retdec
Public Member Functions | Protected Attributes | Private Attributes | List of all members
retdec::fileformat::PeFormat Class Reference

#include <pe_format.h>

Inheritance diagram for retdec::fileformat::PeFormat:
Inheritance graph
[legend]
Collaboration diagram for retdec::fileformat::PeFormat:
Collaboration graph
[legend]

Public Member Functions

 PeFormat (const std::string &pathToFile, const std::string &dllListFile, LoadFlags loadFlags=LoadFlags::NONE)
 
 PeFormat (std::istream &inputStream, LoadFlags loadFlags=LoadFlags::NONE)
 
 PeFormat (const std::uint8_t *data, std::size_t size, LoadFlags loadFlags=LoadFlags::NONE)
 
virtual ~PeFormat () override
 
bool isDotNet () const
 
bool isPackedDotNet () const
 
bool isVisualBasic (unsigned long long &version) const
 
bool getDllFlags (unsigned long long &dllFlags) const
 
bool getNumberOfBaseRelocationBlocks (unsigned long long &relocs) const
 
bool getNumberOfRelocations (unsigned long long &relocs) const
 
bool getDataDirectoryRelative (unsigned long long index, unsigned long long &relAddr, unsigned long long &size) const
 
bool getDataDirectoryAbsolute (unsigned long long index, unsigned long long &absAddr, unsigned long long &size) const
 
const PeCoffSectiongetPeSection (const std::string &secName) const
 
const PeCoffSectiongetPeSection (unsigned long long secIndex) const
 
const CLRHeadergetCLRHeader () const
 
const MetadataHeadergetMetadataHeader () const
 
const MetadataStreamgetMetadataStream () const
 
const StringStreamgetStringStream () const
 
const BlobStreamgetBlobStream () const
 
const GuidStreamgetGuidStream () const
 
const UserStringStreamgetUserStringStream () const
 
const std::string & getModuleVersionId () const
 
const std::string & getTypeLibId () const
 
const std::vector< std::shared_ptr< DotnetClass > > & getDefinedDotnetClasses () const
 
const std::vector< std::shared_ptr< DotnetClass > > & getImportedDotnetClasses () const
 
const std::string & getTypeRefhashCrc32 () const
 
const std::string & getTypeRefhashMd5 () const
 
const std::string & getTypeRefhashSha256 () const
 
const VisualBasicInfogetVisualBasicInfo () const
 
std::vector< std::tuple< const std::uint8_t *, std::size_t > > getDigestRanges () const
 
Byte value storage methods
virtual retdec::utils::Endianness getEndianness () const override
 
virtual std::size_t getBytesPerWord () const override
 
virtual bool hasMixedEndianForDouble () const override
 
Virtual detection methods
virtual std::size_t getDeclaredFileLength () const override
 
virtual bool areSectionsValid () const override
 
virtual bool isObjectFile () const override
 
virtual bool isDll () const override
 
virtual bool isExecutable () const override
 
virtual bool getMachineCode (unsigned long long &result) const override
 
virtual bool getAbiVersion (unsigned long long &result) const override
 
virtual bool getImageBaseAddress (unsigned long long &imageBase) const override
 
virtual bool getEpAddress (unsigned long long &result) const override
 
virtual bool getEpOffset (unsigned long long &epOffset) const override
 
virtual Architecture getTargetArchitecture () const override
 
virtual std::size_t getDeclaredNumberOfSections () const override
 
virtual std::size_t getDeclaredNumberOfSegments () const override
 
virtual std::size_t getSectionTableOffset () const override
 
virtual std::size_t getSectionTableEntrySize () const override
 
virtual std::size_t getSegmentTableOffset () const override
 
virtual std::size_t getSegmentTableEntrySize () const override
 
Detection methods
const PeLib::ImageLoadergetImageLoader () const
 
std::size_t getMzHeaderSize () const
 
std::size_t getOptionalHeaderSize () const
 
std::size_t getPeHeaderOffset () const
 
std::size_t getImageBitability () const
 
std::size_t getCoffSymbolTableOffset () const
 
std::size_t getNumberOfCoffSymbols () const
 
std::size_t getSizeOfStringTable () const
 
std::size_t getMajorLinkerVersion () const
 
std::size_t getMinorLinkerVersion () const
 
std::size_t getFileFlags () const
 
std::size_t getTimeStamp () const
 
std::size_t getChecksum () const
 
std::size_t getFileAlignment () const
 
std::size_t getSectionAlignment () const
 
std::size_t getSizeOfHeaders () const
 
std::size_t getSizeOfImage () const
 
std::size_t getSizeOfStackReserve () const
 
std::size_t getSizeOfStackCommit () const
 
std::size_t getSizeOfHeapReserve () const
 
std::size_t getSizeOfHeapCommit () const
 
std::size_t getNumberOfDataDirectories () const
 
std::size_t getDeclaredNumberOfDataDirectories () const
 
Dependency checking
bool isMissingDependency (std::string dllname) const
 
bool dllListFailedToLoad () const
 
bool initDllList (const std::string &dllListFile)
 
Scanning methods
void scanForAnomalies ()
 
- Public Member Functions inherited from retdec::fileformat::FileFormat
 FileFormat (const std::string &pathToFile, LoadFlags loadFlags=LoadFlags::NONE)
 
 FileFormat (std::istream &inputStream, LoadFlags loadFlags=LoadFlags::NONE)
 
 FileFormat (const std::uint8_t *data, std::size_t size, LoadFlags loadFlags=LoadFlags::NONE)
 
virtual ~FileFormat ()
 
const LoaderErrorInfogetLoaderErrorInfo () const
 
void initArchitecture (Architecture arch, retdec::utils::Endianness endian=retdec::utils::Endianness::UNKNOWN, std::size_t bytesPerWord=4, retdec::common::Address entryPoint=retdec::common::Address::Undefined, retdec::common::Address sectionVMA=retdec::common::Address::Undefined)
 
void loadStrings ()
 
void loadStrings (StringType type, std::size_t charSize)
 
void loadStrings (StringType type, std::size_t charSize, const SecSeg *secSeg)
 
void loadImpHash ()
 
void loadExpHash ()
 
void loadResourceIconHash ()
 
bool isInValidState () const
 
LoadFlags getLoadFlags () const
 
const SectiongetSectionFromOffset (unsigned long long offset) const
 
const SegmentgetSegmentFromOffset (unsigned long long offset) const
 
const SecSeggetSectionOrSegmentFromOffset (unsigned long long offset) const
 
bool haveSectionOrSegmentOnOffset (unsigned long long offset) const
 
bool haveDataOnOffset (unsigned long long offset) const
 
const SectiongetSectionFromAddress (unsigned long long address) const
 
const SegmentgetSegmentFromAddress (unsigned long long address) const
 
const SecSeggetSectionOrSegmentFromAddress (unsigned long long address) const
 
bool haveSectionOrSegmentOnAddress (unsigned long long address) const
 
bool haveDataOnAddress (unsigned long long address) const
 
bool haveReadOnlyDataOnAddress (unsigned long long address) const
 Test if there are some read-only data on provided address – address belongs to some read-only section or segment. More...
 
virtual std::size_t getNibbleLength () const override
 
virtual std::size_t getByteLength () const override
 
virtual std::size_t getWordLength () const override
 
virtual std::size_t getNumberOfNibblesInByte () const override
 
bool isX86 () const
 
bool isX86_64 () const
 
bool isX86OrX86_64 () const
 
bool isArm () const
 
bool isPowerPc () const
 
bool isMips () const
 
bool isUnknownArch () const
 
bool isPe () const
 
bool isElf () const
 
bool isCoff () const
 
bool isMacho () const
 
bool isIntelHex () const
 
bool isRawData () const
 
bool isUnknownFormat () const
 
bool isWindowsDriver () const
 
bool hasCrc32 () const
 
bool hasMd5 () const
 
bool hasSha256 () const
 
bool hasSectionTableCrc32 () const
 
bool hasSectionTableMd5 () const
 
bool hasSectionTableSha256 () const
 
std::string getCrc32 () const
 
std::string getMd5 () const
 
std::string getSha256 () const
 
std::string getSectionTableCrc32 () const
 
std::string getSectionTableMd5 () const
 
std::string getSectionTableSha256 () const
 
std::string getPathToFile () const
 
Format getFileFormat () const
 
std::size_t getNumberOfSections () const
 
std::size_t getNumberOfSegments () const
 
std::size_t getNumberOfSymbolTables () const
 
std::size_t getNumberOfRelocationTables () const
 
std::size_t getNumberOfDynamicTables () const
 
std::size_t getFileLength () const
 
std::size_t getLoadedFileLength () const
 
std::size_t getOverlaySize () const
 
bool getOverlayEntropy (double &res) const
 
std::size_t nibblesFromBytes (std::size_t bytes) const
 
std::size_t bytesFromNibbles (std::size_t nibbles) const
 
std::size_t bytesFromNibblesRounded (std::size_t nibbles) const
 
bool getOffsetFromAddress (unsigned long long &result, unsigned long long address) const
 
bool getAddressFromOffset (unsigned long long &result, unsigned long long offset) const
 
bool getBytes (std::vector< std::uint8_t > &result, unsigned long long offset, unsigned long long numberOfBytes) const
 
bool getEpBytes (std::vector< std::uint8_t > &result, unsigned long long numberOfBytes) const
 
bool getHexBytes (std::string &result, unsigned long long offset, unsigned long long numberOfBytes) const
 
bool getHexEpBytes (std::string &result, unsigned long long numberOfBytes) const
 
bool getHexBytesFromEnd (std::string &result, unsigned long long numberOfBytes) const
 
bool getString (std::string &result, unsigned long long offset, unsigned long long numberOfBytes) const
 
bool getStringFromEnd (std::string &result, unsigned long long numberOfBytes) const
 
bool isObjectStretchedOverSections (std::size_t addr, std::size_t size) const
 
const SectiongetEpSection ()
 
const SectiongetSection (const std::string &secName) const
 
const SectiongetSection (unsigned long long secIndex) const
 
const SectiongetLastSection () const
 
const SectiongetLastButOneSection () const
 
const SegmentgetEpSegment ()
 
const SegmentgetSegment (const std::string &segName) const
 
const SegmentgetSegment (unsigned long long segIndex) const
 
const SegmentgetLastSegment () const
 
const SegmentgetLastButOneSegment () const
 
const SymbolTablegetSymbolTable (unsigned long long tabIndex) const
 
const RelocationTablegetRelocationTable (unsigned long long tabIndex) const
 
const DynamicTablegetDynamicTable (unsigned long long tabIndex) const
 
const ImportTablegetImportTable () const
 
const ExportTablegetExportTable () const
 
const ResourceTablegetResourceTable () const
 
const ResourceTreegetResourceTree () const
 
const RichHeadergetRichHeader () const
 
const PdbInfogetPdbInfo () const
 
const CertificateTablegetCertificateTable () const
 
const TlsInfogetTlsInfo () const
 
const ElfCoreInfogetElfCoreInfo () const
 
const SymbolgetSymbol (const std::string &name) const
 
const SymbolgetSymbol (unsigned long long address) const
 
const RelocationgetRelocation (const std::string &name) const
 
const RelocationgetRelocation (unsigned long long address) const
 
const ImportgetImport (const std::string &name) const
 
const ImportgetImport (unsigned long long address) const
 
const ExportgetExport (const std::string &name) const
 
const ExportgetExport (unsigned long long address) const
 
const ResourcegetManifestResource () const
 
const ResourcegetVersionResource () const
 
bool isSignaturePresent () const
 
bool isSignatureVerified () const
 
const retdec::common::RangeContainer< std::uint64_t > & getNonDecodableAddressRanges () const
 
const std::vector< Section * > & getSections () const
 
const std::vector< Section * > getSections (std::initializer_list< std::string > secs) const
 
const std::vector< Segment * > & getSegments () const
 
const std::vector< Segment * > getSegments (std::initializer_list< std::string > segs) const
 
const std::vector< SymbolTable * > & getSymbolTables () const
 
const std::vector< RelocationTable * > & getRelocationTables () const
 
const std::vector< DynamicTable * > & getDynamicTables () const
 
const std::vector< unsigned char > & getBytes () const
 
const std::vector< unsigned char > & getLoadedBytes () const
 
const unsigned char * getBytesData () const
 
const unsigned char * getLoadedBytesData () const
 
const std::vector< String > & getStrings () const
 
const std::vector< ElfNoteSecSeg > & getElfNoteSecSegs () const
 
const std::set< std::uint64_t > & getUnknownRelocations () const
 
const std::vector< std::pair< std::string, std::string > > & getAnomalies () const
 
virtual bool getXByte (std::uint64_t address, std::uint64_t x, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const override
 
virtual bool getXBytes (std::uint64_t address, std::uint64_t x, std::vector< std::uint8_t > &res) const override
 
virtual bool setXByte (std::uint64_t address, std::uint64_t x, std::uint64_t val, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) override
 
virtual bool setXBytes (std::uint64_t address, const std::vector< std::uint8_t > &val) override
 
bool isPointer (unsigned long long address, std::uint64_t *pointer=nullptr) const
 
bool get1ByteOffset (std::uint64_t offset, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const
 
bool get2ByteOffset (std::uint64_t offset, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const
 
bool get4ByteOffset (std::uint64_t offset, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const
 
bool get8ByteOffset (std::uint64_t offset, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const
 
bool get10ByteOffset (std::uint64_t offset, long double &res) const
 
bool getXByteOffset (std::uint64_t offset, std::uint64_t x, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const
 
bool getXBytesOffset (std::uint64_t offset, std::uint64_t x, std::vector< std::uint8_t > &res) const
 
bool getWordOffset (std::uint64_t offset, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const
 
bool getNTBSOffset (std::uint64_t offset, std::string &res, std::size_t size=0) const
 
bool getNTWSOffset (std::uint64_t offset, std::size_t width, std::vector< std::uint64_t > &res) const
 
virtual std::string getFileFormatName () const
 
void dump ()
 
void dump (std::string &dumpFile)
 
void dumpRegionsValidity ()
 
void dumpRegionsValidity (std::string &dumpStr)
 
void dumpResourceTree ()
 
void dumpResourceTree (std::string &dumpStr)
 
- Public Member Functions inherited from retdec::utils::ByteValueStorage
 ByteValueStorage ()=default
 
virtual ~ByteValueStorage ()=default
 
Endianness getInverseEndianness () const
 
bool isLittleEndian () const
 
bool isBigEndian () const
 
bool isUnknownEndian () const
 
bool hexToBig (std::string &str) const
 
bool hexToLittle (std::string &str) const
 
bool bitsToBig (std::string &str) const
 
bool bitsToLittle (std::string &str) const
 
bool bitsToBig (std::vector< unsigned char > &values) const
 
bool bitsToLittle (std::vector< unsigned char > &values) const
 
bool get1Byte (std::uint64_t address, std::uint64_t &res, Endianness e=Endianness::UNKNOWN) const
 
bool get2Byte (std::uint64_t address, std::uint64_t &res, Endianness e=Endianness::UNKNOWN) const
 
bool get4Byte (std::uint64_t address, std::uint64_t &res, Endianness e=Endianness::UNKNOWN) const
 
bool get8Byte (std::uint64_t address, std::uint64_t &res, Endianness e=Endianness::UNKNOWN) const
 
bool get10Byte (std::uint64_t address, long double &res) const
 
bool getWord (std::uint64_t address, std::uint64_t &res, Endianness e=Endianness::UNKNOWN) const
 
bool getFloat (std::uint64_t address, float &res) const
 
bool getDouble (std::uint64_t address, double &res) const
 
bool set1Byte (std::uint64_t address, std::uint64_t val, Endianness e=Endianness::UNKNOWN)
 
bool set2Byte (std::uint64_t address, std::uint64_t val, Endianness e=Endianness::UNKNOWN)
 
bool set4Byte (std::uint64_t address, std::uint64_t val, Endianness e=Endianness::UNKNOWN)
 
bool set8Byte (std::uint64_t address, std::uint64_t val, Endianness e=Endianness::UNKNOWN)
 
bool set10Byte (std::uint64_t address, long double val)
 
bool setWord (std::uint64_t address, std::uint64_t val, Endianness e=Endianness::UNKNOWN)
 
bool setFloat (std::uint64_t address, float val)
 
bool setDouble (std::uint64_t address, double val)
 
bool getXByteArray (std::uint64_t address, std::uint64_t x, std::vector< std::uint64_t > &res, std::size_t size, Endianness e=Endianness::UNKNOWN) const
 
bool get1ByteArray (std::uint64_t address, std::vector< std::uint64_t > &res, std::size_t size, Endianness e=Endianness::UNKNOWN) const
 
bool get2ByteArray (std::uint64_t address, std::vector< std::uint64_t > &res, std::size_t size, Endianness e=Endianness::UNKNOWN) const
 
bool get4ByteArray (std::uint64_t address, std::vector< std::uint64_t > &res, std::size_t size, Endianness e=Endianness::UNKNOWN) const
 
bool get8ByteArray (std::uint64_t address, std::vector< std::uint64_t > &res, std::size_t size, Endianness e=Endianness::UNKNOWN) const
 
bool get10ByteArray (std::uint64_t address, std::vector< long double > &res, std::size_t size) const
 
bool getWordArray (std::uint64_t address, std::vector< std::uint64_t > &res, std::size_t, Endianness e=Endianness::UNKNOWN) const
 
bool getFloatArray (std::uint64_t address, std::vector< float > &res, std::size_t size) const
 
bool getDoubleArray (std::uint64_t address, std::vector< double > &res, std::size_t size) const
 
bool getNTBS (std::uint64_t address, std::string &res, std::size_t size=0) const
 
bool getNTWS (std::uint64_t address, std::size_t width, std::vector< std::uint64_t > &res) const
 
bool getNTWSNice (std::uint64_t address, std::size_t width, std::vector< std::uint64_t > &res) const
 

Protected Attributes

PeLib::PeFileTfile
 PeLib representation of PE file. More...
 
- Protected Attributes inherited from retdec::fileformat::FileFormat
std::string crc32
 CRC32 of file content. More...
 
std::string md5
 MD5 of file content. More...
 
std::string sha256
 SHA256 of file content. More...
 
std::string sectionCrc32
 CRC32 of section table. More...
 
std::string sectionMd5
 MD5 of section table. More...
 
std::string sectionSha256
 SHA256 of section table. More...
 
std::string filePath
 name of input file More...
 
std::istream & fileStream
 stream representation of input file More...
 
std::vector< Section * > sections
 file sections More...
 
std::vector< Segment * > segments
 file segments More...
 
std::vector< SymbolTable * > symbolTables
 symbol tables More...
 
std::vector< RelocationTable * > relocationTables
 relocation tables More...
 
std::vector< DynamicTable * > dynamicTables
 tables with dynamic records More...
 
std::vector< unsigned char > bytes
 content of file as bytes More...
 
std::vector< Stringstrings
 detected strings More...
 
std::vector< ElfNoteSecSegnoteSecSegs
 note sections or segemnts found in ELF file More...
 
std::set< std::uint64_t > unknownRelocs
 unknown relocations More...
 
ImportTableimportTable
 table of imports More...
 
ExportTableexportTable
 table of exports More...
 
ResourceTableresourceTable
 table of resources More...
 
ResourceTreeresourceTree
 structure of resource tree More...
 
RichHeaderrichHeader
 rich header More...
 
PdbInfopdbInfo
 information about related PDB debug file More...
 
CertificateTablecertificateTable
 table of certificates More...
 
TlsInfotlsInfo
 thread-local information More...
 
ElfCoreInfoelfCoreInfo
 information about core file structures More...
 
Format fileFormat
 format of input file More...
 
LoaderErrorInfo _ldrErrInfo
 loader error (e.g. Windows loader error for PE files) More...
 
bool stateIsValid
 internal state of instance More...
 
std::vector< std::pair< std::size_t, std::size_t > > secHashInfo
 information for calculation of section table hash More...
 
std::optional< bool > signatureVerified
 indicates whether the signature is present and also verified More...
 
retdec::common::RangeContainer< std::uint64_t > nonDecodableRanges
 Address ranges which should not be decoded for instructions. More...
 
std::vector< std::pair< std::string, std::string > > anomalies
 file format anomalies More...
 

Private Member Functions

Initialization methods
void initLoaderErrorInfo (PeLib::LoaderError ldrError)
 
void initLoaderErrorInfo ()
 
void initStructures (const std::string &dllListFile)
 
Virtual initialization methods
virtual std::size_t initSectionTableHashOffsets () override
 
.NET methods
void loadDotnetHeaders ()
 
void parseMetadataStream (std::uint64_t baseAddress, std::uint64_t offset, std::uint64_t size)
 
void parseBlobStream (std::uint64_t baseAddress, std::uint64_t offset, std::uint64_t size)
 
void parseGuidStream (std::uint64_t baseAddress, std::uint64_t offset, std::uint64_t size)
 
void parseStringStream (std::uint64_t baseAddress, std::uint64_t offset, std::uint64_t size)
 
void parseUserStringStream (std::uint64_t baseAddress, std::uint64_t offset, std::uint64_t size)
 
template<typename T >
void parseMetadataTable (BaseMetadataTable *table, std::uint64_t &address)
 
void detectModuleVersionId ()
 
void detectTypeLibId ()
 
void detectDotnetTypes ()
 
std::uint64_t detectPossibleMetadataHeaderAddress () const
 
void computeTypeRefHashes ()
 
Visual Basic methods
bool parseVisualBasicProjectInfo (std::size_t structureOffset)
 
bool parseVisualBasicExternTable (std::size_t structureOffset, std::size_t nEntries)
 
bool parseVisualBasicObjectTable (std::size_t structureOffset)
 
bool parseVisualBasicObjects (std::size_t structureOffset, std::size_t nObjects)
 
bool parseVisualBasicComRegistrationData (std::size_t structureOffset)
 
bool parseVisualBasicComRegistrationInfo (std::size_t structureOffset, std::size_t comRegDataOffset)
 
Auxiliary scanning methods
void scanForSectionAnomalies (unsigned anamaliesLimit=1000)
 
void scanForResourceAnomalies ()
 
void scanForImportAnomalies ()
 
void scanForExportAnomalies ()
 
void scanForOptHeaderAnomalies ()
 

Private Attributes

PeFormatParserformatParser
 parser of PE file More...
 
std::unique_ptr< CLRHeaderclrHeader
 .NET CLR header More...
 
std::unique_ptr< MetadataHeadermetadataHeader
 .NET metadata header More...
 
std::unique_ptr< MetadataStreammetadataStream
 .NET metadata stream More...
 
std::unique_ptr< BlobStreamblobStream
 .NET blob stream More...
 
std::unique_ptr< GuidStreamguidStream
 .NET GUID stream More...
 
std::unique_ptr< StringStreamstringStream
 .NET string stream More...
 
std::unique_ptr< UserStringStreamuserStringStream
 .NET user string stream More...
 
std::string moduleVersionId
 .NET module version ID More...
 
std::string typeLibId
 .NET type lib ID More...
 
std::vector< std::shared_ptr< DotnetClass > > definedClasses
 .NET defined class list More...
 
std::vector< std::shared_ptr< DotnetClass > > importedClasses
 .NET imported class list More...
 
std::string typeRefHashCrc32
 .NET typeref table hash as CRC32 More...
 
std::string typeRefHashMd5
 .NET typeref table hash as MD5 More...
 
std::string typeRefHashSha256
 .NET typeref table hash as SHA256 More...
 
VisualBasicInfo visualBasicInfo
 visual basic header information More...
 
std::unordered_set< std::string > dllList
 Override set of DLLs for checking dependency missing. More...
 
bool errorLoadingDllList
 If true, then an error happened while loading DLL list. More...
 

Auxiliary methods

std::size_t getRichHeaderOffset (const std::string &plainFile)
 
bool getResourceNodes (std::vector< const PeLib::ResourceChild * > &nodes, std::vector< std::size_t > &levels)
 
void loadRichHeader ()
 
void loadSections ()
 
void loadSymbols ()
 
void loadImports ()
 
void loadExports ()
 
void loadVisualBasicHeader ()
 
void loadPdbInfo ()
 
void loadResourceNodes (std::vector< const PeLib::ResourceChild * > &nodes, const std::vector< std::size_t > &levels)
 
void loadResources ()
 
void loadCertificates ()
 
void loadTlsInformation ()
 
static bool checkDefaultList (std::string_view)
 

Additional Inherited Members

- Protected Types inherited from retdec::utils::ByteValueStorage
using GetNByteFn = std::function< bool(std::uint64_t, std::uint64_t &, Endianness)>
 
using GetXByteFn = std::function< bool(std::uint64_t, std::uint64_t, std::uint64_t &, Endianness)>
 
- Protected Member Functions inherited from retdec::fileformat::FileFormat
void clear ()
 
void computeSectionTableHashes ()
 
void setLoadedBytes (std::vector< unsigned char > *lBytes)
 
- Protected Member Functions inherited from retdec::utils::ByteValueStorage
bool createValueFromBytes (const std::vector< std::uint8_t > &data, std::uint64_t &value, Endianness endian, std::uint64_t offset=0, std::uint64_t size=0) const
 
bool createBytesFromValue (std::uint64_t data, std::uint64_t x, std::vector< std::uint8_t > &value, Endianness endian) const
 
bool get10ByteImpl (const std::vector< std::uint8_t > &data, long double &res) const
 
bool getFloatImpl (const std::vector< std::uint8_t > &data, float &res) const
 
bool getDoubleImpl (const std::vector< std::uint8_t > &data, double &res) const
 
bool getNTBSImpl (const GetNByteFn &get1ByteFn, std::uint64_t address, std::string &res, std::size_t size) const
 
bool getNTWSImpl (const GetXByteFn &getXByteFn, std::uint64_t address, std::size_t width, std::vector< std::uint64_t > &res) const
 
bool getNTWSNiceImpl (const GetXByteFn &getXByteFn, std::uint64_t address, std::size_t width, std::vector< std::uint64_t > &res) const
 

Detailed Description

PeFormat - wrapper for parsing PE files

Constructor & Destructor Documentation

◆ PeFormat() [1/3]

retdec::fileformat::PeFormat::PeFormat ( const std::string &  pathToFile,
const std::string &  dllListFile,
LoadFlags  loadFlags = LoadFlags::NONE 
)

Constructor

Parameters
pathToFilePath to input file
dllListFilePath to text file containing list of OS DLLs
loadFlagsLoad flags

◆ PeFormat() [2/3]

retdec::fileformat::PeFormat::PeFormat ( std::istream &  inputStream,
LoadFlags  loadFlags = LoadFlags::NONE 
)

Constructor

Parameters
inputStreamRepresentation of input file
loadFlagsLoad flags

◆ PeFormat() [3/3]

retdec::fileformat::PeFormat::PeFormat ( const std::uint8_t *  data,
std::size_t  size,
LoadFlags  loadFlags = LoadFlags::NONE 
)

Constructor

Parameters
dataInput data.
sizeInput data size.
loadFlagsLoad flags

◆ ~PeFormat()

retdec::fileformat::PeFormat::~PeFormat ( )
overridevirtual

Destructor

Member Function Documentation

◆ areSectionsValid()

bool retdec::fileformat::PeFormat::areSectionsValid ( ) const
overridevirtual

Determine if loaded sections are OK to use for decompilation purposes. We want at least one valid section which may hold code.

Returns
true if sections are to be used, false otherwise (use segments).

Reimplemented from retdec::fileformat::FileFormat.

◆ checkDefaultList()

bool retdec::fileformat::PeFormat::checkDefaultList ( std::string_view  name)
staticprivate

◆ computeTypeRefHashes()

void retdec::fileformat::PeFormat::computeTypeRefHashes ( )
private

Compute typeref hashes - CRC32, MD5, SHA256.

◆ detectDotnetTypes()

void retdec::fileformat::PeFormat::detectDotnetTypes ( )
private

Detects and reconstructs .NET types such as classes, methods, fields, properties etc.

◆ detectModuleVersionId()

void retdec::fileformat::PeFormat::detectModuleVersionId ( )
private

Detects Module Version ID (GUID) out of .NET tables.

◆ detectPossibleMetadataHeaderAddress()

std::uint64_t retdec::fileformat::PeFormat::detectPossibleMetadataHeaderAddress ( ) const
private

Detects possible metadata header structure. It first searches for metadata header signature 0x424A5342. If it finds this signature, it then tries to look further for possible stream names.

Returns
Possible metadata header address, 0 if unsuccessful.

◆ detectTypeLibId()

void retdec::fileformat::PeFormat::detectTypeLibId ( )
private

Detects TypeLib ID (GUID) out of .NET tables.

◆ dllListFailedToLoad()

bool retdec::fileformat::PeFormat::dllListFailedToLoad ( ) const

Returns a flag whether the given DLL list has failed to load.

Returns
true: Failed to load the DLL list

◆ getAbiVersion()

bool retdec::fileformat::PeFormat::getAbiVersion ( unsigned long long &  result) const
overridevirtual

Get file format-dependent version of used ABI

Parameters
resultParameter for store the result
Returns
true if method went OK, false otherwise

Implements retdec::fileformat::FileFormat.

◆ getBlobStream()

const BlobStream * retdec::fileformat::PeFormat::getBlobStream ( ) const

◆ getBytesPerWord()

std::size_t retdec::fileformat::PeFormat::getBytesPerWord ( ) const
overridevirtual

◆ getChecksum()

std::size_t retdec::fileformat::PeFormat::getChecksum ( ) const

Get file checksum

Returns
File checksum

◆ getCLRHeader()

const CLRHeader * retdec::fileformat::PeFormat::getCLRHeader ( ) const

◆ getCoffSymbolTableOffset()

std::size_t retdec::fileformat::PeFormat::getCoffSymbolTableOffset ( ) const

Get offset of COFF symbol table

Returns
Offset of COFF symbol table

◆ getDataDirectoryAbsolute()

bool retdec::fileformat::PeFormat::getDataDirectoryAbsolute ( unsigned long long  index,
unsigned long long &  absAddr,
unsigned long long &  size 
) const

Get data directory

Parameters
indexIndex of selected directory
absAddrInto this parameter is stored absolute virtual address of directory
sizeInto this parameter is stored size of directory
Returns
true if index of selected directory is valid, false otherwise

If method returns false, absAddr and size are left unchanged.

◆ getDataDirectoryRelative()

bool retdec::fileformat::PeFormat::getDataDirectoryRelative ( unsigned long long  index,
unsigned long long &  relAddr,
unsigned long long &  size 
) const

Get data directory

Parameters
indexIndex of selected directory
relAddrInto this parameter is stored relative virtual address of directory
sizeInto this parameter is stored size of directory
Returns
true if index of selected directory is valid, false otherwise

If method returns false, relAddr and size are left unchanged.

◆ getDeclaredFileLength()

std::size_t retdec::fileformat::PeFormat::getDeclaredFileLength ( ) const
overridevirtual

Get declared length of file. This length may be shorter or longer than real length of file.

Returns
Declared length of file

Reimplemented from retdec::fileformat::FileFormat.

◆ getDeclaredNumberOfDataDirectories()

std::size_t retdec::fileformat::PeFormat::getDeclaredNumberOfDataDirectories ( ) const

Get number of data-directory entries declared in the optional header

Returns
Number of data-directory entries declared in the optional header

◆ getDeclaredNumberOfSections()

std::size_t retdec::fileformat::PeFormat::getDeclaredNumberOfSections ( ) const
overridevirtual

Get declared number of sections. This number may be different than real number of sections in file

Returns
Declared number of sections

Implements retdec::fileformat::FileFormat.

◆ getDeclaredNumberOfSegments()

std::size_t retdec::fileformat::PeFormat::getDeclaredNumberOfSegments ( ) const
overridevirtual

Get declared number of segments. This number may be different than real number of segments in file

Returns
Declared number of segments

Implements retdec::fileformat::FileFormat.

◆ getDefinedDotnetClasses()

const std::vector< std::shared_ptr< DotnetClass > > & retdec::fileformat::PeFormat::getDefinedDotnetClasses ( ) const

◆ getDigestRanges()

std::vector< std::tuple< const std::uint8_t *, std::size_t > > retdec::fileformat::PeFormat::getDigestRanges ( ) const

Returns ranges that are used for digest calculation. This digest is used for signature verification. Range is represented in form of tuple where first element is pointer to the beginning of the range and second is size of the range.

Returns
Ranges used for digest process.

◆ getDllFlags()

bool retdec::fileformat::PeFormat::getDllFlags ( unsigned long long &  dllFlags) const

Get DLL flags

Parameters
dllFlagsInto this parameter DLL flags will be stored
Returns
true if file is DLL and flags are successfully detected, false otherwise

◆ getEndianness()

retdec::utils::Endianness retdec::fileformat::PeFormat::getEndianness ( ) const
overridevirtual

◆ getEpAddress()

bool retdec::fileformat::PeFormat::getEpAddress ( unsigned long long &  result) const
overridevirtual

Get virtual address of entry point

Parameters
resultParameter for store the result
Returns
true if file has entry point and entry point address is successfully detected, false otherwise

If file has no associated entry point, result is left unchanged.

If file has entry point but detection of entry point address is failed, instance method isInValidState() returns false after its invocation.

Implements retdec::fileformat::FileFormat.

◆ getEpOffset()

bool retdec::fileformat::PeFormat::getEpOffset ( unsigned long long &  epOffset) const
overridevirtual

Get offset of entry point

Parameters
epOffsetInto this parameter the resulting number is stored
Returns
true if file has entry point and entry point offset is successfully detected, false otherwise

If file has no associated entry point, epOffset is left unchanged.

If file has entry point but detection of entry point offset is failed, instance method isInValidState() returns false after its invocation.

Implements retdec::fileformat::FileFormat.

◆ getFileAlignment()

std::size_t retdec::fileformat::PeFormat::getFileAlignment ( ) const

Get file alignment

Returns
File alignment

◆ getFileFlags()

std::size_t retdec::fileformat::PeFormat::getFileFlags ( ) const

Get file flags

Returns
File flags as number

◆ getGuidStream()

const GuidStream * retdec::fileformat::PeFormat::getGuidStream ( ) const

◆ getImageBaseAddress()

bool retdec::fileformat::PeFormat::getImageBaseAddress ( unsigned long long &  imageBase) const
overridevirtual

Get image base address of file

Parameters
imageBaseInto this parameter the resulting number is stored
Returns
true if file has image base address and this address was successfully detected, false otherwise

If file has no image base, imageBase is left unchanged

Implements retdec::fileformat::FileFormat.

◆ getImageBitability()

std::size_t retdec::fileformat::PeFormat::getImageBitability ( ) const

Get image bitability

Returns
32=32-bit image, 64=64-bit image

In some cases (e.g. FSG packer), offset of PE signature may be inside MZ header and therefore this method may return lesser number that method getMzHeaderSize().

◆ getImageLoader()

const PeLib::ImageLoader & retdec::fileformat::PeFormat::getImageLoader ( ) const

◆ getImportedDotnetClasses()

const std::vector< std::shared_ptr< DotnetClass > > & retdec::fileformat::PeFormat::getImportedDotnetClasses ( ) const

◆ getMachineCode()

bool retdec::fileformat::PeFormat::getMachineCode ( unsigned long long &  result) const
overridevirtual

Get file format-dependent number representing code of target architecture of file

Parameters
resultParameter for store the result
Returns
true if method went OK, false otherwise

Implements retdec::fileformat::FileFormat.

◆ getMajorLinkerVersion()

std::size_t retdec::fileformat::PeFormat::getMajorLinkerVersion ( ) const

Get major version of used linker

Returns
Major version of used linker

◆ getMetadataHeader()

const MetadataHeader * retdec::fileformat::PeFormat::getMetadataHeader ( ) const

◆ getMetadataStream()

const MetadataStream * retdec::fileformat::PeFormat::getMetadataStream ( ) const

◆ getMinorLinkerVersion()

std::size_t retdec::fileformat::PeFormat::getMinorLinkerVersion ( ) const

Get minor version of used linker

Returns
Minor version of used linker

◆ getModuleVersionId()

const std::string & retdec::fileformat::PeFormat::getModuleVersionId ( ) const

◆ getMzHeaderSize()

std::size_t retdec::fileformat::PeFormat::getMzHeaderSize ( ) const

Get size of MZ header

Returns
Size of MZ header

◆ getNumberOfBaseRelocationBlocks()

bool retdec::fileformat::PeFormat::getNumberOfBaseRelocationBlocks ( unsigned long long &  relocs) const

Get number of base relocation blocks

Parameters
relocsInto this parameter the number of blocks is stored
Returns
true if number of blocks is successfully detected, false otherwise

If function returns false, relocs is left unchanged

◆ getNumberOfCoffSymbols()

std::size_t retdec::fileformat::PeFormat::getNumberOfCoffSymbols ( ) const

Get number of symbols in COFF symbol table

Returns
Number of symbols in COFF symbol table

◆ getNumberOfDataDirectories()

std::size_t retdec::fileformat::PeFormat::getNumberOfDataDirectories ( ) const

Get number of data-directory entries in input file

Returns
Number of data-directory entries in input file

◆ getNumberOfRelocations()

bool retdec::fileformat::PeFormat::getNumberOfRelocations ( unsigned long long &  relocs) const

Get number of relocations

Parameters
relocsInto this parameter the number of relocations is stored
Returns
true if number of relocations is successfully detected, false otherwise

If function returns false, relocs is left unchanged

◆ getOptionalHeaderSize()

std::size_t retdec::fileformat::PeFormat::getOptionalHeaderSize ( ) const

Get size of optional header

Returns
Size of optional header

◆ getPeHeaderOffset()

std::size_t retdec::fileformat::PeFormat::getPeHeaderOffset ( ) const

Get offset of PE signature

Returns
Offset of PE signature

In some cases (e.g. FSG packer), offset of PE signature may be inside MZ header and therefore this method may return lesser number that method getMzHeaderSize().

◆ getPeSection() [1/2]

const PeCoffSection * retdec::fileformat::PeFormat::getPeSection ( const std::string &  secName) const

Get information about section with name secName

Parameters
secNameName of section
Returns
Pointer to section or nullptr if section was not found

If file has more sections with name equal to secName, then is returned first such section.

◆ getPeSection() [2/2]

const PeCoffSection * retdec::fileformat::PeFormat::getPeSection ( unsigned long long  secIndex) const

Get information about section with index secIndex

Parameters
secIndexIndex of section (indexed from 0)
Returns
Pointer to section or nullptr if section was not detected

◆ getResourceNodes()

bool retdec::fileformat::PeFormat::getResourceNodes ( std::vector< const PeLib::ResourceChild * > &  nodes,
std::vector< std::size_t > &  levels 
)
private

Get nodes of resource tree except root

Parameters
nodesInto this parameter nodes are stored (except root node)
levelsInto this parameter is stored number of nodes in each level of tree (except root level)
Returns
true if nodes was successfully loaded, false otherwise

◆ getRichHeaderOffset()

std::size_t retdec::fileformat::PeFormat::getRichHeaderOffset ( const std::string &  plainFile)
private

Calculate offset of rich header

Parameters
plainFileContent of input file from space after MZ header to offset of PE signature

Method returns default value (0x80) if detection of offset fails or rich header is not present in input file.

◆ getSectionAlignment()

std::size_t retdec::fileformat::PeFormat::getSectionAlignment ( ) const

Get section alignment

Returns
Section alignment

◆ getSectionTableEntrySize()

std::size_t retdec::fileformat::PeFormat::getSectionTableEntrySize ( ) const
overridevirtual

Get size of one record in section table or zero if section table does not exist

Returns
Size of one record in section table

Implements retdec::fileformat::FileFormat.

◆ getSectionTableOffset()

std::size_t retdec::fileformat::PeFormat::getSectionTableOffset ( ) const
overridevirtual

Get section table offset or zero if section table does not exist

Returns
Section table offset

Implements retdec::fileformat::FileFormat.

◆ getSegmentTableEntrySize()

std::size_t retdec::fileformat::PeFormat::getSegmentTableEntrySize ( ) const
overridevirtual

Get size of one record in segment table or zero if segment table does not exist

Returns
Size of one record in segment table

Implements retdec::fileformat::FileFormat.

◆ getSegmentTableOffset()

std::size_t retdec::fileformat::PeFormat::getSegmentTableOffset ( ) const
overridevirtual

Get segment table offset or zero if segment table does not exist

Returns
Segment table offset

Implements retdec::fileformat::FileFormat.

◆ getSizeOfHeaders()

std::size_t retdec::fileformat::PeFormat::getSizeOfHeaders ( ) const

Get size of headers

Returns
Size of headers

◆ getSizeOfHeapCommit()

std::size_t retdec::fileformat::PeFormat::getSizeOfHeapCommit ( ) const

Get size of the local heap space to commit

Returns
Size of the local heap space to commit

◆ getSizeOfHeapReserve()

std::size_t retdec::fileformat::PeFormat::getSizeOfHeapReserve ( ) const

Get size of the local heap space to reserve

Returns
Size of the local heap space to reserve

◆ getSizeOfImage()

std::size_t retdec::fileformat::PeFormat::getSizeOfImage ( ) const

Get size of image

Returns
Size of image

◆ getSizeOfStackCommit()

std::size_t retdec::fileformat::PeFormat::getSizeOfStackCommit ( ) const

Get size of the stack to commit

Returns
Size of the stack to commit

◆ getSizeOfStackReserve()

std::size_t retdec::fileformat::PeFormat::getSizeOfStackReserve ( ) const

Get size of the stack to reserve

Returns
Size of the stack to reserve

◆ getSizeOfStringTable()

std::size_t retdec::fileformat::PeFormat::getSizeOfStringTable ( ) const

Get size in bytes of string table

Returns
Size in bytes of string table

◆ getStringStream()

const StringStream * retdec::fileformat::PeFormat::getStringStream ( ) const

◆ getTargetArchitecture()

Architecture retdec::fileformat::PeFormat::getTargetArchitecture ( ) const
overridevirtual

Get target architecture

Returns
Target architecture of input file
Return values
Architecture::UNKNOWNArchitecture is unknown

Implements retdec::fileformat::FileFormat.

◆ getTimeStamp()

std::size_t retdec::fileformat::PeFormat::getTimeStamp ( ) const

Get time stamp

Returns
File time stamp

◆ getTypeLibId()

const std::string & retdec::fileformat::PeFormat::getTypeLibId ( ) const

◆ getTypeRefhashCrc32()

const std::string & retdec::fileformat::PeFormat::getTypeRefhashCrc32 ( ) const

◆ getTypeRefhashMd5()

const std::string & retdec::fileformat::PeFormat::getTypeRefhashMd5 ( ) const

◆ getTypeRefhashSha256()

const std::string & retdec::fileformat::PeFormat::getTypeRefhashSha256 ( ) const

◆ getUserStringStream()

const UserStringStream * retdec::fileformat::PeFormat::getUserStringStream ( ) const

◆ getVisualBasicInfo()

const VisualBasicInfo * retdec::fileformat::PeFormat::getVisualBasicInfo ( ) const

◆ hasMixedEndianForDouble()

bool retdec::fileformat::PeFormat::hasMixedEndianForDouble ( ) const
overridevirtual

◆ initDllList()

bool retdec::fileformat::PeFormat::initDllList ( const std::string &  dllListFile)

◆ initLoaderErrorInfo() [1/2]

void retdec::fileformat::PeFormat::initLoaderErrorInfo ( )
private

◆ initLoaderErrorInfo() [2/2]

void retdec::fileformat::PeFormat::initLoaderErrorInfo ( PeLib::LoaderError  ldrError)
private

Init information from PE loader

◆ initSectionTableHashOffsets()

std::size_t retdec::fileformat::PeFormat::initSectionTableHashOffsets ( )
overrideprivatevirtual

Init offsets for calculation of section table hashes

Returns
Number of offsets in offsets vector after initialization

Implements retdec::fileformat::FileFormat.

◆ initStructures()

void retdec::fileformat::PeFormat::initStructures ( const std::string &  dllListFile)
private

Init internal structures

◆ isDll()

bool retdec::fileformat::PeFormat::isDll ( ) const
overridevirtual
Returns
true if file id dynamic linked library, false otherwise

Implements retdec::fileformat::FileFormat.

◆ isDotNet()

bool retdec::fileformat::PeFormat::isDotNet ( ) const

Check if input file contains CIL/.NET code

Returns
true if input file contains CIL/.NET code, false otherwise

◆ isExecutable()

bool retdec::fileformat::PeFormat::isExecutable ( ) const
overridevirtual
Returns
true if input file is executable file, false otherwise

Implements retdec::fileformat::FileFormat.

◆ isMissingDependency()

bool retdec::fileformat::PeFormat::isMissingDependency ( std::string  dllname) const

◆ isObjectFile()

bool retdec::fileformat::PeFormat::isObjectFile ( ) const
overridevirtual
Returns
true if file is object file, false otherwise

Implements retdec::fileformat::FileFormat.

◆ isPackedDotNet()

bool retdec::fileformat::PeFormat::isPackedDotNet ( ) const

Check if input file contains packed CIL/.NET code

Returns
true if input file contains packed CIL/.NET code, false otherwise

◆ isVisualBasic()

bool retdec::fileformat::PeFormat::isVisualBasic ( unsigned long long &  version) const

Check if input file original language is Visual Basic

Parameters
versionInto this parameter is stored version of Visual Basic, or 0 if version was not detected
Returns
true if input file original language is Visual Basic, false otherwise

◆ loadCertificates()

void retdec::fileformat::PeFormat::loadCertificates ( )
private

Load certificates.

◆ loadDotnetHeaders()

void retdec::fileformat::PeFormat::loadDotnetHeaders ( )
private

Load .NET headers.

◆ loadExports()

void retdec::fileformat::PeFormat::loadExports ( )
private

Load informations about exports

◆ loadImports()

void retdec::fileformat::PeFormat::loadImports ( )
private

Load information about imports

◆ loadPdbInfo()

void retdec::fileformat::PeFormat::loadPdbInfo ( )
private

Load information about related PDB file

◆ loadResourceNodes()

void retdec::fileformat::PeFormat::loadResourceNodes ( std::vector< const PeLib::ResourceChild * > &  nodes,
const std::vector< std::size_t > &  levels 
)
private

Load only resource nodes

Parameters
nodesNodes of tree (except root node)
levelsNumber of nodes in each level of tree (except root level)

◆ loadResources()

void retdec::fileformat::PeFormat::loadResources ( )
private

Load resources

◆ loadRichHeader()

void retdec::fileformat::PeFormat::loadRichHeader ( )
private

Load Rich header

◆ loadSections()

void retdec::fileformat::PeFormat::loadSections ( )
private

Load information about sections

◆ loadSymbols()

void retdec::fileformat::PeFormat::loadSymbols ( )
private

Load information about symbols

Instance method loadSections() must be invoked before invocation of this method

◆ loadTlsInformation()

void retdec::fileformat::PeFormat::loadTlsInformation ( )
private

Load thread-local storage information

◆ loadVisualBasicHeader()

void retdec::fileformat::PeFormat::loadVisualBasicHeader ( )
private

Load visual basic header

◆ parseBlobStream()

void retdec::fileformat::PeFormat::parseBlobStream ( std::uint64_t  baseAddress,
std::uint64_t  offset,
std::uint64_t  size 
)
private

Parses .NET blob stream.

Parameters
baseAddressBase address of .NET metadata header.
offsetOffset of blob stream.
sizeSize of stream.

◆ parseGuidStream()

void retdec::fileformat::PeFormat::parseGuidStream ( std::uint64_t  baseAddress,
std::uint64_t  offset,
std::uint64_t  size 
)
private

Parses .NET GUID stream.

Parameters
baseAddressBase address of .NET metadata header.
offsetOffset of GUID stream.
sizeSize of stream.

◆ parseMetadataStream()

void retdec::fileformat::PeFormat::parseMetadataStream ( std::uint64_t  baseAddress,
std::uint64_t  offset,
std::uint64_t  size 
)
private

Parses .NET metadata stream.

Parameters
baseAddressBase address of .NET metadata header.
offsetOffset of metadata stream.
sizeSize of stream.

◆ parseMetadataTable()

template<typename T >
void retdec::fileformat::PeFormat::parseMetadataTable ( BaseMetadataTable table,
std::uint64_t &  address 
)
private

Parses single metadata table from metadata stream.

Parameters
tableTable where to insert data.
addressAddress of table data.

◆ parseStringStream()

void retdec::fileformat::PeFormat::parseStringStream ( std::uint64_t  baseAddress,
std::uint64_t  offset,
std::uint64_t  size 
)
private

Parses .NET string stream.

Parameters
baseAddressBase address of .NET metadata header.
offsetOffset of string stream.
sizeSize of stream.

◆ parseUserStringStream()

void retdec::fileformat::PeFormat::parseUserStringStream ( std::uint64_t  baseAddress,
std::uint64_t  offset,
std::uint64_t  size 
)
private

Parses .NET user string stream.

Parameters
baseAddressBase address of .NET metadata header.
offsetOffset of user string stream.
sizeSize of stream.

◆ parseVisualBasicComRegistrationData()

bool retdec::fileformat::PeFormat::parseVisualBasicComRegistrationData ( std::size_t  structureOffset)
private

Parse visual basic COM registration data

Parameters
structureOffsetOffset in file where the structure starts
Returns
true if COM registration data was successfuly parsed, false otherwise

◆ parseVisualBasicComRegistrationInfo()

bool retdec::fileformat::PeFormat::parseVisualBasicComRegistrationInfo ( std::size_t  structureOffset,
std::size_t  comRegDataOffset 
)
private

Parse visual basic COM registration info

Parameters
structureOffsetOffset in file where the structure starts
comRegDataOffsetOffset in file where the com registration data structure starts
Returns
true if COM registration info was successfuly parsed, false otherwise

◆ parseVisualBasicExternTable()

bool retdec::fileformat::PeFormat::parseVisualBasicExternTable ( std::size_t  structureOffset,
std::size_t  nEntries 
)
private

Parse visual basic extern table

Parameters
structureOffsetOffset in file where the structure starts
nEntriesNumber of entries in table
Returns
true if extern table was successfuly parsed, false otherwise

◆ parseVisualBasicObjects()

bool retdec::fileformat::PeFormat::parseVisualBasicObjects ( std::size_t  structureOffset,
std::size_t  nObjects 
)
private

Parse visual basic objects

Parameters
structureOffsetOffset in file where the public object descriptors array starts
nObjectsNumber of objects in array
Returns
true if objects were successfuly parsed, false otherwise

◆ parseVisualBasicObjectTable()

bool retdec::fileformat::PeFormat::parseVisualBasicObjectTable ( std::size_t  structureOffset)
private

Parse visual basic object table

Parameters
structureOffsetOffset in file where the structure starts
Returns
true if object table was successfuly parsed, false otherwise

◆ parseVisualBasicProjectInfo()

bool retdec::fileformat::PeFormat::parseVisualBasicProjectInfo ( std::size_t  structureOffset)
private

Parse visual basic project info

Parameters
structureOffsetOffset in file where the structure starts
Returns
true if project info was successfuly parsed, false otherwise

◆ scanForAnomalies()

void retdec::fileformat::PeFormat::scanForAnomalies ( )

Scan for file format anomalies

◆ scanForExportAnomalies()

void retdec::fileformat::PeFormat::scanForExportAnomalies ( )
private

Scan for export anomalies

◆ scanForImportAnomalies()

void retdec::fileformat::PeFormat::scanForImportAnomalies ( )
private

Scan for import anomalies

◆ scanForOptHeaderAnomalies()

void retdec::fileformat::PeFormat::scanForOptHeaderAnomalies ( )
private

Scan for optional header anomalies

◆ scanForResourceAnomalies()

void retdec::fileformat::PeFormat::scanForResourceAnomalies ( )
private

Scan for section anomalies

◆ scanForSectionAnomalies()

void retdec::fileformat::PeFormat::scanForSectionAnomalies ( unsigned  anamaliesLimit = 1000)
private

Scan for section anomalies

Member Data Documentation

◆ blobStream

std::unique_ptr<BlobStream> retdec::fileformat::PeFormat::blobStream
private

.NET blob stream

◆ clrHeader

std::unique_ptr<CLRHeader> retdec::fileformat::PeFormat::clrHeader
private

.NET CLR header

◆ definedClasses

std::vector<std::shared_ptr<DotnetClass> > retdec::fileformat::PeFormat::definedClasses
private

.NET defined class list

◆ dllList

std::unordered_set<std::string> retdec::fileformat::PeFormat::dllList
private

Override set of DLLs for checking dependency missing.

◆ errorLoadingDllList

bool retdec::fileformat::PeFormat::errorLoadingDllList
private

If true, then an error happened while loading DLL list.

◆ file

PeLib::PeFileT* retdec::fileformat::PeFormat::file
protected

PeLib representation of PE file.

◆ formatParser

PeFormatParser* retdec::fileformat::PeFormat::formatParser
private

parser of PE file

◆ guidStream

std::unique_ptr<GuidStream> retdec::fileformat::PeFormat::guidStream
private

.NET GUID stream

◆ importedClasses

std::vector<std::shared_ptr<DotnetClass> > retdec::fileformat::PeFormat::importedClasses
private

.NET imported class list

◆ metadataHeader

std::unique_ptr<MetadataHeader> retdec::fileformat::PeFormat::metadataHeader
private

.NET metadata header

◆ metadataStream

std::unique_ptr<MetadataStream> retdec::fileformat::PeFormat::metadataStream
private

.NET metadata stream

◆ moduleVersionId

std::string retdec::fileformat::PeFormat::moduleVersionId
private

.NET module version ID

◆ stringStream

std::unique_ptr<StringStream> retdec::fileformat::PeFormat::stringStream
private

.NET string stream

◆ typeLibId

std::string retdec::fileformat::PeFormat::typeLibId
private

.NET type lib ID

◆ typeRefHashCrc32

std::string retdec::fileformat::PeFormat::typeRefHashCrc32
private

.NET typeref table hash as CRC32

◆ typeRefHashMd5

std::string retdec::fileformat::PeFormat::typeRefHashMd5
private

.NET typeref table hash as MD5

◆ typeRefHashSha256

std::string retdec::fileformat::PeFormat::typeRefHashSha256
private

.NET typeref table hash as SHA256

◆ userStringStream

std::unique_ptr<UserStringStream> retdec::fileformat::PeFormat::userStringStream
private

.NET user string stream

◆ visualBasicInfo

VisualBasicInfo retdec::fileformat::PeFormat::visualBasicInfo
private

visual basic header information


The documentation for this class was generated from the following files: