retdec
Public Member Functions | List of all members
retdec::fileinfo::CoffWrapper Class Reference

#include <coff_wrapper.h>

Inheritance diagram for retdec::fileinfo::CoffWrapper:
Inheritance graph
[legend]
Collaboration diagram for retdec::fileinfo::CoffWrapper:
Collaboration graph
[legend]

Public Member Functions

 CoffWrapper (std::string pathToFile, retdec::fileformat::LoadFlags loadFlags)
 
Detection methods

{

const llvm::object::COFFObjectFile * getCoffParser () const
 
std::string getTypeOfFile () const
 
- Public Member Functions inherited from retdec::fileformat::CoffFormat
 CoffFormat (std::string pathToFile, LoadFlags loadFlags=LoadFlags::NONE)
 
 CoffFormat (std::istream &inputStream, LoadFlags loadFlags=LoadFlags::NONE)
 
 CoffFormat (const std::uint8_t *data, std::size_t size, LoadFlags loadFlags=LoadFlags::NONE)
 
virtual ~CoffFormat () override
 
virtual retdec::utils::Endianness getEndianness () const override
 
virtual std::size_t getBytesPerWord () const override
 
virtual bool hasMixedEndianForDouble () const override
 
virtual std::size_t getDeclaredFileLength () const override
 
virtual bool areSectionsValid () const override
 
virtual bool isObjectFile () const override
 
virtual bool isDll () const override
 
virtual bool isExecutable () const override
 
virtual bool getMachineCode (unsigned long long &result) const override
 
virtual bool getAbiVersion (unsigned long long &result) const override
 
virtual bool getImageBaseAddress (unsigned long long &imageBase) const override
 
virtual bool getEpAddress (unsigned long long &result) const override
 
virtual bool getEpOffset (unsigned long long &epOffset) const override
 
virtual Architecture getTargetArchitecture () const override
 
virtual std::size_t getDeclaredNumberOfSections () const override
 
virtual std::size_t getDeclaredNumberOfSegments () const override
 
virtual std::size_t getSectionTableOffset () const override
 
virtual std::size_t getSectionTableEntrySize () const override
 
virtual std::size_t getSegmentTableOffset () const override
 
virtual std::size_t getSegmentTableEntrySize () const override
 
std::size_t getCoffSymbolTableOffset () const
 
std::size_t getNumberOfCoffSymbols () const
 
std::size_t getSizeOfStringTable () const
 
std::size_t getFileFlags () const
 
std::size_t getTimeStamp () const
 
bool is32BitArchitecture () const
 
- Public Member Functions inherited from retdec::fileformat::FileFormat
 FileFormat (const std::string &pathToFile, LoadFlags loadFlags=LoadFlags::NONE)
 
 FileFormat (std::istream &inputStream, LoadFlags loadFlags=LoadFlags::NONE)
 
 FileFormat (const std::uint8_t *data, std::size_t size, LoadFlags loadFlags=LoadFlags::NONE)
 
virtual ~FileFormat ()
 
const LoaderErrorInfogetLoaderErrorInfo () const
 
void initArchitecture (Architecture arch, retdec::utils::Endianness endian=retdec::utils::Endianness::UNKNOWN, std::size_t bytesPerWord=4, retdec::common::Address entryPoint=retdec::common::Address::Undefined, retdec::common::Address sectionVMA=retdec::common::Address::Undefined)
 
void loadStrings ()
 
void loadStrings (StringType type, std::size_t charSize)
 
void loadStrings (StringType type, std::size_t charSize, const SecSeg *secSeg)
 
void loadImpHash ()
 
void loadExpHash ()
 
void loadResourceIconHash ()
 
bool isInValidState () const
 
LoadFlags getLoadFlags () const
 
const SectiongetSectionFromOffset (unsigned long long offset) const
 
const SegmentgetSegmentFromOffset (unsigned long long offset) const
 
const SecSeggetSectionOrSegmentFromOffset (unsigned long long offset) const
 
bool haveSectionOrSegmentOnOffset (unsigned long long offset) const
 
bool haveDataOnOffset (unsigned long long offset) const
 
const SectiongetSectionFromAddress (unsigned long long address) const
 
const SegmentgetSegmentFromAddress (unsigned long long address) const
 
const SecSeggetSectionOrSegmentFromAddress (unsigned long long address) const
 
bool haveSectionOrSegmentOnAddress (unsigned long long address) const
 
bool haveDataOnAddress (unsigned long long address) const
 
bool haveReadOnlyDataOnAddress (unsigned long long address) const
 Test if there are some read-only data on provided address – address belongs to some read-only section or segment. More...
 
virtual std::size_t getNibbleLength () const override
 
virtual std::size_t getByteLength () const override
 
virtual std::size_t getWordLength () const override
 
virtual std::size_t getNumberOfNibblesInByte () const override
 
bool isX86 () const
 
bool isX86_64 () const
 
bool isX86OrX86_64 () const
 
bool isArm () const
 
bool isPowerPc () const
 
bool isMips () const
 
bool isUnknownArch () const
 
bool isPe () const
 
bool isElf () const
 
bool isCoff () const
 
bool isMacho () const
 
bool isIntelHex () const
 
bool isRawData () const
 
bool isUnknownFormat () const
 
bool isWindowsDriver () const
 
bool hasCrc32 () const
 
bool hasMd5 () const
 
bool hasSha256 () const
 
bool hasSectionTableCrc32 () const
 
bool hasSectionTableMd5 () const
 
bool hasSectionTableSha256 () const
 
std::string getCrc32 () const
 
std::string getMd5 () const
 
std::string getSha256 () const
 
std::string getSectionTableCrc32 () const
 
std::string getSectionTableMd5 () const
 
std::string getSectionTableSha256 () const
 
std::string getPathToFile () const
 
Format getFileFormat () const
 
std::size_t getNumberOfSections () const
 
std::size_t getNumberOfSegments () const
 
std::size_t getNumberOfSymbolTables () const
 
std::size_t getNumberOfRelocationTables () const
 
std::size_t getNumberOfDynamicTables () const
 
std::size_t getFileLength () const
 
std::size_t getLoadedFileLength () const
 
std::size_t getOverlaySize () const
 
bool getOverlayEntropy (double &res) const
 
std::size_t nibblesFromBytes (std::size_t bytes) const
 
std::size_t bytesFromNibbles (std::size_t nibbles) const
 
std::size_t bytesFromNibblesRounded (std::size_t nibbles) const
 
bool getOffsetFromAddress (unsigned long long &result, unsigned long long address) const
 
bool getAddressFromOffset (unsigned long long &result, unsigned long long offset) const
 
bool getBytes (std::vector< std::uint8_t > &result, unsigned long long offset, unsigned long long numberOfBytes) const
 
bool getEpBytes (std::vector< std::uint8_t > &result, unsigned long long numberOfBytes) const
 
bool getHexBytes (std::string &result, unsigned long long offset, unsigned long long numberOfBytes) const
 
bool getHexEpBytes (std::string &result, unsigned long long numberOfBytes) const
 
bool getHexBytesFromEnd (std::string &result, unsigned long long numberOfBytes) const
 
bool getString (std::string &result, unsigned long long offset, unsigned long long numberOfBytes) const
 
bool getStringFromEnd (std::string &result, unsigned long long numberOfBytes) const
 
bool isObjectStretchedOverSections (std::size_t addr, std::size_t size) const
 
const SectiongetEpSection ()
 
const SectiongetSection (const std::string &secName) const
 
const SectiongetSection (unsigned long long secIndex) const
 
const SectiongetLastSection () const
 
const SectiongetLastButOneSection () const
 
const SegmentgetEpSegment ()
 
const SegmentgetSegment (const std::string &segName) const
 
const SegmentgetSegment (unsigned long long segIndex) const
 
const SegmentgetLastSegment () const
 
const SegmentgetLastButOneSegment () const
 
const SymbolTablegetSymbolTable (unsigned long long tabIndex) const
 
const RelocationTablegetRelocationTable (unsigned long long tabIndex) const
 
const DynamicTablegetDynamicTable (unsigned long long tabIndex) const
 
const ImportTablegetImportTable () const
 
const ExportTablegetExportTable () const
 
const ResourceTablegetResourceTable () const
 
const ResourceTreegetResourceTree () const
 
const RichHeadergetRichHeader () const
 
const PdbInfogetPdbInfo () const
 
const CertificateTablegetCertificateTable () const
 
const TlsInfogetTlsInfo () const
 
const ElfCoreInfogetElfCoreInfo () const
 
const SymbolgetSymbol (const std::string &name) const
 
const SymbolgetSymbol (unsigned long long address) const
 
const RelocationgetRelocation (const std::string &name) const
 
const RelocationgetRelocation (unsigned long long address) const
 
const ImportgetImport (const std::string &name) const
 
const ImportgetImport (unsigned long long address) const
 
const ExportgetExport (const std::string &name) const
 
const ExportgetExport (unsigned long long address) const
 
const ResourcegetManifestResource () const
 
const ResourcegetVersionResource () const
 
bool isSignaturePresent () const
 
bool isSignatureVerified () const
 
const retdec::common::RangeContainer< std::uint64_t > & getNonDecodableAddressRanges () const
 
const std::vector< Section * > & getSections () const
 
const std::vector< Section * > getSections (std::initializer_list< std::string > secs) const
 
const std::vector< Segment * > & getSegments () const
 
const std::vector< Segment * > getSegments (std::initializer_list< std::string > segs) const
 
const std::vector< SymbolTable * > & getSymbolTables () const
 
const std::vector< RelocationTable * > & getRelocationTables () const
 
const std::vector< DynamicTable * > & getDynamicTables () const
 
const std::vector< unsigned char > & getBytes () const
 
const std::vector< unsigned char > & getLoadedBytes () const
 
const unsigned char * getBytesData () const
 
const unsigned char * getLoadedBytesData () const
 
const std::vector< String > & getStrings () const
 
const std::vector< ElfNoteSecSeg > & getElfNoteSecSegs () const
 
const std::set< std::uint64_t > & getUnknownRelocations () const
 
const std::vector< std::pair< std::string, std::string > > & getAnomalies () const
 
virtual bool getXByte (std::uint64_t address, std::uint64_t x, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const override
 
virtual bool getXBytes (std::uint64_t address, std::uint64_t x, std::vector< std::uint8_t > &res) const override
 
virtual bool setXByte (std::uint64_t address, std::uint64_t x, std::uint64_t val, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) override
 
virtual bool setXBytes (std::uint64_t address, const std::vector< std::uint8_t > &val) override
 
bool isPointer (unsigned long long address, std::uint64_t *pointer=nullptr) const
 
bool get1ByteOffset (std::uint64_t offset, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const
 
bool get2ByteOffset (std::uint64_t offset, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const
 
bool get4ByteOffset (std::uint64_t offset, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const
 
bool get8ByteOffset (std::uint64_t offset, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const
 
bool get10ByteOffset (std::uint64_t offset, long double &res) const
 
bool getXByteOffset (std::uint64_t offset, std::uint64_t x, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const
 
bool getXBytesOffset (std::uint64_t offset, std::uint64_t x, std::vector< std::uint8_t > &res) const
 
bool getWordOffset (std::uint64_t offset, std::uint64_t &res, retdec::utils::Endianness e=retdec::utils::Endianness::UNKNOWN) const
 
bool getNTBSOffset (std::uint64_t offset, std::string &res, std::size_t size=0) const
 
bool getNTWSOffset (std::uint64_t offset, std::size_t width, std::vector< std::uint64_t > &res) const
 
virtual std::string getFileFormatName () const
 
void dump ()
 
void dump (std::string &dumpFile)
 
void dumpRegionsValidity ()
 
void dumpRegionsValidity (std::string &dumpStr)
 
void dumpResourceTree ()
 
void dumpResourceTree (std::string &dumpStr)
 
- Public Member Functions inherited from retdec::utils::ByteValueStorage
 ByteValueStorage ()=default
 
virtual ~ByteValueStorage ()=default
 
Endianness getInverseEndianness () const
 
bool isLittleEndian () const
 
bool isBigEndian () const
 
bool isUnknownEndian () const
 
bool hexToBig (std::string &str) const
 
bool hexToLittle (std::string &str) const
 
bool bitsToBig (std::string &str) const
 
bool bitsToLittle (std::string &str) const
 
bool bitsToBig (std::vector< unsigned char > &values) const
 
bool bitsToLittle (std::vector< unsigned char > &values) const
 
bool get1Byte (std::uint64_t address, std::uint64_t &res, Endianness e=Endianness::UNKNOWN) const
 
bool get2Byte (std::uint64_t address, std::uint64_t &res, Endianness e=Endianness::UNKNOWN) const
 
bool get4Byte (std::uint64_t address, std::uint64_t &res, Endianness e=Endianness::UNKNOWN) const
 
bool get8Byte (std::uint64_t address, std::uint64_t &res, Endianness e=Endianness::UNKNOWN) const
 
bool get10Byte (std::uint64_t address, long double &res) const
 
bool getWord (std::uint64_t address, std::uint64_t &res, Endianness e=Endianness::UNKNOWN) const
 
bool getFloat (std::uint64_t address, float &res) const
 
bool getDouble (std::uint64_t address, double &res) const
 
bool set1Byte (std::uint64_t address, std::uint64_t val, Endianness e=Endianness::UNKNOWN)
 
bool set2Byte (std::uint64_t address, std::uint64_t val, Endianness e=Endianness::UNKNOWN)
 
bool set4Byte (std::uint64_t address, std::uint64_t val, Endianness e=Endianness::UNKNOWN)
 
bool set8Byte (std::uint64_t address, std::uint64_t val, Endianness e=Endianness::UNKNOWN)
 
bool set10Byte (std::uint64_t address, long double val)
 
bool setWord (std::uint64_t address, std::uint64_t val, Endianness e=Endianness::UNKNOWN)
 
bool setFloat (std::uint64_t address, float val)
 
bool setDouble (std::uint64_t address, double val)
 
bool getXByteArray (std::uint64_t address, std::uint64_t x, std::vector< std::uint64_t > &res, std::size_t size, Endianness e=Endianness::UNKNOWN) const
 
bool get1ByteArray (std::uint64_t address, std::vector< std::uint64_t > &res, std::size_t size, Endianness e=Endianness::UNKNOWN) const
 
bool get2ByteArray (std::uint64_t address, std::vector< std::uint64_t > &res, std::size_t size, Endianness e=Endianness::UNKNOWN) const
 
bool get4ByteArray (std::uint64_t address, std::vector< std::uint64_t > &res, std::size_t size, Endianness e=Endianness::UNKNOWN) const
 
bool get8ByteArray (std::uint64_t address, std::vector< std::uint64_t > &res, std::size_t size, Endianness e=Endianness::UNKNOWN) const
 
bool get10ByteArray (std::uint64_t address, std::vector< long double > &res, std::size_t size) const
 
bool getWordArray (std::uint64_t address, std::vector< std::uint64_t > &res, std::size_t, Endianness e=Endianness::UNKNOWN) const
 
bool getFloatArray (std::uint64_t address, std::vector< float > &res, std::size_t size) const
 
bool getDoubleArray (std::uint64_t address, std::vector< double > &res, std::size_t size) const
 
bool getNTBS (std::uint64_t address, std::string &res, std::size_t size=0) const
 
bool getNTWS (std::uint64_t address, std::size_t width, std::vector< std::uint64_t > &res) const
 
bool getNTWSNice (std::uint64_t address, std::size_t width, std::vector< std::uint64_t > &res) const
 

Additional Inherited Members

- Protected Types inherited from retdec::utils::ByteValueStorage
using GetNByteFn = std::function< bool(std::uint64_t, std::uint64_t &, Endianness)>
 
using GetXByteFn = std::function< bool(std::uint64_t, std::uint64_t, std::uint64_t &, Endianness)>
 
- Protected Member Functions inherited from retdec::fileformat::FileFormat
void clear ()
 
void computeSectionTableHashes ()
 
void setLoadedBytes (std::vector< unsigned char > *lBytes)
 
- Protected Member Functions inherited from retdec::utils::ByteValueStorage
bool createValueFromBytes (const std::vector< std::uint8_t > &data, std::uint64_t &value, Endianness endian, std::uint64_t offset=0, std::uint64_t size=0) const
 
bool createBytesFromValue (std::uint64_t data, std::uint64_t x, std::vector< std::uint8_t > &value, Endianness endian) const
 
bool get10ByteImpl (const std::vector< std::uint8_t > &data, long double &res) const
 
bool getFloatImpl (const std::vector< std::uint8_t > &data, float &res) const
 
bool getDoubleImpl (const std::vector< std::uint8_t > &data, double &res) const
 
bool getNTBSImpl (const GetNByteFn &get1ByteFn, std::uint64_t address, std::string &res, std::size_t size) const
 
bool getNTWSImpl (const GetXByteFn &getXByteFn, std::uint64_t address, std::size_t width, std::vector< std::uint64_t > &res) const
 
bool getNTWSNiceImpl (const GetXByteFn &getXByteFn, std::uint64_t address, std::size_t width, std::vector< std::uint64_t > &res) const
 
- Protected Attributes inherited from retdec::fileformat::CoffFormat
llvm::object::COFFObjectFile * file
 parser of input COFF file More...
 
- Protected Attributes inherited from retdec::fileformat::FileFormat
std::string crc32
 CRC32 of file content. More...
 
std::string md5
 MD5 of file content. More...
 
std::string sha256
 SHA256 of file content. More...
 
std::string sectionCrc32
 CRC32 of section table. More...
 
std::string sectionMd5
 MD5 of section table. More...
 
std::string sectionSha256
 SHA256 of section table. More...
 
std::string filePath
 name of input file More...
 
std::istream & fileStream
 stream representation of input file More...
 
std::vector< Section * > sections
 file sections More...
 
std::vector< Segment * > segments
 file segments More...
 
std::vector< SymbolTable * > symbolTables
 symbol tables More...
 
std::vector< RelocationTable * > relocationTables
 relocation tables More...
 
std::vector< DynamicTable * > dynamicTables
 tables with dynamic records More...
 
std::vector< unsigned char > bytes
 content of file as bytes More...
 
std::vector< Stringstrings
 detected strings More...
 
std::vector< ElfNoteSecSegnoteSecSegs
 note sections or segemnts found in ELF file More...
 
std::set< std::uint64_t > unknownRelocs
 unknown relocations More...
 
ImportTableimportTable
 table of imports More...
 
ExportTableexportTable
 table of exports More...
 
ResourceTableresourceTable
 table of resources More...
 
ResourceTreeresourceTree
 structure of resource tree More...
 
RichHeaderrichHeader
 rich header More...
 
PdbInfopdbInfo
 information about related PDB debug file More...
 
CertificateTablecertificateTable
 table of certificates More...
 
TlsInfotlsInfo
 thread-local information More...
 
ElfCoreInfoelfCoreInfo
 information about core file structures More...
 
Format fileFormat
 format of input file More...
 
LoaderErrorInfo _ldrErrInfo
 loader error (e.g. Windows loader error for PE files) More...
 
bool stateIsValid
 internal state of instance More...
 
std::vector< std::pair< std::size_t, std::size_t > > secHashInfo
 information for calculation of section table hash More...
 
std::optional< bool > signatureVerified
 indicates whether the signature is present and also verified More...
 
retdec::common::RangeContainer< std::uint64_t > nonDecodableRanges
 Address ranges which should not be decoded for instructions. More...
 
std::vector< std::pair< std::string, std::string > > anomalies
 file format anomalies More...
 

Detailed Description

Wrapper for parsing COFF files

Constructor & Destructor Documentation

◆ CoffWrapper()

retdec::fileinfo::CoffWrapper::CoffWrapper ( std::string  pathToFile,
retdec::fileformat::LoadFlags  loadFlags 
)

Constructor

Parameters
pathToFilePath to COFF binary file
loadFlagsLoad flags

Member Function Documentation

◆ getCoffParser()

const llvm::object::COFFObjectFile * retdec::fileinfo::CoffWrapper::getCoffParser ( ) const

Get LLVM COFF parser

Returns
LLVM COFF parser

◆ getTypeOfFile()

std::string retdec::fileinfo::CoffWrapper::getTypeOfFile ( ) const

Get type of binary file

Returns
Type of binary file (e.g. DLL)

The documentation for this class was generated from the following files: