LIEF: Library to Instrument Executable Formats Version 0.15.1
Loading...
Searching...
No Matches
LIEF::PE::Binary Class Reference

Class which represents a PE binary This is the main interface to manage and modify a PE executable. More...

#include <Binary.hpp>

Inheritance diagram for LIEF::PE::Binary:
Collaboration diagram for LIEF::PE::Binary:

Public Types

using sections_t = std::vector<std::unique_ptr<Section>>
 Internal container for storing PE's Section.
 
using it_sections = ref_iterator<sections_t&, Section*>
 Iterator that outputs Section& object.
 
using it_const_sections = const_ref_iterator<const sections_t&, const Section*>
 Iterator that outputs const Section& object.
 
using data_directories_t = std::vector<std::unique_ptr<DataDirectory>>
 Internal container for storing PE's DataDirectory.
 
using it_data_directories = ref_iterator<data_directories_t&, DataDirectory*>
 Iterator that outputs DataDirectory&.
 
using it_const_data_directories = const_ref_iterator<const data_directories_t&, const DataDirectory*>
 Iterator that outputs const DataDirectory&.
 
using relocations_t = std::vector<std::unique_ptr<Relocation>>
 Internal container for storing PE's Relocation.
 
using it_relocations = ref_iterator<relocations_t&, Relocation*>
 Iterator that outputs Relocation&.
 
using it_const_relocations = const_ref_iterator<const relocations_t&, const Relocation*>
 Iterator that outputs const Relocation&.
 
using imports_t = std::vector<Import>
 Internal container for storing PE's Import.
 
using it_imports = ref_iterator<imports_t&>
 Iterator that output Import&.
 
using it_const_imports = const_ref_iterator<const imports_t&>
 Iterator that outputs const Import&.
 
using delay_imports_t = std::vector<DelayImport>
 Internal container for storing PE's DelayImport.
 
using it_delay_imports = ref_iterator<delay_imports_t&>
 Iterator that output DelayImport&.
 
using it_const_delay_imports = const_ref_iterator<const delay_imports_t&>
 Iterator that outputs const DelayImport&.
 
using debug_entries_t = std::vector<std::unique_ptr<Debug>>
 Internal container for storing Debug information.
 
using it_debug_entries = ref_iterator<debug_entries_t&, Debug*>
 Iterator that outputs Debug&.
 
using it_const_debug_entries = const_ref_iterator<const debug_entries_t&, const Debug*>
 Iterator that outputs const Debug&.
 
using symbols_t = std::vector<Symbol>
 Internal container for storing COFF Symbols.
 
using it_symbols = ref_iterator<symbols_t&>
 Iterator that outputs Symbol&.
 
using it_const_symbols = const_ref_iterator<const symbols_t&>
 Iterator that outputs const Symbol&.
 
using strings_table_t = std::vector<std::string>
 Internal container for storing strings.
 
using it_strings_table = ref_iterator<strings_table_t&>
 Iterator that outputs std::string&.
 
using it_const_strings_table = const_ref_iterator<const strings_table_t&>
 Iterator that outputs const std::string&.
 
using signatures_t = std::vector<Signature>
 Internal container for storing PE's authenticode Signature.
 
using it_signatures = ref_iterator<signatures_t&>
 Iterator that outputs Signature&.
 
using it_const_signatures = const_ref_iterator<const signatures_t&>
 Iterator that outputs const Signature&.
 
- Public Types inherited from LIEF::Binary
enum class  VA_TYPES { AUTO = 0 , RVA = 1 , VA = 2 }
 Type of a virtual address. More...
 
enum  FORMATS {
  UNKNOWN = 0 , ELF , PE , MACHO ,
  OAT
}
 
using functions_t = std::vector<Function>
 
using sections_t = std::vector<Section*>
 Internal container.
 
using it_sections = ref_iterator<sections_t>
 Iterator that outputs LIEF::Section&.
 
using it_const_sections = const_ref_iterator<sections_t>
 Iterator that outputs const LIEF::Section&.
 
using symbols_t = std::vector<Symbol*>
 Internal container.
 
using it_symbols = ref_iterator<symbols_t>
 Iterator that outputs LIEF::Symbol&.
 
using it_const_symbols = const_ref_iterator<symbols_t>
 Iterator that outputs const LIEF::Symbol&.
 
using relocations_t = std::vector<Relocation*>
 Internal container.
 
using it_relocations = ref_iterator<relocations_t>
 Iterator that outputs LIEF::Relocation&.
 
using it_const_relocations = const_ref_iterator<relocations_t>
 Iterator that outputs const LIEF::Relocation&.
 
- Public Types inherited from LIEF::Object
template<class T >
using output_t = add_pointer_t<decay_t<T>>
 
template<class T >
using output_const_t = add_pointer_t<add_const_t<decay_t<T>>>
 

Public Member Functions

 Binary (PE_TYPE type)
 
 ~Binary () override
 
PE_TYPE type () const
 Return PE32 or PE32+
 
uint64_t rva_to_offset (uint64_t RVA) const
 Convert a Relative Virtual Address into an offset.
 
uint64_t va_to_offset (uint64_t VA) const
 Convert the absolute virtual address into an offset.
 
result< uint64_t > offset_to_virtual_address (uint64_t offset, uint64_t slide=0) const override
 Convert the given offset into a virtual address.
 
uint64_t imagebase () const override
 Return binary's imagebase. 0 if not relevant.
 
Sectionsection_from_offset (uint64_t offset)
 Find the section associated that encompasses the given offset.
 
const Sectionsection_from_offset (uint64_t offset) const
 
Sectionsection_from_rva (uint64_t virtual_address)
 Find the section associated that encompasses the given RVA.
 
const Sectionsection_from_rva (uint64_t virtual_address) const
 
it_sections sections ()
 Return an iterator over the PE's Section.
 
it_const_sections sections () const
 
DosHeaderdos_header ()
 Return a reference to the PE::DosHeader object.
 
const DosHeaderdos_header () const
 
Headerheader ()
 Return a reference to the PE::Header object.
 
const Headerheader () const
 
OptionalHeaderoptional_header ()
 Header that follows the header(). It is named optional from the COFF specfication but it is mandatory in a PE file.
 
const OptionalHeaderoptional_header () const
 
uint32_t compute_checksum () const
 Re-compute the value of OptionalHeader::checksum. If both values do not match, it could mean that the binary has been modified after the compilation.
 
uint64_t virtual_size () const
 Compute the binary's virtual size. It should match OptionalHeader::sizeof_image.
 
uint32_t sizeof_headers () const
 Compute the size of all the headers.
 
TLStls ()
 Return a reference to the TLS object.
 
const TLStls () const
 
void tls (const TLS &tls)
 Set a TLS object in the current Binary.
 
bool has_tls () const
 Check if the current binary has a TLS object.
 
bool has_imports () const
 Check if the current binary contains imports.
 
bool has_signatures () const
 Check if the current binary contains signatures.
 
bool has_exports () const
 Check if the current binary has exports.
 
bool has_resources () const
 Check if the current binary has resources.
 
bool has_exceptions () const
 Check if the current binary has exceptions.
 
bool has_relocations () const
 Check if the current binary has relocations.
 
bool has_debug () const
 Check if the current binary contains debug information.
 
bool has_configuration () const
 Check if the current binary has a load configuration.
 
bool is_reproducible_build () const
 Check if the current binary is reproducible build, replacing timestamps by a compile hash.
 
it_const_signatures signatures () const
 Return an iterator over the Signature object(s) if the binary is signed.
 
it_signatures signatures ()
 
Signature::VERIFICATION_FLAGS verify_signature (Signature::VERIFICATION_CHECKS checks=Signature::VERIFICATION_CHECKS::DEFAULT) const
 Verify the binary against the embedded signature(s) (if any) First, it checks that the embedded signatures are correct (c.f. Signature::check) and then, it checks that the authentihash matches ContentInfo::digest.
 
Signature::VERIFICATION_FLAGS verify_signature (const Signature &sig, Signature::VERIFICATION_CHECKS checks=Signature::VERIFICATION_CHECKS::DEFAULT) const
 Verify the binary with the Signature object provided in the first parameter. It can be used to verify a detached signature:
 
std::vector< uint8_t > authentihash (ALGORITHMS algo) const
 Compute the authentihash according to the algorithm provided in the first parameter.
 
uint32_t predict_function_rva (const std::string &library, const std::string &function)
 Try to predict the RVA of the function function in the import library library
 
Exportget_export ()
 Return the Export object.
 
const Exportget_export () const
 
std::vector< Symbol > & symbols ()
 Return binary Symbols.
 
const std::vector< Symbol > & symbols () const
 
ResourceNoderesources ()
 Return resources as a tree or a nullptr if there is no resources.
 
const ResourceNoderesources () const
 
void set_resources (const ResourceDirectory &resource)
 Set a new resource tree.
 
void set_resources (const ResourceData &resource)
 Set a new resource tree.
 
result< ResourcesManagerresources_manager () const
 Return the ResourcesManager (class to manage resources more easily than the tree one)
 
Sectionget_section (const std::string &name)
 Return binary's section from its name. If the secion can't be found, return a nullptr.
 
const Sectionget_section (const std::string &name) const
 
const Sectionimport_section () const
 Return the section associated with import table or a nullptr if the binary does not have an import table.
 
Sectionimport_section ()
 
void remove_section (const std::string &name, bool clear=false) override
 Delete the section with the given name.
 
void remove (const Section &section, bool clear=false)
 Remove the given section.
 
