Class SectionHeader

java.lang.Object
ghidra.app.util.bin.format.pe.SectionHeader
All Implemented Interfaces:
ByteArrayConverter, StructConverter
public class SectionHeader extends Object implements StructConverter, ByteArrayConverter

A class to the represent the IMAGE_SECTION_HEADER struct as defined in winnt.h

typedef struct _IMAGE_SECTION_HEADER {
    BYTE    Name[IMAGE_SIZEOF_SHORT_NAME];
    union {
        DWORD   PhysicalAddress;
        DWORD   VirtualSize;			// MANDATORY
    } Misc;
    DWORD   VirtualAddress;				// MANDATORY
    DWORD   SizeOfRawData;				// MANDATORY
    DWORD   PointerToRawData;				// MANDATORY
    DWORD   PointerToRelocations;
    DWORD   PointerToLinenumbers;
    WORD    NumberOfRelocations;
    WORD    NumberOfLinenumbers;
    DWORD   Characteristics;				// MANDATORY
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;

#define IMAGE_SIZEOF_SECTION_HEADER 40

  • Field Details

    • NAME

      public static final String NAME
      The name to use when converting into a structure data type
      See Also:

    • IMAGE_SIZEOF_SHORT_NAME

      public static final int IMAGE_SIZEOF_SHORT_NAME
      The size of the section header short name
      See Also:

    • IMAGE_SIZEOF_SECTION_HEADER

      public static final int IMAGE_SIZEOF_SECTION_HEADER
      The size of the section header
      See Also:

    • IMAGE_SCN_RESERVED1

      public static final int IMAGE_SCN_RESERVED1
      Reserved for future use
      See Also:

    • IMAGE_SCN_RESERVED2

      public static final int IMAGE_SCN_RESERVED2
      Reserved for future use
      See Also:

    • IMAGE_SCN_RESERVED3

      public static final int IMAGE_SCN_RESERVED3
      Reserved for future use
      See Also:

    • IMAGE_SCN_RESERVED4

      public static final int IMAGE_SCN_RESERVED4
      Reserved for future use
      See Also:

    • IMAGE_SCN_TYPE_NO_PAD

      public static final int IMAGE_SCN_TYPE_NO_PAD
      See Also:

    • IMAGE_SCN_RESERVED5

      public static final int IMAGE_SCN_RESERVED5
      Reserved for future use
      See Also:

    • IMAGE_SCN_CNT_CODE

      public static final int IMAGE_SCN_CNT_CODE
      Section contains code
      See Also:

    • IMAGE_SCN_CNT_INITIALIZED_DATA

      public static final int IMAGE_SCN_CNT_INITIALIZED_DATA
      Section contains initialized data
      See Also:

    • IMAGE_SCN_CNT_UNINITIALIZED_DATA

      public static final int IMAGE_SCN_CNT_UNINITIALIZED_DATA
      Section contains uninitialized data
      See Also:

    • IMAGE_SCN_LNK_OTHER

      public static final int IMAGE_SCN_LNK_OTHER
      Reserved for future use
      See Also:

    • IMAGE_SCN_LNK_INFO

      public static final int IMAGE_SCN_LNK_INFO
      Section contains information for use by the linker (only exists in OBJs)
      See Also:

    • IMAGE_SCN_RESERVED6

      public static final int IMAGE_SCN_RESERVED6
      Reserved for future use
      See Also:

    • IMAGE_SCN_LNK_REMOVE

      public static final int IMAGE_SCN_LNK_REMOVE
      Section contents will not become part of the image (this only appears in OBJ files)
      See Also:

    • IMAGE_SCN_LNK_COMDAT

      public static final int IMAGE_SCN_LNK_COMDAT
      Section contents is communal data (comdat). Communal data is data (or code) that can be defined in multiple OBJs. The linker will select one copy to include in the executable. Comdats are vital for support of C++ template functions and function-level linking. Comdat sections only appear in OBJ files.
      See Also:

    • IMAGE_SCN_NO_DEFER_SPEC_EXC

      public static final int IMAGE_SCN_NO_DEFER_SPEC_EXC
      Reset speculative exceptions handling bits in the TLB entries for this section
      See Also:

    • IMAGE_SCN_GPREL

      public static final int IMAGE_SCN_GPREL
      Section content can be accessed relative to GP
      See Also:

    • IMAGE_SCN_MEM_PURGEABLE

      public static final int IMAGE_SCN_MEM_PURGEABLE
      Reserved for future use
      See Also:

    • IMAGE_SCN_MEM_16BIT

      public static final int IMAGE_SCN_MEM_16BIT
      Reserved for future use
      See Also:

    • IMAGE_SCN_MEM_LOCKED

      public static final int IMAGE_SCN_MEM_LOCKED
      Reserved for future use
      See Also:

    • IMAGE_SCN_MEM_PRELOAD

      public static final int IMAGE_SCN_MEM_PRELOAD
      Reserved for future use
      See Also:

    • IMAGE_SCN_ALIGN_1BYTES

      public static final int IMAGE_SCN_ALIGN_1BYTES
      Align on 1-byte boundary
      See Also:

    • IMAGE_SCN_ALIGN_2BYTES

      public static final int IMAGE_SCN_ALIGN_2BYTES
      Align on 2-byte boundary
      See Also:

    • IMAGE_SCN_ALIGN_4BYTES

      public static final int IMAGE_SCN_ALIGN_4BYTES
      Align on 4-byte boundary
      See Also:

    • IMAGE_SCN_ALIGN_8BYTES

      public static final int IMAGE_SCN_ALIGN_8BYTES
      Align on 8-byte boundary
      See Also:

    • IMAGE_SCN_ALIGN_16BYTES

      public static final int IMAGE_SCN_ALIGN_16BYTES
      Align on 16-byte boundary
      See Also:

    • IMAGE_SCN_ALIGN_32BYTES

      public static final int IMAGE_SCN_ALIGN_32BYTES
      Align on 32-byte boundary
      See Also:

    • IMAGE_SCN_ALIGN_64BYTES

      public static final int IMAGE_SCN_ALIGN_64BYTES
      Align on 64-byte boundary
      See Also:

    • IMAGE_SCN_ALIGN_128BYTES

      public static final int IMAGE_SCN_ALIGN_128BYTES
      Align on 128-byte boundary
      See Also:

    • IMAGE_SCN_ALIGN_256BYTES

      public static final int IMAGE_SCN_ALIGN_256BYTES
      Align on 256-byte boundary
      See Also:

    • IMAGE_SCN_ALIGN_512BYTES

      public static final int IMAGE_SCN_ALIGN_512BYTES
      Align on 512-byte boundary
      See Also:

    • IMAGE_SCN_ALIGN_1024BYTES

      public static final int IMAGE_SCN_ALIGN_1024BYTES
      Align on 1024-byte boundary
      See Also:

    • IMAGE_SCN_ALIGN_2048BYTES

      public static final int IMAGE_SCN_ALIGN_2048BYTES
      Align on 2048-byte boundary
      See Also:

    • IMAGE_SCN_ALIGN_4096BYTES

      public static final int IMAGE_SCN_ALIGN_4096BYTES
      Align on 4096-byte boundary
      See Also:

    • IMAGE_SCN_ALIGN_8192BYTES

      public static final int IMAGE_SCN_ALIGN_8192BYTES
      Align on 8192-byte boundary
      See Also:

    • IMAGE_SCN_ALIGN_MASK

      public static final int IMAGE_SCN_ALIGN_MASK
      Mask for alignment flags
      See Also:

    • IMAGE_SCN_LNK_NRELOC_OVFL

      public static final int IMAGE_SCN_LNK_NRELOC_OVFL
      Section contains extended relocations
      See Also:

    • IMAGE_SCN_MEM_DISCARDABLE

      public static final int IMAGE_SCN_MEM_DISCARDABLE
      The section can be discarded from the final executable. Used to hold information for the linker's use, including the .debug$ sections.
      See Also:

    • IMAGE_SCN_MEM_NOT_CACHED

      public static final int IMAGE_SCN_MEM_NOT_CACHED
      Section is not cachable
      See Also:

    • IMAGE_SCN_MEM_NOT_PAGED

      public static final int IMAGE_SCN_MEM_NOT_PAGED
      The section is not pageable, so it should always be physically present in memory. Often used for kernel-mode drivers.
      See Also:

    • IMAGE_SCN_MEM_SHARED

      public static final int IMAGE_SCN_MEM_SHARED
      Section is shareable. The physical pages containing this section's data will be shared between all processes that have this executable loaded. Thus, every process will see the exact same values for data in this section. Useful for making global variables shared between all instances of a process. To make a section shared, use the /section:name,S linker switch.
      See Also:

    • IMAGE_SCN_MEM_EXECUTE

      public static final int IMAGE_SCN_MEM_EXECUTE
      Section is executable
      See Also:

    • IMAGE_SCN_MEM_READ

      public static final int IMAGE_SCN_MEM_READ
      Section is readable
      See Also:

    • IMAGE_SCN_MEM_WRITE

      public static final int IMAGE_SCN_MEM_WRITE
      Section is writeable
      See Also:

  • Constructor Details

    • SectionHeader

      public SectionHeader(BinaryReader reader, long index, long stringTableOffset, int sectionNumber) throws IOException
      Creates a new SectionHeader from the specified stream starting at index
      Parameters:
      reader - BinaryReader to read from
      index - long offset in the reader where the section header starts
      stringTableOffset - offset of the string table, or -1 if not available
      sectionNumber - The section number (0-based)
      Throws:
      IOException - if error reading data

  • Method Details

    • getName

      public String getName()
      Returns the ASCII name of the section.

      A section name is not guaranteed to be null-terminated. If you specify a section name longer than eight characters, the linker truncates it to eight characters in the executable. A mechanism exists for allowing longer section names in OBJ files. Section names often start with a period, but this is not a requirement. Section names with a $ in the name get special treatment from the linker. Sections with identical names prior to the $ character are merged. The characters following the $ provide an alphabetic ordering for how the merged sections appear in the final section. There's quite a bit more to the subject of sections with $ in the name and how they're combined, but the details are outside the scope of this article.

      Returns:
      the ASCII name of the section

    • getReadableName

      public String getReadableName()
      Returns a readable ascii version of the name (all non-readable characters are replaced with underscores.
      Returns:
      a readable ascii version of the name (all non-readable characters are replaced with underscores

    • getPhysicalAddress

      public int getPhysicalAddress()
      Returns the original, unaligned physical address of this section.
      Returns:
      the original, unaligned physical address of this section

    • getVirtualAddress

      public int getVirtualAddress()
      Returns the original, unaligned RVA where the section begins in memory.
      Returns:
      the original, unaligned RVA where the section begins in memory

    • getAlignedVirtualAddress

      public int getAlignedVirtualAddress(OptionalHeader optionalHeader)
      Returns the aligned RVA where the section begins in memory.
      Parameters:
      optionalHeader - The OptionalHeader, or null if not available
      Returns:
      the aligned RVA where the section begins in memory

    • getVirtualSize

      public int getVirtualSize()
      Returns the original, unaligned size of the section in memory.
      Returns:
      the original, unaligned size of the section in memory

    • getAlignedVirtualSize

      public int getAlignedVirtualSize(OptionalHeader optionalHeader, MessageLog log)
      Returns the actual, used size of the section.
      Parameters:
      optionalHeader - The OptionalHeader, or null if not available
      log - A log to report errors to
      Returns:
      the actual, used size of the section

    • getPointerToRawData

      public int getPointerToRawData()
      Returns the original, unaligned offset of the section in the file.
      Returns:
      the original, unaligned offset of the section in the file

    • getAlignedPointerToRawData

      public int getAlignedPointerToRawData(OptionalHeader optionalHeader, MessageLog log)
      Returns the aligned offset of the section in the file.
      Parameters:
      optionalHeader - The OptionalHeader, or null if not available
      log - A log to report errors to
      Returns:
      the aligned offset of the section in the file

    • getSizeOfRawData

      public int getSizeOfRawData()
      Returns the original, unaligned size of the section in the file.
      Returns:
      the original, unaligned size of the section in the file

    • getAlignedSizeOfRawData

      public int getAlignedSizeOfRawData(OptionalHeader optionalHeader, MessageLog log)
      Returns the aligned size of the section in the file.
      Parameters:
      optionalHeader - The OptionalHeader, or null if not available
      log - A log to report errors to
      Returns:
      the aligned size of the section in the file

    • getPointerToRelocations

      public int getPointerToRelocations()
      Returns the file offset of relocations for this section.
      Returns:
      the file offset of relocations for this section

    • getNumberOfRelocations

      public short getNumberOfRelocations()
      Returns the number of relocations pointed to by the PointerToRelocations field.
      Returns:
      the number of relocations pointed to by the PointerToRelocations field

    • getPointerToLinenumbers

      public int getPointerToLinenumbers()
      Returns the file offset for COFF-style line numbers for this section.
      Returns:
      the file offset for COFF-style line numbers for this section

    • getCharacteristics

      public int getCharacteristics()
      Returns the flags OR'ed together, indicating the attributes of this section. Many of these flags can be set with the linker's /SECTION option. Common values include those listed in Figure 7.
      Returns:
      the flags OR'ed together, indicating the attributes of this section

    • getNumberOfLinenumbers

      public short getNumberOfLinenumbers()
      Returns the number of line numbers pointed to by the PointerToLinenumbers field.
      Returns:
      the number of line numbers pointed to by the PointerToLinenumbers field

    • toBytes

      public byte[] toBytes(DataConverter dc) throws IOException
      Description copied from interface: ByteArrayConverter
      Returns a byte array representing this implementor of this interface.
      Specified by:
      toBytes in interface ByteArrayConverter
      Parameters:
      dc - the data converter to use
      Returns:
      a byte array representing this object
      Throws:
      IOException - if an IO-related error occurs

    • getDataStream

      public InputStream getDataStream() throws IOException
      Returns an InputStream to underlying bytes of this section.
      Returns:
      an InputStream to underlying bytes of this section
      Throws:
      IOException - if an IO-related error occurred

    • getDataByteProvider

      public ByteProvider getDataByteProvider()
      Returns a ByteProvider to underlying bytes of this section.
      Returns:
      a ByteProvider to underlying bytes of this section

    • isRead

      public boolean isRead()
      Returns whether or not this section has read permissions.
      Returns:
      whether or not this section has read permissions

    • isWrite

      public boolean isWrite()
      Returns whether or not this section has write permissions.
      Returns:
      whether or not this section has write permissions

    • isExecute

      public boolean isExecute()
      Returns whether or not this section has execute permissions.
      Returns:
      whether or not this section has execute permissions

    • toString

      public String toString()
      Overrides:
      toString in class Object

    • toDataType

      public DataType toDataType() throws DuplicateNameException
      Description copied from interface: StructConverter
      Returns a structure datatype representing the contents of the implementor of this interface.

      For example, given: 

      class A {
    int foo;
    double bar;
}

      The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.

      Specified by:
      toDataType in interface StructConverter
      Returns:
      returns a structure datatype representing the implementor of this interface
      Throws:
      DuplicateNameException - when a datatype of the same name already exists
      See Also: