PE

Typedefs

typedef struct Pe_DataDirectory_t Pe_DataDirectory_t

Enums

enum LIEF_PE_DATA_DIRECTORY

Values:

enumerator LIEF_PE_DATA_DIR_EXPORT_TABLE = 0
enumerator LIEF_PE_DATA_DIR_IMPORT_TABLE
enumerator LIEF_PE_DATA_DIR_RESOURCE_TABLE
enumerator LIEF_PE_DATA_DIR_EXCEPTION_TABLE
enumerator LIEF_PE_DATA_DIR_CERTIFICATE_TABLE
enumerator LIEF_PE_DATA_DIR_BASE_RELOCATION_TABLE
enumerator LIEF_PE_DATA_DIR_DEBUG
enumerator LIEF_PE_DATA_DIR_ARCHITECTURE
enumerator LIEF_PE_DATA_DIR_GLOBAL_PTR
enumerator LIEF_PE_DATA_DIR_TLS_TABLE
enumerator LIEF_PE_DATA_DIR_LOAD_CONFIG_TABLE
enumerator LIEF_PE_DATA_DIR_BOUND_IMPORT
enumerator LIEF_PE_DATA_DIR_IAT
enumerator LIEF_PE_DATA_DIR_DELAY_IMPORT_DESCRIPTOR
enumerator LIEF_PE_DATA_DIR_CLR_RUNTIME_HEADER
enumerator LIEF_PE_DATA_DIR_RESERVED
enumerator LIEF_PE_DATA_DIR_NONE
struct Pe_DataDirectory_t

Public Members

uint32_t rva
uint32_t size

Typedefs

typedef struct Pe_Section_t Pe_Section_t

Enums

enum LIEF_PE_SECTION_CHARACTERISTICS

Values:

enumerator LIEF_PE_SECTION_CHARACTERISTICS_TYPE_NO_PAD = 0x00000008
enumerator LIEF_PE_SECTION_CHARACTERISTICS_CNT_CODE = 0x00000020
enumerator LIEF_PE_SECTION_CHARACTERISTICS_CNT_INITIALIZED_DATA = 0x00000040
enumerator LIEF_PE_SECTION_CHARACTERISTICS_CNT_UNINITIALIZED_DATA = 0x00000080
enumerator LIEF_PE_SECTION_CHARACTERISTICS_LNK_OTHER = 0x00000100
enumerator LIEF_PE_SECTION_CHARACTERISTICS_LNK_INFO = 0x00000200
enumerator LIEF_PE_SECTION_CHARACTERISTICS_LNK_REMOVE = 0x00000800
enumerator LIEF_PE_SECTION_CHARACTERISTICS_LNK_COMDAT = 0x00001000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_GPREL = 0x00008000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_MEM_PURGEABLE = 0x00010000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_MEM_16BIT = 0x00020000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_MEM_LOCKED = 0x00040000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_MEM_PRELOAD = 0x00080000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_ALIGN_1BYTES = 0x00100000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_ALIGN_2BYTES = 0x00200000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_ALIGN_4BYTES = 0x00300000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_ALIGN_8BYTES = 0x00400000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_ALIGN_16BYTES = 0x00500000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_ALIGN_32BYTES = 0x00600000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_ALIGN_64BYTES = 0x00700000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_ALIGN_128BYTES = 0x00800000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_ALIGN_256BYTES = 0x00900000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_ALIGN_512BYTES = 0x00A00000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_ALIGN_1024BYTES = 0x00B00000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_ALIGN_2048BYTES = 0x00C00000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_ALIGN_4096BYTES = 0x00D00000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_ALIGN_8192BYTES = 0x00E00000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_LNK_NRELOC_OVFL = 0x01000000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_MEM_DISCARDABLE = 0x02000000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_MEM_NOT_CACHED = 0x04000000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_MEM_NOT_PAGED = 0x08000000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_MEM_SHARED = 0x10000000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_MEM_EXECUTE = 0x20000000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_MEM_READ = 0x40000000
enumerator LIEF_PE_SECTION_CHARACTERISTICS_MEM_WRITE = 0x80000000
struct Pe_Section_t

Public Members

const char *name
uint64_t virtual_address
uint64_t size
uint64_t offset
uint32_t virtual_size
uint32_t pointerto_relocation
uint32_t pointerto_line_numbers
uint32_t characteristics
uint8_t *content
uint64_t content_size
double entropy

Typedefs

typedef struct Pe_OptionalHeader_t Pe_OptionalHeader_t

Enums

enum LIEF_PE_DLL_CHARACTERISTICS

Values:

enumerator LIEF_PE_DLL_CHARACTERISTICS_HIGH_ENTROPY_VA = 0x0020

ASLR with 64 bit address space.

enumerator LIEF_PE_DLL_CHARACTERISTICS_DYNAMIC_BASE = 0x0040

DLL can be relocated at load time.

enumerator LIEF_PE_DLL_CHARACTERISTICS_FORCE_INTEGRITY = 0x0080

Code integrity checks are enforced.

enumerator LIEF_PE_DLL_CHARACTERISTICS_NX_COMPAT = 0x0100

Image is NX compatible.

enumerator LIEF_PE_DLL_CHARACTERISTICS_NO_ISOLATION = 0x0200

Isolation aware, but do not isolate the image.

enumerator LIEF_PE_DLL_CHARACTERISTICS_NO_SEH = 0x0400

Does not use structured exception handling (SEH). No SEH handler may be called in this image.

enumerator LIEF_PE_DLL_CHARACTERISTICS_NO_BIND = 0x0800

Do not bind the image.

enumerator LIEF_PE_DLL_CHARACTERISTICS_APPCONTAINER = 0x1000

Image should execute in an AppContainer.

enumerator LIEF_PE_DLL_CHARACTERISTICS_WDM_DRIVER = 0x2000

A WDM driver.

enumerator LIEF_PE_DLL_CHARACTERISTICS_GUARD_CF = 0x4000

Image supports Control Flow Guard.

enumerator LIEF_PE_DLL_CHARACTERISTICS_TERMINAL_SERVER_AWARE = 0x8000

Terminal Server aware.

enum LIEF_PE_SUBSYSTEM

Values:

enumerator LIEF_PE_SUBSYSTEM_UNKNOWN = 0

An unknown subsystem.

enumerator LIEF_PE_SUBSYSTEM_NATIVE = 1

Device drivers and native Windows processes

enumerator LIEF_PE_SUBSYSTEM_WINDOWS_GUI = 2

The Windows GUI subsystem.

enumerator LIEF_PE_SUBSYSTEM_WINDOWS_CUI = 3

The Windows character subsystem.

enumerator LIEF_PE_SUBSYSTEM_OS2_CUI = 5

The OS/2 character subsytem.

enumerator LIEF_PE_SUBSYSTEM_POSIX_CUI = 7

The POSIX character subsystem.

enumerator LIEF_PE_SUBSYSTEM_NATIVE_WINDOWS = 8

Native Windows 9x driver.

enumerator LIEF_PE_SUBSYSTEM_WINDOWS_CE_GUI = 9

Windows CE.

enumerator LIEF_PE_SUBSYSTEM_EFI_APPLICATION = 10

An EFI application.

enumerator LIEF_PE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER = 11

An EFI driver with boot services.

enumerator LIEF_PE_SUBSYSTEM_EFI_RUNTIME_DRIVER = 12

An EFI driver with run-time services.

enumerator LIEF_PE_SUBSYSTEM_EFI_ROM = 13

An EFI ROM image.

enumerator LIEF_PE_SUBSYSTEM_XBOX = 14

XBOX.

enumerator LIEF_PE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION = 16

A BCD application.

Functions

const char *lief_pe_subsytem_str(enum LIEF_PE_SUBSYSTEM e)
struct Pe_OptionalHeader_t

Public Members

enum LIEF_PE_PE_TYPES magic
uint8_t major_linker_version
uint8_t minor_linker_version
uint32_t sizeof_code
uint32_t sizeof_initialized_data
uint32_t sizeof_uninitialized_data
uint32_t addressof_entrypoint
uint32_t baseof_code
uint32_t baseof_data
uint64_t imagebase
uint32_t section_alignment
uint32_t file_alignment
uint16_t major_operating_system_version
uint16_t minor_operating_system_version
uint16_t major_image_version
uint16_t minor_image_version
uint16_t major_subsystem_version
uint16_t minor_subsystem_version
uint32_t win32_version_value
uint32_t sizeof_image
uint32_t sizeof_headers
uint32_t checksum
enum LIEF_PE_SUBSYSTEM subsystem
uint32_t dll_characteristics
uint64_t sizeof_stack_reserve
uint64_t sizeof_stack_commit
uint64_t sizeof_heap_reserve
uint64_t sizeof_heap_commit
uint32_t loader_flags
uint32_t numberof_rva_and_size

Typedefs

typedef struct Pe_ImportEntry_t Pe_ImportEntry_t
struct Pe_ImportEntry_t

Public Members

bool is_ordinal
const char *name
uint16_t ordinal
uint64_t hint_name_rva
uint16_t hint
uint64_t iat_value
uint64_t data
uint64_t iat_address

Typedefs

typedef struct Pe_Import_t Pe_Import_t
struct Pe_Import_t

Public Members

const char *name
uint32_t forwarder_chain
uint32_t timedatestamp
Pe_ImportEntry_t **entries
uint32_t import_address_table_rva
uint32_t import_lookup_table_rva

Typedefs

typedef struct Pe_Header_t Pe_Header_t

Enums

enum LIEF_PE_MACHINE_TYPES

Values:

enumerator LIEF_PE_MACHINE_UNKNOWN = 0x0
enumerator LIEF_PE_MACHINE_AM33 = 0x1D3

Matsushita AM33

enumerator LIEF_PE_MACHINE_AMD64 = 0x8664

AMD x64

enumerator LIEF_PE_MACHINE_ARM = 0x1C0

ARM little endian

enumerator LIEF_PE_MACHINE_ARMNT = 0x1C4

ARMv7 Thumb mode only

enumerator LIEF_PE_MACHINE_ARM64 = 0xAA64

ARMv8 in 64-bits mode

enumerator LIEF_PE_MACHINE_EBC = 0xEBC

EFI byte code

enumerator LIEF_PE_MACHINE_I386 = 0x14C

Intel 386 or later

enumerator LIEF_PE_MACHINE_IA64 = 0x200

Intel Itanium processor family

enumerator LIEF_PE_MACHINE_M32R = 0x9041

Mitsubishi M32R little endian

enumerator LIEF_PE_MACHINE_MIPS16 = 0x266

MIPS16

enumerator LIEF_PE_MACHINE_MIPSFPU = 0x366

MIPS with FPU

enumerator LIEF_PE_MACHINE_MIPSFPU16 = 0x466

MIPS16 with FPU

enumerator LIEF_PE_MACHINE_POWERPC = 0x1F0

Power PC little endian

enumerator LIEF_PE_MACHINE_POWERPCFP = 0x1F1

Power PC with floating point

enumerator LIEF_PE_MACHINE_R4000 = 0x166

MIPS with little endian

enumerator LIEF_PE_MACHINE_RISCV32 = 0x5032

RISC-V 32-bit address space

enumerator LIEF_PE_MACHINE_RISCV64 = 0x5064

RISC-V 64-bit address space

enumerator LIEF_PE_MACHINE_RISCV128 = 0x5128

RISC-V 128-bit address space

enumerator LIEF_PE_MACHINE_SH3 = 0x1A2

Hitachi SH3

enumerator LIEF_PE_MACHINE_SH3DSP = 0x1A3

Hitachi SH3 DSP

enumerator LIEF_PE_MACHINE_SH4 = 0x1A6

Hitachi SH4

enumerator LIEF_PE_MACHINE_SH5 = 0x1A8

Hitachi SH5

enumerator LIEF_PE_MACHINE_THUMB = 0x1C2

ARM or Thumb

enumerator LIEF_PE_MACHINE_WCEMIPSV2 = 0x169

MIPS little-endian WCE v2

enum LIEF_PE_HEADER_CHARACTERISTICS

Values:

enumerator LIEF_PE_HEADER_CHARACTERISTICS_INVALID = 0x0000
enumerator LIEF_PE_HEADER_CHARACTERISTICS_RELOCS_STRIPPED = 0x0001

The file does not contain base relocations and must be loaded at its preferred base. If this cannot be done, the loader will error.

enumerator LIEF_PE_HEADER_CHARACTERISTICS_EXECUTABLE_IMAGE = 0x0002

The file is valid and can be run.

enumerator LIEF_PE_HEADER_CHARACTERISTICS_LINE_NUMS_STRIPPED = 0x0004

COFF line numbers have been stripped. This is deprecated and should be 0

enumerator LIEF_PE_HEADER_CHARACTERISTICS_LOCAL_SYMS_STRIPPED = 0x0008

COFF symbol table entries for local symbols have been removed. This is deprecated and should be 0.

enumerator LIEF_PE_HEADER_CHARACTERISTICS_AGGRESSIVE_WS_TRIM = 0x0010

Aggressively trim working set. This is deprecated and must be 0.

enumerator LIEF_PE_HEADER_CHARACTERISTICS_LARGE_ADDRESS_AWARE = 0x0020

Image can handle > 2GiB addresses.

enumerator LIEF_PE_HEADER_CHARACTERISTICS_BYTES_REVERSED_LO = 0x0080

Little endian: the LSB precedes the MSB in memory. This is deprecated and should be 0.

enumerator LIEF_PE_HEADER_CHARACTERISTICS_32BIT_MACHINE = 0x0100

Machine is based on a 32bit word architecture.

enumerator LIEF_PE_HEADER_CHARACTERISTICS_DEBUG_STRIPPED = 0x0200

Debugging info has been removed.

enumerator LIEF_PE_HEADER_CHARACTERISTICS_REMOVABLE_RUN_FROM_SWAP = 0x0400

If the image is on removable media, fully load it and copy it to swap.

enumerator LIEF_PE_HEADER_CHARACTERISTICS_NET_RUN_FROM_SWAP = 0x0800

If the image is on network media, fully load it and copy it to swap.

enumerator LIEF_PE_HEADER_CHARACTERISTICS_SYSTEM = 0x1000

The image file is a system file, not a user program.

enumerator LIEF_PE_HEADER_CHARACTERISTICS_DLL = 0x2000

The image file is a DLL.

enumerator LIEF_PE_HEADER_CHARACTERISTICS_UP_SYSTEM_ONLY = 0x4000

This file should only be run on a uniprocessor machine.

enumerator LIEF_PE_HEADER_CHARACTERISTICS_BYTES_REVERSED_HI = 0x8000

Big endian: the MSB precedes the LSB in memory. This is deprecated

Functions

const char *lief_pe_header_machine_str(enum LIEF_PE_MACHINE_TYPES e)
const char *lief_pe_header_characteristics_str(enum LIEF_PE_HEADER_CHARACTERISTICS e)
struct Pe_Header_t

Public Members

uint8_t signature[4]
enum LIEF_PE_MACHINE_TYPES machine
uint16_t numberof_sections
uint32_t time_date_stamp
uint32_t pointerto_symbol_table
uint32_t numberof_symbols
uint16_t sizeof_optional_header
uint16_t characteristics

Typedefs

typedef struct Pe_DosHeader_t Pe_DosHeader_t
struct Pe_DosHeader_t

Public Members

uint16_t magic
uint16_t used_bytes_in_last_page
uint16_t file_size_in_pages
uint16_t numberof_relocation
uint16_t header_size_in_paragraphs
uint16_t minimum_extra_paragraphs
uint16_t maximum_extra_paragraphs
uint16_t initial_relative_ss
uint16_t initial_sp
uint16_t checksum
uint16_t initial_ip
uint16_t initial_relative_cs
uint16_t addressof_relocation_table
uint16_t overlay_number
uint16_t reserved[4]
uint16_t oem_id
uint16_t oem_info
uint16_t reserved2[10]
uint32_t addressof_new_exeheader

Typedefs

typedef struct Pe_Binary_t Pe_Binary_t

Functions

Pe_Binary_t *pe_parse(const char *file)

Wrapper on LIEF::PE::Parser::parse

void pe_binary_destroy(Pe_Binary_t *binary)
struct Pe_Binary_t
#include <Binary.h>

LIEF::PE::Binary C Handler.

Public Members

void *handler
const char *name
Pe_DosHeader_t dos_header
Pe_Header_t header
Pe_OptionalHeader_t optional_header
Pe_DataDirectory_t **data_directories
Pe_Section_t **sections
Pe_Import_t **imports

Functions

const char *PE_TYPES_to_string(enum LIEF_PE_PE_TYPES e)

Defines

_LIEF_EN(N)
_LIEF_EN_2(N, TYPE)
_LIEF_EI(X)