Sectionadd_section (const Section &section, PE_SECTION_TYPES type=PE_SECTION_TYPES::UNKNOWN)
 Add a section to the binary and return the section added.
 
it_relocations relocations ()
 Return an iterator over the PE's Relocation.
 
it_const_relocations relocations () const
 
Relocationadd_relocation (const Relocation &relocation)
 Add a PE::Relocation.
 
void remove_all_relocations ()
 Remove all the relocations.
 
it_data_directories data_directories ()
 Return an iterator over the DataDirectory present in the Binary.
 
it_const_data_directories data_directories () const
 
DataDirectorydata_directory (DataDirectory::TYPES type)
 Return the DataDirectory with the given type (or index)
 
const DataDirectorydata_directory (DataDirectory::TYPES type) const
 
bool has (DataDirectory::TYPES type) const
 Check if the current binary has the given DataDirectory::TYPES.
 
it_debug_entries debug ()
 Return an iterator over the Debug entries.
 
it_const_debug_entries debug () const
 
const CodeViewPDBcodeview_pdb () const
 Return the CodeViewPDB object if present.
 
const LoadConfigurationload_configuration () const
 Retrun the LoadConfiguration object or a nullptr if the binary does not use the LoadConfiguration.
 
LoadConfigurationload_configuration ()
 
span< const uint8_t > overlay () const
 Return the overlay content.
 
span< uint8_t > overlay ()
 
uint64_t overlay_offset () const
 Return the original overlay offset.
 
span< const uint8_t > dos_stub () const
 Return the DOS stub content.
 
span< uint8_t > dos_stub ()
 
void dos_stub (std::vector< uint8_t > content)
 Update the DOS stub content.
 
RichHeaderrich_header ()
 Return a reference to the RichHeader object.
 
const RichHeaderrich_header () const
 
void rich_header (const RichHeader &rich_header)
 Set a RichHeader object in the current Binary.
 
bool has_rich_header () const
 Check if the current binary has a RichHeader object.
 
it_imports imports ()
 Return an iterator over the binary imports.
 
it_const_imports imports () const
 
Importget_import (const std::string &import_name)
 Returns the PE::Import from the given name. If it can't be found, return a nullptr.
 
const Importget_import (const std::string &import_name) const
 
bool has_import (const std::string &import_name) const
 True if the binary imports the given library name
 
bool has_delay_imports () const
 Check if the current binary contains delay imports.
 
it_delay_imports delay_imports ()
 Return an iterator over the binary's delay imports.
 
it_const_delay_imports delay_imports () const
 
DelayImportget_delay_import (const std::string &import_name)
 Returns the PE::DelayImport from the given name. If it can't be found, return a nullptr.
 
const DelayImportget_delay_import (const std::string &import_name) const
 
bool has_delay_import (const std::string &import_name) const
 True if the binary delay-imports the given library name
 
ImportEntryadd_import_function (const std::string &library, const std::string &function)
 Add the function function of the library library. If the function fails, it returns a nullptr.
 
Importadd_library (const std::string &name)
 Add an imported library (i.e. DLL) to the binary.
 
void remove_library (const std::string &name)
 Remove the library with the given name
 
void remove_all_libraries ()
 Remove all libraries in the binary.
 
void write (const std::string &filename) override
 Reconstruct the binary object and write the raw PE in filename
 
void write (std::ostream &os) override
 Reconstruct the binary object and write the raw PE in os stream.
 
void accept (Visitor &visitor) const override
 Method so that a visitor can visit us.
 
void patch_address (uint64_t address, const std::vector< uint8_t > &patch_value, LIEF::Binary::VA_TYPES addr_type=LIEF::Binary::VA_TYPES::AUTO) override
 Patch the content at virtual address address with patch_value.
 
void patch_address (uint64_t address, uint64_t patch_value, size_t size=sizeof(uint64_t), LIEF::Binary::VA_TYPES addr_type=LIEF::Binary::VA_TYPES::AUTO) override
 Patch the address with the given value.
 
span< const uint8_t > get_content_from_virtual_address (uint64_t virtual_address, uint64_t size, Binary::VA_TYPES addr_type=Binary::VA_TYPES::AUTO) const override
 Return the content located at the provided virtual address.
 
uint64_t entrypoint () const override
 Return the binary's entrypoint (It is the same value as OptionalHeader::addressof_entrypoint.
 
bool is_pie () const override
 Check if the binary is position independent.
 
bool has_nx () const override
 Check if the binary uses NX protection.
 
LIEF::Binary::functions_t ctor_functions () const override
 Return the list of the binary constructors.
 
LIEF::Binary::functions_t functions () const
 All functions found in the binary
 
LIEF::Binary::functions_t exception_functions () const
 Functions found in the Exception table directory.
 
std::ostream & print (std::ostream &os) const override
 
- Public Member Functions inherited from LIEF::Binary
 Binary ()
 
 Binary (FORMATS fmt)
 
 ~Binary () override
 
Binaryoperator= (const Binary &)=delete
 
 Binary (const Binary &)=delete
 
FORMATS format () const
 Executable format (ELF, PE, Mach-O) of the underlying binary.
 
Header header () const
 Return the abstract header of the binary.
 
it_symbols symbols ()
 Return an iterator over the abstracted symbols in which the elements can be modified.
 
it_const_symbols symbols () const
 Return an iterator over the abstracted symbols in which the elements can't be modified.
 
bool has_symbol (const std::string &name) const
 Check if a Symbol with the given name exists.
 
const Symbolget_symbol (const std::string &name) const
 Return the Symbol with the given name If the symbol does not exist, return a nullptr.
 
Symbolget_symbol (const std::string &name)
 
it_sections sections ()
 Return an iterator over the binary's sections (LIEF::Section)
 
it_const_sections sections () const
 
it_relocations relocations ()
 Return an iterator over the binary relocation (LIEF::Relocation)
 
it_const_relocations relocations () const
 
uint64_t original_size () const
 Binary's original size.
 
functions_t exported_functions () const
 Return the functions exported by the binary.
 
std::vector< std::string > imported_libraries () const
 Return libraries which are imported by the binary.
 
functions_t imported_functions () const
 Return functions imported by the binary.
 
virtual result< uint64_t > get_function_address (const std::string &func_name) const
 Return the address of the given function name.
 
std::vector< uint64_t > xref (uint64_t address) const
 
void original_size (uint64_t size)
 Change binary's original size.
 
DebugInfodebug_info () const
 Return the debug info if present. It can be either a LIEF::dwarf::DebugInfo or a LIEF::pdb::DebugInfo.
 
- Public Member Functions inherited from LIEF::Object
 Object ()
 
 Object (const Object &other)
 
Objectoperator= (const Object &other)
 
template<class T >
output_t< T > as ()
 
template<class T >
output_const_t< T > as () const
 
virtual bool operator== (const Object &other) const
 
virtual bool operator!= (const Object &other) const
 
virtual ~Object ()
 

Static Public Member Functions

static bool classof (const LIEF::Binary *bin)
 

Detailed Description

Class which represents a PE binary This is the main interface to manage and modify a PE executable.

Member Typedef Documentation

◆ data_directories_t

using LIEF::PE::Binary::data_directories_t = std::vector<std::unique_ptr<DataDirectory>>

Internal container for storing PE's DataDirectory.

◆ debug_entries_t

using LIEF::PE::Binary::debug_entries_t = std::vector<std::unique_ptr<Debug>>

Internal container for storing Debug information.

◆ delay_imports_t

Internal container for storing PE's DelayImport.

◆ imports_t

using LIEF::PE::Binary::imports_t = std::vector<Import>

Internal container for storing PE's Import.

◆ it_const_data_directories

◆ it_const_debug_entries

Iterator that outputs const Debug&.

◆ it_const_delay_imports

◆ it_const_imports

Iterator that outputs const Import&.

◆ it_const_relocations

Iterator that outputs const Relocation&.

◆ it_const_sections

Iterator that outputs const Section& object.

◆ it_const_signatures

Iterator that outputs const Signature&.

◆ it_const_strings_table

Iterator that outputs const std::string&.

◆ it_const_symbols

Iterator that outputs const Symbol&.

◆ it_data_directories

◆ it_debug_entries

◆ it_delay_imports

◆ it_imports

Iterator that output Import&.

◆ it_relocations

◆ it_sections

Iterator that outputs Section& object.

◆ it_signatures

◆ it_strings_table

Iterator that outputs std::string&.

◆ it_symbols

Iterator that outputs Symbol&.

◆ relocations_t

using LIEF::PE::Binary::relocations_t = std::vector<std::unique_ptr<Relocation>>

Internal container for storing PE's Relocation.

◆ sections_t

using LIEF::PE::Binary::sections_t = std::vector<std::unique_ptr<Section>>

Internal container for storing PE's Section.

◆ signatures_t

Internal container for storing PE's authenticode Signature.

◆ strings_table_t

using LIEF::PE::Binary::strings_table_t = std::vector<std::string>

Internal container for storing strings.

◆ symbols_t

using LIEF::PE::Binary::symbols_t = std::vector<Symbol>

Internal container for storing COFF Symbols.

Constructor & Destructor Documentation

◆ Binary()

LIEF::PE::Binary::Binary ( PE_TYPE type)

◆ ~Binary()

LIEF::PE::Binary::~Binary ( )
override

Member Function Documentation

◆ accept()

void LIEF::PE::Binary::accept ( Visitor & visitor) const
overridevirtual

Method so that a visitor can visit us.

Reimplemented from LIEF::Binary.

◆ add_import_function()

ImportEntry * LIEF::PE::Binary::add_import_function ( const std::string & library,
const std::string & function )

Add the function function of the library library. If the function fails, it returns a nullptr.

Parameters
[in]libraryLibrary name of the function
[in]functionFunction's name from the library to import

◆ add_library()

Import & LIEF::PE::Binary::add_library ( const std::string & name)
inline

Add an imported library (i.e. DLL) to the binary.

◆ add_relocation()

Relocation & LIEF::PE::Binary::add_relocation ( const Relocation & relocation)

◆ add_section()

Section * LIEF::PE::Binary::add_section ( const Section & section,
PE_SECTION_TYPES type = PE_SECTION_TYPES::UNKNOWN )

Add a section to the binary and return the section added.

◆ authentihash()

std::vector< uint8_t > LIEF::PE::Binary::authentihash ( ALGORITHMS algo) const

Compute the authentihash according to the algorithm provided in the first parameter.

◆ classof()

static bool LIEF::PE::Binary::classof ( const LIEF::Binary * bin)
inlinestatic

◆ codeview_pdb()

const CodeViewPDB * LIEF::PE::Binary::codeview_pdb ( ) const

Return the CodeViewPDB object if present.

◆ compute_checksum()

uint32_t LIEF::PE::Binary::compute_checksum ( ) const

Re-compute the value of OptionalHeader::checksum. If both values do not match, it could mean that the binary has been modified after the compilation.

This value is computed by LIEF for the current binary object.

◆ ctor_functions()

LIEF::Binary::functions_t LIEF::PE::Binary::ctor_functions ( ) const
overridevirtual

Return the list of the binary constructors.

In a PE file, we consider a constructors as a callback in the TLS object

Implements LIEF::Binary.

◆ data_directories() [1/2]

it_data_directories LIEF::PE::Binary::data_directories ( )
inline

Return an iterator over the DataDirectory present in the Binary.

◆ data_directories() [2/2]

it_const_data_directories LIEF::PE::Binary::data_directories ( ) const
inline

◆ data_directory() [1/2]

DataDirectory * LIEF::PE::Binary::data_directory ( DataDirectory::TYPES type)

Return the DataDirectory with the given type (or index)

◆ data_directory() [2/2]

const DataDirectory * LIEF::PE::Binary::data_directory ( DataDirectory::TYPES type) const

◆ debug() [1/2]

it_debug_entries LIEF::PE::Binary::debug ( )
inline

Return an iterator over the Debug entries.

◆ debug() [2/2]

it_const_debug_entries LIEF::PE::Binary::debug ( ) const
inline

◆ delay_imports() [1/2]

it_delay_imports LIEF::PE::Binary::delay_imports ( )
inline

Return an iterator over the binary's delay imports.

◆ delay_imports() [2/2]

it_const_delay_imports LIEF::PE::Binary::delay_imports ( ) const
inline

◆ dos_header() [1/2]

DosHeader & LIEF::PE::Binary::dos_header ( )
inline

Return a reference to the PE::DosHeader object.

◆ dos_header() [2/2]

const DosHeader & LIEF::PE::Binary::dos_header ( ) const
inline

◆ dos_stub() [1/3]

span< uint8_t > LIEF::PE::Binary::dos_stub ( )
inline

◆ dos_stub() [2/3]

span< const uint8_t > LIEF::PE::Binary::dos_stub ( ) const
inline

Return the DOS stub content.

◆ dos_stub() [3/3]

void LIEF::PE::Binary::dos_stub ( std::vector< uint8_t > content)
inline

Update the DOS stub content.

◆ entrypoint()

uint64_t LIEF::PE::Binary::entrypoint ( ) const
inlineoverridevirtual

Return the binary's entrypoint (It is the same value as OptionalHeader::addressof_entrypoint.

Implements LIEF::Binary.

◆ exception_functions()

LIEF::Binary::functions_t LIEF::PE::Binary::exception_functions ( ) const

Functions found in the Exception table directory.

◆ functions()

LIEF::Binary::functions_t LIEF::PE::Binary::functions ( ) const

All functions found in the binary

◆ get_content_from_virtual_address()

span< const uint8_t > LIEF::PE::Binary::get_content_from_virtual_address ( uint64_t virtual_address,
uint64_t size,
Binary::VA_TYPES addr_type = Binary::VA_TYPES::AUTO ) const
overridevirtual

Return the content located at the provided virtual address.

Parameters
[in]virtual_addressVirtual address of the data to retrieve
[in]sizeSize in bytes of the data to retrieve
[in]addr_typeType of the Virtual address: VA or RVA. Default: Auto

Implements LIEF::Binary.

◆ get_delay_import() [1/2]

DelayImport * LIEF::PE::Binary::get_delay_import ( const std::string & import_name)

Returns the PE::DelayImport from the given name. If it can't be found, return a nullptr.

Parameters
[in]import_nameName of the delay import

◆ get_delay_import() [2/2]

const DelayImport * LIEF::PE::Binary::get_delay_import ( const std::string & import_name) const

◆ get_export() [1/2]

Export * LIEF::PE::Binary::get_export ( )
inline

Return the Export object.

◆ get_export() [2/2]

const Export * LIEF::PE::Binary::get_export ( ) const
inline

◆ get_import() [1/2]

Import * LIEF::PE::Binary::get_import ( const std::string & import_name)

Returns the PE::Import from the given name. If it can't be found, return a nullptr.

Parameters
[in]import_nameName of the import

◆ get_import() [2/2]

const Import * LIEF::PE::Binary::get_import ( const std::string & import_name) const

◆ get_section() [1/2]

Section * LIEF::PE::Binary::get_section ( const std::string & name)

Return binary's section from its name. If the secion can't be found, return a nullptr.

Parameters
[in]nameName of the Section

◆ get_section() [2/2]

const Section * LIEF::PE::Binary::get_section ( const std::string & name) const

◆ has()

bool LIEF::PE::Binary::has ( DataDirectory::TYPES type) const
inline

Check if the current binary has the given DataDirectory::TYPES.

◆ has_configuration()

bool LIEF::PE::Binary::has_configuration ( ) const
inline

Check if the current binary has a load configuration.

◆ has_debug()

bool LIEF::PE::Binary::has_debug ( ) const
inline

Check if the current binary contains debug information.

◆ has_delay_import()

bool LIEF::PE::Binary::has_delay_import ( const std::string & import_name) const
inline

True if the binary delay-imports the given library name

Parameters
[in]import_nameName of the delay import

◆ has_delay_imports()

bool LIEF::PE::Binary::has_delay_imports ( ) const
inline

Check if the current binary contains delay imports.

See also
DelayImport
has_import

◆ has_exceptions()

bool LIEF::PE::Binary::has_exceptions ( ) const

Check if the current binary has exceptions.

◆ has_exports()

bool LIEF::PE::Binary::has_exports ( ) const
inline

Check if the current binary has exports.

See also
Export

◆ has_import()

bool LIEF::PE::Binary::has_import ( const std::string & import_name) const
inline

True if the binary imports the given library name

Parameters
[in]import_nameName of the import

◆ has_imports()

bool LIEF::PE::Binary::has_imports ( ) const
inline

Check if the current binary contains imports.

See also
Import

◆ has_nx()

bool LIEF::PE::Binary::has_nx ( ) const
inlineoverridevirtual

Check if the binary uses NX protection.

Implements LIEF::Binary.

◆ has_relocations()

bool LIEF::PE::Binary::has_relocations ( ) const
inline

Check if the current binary has relocations.

See also
Relocation

◆ has_resources()

bool LIEF::PE::Binary::has_resources ( ) const
inline

Check if the current binary has resources.

◆ has_rich_header()

bool LIEF::PE::Binary::has_rich_header ( ) const
inline

Check if the current binary has a RichHeader object.

◆ has_signatures()

bool LIEF::PE::Binary::has_signatures ( ) const
inline

Check if the current binary contains signatures.

See also
signatures

◆ has_tls()

bool LIEF::PE::Binary::has_tls ( ) const
inline

Check if the current binary has a TLS object.

◆ header() [1/2]

Header & LIEF::PE::Binary::header ( )
inline

Return a reference to the PE::Header object.

◆ header() [2/2]

const Header & LIEF::PE::Binary::header ( ) const
inline

◆ imagebase()

uint64_t LIEF::PE::Binary::imagebase ( ) const
inlineoverridevirtual

Return binary's imagebase. 0 if not relevant.

The value is the same as those returned by OptionalHeader::imagebase

Implements LIEF::Binary.

◆ import_section() [1/2]

Section * LIEF::PE::Binary::import_section ( )

◆ import_section() [2/2]

const Section * LIEF::PE::Binary::import_section ( ) const

Return the section associated with import table or a nullptr if the binary does not have an import table.

◆ imports() [1/2]

it_imports LIEF::PE::Binary::imports ( )
inline

Return an iterator over the binary imports.

◆ imports() [2/2]

it_const_imports LIEF::PE::Binary::imports ( ) const
inline

◆ is_pie()

bool LIEF::PE::Binary::is_pie ( ) const
inlineoverridevirtual

Check if the binary is position independent.

Implements LIEF::Binary.

◆ is_reproducible_build()

bool LIEF::PE::Binary::is_reproducible_build ( ) const

Check if the current binary is reproducible build, replacing timestamps by a compile hash.

See also
Repro

◆ load_configuration() [1/2]

LoadConfiguration * LIEF::PE::Binary::load_configuration ( )
inline

◆ load_configuration() [2/2]

const LoadConfiguration * LIEF::PE::Binary::load_configuration ( ) const
inline

Retrun the LoadConfiguration object or a nullptr if the binary does not use the LoadConfiguration.

◆ offset_to_virtual_address()

result< uint64_t > LIEF::PE::Binary::offset_to_virtual_address ( uint64_t offset,
uint64_t slide = 0 ) const
overridevirtual

Convert the given offset into a virtual address.

Parameters
[in]offsetThe offset to convert.
[in]slideIf not 0, it will replace the default base address (if any)

Implements LIEF::Binary.

◆ optional_header() [1/2]

OptionalHeader & LIEF::PE::Binary::optional_header ( )
inline

Header that follows the header(). It is named optional from the COFF specfication but it is mandatory in a PE file.

◆ optional_header() [2/2]

const OptionalHeader & LIEF::PE::Binary::optional_header ( ) const
inline

◆ overlay() [1/2]

span< uint8_t > LIEF::PE::Binary::overlay ( )
inline

◆ overlay() [2/2]

span< const uint8_t > LIEF::PE::Binary::overlay ( ) const
inline

Return the overlay content.

◆ overlay_offset()

uint64_t LIEF::PE::Binary::overlay_offset ( ) const
inline

Return the original overlay offset.

◆ patch_address() [1/2]

void LIEF::PE::Binary::patch_address ( uint64_t address,
const std::vector< uint8_t > & patch_value,
LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO )
overridevirtual

Patch the content at virtual address address with patch_value.

Parameters
[in]addressAddress to patch
[in]patch_valuePatch to apply
[in]addr_typeType of the Virtual address: VA or RVA. Default: Auto

Implements LIEF::Binary.

◆ patch_address() [2/2]

void LIEF::PE::Binary::patch_address ( uint64_t address,
uint64_t patch_value,
size_t size = sizeof(uint64_t),
LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO )
overridevirtual

Patch the address with the given value.

Parameters
[in]addressAddress to patch
[in]patch_valuePatch to apply
[in]sizeSize of the value in bytes (1, 2, ... 8)
[in]addr_typeType of the Virtual address: VA or RVA. Default: Auto

Implements LIEF::Binary.

◆ predict_function_rva()

uint32_t LIEF::PE::Binary::predict_function_rva ( const std::string & library,
const std::string & function )

Try to predict the RVA of the function function in the import library library

Warning
The value could be chang if imports change
Note
It should be used with: LIEF::PE::Builder::build_imports set to true
Parameters
[in]libraryLibrary name in which the function is located
[in]functionFunction name
Returns
The address of the function (IAT) in the new import table

◆ print()

std::ostream & LIEF::PE::Binary::print ( std::ostream & os) const
overridevirtual

Reimplemented from LIEF::Binary.

◆ relocations() [1/2]

it_relocations LIEF::PE::Binary::relocations ( )
inline

Return an iterator over the PE's Relocation.

◆ relocations() [2/2]

it_const_relocations LIEF::PE::Binary::relocations ( ) const
inline

◆ remove()

void LIEF::PE::Binary::remove ( const Section & section,
bool clear = false )

Remove the given section.

See also
remove_section

◆ remove_all_libraries()

void LIEF::PE::Binary::remove_all_libraries ( )
inline

Remove all libraries in the binary.

◆ remove_all_relocations()

void LIEF::PE::Binary::remove_all_relocations ( )

Remove all the relocations.

◆ remove_library()

void LIEF::PE::Binary::remove_library ( const std::string & name)

Remove the library with the given name

◆ remove_section()

void LIEF::PE::Binary::remove_section ( const std::string & name,
bool clear = false )
overridevirtual

Delete the section with the given name.

Parameters
[in]nameName of section to delete
[in]clearif true clear the section's content with 0 before removing (default: false)

Implements LIEF::Binary.

◆ resources() [1/2]

ResourceNode * LIEF::PE::Binary::resources ( )
inline

Return resources as a tree or a nullptr if there is no resources.

◆ resources() [2/2]

const ResourceNode * LIEF::PE::Binary::resources ( ) const
inline

◆ resources_manager()

result< ResourcesManager > LIEF::PE::Binary::resources_manager ( ) const

Return the ResourcesManager (class to manage resources more easily than the tree one)

◆ rich_header() [1/3]

RichHeader * LIEF::PE::Binary::rich_header ( )
inline

Return a reference to the RichHeader object.

◆ rich_header() [2/3]

const RichHeader * LIEF::PE::Binary::rich_header ( ) const
inline

◆ rich_header() [3/3]

void LIEF::PE::Binary::rich_header ( const RichHeader & rich_header)

Set a RichHeader object in the current Binary.

◆ rva_to_offset()

uint64_t LIEF::PE::Binary::rva_to_offset ( uint64_t RVA) const

Convert a Relative Virtual Address into an offset.

The conversion is performed by looking for the section that encompasses the provided RVA.

◆ section_from_offset() [1/2]

Section * LIEF::PE::Binary::section_from_offset ( uint64_t offset)

Find the section associated that encompasses the given offset.

If no section can be found, return a nullptr

◆ section_from_offset() [2/2]

const Section * LIEF::PE::Binary::section_from_offset ( uint64_t offset) const

◆ section_from_rva() [1/2]

Section * LIEF::PE::Binary::section_from_rva ( uint64_t virtual_address)

Find the section associated that encompasses the given RVA.

If no section can be found, return a nullptr

◆ section_from_rva() [2/2]

const Section * LIEF::PE::Binary::section_from_rva ( uint64_t virtual_address) const

◆ sections() [1/2]

it_sections LIEF::PE::Binary::sections ( )
inline

Return an iterator over the PE's Section.

◆ sections() [2/2]

it_const_sections LIEF::PE::Binary::sections ( ) const
inline

◆ set_resources() [1/2]

void LIEF::PE::Binary::set_resources ( const ResourceData & resource)

Set a new resource tree.

◆ set_resources() [2/2]

void LIEF::PE::Binary::set_resources ( const ResourceDirectory & resource)

Set a new resource tree.

◆ signatures() [1/2]

it_signatures LIEF::PE::Binary::signatures ( )
inline

◆ signatures() [2/2]

it_const_signatures LIEF::PE::Binary::signatures ( ) const
inline

Return an iterator over the Signature object(s) if the binary is signed.

◆ sizeof_headers()

uint32_t LIEF::PE::Binary::sizeof_headers ( ) const

Compute the size of all the headers.

◆ symbols() [1/2]

std::vector< Symbol > & LIEF::PE::Binary::symbols ( )
inline

Return binary Symbols.

◆ symbols() [2/2]

const std::vector< Symbol > & LIEF::PE::Binary::symbols ( ) const
inline

◆ tls() [1/3]

TLS * LIEF::PE::Binary::tls ( )
inline

Return a reference to the TLS object.

◆ tls() [2/3]

const TLS * LIEF::PE::Binary::tls ( ) const
inline

◆ tls() [3/3]

void LIEF::PE::Binary::tls ( const TLS & tls)

Set a TLS object in the current Binary.

◆ type()

PE_TYPE LIEF::PE::Binary::type ( ) const
inline

Return PE32 or PE32+

◆ va_to_offset()

uint64_t LIEF::PE::Binary::va_to_offset ( uint64_t VA) const

Convert the absolute virtual address into an offset.

See also
rva_to_offset

◆ verify_signature() [1/2]

Signature::VERIFICATION_FLAGS LIEF::PE::Binary::verify_signature ( const Signature & sig,
Signature::VERIFICATION_CHECKS checks = Signature::VERIFICATION_CHECKS::DEFAULT ) const

Verify the binary with the Signature object provided in the first parameter. It can be used to verify a detached signature:

if (detached) {
binary->verify_signature(detached.value());
}
static result< Signature > parse(std::vector< uint8_t > data, bool skip_header=false)
Parse a PKCS #7 signature given a raw blob.
tl::expected< T, lief_errors > result
Wrapper that contains an Object (T) or an error.
Definition errors.hpp:74

◆ verify_signature() [2/2]

Verify the binary against the embedded signature(s) (if any) First, it checks that the embedded signatures are correct (c.f. Signature::check) and then, it checks that the authentihash matches ContentInfo::digest.

One can tweak the verification process with the Signature::VERIFICATION_CHECKS flags

See also
LIEF::PE::Signature::check

◆ virtual_size()

uint64_t LIEF::PE::Binary::virtual_size ( ) const

Compute the binary's virtual size. It should match OptionalHeader::sizeof_image.

◆ write() [1/2]

void LIEF::PE::Binary::write ( const std::string & filename)
overridevirtual

Reconstruct the binary object and write the raw PE in filename

Rebuild a PE binary from the current Binary object. When rebuilding, import table and relocations are not rebuilt.

Implements LIEF::Binary.

◆ write() [2/2]

void LIEF::PE::Binary::write ( std::ostream & os)
overridevirtual

Reconstruct the binary object and write the raw PE in os stream.

Rebuild a PE binary from the current Binary object. When rebuilding, import table and relocations are not rebuilt.

Implements LIEF::Binary.


The documentation for this class was generated from the following file: