Class PortableExecutable

java.lang.Object

ghidra.app.util.bin.format.pe.PortableExecutable

public class PortableExecutable
extends Object

A class to manage loading Portable Executables (PE).

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static enum	PortableExecutable.SectionLayout	Indicates how sections of this PE are laid out in the underlying ByteProvider.

Field Summary

Fields

Modifier and Type	Field	Description
static boolean	DEBUG
static final String	NAME

Constructor Summary

Constructors

Constructor	Description
PortableExecutable(ByteProvider bp, PortableExecutable.SectionLayout layout)	Constructs a new PortableExecutable using the specified byte provider and layout
PortableExecutable(ByteProvider bp, PortableExecutable.SectionLayout layout, boolean advancedProcess, boolean parseCliHeaders)	Constructs a new PortableExecutable using the specified byte provider and layout

Method Summary

Modifier and Type	Method	Description
DOSHeader	getDOSHeader()	Returns the DOS header from the PE image.
long	getFileLength()	Returns the length of the PortableExecutable file in bytes.
NTHeader	getNTHeader()	Returns the NT header from the PE image.
RichHeader	getRichHeader()	Returns the rich header from the PE image.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

NAME

public static final String NAME

See Also:

• Constant Field Values

DEBUG

public static boolean DEBUG

Constructor Details

PortableExecutable

public PortableExecutable(ByteProvider bp,
 PortableExecutable.SectionLayout layout)
                   throws IOException

Constructs a new PortableExecutable using the specified byte provider and layout

Parameters:

bp - the ByteProvider

layout - specifies the layout of the underlying provider and governs RVA resolution

Throws:

IOException - if an I/O error occurs

PortableExecutable

public PortableExecutable(ByteProvider bp,
 PortableExecutable.SectionLayout layout,
 boolean advancedProcess,
 boolean parseCliHeaders)
                   throws IOException

Constructs a new PortableExecutable using the specified byte provider and layout

Parameters:

bp - the ByteProvider

layout - specifies the layout of the underlying provider and governs RVA resolution

advancedProcess - if true, the data directories are also processed

parseCliHeaders - if true, CLI headers are parsed (if present)

Throws:

IOException - if an I/O error occurs

Method Details

getDOSHeader

public DOSHeader getDOSHeader()

Returns the DOS header from the PE image.

Returns:

the DOS header from the PE image

getRichHeader

public RichHeader getRichHeader()

Returns the rich header from the PE image.

Returns:

the rich header from the PE image

getNTHeader

public NTHeader getNTHeader()

Returns the NT header from the PE image.

Returns:

the NT header from the PE image

getFileLength

public long getFileLength()

Returns the length of the PortableExecutable file in bytes.

Returns:

the length of the PortableExecutable file in bytes