Struct lief::pe::headers::OptionalHeader
pub struct OptionalHeader<'a> { /* private fields */ }Expand description
Structure which represents the PE OptionalHeader (after Header).
Note that the term optional comes from the COFF specifications but this header is mandatory for a PE binary.
Implementations§
§impl OptionalHeader<'_>
impl OptionalHeader<'_>
pub fn major_linker_version(&self) -> u8
pub fn major_linker_version(&self) -> u8
The linker major version
pub fn minor_linker_version(&self) -> u8
pub fn minor_linker_version(&self) -> u8
The linker minor version
pub fn sizeof_code(&self) -> u32
pub fn sizeof_code(&self) -> u32
The size of the code .text section or the sum of
all the sections that contain code (i.e. sections with CNT_CODE flag)
pub fn sizeof_initialized_data(&self) -> u32
pub fn sizeof_initialized_data(&self) -> u32
The size of the initialized data which are usually located in the .data section.
If the initialized data are split across multiple sections, it is the sum of the sections.
pub fn sizeof_uninitialized_data(&self) -> u32
pub fn sizeof_uninitialized_data(&self) -> u32
The size of the uninitialized data which are usually located in the .bss section.
If the uninitialized data are split across multiple sections, it is the sum of the sections.
pub fn addressof_entrypoint(&self) -> u32
pub fn addressof_entrypoint(&self) -> u32
The address of the entry point relative to the image base when the executable file is loaded into memory. For program images, this is the starting address. For device drivers, this is the address of the initialization function.
An entry point is optional for DLLs. When no entry point is present, this field must be zero.
pub fn baseof_code(&self) -> u32
pub fn baseof_code(&self) -> u32
Address relative to the imagebase where the binary’s code starts.
pub fn baseof_data(&self) -> u32
pub fn baseof_data(&self) -> u32
Address relative to the imagebase where the binary’s data starts.
pub fn section_alignment(&self) -> u32
pub fn section_alignment(&self) -> u32
The alignment (in bytes) of sections when they are loaded into memory.
It must be greater than or equal to file_alignment and the default is the page size for the architecture.
pub fn file_alignment(&self) -> u32
pub fn file_alignment(&self) -> u32
The section’s file alignment. This value must be a power of 2 between 512 and 64K. The default value is usually 512
pub fn major_operating_system_version(&self) -> u32
pub fn major_operating_system_version(&self) -> u32
The major version number of the required operating system
pub fn minor_operating_system_version(&self) -> u32
pub fn minor_operating_system_version(&self) -> u32
The minor version number of the required operating system
pub fn major_image_version(&self) -> u32
pub fn major_image_version(&self) -> u32
The major version number of the image
pub fn minor_image_version(&self) -> u32
pub fn minor_image_version(&self) -> u32
The minor version number of the image
pub fn major_subsystem_version(&self) -> u32
pub fn major_subsystem_version(&self) -> u32
The major version number of the subsystem
pub fn minor_subsystem_version(&self) -> u32
pub fn minor_subsystem_version(&self) -> u32
The minor version number of the subsystem
pub fn win32_version_value(&self) -> u32
pub fn win32_version_value(&self) -> u32
According to the official PE specifications, this value is reserved and should be 0.
pub fn sizeof_image(&self) -> u32
pub fn sizeof_image(&self) -> u32
The size (in bytes) of the image, including all headers, as the image is loaded in memory.
It must be a multiple of section_alignment and should match crate::pe::Binary::virtual_size
pub fn sizeof_headers(&self) -> u32
pub fn sizeof_headers(&self) -> u32
Size of the DosHeader + PE Header + Section headers rounded up to a multiple of the file_alignment
pub fn checksum(&self) -> u32
pub fn checksum(&self) -> u32
The image file checksum. The algorithm for computing the checksum is incorporated into IMAGHELP.DLL.
The following are checked for validation at load time all drivers, any DLL loaded at boot time, and any DLL that is loaded into a critical Windows process.
pub fn dll_characteristics(&self) -> DllCharacteristics
pub fn dll_characteristics(&self) -> DllCharacteristics
Some characteristics of the underlying binary like the support of the PIE.
The prefix dll comes from the official PE specifications but these characteristics
are also used for executables
pub fn sizeof_stack_reserve(&self) -> u64
pub fn sizeof_stack_reserve(&self) -> u64
Size of the stack to reserve when loading the PE binary
Only OptionalHeader::sizeof_stack_commit is committed, the rest
available one page at a time until the reserve size is reached.
pub fn sizeof_stack_commit(&self) -> u64
pub fn sizeof_stack_commit(&self) -> u64
Size of the stack to commit
pub fn sizeof_heap_reserve(&self) -> u64
pub fn sizeof_heap_reserve(&self) -> u64
Size of the heap to reserve when loading the PE binary
pub fn sizeof_heap_commit(&self) -> u64
pub fn sizeof_heap_commit(&self) -> u64
Size of the stack to commit
pub fn loader_flags(&self) -> u32
pub fn loader_flags(&self) -> u32
According to the PE specifications, this value is reserved and should be 0.
pub fn numberof_rva_and_size(&self) -> u32
pub fn numberof_rva_and_size(&self) -> u32
The number of DataDirectory that follow this header.