcNestedSignature `]() MsSpcNestedSignature(const [MsSpcNestedSignature]( "LIEF::PE::MsSpcNestedSignature::MsSpcNestedSignature")&) = default #### [` operator= `]() [MsSpcNestedSignature]( "LIEF::PE::MsSpcNestedSignature") &operator=(const [MsSpcNestedSignature]( "LIEF::PE::MsSpcNestedSignature")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` sig `]() inline const [Signature]( "LIEF::PE::Signature") &sig() const Underlying [Signature]() object. #### [` print `]() virtual std::string print() const override Print information about the attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~MsSpcNestedSignature `]() ~MsSpcNestedSignature() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [Signature MsSpcStatementType]() ### [` MsSpcStatementType `]() class MsSpcStatementType : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Interface over the structure described by the OID `1.3.6.1.4.1.311.2.1.11`. The internal structure is described in the official document: [Windows Authenticode Portable Executable Signature Format]() ```text SpcStatementType ::= SEQUENCE of OBJECT IDENTIFIER ``` Public Functions #### [` MsSpcStatementType `]() MsSpcStatementType() = delete #### [` MsSpcStatementType `]() inline MsSpcStatementType(oid\_t oid) #### [` MsSpcStatementType `]() MsSpcStatementType(const [MsSpcStatementType]( "LIEF::PE::MsSpcStatementType::MsSpcStatementType")&) = default #### [` operator= `]() [MsSpcStatementType]( "LIEF::PE::MsSpcStatementType") &operator=(const [MsSpcStatementType]( "LIEF::PE::MsSpcStatementType")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` oid `]() inline const oid\_t &oid() const According to the documentation: > The SpcStatementType MUST contain one Object Identifier with either the value `1.3.6.1.4.1.311.2.1.21 (SPC_INDIVIDUAL_SP_KEY_PURPOSE_OBJID)` or > `1.3.6.1.4.1.311.2.1.22 (SPC_COMMERCIAL_SP_KEY_PURPOSE_OBJID)`. #### [` print `]() virtual std::string print() const override Print information about the attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~MsSpcStatementType `]() ~MsSpcStatementType() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [Signature PKCS9AtSequenceNumber]() ### [` PKCS9AtSequenceNumber `]() class PKCS9AtSequenceNumber : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Interface over the structure described by the OID `1.2.840.113549.1.9.25.4` (PKCS #9). The internal structure is described in the [RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0]() ```text sequenceNumber ATTRIBUTE ::= { WITH SYNTAX SequenceNumber EQUALITY MATCHING RULE integerMatch SINGLE VALUE TRUE ID pkcs-9-at-sequenceNumber } SequenceNumber ::= INTEGER (1..MAX) ``` Public Functions #### [` PKCS9AtSequenceNumber `]() PKCS9AtSequenceNumber() = delete #### [` PKCS9AtSequenceNumber `]() inline PKCS9AtSequenceNumber(uint32\_t num) #### [` PKCS9AtSequenceNumber `]() PKCS9AtSequenceNumber(const [PKCS9AtSequenceNumber]( "LIEF::PE::PKCS9AtSequenceNumber::PKCS9AtSequenceNumber")&) = default #### [` operator= `]() [PKCS9AtSequenceNumber]( "LIEF::PE::PKCS9AtSequenceNumber") &operator=(const [PKCS9AtSequenceNumber]( "LIEF::PE::PKCS9AtSequenceNumber")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` number `]() inline uint32\_t number() const Number as described in the RFC. #### [` print `]() virtual std::string print() const override Print information about the attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~PKCS9AtSequenceNumber `]() ~PKCS9AtSequenceNumber() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [Signature PKCS9CounterSignature]() ### [` PKCS9CounterSignature `]() class PKCS9CounterSignature : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Interface over the structure described by the OID `1.2.840.113549.1.9.6` (PKCS #9). The internal structure is described in the [RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0]() ```text counterSignature ATTRIBUTE ::= { WITH SYNTAX SignerInfo ID pkcs-9-at-counterSignature } ``` Public Functions #### [` PKCS9CounterSignature `]() PKCS9CounterSignature() = delete #### [` PKCS9CounterSignature `]() inline PKCS9CounterSignature([SignerInfo]( "LIEF::PE::SignerInfo") signer) #### [` PKCS9CounterSignature `]() PKCS9CounterSignature(const [PKCS9CounterSignature]( "LIEF::PE::PKCS9CounterSignature::PKCS9CounterSignature")&) = default #### [` operator= `]() [PKCS9CounterSignature]( "LIEF::PE::PKCS9CounterSignature") &operator=(const [PKCS9CounterSignature]( "LIEF::PE::PKCS9CounterSignature")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` signer `]() inline const [SignerInfo]( "LIEF::PE::SignerInfo") &signer() const [SignerInfo]() as described in the RFC #2985. #### [` print `]() virtual std::string print() const override Print information about the attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~PKCS9CounterSignature `]() ~PKCS9CounterSignature() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [Signature PKCS9MessageDigest]() ### [` PKCS9MessageDigest `]() class PKCS9MessageDigest : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Interface over the structure described by the OID `1.2.840.113549.1.9.4` (PKCS #9). The internal structure is described in the [RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0]() ```text messageDigest ATTRIBUTE ::= { WITH SYNTAX MessageDigest EQUALITY MATCHING RULE octetStringMatch SINGLE VALUE TRUE ID pkcs-9-at-messageDigest } MessageDigest ::= OCTET STRING ``` Public Functions #### [` PKCS9MessageDigest `]() PKCS9MessageDigest() = delete #### [` PKCS9MessageDigest `]() inline PKCS9MessageDigest(std::vector<uint8\_t> digest) #### [` PKCS9MessageDigest `]() PKCS9MessageDigest(const [PKCS9MessageDigest]( "LIEF::PE::PKCS9MessageDigest::PKCS9MessageDigest")&) = default #### [` operator= `]() [PKCS9MessageDigest]( "LIEF::PE::PKCS9MessageDigest") &operator=(const [PKCS9MessageDigest]( "LIEF::PE::PKCS9MessageDigest")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` digest `]() inline span<const uint8\_t> digest() const Message digest as a blob of bytes as described in the RFC. #### [` print `]() virtual std::string print() const override Print information about the attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~PKCS9MessageDigest `]() ~PKCS9MessageDigest() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [Signature PKCS9SigningTime]() ### [` PKCS9SigningTime `]() class PKCS9SigningTime : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Interface over the structure described by the OID `1.2.840.113549.1.9.5` (PKCS #9). The internal structure is described in the [RFC #2985: PKCS #9 - Selected Object Classes and Attribute Types Version 2.0]() ```text signingTime ATTRIBUTE ::= { WITH SYNTAX SigningTime EQUALITY MATCHING RULE signingTimeMatch SINGLE VALUE TRUE ID pkcs-9-at-signingTime } SigningTime ::= Time -- imported from ISO/IEC 9594-8 ``` Public Types #### [` time_t `]() using time\_t = std::array<int32\_t, 6> Time as an array [year, month, day, hour, min, sec]. Public Functions #### [` PKCS9SigningTime `]() PKCS9SigningTime() = delete #### [` PKCS9SigningTime `]() inline PKCS9SigningTime([time\_t]( "LIEF::PE::PKCS9SigningTime::time_t") time) #### [` PKCS9SigningTime `]() PKCS9SigningTime(const [PKCS9SigningTime]( "LIEF::PE::PKCS9SigningTime::PKCS9SigningTime")&) = default #### [` operator= `]() [PKCS9SigningTime]( "LIEF::PE::PKCS9SigningTime") &operator=(const [PKCS9SigningTime]( "LIEF::PE::PKCS9SigningTime")&) = default #### [` time `]() inline const [time\_t]( "LIEF::PE::PKCS9SigningTime::time_t") &time() const Time as an array [year, month, day, hour, min, sec]. #### [` print `]() virtual std::string print() const override Print information about the attribute. #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~PKCS9SigningTime `]() ~PKCS9SigningTime() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [Signature SpcSpOpusInfo]() ### [` SpcSpOpusInfo `]() class SpcSpOpusInfo : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Interface over the structure described by the OID `1.3.6.1.4.1.311.2.1.12`. The internal structure is described in the official document: [Windows Authenticode Portable Executable Signature Format]() ```text SpcSpOpusInfo ::= SEQUENCE { programName [0] EXPLICIT SpcString OPTIONAL, moreInfo [1] EXPLICIT SpcLink OPTIONAL } ``` Public Functions #### [` SpcSpOpusInfo `]() inline SpcSpOpusInfo(std::string program\_name, std::string more\_info) #### [` SpcSpOpusInfo `]() inline SpcSpOpusInfo() #### [` SpcSpOpusInfo `]() SpcSpOpusInfo(const [SpcSpOpusInfo]( "LIEF::PE::SpcSpOpusInfo::SpcSpOpusInfo")&) = default #### [` operator= `]() [SpcSpOpusInfo]( "LIEF::PE::SpcSpOpusInfo") &operator=(const [SpcSpOpusInfo]( "LIEF::PE::SpcSpOpusInfo")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` program_name `]() inline std::string\_view program\_name() const Program description provided by the publisher. #### [` more_info `]() inline std::string\_view more\_info() const Other information such as a URL. #### [` print `]() virtual std::string print() const override Print information about the attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~SpcSpOpusInfo `]() ~SpcSpOpusInfo() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [Signature SpcIndirectData]() ### [` SpcIndirectData `]() class SpcIndirectData : public LIEF::PE::[ContentInfo]( "LIEF::PE::ContentInfo")::[Content]( "LIEF::PE::ContentInfo::Content") Public Functions #### [` SpcIndirectData `]() inline SpcIndirectData() #### [` SpcIndirectData `]() SpcIndirectData(const [SpcIndirectData]( "LIEF::PE::SpcIndirectData::SpcIndirectData")&) = default #### [` operator= `]() [SpcIndirectData]( "LIEF::PE::SpcIndirectData") &operator=(const [SpcIndirectData]( "LIEF::PE::SpcIndirectData")&) = default #### [` clone `]() inline virtual std::unique\_ptr<Content> clone() const override #### [` digest_algorithm `]() inline [ALGORITHMS]( "LIEF::PE::ALGORITHMS") digest\_algorithm() const Digest used to hash the file. It should match [LIEF::PE::SignerInfo::digest\_algorithm]() #### [` digest `]() inline span<const uint8\_t> digest() const PE’s authentihash. > **See also** > > [LIEF::PE::Binary::authentihash]() #### [` file `]() inline std::string\_view file() const #### [` url `]() inline std::string\_view url() const #### [` print `]() virtual void print(std::ostream &os) const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~SpcIndirectData `]() ~SpcIndirectData() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [ContentInfo]( "LIEF::PE::ContentInfo")::[Content]( "LIEF::PE::ContentInfo::Content") \*content) Public Static Attributes #### [` SPC_INDIRECT_DATA_OBJID `]() static auto SPC\_INDIRECT\_DATA\_OBJID = "1.3.6.1.4.1.311.2.1.4" Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [SpcIndirectData]( "LIEF::PE::SpcIndirectData") &content) --- ## [Signature GenericContent]() ### [` GenericContent `]() class GenericContent : public LIEF::PE::[ContentInfo]( "LIEF::PE::ContentInfo")::[Content]( "LIEF::PE::ContentInfo::Content") Public Functions #### [` GenericContent `]() GenericContent() #### [` GenericContent `]() GenericContent(oid\_t oid) #### [` GenericContent `]() GenericContent(const [GenericContent]( "LIEF::PE::GenericContent::GenericContent")&) = default #### [` operator= `]() [GenericContent]( "LIEF::PE::GenericContent") &operator=(const [GenericContent]( "LIEF::PE::GenericContent")&) = default #### [` clone `]() inline virtual std::unique\_ptr<Content> clone() const override #### [` oid `]() inline const oid\_t &oid() const #### [` raw `]() inline span<const uint8\_t> raw() const #### [` raw `]() inline span<uint8\_t> raw() #### [` ~GenericContent `]() ~GenericContent() override #### [` print `]() virtual void print(std::ostream &os) const override #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` classof `]() static bool classof(const [ContentInfo]( "LIEF::PE::ContentInfo")::[Content]( "LIEF::PE::ContentInfo::Content") \*content) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [GenericContent]( "LIEF::PE::GenericContent") &content) --- ## [RsaInfo]() ### [` RsaInfo `]() class RsaInfo Object that wraps a RSA key. Public Types #### [` rsa_ctx_handle `]() using rsa\_ctx\_handle = void\* #### [` bignum_wrapper_t `]() using bignum\_wrapper\_t = std::vector<uint8\_t> Container for BigInt. Public Functions #### [` RsaInfo `]() RsaInfo(const [RsaInfo]( "LIEF::PE::RsaInfo::RsaInfo") &other) #### [` RsaInfo `]() RsaInfo([RsaInfo]( "LIEF::PE::RsaInfo::RsaInfo") &&other) #### [` operator= `]() [RsaInfo]( "LIEF::PE::RsaInfo") &operator=([RsaInfo]( "LIEF::PE::RsaInfo") other) #### [` has_public_key `]() bool has\_public\_key() const True if it embeds a public key. #### [` has_private_key `]() bool has\_private\_key() const True if it embeds a private key. #### [` N `]() [bignum\_wrapper\_t]( "LIEF::PE::RsaInfo::bignum_wrapper_t") N() const RSA public modulus. #### [` E `]() [bignum\_wrapper\_t]( "LIEF::PE::RsaInfo::bignum_wrapper_t") E() const RSA public exponent. #### [` D `]() [bignum\_wrapper\_t]( "LIEF::PE::RsaInfo::bignum_wrapper_t") D() const RSA private exponent. #### [` P `]() [bignum\_wrapper\_t]( "LIEF::PE::RsaInfo::bignum_wrapper_t") P() const First prime factor. #### [` Q `]() [bignum\_wrapper\_t]( "LIEF::PE::RsaInfo::bignum_wrapper_t") Q() const Second prime factor. #### [` key_size `]() size\_t key\_size() const Size of the public modulus (in bits). #### [` swap `]() void swap([RsaInfo]( "LIEF::PE::RsaInfo") &other) #### [` operator bool `]() operator bool() const #### [` ~RsaInfo `]() ~RsaInfo() Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [RsaInfo]( "LIEF::PE::RsaInfo") &info) --- ## [x509]() ### [` x509 `]() class x509 : public LIEF::Object Interface over a [x509]() certificate. Public Types #### [` KEY_TYPES `]() enum class KEY\_TYPES : uint32\_t Public key scheme. *Values:* ##### [` NONE `]() enumerator NONE = 0 Unknown scheme. ##### [` RSA `]() enumerator RSA RSA Scheme. ##### [` ECKEY `]() enumerator ECKEY Elliptic-curve scheme. ##### [` ECKEY_DH `]() enumerator ECKEY\_DH Elliptic-curve Diffie-Hellman. ##### [` ECDSA `]() enumerator ECDSA Elliptic-curve Digital [Signature]() Algorithm. ##### [` RSA_ALT `]() enumerator RSA\_ALT RSA scheme with an alternative implementation for signing and decrypting. ##### [` RSASSA_PSS `]() enumerator RSASSA\_PSS RSA Probabilistic signature scheme. #### [` VERIFICATION_FLAGS `]() enum class VERIFICATION\_FLAGS : uint32\_t Mirror of mbedtls’s X509 Verify codes: MBEDTLS\_X509\_XX. It must be sync with include/mbedtls/x509.h *Values:* ##### [` OK `]() enumerator OK = 0 The verification succeed. ##### [` BADCERT_EXPIRED `]() enumerator BADCERT\_EXPIRED = 1 << 0 The certificate validity has expired. ##### [` BADCERT_REVOKED `]() enumerator BADCERT\_REVOKED = 1 << 1 The certificate has been revoked (is on a CRL). ##### [` BADCERT_CN_MISMATCH `]() enumerator BADCERT\_CN\_MISMATCH = 1 << 2 The certificate Common Name (CN) does not match with the expected CN. ##### [` BADCERT_NOT_TRUSTED `]() enumerator BADCERT\_NOT\_TRUSTED = 1 << 3 The certificate is not correctly signed by the trusted CA. ##### [` BADCRL_NOT_TRUSTED `]() enumerator BADCRL\_NOT\_TRUSTED = 1 << 4 The CRL is not correctly signed by the trusted CA. ##### [` BADCRL_EXPIRED `]() enumerator BADCRL\_EXPIRED = 1 << 5 The CRL is expired. ##### [` BADCERT_MISSING `]() enumerator BADCERT\_MISSING = 1 << 6 Certificate was missing. ##### [` BADCERT_SKIP_VERIFY `]() enumerator BADCERT\_SKIP\_VERIFY = 1 << 7 Certificate verification was skipped. ##### [` BADCERT_OTHER `]() enumerator BADCERT\_OTHER = 1 << 8 Other reason (can be used by verify callback). ##### [` BADCERT_FUTURE `]() enumerator BADCERT\_FUTURE = 1 << 9 The certificate validity starts in the future. ##### [` BADCRL_FUTURE `]() enumerator BADCRL\_FUTURE = 1 << 10 The CRL is from the future. ##### [` BADCERT_KEY_USAGE `]() enumerator BADCERT\_KEY\_USAGE = 1 << 11 Usage does not match the keyUsage extension. ##### [` BADCERT_EXT_KEY_USAGE `]() enumerator BADCERT\_EXT\_KEY\_USAGE = 1 << 12 Usage does not match the extendedKeyUsage extension. ##### [` BADCERT_NS_CERT_TYPE `]() enumerator BADCERT\_NS\_CERT\_TYPE = 1 << 13 Usage does not match the nsCertType extension. ##### [` BADCERT_BAD_MD `]() enumerator BADCERT\_BAD\_MD = 1 << 14 The certificate is signed with an unacceptable hash. ##### [` BADCERT_BAD_PK `]() enumerator BADCERT\_BAD\_PK = 1 << 15 The certificate is signed with an unacceptable PK alg (e.g. RSA vs ECDSA). ##### [` BADCERT_BAD_KEY `]() enumerator BADCERT\_BAD\_KEY = 1 << 16 The certificate is signed with an unacceptable key (e.g. bad curve, RSA too short). ##### [` BADCRL_BAD_MD `]() enumerator BADCRL\_BAD\_MD = 1 << 17 The CRL is signed with an unacceptable hash. ##### [` BADCRL_BAD_PK `]() enumerator BADCRL\_BAD\_PK = 1 << 18 The CRL is signed with an unacceptable PK alg (e.g. RSA vs ECDSA). ##### [` BADCRL_BAD_KEY `]() enumerator BADCRL\_BAD\_KEY = 1 << 19 The CRL is signed with an unacceptable key (e.g. bad curve, RSA too short). #### [` KEY_USAGE `]() enum class KEY\_USAGE : uint32\_t Key usage as defined in [RFC #5280 - section-4.2.1.3](). *Values:* ##### [` DIGITAL_SIGNATURE `]() enumerator DIGITAL\_SIGNATURE = 0 The key is used for digital signature. ##### [` NON_REPUDIATION `]() enumerator NON\_REPUDIATION The key is used for digital signature AND to protect against falsely denying some action. ##### [` KEY_ENCIPHERMENT `]() enumerator KEY\_ENCIPHERMENT The key is used for enciphering private or secret keys. ##### [` DATA_ENCIPHERMENT `]() enumerator DATA\_ENCIPHERMENT The key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher. ##### [` KEY_AGREEMENT `]() enumerator KEY\_AGREEMENT The Key is used for key agreement. (e.g. with Diffie-Hellman). ##### [` KEY_CERT_SIGN `]() enumerator KEY\_CERT\_SIGN The key is used for verifying signatures on public key certificates. ##### [` CRL_SIGN `]() enumerator CRL\_SIGN The key is used for verifying signatures on certificate revocation lists. ##### [` ENCIPHER_ONLY `]() enumerator ENCIPHER\_ONLY In **association with** KEY\_AGREEMENT (otherwise the meaning is undefined), the key is only used for enciphering data while performing key agreement. ##### [` DECIPHER_ONLY `]() enumerator DECIPHER\_ONLY In **association with** KEY\_AGREEMENT (otherwise the meaning is undefined), the key is only used for deciphering data while performing key agreement. #### [` date_t `]() using date\_t = std::array<int32\_t, 6> Tuple (Year, Month, Day, Hour, Minute, Second). #### [` certificates_t `]() using certificates\_t = std::vector<[x509]( "LIEF::PE::x509")> Public Functions #### [` x509 `]() x509(mbedtls\_x509\_crt \*ca) #### [` x509 `]() x509(const [x509]( "LIEF::PE::x509::x509") &other) #### [` operator= `]() [x509]( "LIEF::PE::x509") &operator=([x509]( "LIEF::PE::x509") other) #### [` swap `]() void swap([x509]( "LIEF::PE::x509") &other) #### [` version `]() uint32\_t version() const X.509 version. (1=v1, 2=v2, 3=v3). #### [` serial_number `]() std::vector<uint8\_t> serial\_number() const Unique id for certificate issued by a specific CA. #### [` signature_algorithm `]() oid\_t signature\_algorithm() const [Signature]() algorithm (OID). #### [` valid_from `]() [date\_t]( "LIEF::PE::x509::date_t") valid\_from() const Start time of certificate validity. #### [` valid_to `]() [date\_t]( "LIEF::PE::x509::date_t") valid\_to() const End time of certificate validity. #### [` issuer `]() std::string issuer() const Issuer information. #### [` subject `]() std::string subject() const Subject information. #### [` check_signature `]() bool check\_signature(const std::vector<uint8\_t> &hash, const std::vector<uint8\_t> &signature, [ALGORITHMS]( "LIEF::PE::ALGORITHMS") digest) const Try to decrypt the given signature and check if it matches the given hash according to the hash algorithm provided. #### [` raw `]() std::vector<uint8\_t> raw() const The raw [x509]() bytes (DER encoded). #### [` key_type `]() [KEY\_TYPES]( "LIEF::PE::x509::KEY_TYPES") key\_type() const Return the underlying public-key scheme. #### [` rsa_info `]() std::unique\_ptr<[RsaInfo]( "LIEF::PE::RsaInfo")> rsa\_info() const **If** the underlying public-key scheme is RSA, return the RSA information. Otherwise, return a nullptr #### [` verify `]() [VERIFICATION\_FLAGS]( "LIEF::PE::x509::VERIFICATION_FLAGS") verify(const [x509]( "LIEF::PE::x509") &ca) const Verify that this certificate has been used **to trust** the given certificate. #### [` is_trusted_by `]() [VERIFICATION\_FLAGS]( "LIEF::PE::x509::VERIFICATION_FLAGS") is\_trusted\_by(const std::vector<[x509]( "LIEF::PE::x509")> &ca) const Verify that this certificate **is trusted** by the given CA list. #### [` certificate_policies `]() std::vector<oid\_t> certificate\_policies() const Policy information terms as OID (see RFC #5280). #### [` key_usage `]() std::vector<[KEY\_USAGE]( "LIEF::PE::x509::KEY_USAGE")> key\_usage() const Purpose of the key contained in the certificate. #### [` ext_key_usage `]() std::vector<oid\_t> ext\_key\_usage() const Indicates one or more purposes for which the certified public key may be used (OID types). #### [` is_ca `]() bool is\_ca() const #### [` signature `]() std::vector<uint8\_t> signature() const The signature of the certificate. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~x509 `]() ~x509() override Public Static Functions #### [` parse `]() static [certificates\_t]( "LIEF::PE::x509::certificates_t") parse(const std::string &path) Parse [x509]() certificate(s) from file path. #### [` parse `]() static [certificates\_t]( "LIEF::PE::x509::certificates_t") parse(const std::vector<uint8\_t> &content) Parse [x509]() certificate(s) from raw blob. #### [` check_time `]() static bool check\_time(const [date\_t]( "LIEF::PE::x509::date_t") &before, const [date\_t]( "LIEF::PE::x509::date_t") &after) Return True if `before` is *before* than `after`. False otherwise. #### [` time_is_past `]() static bool time\_is\_past(const [date\_t]( "LIEF::PE::x509::date_t") &to) True if the given time is in the **past** according to the clock’s system. #### [` time_is_future `]() static bool time\_is\_future(const [date\_t]( "LIEF::PE::x509::date_t") &from) True if the given time is in the future according to the clock’s system. Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [x509]( "LIEF::PE::x509") &x509\_cert) --- ## [ContentInfo]() ### [` ContentInfo `]() class ContentInfo : public LIEF::Object [ContentInfo]() as described in the RFC2315 ([https://tools.ietf.org/html/rfc2315#section-7]()) ```text ContentInfo ::= SEQUENCE { contentType ContentType, content [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL } ContentType ::= OBJECT IDENTIFIER ``` In the case of PE signature, [ContentType]() **must** be set to SPC\_INDIRECT\_DATA\_OBJID OID: `1.3.6.1.4.1.311.2.1.4` and content is defined by the structure: `SpcIndirectDataContent` ```text SpcIndirectDataContent ::= SEQUENCE { data SpcAttributeTypeAndOptionalValue, messageDigest DigestInfo } SpcAttributeTypeAndOptionalValue ::= SEQUENCE { type ObjectID, value [0] EXPLICIT ANY OPTIONAL } ``` For PE signature, `SpcAttributeTypeAndOptionalValue.type` is set to `SPC_PE_IMAGE_DATAOBJ` (OID: `1.3.6.1.4.1.311.2.1.15`) and the value is defined by `SpcPeImageData` ```text DigestInfo ::= SEQUENCE { digestAlgorithm AlgorithmIdentifier, digest OCTETSTRING } AlgorithmIdentifier ::= SEQUENCE { algorithm ObjectID, parameters [0] EXPLICIT ANY OPTIONAL } ``` Public Functions #### [` ContentInfo `]() ContentInfo() #### [` ContentInfo `]() ContentInfo(const [ContentInfo]( "LIEF::PE::ContentInfo::ContentInfo") &other) #### [` ContentInfo `]() ContentInfo([ContentInfo]( "LIEF::PE::ContentInfo::ContentInfo") &&other) noexcept = default #### [` operator= `]() [ContentInfo]( "LIEF::PE::ContentInfo") &operator=([ContentInfo]( "LIEF::PE::ContentInfo") other) #### [` swap `]() void swap([ContentInfo]( "LIEF::PE::ContentInfo") &other) noexcept #### [` content_type `]() inline oid\_t content\_type() const Return the OID that describes the content wrapped by this object. It should match SPC\_INDIRECT\_DATA\_OBJID (1.3.6.1.4.1.311.2.1.4). #### [` value `]() inline [Content]( "LIEF::PE::ContentInfo::Content") &value() #### [` value `]() inline const [Content]( "LIEF::PE::ContentInfo::Content") &value() const #### [` digest `]() std::vector<uint8\_t> digest() const Return the digest (authentihash) if the underlying content type is `SPC_INDIRECT_DATA_OBJID` Otherwise, return an empty vector. #### [` digest_algorithm `]() [ALGORITHMS]( "LIEF::PE::ALGORITHMS") digest\_algorithm() const Return the digest used to hash the file. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~ContentInfo `]() ~ContentInfo() override = default Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ContentInfo]( "LIEF::PE::ContentInfo") &content\_info) #### [` Content `]() class Content : public LIEF::Object Subclassed by [LIEF::PE::GenericContent](), [LIEF::PE::PKCS9TSTInfo](), [LIEF::PE::SpcIndirectData]() Public Functions ##### [` Content `]() inline Content(oid\_t oid) ##### [` content_type `]() inline const oid\_t &content\_type() const ##### [` clone `]() virtual std::unique\_ptr<[Content]( "LIEF::PE::ContentInfo::Content")> clone() const = 0 ##### [` print `]() virtual void print(std::ostream &os) const = 0 ##### [` Tcast `]() template<class T> inline const [T]( "LIEF::PE::ContentInfo::Content::cast::T") \*cast() const ##### [` Tcast `]() template<class T> inline [T]( "LIEF::PE::ContentInfo::Content::cast::T") \*cast() ##### [` ~Content `]() ~Content() override = default Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Content]( "LIEF::PE::ContentInfo::Content") &content) --- ## [SignerInfo]() ### [` SignerInfo `]() class SignerInfo : public LIEF::Object [SignerInfo]() as described in the [RFC 2315]() ```text SignerInfo ::= SEQUENCE { version Version, issuerAndSerialNumber IssuerAndSerialNumber, digestAlgorithm DigestAlgorithmIdentifier, authenticatedAttributes [0] IMPLICIT Attributes OPTIONAL, digestEncryptionAlgorithm DigestEncryptionAlgorithmIdentifier, encryptedDigest EncryptedDigest, unauthenticatedAttributes [1] IMPLICIT Attributes OPTIONAL } EncryptedDigest ::= OCTET STRING ``` Public Types #### [` encrypted_digest_t `]() using encrypted\_digest\_t = std::vector<uint8\_t> #### [` attributes_t `]() using attributes\_t = std::vector<std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")>> Internal container used to store both authenticated and unauthenticated attributes. #### [` it_const_attributes_t `]() using it\_const\_attributes\_t = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [attributes\_t]( "LIEF::PE::SignerInfo::attributes_t")&, const [Attribute]( "LIEF::PE::Attribute")\*> Iterator which outputs const [Attribute]()&. Public Functions #### [` SignerInfo `]() SignerInfo() #### [` SignerInfo `]() SignerInfo(const [SignerInfo]( "LIEF::PE::SignerInfo::SignerInfo") &other) #### [` operator= `]() [SignerInfo]( "LIEF::PE::SignerInfo") &operator=([SignerInfo]( "LIEF::PE::SignerInfo") other) #### [` SignerInfo `]() SignerInfo([SignerInfo]( "LIEF::PE::SignerInfo::SignerInfo")&&) #### [` operator= `]() [SignerInfo]( "LIEF::PE::SignerInfo") &operator=([SignerInfo]( "LIEF::PE::SignerInfo")&&) #### [` swap `]() void swap([SignerInfo]( "LIEF::PE::SignerInfo") &other) #### [` version `]() inline uint32\_t version() const Should be 1. #### [` serial_number `]() inline span<const uint8\_t> serial\_number() const Return the serial number associated with the [x509]() certificate used by this signer. > **See also** > > [LIEF::PE::x509::serial\_number]() [SignerInfo::issuer]() #### [` issuer `]() inline std::string\_view issuer() const Return the [x509::issuer]() used by this signer. #### [` digest_algorithm `]() inline [ALGORITHMS]( "LIEF::PE::ALGORITHMS") digest\_algorithm() const Algorithm (OID) used to hash the file. This value should match [LIEF::PE::ContentInfo::digest\_algorithm]() and [LIEF::PE::Signature::digest\_algorithm]() #### [` encryption_algorithm `]() inline [ALGORITHMS]( "LIEF::PE::ALGORITHMS") encryption\_algorithm() const Return the (public-key) algorithm used to encrypt the signature. #### [` encrypted_digest `]() inline const [encrypted\_digest\_t]( "LIEF::PE::SignerInfo::encrypted_digest_t") &encrypted\_digest() const Return the signature created by the signing certificate’s private key. #### [` authenticated_attributes `]() inline [it\_const\_attributes\_t]( "LIEF::PE::SignerInfo::it_const_attributes_t") authenticated\_attributes() const Iterator over [LIEF::PE::Attribute]() for **authenticated** attributes. #### [` unauthenticated_attributes `]() inline [it\_const\_attributes\_t]( "LIEF::PE::SignerInfo::it_const_attributes_t") unauthenticated\_attributes() const Iterator over [LIEF::PE::Attribute]() for **unauthenticated** attributes. #### [` get_attribute `]() const [Attribute]( "LIEF::PE::Attribute") \*get\_attribute([Attribute]( "LIEF::PE::Attribute")::[TYPE]( "LIEF::PE::Attribute::TYPE") type) const Return the authenticated or unauthenticated attribute matching the given PE::SIG\_ATTRIBUTE\_TYPES. It returns **the first** entry that matches the given type. If it can’t be found, it returns a nullptr. #### [` get_auth_attribute `]() const [Attribute]( "LIEF::PE::Attribute") \*get\_auth\_attribute([Attribute]( "LIEF::PE::Attribute")::[TYPE]( "LIEF::PE::Attribute::TYPE") type) const Return the authenticated attribute matching the given PE::SIG\_ATTRIBUTE\_TYPES. It returns **the first** entry that matches the given type. If it can’t be found, it returns a nullptr. #### [` get_unauth_attribute `]() const [Attribute]( "LIEF::PE::Attribute") \*get\_unauth\_attribute([Attribute]( "LIEF::PE::Attribute")::[TYPE]( "LIEF::PE::Attribute::TYPE") type) const Return the unauthenticated attribute matching the given PE::SIG\_ATTRIBUTE\_TYPES. It returns **the first** entry that matches the given type. If it can’t be found, it returns a nullptr. #### [` cert `]() inline const [x509]( "LIEF::PE::x509") \*cert() const [x509]() certificate used by this signer. If it can’t be found, it returns a nullptr #### [` cert `]() inline [x509]( "LIEF::PE::x509") \*cert() [x509]() certificate used by this signer. If it can’t be found, it returns a nullptr #### [` raw_auth_data `]() inline span<const uint8\_t> raw\_auth\_data() const Raw blob that is signed by the signer certificate. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~SignerInfo `]() ~SignerInfo() override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [SignerInfo]( "LIEF::PE::SignerInfo") &signer\_info) --- ## [MsCounterSign]() ### [` MsCounterSign `]() class MsCounterSign : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") This class exposes the MS Counter [Signature]() attribute. Public Types #### [` certificates_t `]() using certificates\_t = std::vector<[x509]( "LIEF::PE::x509")> #### [` it_const_certificates `]() using it\_const\_certificates = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [certificates\_t]( "LIEF::PE::MsCounterSign::certificates_t")&> #### [` it_certificates `]() using it\_certificates = [ref\_iterator]( "LIEF::ref_iterator")<[certificates\_t]( "LIEF::PE::MsCounterSign::certificates_t")&> #### [` signers_t `]() using signers\_t = std::vector<[SignerInfo]( "LIEF::PE::SignerInfo")> #### [` it_const_signers `]() using it\_const\_signers = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [signers\_t]( "LIEF::PE::MsCounterSign::signers_t")&> #### [` it_signers `]() using it\_signers = [ref\_iterator]( "LIEF::ref_iterator")<[signers\_t]( "LIEF::PE::MsCounterSign::signers_t")&> Public Functions #### [` MsCounterSign `]() inline MsCounterSign() #### [` MsCounterSign `]() MsCounterSign(const [MsCounterSign]( "LIEF::PE::MsCounterSign::MsCounterSign")&) = default #### [` operator= `]() [MsCounterSign]( "LIEF::PE::MsCounterSign") &operator=(const [MsCounterSign]( "LIEF::PE::MsCounterSign")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` version `]() inline uint32\_t version() const #### [` certificates `]() inline [it\_const\_certificates]( "LIEF::PE::MsCounterSign::it_const_certificates") certificates() const Iterator over the [LIEF::PE::x509]() certificates of this counter signature. #### [` certificates `]() inline [it\_certificates]( "LIEF::PE::MsCounterSign::it_certificates") certificates() #### [` signers `]() inline [it\_const\_signers]( "LIEF::PE::MsCounterSign::it_const_signers") signers() const Signer iterator (same as [LIEF::PE::SignerInfo]()). #### [` signers `]() inline [it\_signers]( "LIEF::PE::MsCounterSign::it_signers") signers() #### [` digest_algorithm `]() inline [ALGORITHMS]( "LIEF::PE::ALGORITHMS") digest\_algorithm() const #### [` content_info `]() inline const [ContentInfo]( "LIEF::PE::ContentInfo") &content\_info() const #### [` print `]() virtual std::string print() const override Print information about the underlying attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~MsCounterSign `]() ~MsCounterSign() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [PKCS9TSTInfo]() ### [` PKCS9TSTInfo `]() class PKCS9TSTInfo : public LIEF::PE::[ContentInfo]( "LIEF::PE::ContentInfo")::[Content]( "LIEF::PE::ContentInfo::Content") Interface over the structure described by the OID `1.2.840.113549.1.9.16.1.4` (PKCS #9). The internal structure is described in the [RFC #3161]() ```text TSTInfo ::= SEQUENCE { version INTEGER { v1(1) }, policy TSAPolicyId, messageImprint MessageImprint, serialNumber INTEGER, genTime GeneralizedTime, accuracy Accuracy OPTIONAL, ordering BOOLEAN DEFAULT FALSE, nonce INTEGER OPTIONAL, tsa [0] GeneralName OPTIONAL, extensions [1] IMPLICIT Extensions OPTIONAL } TSAPolicyId ::= OBJECT IDENTIFIER MessageImprint ::= SEQUENCE { hashAlgorithm AlgorithmIdentifier, hashedMessage OCTET STRING } Accuracy ::= SEQUENCE { seconds INTEGER OPTIONAL, millis [0] INTEGER (1..999) OPTIONAL, micros [1] INTEGER (1..999) OPTIONAL } ``` Public Functions #### [` PKCS9TSTInfo `]() inline PKCS9TSTInfo() #### [` PKCS9TSTInfo `]() PKCS9TSTInfo(const [PKCS9TSTInfo]( "LIEF::PE::PKCS9TSTInfo::PKCS9TSTInfo")&) = default #### [` operator= `]() [PKCS9TSTInfo]( "LIEF::PE::PKCS9TSTInfo") &operator=(const [PKCS9TSTInfo]( "LIEF::PE::PKCS9TSTInfo")&) = default #### [` clone `]() inline virtual std::unique\_ptr<Content> clone() const override #### [` print `]() inline virtual void print(std::ostream&) const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~PKCS9TSTInfo `]() ~PKCS9TSTInfo() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [ContentInfo]( "LIEF::PE::ContentInfo")::[Content]( "LIEF::PE::ContentInfo::Content") \*content) Public Static Attributes #### [` PKCS9_TSTINFO_OBJID `]() static auto PKCS9\_TSTINFO\_OBJID = "1.2.840.113549.1.9.16.1.4" --- ## [MsManifestBinaryID]() ### [` MsManifestBinaryID `]() class MsManifestBinaryID : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Interface over the structure described by the OID `1.3.6.1.4.1.311.10.3.28` (szOID\_PLATFORM\_MANIFEST\_BINARY\_ID). The internal structure is not documented but we can infer the following structure: ```text szOID_PLATFORM_MANIFEST_BINARY_ID ::= SET OF BinaryID ``` `BinaryID` being an alias of UTF8STRING Public Functions #### [` MsManifestBinaryID `]() MsManifestBinaryID() = delete #### [` MsManifestBinaryID `]() inline MsManifestBinaryID(std::string binid) #### [` MsManifestBinaryID `]() MsManifestBinaryID(const [MsManifestBinaryID]( "LIEF::PE::MsManifestBinaryID::MsManifestBinaryID")&) = default #### [` operator= `]() [MsManifestBinaryID]( "LIEF::PE::MsManifestBinaryID") &operator=(const [MsManifestBinaryID]( "LIEF::PE::MsManifestBinaryID")&) = default #### [` print `]() inline virtual std::string print() const override Print information about the attribute. #### [` manifest_id `]() inline std::string\_view manifest\_id() const The manifest id as a string. #### [` manifest_id `]() inline void manifest\_id(const std::string &id) #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~MsManifestBinaryID `]() ~MsManifestBinaryID() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [SpcRelaxedPeMarkerCheck]() ### [` SpcRelaxedPeMarkerCheck `]() class SpcRelaxedPeMarkerCheck : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") Public Functions #### [` SpcRelaxedPeMarkerCheck `]() inline SpcRelaxedPeMarkerCheck() #### [` SpcRelaxedPeMarkerCheck `]() inline SpcRelaxedPeMarkerCheck(uint32\_t value) #### [` SpcRelaxedPeMarkerCheck `]() SpcRelaxedPeMarkerCheck(const [SpcRelaxedPeMarkerCheck]( "LIEF::PE::SpcRelaxedPeMarkerCheck::SpcRelaxedPeMarkerCheck")&) = default #### [` operator= `]() [SpcRelaxedPeMarkerCheck]( "LIEF::PE::SpcRelaxedPeMarkerCheck") &operator=(const [SpcRelaxedPeMarkerCheck]( "LIEF::PE::SpcRelaxedPeMarkerCheck")&) = default #### [` value `]() inline uint32\_t value() const #### [` value `]() inline void value(uint32\_t v) #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` print `]() inline virtual std::string print() const override Print information about the underlying attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~SpcRelaxedPeMarkerCheck `]() ~SpcRelaxedPeMarkerCheck() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [SigningCertificateV2]() ### [` SigningCertificateV2 `]() class SigningCertificateV2 : public LIEF::PE::[Attribute]( "LIEF::PE::Attribute") [SigningCertificateV2]() ::= SEQUENCE { certs SEQUENCE OF ESSCertIDv2, policies SEQUENCE OF PolicyInformation OPTIONAL }. ESSCertIDv2 ::= SEQUENCE { hashAlgorithm AlgorithmIdentifier DEFAULT {algorithm id-sha256}, certHash OCTET STRING, issuerSerial IssuerSerial OPTIONAL } IssuerSerial ::= SEQUENCE { issuer GeneralNames, serialNumber CertificateSerialNumber } PolicyInformation ::= SEQUENCE { policyIdentifier OBJECT IDENTIFIER, policyQualifiers SEQUENCE SIZE (1..MAX) OF PolicyQualifierInfo OPTIONAL } Public Functions #### [` SigningCertificateV2 `]() inline SigningCertificateV2() #### [` SigningCertificateV2 `]() SigningCertificateV2(const [SigningCertificateV2]( "LIEF::PE::SigningCertificateV2::SigningCertificateV2")&) = default #### [` operator= `]() [SigningCertificateV2]( "LIEF::PE::SigningCertificateV2") &operator=(const [SigningCertificateV2]( "LIEF::PE::SigningCertificateV2")&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Attribute]( "LIEF::PE::Attribute")> clone() const override #### [` print `]() virtual std::string print() const override Print information about the underlying attribute. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~SigningCertificateV2 `]() ~SigningCertificateV2() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Attribute]( "LIEF::PE::Attribute") \*attr) --- ## [Builder]() ### [` Builder `]() class Builder Class that is used to rebuild a raw PE binary from a [PE::Binary]() object. Public Functions #### [` Builder `]() Builder() = delete #### [` Builder `]() inline Builder([Binary]( "LIEF::PE::Binary") &binary, [config\_t]( "LIEF::PE::Builder::config_t") config) #### [` ~Builder `]() ~Builder() #### [` build `]() [ok\_error\_t]( "LIEF::ok_error_t") build() Perform the build process. #### [` get_build `]() inline const std::vector<uint8\_t> &get\_build() Return the build result. #### [` write `]() void write(const std::string &filename) const Write the build result into the `output` file. #### [` write `]() void write(std::ostream &os) const Write the build result into the `os` stream. #### [` build `]() [ok\_error\_t]( "LIEF::ok_error_t") build(const [DosHeader]( "LIEF::PE::DosHeader") &dos\_header) #### [` build `]() [ok\_error\_t]( "LIEF::ok_error_t") build(const [Header]( "LIEF::PE::Header") &header) #### [` build `]() [ok\_error\_t]( "LIEF::ok_error_t") build(const [OptionalHeader]( "LIEF::PE::OptionalHeader") &optional\_header) #### [` build `]() [ok\_error\_t]( "LIEF::ok_error_t") build(const [DataDirectory]( "LIEF::PE::DataDirectory") &data\_directory) #### [` build `]() [ok\_error\_t]( "LIEF::ok_error_t") build(const [Section]( "LIEF::PE::Section") &section) #### [` build_overlay `]() [ok\_error\_t]( "LIEF::ok_error_t") build\_overlay() #### [` build_relocations `]() [ok\_error\_t]( "LIEF::ok_error_t") build\_relocations() #### [` build_resources `]() [ok\_error\_t]( "LIEF::ok_error_t") build\_resources() #### [` build_debug_info `]() [ok\_error\_t]( "LIEF::ok_error_t") build\_debug\_info() #### [` build_exports `]() [ok\_error\_t]( "LIEF::ok_error_t") build\_exports() #### [` PE_Tbuild_imports `]() template<typename PE\_T> [ok\_error\_t]( "LIEF::ok_error_t") build\_imports() #### [` PE_Tbuild_tls `]() template<typename PE\_T> [ok\_error\_t]( "LIEF::ok_error_t") build\_tls() #### [` PE_Tbuild_load_config `]() template<typename PE\_T> [ok\_error\_t]( "LIEF::ok_error_t") build\_load\_config() #### [` rsrc_data `]() inline const std::vector<uint8\_t> &rsrc\_data() const #### [` config_t `]() struct config\_t This structure is used to configure the build operation. The default value of these attributes is set to `false` if the operation modifies the binary layout even though nothing changed. For instance, building the import table **always** requires relocating the table to another place. Thus, the default value is false and must be explicitly set to true. Public Types ##### [` resolved_iat_cbk_t `]() using resolved\_iat\_cbk\_t = std::function<void([Binary]( "LIEF::PE::Binary")\*, const [Import]( "LIEF::PE::Import")\*, const [ImportEntry]( "LIEF::PE::ImportEntry")\*, uint32\_t)> Public Members ##### [` imports `]() bool imports = false Whether the builder should reconstruct the imports table. This option should be turned on if you modify imports. Please check LIEF website for more details ##### [` exports `]() bool exports = false Whether the builder should reconstruct the export table This option should be turned on if you modify exports. Please check LIEF website for more details ##### [` resources `]() bool resources = true Whether the builder should regenerate the resources tree. ##### [` relocations `]() bool relocations = true Whether the builder should regenerate relocations. ##### [` load_configuration `]() bool load\_configuration = true Whether the builder should regenerate the load config. ##### [` tls `]() bool tls = true Whether the builder should regenerate the [TLS]() info. ##### [` overlay `]() bool overlay = true Whether the builder should write back any overlay data. ##### [` debug `]() bool debug = true Whether the builder should regenerate debug entries. ##### [` dos_stub `]() bool dos\_stub = true Whether the builder should write back dos stub (including the rich header). ##### [` rsrc_section `]() std::string rsrc\_section = ".rsrc" If the resources tree needs to be relocated, this defines the name of the new section that contains the relocated tree. ##### [` idata_section `]() std::string idata\_section = ".idata" [Section]() that holds the relocated import table (IAT/ILT). ##### [` tls_section `]() std::string tls\_section = ".tls" [Section]() that holds the relocated [TLS]() info. ##### [` reloc_section `]() std::string reloc\_section = ".reloc" [Section]() that holds the relocated relocations. ##### [` export_section `]() std::string export\_section = ".edata" [Section]() that holds the export table. ##### [` debug_section `]() std::string debug\_section = ".debug" [Section]() that holds the debug entries. ##### [` resolved_iat_cbk `]() [resolved\_iat\_cbk\_t]( "LIEF::PE::Builder::config_t::resolved_iat_cbk_t") resolved\_iat\_cbk = nullptr --- ## [Resources Manager]() ### [` ResourcesManager `]() class ResourcesManager : public LIEF::Object The Resource Manager provides an enhanced API to manipulate the resource tree. Public Types #### [` TYPE `]() enum class TYPE The different types of resources From [https://learn.microsoft.com/en-us/windows/win32/menurc/resource-types](). *Values:* ##### [` CURSOR `]() enumerator CURSOR = 1 ##### [` BITMAP `]() enumerator BITMAP = 2 ##### [` ICON `]() enumerator ICON = 3 ##### [` MENU `]() enumerator MENU = 4 ##### [` DIALOG `]() enumerator DIALOG = 5 ##### [` STRING `]() enumerator STRING = 6 ##### [` FONTDIR `]() enumerator FONTDIR = 7 ##### [` FONT `]() enumerator FONT = 8 ##### [` ACCELERATOR `]() enumerator ACCELERATOR = 9 ##### [` RCDATA `]() enumerator RCDATA = 10 ##### [` MESSAGETABLE `]() enumerator MESSAGETABLE = 11 ##### [` GROUP_CURSOR `]() enumerator GROUP\_CURSOR = 12 ##### [` GROUP_ICON `]() enumerator GROUP\_ICON = 14 ##### [` VERSION `]() enumerator VERSION = 16 ##### [` DLGINCLUDE `]() enumerator DLGINCLUDE = 17 ##### [` PLUGPLAY `]() enumerator PLUGPLAY = 19 ##### [` VXD `]() enumerator VXD = 20 ##### [` ANICURSOR `]() enumerator ANICURSOR = 21 ##### [` ANIICON `]() enumerator ANIICON = 22 ##### [` HTML `]() enumerator HTML = 23 ##### [` MANIFEST `]() enumerator MANIFEST = 24 #### [` dialogs_t `]() using dialogs\_t = [ResourceDialog]( "LIEF::PE::ResourceDialog")::[dialogs\_t]( "LIEF::PE::ResourceDialog::dialogs_t") #### [` it_const_dialogs `]() using it\_const\_dialogs = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [dialogs\_t]( "LIEF::PE::ResourcesManager::dialogs_t")&, const [ResourceDialog]( "LIEF::PE::ResourceDialog")\*> #### [` icons_t `]() using icons\_t = std::vector<[ResourceIcon]( "LIEF::PE::ResourceIcon")> #### [` it_const_icons `]() using it\_const\_icons = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<[icons\_t]( "LIEF::PE::ResourcesManager::icons_t")> #### [` accelerators_t `]() using accelerators\_t = std::vector<[ResourceAccelerator]( "LIEF::PE::ResourceAccelerator")> #### [` it_const_accelerators `]() using it\_const\_accelerators = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<[accelerators\_t]( "LIEF::PE::ResourcesManager::accelerators_t")> #### [` strings_table_t `]() using strings\_table\_t = std::vector<[string\_entry\_t]( "LIEF::PE::ResourcesManager::string_entry_t")> Public Functions #### [` ResourcesManager `]() ResourcesManager() = delete #### [` ResourcesManager `]() inline ResourcesManager([ResourceNode]( "LIEF::PE::ResourceNode") &rsrc) #### [` ResourcesManager `]() inline ResourcesManager(const [ResourcesManager]( "LIEF::PE::ResourcesManager::ResourcesManager") &other) #### [` operator= `]() inline [ResourcesManager]( "LIEF::PE::ResourcesManager") &operator=(const [ResourcesManager]( "LIEF::PE::ResourcesManager") &other) #### [` ResourcesManager `]() ResourcesManager([ResourcesManager]( "LIEF::PE::ResourcesManager::ResourcesManager")&&) = default #### [` operator= `]() [ResourcesManager]( "LIEF::PE::ResourcesManager") &operator=([ResourcesManager]( "LIEF::PE::ResourcesManager")&&) = default #### [` ~ResourcesManager `]() ~ResourcesManager() override = default #### [` get_node_type `]() inline [ResourceNode]( "LIEF::PE::ResourceNode") \*get\_node\_type([TYPE]( "LIEF::PE::ResourcesManager::TYPE") type) Return the [ResourceNode]() associated with the given [TYPE]() or a nullptr if not found;. #### [` get_node_type `]() const [ResourceNode]( "LIEF::PE::ResourceNode") \*get\_node\_type([TYPE]( "LIEF::PE::ResourcesManager::TYPE") type) const #### [` get_types `]() std::vector<[TYPE]( "LIEF::PE::ResourcesManager::TYPE")> get\_types() const List of [TYPE]() present in the resources. #### [` has_type `]() inline bool has\_type([TYPE]( "LIEF::PE::ResourcesManager::TYPE") type) const `true` if the resource has the given [TYPE]() node #### [` has_manifest `]() inline bool has\_manifest() const `true` if resources contain the Manifest element #### [` manifest `]() std::string manifest() const Return the manifest as a std::string or an empty string if not found or corrupted. #### [` manifest `]() void manifest(const std::string &manifest) Change or set the manifest. If the manifest node path does not exist, all required nodes are created. #### [` has_version `]() inline bool has\_version() const `true` if resources contain a [LIEF::PE::ResourceVersion]() #### [` version `]() std::vector<[ResourceVersion]( "LIEF::PE::ResourceVersion")> version() const Return a list of version info (`VS_VERSIONINFO`). #### [` has_icons `]() inline bool has\_icons() const `true` if resources contain a [LIEF::PE::ResourceIcon]() #### [` icons `]() [it\_const\_icons]( "LIEF::PE::ResourcesManager::it_const_icons") icons() const Return the list of the icons present in the resources. #### [` add_icon `]() void add\_icon(const [ResourceIcon]( "LIEF::PE::ResourceIcon") &icon) Add an icon to the resources. #### [` change_icon `]() void change\_icon(const [ResourceIcon]( "LIEF::PE::ResourceIcon") &original, const [ResourceIcon]( "LIEF::PE::ResourceIcon") &newone) #### [` has_dialogs `]() inline bool has\_dialogs() const `true` if resources contain dialogs #### [` dialogs `]() [it\_const\_dialogs]( "LIEF::PE::ResourcesManager::it_const_dialogs") dialogs() const Return the list of the dialogs present in the resource. #### [` has_string_table `]() inline bool has\_string\_table() const `true` if the resources contain a string table #### [` string_table `]() [strings\_table\_t]( "LIEF::PE::ResourcesManager::strings_table_t") string\_table() const Return the list of the strings embedded in the string table (`RT_STRING`). #### [` has_html `]() inline bool has\_html() const `true` if the resources contain html #### [` html `]() std::vector<std::string> html() const Return the list of the html resources. #### [` has_accelerator `]() inline bool has\_accelerator() const `true` if the resources contain accelerator info #### [` accelerator `]() [it\_const\_accelerators]( "LIEF::PE::ResourcesManager::it_const_accelerators") accelerator() const Return the list of the accelerator in the resource. #### [` print `]() std::string print(uint32\_t depth = 0) const Print the resource tree to the given depth. #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ResourcesManager]( "LIEF::PE::ResourcesManager") &m) #### [` string_entry_t `]() struct string\_entry\_t This structure represent an entry in the string table (`RT_STRING`). Public Functions ##### [` string_u8 `]() std::string string\_u8() const ##### [` is_defined `]() inline bool is\_defined() const ##### [` operator bool `]() inline operator bool() const Public Members ##### [` string `]() std::u16string string ##### [` id `]() uint32\_t id = 0 Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [string\_entry\_t]( "LIEF::PE::ResourcesManager::string_entry_t") &str) --- ## [Resource Node]() ### [` ResourceNode `]() class ResourceNode : public LIEF::Object Class which represents a Node in the resource tree. Subclassed by [LIEF::PE::ResourceData](), [LIEF::PE::ResourceDirectory]() Public Types #### [` TYPE `]() enum class TYPE Enum that identifies the type of a node in the resource tree. *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` DATA `]() enumerator DATA ##### [` DIRECTORY `]() enumerator DIRECTORY #### [` childs_t `]() using childs\_t = std::vector<std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")>> #### [` it_childs `]() using it\_childs = [ref\_iterator]( "LIEF::ref_iterator")<[childs\_t]( "LIEF::PE::ResourceNode::childs_t")&, [ResourceNode]( "LIEF::PE::ResourceNode")\*> #### [` it_const_childs `]() using it\_const\_childs = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [childs\_t]( "LIEF::PE::ResourceNode::childs_t")&, [ResourceNode]( "LIEF::PE::ResourceNode")\*> Public Functions #### [` ResourceNode `]() ResourceNode(const [ResourceNode]( "LIEF::PE::ResourceNode::ResourceNode") &other) #### [` operator= `]() [ResourceNode]( "LIEF::PE::ResourceNode") &operator=(const [ResourceNode]( "LIEF::PE::ResourceNode") &other) #### [` ResourceNode `]() ResourceNode([ResourceNode]( "LIEF::PE::ResourceNode::ResourceNode") &&other) = default #### [` operator= `]() [ResourceNode]( "LIEF::PE::ResourceNode") &operator=([ResourceNode]( "LIEF::PE::ResourceNode") &&other) = default #### [` swap `]() void swap([ResourceNode]( "LIEF::PE::ResourceNode") &other) #### [` ~ResourceNode `]() ~ResourceNode() override #### [` clone `]() virtual std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> clone() const = 0 #### [` id `]() inline uint32\_t id() const Integer that identifies the Type, Name, or Language ID of the entry depending on its depth in the tree. #### [` name `]() inline const std::u16string &name() const Name of the entry (if any). #### [` utf8_name `]() std::string utf8\_name() const UTF-8 representation of the [name()](). #### [` childs `]() inline [it\_childs]( "LIEF::PE::ResourceNode::it_childs") childs() Iterator on node’s children. #### [` childs `]() inline [it\_const\_childs]( "LIEF::PE::ResourceNode::it_const_childs") childs() const #### [` has_name `]() inline bool has\_name() const `True` if the entry uses a name as ID #### [` depth `]() inline uint32\_t depth() const Current depth of the Node in the resource tree. #### [` is_directory `]() inline bool is\_directory() const `True` if the current entry is a [ResourceDirectory](). It can be safely cast with: ```cpp const auto* dir_node = node.cast(); ``` #### [` is_data `]() inline bool is\_data() const `True` if the current entry is a [ResourceData](). It can be safely cast with: ```cpp const auto* data_node = node.cast(); ``` #### [` id `]() inline void id(uint32\_t id) #### [` name `]() void name(const std::string &name) #### [` name `]() inline void name(std::u16string name) #### [` add_child `]() [ResourceNode]( "LIEF::PE::ResourceNode") &add\_child(std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> child) Add a new child to the current node, taking the ownership of the provided `unique_ptr`. #### [` add_child `]() inline [ResourceNode]( "LIEF::PE::ResourceNode") &add\_child(const [ResourceNode]( "LIEF::PE::ResourceNode") &child) Add a new child to the current node. #### [` delete_child `]() void delete\_child(uint32\_t id) Delete the node with the given `id`. #### [` delete_child `]() void delete\_child(const [ResourceNode]( "LIEF::PE::ResourceNode") &node) Delete the given node from the node’s children. #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` Tcast `]() template<class T> inline const [T]( "LIEF::PE::ResourceNode::cast::T") \*cast() const #### [` Tcast `]() template<class T> inline [T]( "LIEF::PE::ResourceNode::cast::T") \*cast() #### [` to_string `]() inline std::string to\_string() const #### [` push_child `]() inline void push\_child(std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> node) Public Static Functions #### [` parse `]() static std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> parse([BinaryStream]( "LIEF::BinaryStream") &stream, uint64\_t rva) Parse the resource tree from the provided [BinaryStream]() stream and with the original RVA provided in the second parameter. The RVA value should come from the [DataDirectory::RVA]() associated with the resource tree. #### [` parse `]() static std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> parse(const uint8\_t \*buffer, size\_t size, uint64\_t rva) Parse the resource tree from the provided buffer referenced by a pointer and the size. The second parameter is the RVA where the resource is (or was) located. #### [` parse `]() static inline std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> parse(const std::vector<uint8\_t> &buffer, uint64\_t rva) See doc from other parse functions. #### [` parse `]() static inline std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> parse(span<const uint8\_t> buffer, uint64\_t rva) See doc from other parse functions. #### [` parse `]() static std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> parse([BinaryStream]( "LIEF::BinaryStream") &stream, const [Binary]( "LIEF::PE::Binary") &bin) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ResourceNode]( "LIEF::PE::ResourceNode") &node) #### [` operator== `]() friend bool operator==(const [ResourceNode]( "LIEF::PE::ResourceNode") &LHS, const [ResourceNode]( "LIEF::PE::ResourceNode") &RHS) #### [` operator!= `]() inline friend bool operator!=(const [ResourceNode]( "LIEF::PE::ResourceNode") &LHS, const [ResourceNode]( "LIEF::PE::ResourceNode") &RHS) --- ## [Resource Directory]() ### [` ResourceDirectory `]() class ResourceDirectory : public LIEF::PE::[ResourceNode]( "LIEF::PE::ResourceNode") Public Functions #### [` ResourceDirectory `]() inline ResourceDirectory() #### [` ResourceDirectory `]() inline ResourceDirectory(uint32\_t id) #### [` ResourceDirectory `]() ResourceDirectory(const details::pe\_resource\_directory\_table &header) #### [` ResourceDirectory `]() ResourceDirectory(const [ResourceDirectory]( "LIEF::PE::ResourceDirectory::ResourceDirectory") &other) = default #### [` operator= `]() [ResourceDirectory]( "LIEF::PE::ResourceDirectory") &operator=(const [ResourceDirectory]( "LIEF::PE::ResourceDirectory") &other) = default #### [` swap `]() void swap([ResourceDirectory]( "LIEF::PE::ResourceDirectory") &other) noexcept #### [` ~ResourceDirectory `]() ~ResourceDirectory() override = default #### [` clone `]() inline virtual std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> clone() const override #### [` characteristics `]() inline uint32\_t characteristics() const Resource characteristics. This field is reserved for future use. It is currently set to zero. #### [` time_date_stamp `]() inline uint32\_t time\_date\_stamp() const The time that the resource data was created by the resource compiler. #### [` major_version `]() inline uint16\_t major\_version() const The major version number, set by the user. #### [` minor_version `]() inline uint16\_t minor\_version() const The minor version number, set by the user. #### [` numberof_name_entries `]() inline uint16\_t numberof\_name\_entries() const The number of directory entries immediately following the table that use strings to identify Type, Name, or Language entries (depending on the level of the table). #### [` numberof_id_entries `]() inline uint16\_t numberof\_id\_entries() const The number of directory entries immediately following the Name entries that use numeric IDs for Type, Name, or Language entries. #### [` characteristics `]() inline void characteristics(uint32\_t characteristics) #### [` time_date_stamp `]() inline void time\_date\_stamp(uint32\_t time\_date\_stamp) #### [` major_version `]() inline void major\_version(uint16\_t major\_version) #### [` minor_version `]() inline void minor\_version(uint16\_t minor\_version) #### [` numberof_name_entries `]() inline void numberof\_name\_entries(uint16\_t numberof\_name\_entries) #### [` numberof_id_entries `]() inline void numberof\_id\_entries(uint16\_t numberof\_id\_entries) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` classof `]() static inline bool classof(const [ResourceNode]( "LIEF::PE::ResourceNode") \*node) --- ## [Resource Data]() ### [` ResourceData `]() class ResourceData : public LIEF::PE::[ResourceNode]( "LIEF::PE::ResourceNode") Class which represents a Data Node in the PE resources tree. Public Functions #### [` ResourceData `]() inline ResourceData() #### [` ResourceData `]() inline ResourceData(std::vector<uint8\_t> content, uint32\_t code\_page = 0) #### [` ResourceData `]() inline ResourceData(const std::string &str, uint32\_t code\_page = 0) #### [` ResourceData `]() ResourceData(const [ResourceData]( "LIEF::PE::ResourceData::ResourceData") &other) = default #### [` operator= `]() [ResourceData]( "LIEF::PE::ResourceData") &operator=(const [ResourceData]( "LIEF::PE::ResourceData") &other) = default #### [` swap `]() void swap([ResourceData]( "LIEF::PE::ResourceData") &other) noexcept #### [` ~ResourceData `]() ~ResourceData() override = default #### [` clone `]() inline virtual std::unique\_ptr<[ResourceNode]( "LIEF::PE::ResourceNode")> clone() const override #### [` code_page `]() inline uint32\_t code\_page() const Return the code page that is used to decode code point values within the resource data. Typically, the code page is the unicode code page. #### [` content `]() inline span<const uint8\_t> content() const Resource content. #### [` content `]() inline span<uint8\_t> content() #### [` reserved `]() inline uint32\_t reserved() const Reserved value. Should be `0`. #### [` offset `]() inline uint32\_t offset() const Offset of the content within the resource. > **Warning** > > This value may change when rebuilding resource table #### [` code_page `]() inline void code\_page(uint32\_t code\_page) #### [` content `]() inline void content(std::vector<uint8\_t> content) #### [` content `]() inline void content(const std::string &string) #### [` content `]() inline void content(const uint8\_t \*buffer, size\_t size) #### [` reserved `]() inline void reserved(uint32\_t value) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` classof `]() static inline bool classof(const [ResourceNode]( "LIEF::PE::ResourceNode") \*node) --- ## [Resource Icon]() ### [` ResourceIcon `]() class ResourceIcon : public LIEF::Object Public Functions #### [` ResourceIcon `]() ResourceIcon() = default #### [` ResourceIcon `]() ResourceIcon(const details::pe\_resource\_icon\_group &header) #### [` ResourceIcon `]() ResourceIcon(const details::pe\_icon\_header &header) #### [` ResourceIcon `]() ResourceIcon(const [ResourceIcon]( "LIEF::PE::ResourceIcon::ResourceIcon")&) = default #### [` operator= `]() [ResourceIcon]( "LIEF::PE::ResourceIcon") &operator=(const [ResourceIcon]( "LIEF::PE::ResourceIcon")&) = default #### [` ResourceIcon `]() ResourceIcon([ResourceIcon]( "LIEF::PE::ResourceIcon::ResourceIcon")&&) = default #### [` operator= `]() [ResourceIcon]( "LIEF::PE::ResourceIcon") &operator=([ResourceIcon]( "LIEF::PE::ResourceIcon")&&) = default #### [` ~ResourceIcon `]() ~ResourceIcon() override = default #### [` id `]() inline uint32\_t id() const Id associated with the icon. #### [` lang `]() inline uint32\_t lang() const Language associated with the icon. #### [` sublang `]() inline uint32\_t sublang() const Sub language associated with the icon. #### [` width `]() inline uint8\_t width() const Width in pixels of the image. #### [` height `]() inline uint8\_t height() const Height in pixels of the image. #### [` color_count `]() inline uint8\_t color\_count() const Number of colors in image (0 if >=8bpp). #### [` reserved `]() inline uint8\_t reserved() const Reserved (must be 0). #### [` planes `]() inline uint16\_t planes() const Color Planes. #### [` bit_count `]() inline uint16\_t bit\_count() const Bits per pixel. #### [` size `]() inline uint32\_t size() const Size in bytes of the image. #### [` pixels `]() inline span<const uint8\_t> pixels() const Pixels of the image (as bytes). #### [` id `]() inline void id(uint32\_t id) #### [` lang `]() inline void lang(uint32\_t lang) #### [` sublang `]() inline void sublang(uint32\_t sublang) #### [` width `]() inline void width(uint8\_t width) #### [` height `]() inline void height(uint8\_t height) #### [` color_count `]() inline void color\_count(uint8\_t color\_count) #### [` reserved `]() inline void reserved(uint8\_t reserved) #### [` planes `]() inline void planes(uint16\_t planes) #### [` bit_count `]() inline void bit\_count(uint16\_t bit\_count) #### [` pixels `]() inline void pixels(std::vector<uint8\_t> pixels) #### [` save `]() void save(const std::string &filename) const Save the icon to the given filename. **Parameters:** **filename** – **[in]** Path to file in which the icon will be saved #### [` serialize `]() std::vector<uint8\_t> serialize() const #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` from_serialization `]() static [result]( "LIEF::result")<[ResourceIcon]( "LIEF::PE::ResourceIcon")> from\_serialization(const uint8\_t \*buffer, size\_t size) #### [` from_serialization `]() static inline [result]( "LIEF::result")<[ResourceIcon]( "LIEF::PE::ResourceIcon")> from\_serialization(const std::vector<uint8\_t> &bytes) #### [` from_bytes `]() static inline [result]( "LIEF::result")<[ResourceIcon]( "LIEF::PE::ResourceIcon")> from\_bytes(LIEF::span<const uint8\_t> bytes) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ResourceIcon]( "LIEF::PE::ResourceIcon") &entry) --- ## [Resource Dialog]() ### [` ResourceDialog `]() class ResourceDialog : public LIEF::Object This class is the base class for either a regular (legacy) Dialog or an extended Dialog. These different kinds of Dialogs are documented by MS at the following addresses: - [https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgtemplate]() - [https://learn.microsoft.com/fr-fr/windows/win32/dlgbox/dlgitemtemplateex]() Subclassed by [LIEF::PE::ResourceDialogExtended](), [LIEF::PE::ResourceDialogRegular]() Public Types #### [` TYPE `]() enum class TYPE Enum for discriminating the kind of the Dialog (regular vs extended). *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` REGULAR `]() enumerator REGULAR ##### [` EXTENDED `]() enumerator EXTENDED #### [` DIALOG_STYLES `]() enum class DIALOG\_STYLES : uint32\_t From: [https://learn.microsoft.com/en-us/windows/win32/dlgbox/dialog-box-styles](). *Values:* ##### [` ABSALIGN `]() enumerator ABSALIGN = 0x0001 ##### [` SYSMODAL `]() enumerator SYSMODAL = 0x0002 ##### [` LOCALEDIT `]() enumerator LOCALEDIT = 0x0020 ##### [` SETFONT `]() enumerator SETFONT = 0x0040 ##### [` MODALFRAME `]() enumerator MODALFRAME = 0x0080 ##### [` NOIDLEMSG `]() enumerator NOIDLEMSG = 0x0100 ##### [` SETFOREGROUND `]() enumerator SETFOREGROUND = 0x0200 ##### [` S3DLOOK `]() enumerator S3DLOOK = 0x0004 ##### [` FIXEDSYS `]() enumerator FIXEDSYS = 0x0008 ##### [` NOFAILCREATE `]() enumerator NOFAILCREATE = 0x0010 ##### [` CONTROL `]() enumerator CONTROL = 0x0400 ##### [` CENTER `]() enumerator CENTER = 0x0800 ##### [` CENTERMOUSE `]() enumerator CENTERMOUSE = 0x1000 ##### [` CONTEXTHELP `]() enumerator CONTEXTHELP = 0x2000 ##### [` SHELLFONT `]() enumerator SHELLFONT = [SETFONT]( "LIEF::PE::ResourceDialog::DIALOG_STYLES::SETFONT") | [FIXEDSYS]( "LIEF::PE::ResourceDialog::DIALOG_STYLES::FIXEDSYS") #### [` WINDOW_STYLES `]() enum class WINDOW\_STYLES : uint32\_t From: [https://docs.microsoft.com/en-us/windows/win32/winmsg/window-styles](). *Values:* ##### [` OVERLAPPED `]() enumerator OVERLAPPED = 0x00000000 ##### [` POPUP `]() enumerator POPUP = 0x80000000 ##### [` CHILD `]() enumerator CHILD = 0x40000000 ##### [` MINIMIZE `]() enumerator MINIMIZE = 0x20000000 ##### [` VISIBLE `]() enumerator VISIBLE = 0x10000000 ##### [` DISABLED `]() enumerator DISABLED = 0x08000000 ##### [` CLIPSIBLINGS `]() enumerator CLIPSIBLINGS = 0x04000000 ##### [` CLIPCHILDREN `]() enumerator CLIPCHILDREN = 0x02000000 ##### [` MAXIMIZE `]() enumerator MAXIMIZE = 0x01000000 ##### [` CAPTION `]() enumerator CAPTION = 0x00C00000 ##### [` BORDER `]() enumerator BORDER = 0x00800000 ##### [` DLGFRAME `]() enumerator DLGFRAME = 0x00400000 ##### [` VSCROLL `]() enumerator VSCROLL = 0x00200000 ##### [` HSCROLL `]() enumerator HSCROLL = 0x00100000 ##### [` SYSMENU `]() enumerator SYSMENU = 0x00080000 ##### [` THICKFRAME `]() enumerator THICKFRAME = 0x00040000 ##### [` GROUP `]() enumerator GROUP = 0x00020000 ##### [` TABSTOP `]() enumerator TABSTOP = 0x00010000 #### [` WINDOW_EXTENDED_STYLES `]() enum class WINDOW\_EXTENDED\_STYLES : uint32\_t From [https://docs.microsoft.com/en-us/windows/win32/winmsg/extended-window-styles](). *Values:* ##### [` DLGMODALFRAME `]() enumerator DLGMODALFRAME = 0x00000001 ##### [` NOPARENTNOTIFY `]() enumerator NOPARENTNOTIFY = 0x00000004 ##### [` TOPMOST `]() enumerator TOPMOST = 0x00000008 ##### [` ACCEPTFILES `]() enumerator ACCEPTFILES = 0x00000010 ##### [` TRANSPARENT_STY `]() enumerator TRANSPARENT\_STY = 0x00000020 ##### [` MDICHILD `]() enumerator MDICHILD = 0x00000040 ##### [` TOOLWINDOW `]() enumerator TOOLWINDOW = 0x00000080 ##### [` WINDOWEDGE `]() enumerator WINDOWEDGE = 0x00000100 ##### [` CLIENTEDGE `]() enumerator CLIENTEDGE = 0x00000200 ##### [` CONTEXTHELP `]() enumerator CONTEXTHELP = 0x00000400 ##### [` RIGHT `]() enumerator RIGHT = 0x00001000 ##### [` LEFT `]() enumerator LEFT = 0x00000000 ##### [` RTLREADING `]() enumerator RTLREADING = 0x00002000 ##### [` LEFTSCROLLBAR `]() enumerator LEFTSCROLLBAR = 0x00004000 ##### [` CONTROLPARENT `]() enumerator CONTROLPARENT = 0x00010000 ##### [` STATICEDGE `]() enumerator STATICEDGE = 0x00020000 ##### [` APPWINDOW `]() enumerator APPWINDOW = 0x00040000 #### [` CONTROL_STYLES `]() enum class CONTROL\_STYLES : uint32\_t From: [https://learn.microsoft.com/en-us/windows/win32/controls/common-control-styles](). *Values:* ##### [` TOP `]() enumerator TOP = 0x00000001 ##### [` NOMOVEY `]() enumerator NOMOVEY = 0x00000002 ##### [` BOTTOM `]() enumerator BOTTOM = 0x00000003 ##### [` NORESIZE `]() enumerator NORESIZE = 0x00000004 ##### [` NOPARENTALIGN `]() enumerator NOPARENTALIGN = 0x00000008 ##### [` ADJUSTABLE `]() enumerator ADJUSTABLE = 0x00000020 ##### [` NODIVIDER `]() enumerator NODIVIDER = 0x00000040 ##### [` VERT `]() enumerator VERT = 0x00000080 ##### [` LEFT `]() enumerator LEFT = [VERT]( "LIEF::PE::ResourceDialog::CONTROL_STYLES::VERT") | [TOP]( "LIEF::PE::ResourceDialog::CONTROL_STYLES::TOP") ##### [` RIGHT `]() enumerator RIGHT = [VERT]( "LIEF::PE::ResourceDialog::CONTROL_STYLES::VERT") | [BOTTOM]( "LIEF::PE::ResourceDialog::CONTROL_STYLES::BOTTOM") ##### [` NOMOVEX `]() enumerator NOMOVEX = [VERT]( "LIEF::PE::ResourceDialog::CONTROL_STYLES::VERT") | [NOMOVEY]( "LIEF::PE::ResourceDialog::CONTROL_STYLES::NOMOVEY") #### [` dialogs_t `]() using dialogs\_t = std::vector<std::unique\_ptr<[ResourceDialog]( "LIEF::PE::ResourceDialog")>> Public Functions #### [` ResourceDialog `]() ResourceDialog() = default #### [` ResourceDialog `]() ResourceDialog(const [ResourceDialog]( "LIEF::PE::ResourceDialog::ResourceDialog")&) = default #### [` operator= `]() [ResourceDialog]( "LIEF::PE::ResourceDialog") &operator=(const [ResourceDialog]( "LIEF::PE::ResourceDialog")&) = default #### [` ResourceDialog `]() ResourceDialog([ResourceDialog]( "LIEF::PE::ResourceDialog::ResourceDialog")&&) = default #### [` operator= `]() [ResourceDialog]( "LIEF::PE::ResourceDialog") &operator=([ResourceDialog]( "LIEF::PE::ResourceDialog")&&) = default #### [` ResourceDialog `]() inline ResourceDialog([TYPE]( "LIEF::PE::ResourceDialog::TYPE") ty) #### [` clone `]() virtual std::unique\_ptr<[ResourceDialog]( "LIEF::PE::ResourceDialog")> clone() const = 0 #### [` type `]() inline [TYPE]( "LIEF::PE::ResourceDialog::TYPE") type() const #### [` style `]() inline uint32\_t style() const The style of the dialog box. This member can be a combination of window style values (such as [WINDOW\_STYLES::CAPTION]() and [WINDOW\_STYLES::SYSMENU]()) and dialog box style values (such as [DIALOG\_STYLES::CENTER]()). #### [` extended_style `]() inline uint32\_t extended\_style() const The extended styles for a window. This member is not used to create dialog boxes, but applications that use dialog box templates can use it to create other types of windows. For a list of values, see [WINDOW\_EXTENDED\_STYLES](). #### [` x `]() inline int16\_t x() const The x-coordinate, in dialog box units, of the upper-left corner of the dialog box. #### [` y `]() inline int16\_t y() const The y-coordinate, in dialog box units, of the upper-left corner of the dialog box. #### [` cx `]() inline int16\_t cx() const The width, in dialog box units, of the dialog box. #### [` cy `]() inline int16\_t cy() const The height, in dialog box units, of the dialog box. #### [` style `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &style(uint32\_t value) #### [` extended_style `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &extended\_style(uint32\_t value) #### [` x `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &x(int16\_t value) #### [` y `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &y(int16\_t value) #### [` cx `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &cx(int16\_t value) #### [` cy `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &cy(int16\_t value) #### [` menu `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &menu(std::u16string title) #### [` menu `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &menu(uint16\_t ord) #### [` window_class `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &window\_class(std::u16string title) #### [` window_class `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &window\_class(uint16\_t ord) #### [` title `]() inline [ResourceDialog]( "LIEF::PE::ResourceDialog") &title(std::u16string value) #### [` title `]() [ResourceDialog]( "LIEF::PE::ResourceDialog") &title(const std::string &title) #### [` has `]() inline bool has([DIALOG\_STYLES]( "LIEF::PE::ResourceDialog::DIALOG_STYLES") style) const Check if the dialog uses the given dialog style. #### [` has `]() inline bool has([WINDOW\_STYLES]( "LIEF::PE::ResourceDialog::WINDOW_STYLES") style) const Check if the dialog uses the given window style. #### [` has `]() inline bool has([WINDOW\_EXTENDED\_STYLES]( "LIEF::PE::ResourceDialog::WINDOW_EXTENDED_STYLES") style) const Check if the dialog uses the given extended window style. #### [` styles_list `]() std::vector<[DIALOG\_STYLES]( "LIEF::PE::ResourceDialog::DIALOG_STYLES")> styles\_list() const List of [DIALOG\_STYLES]() used by this dialog. #### [` windows_styles_list `]() std::vector<[WINDOW\_STYLES]( "LIEF::PE::ResourceDialog::WINDOW_STYLES")> windows\_styles\_list() const List of [WINDOW\_STYLES]() used by this dialog. #### [` windows_ext_styles_list `]() std::vector<[WINDOW\_EXTENDED\_STYLES]( "LIEF::PE::ResourceDialog::WINDOW_EXTENDED_STYLES")> windows\_ext\_styles\_list() const List of [WINDOW\_EXTENDED\_STYLES]() used by this dialog. #### [` title `]() inline const std::u16string &title() const title of the dialog box #### [` title_utf8 `]() std::string title\_utf8() const title of the dialog box #### [` menu `]() inline const [ordinal\_or\_str\_t]( "LIEF::PE::ResourceDialog::ordinal_or_str_t") &menu() const ordinal or name value of a menu resource. #### [` window_class `]() inline const [ordinal\_or\_str\_t]( "LIEF::PE::ResourceDialog::ordinal_or_str_t") &window\_class() const ordinal of a predefined system window class or name of a registered window class #### [` to_string `]() virtual std::string to\_string() const = 0 #### [` ~ResourceDialog `]() ~ResourceDialog() override = default #### [` Tas `]() template<class T> inline const [T]( "LIEF::PE::ResourceDialog::as::T") \*as() const Helper to **downcast** a [ResourceDialog]() into a [ResourceDialogRegular]() or a [ResourceDialogExtended](). Public Static Functions #### [` parse `]() static [dialogs\_t]( "LIEF::PE::ResourceDialog::dialogs_t") parse(const [ResourceData]( "LIEF::PE::ResourceData") &node) Parse dialogs from the given resource data node. #### [` parse `]() static [dialogs\_t]( "LIEF::PE::ResourceDialog::dialogs_t") parse(const uint8\_t \*buffer, size\_t size) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [ResourceDialog]( "LIEF::PE::ResourceDialog") &dialog) #### [` ordinal_or_str_t `]() struct ordinal\_or\_str\_t This structure wraps either an ordinal value (`uint16_t`) or a string. The ordinal value should refer to an existing resource id in the resource tree. Public Functions ##### [` is_defined `]() inline bool is\_defined() const ##### [` operator bool `]() inline operator bool() const ##### [` to_string `]() std::string to\_string() const Public Members ##### [` ordinal `]() [result]( "LIEF::result")<uint16\_t> ordinal = make\_error\_code([lief\_errors]( "lief_errors")::[not\_found]( "lief_errors::not_found")) ##### [` string `]() std::u16string string #### [` Item `]() class Item This class represents an element of the dialog. It can be for instance, a button, or a caption. This class is inherited by the regular or extended dialog’s item: - [ResourceDialogRegular::Item]() - [ResourceDialogExtended::Item]() Subclassed by [LIEF::PE::ResourceDialogExtended::Item](), [LIEF::PE::ResourceDialogRegular::Item]() Public Types ##### [` WINDOW_CLASS `]() enum class WINDOW\_CLASS : uint32\_t *Values:* ###### [` BUTTON `]() enumerator BUTTON = 0x0080 ###### [` EDIT `]() enumerator EDIT = 0x0081 ###### [` STATIC `]() enumerator STATIC = 0x0082 ###### [` LIST_BOX `]() enumerator LIST\_BOX = 0x0083 ###### [` SCROLL_BAR `]() enumerator SCROLL\_BAR = 0x0084 ###### [` COMBO_BOX `]() enumerator COMBO\_BOX = 0x0085 Public Functions ##### [` Item `]() Item() = default ##### [` Item `]() Item(const [Item]( "LIEF::PE::ResourceDialog::Item::Item")&) = default ##### [` operator= `]() [Item]( "LIEF::PE::ResourceDialog::Item") &operator=(const [Item]( "LIEF::PE::ResourceDialog::Item")&) = default ##### [` Item `]() Item([Item]( "LIEF::PE::ResourceDialog::Item::Item")&&) = default ##### [` operator= `]() [Item]( "LIEF::PE::ResourceDialog::Item") &operator=([Item]( "LIEF::PE::ResourceDialog::Item")&&) = default ##### [` style `]() inline uint32\_t style() const The style of the control. This can be a combination of [WINDOW\_STYLES]() or [CONTROL\_STYLES](). ##### [` extended_style `]() inline uint32\_t extended\_style() const The extended styles for a window. This member is not used to create controls in dialog boxes, but applications that use dialog box templates can use it to create other types of windows. It can take a combination of [WINDOW\_EXTENDED\_STYLES]() ##### [` id `]() inline int32\_t id() const The control identifier. ##### [` has `]() inline bool has([WINDOW\_STYLES]( "LIEF::PE::ResourceDialog::WINDOW_STYLES") style) const Check if this item has the given [WINDOW\_STYLES](). ##### [` has `]() inline bool has([CONTROL\_STYLES]( "LIEF::PE::ResourceDialog::CONTROL_STYLES") style) const Check if this item has the given [CONTROL\_STYLES](). ##### [` window_styles `]() std::vector<[WINDOW\_STYLES]( "LIEF::PE::ResourceDialog::WINDOW_STYLES")> window\_styles() const List of [WINDOW\_STYLES]() used by this item. ##### [` control_styles `]() std::vector<[CONTROL\_STYLES]( "LIEF::PE::ResourceDialog::CONTROL_STYLES")> control\_styles() const List of [CONTROL\_STYLES]() used by this item. ##### [` x `]() inline int16\_t x() const The x-coordinate, in dialog box units, of the upper-left corner of the control. This coordinate is always relative to the upper-left corner of the dialog box’s client area. ##### [` y `]() inline int16\_t y() const The y-coordinate, in dialog box units, of the upper-left corner of the control. This coordinate is always relative to the upper-left corner of the dialog box’s client area. ##### [` cx `]() inline int16\_t cx() const The width, in dialog box units, of the control. ##### [` cy `]() inline int16\_t cy() const The height, in dialog box units, of the control. ##### [` style `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &style(uint32\_t value) ##### [` extended_style `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &extended\_style(uint32\_t value) ##### [` x `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &x(int16\_t value) ##### [` y `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &y(int16\_t value) ##### [` cx `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &cx(int16\_t value) ##### [` cy `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &cy(int16\_t value) ##### [` id `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &id(int32\_t value) ##### [` data `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &data(std::vector<uint8\_t> creation\_data) ##### [` clazz `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &clazz(std::u16string title) ##### [` clazz `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &clazz(uint16\_t ord) ##### [` title `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &title(std::u16string value) ##### [` title `]() inline [Item]( "LIEF::PE::ResourceDialog::Item") &title(uint16\_t ord) ##### [` clazz `]() inline const [ordinal\_or\_str\_t]( "LIEF::PE::ResourceDialog::ordinal_or_str_t") &clazz() const Window class of the control. This can be either: a string that specifies the name of a registered window class or an ordinal value of a predefined system class. ##### [` title `]() inline const [ordinal\_or\_str\_t]( "LIEF::PE::ResourceDialog::ordinal_or_str_t") &title() const Title of the item which can be either: a string that specifies the initial text or an ordinal value of a resource, such as an icon, in an executable file. ##### [` creation_data `]() inline span<const uint8\_t> creation\_data() const Creation data that is passed to the control’s window procedure. ##### [` creation_data `]() inline span<uint8\_t> creation\_data() ##### [` ~Item `]() virtual ~Item() = default ##### [` to_string `]() virtual std::string to\_string() const = 0 Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Item]( "LIEF::PE::ResourceDialog::Item") &item) --- ## [Resource Dialog – Regular]() ### [` ResourceDialogRegular `]() class ResourceDialogRegular : public LIEF::PE::[ResourceDialog]( "LIEF::PE::ResourceDialog") Implementation for a regular/legacy dialog box. See: [https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgtemplate]() Public Types #### [` items_t `]() using items\_t = std::vector<[Item]( "LIEF::PE::ResourceDialogRegular::Item")> #### [` it_items `]() using it\_items = [ref\_iterator]( "LIEF::ref_iterator")<[items\_t]( "LIEF::PE::ResourceDialogRegular::items_t")&> #### [` it_const_items `]() using it\_const\_items = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [items\_t]( "LIEF::PE::ResourceDialogRegular::items_t")&> Public Functions #### [` ResourceDialogRegular `]() inline ResourceDialogRegular() #### [` ResourceDialogRegular `]() ResourceDialogRegular(const [ResourceDialogRegular]( "LIEF::PE::ResourceDialogRegular::ResourceDialogRegular")&) = default #### [` operator= `]() [ResourceDialogRegular]( "LIEF::PE::ResourceDialogRegular") &operator=(const [ResourceDialogRegular]( "LIEF::PE::ResourceDialogRegular")&) = default #### [` ResourceDialogRegular `]() ResourceDialogRegular([ResourceDialogRegular]( "LIEF::PE::ResourceDialogRegular::ResourceDialogRegular")&&) = default #### [` operator= `]() [ResourceDialogRegular]( "LIEF::PE::ResourceDialogRegular") &operator=([ResourceDialogRegular]( "LIEF::PE::ResourceDialogRegular")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[ResourceDialog]( "LIEF::PE::ResourceDialog")> clone() const override #### [` to_string `]() virtual std::string to\_string() const override #### [` nb_items `]() inline uint32\_t nb\_items() const Number of control items. #### [` items `]() inline [it\_items]( "LIEF::PE::ResourceDialogRegular::it_items") items() Iterator over the different control items. #### [` items `]() inline [it\_const\_items]( "LIEF::PE::ResourceDialogRegular::it_const_items") items() const #### [` add_item `]() inline void add\_item(const [Item]( "LIEF::PE::ResourceDialogRegular::Item") &item) Add a new control item to the dialog. #### [` font `]() inline const [font\_t]( "LIEF::PE::ResourceDialogRegular::font_t") &font() const Additional font information. #### [` font `]() inline [ResourceDialogRegular]( "LIEF::PE::ResourceDialogRegular") &font(uint16\_t pointsize, std::u16string name) #### [` font `]() inline [ResourceDialogRegular]( "LIEF::PE::ResourceDialogRegular") &font([font\_t]( "LIEF::PE::ResourceDialogRegular::font_t") f) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` ~ResourceDialogRegular `]() ~ResourceDialogRegular() override = default Public Static Functions #### [` create `]() static std::unique\_ptr<[ResourceDialogRegular]( "LIEF::PE::ResourceDialogRegular")> create([BinaryStream]( "LIEF::BinaryStream") &stream) #### [` classof `]() static inline bool classof(const [ResourceDialog]( "LIEF::PE::ResourceDialog") \*dialog) #### [` Item `]() class Item : public LIEF::PE::[ResourceDialog]( "LIEF::PE::ResourceDialog")::[Item]( "LIEF::PE::ResourceDialog::Item") This class represents a `DLGTEMPLATE` item: `DLGITEMTEMPLATE`. See: [https://learn.microsoft.com/en-us/windows/win32/api/winuser/ns-winuser-dlgitemtemplate]() Public Functions ##### [` Item `]() Item() = default ##### [` Item `]() Item(const [Item]( "LIEF::PE::ResourceDialogRegular::Item::Item")&) = default ##### [` operator= `]() [Item]( "LIEF::PE::ResourceDialogRegular::Item") &operator=(const [Item]( "LIEF::PE::ResourceDialogRegular::Item")&) = default ##### [` Item `]() Item([Item]( "LIEF::PE::ResourceDialogRegular::Item::Item")&&) = default ##### [` operator= `]() [Item]( "LIEF::PE::ResourceDialogRegular::Item") &operator=([Item]( "LIEF::PE::ResourceDialogRegular::Item")&&) = default ##### [` to_string `]() virtual std::string to\_string() const override ##### [` ~Item `]() virtual ~Item() override = default Public Static Functions ##### [` parse `]() static [result]( "LIEF::result")<[Item]( "LIEF::PE::ResourceDialogRegular::Item")> parse([BinaryStream]( "LIEF::BinaryStream") &stream) #### [` font_t `]() struct font\_t This structure represents additional font information that might be embedded at the end of the DLGTEMPLATE stream. Public Functions ##### [` is_defined `]() inline bool is\_defined() const ##### [` operator bool `]() inline operator bool() const ##### [` to_string `]() std::string to\_string() const Public Members ##### [` point_size `]() uint16\_t point\_size = 0 ##### [` name `]() std::u16string name Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [font\_t]( "LIEF::PE::ResourceDialogRegular::font_t") &font) --- ## [Resource Dialog – Extended]() ### [` ResourceDialogExtended `]() class ResourceDialogExtended : public LIEF::PE::[ResourceDialog]( "LIEF::PE::ResourceDialog") Implementation for the new extended dialogbox format. See: [https://learn.microsoft.com/en-us/windows/win32/dlgbox/dlgtemplateex]() Public Types #### [` items_t `]() using items\_t = std::vector<[Item]( "LIEF::PE::ResourceDialogExtended::Item")> #### [` it_items `]() using it\_items = [ref\_iterator]( "LIEF::ref_iterator")<[items\_t]( "LIEF::PE::ResourceDialogExtended::items_t")&> #### [` it_const_items `]() using it\_const\_items = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [items\_t]( "LIEF::PE::ResourceDialogExtended::items_t")&> Public Functions #### [` ResourceDialogExtended `]() inline ResourceDialogExtended() #### [` ResourceDialogExtended `]() ResourceDialogExtended(const [ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended::ResourceDialogExtended")&) = default #### [` operator= `]() [ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended") &operator=(const [ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended")&) = default #### [` ResourceDialogExtended `]() ResourceDialogExtended([ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended::ResourceDialogExtended")&&) = default #### [` operator= `]() [ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended") &operator=([ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[ResourceDialog]( "LIEF::PE::ResourceDialog")> clone() const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` to_string `]() virtual std::string to\_string() const override #### [` ~ResourceDialogExtended `]() ~ResourceDialogExtended() override = default #### [` version `]() inline uint16\_t version() const The version number of the extended dialog box template. This member must be set to 1. #### [` signature `]() inline uint16\_t signature() const Indicates whether a template is an extended dialog box template. If signature is 0xFFFF, this is an extended dialog box template. In this case, the dlgVer member specifies the template version number. #### [` help_id `]() inline uint32\_t help\_id() const The help context identifier for the dialog box window. When the system sends a `WM_HELP` message, it passes the `helpID` value in the `dwContextId` member of the `HELPINFO` structure. #### [` items `]() inline [it\_items]( "LIEF::PE::ResourceDialogExtended::it_items") items() Iterator over the control items of this dialog box. #### [` items `]() inline [it\_const\_items]( "LIEF::PE::ResourceDialogExtended::it_const_items") items() const #### [` add_item `]() inline void add\_item(const [Item]( "LIEF::PE::ResourceDialogExtended::Item") &item) Add a new control item to the dialog. #### [` version `]() inline [ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended") &version(uint16\_t value) #### [` signature `]() inline [ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended") &signature(uint16\_t value) #### [` help_id `]() inline [ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended") &help\_id(uint32\_t value) #### [` font `]() inline const [font\_t]( "LIEF::PE::ResourceDialogExtended::font_t") &font() const Additional font information. #### [` font `]() inline [ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended") &font(uint16\_t point\_size, uint16\_t weight, bool italic, uint8\_t charset, std::u16string typeface) #### [` font `]() inline [ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended") &font([font\_t]( "LIEF::PE::ResourceDialogExtended::font_t") f) Public Static Functions #### [` create `]() static std::unique\_ptr<[ResourceDialogExtended]( "LIEF::PE::ResourceDialogExtended")> create([BinaryStream]( "LIEF::BinaryStream") &stream) #### [` classof `]() static inline bool classof(const [ResourceDialog]( "LIEF::PE::ResourceDialog") \*dialog) #### [` Item `]() class Item : public LIEF::PE::[ResourceDialog]( "LIEF::PE::ResourceDialog")::[Item]( "LIEF::PE::ResourceDialog::Item") This class represents a `DLGTEMPLATEEX` item (`DLGITEMTEMPLATEEX`). See: [https://learn.microsoft.com/en-us/windows/win32/dlgbox/dlgitemtemplateex]() Public Functions ##### [` Item `]() Item() = default ##### [` Item `]() Item(const [Item]( "LIEF::PE::ResourceDialogExtended::Item::Item")&) = default ##### [` operator= `]() [Item]( "LIEF::PE::ResourceDialogExtended::Item") &operator=(const [Item]( "LIEF::PE::ResourceDialogExtended::Item")&) = default ##### [` Item `]() Item([Item]( "LIEF::PE::ResourceDialogExtended::Item::Item")&&) = default ##### [` operator= `]() [Item]( "LIEF::PE::ResourceDialogExtended::Item") &operator=([Item]( "LIEF::PE::ResourceDialogExtended::Item")&&) = default ##### [` to_string `]() virtual std::string to\_string() const override ##### [` help_id `]() inline uint32\_t help\_id() const The help context identifier for the control. When the system sends a `WM_HELP` message, it passes the `helpID` value in the `dwContextId` member of the `HELPINFO` structure. ##### [` help_id `]() inline [Item]( "LIEF::PE::ResourceDialogExtended::Item") &help\_id(uint32\_t value) ##### [` ~Item `]() virtual ~Item() override = default Public Static Functions ##### [` parse `]() static [result]( "LIEF::result")<[Item]( "LIEF::PE::ResourceDialogExtended::Item")> parse([BinaryStream]( "LIEF::BinaryStream") &stream) #### [` font_t `]() struct font\_t Font information for the font to use for the text in the dialog box and its controls. Public Functions ##### [` is_defined `]() inline bool is\_defined() const ##### [` operator bool `]() inline operator bool() const ##### [` to_string `]() std::string to\_string() const Public Members ##### [` point_size `]() uint16\_t point\_size = 0 The point size of the font. ##### [` weight `]() uint16\_t weight = 0 The weight of the font. ##### [` italic `]() bool italic = false Indicates whether the font is italic. ##### [` charset `]() uint8\_t charset = false The character set to be used. ##### [` typeface `]() std::u16string typeface The name of the typeface for the font. Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [font\_t]( "LIEF::PE::ResourceDialogExtended::font_t") &font) --- ## [Resource Version]() ### [` ResourceVersion `]() class ResourceVersion : public LIEF::Object Representation of the data associated with the `RT_VERSION` entry. See: `VS_VERSIONINFO` at [https://learn.microsoft.com/en-us/windows/win32/menurc/vs-versioninfo]() Public Functions #### [` ResourceVersion `]() ResourceVersion(const [ResourceVersion]( "LIEF::PE::ResourceVersion::ResourceVersion")&) = default #### [` operator= `]() [ResourceVersion]( "LIEF::PE::ResourceVersion") &operator=(const [ResourceVersion]( "LIEF::PE::ResourceVersion")&) = default #### [` ResourceVersion `]() ResourceVersion([ResourceVersion]( "LIEF::PE::ResourceVersion::ResourceVersion")&&) = default #### [` operator= `]() [ResourceVersion]( "LIEF::PE::ResourceVersion") &operator=([ResourceVersion]( "LIEF::PE::ResourceVersion")&&) = default #### [` ~ResourceVersion `]() ~ResourceVersion() override = default #### [` file_info `]() inline const [fixed\_file\_info\_t]( "LIEF::PE::ResourceVersion::fixed_file_info_t") &file\_info() const Return the fixed file info (`VS_FIXEDFILEINFO`). #### [` file_info `]() inline [fixed\_file\_info\_t]( "LIEF::PE::ResourceVersion::fixed_file_info_t") &file\_info() #### [` string_file_info `]() inline [ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo") \*string\_file\_info() Return the `StringFileInfo` element. #### [` string_file_info `]() inline const [ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo") \*string\_file\_info() const #### [` var_file_info `]() inline [ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo") \*var\_file\_info() Return the `VarFileInfo` element. #### [` type `]() inline uint16\_t type() const The type of data in the version resource. - `1` if it contains text data - `0` if it contains binary data #### [` key `]() inline const std::u16string &key() const The Unicode string `L"VS_VERSION_INFO"`. #### [` key_u8 `]() std::string key\_u8() const The key as an utf8 string. #### [` type `]() inline [ResourceVersion]( "LIEF::PE::ResourceVersion") &type(uint16\_t value) #### [` key `]() inline [ResourceVersion]( "LIEF::PE::ResourceVersion") &key(std::u16string value) #### [` var_file_info `]() inline const [ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo") \*var\_file\_info() const #### [` var_file_info `]() inline [ResourceVersion]( "LIEF::PE::ResourceVersion") &var\_file\_info([ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo") info) #### [` string_file_info `]() inline [ResourceVersion]( "LIEF::PE::ResourceVersion") &string\_file\_info([ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo") info) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` parse `]() static [result]( "LIEF::result")<[ResourceVersion]( "LIEF::PE::ResourceVersion")> parse(const [ResourceData]( "LIEF::PE::ResourceData") &node) #### [` parse `]() static [result]( "LIEF::result")<[ResourceVersion]( "LIEF::PE::ResourceVersion")> parse(const uint8\_t \*p, size\_t sz) #### [` parse `]() static [result]( "LIEF::result")<[ResourceVersion]( "LIEF::PE::ResourceVersion")> parse([BinaryStream]( "LIEF::BinaryStream") &stream) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ResourceVersion]( "LIEF::PE::ResourceVersion") &version) #### [` fixed_file_info_t `]() struct fixed\_file\_info\_t This structure represents the `VS_FIXEDFILEINFO` structure defined in `verrsrc.h`. Public Types ##### [` VERSION_OS `]() enum class VERSION\_OS : uint32\_t *Values:* ###### [` UNKNOWN `]() enumerator UNKNOWN = 0x00000000 The operating system for which the file was designed is unknown to the system. ###### [` DOS `]() enumerator DOS = 0x00010000 The file was designed for MS-DOS. ###### [` OS216 `]() enumerator OS216 = 0x00020000 The file was designed for 16-bit OS/2. ###### [` OS232 `]() enumerator OS232 = 0x00030000 The file was designed for 32-bit OS/2. ###### [` NT `]() enumerator NT = 0x00040000 The file was designed for Windows NT. ###### [` WINCE `]() enumerator WINCE = 0x00050000 The file was designed for Windows CE (Windows Embedded Compact). ###### [` WINDOWS16 `]() enumerator WINDOWS16 = 0x00000001 The file was designed for 16-bit Windows. ###### [` PM16 `]() enumerator PM16 = 0x00000002 The file was designed for 16-bit Presentation Manager. ###### [` PM32 `]() enumerator PM32 = 0x00000003 The file was designed for 32-bit Presentation Manager. ###### [` WINDOWS32 `]() enumerator WINDOWS32 = 0x00000004 The file was designed for 32-bit Windows. ###### [` DOS_WINDOWS16 `]() enumerator DOS\_WINDOWS16 = [DOS]( "LIEF::PE::ResourceVersion::fixed_file_info_t::VERSION_OS::DOS") | [WINDOWS16]( "LIEF::PE::ResourceVersion::fixed_file_info_t::VERSION_OS::WINDOWS16") The file was designed for 16-bit Windows running on MS-DOS. ###### [` DOS_WINDOWS32 `]() enumerator DOS\_WINDOWS32 = [DOS]( "LIEF::PE::ResourceVersion::fixed_file_info_t::VERSION_OS::DOS") | [WINDOWS32]( "LIEF::PE::ResourceVersion::fixed_file_info_t::VERSION_OS::WINDOWS32") The file was designed for 32-bit Windows running on MS-DOS. ###### [` OS216_PM16 `]() enumerator OS216\_PM16 = [OS216]( "LIEF::PE::ResourceVersion::fixed_file_info_t::VERSION_OS::OS216") | [PM16]( "LIEF::PE::ResourceVersion::fixed_file_info_t::VERSION_OS::PM16") The file was designed for 16-bit Presentation Manager running on 16-bit OS/2. ###### [` OS232_PM32 `]() enumerator OS232\_PM32 = [OS232]( "LIEF::PE::ResourceVersion::fixed_file_info_t::VERSION_OS::OS232") | [PM32]( "LIEF::PE::ResourceVersion::fixed_file_info_t::VERSION_OS::PM32") The file was designed for 32-bit Presentation Manager running on 32-bit OS/2. ###### [` NT_WINDOWS32 `]() enumerator NT\_WINDOWS32 = [NT]( "LIEF::PE::ResourceVersion::fixed_file_info_t::VERSION_OS::NT") | [WINDOWS32]( "LIEF::PE::ResourceVersion::fixed_file_info_t::VERSION_OS::WINDOWS32") The file was designed for Windows NT. ##### [` FILE_TYPE `]() enum class FILE\_TYPE : uint32\_t *Values:* ###### [` UNKNOWN `]() enumerator UNKNOWN = 0x00000000 The file type is unknown to the system. ###### [` APP `]() enumerator APP = 0x00000001 The file contains an application. ###### [` DLL `]() enumerator DLL = 0x00000002 The file contains a DLL. ###### [` DRV `]() enumerator DRV = 0x00000003 The file contains a device driver. If dwFileType is VFT\_DRV, dwFileSubtype contains a more specific description of the driver. ###### [` FONT `]() enumerator FONT = 0x00000004 The file contains a font. If dwFileType is VFT\_FONT, dwFileSubtype contains a more specific description of the font file. ###### [` VXD `]() enumerator VXD = 0x00000005 The file contains a virtual device. ###### [` STATIC_LIB `]() enumerator STATIC\_LIB = 0x00000007 The file contains a static-link library. ##### [` FILE_TYPE_DETAILS `]() enum class FILE\_TYPE\_DETAILS : uint64\_t *Values:* ###### [` UNKNOWN `]() enumerator UNKNOWN = 0x00000000 The type is unknown by the system. ###### [` DRV_PRINTER `]() enumerator DRV\_PRINTER = 0x00000001 | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") The file contains a printer driver. ###### [` DRV_KEYBOARD `]() enumerator DRV\_KEYBOARD = 0x00000002 | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") The file contains a keyboard driver. ###### [` DRV_LANGUAGE `]() enumerator DRV\_LANGUAGE = 0x00000003 | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") The file contains a language driver. ###### [` DRV_DISPLAY `]() enumerator DRV\_DISPLAY = 0x00000004 | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") The file contains a display driver. ###### [` DRV_MOUSE `]() enumerator DRV\_MOUSE = 0x00000005 | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") The file contains a mouse driver. ###### [` DRV_NETWORK `]() enumerator DRV\_NETWORK = 0x00000006 | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") The file contains a network driver. ###### [` DRV_SYSTEM `]() enumerator DRV\_SYSTEM = 0x00000007 | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") The file contains a system driver. ###### [` DRV_INSTALLABLE `]() enumerator DRV\_INSTALLABLE = 0x00000008 | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") The file contains an installable driver. ###### [` DRV_SOUND `]() enumerator DRV\_SOUND = 0x00000009 | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") The file contains a sound driver. ###### [` DRV_COMM `]() enumerator DRV\_COMM = 0x0000000A | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") The file contains a communications driver. ###### [` DRV_INPUTMETHOD `]() enumerator DRV\_INPUTMETHOD = 0x0000000B | [DRV\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::DRV_K") ###### [` DRV_VERSIONED_PRINTER `]() enumerator DRV\_VERSIONED\_PRINTER = 0x0000000C The file contains a versioned printer driver. ###### [` FONT_RASTER `]() enumerator FONT\_RASTER = 0x00000001 | [FONT\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::FONT_K") The file contains a raster font. ###### [` FONT_VECTOR `]() enumerator FONT\_VECTOR = 0x00000002 | [FONT\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::FONT_K") The file contains a vector font. ###### [` FONT_TRUETYPE `]() enumerator FONT\_TRUETYPE = 0x00000003 | [FONT\_K]( "LIEF::PE::ResourceVersion::fixed_file_info_t::FONT_K") The file contains a TrueType font. ##### [` FILE_FLAGS `]() enum class FILE\_FLAGS : uint32\_t *Values:* ###### [` DEBUG `]() enumerator DEBUG = 0x00000001 The file contains debugging information or is compiled with debugging features enabled. ###### [` INFO_INFERRED `]() enumerator INFO\_INFERRED = 0x00000010 The file’s version structure was created dynamically; therefore, some of the members in this structure may be empty or incorrect. This flag should never be set in a file’s `VS_VERSIONINFO` data. ###### [` PATCHED `]() enumerator PATCHED = 0x00000004 The file has been modified and is not identical to the original shipping file of the same version number. ###### [` PRERELEASE `]() enumerator PRERELEASE = 0x00000002 The file is a development version, not a commercially released product. ###### [` PRIVATEBUILD `]() enumerator PRIVATEBUILD = 0x00000008 The file was not built using standard release procedures. If this flag is set, the StringFileInfo structure should contain a PrivateBuild entry. ###### [` SPECIALBUILD `]() enumerator SPECIALBUILD = 0x00000020 The file was built by the original company using standard release procedures but is a variation of the normal file of the same version number. If this flag is set, the StringFileInfo structure should contain a SpecialBuild entry. Public Functions ##### [` has `]() inline bool has([FILE\_FLAGS]( "LIEF::PE::ResourceVersion::fixed_file_info_t::FILE_FLAGS") f) const Check if the given [FILE\_FLAGS]() is present. ##### [` flags `]() std::vector<[FILE\_FLAGS]( "LIEF::PE::ResourceVersion::fixed_file_info_t::FILE_FLAGS")> flags() const List of [FILE\_FLAGS](). ##### [` file_type_details `]() inline [FILE\_TYPE\_DETAILS]( "LIEF::PE::ResourceVersion::fixed_file_info_t::FILE_TYPE_DETAILS") file\_type\_details() const ##### [` to_string `]() std::string to\_string() const Public Members ##### [` signature `]() uint32\_t signature = 0 Contains the value `0xFEEF04BD`. This is used with the `szKey` member of the `VS_VERSIONINFO` structure when searching a file for the `VS_FIXEDFILEINFO` structure. ##### [` struct_version `]() uint32\_t struct\_version = 0 The binary version number of this structure. The high-order word of this member contains the major version number, and the low-order word contains the minor version number. ##### [` file_version_ms `]() uint32\_t file\_version\_ms = 0 The most significant 32 bits of the file’s binary version number. This member is used with file\_version\_ls to form a 64-bit value used for numeric comparisons. ##### [` file_version_ls `]() uint32\_t file\_version\_ls = 0 The least significant 32 bits of the file’s binary version number. This member is used with file\_version\_ms to form a 64-bit value used for numeric comparisons. ##### [` product_version_ms `]() uint32\_t product\_version\_ms = 0 The most significant 32 bits of the binary version number of the product with which this file was distributed. This member is used with product\_version\_ls to form a 64-bit value used for numeric comparisons. ##### [` product_version_ls `]() uint32\_t product\_version\_ls = 0 The least significant 32 bits of the binary version number of the product with which this file was distributed. This member is used with product\_version\_ms to form a 64-bit value used for numeric comparisons. ##### [` file_flags_mask `]() uint32\_t file\_flags\_mask = 0 Contains a bitmask that specifies the valid bits in file\_flags. A bit is valid only if it was defined when the file was created. ##### [` file_flags `]() uint32\_t file\_flags = 0 Contains a bitmask that specifies the Boolean attributes of the file. This member can include one or more of the values specified in [FILE\_FLAGS](). ##### [` file_os `]() uint32\_t file\_os = 0 The operating system for which this file was designed. This member can be one of the values specified in [VERSION\_OS](). ##### [` file_type `]() uint32\_t file\_type = 0 The general type of file. This member can be one of the values specified in [FILE\_TYPE](). All other values are reserved. ##### [` file_subtype `]() uint32\_t file\_subtype = 0 The function of the file. The possible values depend on the value of file\_type. ##### [` file_date_ms `]() uint32\_t file\_date\_ms = 0 The most significant 32 bits of the file’s 64-bit binary creation date and time stamp. ##### [` file_date_ls `]() uint32\_t file\_date\_ls = 0 The least significant 32 bits of the file’s 64-bit binary creation date and time stamp. Public Static Attributes ##### [` DRV_K `]() static auto DRV\_K = uint64\_t(1) << 33 ##### [` FONT_K `]() static auto FONT\_K = uint64\_t(1) << 34 ##### [` SIGNATURE_VALUE `]() static auto SIGNATURE\_VALUE = 0xFEEF04BD Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [fixed\_file\_info\_t]( "LIEF::PE::ResourceVersion::fixed_file_info_t") &info) --- ## [Resource Var File Info]() ### [` ResourceVarFileInfo `]() class ResourceVarFileInfo : public LIEF::Object Representation of the `VarFileInfo` structure. This structure represents the organization of data in a file-version resource. It contains version information not dependent on a particular language and code page combination. See: [https://learn.microsoft.com/en-us/windows/win32/menurc/varfileinfo]() Public Types #### [` vars_t `]() using vars\_t = std::vector<[ResourceVar]( "LIEF::PE::ResourceVar")> #### [` it_vars `]() using it\_vars = [ref\_iterator]( "LIEF::ref_iterator")<[vars\_t]( "LIEF::PE::ResourceVarFileInfo::vars_t")&> #### [` it_const_vars `]() using it\_const\_vars = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [vars\_t]( "LIEF::PE::ResourceVarFileInfo::vars_t")&> Public Functions #### [` ResourceVarFileInfo `]() ResourceVarFileInfo() = default #### [` ResourceVarFileInfo `]() ResourceVarFileInfo(const [ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo::ResourceVarFileInfo")&) = default #### [` operator= `]() [ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo") &operator=(const [ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo")&) = default #### [` ResourceVarFileInfo `]() ResourceVarFileInfo([ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo::ResourceVarFileInfo")&&) = default #### [` operator= `]() [ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo") &operator=([ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo")&&) = default #### [` ~ResourceVarFileInfo `]() ~ResourceVarFileInfo() override = default #### [` type `]() inline uint16\_t type() const The type of data in the version resource. - `1` if it contains text data - `0` if it contains binary data #### [` key `]() inline const std::u16string &key() const [Signature]() of the structure. Must be the unicode string “VarFileInfo”. #### [` key_u8 `]() std::string key\_u8() const Key as an utf8 string. #### [` vars `]() inline [it\_vars]( "LIEF::PE::ResourceVarFileInfo::it_vars") vars() Iterator over the embedded variables associated to the structure. #### [` vars `]() inline [it\_const\_vars]( "LIEF::PE::ResourceVarFileInfo::it_const_vars") vars() const #### [` type `]() inline [ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo") &type(uint16\_t type) #### [` key `]() inline [ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo") &key(std::u16string key) #### [` add_var `]() inline void add\_var([ResourceVar]( "LIEF::PE::ResourceVar") var) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` parse `]() static [result]( "LIEF::result")<[ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo")> parse([BinaryStream]( "LIEF::BinaryStream") &stream) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ResourceVarFileInfo]( "LIEF::PE::ResourceVarFileInfo") &entry) --- ## [Resource Var]() ### [` ResourceVar `]() class ResourceVar This class represents an element of the [ResourceVarFileInfo]() structure It typically contains a list of language and code page identifier pairs that the version of the application or DLL supports. See: [https://learn.microsoft.com/en-us/windows/win32/menurc/var-str]() Public Types #### [` values_t `]() using values\_t = std::vector<uint32\_t> Translation values as a vector of `uint32_t`. Public Functions #### [` ResourceVar `]() ResourceVar() = default #### [` ResourceVar `]() ResourceVar(const [ResourceVar]( "LIEF::PE::ResourceVar::ResourceVar")&) = default #### [` operator= `]() [ResourceVar]( "LIEF::PE::ResourceVar") &operator=(const [ResourceVar]( "LIEF::PE::ResourceVar")&) = default #### [` ResourceVar `]() ResourceVar([ResourceVar]( "LIEF::PE::ResourceVar::ResourceVar")&&) = default #### [` operator= `]() [ResourceVar]( "LIEF::PE::ResourceVar") &operator=([ResourceVar]( "LIEF::PE::ResourceVar")&&) = default #### [` ~ResourceVar `]() ~ResourceVar() = default #### [` key `]() inline const std::u16string &key() const The Unicode string `L"Translation"`. #### [` type `]() inline uint16\_t type() const The type of data in the version resource: - `1` if it contains text data - `0` if it contains binary #### [` key_u8 `]() std::string key\_u8() const The key as an utf8 string. #### [` values `]() inline const [values\_t]( "LIEF::PE::ResourceVar::values_t") &values() const Return the translation values. The low-order word of each uint32\_t must contain a Microsoft language identifier, and the high-order word must contain the IBM code page number. Either high-order or low-order word can be zero, indicating that the file is language or code page independent #### [` values `]() inline [values\_t]( "LIEF::PE::ResourceVar::values_t") &values() #### [` key `]() inline [ResourceVar]( "LIEF::PE::ResourceVar") &key(std::u16string key) #### [` type `]() inline [ResourceVar]( "LIEF::PE::ResourceVar") &type(uint16\_t ty) #### [` add_value `]() inline void add\_value(uint32\_t val) Public Static Functions #### [` parse `]() static [result]( "LIEF::result")<[ResourceVar]( "LIEF::PE::ResourceVar")> parse([BinaryStream]( "LIEF::BinaryStream") &stream) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ResourceVar]( "LIEF::PE::ResourceVar") &entry) --- ## [Resource String File Info]() ### [` ResourceStringFileInfo `]() class ResourceStringFileInfo : public LIEF::Object Representation of the `StringFileInfo` structure. It contains version information that can be displayed for a particular language and code page. See: [https://learn.microsoft.com/en-us/windows/win32/menurc/stringfileinfo]() Public Types #### [` elements_t `]() using elements\_t = std::vector<[ResourceStringTable]( "LIEF::PE::ResourceStringTable")> #### [` it_const_elements `]() using it\_const\_elements = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [elements\_t]( "LIEF::PE::ResourceStringFileInfo::elements_t")&> #### [` it_elements `]() using it\_elements = [ref\_iterator]( "LIEF::ref_iterator")<[elements\_t]( "LIEF::PE::ResourceStringFileInfo::elements_t")&> Public Functions #### [` ResourceStringFileInfo `]() ResourceStringFileInfo() = default #### [` ResourceStringFileInfo `]() ResourceStringFileInfo(const [ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo::ResourceStringFileInfo")&) = default #### [` operator= `]() [ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo") &operator=(const [ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo")&) = default #### [` ResourceStringFileInfo `]() ResourceStringFileInfo([ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo::ResourceStringFileInfo")&&) = default #### [` operator= `]() [ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo") &operator=([ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo")&&) = default #### [` ~ResourceStringFileInfo `]() ~ResourceStringFileInfo() override = default #### [` type `]() inline uint16\_t type() const The type of data in the version resource. - `1` if it contains text data - `0` if it contains binary data #### [` key `]() inline const std::u16string &key() const [Signature]() of the structure. Must be the unicode string “StringFileInfo”. #### [` children `]() inline [it\_const\_elements]( "LIEF::PE::ResourceStringFileInfo::it_const_elements") children() const Iterator over the children values. #### [` children `]() inline [it\_elements]( "LIEF::PE::ResourceStringFileInfo::it_elements") children() #### [` key_u8 `]() std::string key\_u8() const The key as an utf8 string. #### [` type `]() inline [ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo") &type(uint16\_t type) #### [` key `]() inline [ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo") &key(std::u16string key) #### [` add_child `]() inline void add\_child([ResourceStringTable]( "LIEF::PE::ResourceStringTable") table) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` parse `]() static [result]( "LIEF::result")<[ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo")> parse([BinaryStream]( "LIEF::BinaryStream") &stream) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ResourceStringFileInfo]( "LIEF::PE::ResourceStringFileInfo") &info) --- ## [Resource String Table]() ### [` ResourceStringTable `]() class ResourceStringTable : public LIEF::Object This class represents the `StringTable` structure. This structure can be seen as a dictionary of key-value pairs with keys and values defined as UTF-16 strings. Public Types #### [` entries_t `]() using entries\_t = std::vector<[entry\_t]( "LIEF::PE::ResourceStringTable::entry_t")> #### [` it_entries `]() using it\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[entries\_t]( "LIEF::PE::ResourceStringTable::entries_t")&> #### [` it_const_entries `]() using it\_const\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [entries\_t]( "LIEF::PE::ResourceStringTable::entries_t")&> Public Functions #### [` ResourceStringTable `]() ResourceStringTable() = default #### [` ResourceStringTable `]() ResourceStringTable(const [ResourceStringTable]( "LIEF::PE::ResourceStringTable::ResourceStringTable")&) = default #### [` operator= `]() [ResourceStringTable]( "LIEF::PE::ResourceStringTable") &operator=(const [ResourceStringTable]( "LIEF::PE::ResourceStringTable")&) = default #### [` ResourceStringTable `]() ResourceStringTable([ResourceStringTable]( "LIEF::PE::ResourceStringTable::ResourceStringTable")&&) = default #### [` operator= `]() [ResourceStringTable]( "LIEF::PE::ResourceStringTable") &operator=([ResourceStringTable]( "LIEF::PE::ResourceStringTable")&&) = default #### [` ~ResourceStringTable `]() ~ResourceStringTable() override = default #### [` key `]() inline const std::u16string &key() const An 8-digit hexadecimal number stored as a Unicode string. The four most significant digits represent the language identifier. The four least significant digits represent the code page for which the data is formatted. Each Microsoft Standard Language identifier contains two parts: the low-order 10 bits specify the major language, and the high-order 6 bits specify the sublanguage. #### [` type `]() inline uint16\_t type() const The type of data in the version resource: - `1` if it contains text data - `0` if it contains binary #### [` key_u8 `]() std::string key\_u8() const The key as an utf8 string. #### [` entries `]() inline [it\_entries]( "LIEF::PE::ResourceStringTable::it_entries") entries() Iterator over the different [entry\_t]() element of this table. #### [` entries `]() inline [it\_const\_entries]( "LIEF::PE::ResourceStringTable::it_const_entries") entries() const #### [` get `]() inline std::optional<std::u16string> get(const std::u16string &key) const #### [` get `]() std::optional<std::string> get(const std::string &key) const #### [` key `]() inline [ResourceStringTable]( "LIEF::PE::ResourceStringTable") &key(std::u16string value) #### [` type `]() inline [ResourceStringTable]( "LIEF::PE::ResourceStringTable") &type(uint16\_t value) #### [` add_entry `]() inline void add\_entry([entry\_t]( "LIEF::PE::ResourceStringTable::entry_t") entry) #### [` add_entry `]() inline void add\_entry(std::u16string key, std::u16string value) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` operator[] `]() inline std::optional<std::string> operator[](const std::string &str) const #### [` operator[] `]() inline std::optional<std::u16string> operator[](const std::u16string &str) const Public Static Functions #### [` parse `]() static [result]( "LIEF::result")<[ResourceStringTable]( "LIEF::PE::ResourceStringTable")> parse([BinaryStream]( "LIEF::BinaryStream") &stream) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ResourceStringTable]( "LIEF::PE::ResourceStringTable") &table) #### [` entry_t `]() struct entry\_t An entry in this table which is composed of an UTF-16 key and an UTF-16 value. Public Functions ##### [` key_u8 `]() std::string key\_u8() const Key in utf8 representation. ##### [` value_u8 `]() std::string value\_u8() const Value in utf8 representation. ##### [` is_defined `]() inline bool is\_defined() const ##### [` operator bool `]() inline operator bool() const ##### [` to_string `]() inline std::string to\_string() const Public Members ##### [` key `]() std::u16string key ##### [` value `]() std::u16string value Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [entry\_t]( "LIEF::PE::ResourceStringTable::entry_t") &entry) --- ## [Resource Accelerator]() ### [` ResourceAccelerator `]() class ResourceAccelerator : public LIEF::Object Public Types #### [` FLAGS `]() enum class FLAGS : uint32\_t From: [https://docs.microsoft.com/en-us/windows/win32/menurc/acceltableentry](). *Values:* ##### [` VIRTKEY `]() enumerator VIRTKEY = 0x01 The accelerator key is a virtual-key code. If this flag is not specified, the accelerator key is assumed to specify an ASCII character code. ##### [` NOINVERT `]() enumerator NOINVERT = 0x02 A menu item on the menu bar is not highlighted when an accelerator is used. This attribute is obsolete and retained only for backward compatibility with resource files designed for 16-bit Windows. ##### [` SHIFT `]() enumerator SHIFT = 0x04 The accelerator is activated only if the user presses the SHIFT key. This flag applies only to virtual keys. ##### [` CONTROL `]() enumerator CONTROL = 0x08 The accelerator is activated only if the user presses the CTRL key. This flag applies only to virtual keys. ##### [` ALT `]() enumerator ALT = 0x10 The accelerator is activated only if the user presses the ALT key. This flag applies only to virtual keys. ##### [` END `]() enumerator END = 0x80 The entry is last in an accelerator table. Public Functions #### [` ResourceAccelerator `]() ResourceAccelerator() = default #### [` ResourceAccelerator `]() explicit ResourceAccelerator(const details::pe\_resource\_acceltableentry&) #### [` ResourceAccelerator `]() ResourceAccelerator(const [ResourceAccelerator]( "LIEF::PE::ResourceAccelerator::ResourceAccelerator")&) = default #### [` operator= `]() [ResourceAccelerator]( "LIEF::PE::ResourceAccelerator") &operator=(const [ResourceAccelerator]( "LIEF::PE::ResourceAccelerator")&) = default #### [` ResourceAccelerator `]() ResourceAccelerator([ResourceAccelerator]( "LIEF::PE::ResourceAccelerator::ResourceAccelerator")&&) = default #### [` operator= `]() [ResourceAccelerator]( "LIEF::PE::ResourceAccelerator") &operator=([ResourceAccelerator]( "LIEF::PE::ResourceAccelerator")&&) = default #### [` ~ResourceAccelerator `]() ~ResourceAccelerator() override = default #### [` flags_list `]() std::vector<[FLAGS]( "LIEF::PE::ResourceAccelerator::FLAGS")> flags\_list() const #### [` ansi_str `]() inline const char \*ansi\_str() const #### [` flags `]() inline int16\_t flags() const Describe the keyboard accelerator characteristics. #### [` ansi `]() inline int16\_t ansi() const An ANSI character value or a virtual-key code that identifies the accelerator key. #### [` id `]() inline uint16\_t id() const An identifier for the keyboard accelerator. #### [` padding `]() inline int16\_t padding() const The number of bytes inserted to ensure that the structure is aligned on a DWORD boundary. #### [` has `]() inline bool has([FLAGS]( "LIEF::PE::ResourceAccelerator::FLAGS") flag) const Whether the entry has the given flag. #### [` add `]() inline [ResourceAccelerator]( "LIEF::PE::ResourceAccelerator") &add([FLAGS]( "LIEF::PE::ResourceAccelerator::FLAGS") flag) #### [` remove `]() inline [ResourceAccelerator]( "LIEF::PE::ResourceAccelerator") &remove([FLAGS]( "LIEF::PE::ResourceAccelerator::FLAGS") flag) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [ResourceAccelerator]( "LIEF::PE::ResourceAccelerator") &acc) --- ## [Rich Header]() ### [` RichHeader `]() class RichHeader : public LIEF::Object Class which represents the not-so-documented rich header. This structure is usually located at the end of the [Binary::dos\_stub]() and contains information about the build environment. It is generated by the Microsoft linker `link.exe` and there are no options to disable or remove this information. Public Types #### [` entries_t `]() using entries\_t = std::vector<[RichEntry]( "LIEF::PE::RichEntry")> #### [` it_entries `]() using it\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[entries\_t]( "LIEF::PE::RichHeader::entries_t")&> #### [` it_const_entries `]() using it\_const\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [entries\_t]( "LIEF::PE::RichHeader::entries_t")&> Public Functions #### [` RichHeader `]() RichHeader() = default #### [` RichHeader `]() RichHeader(const [RichHeader]( "LIEF::PE::RichHeader::RichHeader")&) = default #### [` operator= `]() [RichHeader]( "LIEF::PE::RichHeader") &operator=(const [RichHeader]( "LIEF::PE::RichHeader")&) = default #### [` ~RichHeader `]() ~RichHeader() override = default #### [` key `]() inline uint32\_t key() const Key used to encode the header (xor operation). #### [` entries `]() inline [it\_entries]( "LIEF::PE::RichHeader::it_entries") entries() Return an iterator over the [PE::RichEntry]() within the header. #### [` entries `]() inline [it\_const\_entries]( "LIEF::PE::RichHeader::it_const_entries") entries() const #### [` key `]() inline void key(uint32\_t key) #### [` add_entry `]() inline void add\_entry([RichEntry]( "LIEF::PE::RichEntry") entry) Add a new [PE::RichEntry](). #### [` add_entry `]() inline void add\_entry(uint16\_t id, uint16\_t build\_id, uint32\_t count) Add a new entry given the id, build\_id and count. #### [` raw `]() inline std::vector<uint8\_t> raw() const The raw structure of the Rich header without xor-encoding. This function is equivalent as calling RichHeader::raw(uint32\_t) with a `xor_key` set to 0 #### [` raw `]() std::vector<uint8\_t> raw(uint32\_t xor\_key) const Given this rich header, this function re-computes the raw bytes of the structure with the provided xor-key. You can access the decoded data’s structure with the `xor_key` set to 0 **Parameters:** **xor\_key** – **[in]** The key to use for the xor-encoding (can be 0) #### [` hash `]() inline std::vector<uint8\_t> hash([ALGORITHMS]( "LIEF::PE::ALGORITHMS") algo) const Compute the hash of the decoded rich header structure with the given hash algorithm. #### [` hash `]() std::vector<uint8\_t> hash([ALGORITHMS]( "LIEF::PE::ALGORITHMS") algo, uint32\_t xor\_key) const Compute the hash of the rich header structure encoded with the provided key. #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Attributes #### [` RICH_MAGIC `]() static uint8\_t RICH\_MAGIC[] = {'R', 'i', 'c', 'h'} #### [` RICH_MAGIC_INT `]() static uint32\_t RICH\_MAGIC\_INT = 0x68636952 #### [` DANS_MAGIC_NUMBER `]() static uint32\_t DANS\_MAGIC\_NUMBER = 0x536E6144 Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [RichHeader]( "LIEF::PE::RichHeader") &rich\_header) --- ## [Rich Entry]() ### [` RichEntry `]() class RichEntry : public LIEF::Object Class which represents an entry associated to the [RichHeader](). Public Functions #### [` RichEntry `]() RichEntry() = default #### [` RichEntry `]() inline RichEntry(uint16\_t id, uint16\_t build\_id, uint32\_t count) #### [` RichEntry `]() RichEntry(const [RichEntry]( "LIEF::PE::RichEntry::RichEntry")&) = default #### [` operator= `]() [RichEntry]( "LIEF::PE::RichEntry") &operator=(const [RichEntry]( "LIEF::PE::RichEntry")&) = default #### [` ~RichEntry `]() ~RichEntry() override = default #### [` id `]() inline uint16\_t id() const Entry type. #### [` build_id `]() inline uint16\_t build\_id() const Build number of the tool (if any). #### [` count `]() inline uint32\_t count() const *Occurrence* count. #### [` id `]() inline void id(uint16\_t id) #### [` build_id `]() inline void build\_id(uint16\_t build\_id) #### [` count `]() inline void count(uint32\_t count) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [RichEntry]( "LIEF::PE::RichEntry") &rich\_entry) --- ## [Code Integrity]() ### [` CodeIntegrity `]() class CodeIntegrity : public LIEF::Object Public Functions #### [` CodeIntegrity `]() CodeIntegrity() = default #### [` ~CodeIntegrity `]() ~CodeIntegrity() override = default #### [` operator= `]() [CodeIntegrity]( "LIEF::PE::CodeIntegrity") &operator=(const [CodeIntegrity]( "LIEF::PE::CodeIntegrity")&) = default #### [` CodeIntegrity `]() CodeIntegrity(const [CodeIntegrity]( "LIEF::PE::CodeIntegrity::CodeIntegrity")&) = default #### [` operator= `]() [CodeIntegrity]( "LIEF::PE::CodeIntegrity") &operator=([CodeIntegrity]( "LIEF::PE::CodeIntegrity")&&) = default #### [` CodeIntegrity `]() CodeIntegrity([CodeIntegrity]( "LIEF::PE::CodeIntegrity::CodeIntegrity")&&) = default #### [` flags `]() inline uint16\_t flags() const Flags to indicate if CI information is available, etc. #### [` catalog `]() inline uint16\_t catalog() const 0xFFFF means not available #### [` catalog_offset `]() inline uint32\_t catalog\_offset() const #### [` reserved `]() inline uint32\_t reserved() const Additional bitmask to be defined later. #### [` flags `]() inline [CodeIntegrity]( "LIEF::PE::CodeIntegrity") &flags(uint16\_t flags) #### [` catalog `]() inline [CodeIntegrity]( "LIEF::PE::CodeIntegrity") &catalog(uint16\_t catalog) #### [` catalog_offset `]() inline [CodeIntegrity]( "LIEF::PE::CodeIntegrity") &catalog\_offset(uint32\_t catalog\_offset) #### [` reserved `]() inline [CodeIntegrity]( "LIEF::PE::CodeIntegrity") &reserved(uint32\_t reserved) #### [` accept `]() virtual void accept(Visitor &visitor) const override Public Static Functions #### [` parse `]() static [result]( "LIEF::result")<[CodeIntegrity]( "LIEF::PE::CodeIntegrity")> parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &stream) Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [CodeIntegrity]( "LIEF::PE::CodeIntegrity") &entry) --- ## [Pogo]() ### [` Pogo `]() class Pogo : public LIEF::PE::[Debug]( "LIEF::PE::Debug") This class represents a *Profile Guided Optimization* entry from the debug directory (`IMAGE_DEBUG_TYPE_POGO`). Public Types #### [` SIGNATURES `]() enum class SIGNATURES *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0x0fffffff ##### [` ZERO `]() enumerator ZERO = 0x00000000 ##### [` LCTG `]() enumerator LCTG = 0x4C544347 ##### [` PGI `]() enumerator PGI = 0x50474900 ##### [` PGO `]() enumerator PGO = 0x50474F00 ##### [` PGU `]() enumerator PGU = 0x50475500 ##### [` SPGO `]() enumerator SPGO = 0x5350474f #### [` entries_t `]() using entries\_t = std::vector<[PogoEntry]( "LIEF::PE::PogoEntry")> #### [` it_entries `]() using it\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[entries\_t]( "LIEF::PE::Pogo::entries_t")&> #### [` it_const_entries `]() using it\_const\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [entries\_t]( "LIEF::PE::Pogo::entries_t")&> Public Functions #### [` Pogo `]() inline Pogo() #### [` Pogo `]() inline Pogo([SIGNATURES]( "LIEF::PE::Pogo::SIGNATURES") sig) #### [` Pogo `]() inline Pogo(const details::pe\_debug &debug, [SIGNATURES]( "LIEF::PE::Pogo::SIGNATURES") sig, [Section]( "LIEF::PE::Section") \*sec) #### [` Pogo `]() Pogo(const [Pogo]( "LIEF::PE::Pogo::Pogo")&) = default #### [` operator= `]() [Pogo]( "LIEF::PE::Pogo") &operator=(const [Pogo]( "LIEF::PE::Pogo")&) = default #### [` Pogo `]() Pogo([Pogo]( "LIEF::PE::Pogo::Pogo")&&) = default #### [` operator= `]() [Pogo]( "LIEF::PE::Pogo") &operator=([Pogo]( "LIEF::PE::Pogo")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[Debug]( "LIEF::PE::Debug")> clone() const override #### [` signature `]() inline [SIGNATURES]( "LIEF::PE::Pogo::SIGNATURES") signature() const #### [` entries `]() inline [it\_entries]( "LIEF::PE::Pogo::it_entries") entries() An iterator over the different POGO elements. #### [` entries `]() inline [it\_const\_entries]( "LIEF::PE::Pogo::it_const_entries") entries() const #### [` add `]() inline void add([PogoEntry]( "LIEF::PE::PogoEntry") entry) #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` to_string `]() virtual std::string to\_string() const override #### [` ~Pogo `]() ~Pogo() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Debug]( "LIEF::PE::Debug") \*debug) --- ## [Pogo Entry]() ### [` PogoEntry `]() class PogoEntry : public LIEF::Object Public Functions #### [` PogoEntry `]() PogoEntry() = default #### [` PogoEntry `]() PogoEntry([PogoEntry]( "LIEF::PE::PogoEntry::PogoEntry") &&other) = default #### [` operator= `]() [PogoEntry]( "LIEF::PE::PogoEntry") &operator=([PogoEntry]( "LIEF::PE::PogoEntry") &&other) = default #### [` PogoEntry `]() PogoEntry(const [PogoEntry]( "LIEF::PE::PogoEntry::PogoEntry")&) = default #### [` PogoEntry `]() inline PogoEntry(uint32\_t start\_rva, uint32\_t size, std::string name) #### [` PogoEntry `]() inline PogoEntry(uint32\_t start\_rva, uint32\_t size) #### [` operator= `]() [PogoEntry]( "LIEF::PE::PogoEntry") &operator=(const [PogoEntry]( "LIEF::PE::PogoEntry")&) = default #### [` ~PogoEntry `]() ~PogoEntry() override = default #### [` start_rva `]() inline uint32\_t start\_rva() const #### [` size `]() inline uint32\_t size() const #### [` name `]() inline std::string\_view name() const #### [` start_rva `]() inline void start\_rva(uint32\_t start\_rva) #### [` size `]() inline void size(uint32\_t size) #### [` name `]() inline void name(std::string name) #### [` accept `]() virtual void accept(Visitor &visitor) const override Friends #### [` operator<< `]() friend std::ostream &operator<<(std::ostream &os, const [PogoEntry]( "LIEF::PE::PogoEntry") &entry) --- ## [Repro]() ### [` Repro `]() class Repro : public LIEF::PE::[Debug]( "LIEF::PE::Debug") This class represents a reproducible build entry from the debug directory. (`IMAGE_DEBUG_TYPE_REPRO`). This entry is usually generated with the undocumented `/Brepro` linker flag. See: [https://nikhilism.com/post/2020/windows-deterministic-builds/]() Public Functions #### [` Repro `]() inline Repro() #### [` Repro `]() inline Repro(std::vector<uint8\_t> hash) #### [` Repro `]() inline Repro(const details::pe\_debug &dbg, std::vector<uint8\_t> hash, [Section]( "LIEF::PE::Section") \*sec) #### [` Repro `]() inline Repro(const details::pe\_debug &dbg, [Section]( "LIEF::PE::Section") \*sec) #### [` Repro `]() Repro(const [Repro]( "LIEF::PE::Repro::Repro") &other) = default #### [` operator= `]() [Repro]( "LIEF::PE::Repro") &operator=(const [Repro]( "LIEF::PE::Repro") &other) = default #### [` Repro `]() Repro([Repro]( "LIEF::PE::Repro::Repro")&&) = default #### [` operator= `]() [Repro]( "LIEF::PE::Repro") &operator=([Repro]( "LIEF::PE::Repro") &&other) = default #### [` hash `]() inline span<const uint8\_t> hash() const The hash associated with the reproducible build. #### [` hash `]() inline span<uint8\_t> hash() #### [` hash `]() inline void hash(std::vector<uint8\_t> h) #### [` clone `]() inline virtual std::unique\_ptr<[Debug]( "LIEF::PE::Debug")> clone() const override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` to_string `]() virtual std::string to\_string() const override #### [` ~Repro `]() ~Repro() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Debug]( "LIEF::PE::Debug") \*debug) --- ## [PDBChecksum]() ### [` PDBChecksum `]() class PDBChecksum : public LIEF::PE::[Debug]( "LIEF::PE::Debug") This class represents the PDB Checksum debug entry which is essentially an array of bytes representing the checksum of the PDB content. Public Types #### [` HASH_ALGO `]() enum class HASH\_ALGO : uint32\_t *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` SHA256 `]() enumerator SHA256 Public Functions #### [` PDBChecksum `]() inline PDBChecksum([HASH\_ALGO]( "LIEF::PE::PDBChecksum::HASH_ALGO") algo, std::vector<uint8\_t> hash) #### [` PDBChecksum `]() inline PDBChecksum(const details::pe\_debug &dbg, [Section]( "LIEF::PE::Section") \*sec, [HASH\_ALGO]( "LIEF::PE::PDBChecksum::HASH_ALGO") algo, std::vector<uint8\_t> hash) #### [` PDBChecksum `]() PDBChecksum(const [PDBChecksum]( "LIEF::PE::PDBChecksum::PDBChecksum") &other) = default #### [` operator= `]() [PDBChecksum]( "LIEF::PE::PDBChecksum") &operator=(const [PDBChecksum]( "LIEF::PE::PDBChecksum") &other) = default #### [` PDBChecksum `]() PDBChecksum([PDBChecksum]( "LIEF::PE::PDBChecksum::PDBChecksum")&&) = default #### [` operator= `]() [PDBChecksum]( "LIEF::PE::PDBChecksum") &operator=([PDBChecksum]( "LIEF::PE::PDBChecksum") &&other) = default #### [` clone `]() inline virtual std::unique\_ptr<[Debug]( "LIEF::PE::Debug")> clone() const override #### [` hash `]() inline span<const uint8\_t> hash() const Hash of the PDB content. #### [` hash `]() inline span<uint8\_t> hash() #### [` hash `]() inline void hash(std::vector<uint8\_t> h) #### [` algorithm `]() inline [HASH\_ALGO]( "LIEF::PE::PDBChecksum::HASH_ALGO") algorithm() const Algorithm used for hashing the PDB content. #### [` algorithm `]() inline void algorithm([HASH\_ALGO]( "LIEF::PE::PDBChecksum::HASH_ALGO") algo) #### [` ~PDBChecksum `]() ~PDBChecksum() override = default #### [` to_string `]() virtual std::string to\_string() const override Public Static Functions #### [` parse `]() static std::unique\_ptr<[PDBChecksum]( "LIEF::PE::PDBChecksum")> parse(const details::pe\_debug &hdr, [Section]( "LIEF::PE::Section") \*section, span<uint8\_t> payload) #### [` classof `]() static inline bool classof(const [Debug]( "LIEF::PE::Debug") \*debug) --- ## [VCFeature]() ### [` VCFeature `]() class VCFeature : public LIEF::PE::[Debug]( "LIEF::PE::Debug") This class represents the `IMAGE_DEBUG_TYPE_VC_FEATURE` debug entry. Public Functions #### [` VCFeature `]() inline VCFeature(const details::pe\_debug &debug, [Section]( "LIEF::PE::Section") \*sec, uint32\_t pre\_vc, uint32\_t c\_cpp, uint32\_t gs, uint32\_t sdl, uint32\_t guards) #### [` VCFeature `]() VCFeature(const [VCFeature]( "LIEF::PE::VCFeature::VCFeature") &other) = default #### [` operator= `]() [VCFeature]( "LIEF::PE::VCFeature") &operator=(const [VCFeature]( "LIEF::PE::VCFeature") &other) = default #### [` VCFeature `]() VCFeature([VCFeature]( "LIEF::PE::VCFeature::VCFeature")&&) = default #### [` operator= `]() [VCFeature]( "LIEF::PE::VCFeature") &operator=([VCFeature]( "LIEF::PE::VCFeature") &&other) = default #### [` clone `]() inline virtual std::unique\_ptr<[Debug]( "LIEF::PE::Debug")> clone() const override #### [` pre_vcpp `]() inline uint32\_t pre\_vcpp() const Count for `Pre-VC++ 11.00`. #### [` c_cpp `]() inline uint32\_t c\_cpp() const Count for `C/C++`. #### [` gs `]() inline uint32\_t gs() const Count for `/GS` (number of guard stack). #### [` sdl `]() inline uint32\_t sdl() const Whether `/sdl` was enabled for this binary. `sdl` stands for Security Development Lifecycle and provides enhanced security features like changing security-relevant warnings into errors or enforcing guard stack. #### [` guards `]() inline uint32\_t guards() const Count for `/guardN`. #### [` pre_vcpp `]() inline [VCFeature]( "LIEF::PE::VCFeature") &pre\_vcpp(uint32\_t value) #### [` c_cpp `]() inline [VCFeature]( "LIEF::PE::VCFeature") &c\_cpp(uint32\_t value) #### [` gs `]() inline [VCFeature]( "LIEF::PE::VCFeature") &gs(uint32\_t value) #### [` sdl `]() inline [VCFeature]( "LIEF::PE::VCFeature") &sdl(uint32\_t value) #### [` guards `]() inline [VCFeature]( "LIEF::PE::VCFeature") &guards(uint32\_t value) #### [` ~VCFeature `]() ~VCFeature() override = default #### [` to_string `]() virtual std::string to\_string() const override Public Static Functions #### [` parse `]() static std::unique\_ptr<[VCFeature]( "LIEF::PE::VCFeature")> parse(const details::pe\_debug &hdr, [Section]( "LIEF::PE::Section") \*section, span<uint8\_t> payload) #### [` classof `]() static inline bool classof(const [Debug]( "LIEF::PE::Debug") \*debug) --- ## [ExDllCharacteristics]() ### [` ExDllCharacteristics `]() class ExDllCharacteristics : public LIEF::PE::[Debug]( "LIEF::PE::Debug") This class represents the `IMAGE_DEBUG_TYPE_EX_DLLCHARACTERISTICS` debug entry. Public Types #### [` CHARACTERISTICS `]() enum class CHARACTERISTICS : uint32\_t Extended DLL Characteristics. *Values:* ##### [` CET_COMPAT `]() enumerator CET\_COMPAT = 0x01 ##### [` CET_COMPAT_STRICT_MODE `]() enumerator CET\_COMPAT\_STRICT\_MODE = 0x02 ##### [` CET_SET_CONTEXT_IP_VALIDATION_RELAXED_MODE `]() enumerator CET\_SET\_CONTEXT\_IP\_VALIDATION\_RELAXED\_MODE = 0x04 ##### [` CET_DYNAMIC_APIS_ALLOW_IN_PROC `]() enumerator CET\_DYNAMIC\_APIS\_ALLOW\_IN\_PROC = 0x08 ##### [` CET_RESERVED_1 `]() enumerator CET\_RESERVED\_1 = 0x10 ##### [` CET_RESERVED_2 `]() enumerator CET\_RESERVED\_2 = 0x20 ##### [` FORWARD_CFI_COMPAT `]() enumerator FORWARD\_CFI\_COMPAT = 0x40 ##### [` HOTPATCH_COMPATIBLE `]() enumerator HOTPATCH\_COMPATIBLE = 0x80 Public Functions #### [` ExDllCharacteristics `]() inline ExDllCharacteristics(const details::pe\_debug &debug, [Section]( "LIEF::PE::Section") \*sec, uint32\_t characteristics) #### [` ExDllCharacteristics `]() ExDllCharacteristics(const [ExDllCharacteristics]( "LIEF::PE::ExDllCharacteristics::ExDllCharacteristics") &other) = default #### [` operator= `]() [ExDllCharacteristics]( "LIEF::PE::ExDllCharacteristics") &operator=(const [ExDllCharacteristics]( "LIEF::PE::ExDllCharacteristics") &other) = default #### [` ExDllCharacteristics `]() ExDllCharacteristics([ExDllCharacteristics]( "LIEF::PE::ExDllCharacteristics::ExDllCharacteristics")&&) = default #### [` operator= `]() [ExDllCharacteristics]( "LIEF::PE::ExDllCharacteristics") &operator=([ExDllCharacteristics]( "LIEF::PE::ExDllCharacteristics") &&other) = default #### [` clone `]() inline virtual std::unique\_ptr<[Debug]( "LIEF::PE::Debug")> clone() const override #### [` characteristics `]() inline [CHARACTERISTICS]( "LIEF::PE::ExDllCharacteristics::CHARACTERISTICS") characteristics() const Return the characteristics. #### [` characteristics_list `]() std::vector<[CHARACTERISTICS]( "LIEF::PE::ExDllCharacteristics::CHARACTERISTICS")> characteristics\_list() const Characteristics as a vector. #### [` has `]() inline bool has([CHARACTERISTICS]( "LIEF::PE::ExDllCharacteristics::CHARACTERISTICS") c) const Check if the given [CHARACTERISTICS]() is used. #### [` ~ExDllCharacteristics `]() ~ExDllCharacteristics() override = default #### [` to_string `]() virtual std::string to\_string() const override Public Static Functions #### [` parse `]() static std::unique\_ptr<[ExDllCharacteristics]( "LIEF::PE::ExDllCharacteristics")> parse(const details::pe\_debug &hdr, [Section]( "LIEF::PE::Section") \*section, span<uint8\_t> payload) #### [` classof `]() static inline bool classof(const [Debug]( "LIEF::PE::Debug") \*debug) --- ## [Frame Pointer Omission (FPO)]() ### [` FPO `]() class FPO : public LIEF::PE::[Debug]( "LIEF::PE::Debug") This class represents the `IMAGE_DEBUG_TYPE_FPO` debug entry. Public Types #### [` FRAME_TYPE `]() enum class FRAME\_TYPE *Values:* ##### [` FPO `]() enumerator FPO = 0 ##### [` TRAP `]() enumerator TRAP = 1 ##### [` TSS `]() enumerator TSS = 2 ##### [` NON_FPO `]() enumerator NON\_FPO = 3 #### [` entries_t `]() using entries\_t = std::vector<[entry\_t]( "LIEF::PE::FPO::entry_t")> #### [` it_entries `]() using it\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[entries\_t]( "LIEF::PE::FPO::entries_t")&> #### [` it_const_entries `]() using it\_const\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [entries\_t]( "LIEF::PE::FPO::entries_t")&> Public Functions #### [` FPO `]() inline FPO(const details::pe\_debug &hdr, [Section]( "LIEF::PE::Section") \*section) #### [` FPO `]() FPO(const [FPO]( "LIEF::PE::FPO::FPO") &other) = default #### [` operator= `]() [FPO]( "LIEF::PE::FPO") &operator=(const [FPO]( "LIEF::PE::FPO") &other) = default #### [` FPO `]() FPO([FPO]( "LIEF::PE::FPO::FPO")&&) = default #### [` operator= `]() [FPO]( "LIEF::PE::FPO") &operator=([FPO]( "LIEF::PE::FPO") &&other) = default #### [` clone `]() inline virtual std::unique\_ptr<[Debug]( "LIEF::PE::Debug")> clone() const override #### [` entries `]() inline [it\_const\_entries]( "LIEF::PE::FPO::it_const_entries") entries() const Iterator over the [FPO]() entries. #### [` entries `]() inline [it\_entries]( "LIEF::PE::FPO::it_entries") entries() #### [` ~FPO `]() ~FPO() override = default #### [` to_string `]() virtual std::string to\_string() const override Public Static Functions #### [` parse `]() static std::unique\_ptr<[FPO]( "LIEF::PE::FPO")> parse(const details::pe\_debug &hdr, [Section]( "LIEF::PE::Section") \*section, span<uint8\_t> payload) #### [` classof `]() static inline bool classof(const [Debug]( "LIEF::PE::Debug") \*debug) #### [` entry_t `]() struct entry\_t Represents the stack frame layout for a x86 function when frame pointer omission ([FPO]()) optimization is used. Public Functions ##### [` to_string `]() std::string to\_string() const Public Members ##### [` rva `]() uint32\_t rva = 0 The function RVA. ##### [` proc_size `]() uint32\_t proc\_size = 0 The number of bytes in the function. ##### [` nb_locals `]() uint32\_t nb\_locals = 0 The number of local variables. ##### [` parameters_size `]() uint32\_t parameters\_size = 0 The size of the parameters. ##### [` prolog_size `]() uint16\_t prolog\_size = 0 The number of bytes in the function prologue code. ##### [` nb_saved_regs `]() uint16\_t nb\_saved\_regs = 0 Number of registers saved. ##### [` use_seh `]() bool use\_seh = false Whether the function uses structured exception handling. ##### [` use_bp `]() bool use\_bp = false Whether the EBP register has been allocated. ##### [` reserved `]() uint16\_t reserved = 0 Reserved for future use. ##### [` type `]() [FRAME\_TYPE]( "LIEF::PE::FPO::FRAME_TYPE") type = [FRAME\_TYPE]( "LIEF::PE::FPO::FRAME_TYPE")::[FPO]( "LIEF::PE::FPO::FRAME_TYPE::FPO") Variable that indicates the frame type. Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [entry\_t]( "LIEF::PE::FPO::entry_t") &entry) --- ## [Exception Info]() ### [` ExceptionInfo `]() class ExceptionInfo This class is the base class for any exception or runtime function entry. Subclassed by [LIEF::PE::RuntimeFunctionAArch64](), [LIEF::PE::RuntimeFunctionX64]() Public Types #### [` ARCH `]() enum class ARCH Arch discriminator for the subclasses. *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` ARM64 `]() enumerator ARM64 ##### [` X86_64 `]() enumerator X86\_64 Public Functions #### [` ExceptionInfo `]() ExceptionInfo() = delete #### [` ExceptionInfo `]() ExceptionInfo(const [ExceptionInfo]( "LIEF::PE::ExceptionInfo::ExceptionInfo")&) = default #### [` operator= `]() [ExceptionInfo]( "LIEF::PE::ExceptionInfo") &operator=(const [ExceptionInfo]( "LIEF::PE::ExceptionInfo")&) = default #### [` ExceptionInfo `]() ExceptionInfo([ExceptionInfo]( "LIEF::PE::ExceptionInfo::ExceptionInfo")&&) = default #### [` operator= `]() [ExceptionInfo]( "LIEF::PE::ExceptionInfo") &operator=([ExceptionInfo]( "LIEF::PE::ExceptionInfo")&&) = default #### [` clone `]() virtual std::unique\_ptr<[ExceptionInfo]( "LIEF::PE::ExceptionInfo")> clone() const = 0 #### [` ExceptionInfo `]() inline ExceptionInfo([ARCH]( "LIEF::PE::ExceptionInfo::ARCH") arch, uint64\_t rva) #### [` ExceptionInfo `]() inline ExceptionInfo([ARCH]( "LIEF::PE::ExceptionInfo::ARCH") arch) #### [` arch `]() inline [ARCH]( "LIEF::PE::ExceptionInfo::ARCH") arch() const Target architecture of this exception. #### [` rva_start `]() inline uint32\_t rva\_start() const [Function]() start address. #### [` offset `]() inline uint64\_t offset() const Offset in the binary where the raw exception information associated with this entry is defined. #### [` to_string `]() virtual std::string to\_string() const = 0 #### [` ~ExceptionInfo `]() virtual ~ExceptionInfo() = default #### [` Tas `]() template<class T> inline [T]( "LIEF::PE::ExceptionInfo::as::T") \*as() Helper to **downcast** an [ExceptionInfo]() into a concrete implementation. #### [` Tas `]() template<class T> inline const [T]( "LIEF::PE::ExceptionInfo::as::T") \*as() const Public Static Functions #### [` parse `]() static std::unique\_ptr<[ExceptionInfo]( "LIEF::PE::ExceptionInfo")> parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &strm) #### [` parse `]() static std::unique\_ptr<[ExceptionInfo]( "LIEF::PE::ExceptionInfo")> parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &strm, [Header]( "LIEF::PE::Header")::[MACHINE\_TYPES]( "LIEF::PE::Header::MACHINE_TYPES") arch) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [ExceptionInfo]( "LIEF::PE::ExceptionInfo") &info) --- ## [RuntimeFunctionX64]() ### [` RuntimeFunctionX64 `]() class RuntimeFunctionX64 : public LIEF::PE::[ExceptionInfo]( "LIEF::PE::ExceptionInfo") This class represents an entry in the exception table (`.pdata` section) for the x86-64 architecture. Reference: [https://learn.microsoft.com/en-us/cpp/build/exception-handling-x64]() Public Types #### [` UNWIND_FLAGS `]() enum class UNWIND\_FLAGS : uint8\_t *Values:* ##### [` EXCEPTION_HANDLER `]() enumerator EXCEPTION\_HANDLER = 1 The function has an exception handler that should be called when looking for functions that need to examine exceptions. ##### [` TERMINATE_HANDLER `]() enumerator TERMINATE\_HANDLER = 2 The function has a termination handler that should be called when unwinding an exception. ##### [` CHAIN_INFO `]() enumerator CHAIN\_INFO = 4 The chained info payload references a previous `RUNTIME_FUNCTION`. #### [` UNWIND_OPCODES `]() enum class UNWIND\_OPCODES : uint32\_t *Values:* ##### [` PUSH_NONVOL `]() enumerator PUSH\_NONVOL = 0 Push a nonvolatile integer register, decrementing RSP by 8. The operation info is the number of the register. Because of the constraints on epilogs, `PUSH_NONVOL` unwind codes must appear first in the prolog and correspondingly, last in the unwind code array. This relative ordering applies to all other unwind codes except [UNWIND\_OPCODES::PUSH\_MACHFRAME](). ##### [` ALLOC_LARGE `]() enumerator ALLOC\_LARGE = 1 Allocate a large-sized area on the stack. There are two forms. If the operation info equals 0, then the size of the allocation divided by 8 is recorded in the next slot, allowing an allocation up to 512K - 8. If the operation info equals 1, then the unscaled size of the allocation is recorded in the next two slots in little-endian format, allowing allocations up to 4GB - 8. ##### [` ALLOC_SMALL `]() enumerator ALLOC\_SMALL = 2 Allocate a small-sized area on the stack. The size of the allocation is the operation info field \* 8 + 8, allowing allocations from 8 to 128 bytes. ##### [` SET_FPREG `]() enumerator SET\_FPREG = 3 Establish the frame pointer register by setting the register to some offset of the current RSP. The offset is equal to the Frame Register offset (scaled) field in the UNWIND\_INFO \* 16, allowing offsets from 0 to 240. The use of an offset permits establishing a frame pointer that points to the middle of the fixed stack allocation, helping code density by allowing more accesses to use short instruction forms. The operation info field is reserved and shouldn’t be used. ##### [` SAVE_NONVOL `]() enumerator SAVE\_NONVOL = 4 Save a nonvolatile integer register on the stack using a MOV instead of a PUSH. This code is primarily used for shrink-wrapping, where a nonvolatile register is saved to the stack in a position that was previously allocated. The operation info is the number of the register. The scaled-by-8 stack offset is recorded in the next unwind operation code slot, as described in the note above. ##### [` SAVE_NONVOL_FAR `]() enumerator SAVE\_NONVOL\_FAR = 5 Save a nonvolatile integer register on the stack with a long offset, using a MOV instead of a PUSH. This code is primarily used for shrink-wrapping, where a nonvolatile register is saved to the stack in a position that was previously allocated. The operation info is the number of the register. The unscaled stack offset is recorded in the next two unwind operation code slots, as described in the note above. ##### [` EPILOG `]() enumerator EPILOG = 6 This entry is only relevant for version 2. It describes the function epilog. ##### [` SPARE `]() enumerator SPARE = 7 Reserved Originally SAVE\_XMM128\_FAR in version 1, but deprecated and removed. ##### [` SAVE_XMM128 `]() enumerator SAVE\_XMM128 = 8 Save all 128 bits of a nonvolatile XMM register on the stack. The operation info is the number of the register. The scaled-by-16 stack offset is recorded in the next slot. ##### [` SAVE_XMM128_FAR `]() enumerator SAVE\_XMM128\_FAR = 9 Save all 128 bits of a nonvolatile XMM register on the stack with a long offset. The operation info is the number of the register. The unscaled stack offset is recorded in the next two slots. ##### [` PUSH_MACHFRAME `]() enumerator PUSH\_MACHFRAME = 10 Push a machine frame. This unwind code is used to record the effect of a hardware interrupt or exception. #### [` UNWIND_REG `]() enum class UNWIND\_REG : uint32\_t *Values:* ##### [` RAX `]() enumerator RAX = 0 ##### [` RCX `]() enumerator RCX ##### [` RDX `]() enumerator RDX ##### [` RBX `]() enumerator RBX ##### [` RSP `]() enumerator RSP ##### [` RBP `]() enumerator RBP ##### [` RSI `]() enumerator RSI ##### [` RDI `]() enumerator RDI ##### [` R8 `]() enumerator R8 ##### [` R9 `]() enumerator R9 ##### [` R10 `]() enumerator R10 ##### [` R11 `]() enumerator R11 ##### [` R12 `]() enumerator R12 ##### [` R13 `]() enumerator R13 ##### [` R14 `]() enumerator R14 ##### [` R15 `]() enumerator R15 Public Functions #### [` RuntimeFunctionX64 `]() inline RuntimeFunctionX64(uint32\_t rva\_start, uint32\_t rva\_end, uint32\_t unwind\_rva) #### [` RuntimeFunctionX64 `]() RuntimeFunctionX64(const [RuntimeFunctionX64]( "LIEF::PE::RuntimeFunctionX64::RuntimeFunctionX64")&) = default #### [` operator= `]() [RuntimeFunctionX64]( "LIEF::PE::RuntimeFunctionX64") &operator=(const [RuntimeFunctionX64]( "LIEF::PE::RuntimeFunctionX64")&) = default #### [` RuntimeFunctionX64 `]() RuntimeFunctionX64([RuntimeFunctionX64]( "LIEF::PE::RuntimeFunctionX64::RuntimeFunctionX64")&&) = default #### [` operator= `]() [RuntimeFunctionX64]( "LIEF::PE::RuntimeFunctionX64") &operator=([RuntimeFunctionX64]( "LIEF::PE::RuntimeFunctionX64")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[ExceptionInfo]( "LIEF::PE::ExceptionInfo")> clone() const override #### [` to_string `]() virtual std::string to\_string() const override #### [` rva_end `]() inline uint32\_t rva\_end() const [Function]() end address. #### [` unwind_rva `]() inline uint32\_t unwind\_rva() const Unwind info address. #### [` size `]() inline uint32\_t size() const Size of the function (in bytes). #### [` unwind_info `]() inline const [unwind\_info\_t]( "LIEF::PE::RuntimeFunctionX64::unwind_info_t") \*unwind\_info() const Detailed unwind information. #### [` unwind_info `]() inline [unwind\_info\_t]( "LIEF::PE::RuntimeFunctionX64::unwind_info_t") \*unwind\_info() #### [` unwind_info `]() inline void unwind\_info([unwind\_info\_t]( "LIEF::PE::RuntimeFunctionX64::unwind_info_t") info) #### [` ~RuntimeFunctionX64 `]() ~RuntimeFunctionX64() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [ExceptionInfo]( "LIEF::PE::ExceptionInfo") \*info) #### [` unwind_info_t `]() struct unwind\_info\_t This structure represents the `UNWIND_INFO` which records the effects a function has on the stack pointer, and where the nonvolatile registers are saved on the stack. Public Types ##### [` opcodes_t `]() using opcodes\_t = std::vector<std::unique\_ptr<unwind\_x64::[Code]( "LIEF::PE::unwind_x64::Code")>> Public Functions ##### [` has `]() inline bool has([UNWIND\_FLAGS]( "LIEF::PE::RuntimeFunctionX64::UNWIND_FLAGS") flag) const Check if the given flag is used. ##### [` opcodes `]() [opcodes\_t]( "LIEF::PE::RuntimeFunctionX64::unwind_info_t::opcodes_t") opcodes() const Enhanced representation of the unwind code. ##### [` to_string `]() std::string to\_string() const Pretty representation of this structure as a string. Public Members ##### [` version `]() uint8\_t version = 0 Version number of the unwind data, currently 1 or 2. ##### [` flags `]() uint8\_t flags = 0 See: [UNWIND\_FLAGS](). ##### [` sizeof_prologue `]() uint8\_t sizeof\_prologue = 0 Length of the function prolog in bytes. ##### [` count_opcodes `]() uint8\_t count\_opcodes = 0 The number of slots in the unwind codes array. Some unwind codes, for example, [UNWIND\_OPCODES::SAVE\_NONVOL](), require more than one slot in the array. ##### [` frame_reg `]() uint8\_t frame\_reg = 0 If nonzero, then the function uses a frame pointer (FP), and this field is the number of the nonvolatile register used as the frame pointer, using the same encoding for the operation info field of [UNWIND\_OPCODES]() nodes. ##### [` frame_reg_offset `]() uint8\_t frame\_reg\_offset = 0 If the frame register field is nonzero, this field is the scaled offset from RSP that is applied to the FP register when it’s established. ##### [` raw_opcodes `]() std::vector<uint8\_t> raw\_opcodes An array of items that explains the effect of the prolog on the nonvolatile registers and RSP. ##### [` handler `]() std::optional<uint32\_t> handler An image-relative pointer to either the function’s language-specific exception or termination handler. This value is set if one of these flags is set: [UNWIND\_FLAGS::EXCEPTION\_HANDLER](), [UNWIND\_FLAGS::TERMINATE\_HANDLER](). ##### [` chained `]() [RuntimeFunctionX64]( "LIEF::PE::RuntimeFunctionX64") \*chained = nullptr If [UNWIND\_FLAGS::CHAIN\_INFO]() is set, this attributes references the chained runtime function. Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [unwind\_info\_t]( "LIEF::PE::RuntimeFunctionX64::unwind_info_t") &info) --- ## [unwind\_x64 - Code]() ### [` Code `]() class Code Base class for all unwind operations. Subclassed by [LIEF::PE::unwind\_x64::Alloc](), [LIEF::PE::unwind\_x64::Epilog](), [LIEF::PE::unwind\_x64::PushMachFrame](), [LIEF::PE::unwind\_x64::PushNonVol](), [LIEF::PE::unwind\_x64::SaveNonVolatile](), [LIEF::PE::unwind\_x64::SaveXMM128](), [LIEF::PE::unwind\_x64::SetFPReg](), [LIEF::PE::unwind\_x64::Spare]() Public Types #### [` OPCODE `]() using OPCODE = [RuntimeFunctionX64]( "LIEF::PE::RuntimeFunctionX64")::[UNWIND\_OPCODES]( "LIEF::PE::RuntimeFunctionX64::UNWIND_OPCODES") #### [` REG `]() using REG = [RuntimeFunctionX64]( "LIEF::PE::RuntimeFunctionX64")::[UNWIND\_REG]( "LIEF::PE::RuntimeFunctionX64::UNWIND_REG") Public Functions #### [` Code `]() Code() = delete #### [` Code `]() Code(const [Code]( "LIEF::PE::unwind_x64::Code::Code")&) = default #### [` operator= `]() [Code]( "LIEF::PE::unwind_x64::Code") &operator=(const [Code]( "LIEF::PE::unwind_x64::Code")&) = default #### [` Code `]() Code([Code]( "LIEF::PE::unwind_x64::Code::Code")&&) = default #### [` operator= `]() [Code]( "LIEF::PE::unwind_x64::Code") &operator=([Code]( "LIEF::PE::unwind_x64::Code")&&) = default #### [` ~Code `]() virtual ~Code() = default #### [` Code `]() inline Code([OPCODE]( "LIEF::PE::unwind_x64::Code::OPCODE") opcode, uint32\_t pos) #### [` Code `]() inline Code([OPCODE]( "LIEF::PE::unwind_x64::Code::OPCODE") opcode) #### [` opcode `]() inline [OPCODE]( "LIEF::PE::unwind_x64::Code::OPCODE") opcode() const The original opcode. #### [` position `]() inline uint32\_t position() const Offset in the prolog. #### [` to_string `]() virtual std::string to\_string() const Pretty representation. Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [Code]( "LIEF::PE::unwind_x64::Code") &code) --- ## [unwind\_x64 - Alloc]() ### [` Alloc `]() class Alloc : public LIEF::PE::unwind\_x64::[Code]( "LIEF::PE::unwind_x64::Code") This class represents a stack-allocation operation (UNWIND\_OPCODES::ALLOC\_SMALL or UNWIND\_OPCODES::ALLOC\_LARGE). Public Functions #### [` Alloc `]() inline Alloc(OPCODE op, size\_t pos, uint32\_t size) #### [` size `]() inline uint32\_t size() const The size allocated. #### [` to_string `]() virtual std::string to\_string() const override Pretty representation. #### [` ~Alloc `]() ~Alloc() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Code]( "LIEF::PE::unwind_x64::Code") \*code) --- ## [unwind\_x64 - PushNonVol]() ### [` PushNonVol `]() class PushNonVol : public LIEF::PE::unwind\_x64::[Code]( "LIEF::PE::unwind_x64::Code") Push a nonvolatile integer register, decrementing RSP by 8. Public Functions #### [` PushNonVol `]() PushNonVol() = delete #### [` PushNonVol `]() inline PushNonVol(REG reg, size\_t pos) #### [` to_string `]() virtual std::string to\_string() const override Pretty representation. #### [` reg `]() inline REG reg() const The register pushed. #### [` ~PushNonVol `]() ~PushNonVol() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Code]( "LIEF::PE::unwind_x64::Code") \*code) --- ## [unwind\_x64 - PushMachFrame]() ### [` PushMachFrame `]() class PushMachFrame : public LIEF::PE::unwind\_x64::[Code]( "LIEF::PE::unwind_x64::Code") Push a machine frame. Public Functions #### [` PushMachFrame `]() PushMachFrame() = delete #### [` PushMachFrame `]() inline PushMachFrame(uint8\_t value, size\_t pos) #### [` value `]() inline uint8\_t value() const 0 or 1 #### [` to_string `]() virtual std::string to\_string() const override Pretty representation. #### [` ~PushMachFrame `]() ~PushMachFrame() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Code]( "LIEF::PE::unwind_x64::Code") \*code) --- ## [unwind\_x64 - SetFPReg]() ### [` SetFPReg `]() class SetFPReg : public LIEF::PE::unwind\_x64::[Code]( "LIEF::PE::unwind_x64::Code") Establish the frame pointer register by setting the register to some offset of the current RSP. Public Functions #### [` SetFPReg `]() SetFPReg() = delete #### [` SetFPReg `]() inline SetFPReg(REG value, size\_t pos) #### [` reg `]() inline REG reg() const Frame pointer register. #### [` to_string `]() virtual std::string to\_string() const override Pretty representation. #### [` ~SetFPReg `]() ~SetFPReg() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Code]( "LIEF::PE::unwind_x64::Code") \*code) --- ## [unwind\_x64 - SaveNonVolatile]() ### [` SaveNonVolatile `]() class SaveNonVolatile : public LIEF::PE::unwind\_x64::[Code]( "LIEF::PE::unwind_x64::Code") Save a nonvolatile integer register on the stack using a `MOV` instead of a `PUSH`. Public Functions #### [` SaveNonVolatile `]() SaveNonVolatile() = delete #### [` SaveNonVolatile `]() inline SaveNonVolatile(OPCODE op, REG value, size\_t pos, uint32\_t offset) #### [` reg `]() inline REG reg() const #### [` offset `]() inline uint32\_t offset() const #### [` to_string `]() virtual std::string to\_string() const override Pretty representation. #### [` ~SaveNonVolatile `]() ~SaveNonVolatile() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Code]( "LIEF::PE::unwind_x64::Code") \*code) --- ## [unwind\_x64 - SaveXMM128]() ### [` SaveXMM128 `]() class SaveXMM128 : public LIEF::PE::unwind\_x64::[Code]( "LIEF::PE::unwind_x64::Code") Public Functions #### [` SaveXMM128 `]() SaveXMM128() = delete #### [` SaveXMM128 `]() inline SaveXMM128(OPCODE op, uint8\_t num, size\_t pos, uint32\_t offset) #### [` num `]() inline uint8\_t num() const #### [` offset `]() inline uint32\_t offset() const #### [` to_string `]() virtual std::string to\_string() const override Pretty representation. #### [` ~SaveXMM128 `]() ~SaveXMM128() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Code]( "LIEF::PE::unwind_x64::Code") \*code) --- ## [unwind\_x64 - Epilog]() ### [` Epilog `]() class Epilog : public LIEF::PE::unwind\_x64::[Code]( "LIEF::PE::unwind_x64::Code") Describes the function’s epilog. Public Functions #### [` Epilog `]() Epilog() = delete #### [` Epilog `]() inline Epilog(uint8\_t flags, uint8\_t size) #### [` flags `]() inline uint8\_t flags() const #### [` size `]() inline uint32\_t size() const Size of the epilog. #### [` to_string `]() virtual std::string to\_string() const override Pretty representation. #### [` ~Epilog `]() ~Epilog() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Code]( "LIEF::PE::unwind_x64::Code") \*code) --- ## [unwind\_x64 - Spare]() ### [` Spare `]() class Spare : public LIEF::PE::unwind\_x64::[Code]( "LIEF::PE::unwind_x64::Code") Public Functions #### [` Spare `]() inline Spare() #### [` to_string `]() inline virtual std::string to\_string() const override Pretty representation. #### [` ~Spare `]() ~Spare() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [Code]( "LIEF::PE::unwind_x64::Code") \*code) --- ## [RuntimeFunctionAArch64]() ### [` RuntimeFunctionAArch64 `]() class RuntimeFunctionAArch64 : public LIEF::PE::[ExceptionInfo]( "LIEF::PE::ExceptionInfo") This class represents an entry in the exception table (`.pdata` section) for the AArch64 architecture. Since the ARM64 unwinding info can be encoded in a *packed* and *unpacked* format, this class is inherited by [LIEF::PE::unwind\_aarch64::PackedFunction]() and [LIEF::PE::unwind\_aarch64::UnpackedFunction]() Reference: [https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling#arm64-exception-handling-information]() Subclassed by [LIEF::PE::unwind\_aarch64::PackedFunction](), [LIEF::PE::unwind\_aarch64::UnpackedFunction]() Public Types #### [` PACKED_FLAGS `]() enum class PACKED\_FLAGS *Values:* ##### [` UNPACKED `]() enumerator UNPACKED = 0 ##### [` PACKED `]() enumerator PACKED = 1 ##### [` PACKED_FRAGMENT `]() enumerator PACKED\_FRAGMENT = 2 ##### [` RESERVED `]() enumerator RESERVED = 3 Public Functions #### [` RuntimeFunctionAArch64 `]() inline RuntimeFunctionAArch64(uint64\_t RVA, uint32\_t length, [PACKED\_FLAGS]( "LIEF::PE::RuntimeFunctionAArch64::PACKED_FLAGS") flag) #### [` RuntimeFunctionAArch64 `]() RuntimeFunctionAArch64(const [RuntimeFunctionAArch64]( "LIEF::PE::RuntimeFunctionAArch64::RuntimeFunctionAArch64")&) = default #### [` operator= `]() [RuntimeFunctionAArch64]( "LIEF::PE::RuntimeFunctionAArch64") &operator=(const [RuntimeFunctionAArch64]( "LIEF::PE::RuntimeFunctionAArch64")&) = default #### [` RuntimeFunctionAArch64 `]() RuntimeFunctionAArch64([RuntimeFunctionAArch64]( "LIEF::PE::RuntimeFunctionAArch64::RuntimeFunctionAArch64")&&) = default #### [` operator= `]() [RuntimeFunctionAArch64]( "LIEF::PE::RuntimeFunctionAArch64") &operator=([RuntimeFunctionAArch64]( "LIEF::PE::RuntimeFunctionAArch64")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[ExceptionInfo]( "LIEF::PE::ExceptionInfo")> clone() const override #### [` length `]() inline uint32\_t length() const Length of the function in bytes. #### [` flag `]() inline [PACKED\_FLAGS]( "LIEF::PE::RuntimeFunctionAArch64::PACKED_FLAGS") flag() const Flag describing the format the unwind data. #### [` rva_end `]() inline uint32\_t rva\_end() const [Function]() end address. #### [` to_string `]() virtual std::string to\_string() const override #### [` ~RuntimeFunctionAArch64 `]() ~RuntimeFunctionAArch64() override = default Public Static Functions #### [` parse `]() static std::unique\_ptr<[RuntimeFunctionAArch64]( "LIEF::PE::RuntimeFunctionAArch64")> parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &strm) #### [` classof `]() static inline bool classof(const [ExceptionInfo]( "LIEF::PE::ExceptionInfo") \*info) ## [Runtime AArch64 (Packed) Function]() ### [` PackedFunction `]() class PackedFunction : public LIEF::PE::[RuntimeFunctionAArch64]( "LIEF::PE::RuntimeFunctionAArch64") This class represents a packed AArch64 exception entry. An excepted entry can be packed if the unwind data fit in 30 bits Reference: [https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling?view=msvc-170#packed-unwind-data]() Public Functions #### [` PackedFunction `]() PackedFunction(const [PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction::PackedFunction")&) = default #### [` operator= `]() [PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction") &operator=(const [PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction")&) = default #### [` PackedFunction `]() PackedFunction([PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction::PackedFunction")&&) = default #### [` operator= `]() [PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction") &operator=([PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction")&&) = default #### [` ~PackedFunction `]() ~PackedFunction() override = default #### [` clone `]() inline virtual std::unique\_ptr<[ExceptionInfo]( "LIEF::PE::ExceptionInfo")> clone() const override #### [` to_string `]() virtual std::string to\_string() const override #### [` frame_size `]() inline uint8\_t frame\_size() const Size of the allocated stack. #### [` reg_I `]() inline uint8\_t reg\_I() const Number of non-volatile INT registers (x19-x28) saved in the canonical stack location. #### [` reg_F `]() inline uint8\_t reg\_F() const Number of non-volatile FP registers (d8-d15) saved in the canonical stack location. #### [` H `]() inline uint8\_t H() const 1-bit flag indicating whether the function homes the integer parameter registers (x0-x7) by storing them at the very start of the function. (0 = doesn’t home registers, 1 = homes registers). #### [` CR `]() inline uint8\_t CR() const Flag indicating whether the function includes extra instructions to set up a frame chain and return link. #### [` frame_size `]() inline [PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction") &frame\_size(uint8\_t value) #### [` reg_I `]() inline [PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction") &reg\_I(uint8\_t value) #### [` reg_F `]() inline [PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction") &reg\_F(uint8\_t value) #### [` H `]() inline [PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction") &H(uint8\_t value) #### [` CR `]() inline [PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction") &CR(uint8\_t value) #### [` RuntimeFunctionAArch64 `]() inline RuntimeFunctionAArch64(uint64\_t RVA, uint32\_t length, PACKED\_FLAGS flag) #### [` RuntimeFunctionAArch64 `]() RuntimeFunctionAArch64(const [RuntimeFunctionAArch64]( "LIEF::PE::unwind_aarch64::PackedFunction::RuntimeFunctionAArch64")&) = default #### [` RuntimeFunctionAArch64 `]() RuntimeFunctionAArch64([RuntimeFunctionAArch64]( "LIEF::PE::unwind_aarch64::PackedFunction::RuntimeFunctionAArch64")&&) = default Public Static Functions #### [` parse `]() static std::unique\_ptr<[PackedFunction]( "LIEF::PE::unwind_aarch64::PackedFunction")> parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &strm, uint32\_t rva, uint32\_t unwind\_data) #### [` classof `]() static inline bool classof(const [ExceptionInfo]( "LIEF::PE::ExceptionInfo") \*info) ## [Runtime AArch64 (UnpackedFunction) Function]() ### [` UnpackedFunction `]() class UnpackedFunction : public LIEF::PE::[RuntimeFunctionAArch64]( "LIEF::PE::RuntimeFunctionAArch64") This class represents an unpacked AArch64 exception entry. Reference: [https://learn.microsoft.com/en-us/cpp/build/arm64-exception-handling?view=msvc-170#xdata-records]() Public Types #### [` epilog_scopes_t `]() using epilog\_scopes\_t = std::vector<[epilog\_scope\_t]( "LIEF::PE::unwind_aarch64::UnpackedFunction::epilog_scope_t")> #### [` it_epilog_scopes `]() using it\_epilog\_scopes = [ref\_iterator]( "LIEF::ref_iterator")<[epilog\_scopes\_t]( "LIEF::PE::unwind_aarch64::UnpackedFunction::epilog_scopes_t")&> #### [` it_const_epilog_scopes `]() using it\_const\_epilog\_scopes = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [epilog\_scopes\_t]( "LIEF::PE::unwind_aarch64::UnpackedFunction::epilog_scopes_t")&> Public Functions #### [` UnpackedFunction `]() inline UnpackedFunction(uint32\_t rva, uint32\_t length) #### [` UnpackedFunction `]() UnpackedFunction(const [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction::UnpackedFunction")&) = default #### [` operator= `]() [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &operator=(const [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction")&) = default #### [` UnpackedFunction `]() UnpackedFunction([UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction::UnpackedFunction")&&) = default #### [` operator= `]() [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &operator=([UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction")&&) = default #### [` ~UnpackedFunction `]() ~UnpackedFunction() override = default #### [` clone `]() inline virtual std::unique\_ptr<[ExceptionInfo]( "LIEF::PE::ExceptionInfo")> clone() const override #### [` to_string `]() virtual std::string to\_string() const override #### [` xdata_rva `]() inline uint32\_t xdata\_rva() const RVA where this unpacked data is located (usually pointing in `.xdata`). #### [` version `]() inline uint32\_t version() const Describes the version of the remaining `.xdata`. Currently (2025-01-04), only version 0 is defined, so values of 1-3 aren’t permitted. #### [` X `]() inline uint8\_t X() const 1-bit field that indicates the presence (1) or absence (0) of exception data. #### [` E `]() inline uint8\_t E() const 1-bit field that indicates that information describing a single epilog is packed into the header (1) rather than requiring more scope words later (0). #### [` epilog_count `]() inline uint16\_t epilog\_count() const **If [E()]() == 0**, specifies the count of the total number of epilog scopes. Otherwise, return 0 #### [` epilog_offset `]() inline uint16\_t epilog\_offset() const **If [E()]() == 1**, index of the first unwind code that describes the one and only epilog. #### [` code_words `]() inline uint32\_t code\_words() const Number of 32-bit words needed to contain all the unwind codes. #### [` exception_handler `]() inline uint32\_t exception\_handler() const Exception handler RVA (if any). #### [` unwind_code `]() inline span<const uint8\_t> unwind\_code() const Bytes that contain the unwind codes. #### [` unwind_code `]() inline span<uint8\_t> unwind\_code() #### [` is_extended `]() inline bool is\_extended() const Whether it uses 2-words encoding. #### [` epilog_scopes_offset `]() inline uint64\_t epilog\_scopes\_offset() const #### [` unwind_code_offset `]() inline uint64\_t unwind\_code\_offset() const #### [` exception_handler_offset `]() inline uint64\_t exception\_handler\_offset() const #### [` epilog_scopes `]() inline [it\_epilog\_scopes]( "LIEF::PE::unwind_aarch64::UnpackedFunction::it_epilog_scopes") epilog\_scopes() Iterator over the epilog scopes. #### [` epilog_scopes `]() inline [it\_const\_epilog\_scopes]( "LIEF::PE::unwind_aarch64::UnpackedFunction::it_const_epilog_scopes") epilog\_scopes() const #### [` xdata_rva `]() inline [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &xdata\_rva(uint32\_t value) #### [` version `]() inline [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &version(uint32\_t value) #### [` X `]() inline [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &X(uint8\_t value) #### [` E `]() inline [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &E(uint8\_t value) #### [` epilog_cnt_offset `]() inline [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &epilog\_cnt\_offset(uint16\_t value) #### [` code_words `]() inline [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &code\_words(uint32\_t value) #### [` exception_handler `]() inline [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &exception\_handler(uint32\_t value) #### [` epilog_scopes `]() inline [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &epilog\_scopes([epilog\_scopes\_t]( "LIEF::PE::unwind_aarch64::UnpackedFunction::epilog_scopes_t") scopes) #### [` unwind_code `]() inline [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &unwind\_code(std::vector<uint8\_t> code) #### [` is_extended `]() inline [UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction") &is\_extended(bool value) Public Static Functions #### [` parse `]() static std::unique\_ptr<[UnpackedFunction]( "LIEF::PE::unwind_aarch64::UnpackedFunction")> parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &strm, uint32\_t xdata\_rva, uint32\_t rva) #### [` classof `]() static inline bool classof(const [ExceptionInfo]( "LIEF::PE::ExceptionInfo") \*info) #### [` epilog_scope_t `]() struct epilog\_scope\_t This structure describes an epilog scope. Public Members ##### [` start_offset `]() uint32\_t start\_offset = 0 Offset of the epilog relatives to the start of the function. ##### [` start_index `]() uint16\_t start\_index = 0 Byte index of the first unwind code that describes this epilog. ##### [` reserved `]() uint8\_t reserved = 0 Reserved for future expansion. Should be 0. Public Static Functions ##### [` from_raw `]() static [epilog\_scope\_t]( "LIEF::PE::unwind_aarch64::UnpackedFunction::epilog_scope_t") from\_raw(uint32\_t raw) --- ## [Load Configuration]() ### [` LoadConfiguration `]() class LoadConfiguration : public LIEF::Object This class represents the load configuration data associated with the `IMAGE_LOAD_CONFIG_DIRECTORY`. This structure is frequently updated by Microsoft to add new metadata. Reference: [https://github.com/MicrosoftDocs/sdk-api/blob/cbeab4d371e8bc7e352c4d3a4c5819caa08c6a1c/sdk-api-src/content/winnt/ns-winnt-image\_load\_config\_directory64.md#L2]() Public Types #### [` IMAGE_GUARD `]() enum class IMAGE\_GUARD : uint32\_t *Values:* ##### [` NONE `]() enumerator NONE = 0x00000000 ##### [` CF_INSTRUMENTED `]() enumerator CF\_INSTRUMENTED = 0x100 Module performs control flow integrity checks using system-supplied support. ##### [` CFW_INSTRUMENTED `]() enumerator CFW\_INSTRUMENTED = 0x200 Module performs control flow and write integrity checks. ##### [` CF_FUNCTION_TABLE_PRESENT `]() enumerator CF\_FUNCTION\_TABLE\_PRESENT = 0x400 Module contains valid control flow target metadata. ##### [` SECURITY_COOKIE_UNUSED `]() enumerator SECURITY\_COOKIE\_UNUSED = 0x800 Module does not make use of the /GS security cookie. ##### [` PROTECT_DELAYLOAD_IAT `]() enumerator PROTECT\_DELAYLOAD\_IAT = 0x1000 Module supports read only delay load IAT. ##### [` DELAYLOAD_IAT_IN_ITS_OWN_SECTION `]() enumerator DELAYLOAD\_IAT\_IN\_ITS\_OWN\_SECTION = 0x2000 Delayload import table in its own .didat section (with nothing else in it) that can be freely reprotected. ##### [` CF_EXPORT_SUPPRESSION_INFO_PRESENT `]() enumerator CF\_EXPORT\_SUPPRESSION\_INFO\_PRESENT = 0x4000 Module contains suppressed export information. This also infers that the address taken IAT table is also present in the load config. ##### [` CF_ENABLE_EXPORT_SUPPRESSION `]() enumerator CF\_ENABLE\_EXPORT\_SUPPRESSION = 0x8000 Module enables suppression of exports. ##### [` CF_LONGJUMP_TABLE_PRESENT `]() enumerator CF\_LONGJUMP\_TABLE\_PRESENT = 0x10000 Module contains longjmp target information. ##### [` RF_INSTRUMENTED `]() enumerator RF\_INSTRUMENTED = 0x00020000 Module contains return flow instrumentation and metadata. ##### [` RF_ENABLE `]() enumerator RF\_ENABLE = 0x00040000 Module requests that the OS enable return flow protection. ##### [` RF_STRICT `]() enumerator RF\_STRICT = 0x00080000 Module requests that the OS enable return flow protection in strict mode. ##### [` RETPOLINE_PRESENT `]() enumerator RETPOLINE\_PRESENT = 0x00100000 Module was built with retpoline support. ##### [` EH_CONTINUATION_TABLE_PRESENT `]() enumerator EH\_CONTINUATION\_TABLE\_PRESENT = 0x400000 Module contains EH continuation target information. ##### [` XFG_ENABLED `]() enumerator XFG\_ENABLED = 0x00800000 Module was built with xfg (deprecated). ##### [` CASTGUARD_PRESENT `]() enumerator CASTGUARD\_PRESENT = 0x01000000 Module has CastGuard instrumentation present. ##### [` MEMCPY_PRESENT `]() enumerator MEMCPY\_PRESENT = 0x02000000 Module has Guarded Memcpy instrumentation present. #### [` guard_functions_t `]() using guard\_functions\_t = std::vector<[guard\_function\_t]( "LIEF::PE::LoadConfiguration::guard_function_t")> #### [` it_guard_functions `]() using it\_guard\_functions = [ref\_iterator]( "LIEF::ref_iterator")<[guard\_functions\_t]( "LIEF::PE::LoadConfiguration::guard_functions_t")&> #### [` it_const_guard_functions `]() using it\_const\_guard\_functions = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [guard\_functions\_t]( "LIEF::PE::LoadConfiguration::guard_functions_t")&> #### [` dynamic_relocations_t `]() using dynamic\_relocations\_t = std::vector<std::unique\_ptr<[DynamicRelocation]( "LIEF::PE::DynamicRelocation")>> #### [` it_dynamic_relocations_t `]() using it\_dynamic\_relocations\_t = [ref\_iterator]( "LIEF::ref_iterator")<[dynamic\_relocations\_t]( "LIEF::PE::LoadConfiguration::dynamic_relocations_t")&, [DynamicRelocation]( "LIEF::PE::DynamicRelocation")\*> #### [` it_const_dynamic_relocations_t `]() using it\_const\_dynamic\_relocations\_t = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [dynamic\_relocations\_t]( "LIEF::PE::LoadConfiguration::dynamic_relocations_t")&, const [DynamicRelocation]( "LIEF::PE::DynamicRelocation")\*> Public Functions #### [` LoadConfiguration `]() LoadConfiguration() #### [` operator= `]() [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &operator=(const [LoadConfiguration]( "LIEF::PE::LoadConfiguration")&) #### [` LoadConfiguration `]() LoadConfiguration(const [LoadConfiguration]( "LIEF::PE::LoadConfiguration::LoadConfiguration")&) #### [` LoadConfiguration `]() LoadConfiguration([LoadConfiguration]( "LIEF::PE::LoadConfiguration::LoadConfiguration")&&) #### [` operator= `]() [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &operator=([LoadConfiguration]( "LIEF::PE::LoadConfiguration")&&) #### [` characteristics `]() inline uint32\_t characteristics() const Characteristics of the structure which is defined by its size. #### [` size `]() inline uint32\_t size() const Size of the current structure. #### [` timedatestamp `]() inline uint32\_t timedatestamp() const The date and time stamp value. #### [` major_version `]() inline uint16\_t major\_version() const Major version. #### [` minor_version `]() inline uint16\_t minor\_version() const Minor version. #### [` global_flags_clear `]() inline uint32\_t global\_flags\_clear() const The global flags that control system behavior. For more information, see `Gflags.exe`. #### [` global_flags_set `]() inline uint32\_t global\_flags\_set() const The global flags that control system behavior. For more information, see `Gflags.exe`. #### [` critical_section_default_timeout `]() inline uint32\_t critical\_section\_default\_timeout() const The critical section default time-out value. #### [` decommit_free_block_threshold `]() inline uint64\_t decommit\_free\_block\_threshold() const The size of the minimum block that must be freed before it is freed (de-committed), in bytes. This value is advisory. #### [` decommit_total_free_threshold `]() inline uint64\_t decommit\_total\_free\_threshold() const The size of the minimum total memory that must be freed in the process heap before it is freed (de-committed), in bytes. This value is advisory. #### [` lock_prefix_table `]() inline uint64\_t lock\_prefix\_table() const The VA of a list of addresses where the `LOCK` prefix is used. These will be replaced by `NOP` on single-processor systems. This member is available only for x86. #### [` maximum_allocation_size `]() inline uint64\_t maximum\_allocation\_size() const The maximum allocation size, in bytes. This member is obsolete and is used only for debugging purposes. #### [` virtual_memory_threshold `]() inline uint64\_t virtual\_memory\_threshold() const The maximum block size that can be allocated from heap segments, in bytes. #### [` process_affinity_mask `]() inline uint64\_t process\_affinity\_mask() const The process affinity mask. For more information, see `GetProcessAffinityMask`. This member is available only for `.exe` files. #### [` process_heap_flags `]() inline uint32\_t process\_heap\_flags() const The process heap flags. For more information, see `HeapCreate`. #### [` csd_version `]() inline uint16\_t csd\_version() const The service pack version. #### [` reserved1 `]() inline uint16\_t reserved1() const See: [dependent\_load\_flags()](). #### [` dependent_load_flags `]() inline uint16\_t dependent\_load\_flags() const Alias for [reserved1()](). The default load flags used when the operating system resolves the statically linked imports of a module. For more information, see `LoadLibraryEx`. #### [` editlist `]() inline uint64\_t editlist() const Reserved for use by the system. #### [` security_cookie `]() inline uint64\_t security\_cookie() const A pointer to a cookie that is used by Visual C++ or GS implementation. #### [` se_handler_table `]() inline std::optional<uint64\_t> se\_handler\_table() const The VA of the sorted table of RVAs of each valid, unique handler in the image. This member is available only for x86. #### [` se_handler_count `]() inline std::optional<uint64\_t> se\_handler\_count() const The count of unique handlers in the table. This member is available only for x86. #### [` seh_functions `]() inline const std::vector<uint32\_t> &seh\_functions() const Return the list of the function RVA in the SEH table (if any). #### [` guard_cf_check_function_pointer `]() inline std::optional<uint64\_t> guard\_cf\_check\_function\_pointer() const The VA where Control Flow Guard check-function pointer is stored. #### [` guard_cf_dispatch_function_pointer `]() inline std::optional<uint64\_t> guard\_cf\_dispatch\_function\_pointer() const The VA where Control Flow Guard dispatch-function pointer is stored. #### [` guard_cf_function_table `]() inline std::optional<uint64\_t> guard\_cf\_function\_table() const The VA of the sorted table of RVAs of each Control Flow Guard function in the image. #### [` guard_cf_function_count `]() inline std::optional<uint64\_t> guard\_cf\_function\_count() const The count of unique RVAs in the [guard\_cf\_function\_table()]() table. #### [` guard_cf_functions `]() inline [it\_const\_guard\_functions]( "LIEF::PE::LoadConfiguration::it_const_guard_functions") guard\_cf\_functions() const Iterator over the Control Flow Guard functions referenced by [guard\_cf\_function\_table()](). #### [` guard_cf_functions `]() inline [it\_guard\_functions]( "LIEF::PE::LoadConfiguration::it_guard_functions") guard\_cf\_functions() #### [` guard_flags `]() inline std::optional<uint32\_t> guard\_flags() const Control Flow Guard related flags. #### [` has `]() inline bool has([IMAGE\_GUARD]( "LIEF::PE::LoadConfiguration::IMAGE_GUARD") flag) const Check if the given flag is present. #### [` guard_cf_flags_list `]() std::vector<[IMAGE\_GUARD]( "LIEF::PE::LoadConfiguration::IMAGE_GUARD")> guard\_cf\_flags\_list() const List of flags. #### [` code_integrity `]() inline const [CodeIntegrity]( "LIEF::PE::CodeIntegrity") \*code\_integrity() const Code integrity information. #### [` code_integrity `]() inline [CodeIntegrity]( "LIEF::PE::CodeIntegrity") \*code\_integrity() #### [` guard_address_taken_iat_entry_table `]() inline std::optional<uint64\_t> guard\_address\_taken\_iat\_entry\_table() const The VA where Control Flow Guard address taken IAT table is stored. #### [` guard_address_taken_iat_entry_count `]() inline std::optional<uint64\_t> guard\_address\_taken\_iat\_entry\_count() const The count of unique RVAs in the table pointed by [guard\_address\_taken\_iat\_entry\_table()](). #### [` guard_address_taken_iat_entries `]() inline [it\_const\_guard\_functions]( "LIEF::PE::LoadConfiguration::it_const_guard_functions") guard\_address\_taken\_iat\_entries() const List of RVA pointed by [guard\_address\_taken\_iat\_entry\_table()](). #### [` guard_address_taken_iat_entries `]() inline [it\_guard\_functions]( "LIEF::PE::LoadConfiguration::it_guard_functions") guard\_address\_taken\_iat\_entries() #### [` guard_long_jump_target_table `]() inline std::optional<uint64\_t> guard\_long\_jump\_target\_table() const The VA where Control Flow Guard long jump target table is stored. #### [` guard_long_jump_target_count `]() inline std::optional<uint64\_t> guard\_long\_jump\_target\_count() const The count of unique RVAs in the table pointed by guard\_long\_jump\_target\_table. #### [` guard_long_jump_targets `]() inline [it\_const\_guard\_functions]( "LIEF::PE::LoadConfiguration::it_const_guard_functions") guard\_long\_jump\_targets() const List of RVA pointed by [guard\_address\_taken\_iat\_entry\_table()](). #### [` guard_long_jump_targets `]() inline [it\_guard\_functions]( "LIEF::PE::LoadConfiguration::it_guard_functions") guard\_long\_jump\_targets() #### [` dynamic_value_reloc_table `]() inline std::optional<uint64\_t> dynamic\_value\_reloc\_table() const VA pointing to a `IMAGE_DYNAMIC_RELOCATION_TABLE`. #### [` dynamic_relocations `]() inline [it\_dynamic\_relocations\_t]( "LIEF::PE::LoadConfiguration::it_dynamic_relocations_t") dynamic\_relocations() Return an iterator over the Dynamic relocations (DVRT). #### [` dynamic_relocations `]() inline [it\_const\_dynamic\_relocations\_t]( "LIEF::PE::LoadConfiguration::it_const_dynamic_relocations_t") dynamic\_relocations() const #### [` hybrid_metadata_pointer `]() inline std::optional<uint64\_t> hybrid\_metadata\_pointer() const Alias for [chpe\_metadata\_pointer()](). #### [` chpe_metadata_pointer `]() inline std::optional<uint64\_t> chpe\_metadata\_pointer() const VA to the extra Compiled Hybrid Portable Executable (CHPE) metadata. #### [` chpe_metadata `]() inline const [CHPEMetadata]( "LIEF::PE::CHPEMetadata") \*chpe\_metadata() const Compiled Hybrid Portable Executable (CHPE) metadata (if any). #### [` chpe_metadata `]() inline [CHPEMetadata]( "LIEF::PE::CHPEMetadata") \*chpe\_metadata() #### [` guard_rf_failure_routine `]() inline std::optional<uint64\_t> guard\_rf\_failure\_routine() const VA of the failure routine. #### [` guard_rf_failure_routine_function_pointer `]() inline std::optional<uint64\_t> guard\_rf\_failure\_routine\_function\_pointer() const VA of the failure routine `fptr`. #### [` dynamic_value_reloctable_offset `]() inline std::optional<uint32\_t> dynamic\_value\_reloctable\_offset() const Offset of dynamic relocation table relative to the relocation table. #### [` dynamic_value_reloctable_section `]() inline std::optional<uint16\_t> dynamic\_value\_reloctable\_section() const The section index of the dynamic value relocation table. #### [` reserved2 `]() inline std::optional<uint16\_t> reserved2() const Must be zero. #### [` guard_rf_verify_stackpointer_function_pointer `]() inline std::optional<uint64\_t> guard\_rf\_verify\_stackpointer\_function\_pointer() const VA of the [Function]() verifying the stack pointer. #### [` hotpatch_table_offset `]() inline std::optional<uint32\_t> hotpatch\_table\_offset() const Offset to the *hotpatch* table. #### [` reserved3 `]() inline std::optional<uint32\_t> reserved3() const #### [` enclave_configuration_ptr `]() inline std::optional<uint64\_t> enclave\_configuration\_ptr() const #### [` enclave_config `]() inline const [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") \*enclave\_config() const #### [` enclave_config `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") \*enclave\_config() #### [` volatile_metadata_pointer `]() inline std::optional<uint64\_t> volatile\_metadata\_pointer() const #### [` volatile_metadata `]() inline const [VolatileMetadata]( "LIEF::PE::VolatileMetadata") \*volatile\_metadata() const #### [` volatile_metadata `]() inline [VolatileMetadata]( "LIEF::PE::VolatileMetadata") \*volatile\_metadata() #### [` guard_eh_continuation_table `]() inline std::optional<uint64\_t> guard\_eh\_continuation\_table() const #### [` guard_eh_continuation_count `]() inline std::optional<uint64\_t> guard\_eh\_continuation\_count() const #### [` guard_eh_continuation_functions `]() inline [it\_const\_guard\_functions]( "LIEF::PE::LoadConfiguration::it_const_guard_functions") guard\_eh\_continuation\_functions() const #### [` guard_eh_continuation_functions `]() inline [it\_guard\_functions]( "LIEF::PE::LoadConfiguration::it_guard_functions") guard\_eh\_continuation\_functions() #### [` guard_xfg_check_function_pointer `]() inline std::optional<uint64\_t> guard\_xfg\_check\_function\_pointer() const #### [` guard_xfg_dispatch_function_pointer `]() inline std::optional<uint64\_t> guard\_xfg\_dispatch\_function\_pointer() const #### [` guard_xfg_table_dispatch_function_pointer `]() inline std::optional<uint64\_t> guard\_xfg\_table\_dispatch\_function\_pointer() const #### [` cast_guard_os_determined_failure_mode `]() inline std::optional<uint64\_t> cast\_guard\_os\_determined\_failure\_mode() const #### [` guard_memcpy_function_pointer `]() inline std::optional<uint64\_t> guard\_memcpy\_function\_pointer() const #### [` uma_function_pointers `]() inline std::optional<uint64\_t> uma\_function\_pointers() const #### [` characteristics `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &characteristics(uint32\_t characteristics) #### [` size `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &size(uint32\_t value) #### [` timedatestamp `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &timedatestamp(uint32\_t timedatestamp) #### [` major_version `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &major\_version(uint16\_t major\_version) #### [` minor_version `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &minor\_version(uint16\_t minor\_version) #### [` global_flags_clear `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &global\_flags\_clear(uint32\_t global\_flags\_clear) #### [` global_flags_set `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &global\_flags\_set(uint32\_t global\_flags\_set) #### [` critical_section_default_timeout `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &critical\_section\_default\_timeout(uint32\_t critical\_section\_default\_timeout) #### [` decommit_free_block_threshold `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &decommit\_free\_block\_threshold(uint64\_t decommit\_free\_block\_threshold) #### [` decommit_total_free_threshold `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &decommit\_total\_free\_threshold(uint64\_t decommit\_total\_free\_threshold) #### [` lock_prefix_table `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &lock\_prefix\_table(uint64\_t lock\_prefix\_table) #### [` maximum_allocation_size `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &maximum\_allocation\_size(uint64\_t maximum\_allocation\_size) #### [` virtual_memory_threshold `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &virtual\_memory\_threshold(uint64\_t virtual\_memory\_threshold) #### [` process_affinity_mask `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &process\_affinity\_mask(uint64\_t process\_affinity\_mask) #### [` process_heap_flags `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &process\_heap\_flags(uint32\_t process\_heap\_flagsid) #### [` csd_version `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &csd\_version(uint16\_t csd\_version) #### [` reserved1 `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &reserved1(uint16\_t reserved1) #### [` dependent_load_flags `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &dependent\_load\_flags(uint16\_t flags) #### [` editlist `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &editlist(uint64\_t editlist) #### [` security_cookie `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &security\_cookie(uint64\_t security\_cookie) #### [` se_handler_table `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &se\_handler\_table(uint64\_t se\_handler\_table) #### [` se_handler_count `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &se\_handler\_count(uint64\_t se\_handler\_count) #### [` guard_cf_check_function_pointer `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_cf\_check\_function\_pointer(uint64\_t check\_pointer) #### [` guard_cf_dispatch_function_pointer `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_cf\_dispatch\_function\_pointer(uint64\_t dispatch\_pointer) #### [` guard_cf_function_table `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_cf\_function\_table(uint64\_t guard\_cf\_function\_table) #### [` guard_cf_function_count `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_cf\_function\_count(uint64\_t guard\_cf\_function\_count) #### [` guard_flags `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_flags([IMAGE\_GUARD]( "LIEF::PE::LoadConfiguration::IMAGE_GUARD") flags) #### [` guard_flags `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_flags(uint32\_t flags) #### [` code_integrity `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &code\_integrity([CodeIntegrity]( "LIEF::PE::CodeIntegrity") CI) #### [` guard_address_taken_iat_entry_table `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_address\_taken\_iat\_entry\_table(uint64\_t value) #### [` guard_address_taken_iat_entry_count `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_address\_taken\_iat\_entry\_count(uint64\_t value) #### [` guard_long_jump_target_table `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_long\_jump\_target\_table(uint64\_t value) #### [` guard_long_jump_target_count `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_long\_jump\_target\_count(uint64\_t value) #### [` dynamic_value_reloc_table `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &dynamic\_value\_reloc\_table(uint64\_t value) #### [` hybrid_metadata_pointer `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &hybrid\_metadata\_pointer(uint64\_t value) #### [` guard_rf_failure_routine `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_rf\_failure\_routine(uint64\_t value) #### [` guard_rf_failure_routine_function_pointer `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_rf\_failure\_routine\_function\_pointer(uint64\_t value) #### [` dynamic_value_reloctable_offset `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &dynamic\_value\_reloctable\_offset(uint32\_t value) #### [` dynamic_value_reloctable_section `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &dynamic\_value\_reloctable\_section(uint16\_t value) #### [` reserved2 `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &reserved2(uint16\_t value) #### [` guard_rf_verify_stackpointer_function_pointer `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_rf\_verify\_stackpointer\_function\_pointer(uint64\_t value) #### [` hotpatch_table_offset `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &hotpatch\_table\_offset(uint32\_t value) #### [` reserved3 `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &reserved3(uint32\_t value) #### [` enclave_configuration_ptr `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &enclave\_configuration\_ptr(uint64\_t value) #### [` volatile_metadata_pointer `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &volatile\_metadata\_pointer(uint64\_t value) #### [` guard_eh_continuation_table `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_eh\_continuation\_table(uint64\_t value) #### [` guard_eh_continuation_count `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_eh\_continuation\_count(uint64\_t value) #### [` guard_xfg_check_function_pointer `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_xfg\_check\_function\_pointer(uint64\_t value) #### [` guard_xfg_dispatch_function_pointer `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_xfg\_dispatch\_function\_pointer(uint64\_t value) #### [` guard_xfg_table_dispatch_function_pointer `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_xfg\_table\_dispatch\_function\_pointer(uint64\_t value) #### [` cast_guard_os_determined_failure_mode `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &cast\_guard\_os\_determined\_failure\_mode(uint64\_t value) #### [` guard_memcpy_function_pointer `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &guard\_memcpy\_function\_pointer(uint64\_t value) #### [` uma_function_pointers `]() inline [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &uma\_function\_pointers(uint64\_t value) #### [` ~LoadConfiguration `]() ~LoadConfiguration() override #### [` accept `]() virtual void accept(Visitor &visitor) const override #### [` to_string `]() std::string to\_string() const Public Static Functions #### [` PE_Tparse `]() template<class PE\_T> static std::unique\_ptr<[LoadConfiguration]( "LIEF::PE::LoadConfiguration")> parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &stream) Friends **friend class Parser** #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [LoadConfiguration]( "LIEF::PE::LoadConfiguration") &config) #### [` guard_function_t `]() struct guard\_function\_t Public Members ##### [` rva `]() uint32\_t rva = 0 ##### [` extra `]() uint32\_t extra = 0 --- ## [CHPEMetadata]() ### [` CHPEMetadata `]() class CHPEMetadata Base class for any Compiled Hybrid Portable Executable (CHPE) metadata. This class is inherited by architecture-specific implementation. Subclassed by [LIEF::PE::CHPEMetadataARM64](), [LIEF::PE::CHPEMetadataX86]() Public Types #### [` KIND `]() enum class KIND Discriminator for the subclasses. *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 ##### [` ARM64 `]() enumerator ARM64 ##### [` X86 `]() enumerator X86 Public Functions #### [` CHPEMetadata `]() CHPEMetadata() = default #### [` CHPEMetadata `]() inline CHPEMetadata([KIND]( "LIEF::PE::CHPEMetadata::KIND") kind, uint32\_t version) #### [` CHPEMetadata `]() CHPEMetadata(const [CHPEMetadata]( "LIEF::PE::CHPEMetadata::CHPEMetadata")&) = default #### [` operator= `]() [CHPEMetadata]( "LIEF::PE::CHPEMetadata") &operator=(const [CHPEMetadata]( "LIEF::PE::CHPEMetadata")&) = default #### [` CHPEMetadata `]() CHPEMetadata([CHPEMetadata]( "LIEF::PE::CHPEMetadata::CHPEMetadata")&&) = default #### [` operator= `]() [CHPEMetadata]( "LIEF::PE::CHPEMetadata") &operator=([CHPEMetadata]( "LIEF::PE::CHPEMetadata")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[CHPEMetadata]( "LIEF::PE::CHPEMetadata")> clone() const #### [` kind `]() inline [KIND]( "LIEF::PE::CHPEMetadata::KIND") kind() const Determine the type of the concrete implementation. #### [` version `]() inline uint32\_t version() const Version of the structure. #### [` to_string `]() inline virtual std::string to\_string() const #### [` Tas `]() template<class T> inline [T]( "LIEF::PE::CHPEMetadata::as::T") \*as() #### [` Tas `]() template<class T> inline const [T]( "LIEF::PE::CHPEMetadata::as::T") \*as() const #### [` ~CHPEMetadata `]() virtual ~CHPEMetadata() = default Public Static Functions #### [` parse `]() static std::unique\_ptr<[CHPEMetadata]( "LIEF::PE::CHPEMetadata")> parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &stream) Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [CHPEMetadata]( "LIEF::PE::CHPEMetadata") &meta) ## [CHPEMetadata (ARM64)]() ### [` CHPEMetadataARM64 `]() class CHPEMetadataARM64 : public LIEF::PE::[CHPEMetadata]( "LIEF::PE::CHPEMetadata") This class represents ARM64-specific metadata used in CHPE (Compatible Hybrid PE) binaries, particularly for hybrid architectures like ARM64EC and ARM64X. It extends the [CHPEMetadata]() base class and provides access to metadata describing code ranges, redirections, entry points, and other hybrid-specific information relevant for binary analysis or instrumentation. Public Types #### [` range_entries_t `]() using range\_entries\_t = std::vector<[range\_entry\_t]( "LIEF::PE::CHPEMetadataARM64::range_entry_t")> #### [` it_range_entries `]() using it\_range\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[range\_entries\_t]( "LIEF::PE::CHPEMetadataARM64::range_entries_t")&> #### [` it_const_range_entries `]() using it\_const\_range\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [range\_entries\_t]( "LIEF::PE::CHPEMetadataARM64::range_entries_t")&> #### [` redirection_entries_t `]() using redirection\_entries\_t = std::vector<[redirection\_entry\_t]( "LIEF::PE::CHPEMetadataARM64::redirection_entry_t")> #### [` it_redirection_entries `]() using it\_redirection\_entries = [ref\_iterator]( "LIEF::ref_iterator")<[redirection\_entries\_t]( "LIEF::PE::CHPEMetadataARM64::redirection_entries_t")&> #### [` it_const_redirection_entries `]() using it\_const\_redirection\_entries = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [redirection\_entries\_t]( "LIEF::PE::CHPEMetadataARM64::redirection_entries_t")&> #### [` code_range_entry_point_entries `]() using code\_range\_entry\_point\_entries = std::vector<[code\_range\_entry\_point\_t]( "LIEF::PE::CHPEMetadataARM64::code_range_entry_point_t")> #### [` it_code_range_entry_point `]() using it\_code\_range\_entry\_point = [ref\_iterator]( "LIEF::ref_iterator")<[code\_range\_entry\_point\_entries]( "LIEF::PE::CHPEMetadataARM64::code_range_entry_point_entries")&> #### [` it_const_code_range_entry_point `]() using it\_const\_code\_range\_entry\_point = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [code\_range\_entry\_point\_entries]( "LIEF::PE::CHPEMetadataARM64::code_range_entry_point_entries")&> Public Functions #### [` CHPEMetadataARM64 `]() inline CHPEMetadataARM64(uint32\_t version) #### [` CHPEMetadataARM64 `]() CHPEMetadataARM64(const [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64::CHPEMetadataARM64")&) = default #### [` operator= `]() [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &operator=(const [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64")&) = default #### [` CHPEMetadataARM64 `]() CHPEMetadataARM64([CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64::CHPEMetadataARM64")&&) = default #### [` operator= `]() [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &operator=([CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[CHPEMetadata]( "LIEF::PE::CHPEMetadata")> clone() const override #### [` code_map `]() inline uint32\_t code\_map() const RVA to the array that describes architecture-specific ranges. #### [` code_map_count `]() inline uint32\_t code\_map\_count() const Number of entries in the code map. #### [` code_ranges_to_entrypoints `]() inline uint32\_t code\_ranges\_to\_entrypoints() const #### [` redirection_metadata `]() inline uint32\_t redirection\_metadata() const #### [` os_arm64x_dispatch_call_no_redirect `]() inline uint32\_t os\_arm64x\_dispatch\_call\_no\_redirect() const #### [` os_arm64x_dispatch_ret `]() inline uint32\_t os\_arm64x\_dispatch\_ret() const #### [` os_arm64x_dispatch_call `]() inline uint32\_t os\_arm64x\_dispatch\_call() const #### [` os_arm64x_dispatch_icall `]() inline uint32\_t os\_arm64x\_dispatch\_icall() const #### [` os_arm64x_dispatch_icall_cfg `]() inline uint32\_t os\_arm64x\_dispatch\_icall\_cfg() const #### [` alternate_entry_point `]() inline uint32\_t alternate\_entry\_point() const #### [` auxiliary_iat `]() inline uint32\_t auxiliary\_iat() const #### [` code_ranges_to_entry_points_count `]() inline uint32\_t code\_ranges\_to\_entry\_points\_count() const #### [` redirection_metadata_count `]() inline uint32\_t redirection\_metadata\_count() const #### [` get_x64_information_function_pointer `]() inline uint32\_t get\_x64\_information\_function\_pointer() const #### [` set_x64_information_function_pointer `]() inline uint32\_t set\_x64\_information\_function\_pointer() const #### [` extra_rfe_table `]() inline uint32\_t extra\_rfe\_table() const RVA to this architecture-specific exception table. #### [` extra_rfe_table_size `]() inline uint32\_t extra\_rfe\_table\_size() const architecture-specific exception table size #### [` os_arm64x_dispatch_fptr `]() inline uint32\_t os\_arm64x\_dispatch\_fptr() const #### [` auxiliary_iat_copy `]() inline uint32\_t auxiliary\_iat\_copy() const #### [` auxiliary_delay_import `]() inline uint32\_t auxiliary\_delay\_import() const #### [` auxiliary_delay_import_copy `]() inline uint32\_t auxiliary\_delay\_import\_copy() const #### [` bitfield_info `]() inline uint32\_t bitfield\_info() const #### [` code_ranges `]() inline [it\_range\_entries]( "LIEF::PE::CHPEMetadataARM64::it_range_entries") code\_ranges() #### [` code_ranges `]() inline [it\_const\_range\_entries]( "LIEF::PE::CHPEMetadataARM64::it_const_range_entries") code\_ranges() const #### [` redirections `]() inline [it\_redirection\_entries]( "LIEF::PE::CHPEMetadataARM64::it_redirection_entries") redirections() #### [` redirections `]() inline [it\_const\_redirection\_entries]( "LIEF::PE::CHPEMetadataARM64::it_const_redirection_entries") redirections() const #### [` code_range_entry_point `]() inline [it\_code\_range\_entry\_point]( "LIEF::PE::CHPEMetadataARM64::it_code_range_entry_point") code\_range\_entry\_point() #### [` code_range_entry_point `]() inline [it\_const\_code\_range\_entry\_point]( "LIEF::PE::CHPEMetadataARM64::it_const_code_range_entry_point") code\_range\_entry\_point() const #### [` code_map `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &code\_map(uint32\_t value) #### [` code_map_count `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &code\_map\_count(uint32\_t value) #### [` code_ranges_to_entrypoints `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &code\_ranges\_to\_entrypoints(uint32\_t value) #### [` redirection_metadata `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &redirection\_metadata(uint32\_t value) #### [` os_arm64x_dispatch_call_no_redirect `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &os\_arm64x\_dispatch\_call\_no\_redirect(uint32\_t value) #### [` os_arm64x_dispatch_ret `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &os\_arm64x\_dispatch\_ret(uint32\_t value) #### [` os_arm64x_dispatch_call `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &os\_arm64x\_dispatch\_call(uint32\_t value) #### [` os_arm64x_dispatch_icall `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &os\_arm64x\_dispatch\_icall(uint32\_t value) #### [` os_arm64x_dispatch_icall_cfg `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &os\_arm64x\_dispatch\_icall\_cfg(uint32\_t value) #### [` alternate_entry_point `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &alternate\_entry\_point(uint32\_t value) #### [` auxiliary_iat `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &auxiliary\_iat(uint32\_t value) #### [` code_ranges_to_entry_points_count `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &code\_ranges\_to\_entry\_points\_count(uint32\_t value) #### [` redirection_metadata_count `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &redirection\_metadata\_count(uint32\_t value) #### [` get_x64_information_function_pointer `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &get\_x64\_information\_function\_pointer(uint32\_t value) #### [` set_x64_information_function_pointer `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &set\_x64\_information\_function\_pointer(uint32\_t value) #### [` extra_rfe_table `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &extra\_rfe\_table(uint32\_t value) #### [` extra_rfe_table_size `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &extra\_rfe\_table\_size(uint32\_t value) #### [` os_arm64x_dispatch_fptr `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &os\_arm64x\_dispatch\_fptr(uint32\_t value) #### [` auxiliary_iat_copy `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &auxiliary\_iat\_copy(uint32\_t value) #### [` auxiliary_delay_import `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &auxiliary\_delay\_import(uint32\_t value) #### [` auxiliary_delay_import_copy `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &auxiliary\_delay\_import\_copy(uint32\_t value) #### [` bitfield_info `]() inline [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &bitfield\_info(uint32\_t value) #### [` to_string `]() virtual std::string to\_string() const override #### [` ~CHPEMetadataARM64 `]() ~CHPEMetadataARM64() override = default Public Static Functions #### [` parse `]() static std::unique\_ptr<[CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64")> parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &stream, uint32\_t version) #### [` parse_code_map `]() static [ok\_error\_t]( "LIEF::ok_error_t") parse\_code\_map([Parser]( "LIEF::PE::Parser") &ctx, [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &metadata) #### [` parse_redirections `]() static [ok\_error\_t]( "LIEF::ok_error_t") parse\_redirections([Parser]( "LIEF::PE::Parser") &ctx, [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &metadata) #### [` parse_code_ranges_to_entry_points `]() static [ok\_error\_t]( "LIEF::ok_error_t") parse\_code\_ranges\_to\_entry\_points([Parser]( "LIEF::PE::Parser") &ctx, [CHPEMetadataARM64]( "LIEF::PE::CHPEMetadataARM64") &metadata) #### [` classof `]() static inline bool classof(const [CHPEMetadata]( "LIEF::PE::CHPEMetadata") \*meta) #### [` range_entry_t `]() struct range\_entry\_t Structure that describes architecture-specific ranges. Public Types ##### [` TYPE `]() enum class TYPE *Values:* ###### [` ARM64 `]() enumerator ARM64 = 0 Pure ARM64 code. ###### [` ARM64EC `]() enumerator ARM64EC = 1 ARM64EC hybrid code (compatible with x64). ###### [` AMD64 `]() enumerator AMD64 = 2 x64 code. Public Functions ##### [` start `]() inline uint32\_t start() const Start of the range (RVA). ##### [` type `]() inline [TYPE]( "LIEF::PE::CHPEMetadataARM64::range_entry_t::TYPE") type() const Architecture for this range. ##### [` end `]() inline uint32\_t end() const End of the range (RVA). Public Members ##### [` start_offset `]() uint32\_t start\_offset = 0 Raw data (include start RVA and type). ##### [` length `]() uint32\_t length = 0 Range’s length. Public Static Attributes ##### [` TYPE_MASK `]() static uint32\_t TYPE\_MASK = 3 #### [` redirection_entry_t `]() struct redirection\_entry\_t Structure that describes a redirection. Public Members ##### [` src `]() uint32\_t src = 0 ##### [` dst `]() uint32\_t dst = 0 #### [` code_range_entry_point_t `]() struct code\_range\_entry\_point\_t Mirror of `IMAGE_ARM64EC_CODE_RANGE_ENTRY_POINT`: Represents a mapping between code range and its entry point. Public Members ##### [` start_rva `]() uint32\_t start\_rva = 0 Start of the code range. ##### [` end_rva `]() uint32\_t end\_rva = 0 End of the code range (RVA). ##### [` entrypoint `]() uint32\_t entrypoint = 0 RVA of the entry point for this range. ## [CHPEMetadata (X86)]() ### [` CHPEMetadataX86 `]() class CHPEMetadataX86 : public LIEF::PE::[CHPEMetadata]( "LIEF::PE::CHPEMetadata") This class represents hybrid metadata for X86. Public Functions #### [` CHPEMetadataX86 `]() inline CHPEMetadataX86(uint32\_t version) #### [` CHPEMetadataX86 `]() CHPEMetadataX86(const [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86::CHPEMetadataX86")&) = default #### [` operator= `]() [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &operator=(const [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86")&) = default #### [` CHPEMetadataX86 `]() CHPEMetadataX86([CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86::CHPEMetadataX86")&&) = default #### [` operator= `]() [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &operator=([CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[CHPEMetadata]( "LIEF::PE::CHPEMetadata")> clone() const override #### [` chpe_code_address_range_offset `]() inline uint32\_t chpe\_code\_address\_range\_offset() const #### [` chpe_code_address_range_count `]() inline uint32\_t chpe\_code\_address\_range\_count() const #### [` wowa64_exception_handler_function_pointer `]() inline uint32\_t wowa64\_exception\_handler\_function\_pointer() const #### [` wowa64_dispatch_call_function_pointer `]() inline uint32\_t wowa64\_dispatch\_call\_function\_pointer() const #### [` wowa64_dispatch_indirect_call_function_pointer `]() inline uint32\_t wowa64\_dispatch\_indirect\_call\_function\_pointer() const #### [` wowa64_dispatch_indirect_call_cfg_function_pointer `]() inline uint32\_t wowa64\_dispatch\_indirect\_call\_cfg\_function\_pointer() const #### [` wowa64_dispatch_ret_function_pointer `]() inline uint32\_t wowa64\_dispatch\_ret\_function\_pointer() const #### [` wowa64_dispatch_ret_leaf_function_pointer `]() inline uint32\_t wowa64\_dispatch\_ret\_leaf\_function\_pointer() const #### [` wowa64_dispatch_jump_function_pointer `]() inline uint32\_t wowa64\_dispatch\_jump\_function\_pointer() const #### [` compiler_iat_pointer `]() inline std::optional<uint32\_t> compiler\_iat\_pointer() const #### [` wowa64_rdtsc_function_pointer `]() inline std::optional<uint32\_t> wowa64\_rdtsc\_function\_pointer() const #### [` chpe_code_address_range_offset `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &chpe\_code\_address\_range\_offset(uint32\_t value) #### [` chpe_code_address_range_count `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &chpe\_code\_address\_range\_count(uint32\_t value) #### [` wowa64_exception_handler_function_pointer `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &wowa64\_exception\_handler\_function\_pointer(uint32\_t value) #### [` wowa64_dispatch_call_function_pointer `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &wowa64\_dispatch\_call\_function\_pointer(uint32\_t value) #### [` wowa64_dispatch_indirect_call_function_pointer `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &wowa64\_dispatch\_indirect\_call\_function\_pointer(uint32\_t value) #### [` wowa64_dispatch_indirect_call_cfg_function_pointer `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &wowa64\_dispatch\_indirect\_call\_cfg\_function\_pointer(uint32\_t value) #### [` wowa64_dispatch_ret_function_pointer `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &wowa64\_dispatch\_ret\_function\_pointer(uint32\_t value) #### [` wowa64_dispatch_ret_leaf_function_pointer `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &wowa64\_dispatch\_ret\_leaf\_function\_pointer(uint32\_t value) #### [` wowa64_dispatch_jump_function_pointer `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &wowa64\_dispatch\_jump\_function\_pointer(uint32\_t value) #### [` compiler_iat_pointer `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &compiler\_iat\_pointer(uint32\_t value) #### [` wowa64_rdtsc_function_pointer `]() inline [CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86") &wowa64\_rdtsc\_function\_pointer(uint32\_t value) #### [` to_string `]() virtual std::string to\_string() const override #### [` ~CHPEMetadataX86 `]() ~CHPEMetadataX86() override = default Public Static Functions #### [` parse `]() static std::unique\_ptr<[CHPEMetadataX86]( "LIEF::PE::CHPEMetadataX86")> parse([Parser]( "LIEF::PE::Parser") &ctx, [BinaryStream]( "LIEF::BinaryStream") &stream, uint32\_t version) #### [` classof `]() static inline bool classof(const [CHPEMetadata]( "LIEF::PE::CHPEMetadata") \*meta) --- ## [DynamicRelocation]() ### [` DynamicRelocation `]() class DynamicRelocation This is the base class for any `IMAGE_DYNAMIC_RELOCATION32`, `IMAGE_DYNAMIC_RELOCATION32_V2`, `IMAGE_DYNAMIC_RELOCATION64`, `IMAGE_DYNAMIC_RELOCATION64_V2` dynamic relocations. Subclassed by [LIEF::PE::DynamicRelocationV1](), [LIEF::PE::DynamicRelocationV2]() Public Types #### [` IMAGE_DYNAMIC_RELOCATION `]() enum IMAGE\_DYNAMIC\_RELOCATION Special symbol values as defined in `link.exe - GetDVRTSpecialSymbolName`. *Values:* ##### [` RELOCATION_GUARD_RF_PROLOGUE `]() enumerator RELOCATION\_GUARD\_RF\_PROLOGUE = 1 Mirror `IMAGE_DYNAMIC_RELOCATION_GUARD_RF_PROLOGUE`. ##### [` RELOCATION_GUARD_RF_EPILOGUE `]() enumerator RELOCATION\_GUARD\_RF\_EPILOGUE = 2 Mirror `IMAGE_DYNAMIC_RELOCATION_GUARD_RF_EPILOGUE`. ##### [` RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER `]() enumerator RELOCATION\_GUARD\_IMPORT\_CONTROL\_TRANSFER = 3 Mirror `IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER`. ##### [` RELOCATION_GUARD_INDIR_CONTROL_TRANSFER `]() enumerator RELOCATION\_GUARD\_INDIR\_CONTROL\_TRANSFER = 4 Mirror `IMAGE_DYNAMIC_RELOCATION_GUARD_INDIR_CONTROL_TRANSFER`. ##### [` RELOCATION_GUARD_SWITCHTABLE_BRANCH `]() enumerator RELOCATION\_GUARD\_SWITCHTABLE\_BRANCH = 5 Mirror `IMAGE_DYNAMIC_RELOCATION_GUARD_SWITCHTABLE_BRANCH`. ##### [` RELOCATION_ARM64X `]() enumerator RELOCATION\_ARM64X = 6 Mirror `IMAGE_DYNAMIC_RELOCATION_ARM64X`. ##### [` RELOCATION_FUNCTION_OVERRIDE `]() enumerator RELOCATION\_FUNCTION\_OVERRIDE = 7 Mirror `IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE`. ##### [` RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER `]() enumerator RELOCATION\_ARM64\_KERNEL\_IMPORT\_CALL\_TRANSFER = 8 Mirror `IMAGE_DYNAMIC_RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER`. ##### [` _RELOC_LAST_ENTRY `]() enumerator \_RELOC\_LAST\_ENTRY Public Functions #### [` DynamicRelocation `]() DynamicRelocation() = delete #### [` DynamicRelocation `]() DynamicRelocation(uint32\_t version) #### [` DynamicRelocation `]() DynamicRelocation(const [DynamicRelocation]( "LIEF::PE::DynamicRelocation::DynamicRelocation")&) #### [` operator= `]() [DynamicRelocation]( "LIEF::PE::DynamicRelocation") &operator=(const [DynamicRelocation]( "LIEF::PE::DynamicRelocation")&) #### [` DynamicRelocation `]() DynamicRelocation([DynamicRelocation]( "LIEF::PE::DynamicRelocation::DynamicRelocation")&&) #### [` operator= `]() [DynamicRelocation]( "LIEF::PE::DynamicRelocation") &operator=([DynamicRelocation]( "LIEF::PE::DynamicRelocation")&&) #### [` clone `]() virtual std::unique\_ptr<[DynamicRelocation]( "LIEF::PE::DynamicRelocation")> clone() const = 0 #### [` version `]() inline uint32\_t version() const Version of the structure. #### [` symbol `]() inline uint64\_t symbol() const [Symbol]() address. Some values have a special meaning (c.f. [IMAGE\_DYNAMIC\_RELOCATION]()) and define how fixups are encoded. #### [` fixups `]() inline const [DynamicFixup]( "LIEF::PE::DynamicFixup") \*fixups() const #### [` fixups `]() inline [DynamicFixup]( "LIEF::PE::DynamicFixup") \*fixups() Return fixups information, where the interpretation may depend on the symbol’s value. #### [` symbol `]() inline [DynamicRelocation]( "LIEF::PE::DynamicRelocation") &symbol(uint64\_t value) #### [` fixups `]() [DynamicRelocation]( "LIEF::PE::DynamicRelocation") &fixups(std::unique\_ptr<[DynamicFixup]( "LIEF::PE::DynamicFixup")> F) #### [` to_string `]() virtual std::string to\_string() const = 0 #### [` Tas `]() template<class T> inline [T]( "LIEF::PE::DynamicRelocation::as::T") \*as() #### [` Tas `]() template<class T> inline const [T]( "LIEF::PE::DynamicRelocation::as::T") \*as() const #### [` ~DynamicRelocation `]() virtual ~DynamicRelocation() Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [DynamicRelocation]( "LIEF::PE::DynamicRelocation") &reloc) ## [DynamicRelocationV1]() ### [` DynamicRelocationV1 `]() class DynamicRelocationV1 : public LIEF::PE::[DynamicRelocation]( "LIEF::PE::DynamicRelocation") This class represents a dynamic relocation (`IMAGE_DYNAMIC_RELOCATION32` or `IMAGE_DYNAMIC_RELOCATION64`). Public Functions #### [` DynamicRelocationV1 `]() inline DynamicRelocationV1() #### [` DynamicRelocationV1 `]() DynamicRelocationV1(const [DynamicRelocationV1]( "LIEF::PE::DynamicRelocationV1::DynamicRelocationV1")&) = default #### [` operator= `]() [DynamicRelocationV1]( "LIEF::PE::DynamicRelocationV1") &operator=(const [DynamicRelocationV1]( "LIEF::PE::DynamicRelocationV1")&) = default #### [` DynamicRelocationV1 `]() DynamicRelocationV1([DynamicRelocationV1]( "LIEF::PE::DynamicRelocationV1::DynamicRelocationV1")&&) = default #### [` operator= `]() [DynamicRelocationV1]( "LIEF::PE::DynamicRelocationV1") &operator=([DynamicRelocationV1]( "LIEF::PE::DynamicRelocationV1")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[DynamicRelocation]( "LIEF::PE::DynamicRelocation")> clone() const override #### [` to_string `]() virtual std::string to\_string() const override #### [` ~DynamicRelocationV1 `]() ~DynamicRelocationV1() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicRelocation]( "LIEF::PE::DynamicRelocation") \*reloc) ## [DynamicRelocationV2]() ### [` DynamicRelocationV2 `]() class DynamicRelocationV2 : public LIEF::PE::[DynamicRelocation]( "LIEF::PE::DynamicRelocation") This class represents a dynamic relocation (`IMAGE_DYNAMIC_RELOCATION64_V2` or `IMAGE_DYNAMIC_RELOCATION32_V2`). Public Functions #### [` DynamicRelocationV2 `]() inline DynamicRelocationV2() #### [` DynamicRelocationV2 `]() DynamicRelocationV2(const [DynamicRelocationV2]( "LIEF::PE::DynamicRelocationV2::DynamicRelocationV2")&) = default #### [` operator= `]() [DynamicRelocationV2]( "LIEF::PE::DynamicRelocationV2") &operator=(const [DynamicRelocationV2]( "LIEF::PE::DynamicRelocationV2")&) = default #### [` DynamicRelocationV2 `]() DynamicRelocationV2([DynamicRelocationV2]( "LIEF::PE::DynamicRelocationV2::DynamicRelocationV2")&&) = default #### [` operator= `]() [DynamicRelocationV2]( "LIEF::PE::DynamicRelocationV2") &operator=([DynamicRelocationV2]( "LIEF::PE::DynamicRelocationV2")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[DynamicRelocation]( "LIEF::PE::DynamicRelocation")> clone() const override #### [` to_string `]() virtual std::string to\_string() const override #### [` ~DynamicRelocationV2 `]() ~DynamicRelocationV2() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicRelocation]( "LIEF::PE::DynamicRelocation") \*reloc) --- ## [DynamicFixup]() ### [` DynamicFixup `]() class DynamicFixup This is the base class for any fixups located in [DynamicRelocation](). Subclassed by [LIEF::PE::DynamicFixupARM64Kernel](), [LIEF::PE::DynamicFixupARM64X](), [LIEF::PE::DynamicFixupControlTransfer](), [LIEF::PE::DynamicFixupGeneric](), [LIEF::PE::DynamicFixupUnknown](), [LIEF::PE::FunctionOverride]() Public Types #### [` KIND `]() enum KIND *Values:* ##### [` UNKNOWN `]() enumerator UNKNOWN = 0 If [DynamicRelocation::symbol]() is a special value that is not supported by LIEF. ##### [` GENERIC `]() enumerator GENERIC If [DynamicRelocation::symbol]() is not a special value. ##### [` ARM64X `]() enumerator ARM64X If [DynamicRelocation::symbol]() is set to `IMAGE_DYNAMIC_RELOCATION_ARM64X`. ##### [` FUNCTION_OVERRIDE `]() enumerator FUNCTION\_OVERRIDE If [DynamicRelocation::symbol]() is set to `IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE`. ##### [` ARM64_KERNEL_IMPORT_CALL_TRANSFER `]() enumerator ARM64\_KERNEL\_IMPORT\_CALL\_TRANSFER If [DynamicRelocation::symbol]() is set to `IMAGE_DYNAMIC_RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER`. ##### [` GUARD_IMPORT_CONTROL_TRANSFER `]() enumerator GUARD\_IMPORT\_CONTROL\_TRANSFER If [DynamicRelocation::symbol]() is set to `IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER`. Public Functions #### [` DynamicFixup `]() DynamicFixup() = delete #### [` DynamicFixup `]() inline DynamicFixup([KIND]( "LIEF::PE::DynamicFixup::KIND") kind) #### [` DynamicFixup `]() DynamicFixup(const [DynamicFixup]( "LIEF::PE::DynamicFixup::DynamicFixup")&) = default #### [` operator= `]() [DynamicFixup]( "LIEF::PE::DynamicFixup") &operator=(const [DynamicFixup]( "LIEF::PE::DynamicFixup")&) = default #### [` DynamicFixup `]() DynamicFixup([DynamicFixup]( "LIEF::PE::DynamicFixup::DynamicFixup")&&) = default #### [` operator= `]() [DynamicFixup]( "LIEF::PE::DynamicFixup") &operator=([DynamicFixup]( "LIEF::PE::DynamicFixup")&&) = default #### [` clone `]() virtual std::unique\_ptr<[DynamicFixup]( "LIEF::PE::DynamicFixup")> clone() const = 0 #### [` to_string `]() virtual std::string to\_string() const = 0 #### [` kind `]() inline [KIND]( "LIEF::PE::DynamicFixup::KIND") kind() const Encoding of the fixups. #### [` Tas `]() template<class T> inline [T]( "LIEF::PE::DynamicFixup::as::T") \*as() #### [` Tas `]() template<class T> inline const [T]( "LIEF::PE::DynamicFixup::as::T") \*as() const #### [` ~DynamicFixup `]() virtual ~DynamicFixup() = default Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [DynamicFixup]( "LIEF::PE::DynamicFixup") &fixup) ## [DynamicFixupControlTransfer]() ### [` DynamicFixupControlTransfer `]() class DynamicFixupControlTransfer : public LIEF::PE::[DynamicFixup]( "LIEF::PE::DynamicFixup") This class wraps fixups associated with the (special) symbol value: `IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER (3)`. Public Types #### [` reloc_entries_t `]() using reloc\_entries\_t = std::vector<[reloc\_entry\_t]( "LIEF::PE::DynamicFixupControlTransfer::reloc_entry_t")> #### [` it_relocations `]() using it\_relocations = [ref\_iterator]( "LIEF::ref_iterator")<[reloc\_entries\_t]( "LIEF::PE::DynamicFixupControlTransfer::reloc_entries_t")&> #### [` it_const_relocations `]() using it\_const\_relocations = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [reloc\_entries\_t]( "LIEF::PE::DynamicFixupControlTransfer::reloc_entries_t")&> Public Functions #### [` DynamicFixupControlTransfer `]() inline DynamicFixupControlTransfer() #### [` DynamicFixupControlTransfer `]() DynamicFixupControlTransfer(const [DynamicFixupControlTransfer]( "LIEF::PE::DynamicFixupControlTransfer::DynamicFixupControlTransfer")&) = default #### [` operator= `]() [DynamicFixupControlTransfer]( "LIEF::PE::DynamicFixupControlTransfer") &operator=(const [DynamicFixupControlTransfer]( "LIEF::PE::DynamicFixupControlTransfer")&) = default #### [` DynamicFixupControlTransfer `]() DynamicFixupControlTransfer([DynamicFixupControlTransfer]( "LIEF::PE::DynamicFixupControlTransfer::DynamicFixupControlTransfer")&&) = default #### [` operator= `]() [DynamicFixupControlTransfer]( "LIEF::PE::DynamicFixupControlTransfer") &operator=([DynamicFixupControlTransfer]( "LIEF::PE::DynamicFixupControlTransfer")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[DynamicFixup]( "LIEF::PE::DynamicFixup")> clone() const override #### [` to_string `]() virtual std::string to\_string() const override #### [` relocations `]() inline [it\_relocations]( "LIEF::PE::DynamicFixupControlTransfer::it_relocations") relocations() Iterator over the relocations. #### [` relocations `]() inline [it\_const\_relocations]( "LIEF::PE::DynamicFixupControlTransfer::it_const_relocations") relocations() const #### [` ~DynamicFixupControlTransfer `]() ~DynamicFixupControlTransfer() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicFixup]( "LIEF::PE::DynamicFixup") \*fixup) Public Static Attributes #### [` NO_IAT_INDEX `]() static auto NO\_IAT\_INDEX = 0x7fff #### [` reloc_entry_t `]() struct reloc\_entry\_t Mirror `IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION`. Public Functions ##### [` to_string `]() std::string to\_string() const Public Members ##### [` rva `]() uint32\_t rva = 0 RVA to the call instruction. ##### [` is_call `]() bool is\_call = false True if target instruction is a `call`, false otherwise. ##### [` iat_index `]() uint16\_t iat\_index = [NO\_IAT\_INDEX]( "LIEF::PE::DynamicFixupControlTransfer::NO_IAT_INDEX") IAT index of the corresponding import. `0x7FFF` is a special value indicating no index. Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [reloc\_entry\_t]( "LIEF::PE::DynamicFixupControlTransfer::reloc_entry_t") &entry) ## [DynamicFixupARM64Kernel]() ### [` DynamicFixupARM64Kernel `]() class DynamicFixupARM64Kernel : public LIEF::PE::[DynamicFixup]( "LIEF::PE::DynamicFixup") This class wraps fixups associated with the (special) symbol value: `IMAGE_DYNAMIC_RELOCATION_ARM64_KERNEL_IMPORT_CALL_TRANSFER (8)`. Public Types #### [` IMPORT_TYPE `]() enum class IMPORT\_TYPE : uint8\_t *Values:* ##### [` STATIC `]() enumerator STATIC = 0 ##### [` DELAYED `]() enumerator DELAYED = 1 #### [` reloc_entries_t `]() using reloc\_entries\_t = std::vector<[reloc\_entry\_t]( "LIEF::PE::DynamicFixupARM64Kernel::reloc_entry_t")> #### [` it_relocations `]() using it\_relocations = [ref\_iterator]( "LIEF::ref_iterator")<[reloc\_entries\_t]( "LIEF::PE::DynamicFixupARM64Kernel::reloc_entries_t")&> #### [` it_const_relocations `]() using it\_const\_relocations = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [reloc\_entries\_t]( "LIEF::PE::DynamicFixupARM64Kernel::reloc_entries_t")&> Public Functions #### [` DynamicFixupARM64Kernel `]() inline DynamicFixupARM64Kernel() #### [` DynamicFixupARM64Kernel `]() DynamicFixupARM64Kernel(const [DynamicFixupARM64Kernel]( "LIEF::PE::DynamicFixupARM64Kernel::DynamicFixupARM64Kernel")&) = default #### [` operator= `]() [DynamicFixupARM64Kernel]( "LIEF::PE::DynamicFixupARM64Kernel") &operator=(const [DynamicFixupARM64Kernel]( "LIEF::PE::DynamicFixupARM64Kernel")&) = default #### [` DynamicFixupARM64Kernel `]() DynamicFixupARM64Kernel([DynamicFixupARM64Kernel]( "LIEF::PE::DynamicFixupARM64Kernel::DynamicFixupARM64Kernel")&&) = default #### [` operator= `]() [DynamicFixupARM64Kernel]( "LIEF::PE::DynamicFixupARM64Kernel") &operator=([DynamicFixupARM64Kernel]( "LIEF::PE::DynamicFixupARM64Kernel")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[DynamicFixup]( "LIEF::PE::DynamicFixup")> clone() const override #### [` to_string `]() virtual std::string to\_string() const override #### [` relocations `]() inline [it\_relocations]( "LIEF::PE::DynamicFixupARM64Kernel::it_relocations") relocations() Iterator over the relocations. #### [` relocations `]() inline [it\_const\_relocations]( "LIEF::PE::DynamicFixupARM64Kernel::it_const_relocations") relocations() const #### [` ~DynamicFixupARM64Kernel `]() ~DynamicFixupARM64Kernel() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicFixup]( "LIEF::PE::DynamicFixup") \*fixup) Public Static Attributes #### [` NO_IAT_INDEX `]() static auto NO\_IAT\_INDEX = 0x7fff #### [` reloc_entry_t `]() struct reloc\_entry\_t Mirror `IMAGE_IMPORT_CONTROL_TRANSFER_ARM64_RELOCATION`. Public Functions ##### [` to_string `]() std::string to\_string() const Public Members ##### [` rva `]() uint32\_t rva = 0 RVA to the call instruction. ##### [` indirect_call `]() bool indirect\_call = false True if target instruction is a `blr`, false if it’s a `br`. ##### [` register_index `]() uint8\_t register\_index = 0 Register index used for the indirect call/jump. For instance, if the instruction is `br x3`, this index is set to `3`. ##### [` import_type `]() [IMPORT\_TYPE]( "LIEF::PE::DynamicFixupARM64Kernel::IMPORT_TYPE") import\_type = [IMPORT\_TYPE]( "LIEF::PE::DynamicFixupARM64Kernel::IMPORT_TYPE")::[STATIC]( "LIEF::PE::DynamicFixupARM64Kernel::IMPORT_TYPE::STATIC") See [IMPORT\_TYPE](). ##### [` iat_index `]() uint16\_t iat\_index = [NO\_IAT\_INDEX]( "LIEF::PE::DynamicFixupARM64Kernel::NO_IAT_INDEX") IAT index of the corresponding import. `0x7FFF` is a special value indicating no index. Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [reloc\_entry\_t]( "LIEF::PE::DynamicFixupARM64Kernel::reloc_entry_t") &entry) ## [DynamicFixupARM64X]() ### [` DynamicFixupARM64X `]() class DynamicFixupARM64X : public LIEF::PE::[DynamicFixup]( "LIEF::PE::DynamicFixup") This class represents `IMAGE_DYNAMIC_RELOCATION_ARM64X`. Public Types #### [` FIXUP_TYPE `]() enum class FIXUP\_TYPE *Values:* ##### [` ZEROFILL `]() enumerator ZEROFILL = 0 ##### [` VALUE `]() enumerator VALUE = 1 ##### [` DELTA `]() enumerator DELTA = 2 #### [` reloc_entries_t `]() using reloc\_entries\_t = std::vector<[reloc\_entry\_t]( "LIEF::PE::DynamicFixupARM64X::reloc_entry_t")> #### [` it_relocations `]() using it\_relocations = [ref\_iterator]( "LIEF::ref_iterator")<[reloc\_entries\_t]( "LIEF::PE::DynamicFixupARM64X::reloc_entries_t")&> #### [` it_const_relocations `]() using it\_const\_relocations = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [reloc\_entries\_t]( "LIEF::PE::DynamicFixupARM64X::reloc_entries_t")&> Public Functions #### [` DynamicFixupARM64X `]() inline DynamicFixupARM64X() #### [` DynamicFixupARM64X `]() DynamicFixupARM64X(const [DynamicFixupARM64X]( "LIEF::PE::DynamicFixupARM64X::DynamicFixupARM64X")&) = default #### [` operator= `]() [DynamicFixupARM64X]( "LIEF::PE::DynamicFixupARM64X") &operator=(const [DynamicFixupARM64X]( "LIEF::PE::DynamicFixupARM64X")&) = default #### [` DynamicFixupARM64X `]() DynamicFixupARM64X([DynamicFixupARM64X]( "LIEF::PE::DynamicFixupARM64X::DynamicFixupARM64X")&&) = default #### [` operator= `]() [DynamicFixupARM64X]( "LIEF::PE::DynamicFixupARM64X") &operator=([DynamicFixupARM64X]( "LIEF::PE::DynamicFixupARM64X")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[DynamicFixup]( "LIEF::PE::DynamicFixup")> clone() const override #### [` to_string `]() virtual std::string to\_string() const override #### [` relocations `]() inline [it\_relocations]( "LIEF::PE::DynamicFixupARM64X::it_relocations") relocations() Iterator over the different fixup entries. #### [` relocations `]() inline [it\_const\_relocations]( "LIEF::PE::DynamicFixupARM64X::it_const_relocations") relocations() const #### [` ~DynamicFixupARM64X `]() ~DynamicFixupARM64X() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicFixup]( "LIEF::PE::DynamicFixup") \*fixup) #### [` reloc_entry_t `]() struct reloc\_entry\_t Public Functions ##### [` to_string `]() std::string to\_string() const Public Members ##### [` rva `]() uint32\_t rva = 0 RVA where the fixup takes place. ##### [` type `]() [FIXUP\_TYPE]( "LIEF::PE::DynamicFixupARM64X::FIXUP_TYPE") type = [FIXUP\_TYPE]( "LIEF::PE::DynamicFixupARM64X::FIXUP_TYPE")::[ZEROFILL]( "LIEF::PE::DynamicFixupARM64X::FIXUP_TYPE::ZEROFILL") Fixup’s kind. ##### [` size `]() size\_t size = 0 Size of the value to patch. ##### [` bytes `]() std::vector<uint8\_t> bytes If the type is [FIXUP\_TYPE::VALUE](), the bytes associated to the fixup entry. ##### [` value `]() int64\_t value = 0 If the type is [FIXUP\_TYPE::DELTA](), the (signed) value. Friends ##### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [reloc\_entry\_t]( "LIEF::PE::DynamicFixupARM64X::reloc_entry_t") &entry) ## [DynamicFixupGeneric]() ### [` DynamicFixupGeneric `]() class DynamicFixupGeneric : public LIEF::PE::[DynamicFixup]( "LIEF::PE::DynamicFixup") This class represents a generic entry where fixups are regular relocations ([LIEF::PE::Relocation]()). Public Types #### [` relocations_t `]() using relocations\_t = std::vector<std::unique\_ptr<[Relocation]( "LIEF::PE::Relocation")>> #### [` it_relocations `]() using it\_relocations = [ref\_iterator]( "LIEF::ref_iterator")<[relocations\_t]( "LIEF::PE::DynamicFixupGeneric::relocations_t")&, [Relocation]( "LIEF::PE::Relocation")\*> #### [` it_const_relocations `]() using it\_const\_relocations = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [relocations\_t]( "LIEF::PE::DynamicFixupGeneric::relocations_t")&, [Relocation]( "LIEF::PE::Relocation")\*> Public Functions #### [` DynamicFixupGeneric `]() DynamicFixupGeneric() #### [` DynamicFixupGeneric `]() DynamicFixupGeneric(const [DynamicFixupGeneric]( "LIEF::PE::DynamicFixupGeneric::DynamicFixupGeneric")&) #### [` operator= `]() [DynamicFixupGeneric]( "LIEF::PE::DynamicFixupGeneric") &operator=(const [DynamicFixupGeneric]( "LIEF::PE::DynamicFixupGeneric")&) #### [` DynamicFixupGeneric `]() DynamicFixupGeneric([DynamicFixupGeneric]( "LIEF::PE::DynamicFixupGeneric::DynamicFixupGeneric")&&) #### [` operator= `]() [DynamicFixupGeneric]( "LIEF::PE::DynamicFixupGeneric") &operator=([DynamicFixupGeneric]( "LIEF::PE::DynamicFixupGeneric")&&) #### [` clone `]() inline virtual std::unique\_ptr<[DynamicFixup]( "LIEF::PE::DynamicFixup")> clone() const override #### [` relocations `]() inline [it\_relocations]( "LIEF::PE::DynamicFixupGeneric::it_relocations") relocations() Iterator over the relocations. #### [` relocations `]() inline [it\_const\_relocations]( "LIEF::PE::DynamicFixupGeneric::it_const_relocations") relocations() const #### [` to_string `]() virtual std::string to\_string() const override #### [` ~DynamicFixupGeneric `]() ~DynamicFixupGeneric() override Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicFixup]( "LIEF::PE::DynamicFixup") \*fixup) ## [DynamicFixupUnknown]() ### [` DynamicFixupUnknown `]() class DynamicFixupUnknown : public LIEF::PE::[DynamicFixup]( "LIEF::PE::DynamicFixup") This class represents a special dynamic relocation where the format of the fixups is not supported by LIEF. Public Functions #### [` DynamicFixupUnknown `]() inline DynamicFixupUnknown(std::vector<uint8\_t> payload) #### [` DynamicFixupUnknown `]() DynamicFixupUnknown(const [DynamicFixupUnknown]( "LIEF::PE::DynamicFixupUnknown::DynamicFixupUnknown")&) = default #### [` operator= `]() [DynamicFixupUnknown]( "LIEF::PE::DynamicFixupUnknown") &operator=(const [DynamicFixupUnknown]( "LIEF::PE::DynamicFixupUnknown")&) = default #### [` DynamicFixupUnknown `]() DynamicFixupUnknown([DynamicFixupUnknown]( "LIEF::PE::DynamicFixupUnknown::DynamicFixupUnknown")&&) = default #### [` operator= `]() [DynamicFixupUnknown]( "LIEF::PE::DynamicFixupUnknown") &operator=([DynamicFixupUnknown]( "LIEF::PE::DynamicFixupUnknown")&&) = default #### [` clone `]() inline virtual std::unique\_ptr<[DynamicFixup]( "LIEF::PE::DynamicFixup")> clone() const override #### [` to_string `]() inline virtual std::string to\_string() const override #### [` payload `]() inline span<const uint8\_t> payload() const Raw fixups. #### [` payload `]() inline span<uint8\_t> payload() #### [` ~DynamicFixupUnknown `]() ~DynamicFixupUnknown() override = default Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicFixup]( "LIEF::PE::DynamicFixup") \*fixup) ## [FunctionOverride]() ### [` FunctionOverride `]() class FunctionOverride : public LIEF::PE::[DynamicFixup]( "LIEF::PE::DynamicFixup") This class represents `IMAGE_DYNAMIC_RELOCATION_FUNCTION_OVERRIDE`. Public Types #### [` func_overriding_info_t `]() using func\_overriding\_info\_t = std::vector<std::unique\_ptr<[FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo")>> #### [` it_func_overriding_info `]() using it\_func\_overriding\_info = [ref\_iterator]( "LIEF::ref_iterator")<[func\_overriding\_info\_t]( "LIEF::PE::FunctionOverride::func_overriding_info_t")&, [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo")\*> #### [` it_const_func_overriding_info `]() using it\_const\_func\_overriding\_info = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [func\_overriding\_info\_t]( "LIEF::PE::FunctionOverride::func_overriding_info_t")&, const [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo")\*> #### [` bdd_info_list_t `]() using bdd\_info\_list\_t = std::vector<[image\_bdd\_info\_t]( "LIEF::PE::FunctionOverride::image_bdd_info_t")> #### [` it_bdd_info `]() using it\_bdd\_info = [ref\_iterator]( "LIEF::ref_iterator")<[bdd\_info\_list\_t]( "LIEF::PE::FunctionOverride::bdd_info_list_t")&> #### [` it_const_bdd_info `]() using it\_const\_bdd\_info = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [bdd\_info\_list\_t]( "LIEF::PE::FunctionOverride::bdd_info_list_t")&> Public Functions #### [` FunctionOverride `]() FunctionOverride() #### [` FunctionOverride `]() FunctionOverride(const [FunctionOverride]( "LIEF::PE::FunctionOverride::FunctionOverride")&) #### [` operator= `]() [FunctionOverride]( "LIEF::PE::FunctionOverride") &operator=(const [FunctionOverride]( "LIEF::PE::FunctionOverride")&) #### [` FunctionOverride `]() FunctionOverride([FunctionOverride]( "LIEF::PE::FunctionOverride::FunctionOverride")&&) #### [` operator= `]() [FunctionOverride]( "LIEF::PE::FunctionOverride") &operator=([FunctionOverride]( "LIEF::PE::FunctionOverride")&&) #### [` clone `]() inline virtual std::unique\_ptr<[DynamicFixup]( "LIEF::PE::DynamicFixup")> clone() const override #### [` func_overriding_info `]() inline [it\_func\_overriding\_info]( "LIEF::PE::FunctionOverride::it_func_overriding_info") func\_overriding\_info() Iterator over the overriding info. #### [` func_overriding_info `]() inline [it\_const\_func\_overriding\_info]( "LIEF::PE::FunctionOverride::it_const_func_overriding_info") func\_overriding\_info() const #### [` bdd_info `]() inline [it\_bdd\_info]( "LIEF::PE::FunctionOverride::it_bdd_info") bdd\_info() Iterator over the BDD info. #### [` bdd_info `]() inline [it\_const\_bdd\_info]( "LIEF::PE::FunctionOverride::it_const_bdd_info") bdd\_info() const #### [` find_bdd_info `]() [image\_bdd\_info\_t]( "LIEF::PE::FunctionOverride::image_bdd_info_t") \*find\_bdd\_info(uint32\_t offset) Find the `IMAGE_BDD_INFO` at the given offset. #### [` find_bdd_info `]() [image\_bdd\_info\_t]( "LIEF::PE::FunctionOverride::image_bdd_info_t") \*find\_bdd\_info(const [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo") &info) Find the `IMAGE_BDD_INFO` associated with the given info. #### [` find_bdd_info `]() inline const [image\_bdd\_info\_t]( "LIEF::PE::FunctionOverride::image_bdd_info_t") \*find\_bdd\_info(uint32\_t offset) const #### [` find_bdd_info `]() inline const [image\_bdd\_info\_t]( "LIEF::PE::FunctionOverride::image_bdd_info_t") \*find\_bdd\_info(const [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo") &info) const #### [` to_string `]() virtual std::string to\_string() const override #### [` ~FunctionOverride `]() ~FunctionOverride() override Public Static Functions #### [` classof `]() static inline bool classof(const [DynamicFixup]( "LIEF::PE::DynamicFixup") \*fixup) #### [` image_bdd_dynamic_relocation_t `]() struct image\_bdd\_dynamic\_relocation\_t Mirror `IMAGE_BDD_DYNAMIC_RELOCATION`. Public Members ##### [` left `]() uint16\_t left = 0 ##### [` right `]() uint16\_t right = 0 ##### [` value `]() uint32\_t value = 0 #### [` image_bdd_info_t `]() struct image\_bdd\_info\_t Mirror `IMAGE_BDD_INFO`. Public Members ##### [` version `]() uint32\_t version = 0 ##### [` original_size `]() uint32\_t original\_size = 0 ##### [` original_offset `]() uint32\_t original\_offset = 0 ##### [` relocations `]() std::vector<[image\_bdd\_dynamic\_relocation\_t]( "LIEF::PE::FunctionOverride::image_bdd_dynamic_relocation_t")> relocations If version == 1. ##### [` payload `]() std::vector<uint8\_t> payload If version != 1. ## [FunctionOverrideInfo]() ### [` FunctionOverrideInfo `]() class FunctionOverrideInfo Public Types #### [` relocations_t `]() using relocations\_t = std::vector<std::unique\_ptr<[Relocation]( "LIEF::PE::Relocation")>> #### [` it_relocations `]() using it\_relocations = [ref\_iterator]( "LIEF::ref_iterator")<[relocations\_t]( "LIEF::PE::FunctionOverrideInfo::relocations_t")&, [Relocation]( "LIEF::PE::Relocation")\*> #### [` it_const_relocations `]() using it\_const\_relocations = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [relocations\_t]( "LIEF::PE::FunctionOverrideInfo::relocations_t")&, const [Relocation]( "LIEF::PE::Relocation")\*> Public Functions #### [` FunctionOverrideInfo `]() FunctionOverrideInfo() = default #### [` FunctionOverrideInfo `]() FunctionOverrideInfo(uint32\_t original\_rva, uint32\_t bdd\_offset, uint32\_t base\_reloc\_size) #### [` FunctionOverrideInfo `]() FunctionOverrideInfo(const [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo::FunctionOverrideInfo")&) #### [` operator= `]() [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo") &operator=(const [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo")&) #### [` FunctionOverrideInfo `]() FunctionOverrideInfo([FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo::FunctionOverrideInfo")&&) #### [` operator= `]() [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo") &operator=([FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo")&&) #### [` to_string `]() std::string to\_string() const #### [` original_rva `]() inline uint32\_t original\_rva() const RVA of the original function. #### [` bdd_offset `]() inline uint32\_t bdd\_offset() const Offset into the BDD region. #### [` rva_size `]() inline uint32\_t rva\_size() const Size in bytes taken by RVAs. #### [` base_reloc_size `]() inline uint32\_t base\_reloc\_size() const Size in bytes taken by BaseRelocs. #### [` functions_rva `]() inline const std::vector<uint32\_t> &functions\_rva() const #### [` relocations `]() inline [it\_relocations]( "LIEF::PE::FunctionOverrideInfo::it_relocations") relocations() #### [` relocations `]() inline [it\_const\_relocations]( "LIEF::PE::FunctionOverrideInfo::it_const_relocations") relocations() const #### [` original_rva `]() inline [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo") &original\_rva(uint32\_t value) #### [` bdd_offset `]() inline [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo") &bdd\_offset(uint32\_t value) #### [` base_reloc_size `]() inline [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo") &base\_reloc\_size(uint32\_t value) #### [` overriding_funcs `]() inline [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo") &overriding\_funcs(std::vector<uint32\_t> funcs) #### [` ~FunctionOverrideInfo `]() ~FunctionOverrideInfo() Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [FunctionOverrideInfo]( "LIEF::PE::FunctionOverrideInfo") &info) --- ## [EnclaveConfiguration]() ### [` EnclaveConfiguration `]() class EnclaveConfiguration This class represents the enclave configuration. Public Types #### [` id_array_t `]() using id\_array\_t = std::array<uint8\_t, 16> #### [` imports_t `]() using imports\_t = std::vector<[EnclaveImport]( "LIEF::PE::EnclaveImport")> #### [` it_imports `]() using it\_imports = [ref\_iterator]( "LIEF::ref_iterator")<[imports\_t]( "LIEF::PE::EnclaveConfiguration::imports_t")&> #### [` it_const_imports `]() using it\_const\_imports = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [imports\_t]( "LIEF::PE::EnclaveConfiguration::imports_t")&> Public Functions #### [` EnclaveConfiguration `]() EnclaveConfiguration() = default #### [` EnclaveConfiguration `]() EnclaveConfiguration(const [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration::EnclaveConfiguration")&) = default #### [` operator= `]() [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &operator=(const [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration")&) = default #### [` EnclaveConfiguration `]() EnclaveConfiguration([EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration::EnclaveConfiguration")&&) = default #### [` operator= `]() [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &operator=([EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration")&&) = default #### [` clone `]() inline std::unique\_ptr<[EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration")> clone() const #### [` size `]() inline uint32\_t size() const The size of the `IMAGE_ENCLAVE_CONFIG64/IMAGE_ENCLAVE_CONFIG32` structure, in bytes. #### [` min_required_config_size `]() inline uint32\_t min\_required\_config\_size() const The minimum size of the `IMAGE_ENCLAVE_CONFIG(32,64)` structure that the image loader must be able to process in order for the enclave to be usable. This member allows an enclave to inform an earlier version of the image loader that the image loader can safely load the enclave and ignore optional members added to `IMAGE_ENCLAVE_CONFIG(32,64)` for later versions of the enclave. If the size of `IMAGE_ENCLAVE_CONFIG(32,64)` that the image loader can process is less than `MinimumRequiredConfigSize`, the enclave cannot be run securely. If `MinimumRequiredConfigSize` is zero, the minimum size of the `IMAGE_ENCLAVE_CONFIG(32,64)` structure that the image loader must be able to process in order for the enclave to be usable is assumed to be the size of the structure through and including the `MinimumRequiredConfigSize` member. #### [` policy_flags `]() inline uint32\_t policy\_flags() const A flag that indicates whether the enclave permits debugging. #### [` is_debuggable `]() inline bool is\_debuggable() const Whether this enclave can be debugged. #### [` import_list_rva `]() inline uint32\_t import\_list\_rva() const The RVA of the array of images that the enclave image may import, with identity information for each image. #### [` import_entry_size `]() inline uint32\_t import\_entry\_size() const The size of each image in the array of images that the [import\_list\_rva()]() member points to. #### [` nb_imports `]() inline size\_t nb\_imports() const The number of images in the array of images that the [import\_list\_rva()]() member points to. #### [` imports `]() inline [it\_imports]( "LIEF::PE::EnclaveConfiguration::it_imports") imports() Return an iterator over the enclave’s imports. #### [` imports `]() inline [it\_const\_imports]( "LIEF::PE::EnclaveConfiguration::it_const_imports") imports() const #### [` family_id `]() inline const [id\_array\_t]( "LIEF::PE::EnclaveConfiguration::id_array_t") &family\_id() const The family identifier that the author of the enclave assigned to the enclave. #### [` image_id `]() inline const [id\_array\_t]( "LIEF::PE::EnclaveConfiguration::id_array_t") &image\_id() const The image identifier that the author of the enclave assigned to the enclave. #### [` image_version `]() inline uint32\_t image\_version() const The version number that the author of the enclave assigned to the enclave. #### [` security_version `]() inline uint32\_t security\_version() const The security version number that the author of the enclave assigned to the enclave. #### [` enclave_size `]() inline uint64\_t enclave\_size() const The expected virtual size of the private address range for the enclave, in bytes. #### [` nb_threads `]() inline uint32\_t nb\_threads() const The maximum number of threads that can be created within the enclave. #### [` enclave_flags `]() inline uint32\_t enclave\_flags() const A flag that indicates whether the image is suitable for use as the primary image in the enclave. #### [` size `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &size(uint32\_t value) #### [` min_required_config_size `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &min\_required\_config\_size(uint32\_t value) #### [` policy_flags `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &policy\_flags(uint32\_t value) #### [` import_list_rva `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &import\_list\_rva(uint32\_t value) #### [` import_entry_size `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &import\_entry\_size(uint32\_t value) #### [` family_id `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &family\_id(const [id\_array\_t]( "LIEF::PE::EnclaveConfiguration::id_array_t") &value) #### [` image_id `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &image\_id(const [id\_array\_t]( "LIEF::PE::EnclaveConfiguration::id_array_t") &value) #### [` image_version `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &image\_version(uint32\_t value) #### [` security_version `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &security\_version(uint32\_t value) #### [` enclave_size `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &enclave\_size(uint64\_t value) #### [` nb_threads `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &nb\_threads(uint32\_t value) #### [` enclave_flags `]() inline [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &enclave\_flags(uint32\_t value) #### [` to_string `]() std::string to\_string() const Public Static Attributes #### [` MIN_SIZE `]() static auto MIN\_SIZE = 0x4C #### [` POLICY_DEBUGGABLE `]() static auto POLICY\_DEBUGGABLE = 0x00000001 #### [` POLICY_STRICT_MEMORY `]() static auto POLICY\_STRICT\_MEMORY = 0x00000002 Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [EnclaveConfiguration]( "LIEF::PE::EnclaveConfiguration") &meta) --- ## [EnclaveImport]() ### [` EnclaveImport `]() class EnclaveImport Defines an entry in the array of images that an enclave can import. Public Types #### [` TYPE `]() enum class TYPE : uint32\_t *Values:* ##### [` NONE `]() enumerator NONE = 0x00000000 None of the identifiers of the image need to match the value in the import record. ##### [` UNIQUE_ID `]() enumerator UNIQUE\_ID = 0x00000001 The value of the enclave unique identifier of the image must match the value in the import record. Otherwise, loading of the image fails. ##### [` AUTHOR_ID `]() enumerator AUTHOR\_ID = 0x00000002 The value of the enclave author identifier of the image must match the value in the import record. Otherwise, loading of the image fails. If this flag is set and the import record indicates an author identifier of all zeros, the imported image must be part of the Windows installation. ##### [` FAMILY_ID `]() enumerator FAMILY\_ID = 0x00000003 The value of the enclave family identifier of the image must match the value in the import record. Otherwise, loading of the image fails. ##### [` IMAGE_ID `]() enumerator IMAGE\_ID = 0x00000004 The value of the enclave image identifier of the image must match the value in the import record. Otherwise, loading of the image fails. #### [` short_id_t `]() using short\_id\_t = std::array<uint8\_t, 16> #### [` long_id_t `]() using long\_id\_t = std::array<uint8\_t, 32> Public Functions #### [` EnclaveImport `]() EnclaveImport() = default #### [` EnclaveImport `]() EnclaveImport(const [EnclaveImport]( "LIEF::PE::EnclaveImport::EnclaveImport")&) = default #### [` operator= `]() [EnclaveImport]( "LIEF::PE::EnclaveImport") &operator=(const [EnclaveImport]( "LIEF::PE::EnclaveImport")&) = default #### [` EnclaveImport `]() EnclaveImport([EnclaveImport]( "LIEF::PE::EnclaveImport::EnclaveImport")&&) = default #### [` operator= `]() [EnclaveImport]( "LIEF::PE::EnclaveImport") &operator=([EnclaveImport]( "LIEF::PE::EnclaveImport")&&) = default #### [` type `]() inline [TYPE]( "LIEF::PE::EnclaveImport::TYPE") type() const The type of identifier of the image that must match the value in the import record. #### [` min_security_version `]() inline uint32\_t min\_security\_version() const The minimum enclave security version that each image must have for the image to be imported successfully. The image is rejected unless its enclave security version is equal to or greater than the minimum value in the import record. Set the value in the import record to zero to turn off the security version check. #### [` id `]() inline const [long\_id\_t]( "LIEF::PE::EnclaveImport::long_id_t") &id() const The unique identifier of the primary module for the enclave, if the [type()]() is [TYPE::UNIQUE\_ID](). Otherwise, the author identifier of the primary module for the enclave. #### [` family_id `]() inline const [short\_id\_t]( "LIEF::PE::EnclaveImport::short_id_t") &family\_id() const The family identifier of the primary module for the enclave. #### [` image_id `]() inline const [short\_id\_t]( "LIEF::PE::EnclaveImport::short_id_t") &image\_id() const The image identifier of the primary module for the enclave. #### [` import_name_rva `]() inline uint32\_t import\_name\_rva() const The relative virtual address of a NULL-terminated string that contains the same value found in the import directory for the image. #### [` import_name `]() inline std::string\_view import\_name() const Resolved import name. #### [` reserved `]() inline uint32\_t reserved() const Reserved. Should be 0. #### [` type `]() inline [EnclaveImport]( "LIEF::PE::EnclaveImport") &type([TYPE]( "LIEF::PE::EnclaveImport::TYPE") ty) #### [` min_security_version `]() inline [EnclaveImport]( "LIEF::PE::EnclaveImport") &min\_security\_version(uint32\_t value) #### [` id `]() inline [EnclaveImport]( "LIEF::PE::EnclaveImport") &id(const [long\_id\_t]( "LIEF::PE::EnclaveImport::long_id_t") &value) #### [` family_id `]() inline [EnclaveImport]( "LIEF::PE::EnclaveImport") &family\_id(const [short\_id\_t]( "LIEF::PE::EnclaveImport::short_id_t") &value) #### [` image_id `]() inline [EnclaveImport]( "LIEF::PE::EnclaveImport") &image\_id(const [short\_id\_t]( "LIEF::PE::EnclaveImport::short_id_t") &value) #### [` import_name_rva `]() inline [EnclaveImport]( "LIEF::PE::EnclaveImport") &import\_name\_rva(uint32\_t value) #### [` reserved `]() inline [EnclaveImport]( "LIEF::PE::EnclaveImport") &reserved(uint32\_t value) #### [` import_name `]() inline [EnclaveImport]( "LIEF::PE::EnclaveImport") &import\_name(std::string name) #### [` to_string `]() std::string to\_string() const Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [EnclaveImport]( "LIEF::PE::EnclaveImport") &meta) --- ## [Volatile Metadata]() ### [` VolatileMetadata `]() class VolatileMetadata This class represents volatile metadata which can be enabled at link time with `/volatileMetadata`. This metadata aims to improve performances when running x64 code on ARM64. Public Types #### [` access_table_t `]() using access\_table\_t = std::vector<uint32\_t> #### [` info_ranges_t `]() using info\_ranges\_t = std::vector<[range\_t]( "LIEF::PE::VolatileMetadata::range_t")> #### [` it_info_ranges_t `]() using it\_info\_ranges\_t = [ref\_iterator]( "LIEF::ref_iterator")<[info\_ranges\_t]( "LIEF::PE::VolatileMetadata::info_ranges_t")&> #### [` it_const_info_ranges_t `]() using it\_const\_info\_ranges\_t = [const\_ref\_iterator]( "LIEF::const_ref_iterator")<const [info\_ranges\_t]( "LIEF::PE::VolatileMetadata::info_ranges_t")&> Public Functions #### [` VolatileMetadata `]() VolatileMetadata() = default #### [` VolatileMetadata `]() VolatileMetadata(const [VolatileMetadata]( "LIEF::PE::VolatileMetadata::VolatileMetadata")&) = default #### [` operator= `]() [VolatileMetadata]( "LIEF::PE::VolatileMetadata") &operator=(const [VolatileMetadata]( "LIEF::PE::VolatileMetadata")&) = default #### [` VolatileMetadata `]() VolatileMetadata([VolatileMetadata]( "LIEF::PE::VolatileMetadata::VolatileMetadata")&&) = default #### [` operator= `]() [VolatileMetadata]( "LIEF::PE::VolatileMetadata") &operator=([VolatileMetadata]( "LIEF::PE::VolatileMetadata")&&) = default #### [` clone `]() inline std::unique\_ptr<[VolatileMetadata]( "LIEF::PE::VolatileMetadata")> clone() const #### [` size `]() inline uint32\_t size() const Size (in bytes) of the current raw structure. #### [` min_version `]() inline uint16\_t min\_version() const #### [` max_version `]() inline uint16\_t max\_version() const #### [` access_table_rva `]() inline uint32\_t access\_table\_rva() const #### [` access_table `]() inline const [access\_table\_t]( "LIEF::PE::VolatileMetadata::access_table_t") &access\_table() const #### [` access_table_size `]() inline uint32\_t access\_table\_size() const #### [` info_range_rva `]() inline uint32\_t info\_range\_rva() const #### [` info_ranges_size `]() inline uint32\_t info\_ranges\_size() const #### [` info_ranges `]() inline [it\_const\_info\_ranges\_t]( "LIEF::PE::VolatileMetadata::it_const_info_ranges_t") info\_ranges() const #### [` info_ranges `]() inline [it\_info\_ranges\_t]( "LIEF::PE::VolatileMetadata::it_info_ranges_t") info\_ranges() #### [` size `]() inline [VolatileMetadata]( "LIEF::PE::VolatileMetadata") &size(uint32\_t value) #### [` min_version `]() inline [VolatileMetadata]( "LIEF::PE::VolatileMetadata") &min\_version(uint16\_t min) #### [` max_version `]() inline [VolatileMetadata]( "LIEF::PE::VolatileMetadata") &max\_version(uint16\_t max) #### [` access_table_rva `]() inline [VolatileMetadata]( "LIEF::PE::VolatileMetadata") &access\_table\_rva(uint32\_t value) #### [` info_range_rva `]() inline [VolatileMetadata]( "LIEF::PE::VolatileMetadata") &info\_range\_rva(uint32\_t value) #### [` to_string `]() std::string to\_string() const Friends #### [` operator<< `]() inline friend std::ostream &operator<<(std::ostream &os, const [VolatileMetadata]( "LIEF::PE::VolatileMetadata") &meta) #### [` range_t `]() struct range\_t Public Functions ##### [` end `]() inline uint32\_t end() const Public Members ##### [` start `]() uint32\_t start = 0 ##### [` size `]() uint32\_t size = 0 --- ## [Utilities]() ### [` LIEF::PE::check_layout `]() bool LIEF::PE::check\_layout(const [Binary]( "LIEF::PE::Binary") &bin, std::string \*error\_info = nullptr) Check that the layout of the given [Binary]() is correct from the Windows loader perspective. ### [` LIEF::PE::get_type `]() [result]( "LIEF::result")<[PE\_TYPE]( "LIEF::PE::PE_TYPE")> LIEF::PE::get\_type(std::string\_view file) if the input `file` is a PE one, return `PE32` or `PE32+` ### [` LIEF::PE::get_type `]() [result]( "LIEF::result")<[PE\_TYPE]( "LIEF::PE::PE_TYPE")> LIEF::PE::get\_type(const std::vector<uint8\_t> &raw) Return `PE32` or `PE32+`. ### [` LIEF::PE::is_pe `]() bool LIEF::PE::is\_pe(std::string\_view file) check if the `file` is a PE file ### [` LIEF::PE::is_pe `]() bool LIEF::PE::is\_pe(const std::vector<uint8\_t> &raw) check if the raw data is a PE file ### [` LIEF::PE::get_imphash `]() std::string LIEF::PE::get\_imphash(const [Binary]( "LIEF::PE::Binary") &binary, [IMPHASH\_MODE]( "LIEF::PE::IMPHASH_MODE") mode = [IMPHASH\_MODE]( "LIEF::PE::IMPHASH_MODE")::[DEFAULT]( "LIEF::PE::IMPHASH_MODE::DEFAULT")) Compute the hash of imported functions. By default, it generates a hash with the following properties: - Order agnostic - Case agnostic - Ordinal (**in some extent**) agnostic If one needs the same output as Virus Total (i.e. pefile), you can pass [IMPHASH\_MODE::PEFILE]() as second parameter. > **See also** > > [https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html]() > **Warning** > > The default algorithm used to compute the *imphash* value has some variations compared to Yara, pefile, VT implementation ### [` LIEF::PE::IMPHASH_MODE `]() enum class [LIEF]( "LIEF::PE::IMPHASH_MODE::LIEF")::PE::IMPHASH\_MODE Enum to define the behavior of [LIEF::PE::get\_imphash](). *Values:* #### [` DEFAULT `]() enumerator DEFAULT = 0 Default implementation. #### [` LIEF `]() enumerator LIEF = [DEFAULT]( "LIEF::PE::IMPHASH_MODE::DEFAULT") Same as [IMPHASH\_MODE::DEFAULT](). #### [` PEFILE `]() enumerator PEFILE Use pefile algorithm. #### [` VT `]() enumerator VT = [PEFILE]( "LIEF::PE::IMPHASH_MODE::PEFILE") Same as [IMPHASH\_MODE::PEFILE]() since Virus Total is using pefile. ### [` LIEF::PE::resolve_ordinals `]() [result]( "LIEF::result")<[Import]( "LIEF::PE::Import")> LIEF::PE::resolve\_ordinals(const [Import]( "LIEF::PE::Import") &import, bool strict = false, bool use\_std = false) Take a [PE::Import]() as entry and try to resolve imports by ordinal. The `strict` boolean parameter enables to throw an LIEF::not\_found exception if the ordinal can’t be resolved. Otherwise, it skips the entry. **Parameters:** - **import** – **[in]** [Import]() to resolve - **strict** – **[in]** If set to `true`, throw an exception if the import can’t be resolved - **use\_std** – **[in]** If `true`, it will use the [pefile]() look-up table for resolving imports **Returns:** The PE::import resolved with [PE::ImportEntry::name]() set ### [` LIEF::PE::oid_to_string `]() const char \*LIEF::PE::oid\_to\_string(const oid\_t &oid) Convert an OID to a human-readable string. --- ## [Enums]() ### [` LIEF::PE::PE_TYPE `]() enum class LIEF::PE::PE\_TYPE : uint16\_t *Values:* #### [` PE32 `]() enumerator PE32 = 0x10b 32bits #### [` PE32_PLUS `]() enumerator PE32\_PLUS = 0x20b 64 bits ### [` LIEF::PE::CODE_PAGES `]() enum class LIEF::PE::CODE\_PAGES : uint32\_t Code page from [https://docs.microsoft.com/en-us/windows/win32/intl/code-page-identifiers](). *Values:* #### [` IBM037 `]() enumerator IBM037 = 37 IBM EBCDIC US-Canada #### [` IBM437 `]() enumerator IBM437 = 437 OEM United States #### [` IBM500 `]() enumerator IBM500 = 500 IBM EBCDIC International #### [` ASMO_708 `]() enumerator ASMO\_708 = 708 Arabic (ASMO 708) #### [` DOS_720 `]() enumerator DOS\_720 = 720 Arabic (Transparent ASMO); Arabic (DOS) #### [` IBM737 `]() enumerator IBM737 = 737 OEM Greek (formerly 437G); Greek (DOS) #### [` IBM775 `]() enumerator IBM775 = 775 OEM Baltic; Baltic (DOS) #### [` IBM850 `]() enumerator IBM850 = 850 OEM Multilingual Latin 1; Western European (DOS) #### [` IBM852 `]() enumerator IBM852 = 852 OEM Latin 2; Central European (DOS) #### [` IBM855 `]() enumerator IBM855 = 855 OEM Cyrillic (primarily Russian) #### [` IBM857 `]() enumerator IBM857 = 857 OEM Turkish; Turkish (DOS) #### [` IBM00858 `]() enumerator IBM00858 = 858 OEM Multilingual Latin 1 + Euro symbol #### [` IBM860 `]() enumerator IBM860 = 860 OEM Portuguese; Portuguese (DOS) #### [` IBM861 `]() enumerator IBM861 = 861 OEM Icelandic; Icelandic (DOS) #### [` DOS_862 `]() enumerator DOS\_862 = 862 OEM Hebrew; Hebrew (DOS) #### [` IBM863 `]() enumerator IBM863 = 863 OEM French Canadian; French Canadian (DOS) #### [` IBM864 `]() enumerator IBM864 = 864 OEM Arabic; Arabic (864) #### [` IBM865 `]() enumerator IBM865 = 865 OEM Nordic; Nordic (DOS) #### [` CP866 `]() enumerator CP866 = 866 OEM Russian; Cyrillic (DOS) #### [` IBM869 `]() enumerator IBM869 = 869 OEM Modern Greek; Greek, Modern (DOS) #### [` IBM870 `]() enumerator IBM870 = 870 IBM EBCDIC Multilingual/ROECE (Latin 2); IBM EBCDIC Multilingual Latin 2 #### [` WINDOWS_874 `]() enumerator WINDOWS\_874 = 874 ANSI/OEM Thai (same as 28605, ISO 8859-15); Thai (Windows) #### [` CP875 `]() enumerator CP875 = 875 IBM EBCDIC Greek Modern #### [` SHIFT_JIS `]() enumerator SHIFT\_JIS = 932 ANSI/OEM Japanese; Japanese (Shift-JIS) #### [` GB2312 `]() enumerator GB2312 = 936 ANSI/OEM Simplified Chinese (PRC, Singapore); Chinese Simplified (GB2312) #### [` KS_C_5601_1987 `]() enumerator KS\_C\_5601\_1987 = 949 ANSI/OEM Korean (Unified Hangul Code) #### [` BIG5 `]() enumerator BIG5 = 950 ANSI/OEM Traditional Chinese (Taiwan; Hong Kong SAR, PRC); Chinese Traditional (Big5) #### [` IBM1026 `]() enumerator IBM1026 = 1026 IBM EBCDIC Turkish (Latin 5) #### [` IBM01047 `]() enumerator IBM01047 = 1047 IBM EBCDIC Latin 1/Open System #### [` IBM01140 `]() enumerator IBM01140 = 1140 IBM EBCDIC US-Canada (037 + Euro symbol); IBM EBCDIC (US-Canada-Euro) #### [` IBM01141 `]() enumerator IBM01141 = 1141 IBM EBCDIC Germany (20273 + Euro symbol); IBM EBCDIC (Germany-Euro) #### [` IBM01142 `]() enumerator IBM01142 = 1142 IBM EBCDIC Denmark-Norway (20277 + Euro symbol); IBM EBCDIC (Denmark-Norway-Euro) #### [` IBM01143 `]() enumerator IBM01143 = 1143 IBM EBCDIC Finland-Sweden (20278 + Euro symbol); IBM EBCDIC (Finland-Sweden-Euro) #### [` IBM01144 `]() enumerator IBM01144 = 1144 IBM EBCDIC Italy (20280 + Euro symbol); IBM EBCDIC (Italy-Euro) #### [` IBM01145 `]() enumerator IBM01145 = 1145 IBM EBCDIC Latin America-Spain (20284 + Euro symbol); IBM EBCDIC (Spain-Euro) #### [` IBM01146 `]() enumerator IBM01146 = 1146 IBM EBCDIC United Kingdom (20285 + Euro symbol); IBM EBCDIC (UK-Euro) #### [` IBM01147 `]() enumerator IBM01147 = 1147 IBM EBCDIC France (20297 + Euro symbol); IBM EBCDIC (France-Euro) #### [` IBM01148 `]() enumerator IBM01148 = 1148 IBM EBCDIC International (500 + Euro symbol); IBM EBCDIC (International-Euro) #### [` IBM01149 `]() enumerator IBM01149 = 1149 IBM EBCDIC Icelandic (20871 + Euro symbol); IBM EBCDIC (Icelandic-Euro) #### [` UTF_16 `]() enumerator UTF\_16 = 1200 Unicode UTF-16, little endian byte order (BMP of ISO 10646); available only to managed applications #### [` UNICODEFFFE `]() enumerator UNICODEFFFE = 1201 Unicode UTF-16, big endian byte order; available only to managed applications #### [` WINDOWS_1250 `]() enumerator WINDOWS\_1250 = 1250 ANSI Central European; Central European (Windows) #### [` WINDOWS_1251 `]() enumerator WINDOWS\_1251 = 1251 ANSI Cyrillic; Cyrillic (Windows) #### [` WINDOWS_1252 `]() enumerator WINDOWS\_1252 = 1252 ANSI Latin 1; Western European (Windows) #### [` WINDOWS_1253 `]() enumerator WINDOWS\_1253 = 1253 ANSI Greek; Greek (Windows) #### [` WINDOWS_1254 `]() enumerator WINDOWS\_1254 = 1254 ANSI Turkish; Turkish (Windows) #### [` WINDOWS_1255 `]() enumerator WINDOWS\_1255 = 1255 ANSI Hebrew; Hebrew (Windows) #### [` WINDOWS_1256 `]() enumerator WINDOWS\_1256 = 1256 ANSI Arabic; Arabic (Windows) #### [` WINDOWS_1257 `]() enumerator WINDOWS\_1257 = 1257 ANSI Baltic; Baltic (Windows) #### [` WINDOWS_1258 `]() enumerator WINDOWS\_1258 = 1258 ANSI/OEM Vietnamese; Vietnamese (Windows) #### [` JOHAB `]() enumerator JOHAB = 1361 Korean (Johab) #### [` MACINTOSH `]() enumerator MACINTOSH = 10000 MAC Roman; Western European (Mac) #### [` X_MAC_JAPANESE `]() enumerator X\_MAC\_JAPANESE = 10001 Japanese (Mac) #### [` X_MAC_CHINESETRAD `]() enumerator X\_MAC\_CHINESETRAD = 10002 MAC Traditional Chinese (Big5); Chinese Traditional (Mac) #### [` X_MAC_KOREAN `]() enumerator X\_MAC\_KOREAN = 10003 Korean (Mac) #### [` X_MAC_ARABIC `]() enumerator X\_MAC\_ARABIC = 10004 Arabic (Mac) #### [` X_MAC_HEBREW `]() enumerator X\_MAC\_HEBREW = 10005 Hebrew (Mac) #### [` X_MAC_GREEK `]() enumerator X\_MAC\_GREEK = 10006 Greek (Mac) #### [` X_MAC_CYRILLIC `]() enumerator X\_MAC\_CYRILLIC = 10007 Cyrillic (Mac) #### [` X_MAC_CHINESESIMP `]() enumerator X\_MAC\_CHINESESIMP = 10008 MAC Simplified Chinese (GB 2312); Chinese Simplified (Mac) #### [` X_MAC_ROMANIAN `]() enumerator X\_MAC\_ROMANIAN = 10010 Romanian (Mac) #### [` X_MAC_UKRAINIAN `]() enumerator X\_MAC\_UKRAINIAN = 10017 Ukrainian (Mac) #### [` X_MAC_THAI `]() enumerator X\_MAC\_THAI = 10021 Thai (Mac) #### [` X_MAC_CE `]() enumerator X\_MAC\_CE = 10029 MAC Latin 2; Central European (Mac) #### [` X_MAC_ICELANDIC `]() enumerator X\_MAC\_ICELANDIC = 10079 Icelandic (Mac) #### [` X_MAC_TURKISH `]() enumerator X\_MAC\_TURKISH = 10081 Turkish (Mac) #### [` X_MAC_CROATIAN `]() enumerator X\_MAC\_CROATIAN = 10082 Croatian (Mac) #### [` UTF_32 `]() enumerator UTF\_32 = 12000 Unicode UTF-32, little endian byte order; available only to managed applications #### [` UTF_32BE `]() enumerator UTF\_32BE = 12001 Unicode UTF-32, big endian byte order; available only to managed applications #### [` X_CHINESE_CNS `]() enumerator X\_CHINESE\_CNS = 20000 CNS Taiwan; Chinese Traditional (CNS) #### [` X_CP20001 `]() enumerator X\_CP20001 = 20001 TCA Taiwan #### [` X_CHINESE_ETEN `]() enumerator X\_CHINESE\_ETEN = 20002 Eten Taiwan; Chinese Traditional (Eten) #### [` X_CP20003 `]() enumerator X\_CP20003 = 20003 IBM5550 Taiwan #### [` X_CP20004 `]() enumerator X\_CP20004 = 20004 TeleText Taiwan #### [` X_CP20005 `]() enumerator X\_CP20005 = 20005 Wang Taiwan #### [` X_IA5 `]() enumerator X\_IA5 = 20105 IA5 (IRV International Alphabet No. 5, 7-bit); Western European (IA5) #### [` X_IA5_GERMAN `]() enumerator X\_IA5\_GERMAN = 20106 IA5 German (7-bit) #### [` X_IA5_SWEDISH `]() enumerator X\_IA5\_SWEDISH = 20107 IA5 Swedish (7-bit) #### [` X_IA5_NORWEGIAN `]() enumerator X\_IA5\_NORWEGIAN = 20108 IA5 Norwegian (7-bit) #### [` US_ASCII `]() enumerator US\_ASCII = 20127 US-ASCII (7-bit) #### [` X_CP20261 `]() enumerator X\_CP20261 = 20261 T.61 #### [` X_CP20269 `]() enumerator X\_CP20269 = 20269 ISO 6937 Non-Spacing Accent #### [` IBM273 `]() enumerator IBM273 = 20273 IBM EBCDIC Germany #### [` IBM277 `]() enumerator IBM277 = 20277 IBM EBCDIC Denmark-Norway #### [` IBM278 `]() enumerator IBM278 = 20278 IBM EBCDIC Finland-Sweden #### [` IBM280 `]() enumerator IBM280 = 20280 IBM EBCDIC Italy #### [` IBM284 `]() enumerator IBM284 = 20284 IBM EBCDIC Latin America-Spain #### [` IBM285 `]() enumerator IBM285 = 20285 IBM EBCDIC United Kingdom #### [` IBM290 `]() enumerator IBM290 = 20290 IBM EBCDIC Japanese Katakana Extended #### [` IBM297 `]() enumerator IBM297 = 20297 IBM EBCDIC France #### [` IBM420 `]() enumerator IBM420 = 20420 IBM EBCDIC Arabic #### [` IBM423 `]() enumerator IBM423 = 20423 IBM EBCDIC Greek #### [` IBM424 `]() enumerator IBM424 = 20424 IBM EBCDIC Hebrew #### [` X_EBCDIC_KOREANEXTENDED `]() enumerator X\_EBCDIC\_KOREANEXTENDED = 20833 IBM EBCDIC Korean Extended #### [` IBM_THAI `]() enumerator IBM\_THAI = 20838 IBM EBCDIC Thai #### [` KOI8_R `]() enumerator KOI8\_R = 20866 Russian (KOI8-R); Cyrillic (KOI8-R) #### [` IBM871 `]() enumerator IBM871 = 20871 IBM EBCDIC Icelandic #### [` IBM880 `]() enumerator IBM880 = 20880 IBM EBCDIC Cyrillic Russian #### [` IBM905 `]() enumerator IBM905 = 20905 IBM EBCDIC Turkish #### [` IBM00924 `]() enumerator IBM00924 = 20924 IBM EBCDIC Latin 1/Open System (1047 + Euro symbol) #### [` EUC_JP_JIS `]() enumerator EUC\_JP\_JIS = 20932 Japanese (JIS 0208-1990 and 0121-1990) #### [` X_CP20936 `]() enumerator X\_CP20936 = 20936 Simplified Chinese (GB2312); Chinese Simplified (GB2312-80) #### [` X_CP20949 `]() enumerator X\_CP20949 = 20949 Korean Wansung #### [` CP1025 `]() enumerator CP1025 = 21025 IBM EBCDIC Cyrillic Serbian-Bulgarian #### [` KOI8_U `]() enumerator KOI8\_U = 21866 Ukrainian (KOI8-U); Cyrillic (KOI8-U) #### [` ISO_8859_1 `]() enumerator ISO\_8859\_1 = 28591 ISO 8859-1 Latin 1; Western European (ISO) #### [` ISO_8859_2 `]() enumerator ISO\_8859\_2 = 28592 ISO 8859-2 Central European; Central European (ISO) #### [` ISO_8859_3 `]() enumerator ISO\_8859\_3 = 28593 ISO 8859-3 Latin 3 #### [` ISO_8859_4 `]() enumerator ISO\_8859\_4 = 28594 ISO 8859-4 Baltic #### [` ISO_8859_5 `]() enumerator ISO\_8859\_5 = 28595 ISO 8859-5 Cyrillic #### [` ISO_8859_6 `]() enumerator ISO\_8859\_6 = 28596 ISO 8859-6 Arabic #### [` ISO_8859_7 `]() enumerator ISO\_8859\_7 = 28597 ISO 8859-7 Greek #### [` ISO_8859_8 `]() enumerator ISO\_8859\_8 = 28598 ISO 8859-8 Hebrew; Hebrew (ISO-Visual) #### [` ISO_8859_9 `]() enumerator ISO\_8859\_9 = 28599 ISO 8859-9 Turkish #### [` ISO_8859_13 `]() enumerator ISO\_8859\_13 = 28603 ISO 8859-13 Estonian #### [` ISO_8859_15 `]() enumerator ISO\_8859\_15 = 28605 ISO 8859-15 Latin 9 #### [` X_EUROPA `]() enumerator X\_EUROPA = 29001 Europa 3 #### [` ISO_8859_8_I `]() enumerator ISO\_8859\_8\_I = 38598 ISO 8859-8 Hebrew; Hebrew (ISO-Logical) #### [` ISO_2022_JP `]() enumerator ISO\_2022\_JP = 50220 ISO 2022 Japanese with no halfwidth Katakana; Japanese (JIS) #### [` CSISO2022JP `]() enumerator CSISO2022JP = 50221 ISO 2022 Japanese with halfwidth Katakana; Japanese (JIS-Allow 1 byte Kana) #### [` ISO_2022_JP_JIS `]() enumerator ISO\_2022\_JP\_JIS = 50222 ISO 2022 Japanese JIS X 0201-1989; Japanese (JIS-Allow 1 byte Kana - SO/SI) #### [` ISO_2022_KR `]() enumerator ISO\_2022\_KR = 50225 ISO 2022 Korean #### [` X_CP50227 `]() enumerator X\_CP50227 = 50227 ISO 2022 Simplified Chinese; Chinese Simplified (ISO 2022) #### [` EUC_JP `]() enumerator EUC\_JP = 51932 EUC Japanese #### [` EUC_CN `]() enumerator EUC\_CN = 51936 EUC Simplified Chinese; Chinese Simplified (EUC) #### [` EUC_KR `]() enumerator EUC\_KR = 51949 EUC Korean #### [` HZ_GB_2312 `]() enumerator HZ\_GB\_2312 = 52936 HZ-GB2312 Simplified Chinese; Chinese Simplified (HZ) #### [` GB18030 `]() enumerator GB18030 = 54936 Windows XP and later: GB18030 Simplified Chinese (4 byte); Chinese Simplified (GB18030) #### [` X_ISCII_DE `]() enumerator X\_ISCII\_DE = 57002 ISCII Devanagari #### [` X_ISCII_BE `]() enumerator X\_ISCII\_BE = 57003 ISCII Bengali #### [` X_ISCII_TA `]() enumerator X\_ISCII\_TA = 57004 ISCII Tamil #### [` X_ISCII_TE `]() enumerator X\_ISCII\_TE = 57005 ISCII Telugu #### [` X_ISCII_AS `]() enumerator X\_ISCII\_AS = 57006 ISCII Assamese #### [` X_ISCII_OR `]() enumerator X\_ISCII\_OR = 57007 ISCII Oriya #### [` X_ISCII_KA `]() enumerator X\_ISCII\_KA = 57008 ISCII Kannada #### [` X_ISCII_MA `]() enumerator X\_ISCII\_MA = 57009 ISCII Malayalam #### [` X_ISCII_GU `]() enumerator X\_ISCII\_GU = 57010 ISCII Gujarati #### [` X_ISCII_PA `]() enumerator X\_ISCII\_PA = 57011 ISCII Punjabi #### [` UTF_7 `]() enumerator UTF\_7 = 65000 Unicode (UTF-7) #### [` UTF_8 `]() enumerator UTF\_8 = 65001 Unicode (UTF-8) ### [` LIEF::PE::ALGORITHMS `]() enum class LIEF::PE::ALGORITHMS : uint32\_t Cryptography algorithms. *Values:* #### [` UNKNOWN `]() enumerator UNKNOWN = 0 #### [` SHA_512 `]() enumerator SHA\_512 #### [` SHA_384 `]() enumerator SHA\_384 #### [` SHA_256 `]() enumerator SHA\_256 #### [` SHA_1 `]() enumerator SHA\_1 #### [` MD5 `]() enumerator MD5 #### [` MD4 `]() enumerator MD4 #### [` MD2 `]() enumerator MD2 #### [` RSA `]() enumerator RSA #### [` EC `]() enumerator EC #### [` MD5_RSA `]() enumerator MD5\_RSA #### [` SHA1_DSA `]() enumerator SHA1\_DSA #### [` SHA1_RSA `]() enumerator SHA1\_RSA #### [` SHA_256_RSA `]() enumerator SHA\_256\_RSA #### [` SHA_384_RSA `]() enumerator SHA\_384\_RSA #### [` SHA_512_RSA `]() enumerator SHA\_512\_RSA #### [` SHA1_ECDSA `]() enumerator SHA1\_ECDSA #### [` SHA_256_ECDSA `]() enumerator SHA\_256\_ECDSA #### [` SHA_384_ECDSA `]() enumerator SHA\_384\_ECDSA #### [` SHA_512_ECDSA `]() enumerator SHA\_512\_ECDSA ### [` LIEF::PE::ACCELERATOR_CODES `]() enum class LIEF::PE::ACCELERATOR\_CODES : uint32\_t From [https://docs.microsoft.com/en-us/windows/win32/inputdev/virtual-key-codes](). *Values:* #### [` LBUTTON `]() enumerator LBUTTON = 0x01 #### [` RBUTTON `]() enumerator RBUTTON = 0x02 #### [` CANCEL `]() enumerator CANCEL = 0x03 #### [` MBUTTON `]() enumerator MBUTTON = 0x04 #### [` XBUTTON1_K `]() enumerator XBUTTON1\_K = 0x05 #### [` XBUTTON2_K `]() enumerator XBUTTON2\_K = 0x06 #### [` BACK `]() enumerator BACK = 0x08 #### [` TAB `]() enumerator TAB = 0x09 #### [` CLEAR `]() enumerator CLEAR = 0x0C #### [` RETURN `]() enumerator RETURN = 0x0D #### [` SHIFT `]() enumerator SHIFT = 0x10 #### [` CONTROL `]() enumerator CONTROL = 0x11 #### [` MENU `]() enumerator MENU = 0x12 #### [` PAUSE `]() enumerator PAUSE = 0x13 #### [` CAPITAL `]() enumerator CAPITAL = 0x14 #### [` KANA `]() enumerator KANA = 0x15 #### [` IME_ON `]() enumerator IME\_ON = 0x16 #### [` JUNJA `]() enumerator JUNJA = 0x17 #### [` FINAL `]() enumerator FINAL = 0x18 #### [` KANJI `]() enumerator KANJI = 0x19 #### [` IME_OFF `]() enumerator IME\_OFF = 0x1A #### [` ESCAPE `]() enumerator ESCAPE = 0x1B #### [` CONVERT `]() enumerator CONVERT = 0x1C #### [` NONCONVERT `]() enumerator NONCONVERT = 0x1D #### [` ACCEPT `]() enumerator ACCEPT = 0x1E #### [` MODECHANGE `]() enumerator MODECHANGE = 0x1F #### [` SPACE `]() enumerator SPACE = 0x20 #### [` PRIOR `]() enumerator PRIOR = 0x21 #### [` NEXT `]() enumerator NEXT = 0x22 #### [` END `]() enumerator END = 0x23 #### [` HOME `]() enumerator HOME = 0x24 #### [` LEFT `]() enumerator LEFT = 0x25 #### [` UP `]() enumerator UP = 0x26 #### [` RIGHT `]() enumerator RIGHT = 0x27 #### [` DOWN `]() enumerator DOWN = 0x28 #### [` SELECT `]() enumerator SELECT = 0x29 #### [` PRINT `]() enumerator PRINT = 0x2A #### [` EXECUTE `]() enumerator EXECUTE = 0x2B #### [` SNAPSHOT `]() enumerator SNAPSHOT = 0x2C #### [` INSERT `]() enumerator INSERT = 0x2D #### [` DELETE_K `]() enumerator DELETE\_K = 0x2E #### [` HELP `]() enumerator HELP = 0x2F #### [` NUM_0 `]() enumerator NUM\_0 = 0x30 #### [` NUM_1 `]() enumerator NUM\_1 = 0x31 #### [` NUM_2 `]() enumerator NUM\_2 = 0x32 #### [` NUM_3 `]() enumerator NUM\_3 = 0x33 #### [` NUM_4 `]() enumerator NUM\_4 = 0x34 #### [` NUM_5 `]() enumerator NUM\_5 = 0x35 #### [` NUM_6 `]() enumerator NUM\_6 = 0x36 #### [` NUM_7 `]() enumerator NUM\_7 = 0x37 #### [` NUM_8 `]() enumerator NUM\_8 = 0x38 #### [` NUM_9 `]() enumerator NUM\_9 = 0x39 #### [` A `]() enumerator A = 0x41 #### [` B `]() enumerator B = 0x42 #### [` C `]() enumerator C = 0x43 #### [` D `]() enumerator D = 0x44 #### [` E `]() enumerator E = 0x45 #### [` F `]() enumerator F = 0x46 #### [` G `]() enumerator G = 0x47 #### [` H `]() enumerator H = 0x48 #### [` I `]() enumerator I = 0x49 #### [` J `]() enumerator J = 0x4A #### [` K `]() enumerator K = 0x4B #### [` L `]() enumerator L = 0x4C #### [` M `]() enumerator M = 0x4D #### [` N `]() enumerator N = 0x4E #### [` O `]() enumerator O = 0x4F #### [` P `]() enumerator P = 0x50 #### [` Q `]() enumerator Q = 0x51 #### [` R `]() enumerator R = 0x52 #### [` S `]() enumerator S = 0x53 #### [` T `]() enumerator T = 0x54 #### [` U `]() enumerator U = 0x55 #### [` V `]() enumerator V = 0x56 #### [` W `]() enumerator W = 0x57 #### [` X `]() enumerator X = 0x58 #### [` Y `]() enumerator Y = 0x59 #### [` Z `]() enumerator Z = 0x5A #### [` LWIN `]() enumerator LWIN = 0x5B #### [` RWIN `]() enumerator RWIN = 0x5C #### [` APPS `]() enumerator APPS = 0x5D #### [` SLEEP `]() enumerator SLEEP = 0x5F #### [` NUMPAD0 `]() enumerator NUMPAD0 = 0x60 #### [` NUMPAD1 `]() enumerator NUMPAD1 = 0x61 #### [` NUMPAD2 `]() enumerator NUMPAD2 = 0x62 #### [` NUMPAD3 `]() enumerator NUMPAD3 = 0x63 #### [` NUMPAD4 `]() enumerator NUMPAD4 = 0x64 #### [` NUMPAD5 `]() enumerator NUMPAD5 = 0x65 #### [` NUMPAD6 `]() enumerator NUMPAD6 = 0x66 #### [` NUMPAD7 `]() enumerator NUMPAD7 = 0x67 #### [` NUMPAD8 `]() enumerator NUMPAD8 = 0x68 #### [` NUMPAD9 `]() enumerator NUMPAD9 = 0x69 #### [` MULTIPLY `]() enumerator MULTIPLY = 0x6A #### [` ADD `]() enumerator ADD = 0x6B #### [` SEPARATOR `]() enumerator SEPARATOR = 0x6C #### [` SUBTRACT `]() enumerator SUBTRACT = 0x6D #### [` DECIMAL `]() enumerator DECIMAL = 0x6E #### [` DIVIDE `]() enumerator DIVIDE = 0x6F #### [` F1 `]() enumerator F1 = 0x70 #### [` F2 `]() enumerator F2 = 0x71 #### [` F3 `]() enumerator F3 = 0x72 #### [` F4 `]() enumerator F4 = 0x73 #### [` F5 `]() enumerator F5 = 0x74 #### [` F6 `]() enumerator F6 = 0x75 #### [` F7 `]() enumerator F7 = 0x76 #### [` F8 `]() enumerator F8 = 0x77 #### [` F9 `]() enumerator F9 = 0x78 #### [` F10 `]() enumerator F10 = 0x79 #### [` F11 `]() enumerator F11 = 0x7A #### [` F12 `]() enumerator F12 = 0x7B #### [` F13 `]() enumerator F13 = 0x7C #### [` F14 `]() enumerator F14 = 0x7D #### [` F15 `]() enumerator F15 = 0x7E #### [` F16 `]() enumerator F16 = 0x7F #### [` F17 `]() enumerator F17 = 0x80 #### [` F18 `]() enumerator F18 = 0x81 #### [` F19 `]() enumerator F19 = 0x82 #### [` F20 `]() enumerator F20 = 0x83 #### [` F21 `]() enumerator F21 = 0x84 #### [` F22 `]() enumerator F22 = 0x85 #### [` F23 `]() enumerator F23 = 0x86 #### [` F24 `]() enumerator F24 = 0x87 #### [` NUMLOCK `]() enumerator NUMLOCK = 0x90 #### [` SCROLL `]() enumerator SCROLL = 0x91 #### [` LSHIFT `]() enumerator LSHIFT = 0xA0 #### [` RSHIFT `]() enumerator RSHIFT = 0xA1 #### [` LCONTROL `]() enumerator LCONTROL = 0xA2 #### [` RCONTROL `]() enumerator RCONTROL = 0xA3 #### [` LMENU `]() enumerator LMENU = 0xA4 #### [` RMENU `]() enumerator RMENU = 0xA5 #### [` BROWSER_BACK `]() enumerator BROWSER\_BACK = 0xA6 #### [` BROWSER_FORWARD `]() enumerator BROWSER\_FORWARD = 0xA7 #### [` BROWSER_REFRESH `]() enumerator BROWSER\_REFRESH = 0xA8 #### [` BROWSER_STOP `]() enumerator BROWSER\_STOP = 0xA9 #### [` BROWSER_SEARCH `]() enumerator BROWSER\_SEARCH = 0xAA #### [` BROWSER_FAVORITES `]() enumerator BROWSER\_FAVORITES = 0xAB #### [` BROWSER_HOME `]() enumerator BROWSER\_HOME = 0xAC #### [` VOLUME_MUTE `]() enumerator VOLUME\_MUTE = 0xAD #### [` VOLUME_DOWN `]() enumerator VOLUME\_DOWN = 0xAE #### [` VOLUME_UP `]() enumerator VOLUME\_UP = 0xAF #### [` MEDIA_NEXT_TRACK `]() enumerator MEDIA\_NEXT\_TRACK = 0xB0 #### [` MEDIA_PREV_TRACK `]() enumerator MEDIA\_PREV\_TRACK = 0xB1 #### [` MEDIA_STOP `]() enumerator MEDIA\_STOP = 0xB2 #### [` MEDIA_PLAY_PAUSE `]() enumerator MEDIA\_PLAY\_PAUSE = 0xB3 #### [` LAUNCH_MAIL `]() enumerator LAUNCH\_MAIL = 0xB4 #### [` LAUNCH_MEDIA_SELECT `]() enumerator LAUNCH\_MEDIA\_SELECT = 0xB5 #### [` LAUNCH_APP1 `]() enumerator LAUNCH\_APP1 = 0xB6 #### [` LAUNCH_APP2 `]() enumerator LAUNCH\_APP2 = 0xB7 #### [` OEM_1 `]() enumerator OEM\_1 = 0xBA #### [` OEM_PLUS `]() enumerator OEM\_PLUS = 0xBB #### [` OEM_COMMA `]() enumerator OEM\_COMMA = 0xBC #### [` OEM_MINUS `]() enumerator OEM\_MINUS = 0xBD #### [` OEM_PERIOD `]() enumerator OEM\_PERIOD = 0xBE #### [` OEM_2 `]() enumerator OEM\_2 = 0xBF #### [` OEM_4 `]() enumerator OEM\_4 = 0xDB #### [` OEM_5 `]() enumerator OEM\_5 = 0xDC #### [` OEM_6 `]() enumerator OEM\_6 = 0xDD #### [` OEM_7 `]() enumerator OEM\_7 = 0xDE #### [` OEM_8 `]() enumerator OEM\_8 = 0xDF #### [` OEM_102 `]() enumerator OEM\_102 = 0xE2 #### [` PROCESSKEY `]() enumerator PROCESSKEY = 0xE5 #### [` PACKET `]() enumerator PACKET = 0xE7 #### [` ATTN `]() enumerator ATTN = 0xF6 #### [` CRSEL `]() enumerator CRSEL = 0xF7 #### [` EXSEL `]() enumerator EXSEL = 0xF8 #### [` EREOF `]() enumerator EREOF = 0xF9 #### [` PLAY `]() enumerator PLAY = 0xFA #### [` ZOOM `]() enumerator ZOOM = 0xFB #### [` NONAME `]() enumerator NONAME = 0xFC #### [` PA1 `]() enumerator PA1 = 0xFD #### [` OEM_CLEAR `]() enumerator OEM\_CLEAR = 0xFE