LIEF::PE Namespace Reference

Namespace related to the LIEF's PE module. More...

Namespaces
namespace	details

Classes
class	Attribute
	Interface over PKCS #7 attribute. More...
class	AuxiliarySymbol
class	Binary
	Class which represents a PE binary This is the main interface to manage and modify a PE executable. More...
class	Builder
	Class that is used to rebuild a raw PE binary from a PE::Binary object. More...
class	CodeIntegrity
class	CodeView
	Interface for the (generic) Debug CodeView (IMAGE_DEBUG_TYPE_CODEVIEW) More...
class	CodeViewPDB
	CodeView PDB specialization. More...
class	ContentInfo
class	ContentType
	Interface over the structure described by the OID 1.2.840.113549.1.9.3 (PKCS #9) More...
class	DataDirectory
	Class that represents a PE data directory entry. More...
class	Debug
	This class represents a generic entry in the debug data directory. For known types, this class is extended to provide a dedicated API (see: ! CodeCodeView) More...
class	DelayImport
	Class that represents a PE delayed import. More...
class	DelayImportEntry
	Class that represents an entry (i.e. an import) in the delay import table (DelayImport). More...
class	DosHeader
	Class which represents the DosHeader, the first structure presents at the beginning of a PE file. More...
class	Export
	Class which represents a PE Export. More...
class	ExportEntry
	Class which represents a PE Export entry (cf. PE::Export) More...
class	GenericContent
class	GenericType
	Interface over an attribute for which the internal structure is not supported by LIEF. More...
class	Hash
	Class which implements a visitor to compute a deterministic hash for LIEF PE objects. More...
class	Header
	Class that represents the PE header (which follows the DosHeader) More...
class	Import
	Class that represents a PE import. More...
class	ImportEntry
	Class that represents an entry (i.e. an import) in the import table (Import). More...
class	LangCodeItem
	Class which represents the childs of the ResourceStringFileInfo. More...
class	LoadConfiguration
	Class that represents the default PE's LoadConfiguration More...
class	LoadConfigurationV0
	LoadConfiguration enhanced with SEH. More...
class	LoadConfigurationV1
	LoadConfiguration enhanced with Control Flow Guard. More...
class	LoadConfigurationV10
class	LoadConfigurationV11
class	LoadConfigurationV2
	LoadConfiguration enhanced with code integrity. More...
class	LoadConfigurationV3
	LoadConfiguration with Control Flow Guard improved. More...
class	LoadConfigurationV4
	Load Configuration enhanced with. More...
class	LoadConfigurationV5
	Load Configuration enhanced with Return Flow Guard. More...
class	LoadConfigurationV6
	Load Configuration enhanced with Hotpatch and improved RFG. More...
class	LoadConfigurationV7
class	LoadConfigurationV8
class	LoadConfigurationV9
class	MsCounterSign
	This class exposes the MS Counter Signature attribute. More...
class	MsManifestBinaryID
	Interface over the structure described by the OID 1.3.6.1.4.1.311.10.3.28 (szOID_PLATFORM_MANIFEST_BINARY_ID) More...
class	MsSpcNestedSignature
	Interface over the structure described by the OID 1.3.6.1.4.1.311.2.4.1 More...
class	MsSpcStatementType
	Interface over the structure described by the OID 1.3.6.1.4.1.311.2.1.11 More...
class	OptionalHeader
	Class which represents the PE OptionalHeader structure. More...
class	Parser
	Main interface to parse PE binaries. In particular the static functions: Parser::parse should be used to get a LIEF::PE::Binary. More...
struct	ParserConfig
	This structure is used to tweak the PE Parser (PE::Parser) More...
class	PKCS9AtSequenceNumber
	Interface over the structure described by the OID 1.2.840.113549.1.9.25.4 (PKCS #9) More...
class	PKCS9CounterSignature
	Interface over the structure described by the OID 1.2.840.113549.1.9.6 (PKCS #9) More...
class	PKCS9MessageDigest
	Interface over the structure described by the OID 1.2.840.113549.1.9.4 (PKCS #9) More...
class	PKCS9SigningTime
	Interface over the structure described by the OID 1.2.840.113549.1.9.5 (PKCS #9) More...
class	PKCS9TSTInfo
	Interface over the structure described by the OID 1.2.840.113549.1.9.16.1.4 (PKCS #9) More...
class	Pogo
	This class represents a Profile Guided Optimization entry from the debug directory (IMAGE_DEBUG_TYPE_POGO). More...
class	PogoEntry
class	Relocation
	Class which represents the Base Relocation Block We usually find this structure in the .reloc section. More...
class	RelocationEntry
	Class which represents an entry of the PE relocation table. More...
class	Repro
	This class represents a reproducible build entry from the debug directory. (IMAGE_DEBUG_TYPE_REPRO). This entry is usually generated with the undocumented /Brepro linker flag. More...
class	ResourceAccelerator
class	ResourceData
	Class which represents a Data Node in the PE resources tree. More...
class	ResourceDialog
	Representation of a dialog box. More...
class	ResourceDialogItem
	This class represents an item in the ResourceDialog. More...
class	ResourceDirectory
class	ResourceFixedFileInfo
	Representation of VS_FIXEDFILEINFO Structure. More...
class	ResourceIcon
class	ResourceNode
	Class which represents a Node in the resource tree. More...
class	ResourcesManager
	The Resource Manager provides an enhanced API to manipulate the resource tree. More...
class	ResourceStringFileInfo
	Representation of the StringFileInfo structure. More...
class	ResourceStringTable
class	ResourceVarFileInfo
	This object describes information about languages supported by the application. More...
class	ResourceVersion
	Representation of the data associated with the RT_VERSION entry. More...
class	RichEntry
	Class which represents an entry associated to the RichHeader. More...
class	RichHeader
	Class which represents the not-so-documented rich header. More...
class	RsaInfo
	Object that wraps a RSA key. More...
class	Section
	Class which represents a PE section. More...
class	Signature
	Main interface for the PKCS #7 signature scheme. More...
class	SignatureParser
class	SignerInfo
class	SigningCertificateV2
	SigningCertificateV2 ::= SEQUENCE { certs SEQUENCE OF ESSCertIDv2, policies SEQUENCE OF PolicyInformation OPTIONAL }. More...
class	SpcIndirectData
class	SpcRelaxedPeMarkerCheck
class	SpcSpOpusInfo
	Interface over the structure described by the OID 1.3.6.1.4.1.311.2.1.12 More...
class	Symbol
	Class that represents a PE symbol. More...
class	TLS
	Class which represents the PE Thread Local Storage. More...
class	x509
	Interface over a x509 certificate. More...

Typedefs
using	oid_t = std::string

Enumerations
enum class	PE_TYPES : size_t { PE32 = 0x10b , PE32_PLUS = 0x20b }
enum	SYMBOL_SECTION_NUMBER : int { IMAGE_SYM_DEBUG = -2 , IMAGE_SYM_ABSOLUTE = -1 , IMAGE_SYM_UNDEFINED = 0 }
enum	SYMBOL_STORAGE_CLASS : int {   IMAGE_SYM_CLASS_INVALID = 0xFF , IMAGE_SYM_CLASS_END_OF_FUNCTION = -1 , IMAGE_SYM_CLASS_NULL = 0 , IMAGE_SYM_CLASS_AUTOMATIC = 1 ,   IMAGE_SYM_CLASS_EXTERNAL = 2 , IMAGE_SYM_CLASS_STATIC = 3 , IMAGE_SYM_CLASS_REGISTER = 4 , IMAGE_SYM_CLASS_EXTERNAL_DEF = 5 ,   IMAGE_SYM_CLASS_LABEL = 6 , IMAGE_SYM_CLASS_UNDEFINED_LABEL = 7 , IMAGE_SYM_CLASS_MEMBER_OF_STRUCT = 8 , IMAGE_SYM_CLASS_ARGUMENT = 9 ,   IMAGE_SYM_CLASS_STRUCT_TAG = 10 , IMAGE_SYM_CLASS_MEMBER_OF_UNION = 11 , IMAGE_SYM_CLASS_UNION_TAG = 12 , IMAGE_SYM_CLASS_TYPE_DEFINITION = 13 ,   IMAGE_SYM_CLASS_UNDEFINED_STATIC = 14 , IMAGE_SYM_CLASS_ENUM_TAG = 15 , IMAGE_SYM_CLASS_MEMBER_OF_ENUM = 16 , IMAGE_SYM_CLASS_REGISTER_PARAM = 17 ,   IMAGE_SYM_CLASS_BIT_FIELD = 18 , IMAGE_SYM_CLASS_BLOCK = 100 , IMAGE_SYM_CLASS_FUNCTION = 101 , IMAGE_SYM_CLASS_END_OF_STRUCT = 102 ,   IMAGE_SYM_CLASS_FILE = 103 , IMAGE_SYM_CLASS_SECTION = 104 , IMAGE_SYM_CLASS_WEAK_EXTERNAL = 105 , IMAGE_SYM_CLASS_CLR_TOKEN = 107 }
	Storage class tells where and what the symbol represents. More...
enum class	SYMBOL_BASE_TYPES : size_t {   IMAGE_SYM_TYPE_NULL = 0 , IMAGE_SYM_TYPE_VOID = 1 , IMAGE_SYM_TYPE_CHAR = 2 , IMAGE_SYM_TYPE_SHORT = 3 ,   IMAGE_SYM_TYPE_INT = 4 , IMAGE_SYM_TYPE_LONG = 5 , IMAGE_SYM_TYPE_FLOAT = 6 , IMAGE_SYM_TYPE_DOUBLE = 7 ,   IMAGE_SYM_TYPE_STRUCT = 8 , IMAGE_SYM_TYPE_UNION = 9 , IMAGE_SYM_TYPE_ENUM = 10 , IMAGE_SYM_TYPE_MOE = 11 ,   IMAGE_SYM_TYPE_BYTE = 12 , IMAGE_SYM_TYPE_WORD = 13 , IMAGE_SYM_TYPE_UINT = 14 , IMAGE_SYM_TYPE_DWORD = 15 }
enum class	SYMBOL_COMPLEX_TYPES : size_t {   IMAGE_SYM_DTYPE_NULL = 0 , IMAGE_SYM_DTYPE_POINTER = 1 , IMAGE_SYM_DTYPE_FUNCTION = 2 , IMAGE_SYM_DTYPE_ARRAY = 3 ,   SCT_COMPLEX_TYPE_SHIFT = 4 }
enum class	AuxSymbolType : size_t { IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF = 1 }
enum class	RELOCATIONS_I386 : size_t {   IMAGE_REL_I386_ABSOLUTE = 0x0000 , IMAGE_REL_I386_DIR16 = 0x0001 , IMAGE_REL_I386_REL16 = 0x0002 , IMAGE_REL_I386_DIR32 = 0x0006 ,   IMAGE_REL_I386_DIR32NB = 0x0007 , IMAGE_REL_I386_SEG12 = 0x0009 , IMAGE_REL_I386_SECTION = 0x000A , IMAGE_REL_I386_SECREL = 0x000B ,   IMAGE_REL_I386_TOKEN = 0x000C , IMAGE_REL_I386_SECREL7 = 0x000D , IMAGE_REL_I386_REL32 = 0x0014 }
enum class	RELOCATIONS_AMD64 : size_t {   IMAGE_REL_AMD64_ABSOLUTE = 0x0000 , IMAGE_REL_AMD64_ADDR64 = 0x0001 , IMAGE_REL_AMD64_ADDR32 = 0x0002 , IMAGE_REL_AMD64_ADDR32NB = 0x0003 ,   IMAGE_REL_AMD64_REL32 = 0x0004 , IMAGE_REL_AMD64_REL32_1 = 0x0005 , IMAGE_REL_AMD64_REL32_2 = 0x0006 , IMAGE_REL_AMD64_REL32_3 = 0x0007 ,   IMAGE_REL_AMD64_REL32_4 = 0x0008 , IMAGE_REL_AMD64_REL32_5 = 0x0009 , IMAGE_REL_AMD64_SECTION = 0x000A , IMAGE_REL_AMD64_SECREL = 0x000B ,   IMAGE_REL_AMD64_SECREL7 = 0x000C , IMAGE_REL_AMD64_TOKEN = 0x000D , IMAGE_REL_AMD64_SREL32 = 0x000E , IMAGE_REL_AMD64_PAIR = 0x000F ,   IMAGE_REL_AMD64_SSPAN32 = 0x0010 }
enum class	RELOCATIONS_ARM : size_t {   IMAGE_REL_ARM_ABSOLUTE = 0x0000 , IMAGE_REL_ARM_ADDR32 = 0x0001 , IMAGE_REL_ARM_ADDR32NB = 0x0002 , IMAGE_REL_ARM_BRANCH24 = 0x0003 ,   IMAGE_REL_ARM_BRANCH11 = 0x0004 , IMAGE_REL_ARM_TOKEN = 0x0005 , IMAGE_REL_ARM_BLX24 = 0x0008 , IMAGE_REL_ARM_BLX11 = 0x0009 ,   IMAGE_REL_ARM_SECTION = 0x000E , IMAGE_REL_ARM_SECREL = 0x000F , IMAGE_REL_ARM_MOV32A = 0x0010 , IMAGE_REL_ARM_MOV32T = 0x0011 ,   IMAGE_REL_ARM_BRANCH20T = 0x0012 , IMAGE_REL_ARM_BRANCH24T = 0x0014 , IMAGE_REL_ARM_BLX23T = 0x0015 }
enum class	WeakExternalCharacteristics : size_t { IMAGE_WEAK_EXTERN_SEARCH_NOLIBRARY = 1 , IMAGE_WEAK_EXTERN_SEARCH_LIBRARY = 2 , IMAGE_WEAK_EXTERN_SEARCH_ALIAS = 3 }
	These are not documented in the spec, but are located in WinNT.h. More...
enum class	ImportType : size_t { IMPORT_CODE = 0 , IMPORT_DATA = 1 , IMPORT_CONST = 2 }
enum class	ImportNameType : size_t { IMPORT_ORDINAL = 0 , IMPORT_NAME = 1 , IMPORT_NAME_NOPREFIX = 2 , IMPORT_NAME_UNDECORATE = 3 }
enum class	CodeViewIdentifiers : size_t {   DEBUG_LINE_TABLES_HAVE_COLUMN_RECORDS = 0x1 , DEBUG_SECTION_MAGIC = 0x4 , DEBUG_SYMBOL_SUBSECTION = 0xF1 , DEBUG_LINE_TABLE_SUBSECTION = 0xF2 ,   DEBUG_STRING_TABLE_SUBSECTION = 0xF3 , DEBUG_INDEX_SUBSECTION = 0xF4 , DEBUG_SYMBOL_TYPE_PROC_START = 0x1147 , DEBUG_SYMBOL_TYPE_PROC_END = 0x114F }
enum class	EXTENDED_WINDOW_STYLES : size_t {   WS_EX_DLGMODALFRAME = 0x00000001L , WS_EX_NOPARENTNOTIFY = 0x00000004L , WS_EX_TOPMOST = 0x00000008L , WS_EX_ACCEPTFILES = 0x00000010L ,   WS_EX_TRANSPARENT = 0x00000020L , WS_EX_MDICHILD = 0x00000040L , WS_EX_TOOLWINDOW = 0x00000080L , WS_EX_WINDOWEDGE = 0x00000100L ,   WS_EX_CLIENTEDGE = 0x00000200L , WS_EX_CONTEXTHELP = 0x00000400L , WS_EX_RIGHT = 0x00001000L , WS_EX_LEFT = 0x00000000L ,   WS_EX_RTLREADING = 0x00002000L , WS_EX_LTRREADING = 0x00000000L , WS_EX_LEFTSCROLLBAR = 0x00004000L , WS_EX_RIGHTSCROLLBAR = 0x00000000L ,   WS_EX_CONTROLPARENT = 0x00010000L , WS_EX_STATICEDGE = 0x00020000L , WS_EX_APPWINDOW = 0x00040000L }
	From https://docs.microsoft.com/en-us/windows/win32/winmsg/extended-window-styles. More...
enum class	WINDOW_STYLES : size_t {   WS_OVERLAPPED = 0x00000000L , WS_POPUP = 0x80000000L , WS_CHILD = 0x40000000L , WS_MINIMIZE = 0x20000000L ,   WS_VISIBLE = 0x10000000L , WS_DISABLED = 0x08000000L , WS_CLIPSIBLINGS = 0x04000000L , WS_CLIPCHILDREN = 0x02000000L ,   WS_MAXIMIZE = 0x01000000L , WS_CAPTION = 0x00C00000L , WS_BORDER = 0x00800000L , WS_DLGFRAME = 0x00400000L ,   WS_VSCROLL = 0x00200000L , WS_HSCROLL = 0x00100000L , WS_SYSMENU = 0x00080000L , WS_THICKFRAME = 0x00040000L ,   WS_GROUP = 0x00020000L , WS_TABSTOP = 0x00010000L , WS_MINIMIZEBOX = 0x00020000L , WS_MAXIMIZEBOX = 0x00010000L }
	From: https://docs.microsoft.com/en-us/windows/win32/winmsg/window-styles. More...
enum class	DIALOG_BOX_STYLES : size_t {   DS_ABSALIGN = 0x0001L , DS_SYSMODAL = 0x0002L , DS_LOCALEDIT = 0x0020L , DS_SETFONT = 0x0040L ,   DS_MODALFRAME = 0x0080L , DS_NOIDLEMSG = 0x0100L , DS_SETFOREGROUND = 0x0200L , DS_3DLOOK = 0x0004L ,   DS_FIXEDSYS = 0x0008L , DS_NOFAILCREATE = 0x0010L , DS_CONTROL = 0x0400L , DS_CENTER = 0x0800L ,   DS_CENTERMOUSE = 0x1000L , DS_CONTEXTHELP = 0x2000L , DS_SHELLFONT = 0x0040L | 0x0008L }
	From https://docs.microsoft.com/en-us/windows/win32/dlgbox/dialog-box-styles. More...
enum class	FIXED_VERSION_OS : size_t {   VOS_UNKNOWN = 0x00000000L , VOS_DOS = 0x00010000L , VOS_NT = 0x00040000L , VOS__WINDOWS16 = 0x00000001L ,   VOS__WINDOWS32 = 0x00000004L , VOS_OS216 = 0x00020000L , VOS_OS232 = 0x00030000L , VOS__PM16 = 0x00000002L ,   VOS__PM32 = 0x00000003L , VOS_DOS_WINDOWS16 = 0x00010000L | 0x00000001L , VOS_DOS_WINDOWS32 = 0x00010000L | 0x00000004L , VOS_NT_WINDOWS32 = 0x00040000L | 0x00000004L ,   VOS_OS216_PM16 = 0x00020000L | 0x00000002L , VOS_OS232_PM32 = 0x00030000L | 0x00000003L }
enum class	FIXED_VERSION_FILE_FLAGS : size_t {   VS_FF_DEBUG = 0x00000001L , VS_FF_INFOINFERRED = 0x00000010L , VS_FF_PATCHED = 0x00000004L , VS_FF_PRERELEASE = 0x00000002L ,   VS_FF_PRIVATEBUILD = 0x00000008L , VS_FF_SPECIALBUILD = 0x00000020L }
enum class	FIXED_VERSION_FILE_TYPES : size_t {   VFT_APP = 0x00000001L , VFT_DLL = 0x00000002L , VFT_DRV = 0x00000003L , VFT_FONT = 0x00000004L ,   VFT_STATIC_LIB = 0x00000007L , VFT_UNKNOWN = 0x00000000L , VFT_VXD = 0x00000005L }
enum class	FIXED_VERSION_FILE_SUB_TYPES : size_t {   VFT2_DRV_COMM = 0x0000000AL , VFT2_DRV_DISPLAY = 0x00000004L , VFT2_DRV_INSTALLABLE = 0x00000008L , VFT2_DRV_KEYBOARD = 0x00000002L ,   VFT2_DRV_LANGUAGE = 0x00000003L , VFT2_DRV_MOUSE = 0x00000005L , VFT2_DRV_NETWORK = 0x00000006L , VFT2_DRV_PRINTER = 0x00000001L ,   VFT2_DRV_SOUND = 0x00000009L , VFT2_DRV_SYSTEM = 0x00000007L , VFT2_DRV_VERSIONED_PRINTER = 0x0000000CL , VFT2_FONT_RASTER = 0x00000001L ,   VFT2_FONT_TRUETYPE = 0x00000003L , VFT2_FONT_VECTOR = 0x00000002L , VFT2_UNKNOWN = 0x00000000L }
enum class	CODE_PAGES : size_t {   CP_IBM037 = 37 , CP_IBM437 = 437 , CP_IBM500 = 500 , CP_ASMO_708 = 708 ,   CP_DOS_720 = 720 , CP_IBM737 = 737 , CP_IBM775 = 775 , CP_IBM850 = 850 ,   CP_IBM852 = 852 , CP_IBM855 = 855 , CP_IBM857 = 857 , CP_IBM00858 = 858 ,   CP_IBM860 = 860 , CP_IBM861 = 861 , CP_DOS_862 = 862 , CP_IBM863 = 863 ,   CP_IBM864 = 864 , CP_IBM865 = 865 , CP_CP866 = 866 , CP_IBM869 = 869 ,   CP_IBM870 = 870 , CP_WINDOWS_874 = 874 , CP_CP875 = 875 , CP_SHIFT_JIS = 932 ,   CP_GB2312 = 936 , CP_KS_C_5601_1987 = 949 , CP_BIG5 = 950 , CP_IBM1026 = 1026 ,   CP_IBM01047 = 1047 , CP_IBM01140 = 1140 , CP_IBM01141 = 1141 , CP_IBM01142 = 1142 ,   CP_IBM01143 = 1143 , CP_IBM01144 = 1144 , CP_IBM01145 = 1145 , CP_IBM01146 = 1146 ,   CP_IBM01147 = 1147 , CP_IBM01148 = 1148 , CP_IBM01149 = 1149 , CP_UTF_16 = 1200 ,   CP_UNICODEFFFE = 1201 , CP_WINDOWS_1250 = 1250 , CP_WINDOWS_1251 = 1251 , CP_WINDOWS_1252 = 1252 ,   CP_WINDOWS_1253 = 1253 , CP_WINDOWS_1254 = 1254 , CP_WINDOWS_1255 = 1255 , CP_WINDOWS_1256 = 1256 ,   CP_WINDOWS_1257 = 1257 , CP_WINDOWS_1258 = 1258 , CP_JOHAB = 1361 , CP_MACINTOSH = 10000 ,   CP_X_MAC_JAPANESE = 10001 , CP_X_MAC_CHINESETRAD = 10002 , CP_X_MAC_KOREAN = 10003 , CP_X_MAC_ARABIC = 10004 ,   CP_X_MAC_HEBREW = 10005 , CP_X_MAC_GREEK = 10006 , CP_X_MAC_CYRILLIC = 10007 , CP_X_MAC_CHINESESIMP = 10008 ,   CP_X_MAC_ROMANIAN = 10010 , CP_X_MAC_UKRAINIAN = 10017 , CP_X_MAC_THAI = 10021 , CP_X_MAC_CE = 10029 ,   CP_X_MAC_ICELANDIC = 10079 , CP_X_MAC_TURKISH = 10081 , CP_X_MAC_CROATIAN = 10082 , CP_UTF_32 = 12000 ,   CP_UTF_32BE = 12001 , CP_X_CHINESE_CNS = 20000 , CP_X_CP20001 = 20001 , CP_X_CHINESE_ETEN = 20002 ,   CP_X_CP20003 = 20003 , CP_X_CP20004 = 20004 , CP_X_CP20005 = 20005 , CP_X_IA5 = 20105 ,   CP_X_IA5_GERMAN = 20106 , CP_X_IA5_SWEDISH = 20107 , CP_X_IA5_NORWEGIAN = 20108 , CP_US_ASCII = 20127 ,   CP_X_CP20261 = 20261 , CP_X_CP20269 = 20269 , CP_IBM273 = 20273 , CP_IBM277 = 20277 ,   CP_IBM278 = 20278 , CP_IBM280 = 20280 , CP_IBM284 = 20284 , CP_IBM285 = 20285 ,   CP_IBM290 = 20290 , CP_IBM297 = 20297 , CP_IBM420 = 20420 , CP_IBM423 = 20423 ,   CP_IBM424 = 20424 , CP_X_EBCDIC_KOREANEXTENDED = 20833 , CP_IBM_THAI = 20838 , CP_KOI8_R = 20866 ,   CP_IBM871 = 20871 , CP_IBM880 = 20880 , CP_IBM905 = 20905 , CP_IBM00924 = 20924 ,   CP_EUC_JP_JIS = 20932 , CP_X_CP20936 = 20936 , CP_X_CP20949 = 20949 , CP_CP1025 = 21025 ,   CP_KOI8_U = 21866 , CP_ISO_8859_1 = 28591 , CP_ISO_8859_2 = 28592 , CP_ISO_8859_3 = 28593 ,   CP_ISO_8859_4 = 28594 , CP_ISO_8859_5 = 28595 , CP_ISO_8859_6 = 28596 , CP_ISO_8859_7 = 28597 ,   CP_ISO_8859_8 = 28598 , CP_ISO_8859_9 = 28599 , CP_ISO_8859_13 = 28603 , CP_ISO_8859_15 = 28605 ,   CP_X_EUROPA = 29001 , CP_ISO_8859_8_I = 38598 , CP_ISO_2022_JP = 50220 , CP_CSISO2022JP = 50221 ,   CP_ISO_2022_JP_JIS = 50222 , CP_ISO_2022_KR = 50225 , CP_X_CP50227 = 50227 , CP_EUC_JP = 51932 ,   CP_EUC_CN = 51936 , CP_EUC_KR = 51949 , CP_HZ_GB_2312 = 52936 , CP_GB18030 = 54936 ,   CP_X_ISCII_DE = 57002 , CP_X_ISCII_BE = 57003 , CP_X_ISCII_TA = 57004 , CP_X_ISCII_TE = 57005 ,   CP_X_ISCII_AS = 57006 , CP_X_ISCII_OR = 57007 , CP_X_ISCII_KA = 57008 , CP_X_ISCII_MA = 57009 ,   CP_X_ISCII_GU = 57010 , CP_X_ISCII_PA = 57011 , CP_UTF_7 = 65000 , CP_UTF_8 = 65001 }
	Code page from https://docs.microsoft.com/en-us/windows/win32/intl/code-page-identifiers. More...
enum class	ACCELERATOR_FLAGS : size_t {   FVIRTKEY = 0x01 , FNOINVERT = 0x02 , FSHIFT = 0x04 , FCONTROL = 0x08 ,   FALT = 0x10 , END = 0x80 }
	From https://docs.microsoft.com/en-us/windows/win32/menurc/acceltableentry. More...
enum class	ACCELERATOR_VK_CODES : size_t {   VK_LBUTTON = 0x01 , VK_RBUTTON = 0x02 , VK_CANCEL = 0x03 , VK_MBUTTON = 0x04 ,   VK_XBUTTON1 = 0x05 , VK_XBUTTON2 = 0x06 , VK_BACK = 0x08 , VK_TAB = 0x09 ,   VK_CLEAR = 0x0C , VK_RETURN = 0x0D , VK_SHIFT = 0x10 , VK_CONTROL = 0x11 ,   VK_MENU = 0x12 , VK_PAUSE = 0x13 , VK_CAPITAL = 0x14 , VK_KANA = 0x15 ,   VK_HANGUEL = 0x15 , VK_HANGUL = 0x15 , VK_IME_ON = 0x16 , VK_JUNJA = 0x17 ,   VK_FINAL = 0x18 , VK_HANJA = 0x19 , VK_KANJI = 0x19 , VK_IME_OFF = 0x1A ,   VK_ESCAPE = 0x1B , VK_CONVERT = 0x1C , VK_NONCONVERT = 0x1D , VK_ACCEPT = 0x1E ,   VK_MODECHANGE = 0x1F , VK_SPACE = 0x20 , VK_PRIOR = 0x21 , VK_NEXT = 0x22 ,   VK_END = 0x23 , VK_HOME = 0x24 , VK_LEFT = 0x25 , VK_UP = 0x26 ,   VK_RIGHT = 0x27 , VK_DOWN = 0x28 , VK_SELECT = 0x29 , VK_PRINT = 0x2A ,   VK_EXECUTE = 0x2B , VK_SNAPSHOT = 0x2C , VK_INSERT = 0x2D , VK_DELETE = 0x2E ,   VK_HELP = 0x2F , VK_0 = 0x30 , VK_1 = 0x31 , VK_2 = 0x32 ,   VK_3 = 0x33 , VK_4 = 0x34 , VK_5 = 0x35 , VK_6 = 0x36 ,   VK_7 = 0x37 , VK_8 = 0x38 , VK_9 = 0x39 , VK_A = 0x41 ,   VK_B = 0x42 , VK_C = 0x43 , VK_D = 0x44 , VK_E = 0x45 ,   VK_F = 0x46 , VK_G = 0x47 , VK_H = 0x48 , VK_I = 0x49 ,   VK_J = 0x4A , VK_K = 0x4B , VK_L = 0x4C , VK_M = 0x4D ,   VK_N = 0x4E , VK_O = 0x4F , VK_P = 0x50 , VK_Q = 0x51 ,   VK_R = 0x52 , VK_S = 0x53 , VK_T = 0x54 , VK_U = 0x55 ,   VK_V = 0x56 , VK_W = 0x57 , VK_X = 0x58 , VK_Y = 0x59 ,   VK_Z = 0x60 , VK_LWIN = 0x5B , VK_RWIN = 0x5C , VK_APPS = 0x5D ,   VK_SLEEP = 0x5F , VK_NUMPAD0 = 0x60 , VK_NUMPAD1 = 0x61 , VK_NUMPAD2 = 0x62 ,   VK_NUMPAD3 = 0x63 , VK_NUMPAD4 = 0x64 , VK_NUMPAD5 = 0x65 , VK_NUMPAD6 = 0x66 ,   VK_NUMPAD7 = 0x67 , VK_NUMPAD8 = 0x68 , VK_NUMPAD9 = 0x69 , VK_MULTIPLY = 0x6A ,   VK_ADD = 0x6B , VK_SEPARATOR = 0x6C , VK_SUBTRACT = 0x6D , VK_DECIMAL = 0x6E ,   VK_DIVIDE = 0x6F , VK_F1 = 0x70 , VK_F2 = 0x71 , VK_F3 = 0x72 ,   VK_F4 = 0x73 , VK_F5 = 0x74 , VK_F6 = 0x75 , VK_F7 = 0x76 ,   VK_F8 = 0x77 , VK_F9 = 0x78 , VK_F10 = 0x79 , VK_F11 = 0x7A ,   VK_F12 = 0x7B , VK_F13 = 0x7C , VK_F14 = 0x7D , VK_F15 = 0x7E ,   VK_F16 = 0x7F , VK_F17 = 0x80 , VK_F18 = 0x81 , VK_F19 = 0x82 ,   VK_F20 = 0x83 , VK_F21 = 0x84 , VK_F22 = 0x85 , VK_F23 = 0x86 ,   VK_F24 = 0x87 , VK_NUMLOCK = 0x90 , VK_SCROLL = 0x91 , VK_LSHIFT = 0xA0 ,   VK_RSHIFT = 0xA1 , VK_LCONTROL = 0xA2 , VK_RCONTROL = 0xA3 , VK_LMENU = 0xA4 ,   VK_RMENU = 0xA5 , VK_BROWSER_BACK = 0xA6 , VK_BROWSER_FORWARD = 0xA7 , VK_BROWSER_REFRESH = 0xA8 ,   VK_BROWSER_STOP = 0xA9 , VK_BROWSER_SEARCH = 0xAA , VK_BROWSER_FAVORITES = 0xAB , VK_BROWSER_HOME = 0xAC ,   VK_VOLUME_MUTE = 0xAD , VK_VOLUME_DOWN = 0xAE , VK_VOLUME_UP = 0xAF , VK_MEDIA_NEXT_TRACK = 0xB0 ,   VK_MEDIA_PREV_TRACK = 0xB1 , VK_MEDIA_STOP = 0xB2 , VK_MEDIA_PLAY_PAUSE = 0xB3 , VK_LAUNCH_MAIL = 0xB4 ,   VK_LAUNCH_MEDIA_SELECT = 0xB5 , VK_LAUNCH_APP1 = 0xB6 , VK_LAUNCH_APP2 = 0xB7 , VK_OEM_1 = 0xBA ,   VK_OEM_PLUS = 0xBB , VK_OEM_COMMA = 0xBC , VK_OEM_MINUS = 0xBD , VK_OEM_PERIOD = 0xBE ,   VK_OEM_2 = 0xBF , VK_OEM_4 = 0xDB , VK_OEM_5 = 0xDC , VK_OEM_6 = 0xDD ,   VK_OEM_7 = 0xDE , VK_OEM_8 = 0xDF , VK_OEM_102 = 0xE2 , VK_PROCESSKEY = 0xE5 ,   VK_PACKET = 0xE7 , VK_ATTN = 0xF6 , VK_CRSEL = 0xF7 , VK_EXSEL = 0xF8 ,   VK_EREOF = 0xF9 , VK_PLAY = 0xFA , VK_ZOOM = 0xFB , VK_NONAME = 0xFC ,   VK_PA1 = 0xFD , VK_OEM_CLEAR = 0xFE }
	From https://docs.microsoft.com/en-us/windows/win32/inputdev/virtual-key-codes. More...
enum class	PE_SECTION_TYPES : uint8_t {   TEXT = 0 , TLS = 1 , IMPORT = 2 , DATA = 3 ,   BSS = 4 , RESOURCE = 5 , RELOCATION = 6 , EXPORT = 7 ,   DEBUG_TYPE = 8 , LOAD_CONFIG = 9 , UNKNOWN = 10 }
	Common section type. More...
enum class	PE_TYPE : uint16_t { PE32 = 0x10b , PE32_PLUS = 0x20b }
enum class	ALGORITHMS : uint32_t {   UNKNOWN = 0 , SHA_512 , SHA_384 , SHA_256 ,   SHA_1 , MD5 , MD4 , MD2 ,   RSA , EC , MD5_RSA , SHA1_DSA ,   SHA1_RSA , SHA_256_RSA , SHA_384_RSA , SHA_512_RSA ,   SHA1_ECDSA , SHA_256_ECDSA , SHA_384_ECDSA , SHA_512_ECDSA }
	Cryptography algorithms. More...
enum class	RESOURCE_LANGS {   NEUTRAL = 0x00 , INVARIANT = 0x7f , AFRIKAANS = 0x36 , ALBANIAN = 0x1c ,   ARABIC = 0x01 , ARMENIAN = 0x2b , ASSAMESE = 0x4d , AZERI = 0x2c ,   BASQUE = 0x2d , BELARUSIAN = 0x23 , BANGLA = 0x45 , BULGARIAN = 0x02 ,   CATALAN = 0x03 , CHINESE = 0x04 , CROATIAN = 0x1a , BOSNIAN = 0x1a ,   CZECH = 0x05 , DANISH = 0x06 , DIVEHI = 0x65 , DUTCH = 0x13 ,   ENGLISH = 0x09 , ESTONIAN = 0x25 , FAEROESE = 0x38 , FARSI = 0x29 ,   FINNISH = 0x0b , FRENCH = 0x0c , GALICIAN = 0x56 , GEORGIAN = 0x37 ,   GERMAN = 0x07 , GREEK = 0x08 , GUJARATI = 0x47 , HEBREW = 0x0d ,   HINDI = 0x39 , HUNGARIAN = 0x0e , ICELANDIC = 0x0f , INDONESIAN = 0x21 ,   ITALIAN = 0x10 , JAPANESE = 0x11 , KANNADA = 0x4b , KASHMIRI = 0x60 ,   KAZAK = 0x3f , KONKANI = 0x57 , KOREAN = 0x12 , KYRGYZ = 0x40 ,   LATVIAN = 0x26 , LITHUANIAN = 0x27 , MACEDONIAN = 0x2f , MALAY = 0x3e ,   MALAYALAM = 0x4c , MANIPURI = 0x58 , MARATHI = 0x4e , MONGOLIAN = 0x50 ,   NEPALI = 0x61 , NORWEGIAN = 0x14 , ORIYA = 0x48 , POLISH = 0x15 ,   PORTUGUESE = 0x16 , PUNJABI = 0x46 , ROMANIAN = 0x18 , RUSSIAN = 0x19 ,   SANSKRIT = 0x4f , SERBIAN = 0x1a , SINDHI = 0x59 , SLOVAK = 0x1b ,   SLOVENIAN = 0x24 , SPANISH = 0x0a , SWAHILI = 0x41 , SWEDISH = 0x1d ,   SYRIAC = 0x5a , TAMIL = 0x49 , TATAR = 0x44 , TELUGU = 0x4a ,   THAI = 0x1e , TURKISH = 0x1f , UKRAINIAN = 0x22 , URDU = 0x20 ,   UZBEK = 0x43 , VIETNAMESE = 0x2a , GAELIC = 0x3c , MALTESE = 0x3a ,   MAORI = 0x28 , RHAETO_ROMANCE = 0x17 , SAMI = 0x3b , SORBIAN = 0x2e ,   SUTU = 0x30 , TSONGA = 0x31 , TSWANA = 0x32 , VENDA = 0x33 ,   XHOSA = 0x34 , ZULU = 0x35 , ESPERANTO = 0x8f , WALON = 0x90 ,   CORNISH = 0x91 , WELSH = 0x92 , BRETON = 0x93 , INUKTITUT = 0x5d ,   IRISH = 0x3C , LOWER_SORBIAN = 0x2E , PULAR = 0x67 , QUECHUA = 0x6B ,   TAMAZIGHT = 0x5F , TIGRINYA = 0x73 , VALENCIAN = 0x03 }
enum class	IMPHASH_MODE { DEFAULT = 0 , LIEF = DEFAULT , PEFILE , VT = PEFILE }
	Enum to define the behavior of LIEF::PE::get_imphash. More...

