Package ghidra.app.util.bin.format.pe
Class NTHeader
- java.lang.Object
-
- ghidra.app.util.bin.format.pe.NTHeader
-
- All Implemented Interfaces:
OffsetValidator
,StructConverter
public class NTHeader extends java.lang.Object implements StructConverter, OffsetValidator
A class to represent theIMAGE_NT_HEADERS32
and IMAGE_NT_HEADERS64 structs as defined inwinnt.h
.typedef struct _IMAGE_NT_HEADERS { DWORD Signature; IMAGE_FILE_HEADER FileHeader; IMAGE_OPTIONAL_HEADER32 OptionalHeader; };
-
-
Field Summary
Fields Modifier and Type Field Description static int
MAX_SANE_COUNT
static int
SIZEOF_SIGNATURE
The size of the NT header signature.
-
Constructor Summary
Constructors Constructor Description NTHeader()
DO NOT USE THIS CONSTRUCTOR, USE create*(GenericFactory ...) FACTORY METHODS INSTEAD.
-
Method Summary
All Methods Static Methods Instance Methods Concrete Methods Modifier and Type Method Description boolean
checkPointer(long ptr)
boolean
checkRVA(long rva)
static NTHeader
createNTHeader(FactoryBundledWithBinaryReader reader, int index, PortableExecutable.SectionLayout layout, boolean advancedProcess, boolean parseCliHeaders)
Constructs a new NT header.FileHeader
getFileHeader()
Returns the file header.java.lang.String
getName()
Returns the name to use when converting into a structure data type.OptionalHeader
getOptionalHeader()
Returns the optional header.boolean
isRVAResoltionSectionAligned()
int
rvaToPointer(int rva)
Converts a relative virtual address (RVA) into a pointer.long
rvaToPointer(long rva)
DataType
toDataType()
Returns a structure datatype representing the contents of the implementor of this interface.int
vaToPointer(int va)
Converts a virtual address (VA) into a pointer.long
vaToPointer(long va)
-
-
-
Field Detail
-
SIZEOF_SIGNATURE
public static final int SIZEOF_SIGNATURE
The size of the NT header signature.- See Also:
- Constant Field Values
-
MAX_SANE_COUNT
public static final int MAX_SANE_COUNT
- See Also:
- Constant Field Values
-
-
Method Detail
-
createNTHeader
public static NTHeader createNTHeader(FactoryBundledWithBinaryReader reader, int index, PortableExecutable.SectionLayout layout, boolean advancedProcess, boolean parseCliHeaders) throws InvalidNTHeaderException, java.io.IOException
Constructs a new NT header.- Parameters:
reader
- the binary readerindex
- the index into the reader to the start of the NT headeradvancedProcess
- if true, information rafside of the base header will be processedparseCliHeaders
- if true, CLI headers are parsed (if present)- Throws:
InvalidNTHeaderException
- if the bytes the specified index do not constitute an accurate NT header.java.io.IOException
-
getName
public java.lang.String getName()
Returns the name to use when converting into a structure data type.- Returns:
- the name to use when converting into a structure data type
-
isRVAResoltionSectionAligned
public boolean isRVAResoltionSectionAligned()
-
getFileHeader
public FileHeader getFileHeader()
Returns the file header.- Returns:
- the file header
-
getOptionalHeader
public OptionalHeader getOptionalHeader()
Returns the optional header.- Returns:
- the optional header
-
toDataType
public DataType toDataType() throws DuplicateNameException, java.io.IOException
Description copied from interface:StructConverter
Returns a structure datatype representing the contents of the implementor of this interface.For example, given:
class A { int foo; double bar; }
The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.
- Specified by:
toDataType
in interfaceStructConverter
- Returns:
- returns a structure datatype representing the implementor of this interface
- Throws:
DuplicateNameException
- when a datatype of the same name already existsjava.io.IOException
- See Also:
StructConverter.toDataType()
-
rvaToPointer
public int rvaToPointer(int rva)
Converts a relative virtual address (RVA) into a pointer.- See Also:
rvaToPointer(long)
-
rvaToPointer
public long rvaToPointer(long rva)
- Parameters:
rva
- the relative virtual address- Returns:
- the pointer into binary image, 0 if not valid
-
checkPointer
public boolean checkPointer(long ptr)
- Specified by:
checkPointer
in interfaceOffsetValidator
-
checkRVA
public boolean checkRVA(long rva)
- Specified by:
checkRVA
in interfaceOffsetValidator
-
vaToPointer
public int vaToPointer(int va)
Converts a virtual address (VA) into a pointer.- See Also:
vaToPointer(long)
-
vaToPointer
public long vaToPointer(long va)
- Parameters:
va
- the virtual address- Returns:
- the pointer into binary image, 0 if not valid
-
-