LIEF: Library to Instrument Executable Formats Version 1.0.0
Loading...
Searching...
No Matches
OptionalHeader.hpp
Go to the documentation of this file.
1/* Copyright 2017 - 2026 R. Thomas
2 * Copyright 2017 - 2026 Quarkslab
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16#ifndef LIEF_PE_OPTIONAL_HEADER_H
17#define LIEF_PE_OPTIONAL_HEADER_H
18#include <ostream>
19#include <vector>
20#include <cstdint>
21
23#include "LIEF/Object.hpp"
24#include "LIEF/visibility.h"
25
26#include "LIEF/enums.hpp"
27#include "LIEF/PE/enums.hpp"
28
29namespace LIEF {
30namespace PE {
31class Parser;
32class Binary;
33
34namespace details {
35struct pe32_optional_header;
36struct pe64_optional_header;
37}
38
44 friend class Parser;
45 friend class Binary;
46
47 public:
48 enum class DLL_CHARACTERISTICS : size_t {
50 HIGH_ENTROPY_VA = 0x0020,
51
53 DYNAMIC_BASE = 0x0040,
54
56 FORCE_INTEGRITY = 0x0080,
57
59 NX_COMPAT = 0x0100,
60
62 NO_ISOLATION = 0x0200,
63
66 NO_SEH = 0x0400,
67
69 NO_BIND = 0x0800,
70
72 APPCONTAINER = 0x1000,
73
75 WDM_DRIVER = 0x2000,
76
78 GUARD_CF = 0x4000,
79
81 TERMINAL_SERVER_AWARE = 0x8000,
82 };
83
84 enum class SUBSYSTEM : size_t {
85 UNKNOWN = 0,
86 NATIVE = 1,
87 WINDOWS_GUI = 2,
88 WINDOWS_CUI = 3,
89 OS2_CUI = 5,
90 POSIX_CUI = 7,
91 NATIVE_WINDOWS = 8,
92 WINDOWS_CE_GUI = 9,
93 EFI_APPLICATION = 10,
94 EFI_BOOT_SERVICE_DRIVER = 11,
95 EFI_RUNTIME_DRIVER = 12,
96 EFI_ROM = 13,
97 XBOX = 14,
98 WINDOWS_BOOT_APPLICATION = 16,
99 XBOX_CODE_CATALOG = 17,
100 };
101
102 OptionalHeader(const details::pe32_optional_header& header);
103 OptionalHeader(const details::pe64_optional_header& header);
104 ~OptionalHeader() override = default;
105
108
110
112 PE_TYPE magic() const {
113 return magic_;
114 }
115
117 uint8_t major_linker_version() const {
118 return major_linker_version_;
119 }
120
122 uint8_t minor_linker_version() const {
123 return minor_linker_version_;
124 }
125
129 uint32_t sizeof_code() const {
130 return sizeof_code_;
131 }
132
139 uint32_t sizeof_initialized_data() const {
140 return sizeof_initialized_data_;
141 }
142
149 uint32_t sizeof_uninitialized_data() const {
150 return sizeof_uninitialized_data_;
151 }
152
159 uint32_t addressof_entrypoint() const {
160 return entrypoint_;
161 }
162
164 uint32_t baseof_code() const {
165 return baseof_code_;
166 }
167
171 uint32_t baseof_data() const {
172 return baseof_data_;
173 }
174
176 uint64_t imagebase() const {
177 return imagebase_;
178 }
179
184 uint32_t section_alignment() const {
185 return section_align_;
186 }
187
190 uint32_t file_alignment() const {
191 return file_align_;
192 }
193
196 return major_os_version_;
197 }
198
201 return minor_os_version_;
202 }
203
205 uint16_t major_image_version() const {
206 return major_image_version_;
207 }
208
210 uint16_t minor_image_version() const {
211 return minor_image_version_;
212 }
213
215 uint16_t major_subsystem_version() const {
216 return major_subsys_version_;
217 }
218
220 uint16_t minor_subsystem_version() const {
221 return minor_subsys_version_;
222 }
223
226 uint32_t win32_version_value() const {
227 return win32_version_value_;
228 }
229
235 uint32_t sizeof_image() const {
236 return sizeof_image_;
237 }
238
241 uint32_t sizeof_headers() const {
242 return sizeof_headers_;
243 }
244
251 uint32_t checksum() const {
252 return checksum_;
253 }
254
257 return subsystem_;
258 }
259
263 uint32_t dll_characteristics() const {
264 return dll_characteristics_;
265 }
266
271 uint64_t sizeof_stack_reserve() const {
272 return sizeof_stack_reserve_;
273 }
274
276 uint64_t sizeof_stack_commit() const {
277 return sizeof_stack_commit_;
278 }
279
281 uint64_t sizeof_heap_reserve() const {
282 return sizeof_heap_reserve_;
283 }
284
286 uint64_t sizeof_heap_commit() const {
287 return sizeof_heap_commit_;
288 }
289
292 uint32_t loader_flags() const {
293 return loader_flags_;
294 }
295
297 uint32_t numberof_rva_and_size() const {
298 return nb_rva_size_;
299 }
300
302 bool has(DLL_CHARACTERISTICS c) const {
303 return (dll_characteristics() & static_cast<uint32_t>(c)) != 0;
304 }
305
308 std::vector<DLL_CHARACTERISTICS> dll_characteristics_list() const;
309
312 dll_characteristics(dll_characteristics() | static_cast<uint32_t>(c));
313 }
314
317 dll_characteristics(dll_characteristics() & (~static_cast<uint32_t>(c)));
318 }
319
321 magic_ = magic;
322 }
323
324 void major_linker_version(uint8_t value) {
325 major_linker_version_ = value;
326 }
327
328 void minor_linker_version(uint8_t value) {
329 minor_linker_version_ = value;
330 }
331
332 void sizeof_code(uint32_t value) {
333 sizeof_code_ = value;
334 }
335
336 void sizeof_initialized_data(uint32_t value) {
337 sizeof_initialized_data_ = value;
338 }
339
340 void sizeof_uninitialized_data(uint32_t value) {
341 sizeof_uninitialized_data_ = value;
342 }
343
344 void addressof_entrypoint(uint32_t value) {
345 entrypoint_ = value;
346 }
347
348 void baseof_code(uint32_t value) {
349 baseof_code_ = value;
350 }
351
352 void baseof_data(uint32_t value) {
353 baseof_data_ = value;
354 }
355
356 void imagebase(uint64_t value) {
357 imagebase_ = value;
358 }
359
360 void section_alignment(uint32_t value) {
361 section_align_ = value;
362 }
363
364 void file_alignment(uint32_t value) {
365 file_align_ = value;
366 }
367
368 void major_operating_system_version(uint16_t value) {
369 major_os_version_ = value;
370 }
371
372 void minor_operating_system_version(uint16_t value) {
373 minor_os_version_ = value;
374 }
375
376 void major_image_version(uint16_t value) {
377 major_image_version_ = value;
378 }
379
380 void minor_image_version(uint16_t value) {
381 minor_image_version_ = value;
382 }
383
384 void major_subsystem_version(uint16_t value) {
385 major_subsys_version_ = value;
386 }
387
388 void minor_subsystem_version(uint16_t value) {
389 minor_subsys_version_ = value;
390 }
391
392 void win32_version_value(uint32_t value) {
393 win32_version_value_ = value;
394 }
395
396 void sizeof_image(uint32_t value) {
397 sizeof_image_ = value;
398 }
399
400 void sizeof_headers(uint32_t value) {
401 sizeof_headers_ = value;
402 }
403
404 void checksum(uint32_t value) {
405 checksum_ = value;
406 }
407
408 void subsystem(SUBSYSTEM value) {
409 subsystem_ = value;
410 }
411
412 void dll_characteristics(uint32_t value) {
413 dll_characteristics_ = value;
414 }
415
416 void sizeof_stack_reserve(uint64_t value) {
417 sizeof_stack_reserve_ = value;
418 }
419
420 void sizeof_stack_commit(uint64_t value) {
421 sizeof_stack_commit_ = value;
422 }
423
424 void sizeof_heap_reserve(uint64_t value) {
425 sizeof_heap_reserve_ = value;
426 }
427
428 void sizeof_heap_commit(uint64_t value) {
429 sizeof_heap_commit_ = value;
430 }
431
432 void loader_flags(uint32_t value) {
433 loader_flags_ = value;
434 }
435
436 void numberof_rva_and_size(uint32_t value) {
437 nb_rva_size_ = value;
438 }
439
440 void accept(Visitor& visitor) const override;
441
450
451 LIEF_API friend std::ostream& operator<<(std::ostream& os,
452 const OptionalHeader& entry);
453
454 private:
455 OptionalHeader() = default;
456
457 PE_TYPE magic_ = PE_TYPE::PE32;
458 uint8_t major_linker_version_ = 0;
459 uint8_t minor_linker_version_ = 0;
460 uint32_t sizeof_code_ = 0;
461 uint32_t sizeof_initialized_data_ = 0;
462 uint32_t sizeof_uninitialized_data_ = 0;
463 uint32_t entrypoint_ = 0;
464 uint32_t baseof_code_ = 0;
465 uint32_t baseof_data_ = 0;
466 uint64_t imagebase_ = 0;
467 uint32_t section_align_ = 0;
468 uint32_t file_align_ = 0;
469 uint16_t major_os_version_ = 0;
470 uint16_t minor_os_version_ = 0;
471 uint16_t major_image_version_ = 0;
472 uint16_t minor_image_version_ = 0;
473 uint16_t major_subsys_version_ = 0;
474 uint16_t minor_subsys_version_ = 0;
475 uint32_t win32_version_value_ = 0;
476 uint32_t sizeof_image_ = 0;
477 uint32_t sizeof_headers_ = 0;
478 uint32_t checksum_ = 0;
479 SUBSYSTEM subsystem_ = SUBSYSTEM::UNKNOWN;
480 uint32_t dll_characteristics_ = 0;
481 uint64_t sizeof_stack_reserve_ = 0;
482 uint64_t sizeof_stack_commit_ = 0;
483 uint64_t sizeof_heap_reserve_ = 0;
484 uint64_t sizeof_heap_commit_ = 0;
485 uint32_t loader_flags_ = 0;
486 uint32_t nb_rva_size_ = 0;
487};
488
491
492}
493}
494
496
497#endif
Class which represents a PE binary This is the main interface to manage and modify a PE executable.
Definition PE/Binary.hpp:57
DLL_CHARACTERISTICS
Definition OptionalHeader.hpp:48
uint16_t major_image_version() const
The major version number of the image.
Definition OptionalHeader.hpp:205
void baseof_data(uint32_t value)
Definition OptionalHeader.hpp:352
uint16_t minor_subsystem_version() const
The minor version number of the subsystem.
Definition OptionalHeader.hpp:220
void sizeof_code(uint32_t value)
Definition OptionalHeader.hpp:332
SUBSYSTEM
Definition OptionalHeader.hpp:84
@ UNKNOWN
An unknown subsystem.
Definition OptionalHeader.hpp:85
uint32_t numberof_rva_and_size() const
The number of DataDirectory that follow this header.
Definition OptionalHeader.hpp:297
friend std::ostream & operator<<(std::ostream &os, const OptionalHeader &entry)
uint32_t sizeof_uninitialized_data() const
The size of the uninitialized data which are usually located in the .bss section. If the uninitialize...
Definition OptionalHeader.hpp:149
void win32_version_value(uint32_t value)
Definition OptionalHeader.hpp:392
OptionalHeader(const details::pe64_optional_header &header)
std::vector< DLL_CHARACTERISTICS > dll_characteristics_list() const
Return the list of the dll_characteristics as an std::set of DLL_CHARACTERISTICS.
uint64_t sizeof_stack_commit() const
Size of the stack to commit.
Definition OptionalHeader.hpp:276
void major_subsystem_version(uint16_t value)
Definition OptionalHeader.hpp:384
void major_operating_system_version(uint16_t value)
Definition OptionalHeader.hpp:368
OptionalHeader & operator=(const OptionalHeader &)=default
void dll_characteristics(uint32_t value)
Definition OptionalHeader.hpp:412
bool has(DLL_CHARACTERISTICS c) const
Check if the given DLL_CHARACTERISTICS is included in the dll_characteristics.
Definition OptionalHeader.hpp:302
void sizeof_initialized_data(uint32_t value)
Definition OptionalHeader.hpp:336
void addressof_entrypoint(uint32_t value)
Definition OptionalHeader.hpp:344
void magic(PE_TYPE magic)
Definition OptionalHeader.hpp:320
uint8_t minor_linker_version() const
The linker minor version.
Definition OptionalHeader.hpp:122
uint8_t major_linker_version() const
The linker major version.
Definition OptionalHeader.hpp:117
uint32_t sizeof_headers() const
Size of the DosHeader + PE Header + Section headers rounded up to a multiple of the file_alignment.
Definition OptionalHeader.hpp:241
void remove(DLL_CHARACTERISTICS c)
Remove a DLL_CHARACTERISTICS from the current characteristics.
Definition OptionalHeader.hpp:316
uint16_t major_operating_system_version() const
The major version number of the required operating system.
Definition OptionalHeader.hpp:195
~OptionalHeader() override=default
void minor_linker_version(uint8_t value)
Definition OptionalHeader.hpp:328
void sizeof_image(uint32_t value)
Definition OptionalHeader.hpp:396
void minor_operating_system_version(uint16_t value)
Definition OptionalHeader.hpp:372
uint32_t win32_version_value() const
According to the official PE specifications, this value is reserved and should be 0.
Definition OptionalHeader.hpp:226
void loader_flags(uint32_t value)
Definition OptionalHeader.hpp:432
void sizeof_headers(uint32_t value)
Definition OptionalHeader.hpp:400
uint64_t sizeof_heap_commit() const
Size of the heap to commit.
Definition OptionalHeader.hpp:286
uint32_t sizeof_image() const
The size (in bytes) of the image, including all headers, as the image is loaded in memory.
Definition OptionalHeader.hpp:235
uint64_t imagebase() const
The preferred base address when mapping the binary in memory.
Definition OptionalHeader.hpp:176
uint32_t baseof_data() const
Address relative to the imagebase where the binary's data starts.
Definition OptionalHeader.hpp:171
void imagebase(uint64_t value)
Definition OptionalHeader.hpp:356
friend class Binary
Definition OptionalHeader.hpp:45
uint32_t section_alignment() const
The alignment (in bytes) of sections when they are loaded into memory.
Definition OptionalHeader.hpp:184
uint32_t sizeof_code() const
The size of the code .text section or the sum of all the sections that contain code (i....
Definition OptionalHeader.hpp:129
uint16_t minor_operating_system_version() const
The minor version number of the required operating system.
Definition OptionalHeader.hpp:200
uint16_t major_subsystem_version() const
The major version number of the subsystem.
Definition OptionalHeader.hpp:215
friend class Parser
Definition OptionalHeader.hpp:44
void subsystem(SUBSYSTEM value)
Definition OptionalHeader.hpp:408
uint32_t loader_flags() const
According to the PE specifications, this value is reserved and should be 0.
Definition OptionalHeader.hpp:292
SUBSYSTEM subsystem() const
Target subsystem like Driver, XBox, Windows GUI, ...
Definition OptionalHeader.hpp:256
void section_alignment(uint32_t value)
Definition OptionalHeader.hpp:360
uint32_t file_alignment() const
The section's file alignment. This value must be a power of 2 between 512 and 64K....
Definition OptionalHeader.hpp:190
void sizeof_stack_reserve(uint64_t value)
Definition OptionalHeader.hpp:416
void baseof_code(uint32_t value)
Definition OptionalHeader.hpp:348
void file_alignment(uint32_t value)
Definition OptionalHeader.hpp:364
OptionalHeader & operator+=(DLL_CHARACTERISTICS c)
Definition OptionalHeader.hpp:442
void accept(Visitor &visitor) const override
static OptionalHeader create(PE_TYPE type)
uint32_t baseof_code() const
Address relative to the imagebase where the binary's code starts.
Definition OptionalHeader.hpp:164
uint64_t sizeof_stack_reserve() const
Size of the stack to reserve when loading the PE binary.
Definition OptionalHeader.hpp:271
uint32_t sizeof_initialized_data() const
The size of the initialized data which are usually located in the .data section. If the initialized d...
Definition OptionalHeader.hpp:139
uint32_t dll_characteristics() const
Some characteristics of the underlying binary like the support of the PIE. The prefix dll comes from ...
Definition OptionalHeader.hpp:263
uint32_t checksum() const
The image file checksum. The algorithm for computing the checksum is incorporated into IMAGHELP....
Definition OptionalHeader.hpp:251
void major_image_version(uint16_t value)
Definition OptionalHeader.hpp:376
void sizeof_uninitialized_data(uint32_t value)
Definition OptionalHeader.hpp:340
OptionalHeader & operator-=(DLL_CHARACTERISTICS c)
Definition OptionalHeader.hpp:446
void minor_image_version(uint16_t value)
Definition OptionalHeader.hpp:380
uint16_t minor_image_version() const
The minor version number of the image.
Definition OptionalHeader.hpp:210
void major_linker_version(uint8_t value)
Definition OptionalHeader.hpp:324
OptionalHeader(const OptionalHeader &)=default
OptionalHeader(const details::pe32_optional_header &header)
uint32_t addressof_entrypoint() const
The address of the entry point relative to the image base when the executable file is loaded into mem...
Definition OptionalHeader.hpp:159
void minor_subsystem_version(uint16_t value)
Definition OptionalHeader.hpp:388
void add(DLL_CHARACTERISTICS c)
Add a DLL_CHARACTERISTICS to the current characteristics.
Definition OptionalHeader.hpp:311
void checksum(uint32_t value)
Definition OptionalHeader.hpp:404
void numberof_rva_and_size(uint32_t value)
Definition OptionalHeader.hpp:436
void sizeof_stack_commit(uint64_t value)
Definition OptionalHeader.hpp:420
uint64_t sizeof_heap_reserve() const
Size of the heap to reserve when loading the PE binary.
Definition OptionalHeader.hpp:281
PE_TYPE magic() const
Magic bytes: either PE32 or PE32+ for 64-bits PE files.
Definition OptionalHeader.hpp:112
void sizeof_heap_reserve(uint64_t value)
Definition OptionalHeader.hpp:424
void sizeof_heap_commit(uint64_t value)
Definition OptionalHeader.hpp:428
Main interface to parse PE binaries. In particular, the static Parser::parse functions should be used...
Definition PE/Parser.hpp:53
Definition Visitor.hpp:212
#define LIEF_LIFETIMEBOUND
Definition compiler_attributes.hpp:72
#define ENABLE_BITMASK_OPERATORS(X)
Definition enums.hpp:24
Definition DataDirectory.hpp:37
Namespace related to the LIEF's PE module.
Definition Abstract/Header.hpp:32
const char * to_string(CODE_PAGES e)
PE_TYPE
Definition PE/enums.hpp:22
@ PE32
32bits
Definition PE/enums.hpp:23
LIEF namespace.
Definition Abstract/Binary.hpp:41
#define LIEF_API
Definition visibility.h:45