Functions
const char *	to_string (DataDirectory::TYPES e)
const char *	to_string (CodeView::SIGNATURES e)
const char *	to_string (Debug::TYPES e)
const char *	to_string (Pogo::SIGNATURES e)
const char *	to_string (PE_TYPE e)
const char *	to_string (PE_SECTION_TYPES e)
const char *	to_string (SYMBOL_BASE_TYPES e)
const char *	to_string (SYMBOL_COMPLEX_TYPES e)
const char *	to_string (SYMBOL_SECTION_NUMBER e)
const char *	to_string (SYMBOL_STORAGE_CLASS e)
const char *	to_string (RELOCATIONS_BASE_TYPES e)
const char *	to_string (RELOCATIONS_I386 e)
const char *	to_string (RELOCATIONS_AMD64 e)
const char *	to_string (RELOCATIONS_ARM e)
const char *	to_string (CODE_PAGES e)
const char *	to_string (EXTENDED_WINDOW_STYLES e)
const char *	to_string (WINDOW_STYLES e)
const char *	to_string (DIALOG_BOX_STYLES e)
const char *	to_string (FIXED_VERSION_OS e)
const char *	to_string (FIXED_VERSION_FILE_FLAGS e)
const char *	to_string (FIXED_VERSION_FILE_TYPES e)
const char *	to_string (FIXED_VERSION_FILE_SUB_TYPES e)
const char *	to_string (ACCELERATOR_FLAGS e)
const char *	to_string (ACCELERATOR_VK_CODES e)
const char *	to_string (ALGORITHMS e)
const char *	to_string (Header::CHARACTERISTICS c)
const char *	to_string (Header::MACHINE_TYPES c)
std::string	to_json (const Object &v)
const char *	to_string (LoadConfiguration::VERSION e)
const char *	to_string (LoadConfigurationV1::IMAGE_GUARD e)
const char *	to_string (OptionalHeader::DLL_CHARACTERISTICS)
const char *	to_string (OptionalHeader::SUBSYSTEM)
const char *	to_string (RelocationEntry::BASE_TYPES e)
const char *	to_string (ResourcesManager::TYPE type)
const char *	to_string (Section::CHARACTERISTICS e)
const char *	to_string (Attribute::TYPE e)
const char *	oid_to_string (const oid_t &oid)
	Convert an OID to a human-readable string.
bool	is_pe (BinaryStream &stream)
bool	is_pe (const std::string &file)
	check if the file is a PE file
bool	is_pe (const std::vector< uint8_t > &raw)
	check if the raw data is a PE file
result< PE_TYPE >	get_type (const std::string &file)
	if the input file is a PE one, return PE32 or PE32+
result< PE_TYPE >	get_type (const std::vector< uint8_t > &raw)
	Return PE32 or PE32+
result< PE_TYPE >	get_type_from_stream (BinaryStream &stream)
std::string	get_imphash (const Binary &binary, IMPHASH_MODE mode=IMPHASH_MODE::DEFAULT)
	Compute the hash of imported functions.
result< Import >	resolve_ordinals (const Import &import, bool strict=false, bool use_std=false)
	Take a PE::Import as entry and try to resolve imports by ordinal.
ALGORITHMS	algo_from_oid (const std::string &oid)

Detailed Description

Namespace related to the LIEF's PE module.

Typedef Documentation

oid_t

using LIEF::PE::oid_t = std::string

Enumeration Type Documentation

ACCELERATOR_FLAGS

enum class LIEF::PE::ACCELERATOR_FLAGS : size_t

strong

From https://docs.microsoft.com/en-us/windows/win32/menurc/acceltableentry.

Enumerator
FVIRTKEY
FNOINVERT
FSHIFT
FCONTROL
FALT
END

ACCELERATOR_VK_CODES

enum class LIEF::PE::ACCELERATOR_VK_CODES : size_t

strong

From https://docs.microsoft.com/en-us/windows/win32/inputdev/virtual-key-codes.

Enumerator
VK_LBUTTON
VK_RBUTTON
VK_CANCEL
VK_MBUTTON
VK_XBUTTON1
VK_XBUTTON2
VK_BACK
VK_TAB
VK_CLEAR
VK_RETURN
VK_SHIFT
VK_CONTROL
VK_MENU
VK_PAUSE
VK_CAPITAL
VK_KANA
VK_HANGUEL
VK_HANGUL
VK_IME_ON
VK_JUNJA
VK_FINAL
VK_HANJA
VK_KANJI
VK_IME_OFF
VK_ESCAPE
VK_CONVERT
VK_NONCONVERT
VK_ACCEPT
VK_MODECHANGE
VK_SPACE
VK_PRIOR
VK_NEXT
VK_END
VK_HOME
VK_LEFT
VK_UP
VK_RIGHT
VK_DOWN
VK_SELECT
VK_PRINT
VK_EXECUTE
VK_SNAPSHOT
VK_INSERT
VK_DELETE
VK_HELP
VK_0
VK_1
VK_2
VK_3
VK_4
VK_5
VK_6
VK_7
VK_8
VK_9
VK_A
VK_B
VK_C
VK_D
VK_E
VK_F
VK_G
VK_H
VK_I
VK_J
VK_K
VK_L
VK_M
VK_N
VK_O
VK_P
VK_Q
VK_R
VK_S
VK_T
VK_U
VK_V
VK_W
VK_X
VK_Y
VK_Z
VK_LWIN
VK_RWIN
VK_APPS
VK_SLEEP
VK_NUMPAD0
VK_NUMPAD1
VK_NUMPAD2
VK_NUMPAD3
VK_NUMPAD4
VK_NUMPAD5
VK_NUMPAD6
VK_NUMPAD7
VK_NUMPAD8
VK_NUMPAD9
VK_MULTIPLY
VK_ADD
VK_SEPARATOR
VK_SUBTRACT
VK_DECIMAL
VK_DIVIDE
VK_F1
VK_F2
VK_F3
VK_F4
VK_F5
VK_F6
VK_F7
VK_F8
VK_F9
VK_F10
VK_F11
VK_F12
VK_F13
VK_F14
VK_F15
VK_F16
VK_F17
VK_F18
VK_F19
VK_F20
VK_F21
VK_F22
VK_F23
VK_F24
VK_NUMLOCK
VK_SCROLL
VK_LSHIFT
VK_RSHIFT
VK_LCONTROL
VK_RCONTROL
VK_LMENU
VK_RMENU
VK_BROWSER_BACK
VK_BROWSER_FORWARD
VK_BROWSER_REFRESH
VK_BROWSER_STOP
VK_BROWSER_SEARCH
VK_BROWSER_FAVORITES
VK_BROWSER_HOME
VK_VOLUME_MUTE
VK_VOLUME_DOWN
VK_VOLUME_UP
VK_MEDIA_NEXT_TRACK
VK_MEDIA_PREV_TRACK
VK_MEDIA_STOP
VK_MEDIA_PLAY_PAUSE
VK_LAUNCH_MAIL
VK_LAUNCH_MEDIA_SELECT
VK_LAUNCH_APP1
VK_LAUNCH_APP2
VK_OEM_1
VK_OEM_PLUS
VK_OEM_COMMA
VK_OEM_MINUS
VK_OEM_PERIOD
VK_OEM_2
VK_OEM_4
VK_OEM_5
VK_OEM_6
VK_OEM_7
VK_OEM_8
VK_OEM_102
VK_PROCESSKEY
VK_PACKET
VK_ATTN
VK_CRSEL
VK_EXSEL
VK_EREOF
VK_PLAY
VK_ZOOM
VK_NONAME
VK_PA1
VK_OEM_CLEAR

ALGORITHMS

enum class LIEF::PE::ALGORITHMS : uint32_t

strong

Cryptography algorithms.

Enumerator
UNKNOWN
SHA_512
SHA_384
SHA_256
SHA_1
MD5
MD4
MD2
RSA
EC
MD5_RSA
SHA1_DSA
SHA1_RSA
SHA_256_RSA
SHA_384_RSA
SHA_512_RSA
SHA1_ECDSA
SHA_256_ECDSA
SHA_384_ECDSA
SHA_512_ECDSA

AuxSymbolType

enum class LIEF::PE::AuxSymbolType : size_t

strong

Enumerator
IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF

CODE_PAGES

enum class LIEF::PE::CODE_PAGES : size_t

strong

Code page from https://docs.microsoft.com/en-us/windows/win32/intl/code-page-identifiers.

Enumerator
CP_IBM037	IBM EBCDIC US-Canada
CP_IBM437	OEM United States
CP_IBM500	IBM EBCDIC International
CP_ASMO_708	Arabic (ASMO 708)
CP_DOS_720	Arabic (Transparent ASMO); Arabic (DOS)
CP_IBM737	OEM Greek (formerly 437G); Greek (DOS)
CP_IBM775	OEM Baltic; Baltic (DOS)
CP_IBM850	OEM Multilingual Latin 1; Western European (DOS)
CP_IBM852	OEM Latin 2; Central European (DOS)
CP_IBM855	OEM Cyrillic (primarily Russian)
CP_IBM857	OEM Turkish; Turkish (DOS)
CP_IBM00858	OEM Multilingual Latin 1 + Euro symbol
CP_IBM860	OEM Portuguese; Portuguese (DOS)
CP_IBM861	OEM Icelandic; Icelandic (DOS)
CP_DOS_862	OEM Hebrew; Hebrew (DOS)
CP_IBM863	OEM French Canadian; French Canadian (DOS)
CP_IBM864	OEM Arabic; Arabic (864)
CP_IBM865	OEM Nordic; Nordic (DOS)
CP_CP866	OEM Russian; Cyrillic (DOS)
CP_IBM869	OEM Modern Greek; Greek, Modern (DOS)
CP_IBM870	IBM EBCDIC Multilingual/ROECE (Latin 2); IBM EBCDIC Multilingual Latin 2
CP_WINDOWS_874	ANSI/OEM Thai (same as 28605, ISO 8859-15); Thai (Windows)
CP_CP875	IBM EBCDIC Greek Modern
CP_SHIFT_JIS	ANSI/OEM Japanese; Japanese (Shift-JIS)
CP_GB2312	ANSI/OEM Simplified Chinese (PRC, Singapore); Chinese Simplified (GB2312)
CP_KS_C_5601_1987	ANSI/OEM Korean (Unified Hangul Code)
CP_BIG5	ANSI/OEM Traditional Chinese (Taiwan; Hong Kong SAR, PRC); Chinese Traditional (Big5)
CP_IBM1026	IBM EBCDIC Turkish (Latin 5)
CP_IBM01047	IBM EBCDIC Latin 1/Open System
CP_IBM01140	IBM EBCDIC US-Canada (037 + Euro symbol); IBM EBCDIC (US-Canada-Euro)
CP_IBM01141	IBM EBCDIC Germany (20273 + Euro symbol); IBM EBCDIC (Germany-Euro)
CP_IBM01142	IBM EBCDIC Denmark-Norway (20277 + Euro symbol); IBM EBCDIC (Denmark-Norway-Euro)
CP_IBM01143	IBM EBCDIC Finland-Sweden (20278 + Euro symbol); IBM EBCDIC (Finland-Sweden-Euro)
CP_IBM01144	IBM EBCDIC Italy (20280 + Euro symbol); IBM EBCDIC (Italy-Euro)
CP_IBM01145	IBM EBCDIC Latin America-Spain (20284 + Euro symbol); IBM EBCDIC (Spain-Euro)
CP_IBM01146	IBM EBCDIC United Kingdom (20285 + Euro symbol); IBM EBCDIC (UK-Euro)
CP_IBM01147	IBM EBCDIC France (20297 + Euro symbol); IBM EBCDIC (France-Euro)
CP_IBM01148	IBM EBCDIC International (500 + Euro symbol); IBM EBCDIC (International-Euro)
CP_IBM01149	IBM EBCDIC Icelandic (20871 + Euro symbol); IBM EBCDIC (Icelandic-Euro)
CP_UTF_16	Unicode UTF-16, little endian byte order (BMP of ISO 10646); available only to managed applications
CP_UNICODEFFFE	Unicode UTF-16, big endian byte order; available only to managed applications
CP_WINDOWS_1250	ANSI Central European; Central European (Windows)
CP_WINDOWS_1251	ANSI Cyrillic; Cyrillic (Windows)
CP_WINDOWS_1252	ANSI Latin 1; Western European (Windows)
CP_WINDOWS_1253	ANSI Greek; Greek (Windows)
CP_WINDOWS_1254	ANSI Turkish; Turkish (Windows)
CP_WINDOWS_1255	ANSI Hebrew; Hebrew (Windows)
CP_WINDOWS_1256	ANSI Arabic; Arabic (Windows)
CP_WINDOWS_1257	ANSI Baltic; Baltic (Windows)
CP_WINDOWS_1258	ANSI/OEM Vietnamese; Vietnamese (Windows)
CP_JOHAB	Korean (Johab)
CP_MACINTOSH	MAC Roman; Western European (Mac)
CP_X_MAC_JAPANESE	Japanese (Mac)
CP_X_MAC_CHINESETRAD	MAC Traditional Chinese (Big5); Chinese Traditional (Mac)
CP_X_MAC_KOREAN	Korean (Mac)
CP_X_MAC_ARABIC	Arabic (Mac)
CP_X_MAC_HEBREW	Hebrew (Mac)
CP_X_MAC_GREEK	Greek (Mac)
CP_X_MAC_CYRILLIC	Cyrillic (Mac)
CP_X_MAC_CHINESESIMP	MAC Simplified Chinese (GB 2312); Chinese Simplified (Mac)
CP_X_MAC_ROMANIAN	Romanian (Mac)
CP_X_MAC_UKRAINIAN	Ukrainian (Mac)
CP_X_MAC_THAI	Thai (Mac)
CP_X_MAC_CE	MAC Latin 2; Central European (Mac)
CP_X_MAC_ICELANDIC	Icelandic (Mac)
CP_X_MAC_TURKISH	Turkish (Mac)
CP_X_MAC_CROATIAN	Croatian (Mac)
CP_UTF_32	Unicode UTF-32, little endian byte order; available only to managed applications
CP_UTF_32BE	Unicode UTF-32, big endian byte order; available only to managed applications
CP_X_CHINESE_CNS	CNS Taiwan; Chinese Traditional (CNS)
CP_X_CP20001	TCA Taiwan
CP_X_CHINESE_ETEN	Eten Taiwan; Chinese Traditional (Eten)
CP_X_CP20003	IBM5550 Taiwan
CP_X_CP20004	TeleText Taiwan
CP_X_CP20005	Wang Taiwan
CP_X_IA5	IA5 (IRV International Alphabet No. 5, 7-bit); Western European (IA5)
CP_X_IA5_GERMAN	IA5 German (7-bit)
CP_X_IA5_SWEDISH	IA5 Swedish (7-bit)
CP_X_IA5_NORWEGIAN	IA5 Norwegian (7-bit)
CP_US_ASCII	US-ASCII (7-bit)
CP_X_CP20261	T.61
CP_X_CP20269	ISO 6937 Non-Spacing Accent
CP_IBM273	IBM EBCDIC Germany
CP_IBM277	IBM EBCDIC Denmark-Norway
CP_IBM278	IBM EBCDIC Finland-Sweden
CP_IBM280	IBM EBCDIC Italy
CP_IBM284	IBM EBCDIC Latin America-Spain
CP_IBM285	IBM EBCDIC United Kingdom
CP_IBM290	IBM EBCDIC Japanese Katakana Extended
CP_IBM297	IBM EBCDIC France
CP_IBM420	IBM EBCDIC Arabic
CP_IBM423	IBM EBCDIC Greek
CP_IBM424	IBM EBCDIC Hebrew
CP_X_EBCDIC_KOREANEXTENDED	IBM EBCDIC Korean Extended
CP_IBM_THAI	IBM EBCDIC Thai
CP_KOI8_R	Russian (KOI8-R); Cyrillic (KOI8-R)
CP_IBM871	IBM EBCDIC Icelandic
CP_IBM880	IBM EBCDIC Cyrillic Russian
CP_IBM905	IBM EBCDIC Turkish
CP_IBM00924	IBM EBCDIC Latin 1/Open System (1047 + Euro symbol)
CP_EUC_JP_JIS	Japanese (JIS 0208-1990 and 0121-1990)
CP_X_CP20936	Simplified Chinese (GB2312); Chinese Simplified (GB2312-80)
CP_X_CP20949	Korean Wansung
CP_CP1025	IBM EBCDIC Cyrillic Serbian-Bulgarian
CP_KOI8_U	Ukrainian (KOI8-U); Cyrillic (KOI8-U)
CP_ISO_8859_1	ISO 8859-1 Latin 1; Western European (ISO)
CP_ISO_8859_2	ISO 8859-2 Central European; Central European (ISO)
CP_ISO_8859_3	ISO 8859-3 Latin 3
CP_ISO_8859_4	ISO 8859-4 Baltic
CP_ISO_8859_5	ISO 8859-5 Cyrillic
CP_ISO_8859_6	ISO 8859-6 Arabic
CP_ISO_8859_7	ISO 8859-7 Greek
CP_ISO_8859_8	ISO 8859-8 Hebrew; Hebrew (ISO-Visual)
CP_ISO_8859_9	ISO 8859-9 Turkish
CP_ISO_8859_13	ISO 8859-13 Estonian
CP_ISO_8859_15	ISO 8859-15 Latin 9
CP_X_EUROPA	Europa 3
CP_ISO_8859_8_I	ISO 8859-8 Hebrew; Hebrew (ISO-Logical)
CP_ISO_2022_JP	ISO 2022 Japanese with no halfwidth Katakana; Japanese (JIS)
CP_CSISO2022JP	ISO 2022 Japanese with halfwidth Katakana; Japanese (JIS-Allow 1 byte Kana)
CP_ISO_2022_JP_JIS	ISO 2022 Japanese JIS X 0201-1989; Japanese (JIS-Allow 1 byte Kana - SO/SI)
CP_ISO_2022_KR	ISO 2022 Korean
CP_X_CP50227	ISO 2022 Simplified Chinese; Chinese Simplified (ISO 2022)
CP_EUC_JP	EUC Japanese
CP_EUC_CN	EUC Simplified Chinese; Chinese Simplified (EUC)
CP_EUC_KR	EUC Korean
CP_HZ_GB_2312	HZ-GB2312 Simplified Chinese; Chinese Simplified (HZ)
CP_GB18030	Windows XP and later: GB18030 Simplified Chinese (4 byte); Chinese Simplified (GB18030)
CP_X_ISCII_DE	ISCII Devanagari
CP_X_ISCII_BE	ISCII Bengali
CP_X_ISCII_TA	ISCII Tamil
CP_X_ISCII_TE	ISCII Telugu
CP_X_ISCII_AS	ISCII Assamese
CP_X_ISCII_OR	ISCII Oriya
CP_X_ISCII_KA	ISCII Kannada
CP_X_ISCII_MA	ISCII Malayalam
CP_X_ISCII_GU	ISCII Gujarati
CP_X_ISCII_PA	ISCII Punjabi
CP_UTF_7	Unicode (UTF-7)
CP_UTF_8	Unicode (UTF-8)

CodeViewIdentifiers

enum class LIEF::PE::CodeViewIdentifiers : size_t

strong

Enumerator
DEBUG_LINE_TABLES_HAVE_COLUMN_RECORDS
DEBUG_SECTION_MAGIC
DEBUG_SYMBOL_SUBSECTION
DEBUG_LINE_TABLE_SUBSECTION
DEBUG_STRING_TABLE_SUBSECTION
DEBUG_INDEX_SUBSECTION
DEBUG_SYMBOL_TYPE_PROC_START
DEBUG_SYMBOL_TYPE_PROC_END

DIALOG_BOX_STYLES

enum class LIEF::PE::DIALOG_BOX_STYLES : size_t

strong

From https://docs.microsoft.com/en-us/windows/win32/dlgbox/dialog-box-styles.

Enumerator
DS_ABSALIGN
DS_SYSMODAL
DS_LOCALEDIT
DS_SETFONT
DS_MODALFRAME
DS_NOIDLEMSG
DS_SETFOREGROUND
DS_3DLOOK
DS_FIXEDSYS
DS_NOFAILCREATE
DS_CONTROL
DS_CENTER
DS_CENTERMOUSE
DS_CONTEXTHELP
DS_SHELLFONT

EXTENDED_WINDOW_STYLES

enum class LIEF::PE::EXTENDED_WINDOW_STYLES : size_t

strong

From https://docs.microsoft.com/en-us/windows/win32/winmsg/extended-window-styles.

Enumerator
WS_EX_DLGMODALFRAME
WS_EX_NOPARENTNOTIFY
WS_EX_TOPMOST
WS_EX_ACCEPTFILES
WS_EX_TRANSPARENT
WS_EX_MDICHILD
WS_EX_TOOLWINDOW
WS_EX_WINDOWEDGE
WS_EX_CLIENTEDGE
WS_EX_CONTEXTHELP
WS_EX_RIGHT
WS_EX_LEFT
WS_EX_RTLREADING
WS_EX_LTRREADING
WS_EX_LEFTSCROLLBAR
WS_EX_RIGHTSCROLLBAR
WS_EX_CONTROLPARENT
WS_EX_STATICEDGE
WS_EX_APPWINDOW

FIXED_VERSION_FILE_FLAGS

enum class LIEF::PE::FIXED_VERSION_FILE_FLAGS : size_t

strong

Enumerator
VS_FF_DEBUG
VS_FF_INFOINFERRED
VS_FF_PATCHED
VS_FF_PRERELEASE
VS_FF_PRIVATEBUILD
VS_FF_SPECIALBUILD

FIXED_VERSION_FILE_SUB_TYPES

enum class LIEF::PE::FIXED_VERSION_FILE_SUB_TYPES : size_t

strong

Enumerator
VFT2_DRV_COMM
VFT2_DRV_DISPLAY
VFT2_DRV_INSTALLABLE
VFT2_DRV_KEYBOARD
VFT2_DRV_LANGUAGE
VFT2_DRV_MOUSE
VFT2_DRV_NETWORK
VFT2_DRV_PRINTER
VFT2_DRV_SOUND
VFT2_DRV_SYSTEM
VFT2_DRV_VERSIONED_PRINTER
VFT2_FONT_RASTER
VFT2_FONT_TRUETYPE
VFT2_FONT_VECTOR
VFT2_UNKNOWN

FIXED_VERSION_FILE_TYPES

enum class LIEF::PE::FIXED_VERSION_FILE_TYPES : size_t

strong

Enumerator
VFT_APP
VFT_DLL
VFT_DRV
VFT_FONT
VFT_STATIC_LIB
VFT_UNKNOWN
VFT_VXD

FIXED_VERSION_OS

enum class LIEF::PE::FIXED_VERSION_OS : size_t

strong

Enumerator
VOS_UNKNOWN
VOS_DOS
VOS_NT
VOS__WINDOWS16
VOS__WINDOWS32
VOS_OS216
VOS_OS232
VOS__PM16
VOS__PM32
VOS_DOS_WINDOWS16
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS_OS216_PM16
VOS_OS232_PM32

IMPHASH_MODE

enum class LIEF::PE::IMPHASH_MODE

strong

Enum to define the behavior of LIEF::PE::get_imphash.

Enumerator
DEFAULT	Default implementation
LIEF	Same as IMPHASH_MODE::DEFAULT
PEFILE	Use pefile algorithm
VT	Same as IMPHASH_MODE::PEFILE since Virus Total is using pefile

ImportNameType

enum class LIEF::PE::ImportNameType : size_t

strong

Enumerator
IMPORT_ORDINAL	Import is by ordinal. This indicates that the value in the Ordinal/Hint field of the import header is the import's ordinal. If this constant is not specified, then the Ordinal/Hint field should always be interpreted as the import's hint.
IMPORT_NAME	The import name is identical to the public symbol name.
IMPORT_NAME_NOPREFIX	The import name is the public symbol name, but skipping the leading ?, @, or optionally _.
IMPORT_NAME_UNDECORATE	The import name is the public symbol name, but skipping the leading ?, @, or optionally _, and truncating at the first .

ImportType

enum class LIEF::PE::ImportType : size_t

strong

Enumerator
IMPORT_CODE
IMPORT_DATA
IMPORT_CONST

PE_SECTION_TYPES

enum class LIEF::PE::PE_SECTION_TYPES : uint8_t

strong

Common section type.

Enumerator
TEXT
TLS
IMPORT
DATA
BSS
RESOURCE
RELOCATION
EXPORT
DEBUG_TYPE
LOAD_CONFIG
UNKNOWN

PE_TYPE

enum class LIEF::PE::PE_TYPE : uint16_t

strong

Enumerator
PE32	32bits
PE32_PLUS	64 bits

PE_TYPES

enum class LIEF::PE::PE_TYPES : size_t

strong

Enumerator
PE32
PE32_PLUS	32bits

RELOCATIONS_AMD64

enum class LIEF::PE::RELOCATIONS_AMD64 : size_t

strong

Enumerator
IMAGE_REL_AMD64_ABSOLUTE
IMAGE_REL_AMD64_ADDR64
IMAGE_REL_AMD64_ADDR32
IMAGE_REL_AMD64_ADDR32NB
IMAGE_REL_AMD64_REL32
IMAGE_REL_AMD64_REL32_1
IMAGE_REL_AMD64_REL32_2
IMAGE_REL_AMD64_REL32_3
IMAGE_REL_AMD64_REL32_4
IMAGE_REL_AMD64_REL32_5
IMAGE_REL_AMD64_SECTION
IMAGE_REL_AMD64_SECREL
IMAGE_REL_AMD64_SECREL7
IMAGE_REL_AMD64_TOKEN
IMAGE_REL_AMD64_SREL32
IMAGE_REL_AMD64_PAIR
IMAGE_REL_AMD64_SSPAN32

RELOCATIONS_ARM

enum class LIEF::PE::RELOCATIONS_ARM : size_t

strong

Enumerator
IMAGE_REL_ARM_ABSOLUTE
IMAGE_REL_ARM_ADDR32
IMAGE_REL_ARM_ADDR32NB
IMAGE_REL_ARM_BRANCH24
IMAGE_REL_ARM_BRANCH11
IMAGE_REL_ARM_TOKEN
IMAGE_REL_ARM_BLX24
IMAGE_REL_ARM_BLX11
IMAGE_REL_ARM_SECTION
IMAGE_REL_ARM_SECREL
IMAGE_REL_ARM_MOV32A
IMAGE_REL_ARM_MOV32T
IMAGE_REL_ARM_BRANCH20T
IMAGE_REL_ARM_BRANCH24T
IMAGE_REL_ARM_BLX23T

RELOCATIONS_I386

enum class LIEF::PE::RELOCATIONS_I386 : size_t

strong

Enumerator
IMAGE_REL_I386_ABSOLUTE
IMAGE_REL_I386_DIR16
IMAGE_REL_I386_REL16
IMAGE_REL_I386_DIR32
IMAGE_REL_I386_DIR32NB
IMAGE_REL_I386_SEG12
IMAGE_REL_I386_SECTION
IMAGE_REL_I386_SECREL
IMAGE_REL_I386_TOKEN
IMAGE_REL_I386_SECREL7
IMAGE_REL_I386_REL32

RESOURCE_LANGS

enum class LIEF::PE::RESOURCE_LANGS

strong

Enumerator
NEUTRAL
INVARIANT
AFRIKAANS
ALBANIAN
ARABIC
ARMENIAN
ASSAMESE
AZERI
BASQUE
BELARUSIAN
BANGLA
BULGARIAN
CATALAN
CHINESE
CROATIAN
BOSNIAN
CZECH
DANISH
DIVEHI
DUTCH
ENGLISH
ESTONIAN
FAEROESE
FARSI
FINNISH
FRENCH
GALICIAN
GEORGIAN
GERMAN
GREEK
GUJARATI
HEBREW
HINDI
HUNGARIAN
ICELANDIC
INDONESIAN
ITALIAN
JAPANESE
KANNADA
KASHMIRI
KAZAK
KONKANI
KOREAN
KYRGYZ
LATVIAN
LITHUANIAN
MACEDONIAN
MALAY
MALAYALAM
MANIPURI
MARATHI
MONGOLIAN
NEPALI
NORWEGIAN
ORIYA
POLISH
PORTUGUESE
PUNJABI
ROMANIAN
RUSSIAN
SANSKRIT
SERBIAN
SINDHI
SLOVAK
SLOVENIAN
SPANISH
SWAHILI
SWEDISH
SYRIAC
TAMIL
TATAR
TELUGU
THAI
TURKISH
UKRAINIAN
URDU
UZBEK
VIETNAMESE
GAELIC
MALTESE
MAORI
RHAETO_ROMANCE
SAMI
SORBIAN
SUTU
TSONGA
TSWANA
VENDA
XHOSA
ZULU
ESPERANTO
WALON
CORNISH
WELSH
BRETON
INUKTITUT
IRISH
LOWER_SORBIAN
PULAR
QUECHUA
TAMAZIGHT
TIGRINYA
VALENCIAN

SYMBOL_BASE_TYPES

enum class LIEF::PE::SYMBOL_BASE_TYPES : size_t

strong

Enumerator
IMAGE_SYM_TYPE_NULL	No type information or unknown base type.
IMAGE_SYM_TYPE_VOID	Used with void pointers and functions.
IMAGE_SYM_TYPE_CHAR	A character (signed byte).
IMAGE_SYM_TYPE_SHORT	A 2-byte signed integer.
IMAGE_SYM_TYPE_INT	A natural integer type on the target.
IMAGE_SYM_TYPE_LONG	A 4-byte signed integer.
IMAGE_SYM_TYPE_FLOAT	A 4-byte floating-point number.
IMAGE_SYM_TYPE_DOUBLE	An 8-byte floating-point number.
IMAGE_SYM_TYPE_STRUCT	A structure.
IMAGE_SYM_TYPE_UNION	An union.
IMAGE_SYM_TYPE_ENUM	An enumerated type.
IMAGE_SYM_TYPE_MOE	A member of enumeration (a specific value).
IMAGE_SYM_TYPE_BYTE	A byte; unsigned 1-byte integer.
IMAGE_SYM_TYPE_WORD	A word; unsigned 2-byte integer.
IMAGE_SYM_TYPE_UINT	An unsigned integer of natural size.
IMAGE_SYM_TYPE_DWORD	An unsigned 4-byte integer.

SYMBOL_COMPLEX_TYPES

enum class LIEF::PE::SYMBOL_COMPLEX_TYPES : size_t

strong

Enumerator
IMAGE_SYM_DTYPE_NULL	No complex type; simple scalar variable.
IMAGE_SYM_DTYPE_POINTER	A pointer to base type.
IMAGE_SYM_DTYPE_FUNCTION	A function that returns a base type.
IMAGE_SYM_DTYPE_ARRAY	An array of base type.
SCT_COMPLEX_TYPE_SHIFT	Type is formed as (base + (derived << SCT_COMPLEX_TYPE_SHIFT))

SYMBOL_SECTION_NUMBER

enum LIEF::PE::SYMBOL_SECTION_NUMBER : int

Enumerator
IMAGE_SYM_DEBUG
IMAGE_SYM_ABSOLUTE
IMAGE_SYM_UNDEFINED

SYMBOL_STORAGE_CLASS

enum LIEF::PE::SYMBOL_STORAGE_CLASS : int

Storage class tells where and what the symbol represents.

Enumerator
IMAGE_SYM_CLASS_INVALID
IMAGE_SYM_CLASS_END_OF_FUNCTION	Physical end of function.
IMAGE_SYM_CLASS_NULL	No symbol.
IMAGE_SYM_CLASS_AUTOMATIC	Stack variable.
IMAGE_SYM_CLASS_EXTERNAL	External symbol.
IMAGE_SYM_CLASS_STATIC	Static.
IMAGE_SYM_CLASS_REGISTER	Register variable.
IMAGE_SYM_CLASS_EXTERNAL_DEF	External definition.
IMAGE_SYM_CLASS_LABEL	Label.
IMAGE_SYM_CLASS_UNDEFINED_LABEL	Undefined label.
IMAGE_SYM_CLASS_MEMBER_OF_STRUCT	Member of structure.
IMAGE_SYM_CLASS_ARGUMENT	Function argument.
IMAGE_SYM_CLASS_STRUCT_TAG	Structure tag.
IMAGE_SYM_CLASS_MEMBER_OF_UNION	Member of union.
IMAGE_SYM_CLASS_UNION_TAG	Union tag.
IMAGE_SYM_CLASS_TYPE_DEFINITION	Type definition.
IMAGE_SYM_CLASS_UNDEFINED_STATIC	Undefined static.
IMAGE_SYM_CLASS_ENUM_TAG	Enumeration tag.
IMAGE_SYM_CLASS_MEMBER_OF_ENUM	Member of enumeration.
IMAGE_SYM_CLASS_REGISTER_PARAM	Register parameter.
IMAGE_SYM_CLASS_BIT_FIELD	Bit field ".bb" or ".eb" - beginning or end of block.
IMAGE_SYM_CLASS_BLOCK	".bf" or ".ef" - beginning or end of function
IMAGE_SYM_CLASS_FUNCTION
IMAGE_SYM_CLASS_END_OF_STRUCT	End of structure.
IMAGE_SYM_CLASS_FILE	File name line number, reformatted as symbol.
IMAGE_SYM_CLASS_SECTION
IMAGE_SYM_CLASS_WEAK_EXTERNAL	Duplicate tag external symbol in dmert public lib.
IMAGE_SYM_CLASS_CLR_TOKEN

WeakExternalCharacteristics

enum class LIEF::PE::WeakExternalCharacteristics : size_t

strong

These are not documented in the spec, but are located in WinNT.h.

Enumerator
IMAGE_WEAK_EXTERN_SEARCH_NOLIBRARY
IMAGE_WEAK_EXTERN_SEARCH_LIBRARY
IMAGE_WEAK_EXTERN_SEARCH_ALIAS

WINDOW_STYLES

enum class LIEF::PE::WINDOW_STYLES : size_t

strong

From: https://docs.microsoft.com/en-us/windows/win32/winmsg/window-styles.

Enumerator
WS_OVERLAPPED
WS_POPUP
WS_CHILD
WS_MINIMIZE
WS_VISIBLE
WS_DISABLED
WS_CLIPSIBLINGS
WS_CLIPCHILDREN
WS_MAXIMIZE
WS_CAPTION
WS_BORDER
WS_DLGFRAME
WS_VSCROLL
WS_HSCROLL
WS_SYSMENU
WS_THICKFRAME
WS_GROUP
WS_TABSTOP
WS_MINIMIZEBOX
WS_MAXIMIZEBOX

Function Documentation

algo_from_oid()

ALGORITHMS LIEF::PE::algo_from_oid

(

const std::string &

oid

)

get_imphash()

std::string LIEF::PE::get_imphash	(	const Binary &	binary,
		IMPHASH_MODE	mode = IMPHASH_MODE::DEFAULT )

Compute the hash of imported functions.

By default, it generates an hash with the following properties:

• Order agnostic
• Casse agnostic
• Ordinal (in some extent) agnostic

If one needs the same output as Virus Total (i.e. pefile), you can pass IMPHASH_MODE::PEFILE as second parameter.

Warning

The default algorithm used to compute the imphash value has some variations compared to Yara, pefile, VT implementation

See also

https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html

get_type() [1/2]

result< PE_TYPE > LIEF::PE::get_type

(

const std::string &

file

)

if the input file is a PE one, return PE32 or PE32+

get_type() [2/2]

result< PE_TYPE > LIEF::PE::get_type

(

const std::vector< uint8_t > &

raw

)

Return PE32 or PE32+

get_type_from_stream()

result< PE_TYPE > LIEF::PE::get_type_from_stream

(

BinaryStream &

stream

)

is_pe() [1/3]

bool LIEF::PE::is_pe

(

BinaryStream &

stream

)

is_pe() [2/3]

bool LIEF::PE::is_pe

(

const std::string &

file

)

check if the file is a PE file

is_pe() [3/3]

bool LIEF::PE::is_pe

(

const std::vector< uint8_t > &

raw

)

check if the raw data is a PE file

oid_to_string()

const char * LIEF::PE::oid_to_string

(

const oid_t &

oid

)

Convert an OID to a human-readable string.

resolve_ordinals()

result< Import > LIEF::PE::resolve_ordinals	(	const Import &	import,
		bool	strict = false,
		bool	use_std = false )

Take a PE::Import as entry and try to resolve imports by ordinal.

The strict boolean parameter enables to throw an LIEF::not_found exception if the ordinal can't be resolved. Otherwise it skips the entry.

Parameters

[in]	import	Import to resolve
[in]	strict	If set to true, throw an exception if the import can't be resolved
[in]	use_std	If true, it will use the pefile look-up table for resolving imports

Returns

The PE::import resolved with PE::ImportEntry::name set

to_json()

std::string LIEF::PE::to_json

(

const Object &

v

)

to_string() [1/35]

const char * LIEF::PE::to_string

(

ACCELERATOR_FLAGS

e

)

to_string() [2/35]

const char * LIEF::PE::to_string

(

ACCELERATOR_VK_CODES

e

)

to_string() [3/35]

const char * LIEF::PE::to_string

(

ALGORITHMS

e

)

to_string() [4/35]

const char * LIEF::PE::to_string

(

Attribute::TYPE

e

)

to_string() [5/35]

const char * LIEF::PE::to_string

(

CODE_PAGES

e

)

to_string() [6/35]

const char * LIEF::PE::to_string

(

CodeView::SIGNATURES

e

)

to_string() [7/35]

const char * LIEF::PE::to_string

(

DataDirectory::TYPES

e

)

to_string() [8/35]

const char * LIEF::PE::to_string

(

Debug::TYPES

e

)

to_string() [9/35]

const char * LIEF::PE::to_string

(

DIALOG_BOX_STYLES

e

)

to_string() [10/35]

const char * LIEF::PE::to_string

(

EXTENDED_WINDOW_STYLES

e

)

to_string() [11/35]

const char * LIEF::PE::to_string

(

FIXED_VERSION_FILE_FLAGS

e

)

to_string() [12/35]

const char * LIEF::PE::to_string

(

FIXED_VERSION_FILE_SUB_TYPES

e

)

to_string() [13/35]

const char * LIEF::PE::to_string

(

FIXED_VERSION_FILE_TYPES

e

)

to_string() [14/35]

const char * LIEF::PE::to_string

(

FIXED_VERSION_OS

e

)

to_string() [15/35]

const char * LIEF::PE::to_string

(

Header::CHARACTERISTICS

c

)

to_string() [16/35]

const char * LIEF::PE::to_string

(

Header::MACHINE_TYPES

c

)

to_string() [17/35]

const char * LIEF::PE::to_string

(

LoadConfiguration::VERSION

e

)

to_string() [18/35]

const char * LIEF::PE::to_string

(

LoadConfigurationV1::IMAGE_GUARD

e

)

to_string() [19/35]

const char * LIEF::PE::to_string

(

OptionalHeader::DLL_CHARACTERISTICS

)

to_string() [20/35]

const char * LIEF::PE::to_string

(

OptionalHeader::SUBSYSTEM

)

to_string() [21/35]

const char * LIEF::PE::to_string

(

PE_SECTION_TYPES

e

)

to_string() [22/35]

const char * LIEF::PE::to_string

(

PE_TYPE

e

)

to_string() [23/35]

const char * LIEF::PE::to_string

(

Pogo::SIGNATURES

e

)

to_string() [24/35]

const char * LIEF::PE::to_string

(

RelocationEntry::BASE_TYPES

e

)

to_string() [25/35]

const char * LIEF::PE::to_string

(

RELOCATIONS_AMD64

e

)

to_string() [26/35]

const char * LIEF::PE::to_string

(

RELOCATIONS_ARM

e

)

to_string() [27/35]

const char * LIEF::PE::to_string

(

RELOCATIONS_BASE_TYPES

e

)

to_string() [28/35]

const char * LIEF::PE::to_string

(

RELOCATIONS_I386

e

)

to_string() [29/35]

const char * LIEF::PE::to_string

(

ResourcesManager::TYPE

type

)

to_string() [30/35]

const char * LIEF::PE::to_string

(

Section::CHARACTERISTICS

e

)

to_string() [31/35]

const char * LIEF::PE::to_string

(

SYMBOL_BASE_TYPES

e

)

to_string() [32/35]

const char * LIEF::PE::to_string

(

SYMBOL_COMPLEX_TYPES

e

)

to_string() [33/35]

const char * LIEF::PE::to_string

(

SYMBOL_SECTION_NUMBER

e

)

to_string() [34/35]

const char * LIEF::PE::to_string

(

SYMBOL_STORAGE_CLASS

e

)

to_string() [35/35]

const char * LIEF::PE::to_string

(

WINDOW_STYLES

e

)