retdec
pe_format.h
Go to the documentation of this file.
1 
7 #ifndef RETDEC_FILEFORMAT_FILE_FORMAT_PE_PE_FORMAT_H
8 #define RETDEC_FILEFORMAT_FILE_FORMAT_PE_PE_FORMAT_H
9 
19 #include "retdec/pelib/PeFile.h"
20 
21 namespace retdec {
22 namespace fileformat {
23 
27 class PeFormat : public FileFormat
28 {
29  private:
31  std::unique_ptr<CLRHeader> clrHeader;
32  std::unique_ptr<MetadataHeader> metadataHeader;
33  std::unique_ptr<MetadataStream> metadataStream;
34  std::unique_ptr<BlobStream> blobStream;
35  std::unique_ptr<GuidStream> guidStream;
36  std::unique_ptr<StringStream> stringStream;
37  std::unique_ptr<UserStringStream> userStringStream;
38  std::string moduleVersionId;
39  std::string typeLibId;
40  std::vector<std::shared_ptr<DotnetClass>> definedClasses;
41  std::vector<std::shared_ptr<DotnetClass>> importedClasses;
42  std::string typeRefHashCrc32;
43  std::string typeRefHashMd5;
44  std::string typeRefHashSha256;
46 
47  std::unordered_set<std::string> dllList;
49 
53  void initLoaderErrorInfo();
54  void initStructures(const std::string & dllListFile);
56 
59  virtual std::size_t initSectionTableHashOffsets() override;
61 
64  std::size_t getRichHeaderOffset(const std::string &plainFile);
65  bool getResourceNodes(std::vector<const PeLib::ResourceChild*> &nodes, std::vector<std::size_t> &levels);
66  void loadRichHeader();
67  void loadSections();
68  void loadSymbols();
69  void loadImports();
70  void loadExports();
71  void loadVisualBasicHeader();
72  void loadPdbInfo();
73  void loadResourceNodes(std::vector<const PeLib::ResourceChild*> &nodes, const std::vector<std::size_t> &levels);
74  void loadResources();
75  void loadCertificates();
76  void loadTlsInformation();
77  static bool checkDefaultList(std::string_view);
79 
82  void loadDotnetHeaders();
83  void parseMetadataStream(std::uint64_t baseAddress, std::uint64_t offset, std::uint64_t size);
84  void parseBlobStream(std::uint64_t baseAddress, std::uint64_t offset, std::uint64_t size);
85  void parseGuidStream(std::uint64_t baseAddress, std::uint64_t offset, std::uint64_t size);
86  void parseStringStream(std::uint64_t baseAddress, std::uint64_t offset, std::uint64_t size);
87  void parseUserStringStream(std::uint64_t baseAddress, std::uint64_t offset, std::uint64_t size);
88  template <typename T> void parseMetadataTable(BaseMetadataTable* table, std::uint64_t& address);
89  void detectModuleVersionId();
90  void detectTypeLibId();
91  void detectDotnetTypes();
92  std::uint64_t detectPossibleMetadataHeaderAddress() const;
93  void computeTypeRefHashes();
97  bool parseVisualBasicProjectInfo(std::size_t structureOffset);
98  bool parseVisualBasicExternTable(std::size_t structureOffset, std::size_t nEntries);
99  bool parseVisualBasicObjectTable(std::size_t structureOffset);
100  bool parseVisualBasicObjects(std::size_t structureOffset, std::size_t nObjects);
101  bool parseVisualBasicComRegistrationData(std::size_t structureOffset);
102  bool parseVisualBasicComRegistrationInfo(std::size_t structureOffset,
103  std::size_t comRegDataOffset);
107  void scanForSectionAnomalies(unsigned anamaliesLimit = 1000);
109  void scanForImportAnomalies();
110  void scanForExportAnomalies();
113  protected:
115  public:
116  PeFormat(const std::string & pathToFile, const std::string & dllListFile, LoadFlags loadFlags = LoadFlags::NONE);
117  PeFormat(std::istream &inputStream, LoadFlags loadFlags = LoadFlags::NONE);
118  PeFormat(const std::uint8_t *data, std::size_t size, LoadFlags loadFlags = LoadFlags::NONE);
119  virtual ~PeFormat() override;
120 
123  virtual retdec::utils::Endianness getEndianness() const override;
124  virtual std::size_t getBytesPerWord() const override;
125  virtual bool hasMixedEndianForDouble() const override;
127 
130  virtual std::size_t getDeclaredFileLength() const override;
131  virtual bool areSectionsValid() const override;
132  virtual bool isObjectFile() const override;
133  virtual bool isDll() const override;
134  virtual bool isExecutable() const override;
135  virtual bool getMachineCode(unsigned long long &result) const override;
136  virtual bool getAbiVersion(unsigned long long &result) const override;
137  virtual bool getImageBaseAddress(unsigned long long &imageBase) const override;
138  virtual bool getEpAddress(unsigned long long &result) const override;
139  virtual bool getEpOffset(unsigned long long &epOffset) const override;
140  virtual Architecture getTargetArchitecture() const override;
141  virtual std::size_t getDeclaredNumberOfSections() const override;
142  virtual std::size_t getDeclaredNumberOfSegments() const override;
143  virtual std::size_t getSectionTableOffset() const override;
144  virtual std::size_t getSectionTableEntrySize() const override;
145  virtual std::size_t getSegmentTableOffset() const override;
146  virtual std::size_t getSegmentTableEntrySize() const override;
148 
151  const PeLib::ImageLoader & getImageLoader() const;
152  std::size_t getMzHeaderSize() const;
153  std::size_t getOptionalHeaderSize() const;
154  std::size_t getPeHeaderOffset() const;
155  std::size_t getImageBitability() const;
156  std::size_t getCoffSymbolTableOffset() const;
157  std::size_t getNumberOfCoffSymbols() const;
158  std::size_t getSizeOfStringTable() const;
159  std::size_t getMajorLinkerVersion() const;
160  std::size_t getMinorLinkerVersion() const;
161  std::size_t getFileFlags() const;
162  std::size_t getTimeStamp() const;
163  std::size_t getChecksum() const;
164  std::size_t getFileAlignment() const;
165  std::size_t getSectionAlignment() const;
166  std::size_t getSizeOfHeaders() const;
167  std::size_t getSizeOfImage() const;
168  std::size_t getSizeOfStackReserve() const;
169  std::size_t getSizeOfStackCommit() const;
170  std::size_t getSizeOfHeapReserve() const;
171  std::size_t getSizeOfHeapCommit() const;
172  std::size_t getNumberOfDataDirectories() const;
173  std::size_t getDeclaredNumberOfDataDirectories() const;
174 
177  bool isMissingDependency(std::string dllname) const;
178  bool dllListFailedToLoad() const;
179  bool initDllList(const std::string & dllListFile);
181 
182  bool isDotNet() const;
183  bool isPackedDotNet() const;
184  bool isVisualBasic(unsigned long long &version) const;
185  bool getDllFlags(unsigned long long &dllFlags) const;
186  bool getNumberOfBaseRelocationBlocks(unsigned long long &relocs) const;
187  bool getNumberOfRelocations(unsigned long long &relocs) const;
188  bool getDataDirectoryRelative(unsigned long long index, unsigned long long &relAddr, unsigned long long &size) const;
189  bool getDataDirectoryAbsolute(unsigned long long index, unsigned long long &absAddr, unsigned long long &size) const;
190  const PeCoffSection* getPeSection(const std::string &secName) const;
191  const PeCoffSection* getPeSection(unsigned long long secIndex) const;
192  const CLRHeader* getCLRHeader() const;
193  const MetadataHeader* getMetadataHeader() const;
194  const MetadataStream* getMetadataStream() const;
195  const StringStream* getStringStream() const;
196  const BlobStream* getBlobStream() const;
197  const GuidStream* getGuidStream() const;
198  const UserStringStream* getUserStringStream() const;
199  const std::string& getModuleVersionId() const;
200  const std::string& getTypeLibId() const;
201  const std::vector<std::shared_ptr<DotnetClass>>& getDefinedDotnetClasses() const;
202  const std::vector<std::shared_ptr<DotnetClass>>& getImportedDotnetClasses() const;
203  const std::string& getTypeRefhashCrc32() const;
204  const std::string& getTypeRefhashMd5() const;
205  const std::string& getTypeRefhashSha256() const;
206  const VisualBasicInfo* getVisualBasicInfo() const;
207  std::vector<std::tuple<const std::uint8_t*, std::size_t>> getDigestRanges() const;
208 
211  void scanForAnomalies();
213 };
214 
215 } // namespace fileformat
216 } // namespace retdec
217 
218 #endif
Class for #Blob Stream.
Definition: ImageLoader.h:138
Definition: PeFile.h:109
Definition: metadata_table.h:68
Definition: blob_stream.h:18
Definition: clr_header.h:19
Definition: file_format.h:45
LoadFlags loadFlags
load flags for configurable file loading
Definition: file_format.h:51
Definition: guid_stream.h:19
Definition: metadata_header.h:21
Definition: metadata_stream.h:21
Definition: pe_coff_section.h:19
Definition: pe_format_parser.h:22
Definition: pe_format.h:28
virtual bool hasMixedEndianForDouble() const override
Definition: pe_format.cpp:3175
std::uint64_t detectPossibleMetadataHeaderAddress() const
Definition: pe_format.cpp:2905
const std::string & getModuleVersionId() const
Definition: pe_format.cpp:3781
std::size_t getNumberOfCoffSymbols() const
Definition: pe_format.cpp:3390
bool getNumberOfRelocations(unsigned long long &relocs) const
Definition: pe_format.cpp:3679
const std::string & getTypeRefhashMd5() const
Definition: pe_format.cpp:3806
const std::string & getTypeRefhashSha256() const
Definition: pe_format.cpp:3811
std::vector< std::shared_ptr< DotnetClass > > importedClasses
.NET imported class list
Definition: pe_format.h:41
void detectTypeLibId()
Definition: pe_format.cpp:2785
void detectDotnetTypes()
Definition: pe_format.cpp:2884
std::size_t getMinorLinkerVersion() const
Definition: pe_format.cpp:3417
virtual bool isDll() const override
Definition: pe_format.cpp:3206
const std::vector< std::shared_ptr< DotnetClass > > & getDefinedDotnetClasses() const
Definition: pe_format.cpp:3791
void loadRichHeader()
Definition: pe_format.cpp:1025
virtual std::size_t getDeclaredNumberOfSections() const override
Definition: pe_format.cpp:3293
void parseGuidStream(std::uint64_t baseAddress, std::uint64_t offset, std::uint64_t size)
Definition: pe_format.cpp:2684
std::size_t getMzHeaderSize() const
Definition: pe_format.cpp:3338
virtual bool isObjectFile() const override
Definition: pe_format.cpp:3201
std::size_t getSizeOfHeapCommit() const
Definition: pe_format.cpp:3516
std::size_t getSizeOfHeaders() const
Definition: pe_format.cpp:3462
const PeCoffSection * getPeSection(const std::string &secName) const
Definition: pe_format.cpp:3731
virtual std::size_t getDeclaredFileLength() const override
Definition: pe_format.cpp:3184
std::size_t getTimeStamp() const
Definition: pe_format.cpp:3435
std::size_t getChecksum() const
Definition: pe_format.cpp:3480
const BlobStream * getBlobStream() const
Definition: pe_format.cpp:3766
std::string moduleVersionId
.NET module version ID
Definition: pe_format.h:38
std::vector< std::tuple< const std::uint8_t *, std::size_t > > getDigestRanges() const
Definition: pe_format.cpp:2364
std::size_t getSizeOfStringTable() const
Definition: pe_format.cpp:3399
std::size_t getImageBitability() const
Definition: pe_format.cpp:3371
const std::vector< std::shared_ptr< DotnetClass > > & getImportedDotnetClasses() const
Definition: pe_format.cpp:3796
const MetadataHeader * getMetadataHeader() const
Definition: pe_format.cpp:3751
std::size_t getPeHeaderOffset() const
Definition: pe_format.cpp:3359
virtual std::size_t getDeclaredNumberOfSegments() const override
Definition: pe_format.cpp:3298
virtual bool getEpOffset(unsigned long long &epOffset) const override
Definition: pe_format.cpp:3248
std::size_t getSizeOfStackReserve() const
Definition: pe_format.cpp:3489
void initStructures(const std::string &dllListFile)
Definition: pe_format.cpp:866
virtual std::size_t getSectionTableOffset() const override
Definition: pe_format.cpp:3303
std::size_t getFileAlignment() const
Definition: pe_format.cpp:3444
bool isMissingDependency(std::string dllname) const
Definition: pe_format.cpp:3539
const StringStream * getStringStream() const
Definition: pe_format.cpp:3761
void parseUserStringStream(std::uint64_t baseAddress, std::uint64_t offset, std::uint64_t size)
Definition: pe_format.cpp:2731
void loadResourceNodes(std::vector< const PeLib::ResourceChild * > &nodes, const std::vector< std::size_t > &levels)
Definition: pe_format.cpp:1885
std::string typeRefHashCrc32
.NET typeref table hash as CRC32
Definition: pe_format.h:42
const std::string & getTypeLibId() const
Definition: pe_format.cpp:3786
void loadResources()
Definition: pe_format.cpp:1925
void detectModuleVersionId()
Definition: pe_format.cpp:2763
virtual bool areSectionsValid() const override
Definition: pe_format.cpp:3196
void loadPdbInfo()
Definition: pe_format.cpp:1804
void scanForOptHeaderAnomalies()
Definition: pe_format.cpp:4123
void loadImports()
Definition: pe_format.cpp:1728
bool isDotNet() const
Definition: pe_format.cpp:3599
virtual std::size_t initSectionTableHashOffsets() override
Definition: pe_format.cpp:926
bool initDllList(const std::string &dllListFile)
Definition: pe_format.cpp:3567
std::size_t getCoffSymbolTableOffset() const
Definition: pe_format.cpp:3381
std::vector< std::shared_ptr< DotnetClass > > definedClasses
.NET defined class list
Definition: pe_format.h:40
std::size_t getSectionAlignment() const
Definition: pe_format.cpp:3453
bool getDllFlags(unsigned long long &dllFlags) const
Definition: pe_format.cpp:3648
const VisualBasicInfo * getVisualBasicInfo() const
Definition: pe_format.cpp:3816
void loadSections()
Definition: pe_format.cpp:1659
bool getResourceNodes(std::vector< const PeLib::ResourceChild * > &nodes, std::vector< std::size_t > &levels)
Definition: pe_format.cpp:975
bool parseVisualBasicExternTable(std::size_t structureOffset, std::size_t nEntries)
Definition: pe_format.cpp:1429
PeLib::PeFileT * file
PeLib representation of PE file.
Definition: pe_format.h:114
const UserStringStream * getUserStringStream() const
Definition: pe_format.cpp:3776
VisualBasicInfo visualBasicInfo
visual basic header information
Definition: pe_format.h:45
std::unique_ptr< BlobStream > blobStream
.NET blob stream
Definition: pe_format.h:34
void initLoaderErrorInfo()
Definition: pe_format.cpp:858
virtual bool getAbiVersion(unsigned long long &result) const override
Definition: pe_format.cpp:3222
const PeLib::ImageLoader & getImageLoader() const
Definition: pe_format.cpp:3329
std::string typeRefHashSha256
.NET typeref table hash as SHA256
Definition: pe_format.h:44
void parseStringStream(std::uint64_t baseAddress, std::uint64_t offset, std::uint64_t size)
Definition: pe_format.cpp:2702
std::unique_ptr< UserStringStream > userStringStream
.NET user string stream
Definition: pe_format.h:37
virtual std::size_t getSectionTableEntrySize() const override
Definition: pe_format.cpp:3314
void scanForSectionAnomalies(unsigned anamaliesLimit=1000)
Definition: pe_format.cpp:3836
bool parseVisualBasicObjects(std::size_t structureOffset, std::size_t nObjects)
Definition: pe_format.cpp:1571
std::string typeRefHashMd5
.NET typeref table hash as MD5
Definition: pe_format.h:43
virtual std::size_t getSegmentTableOffset() const override
Definition: pe_format.cpp:3319
void loadVisualBasicHeader()
Definition: pe_format.cpp:1122
bool dllListFailedToLoad() const
Definition: pe_format.cpp:3562
PeFormat(const std::string &pathToFile, const std::string &dllListFile, LoadFlags loadFlags=LoadFlags::NONE)
Definition: pe_format.cpp:805
void loadTlsInformation()
Definition: pe_format.cpp:2237
void computeTypeRefHashes()
Definition: pe_format.cpp:2958
bool getDataDirectoryAbsolute(unsigned long long index, unsigned long long &absAddr, unsigned long long &size) const
Definition: pe_format.cpp:3719
const std::string & getTypeRefhashCrc32() const
Definition: pe_format.cpp:3801
static bool checkDefaultList(std::string_view)
Definition: pe_dll_list.cpp:4113
std::unique_ptr< MetadataStream > metadataStream
.NET metadata stream
Definition: pe_format.h:33
void parseBlobStream(std::uint64_t baseAddress, std::uint64_t offset, std::uint64_t size)
Definition: pe_format.cpp:2625
virtual bool isExecutable() const override
Definition: pe_format.cpp:3211
std::size_t getNumberOfDataDirectories() const
Definition: pe_format.cpp:3525
std::unique_ptr< CLRHeader > clrHeader
.NET CLR header
Definition: pe_format.h:31
std::unique_ptr< GuidStream > guidStream
.NET GUID stream
Definition: pe_format.h:35
virtual Architecture getTargetArchitecture() const override
Definition: pe_format.cpp:3261
std::unique_ptr< MetadataHeader > metadataHeader
.NET metadata header
Definition: pe_format.h:32
bool getDataDirectoryRelative(unsigned long long index, unsigned long long &relAddr, unsigned long long &size) const
Definition: pe_format.cpp:3705
std::unordered_set< std::string > dllList
Override set of DLLs for checking dependency missing.
Definition: pe_format.h:47
void scanForResourceAnomalies()
Definition: pe_format.cpp:3998
bool parseVisualBasicObjectTable(std::size_t structureOffset)
Definition: pe_format.cpp:1508
virtual bool getMachineCode(unsigned long long &result) const override
Definition: pe_format.cpp:3216
void scanForExportAnomalies()
Definition: pe_format.cpp:4079
std::size_t getRichHeaderOffset(const std::string &plainFile)
Definition: pe_format.cpp:942
bool isVisualBasic(unsigned long long &version) const
Definition: pe_format.cpp:3626
void loadCertificates()
Definition: pe_format.cpp:2067
std::unique_ptr< StringStream > stringStream
.NET string stream
Definition: pe_format.h:36
void loadSymbols()
Definition: pe_format.cpp:1679
const GuidStream * getGuidStream() const
Definition: pe_format.cpp:3771
PeFormatParser * formatParser
parser of PE file
Definition: pe_format.h:30
bool getNumberOfBaseRelocationBlocks(unsigned long long &relocs) const
Definition: pe_format.cpp:3660
std::string typeLibId
.NET type lib ID
Definition: pe_format.h:39
const CLRHeader * getCLRHeader() const
Definition: pe_format.cpp:3746
virtual bool getImageBaseAddress(unsigned long long &imageBase) const override
Definition: pe_format.cpp:3229
std::size_t getSizeOfHeapReserve() const
Definition: pe_format.cpp:3507
std::size_t getSizeOfStackCommit() const
Definition: pe_format.cpp:3498
std::size_t getSizeOfImage() const
Definition: pe_format.cpp:3471
bool errorLoadingDllList
If true, then an error happened while loading DLL list.
Definition: pe_format.h:48
virtual std::size_t getSegmentTableEntrySize() const override
Definition: pe_format.cpp:3324
void loadExports()
Definition: pe_format.cpp:1776
void parseMetadataStream(std::uint64_t baseAddress, std::uint64_t offset, std::uint64_t size)
Definition: pe_format.cpp:2420
virtual retdec::utils::Endianness getEndianness() const override
Definition: pe_format.cpp:3096
virtual bool getEpAddress(unsigned long long &result) const override
Definition: pe_format.cpp:3235
std::size_t getDeclaredNumberOfDataDirectories() const
Definition: pe_format.cpp:3534
virtual std::size_t getBytesPerWord() const override
Definition: pe_format.cpp:3125
const MetadataStream * getMetadataStream() const
Definition: pe_format.cpp:3756
bool parseVisualBasicComRegistrationInfo(std::size_t structureOffset, std::size_t comRegDataOffset)
Definition: pe_format.cpp:1308
void loadDotnetHeaders()
Definition: pe_format.cpp:2261
bool parseVisualBasicProjectInfo(std::size_t structureOffset)
Definition: pe_format.cpp:1378
void parseMetadataTable(BaseMetadataTable *table, std::uint64_t &address)
Definition: pe_format.cpp:2742
void scanForAnomalies()
Definition: pe_format.cpp:3824
bool parseVisualBasicComRegistrationData(std::size_t structureOffset)
Definition: pe_format.cpp:1246
std::size_t getMajorLinkerVersion() const
Definition: pe_format.cpp:3408
void scanForImportAnomalies()
Definition: pe_format.cpp:4035
virtual ~PeFormat() override
Definition: pe_format.cpp:837
std::size_t getOptionalHeaderSize() const
Definition: pe_format.cpp:3347
bool isPackedDotNet() const
Definition: pe_format.cpp:3608
std::size_t getFileFlags() const
Definition: pe_format.cpp:3426
Definition: string_stream.h:18
Definition: user_string_stream.h:16
Definition: visual_basic_info.h:24
Class for .NET class.
Definition of FileFormat class.
Class for #GUID Stream.
Class for visual basic information.
Class for #~ Stream.
LoaderError
Definition: PeLibAux.h:47
LoadFlags
Definition: fftypes.h:69
@ NONE
Definition: fftypes.h:70
Architecture
Definition: fftypes.h:59
Endianness
Definition: byte_value_storage.h:21
Definition: archive_wrapper.h:19
Definition of PeFormatParser class.
Class for #Strings Stream.
Class for #US Stream.