LIEF: Library to Instrument Executable Formats Version 0.15.1
Loading...
Searching...
No Matches
Header.h File Reference
#include <inttypes.h>
#include "LIEF/visibility.h"
Include dependency graph for PE/Header.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Classes

struct  Pe_Header_t
 

Typedefs

typedef struct Pe_Header_t Pe_Header_t
 

Enumerations

enum  LIEF_PE_MACHINE_TYPES {
  LIEF_PE_MACHINE_UNKNOWN = 0x0 , LIEF_PE_MACHINE_AM33 = 0x1D3 , LIEF_PE_MACHINE_AMD64 = 0x8664 , LIEF_PE_MACHINE_ARM = 0x1C0 ,
  LIEF_PE_MACHINE_ARMNT = 0x1C4 , LIEF_PE_MACHINE_ARM64 = 0xAA64 , LIEF_PE_MACHINE_EBC = 0xEBC , LIEF_PE_MACHINE_I386 = 0x14C ,
  LIEF_PE_MACHINE_IA64 = 0x200 , LIEF_PE_MACHINE_M32R = 0x9041 , LIEF_PE_MACHINE_MIPS16 = 0x266 , LIEF_PE_MACHINE_MIPSFPU = 0x366 ,
  LIEF_PE_MACHINE_MIPSFPU16 = 0x466 , LIEF_PE_MACHINE_POWERPC = 0x1F0 , LIEF_PE_MACHINE_POWERPCFP = 0x1F1 , LIEF_PE_MACHINE_R4000 = 0x166 ,
  LIEF_PE_MACHINE_RISCV32 = 0x5032 , LIEF_PE_MACHINE_RISCV64 = 0x5064 , LIEF_PE_MACHINE_RISCV128 = 0x5128 , LIEF_PE_MACHINE_SH3 = 0x1A2 ,
  LIEF_PE_MACHINE_SH3DSP = 0x1A3 , LIEF_PE_MACHINE_SH4 = 0x1A6 , LIEF_PE_MACHINE_SH5 = 0x1A8 , LIEF_PE_MACHINE_THUMB = 0x1C2 ,
  LIEF_PE_MACHINE_WCEMIPSV2 = 0x169
}
 
enum  LIEF_PE_HEADER_CHARACTERISTICS {
  LIEF_PE_HEADER_CHARACTERISTICS_INVALID = 0x0000 , LIEF_PE_HEADER_CHARACTERISTICS_RELOCS_STRIPPED = 0x0001 , LIEF_PE_HEADER_CHARACTERISTICS_EXECUTABLE_IMAGE = 0x0002 , LIEF_PE_HEADER_CHARACTERISTICS_LINE_NUMS_STRIPPED = 0x0004 ,
  LIEF_PE_HEADER_CHARACTERISTICS_LOCAL_SYMS_STRIPPED = 0x0008 , LIEF_PE_HEADER_CHARACTERISTICS_AGGRESSIVE_WS_TRIM = 0x0010 , LIEF_PE_HEADER_CHARACTERISTICS_LARGE_ADDRESS_AWARE = 0x0020 , LIEF_PE_HEADER_CHARACTERISTICS_BYTES_REVERSED_LO = 0x0080 ,
  LIEF_PE_HEADER_CHARACTERISTICS_32BIT_MACHINE = 0x0100 , LIEF_PE_HEADER_CHARACTERISTICS_DEBUG_STRIPPED = 0x0200 , LIEF_PE_HEADER_CHARACTERISTICS_REMOVABLE_RUN_FROM_SWAP = 0x0400 , LIEF_PE_HEADER_CHARACTERISTICS_NET_RUN_FROM_SWAP = 0x0800 ,
  LIEF_PE_HEADER_CHARACTERISTICS_SYSTEM = 0x1000 , LIEF_PE_HEADER_CHARACTERISTICS_DLL = 0x2000 , LIEF_PE_HEADER_CHARACTERISTICS_UP_SYSTEM_ONLY = 0x4000 , LIEF_PE_HEADER_CHARACTERISTICS_BYTES_REVERSED_HI = 0x8000
}
 

Functions

const char * lief_pe_header_machine_str (enum LIEF_PE_MACHINE_TYPES e)
 
const char * lief_pe_header_characteristics_str (enum LIEF_PE_HEADER_CHARACTERISTICS e)
 

Typedef Documentation

◆ Pe_Header_t

typedef struct Pe_Header_t Pe_Header_t

Enumeration Type Documentation

◆ LIEF_PE_HEADER_CHARACTERISTICS

Enumerator
LIEF_PE_HEADER_CHARACTERISTICS_INVALID 
LIEF_PE_HEADER_CHARACTERISTICS_RELOCS_STRIPPED 

The file does not contain base relocations and must be loaded at its preferred base. If this cannot be done, the loader will error.

LIEF_PE_HEADER_CHARACTERISTICS_EXECUTABLE_IMAGE 

The file is valid and can be run.

LIEF_PE_HEADER_CHARACTERISTICS_LINE_NUMS_STRIPPED 

COFF line numbers have been stripped. This is deprecated and should be 0

LIEF_PE_HEADER_CHARACTERISTICS_LOCAL_SYMS_STRIPPED 

COFF symbol table entries for local symbols have been removed. This is deprecated and should be 0.

LIEF_PE_HEADER_CHARACTERISTICS_AGGRESSIVE_WS_TRIM 

Aggressively trim working set. This is deprecated and must be 0.

LIEF_PE_HEADER_CHARACTERISTICS_LARGE_ADDRESS_AWARE 

Image can handle > 2GiB addresses.

LIEF_PE_HEADER_CHARACTERISTICS_BYTES_REVERSED_LO 

Little endian: the LSB precedes the MSB in memory. This is deprecated and should be 0.

LIEF_PE_HEADER_CHARACTERISTICS_32BIT_MACHINE 

Machine is based on a 32bit word architecture.

LIEF_PE_HEADER_CHARACTERISTICS_DEBUG_STRIPPED 

Debugging info has been removed.

LIEF_PE_HEADER_CHARACTERISTICS_REMOVABLE_RUN_FROM_SWAP 

If the image is on removable media, fully load it and copy it to swap.

LIEF_PE_HEADER_CHARACTERISTICS_NET_RUN_FROM_SWAP 

If the image is on network media, fully load it and copy it to swap.

LIEF_PE_HEADER_CHARACTERISTICS_SYSTEM 

The image file is a system file, not a user program.

LIEF_PE_HEADER_CHARACTERISTICS_DLL 

The image file is a DLL.

LIEF_PE_HEADER_CHARACTERISTICS_UP_SYSTEM_ONLY 

This file should only be run on a uniprocessor machine.

LIEF_PE_HEADER_CHARACTERISTICS_BYTES_REVERSED_HI 

Big endian: the MSB precedes the LSB in memory. This is deprecated

◆ LIEF_PE_MACHINE_TYPES

Enumerator
LIEF_PE_MACHINE_UNKNOWN 
LIEF_PE_MACHINE_AM33 

Matsushita AM33

LIEF_PE_MACHINE_AMD64 

AMD x64

LIEF_PE_MACHINE_ARM 

ARM little endian

LIEF_PE_MACHINE_ARMNT 

ARMv7 Thumb mode only

LIEF_PE_MACHINE_ARM64 

ARMv8 in 64-bits mode

LIEF_PE_MACHINE_EBC 

EFI byte code

LIEF_PE_MACHINE_I386 

Intel 386 or later

LIEF_PE_MACHINE_IA64 

Intel Itanium processor family

LIEF_PE_MACHINE_M32R 

Mitsubishi M32R little endian

LIEF_PE_MACHINE_MIPS16 

MIPS16

LIEF_PE_MACHINE_MIPSFPU 

MIPS with FPU

LIEF_PE_MACHINE_MIPSFPU16 

MIPS16 with FPU

LIEF_PE_MACHINE_POWERPC 

Power PC little endian

LIEF_PE_MACHINE_POWERPCFP 

Power PC with floating point

LIEF_PE_MACHINE_R4000 

MIPS with little endian

LIEF_PE_MACHINE_RISCV32 

RISC-V 32-bit address space

LIEF_PE_MACHINE_RISCV64 

RISC-V 64-bit address space

LIEF_PE_MACHINE_RISCV128 

RISC-V 128-bit address space

LIEF_PE_MACHINE_SH3 

Hitachi SH3

LIEF_PE_MACHINE_SH3DSP 

Hitachi SH3 DSP

LIEF_PE_MACHINE_SH4 

Hitachi SH4

LIEF_PE_MACHINE_SH5 

Hitachi SH5

LIEF_PE_MACHINE_THUMB 

ARM or Thumb

LIEF_PE_MACHINE_WCEMIPSV2 

MIPS little-endian WCE v2

Function Documentation

◆ lief_pe_header_characteristics_str()

const char * lief_pe_header_characteristics_str ( enum LIEF_PE_HEADER_CHARACTERISTICS e)

◆ lief_pe_header_machine_str()

const char * lief_pe_header_machine_str ( enum LIEF_PE_MACHINE_TYPES e)