Package ghidra.app.util.bin.format.pe
Class NTHeader
- java.lang.Object
-
- ghidra.app.util.bin.format.pe.NTHeader
-
- All Implemented Interfaces:
OffsetValidator,StructConverter
public class NTHeader extends java.lang.Object implements StructConverter, OffsetValidator
A class to represent theIMAGE_NT_HEADERS32and IMAGE_NT_HEADERS64 structs as defined inwinnt.h.typedef struct _IMAGE_NT_HEADERS { DWORD Signature; IMAGE_FILE_HEADER FileHeader; IMAGE_OPTIONAL_HEADER32 OptionalHeader; };
-
-
Field Summary
Fields Modifier and Type Field Description static intMAX_SANE_COUNTstatic java.lang.StringNAMEThe name to use when converting into a structure data type.static intSIZEOF_SIGNATUREThe size of the NT header signature.
-
Constructor Summary
Constructors Constructor Description NTHeader()DO NOT USE THIS CONSTRUCTOR, USE create*(GenericFactory ...) FACTORY METHODS INSTEAD.
-
Method Summary
All Methods Static Methods Instance Methods Concrete Methods Modifier and Type Method Description booleancheckPointer(long ptr)booleancheckRVA(long rva)static NTHeadercreateNTHeader(FactoryBundledWithBinaryReader reader, int index, PortableExecutable.SectionLayout layout, boolean advancedProcess, boolean parseCliHeaders)Constructs a new NT header.FileHeadergetFileHeader()Returns the file header.OptionalHeadergetOptionalHeader()Returns the optional header.booleanisRVAResoltionSectionAligned()intrvaToPointer(int rva)Converts a relative virtual address (RVA) into a pointer.longrvaToPointer(long rva)DataTypetoDataType()Returns a structure datatype representing the contents of the implementor of this interface.intvaToPointer(int va)Converts a virtual address (VA) into a pointer.longvaToPointer(long va)
-
-
-
Field Detail
-
NAME
public static final java.lang.String NAME
The name to use when converting into a structure data type.- See Also:
- Constant Field Values
-
SIZEOF_SIGNATURE
public static final int SIZEOF_SIGNATURE
The size of the NT header signature.- See Also:
- Constant Field Values
-
MAX_SANE_COUNT
public static final int MAX_SANE_COUNT
- See Also:
- Constant Field Values
-
-
Method Detail
-
createNTHeader
public static NTHeader createNTHeader(FactoryBundledWithBinaryReader reader, int index, PortableExecutable.SectionLayout layout, boolean advancedProcess, boolean parseCliHeaders) throws InvalidNTHeaderException, java.io.IOException
Constructs a new NT header.- Parameters:
reader- the binary readerindex- the index into the reader to the start of the NT headeradvancedProcess- if true, information rafside of the base header will be processedparseCliHeaders- if true, CLI headers are parsed (if present)- Throws:
InvalidNTHeaderException- if the bytes the specified index do not constitute an accurate NT header.java.io.IOException
-
isRVAResoltionSectionAligned
public boolean isRVAResoltionSectionAligned()
-
getFileHeader
public FileHeader getFileHeader()
Returns the file header.- Returns:
- the file header
-
getOptionalHeader
public OptionalHeader getOptionalHeader()
Returns the optional header.- Returns:
- the optional header
-
toDataType
public DataType toDataType() throws DuplicateNameException, java.io.IOException
Description copied from interface:StructConverterReturns a structure datatype representing the contents of the implementor of this interface.For example, given:
class A { int foo; double bar; }The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.
- Specified by:
toDataTypein interfaceStructConverter- Returns:
- returns a structure datatype representing the implementor of this interface
- Throws:
DuplicateNameException- when a datatype of the same name already existsjava.io.IOException- See Also:
StructConverter.toDataType()
-
rvaToPointer
public int rvaToPointer(int rva)
Converts a relative virtual address (RVA) into a pointer.- See Also:
rvaToPointer(long)
-
rvaToPointer
public long rvaToPointer(long rva)
- Parameters:
rva- the relative virtual address- Returns:
- the pointer into binary image, 0 if not valid
-
checkPointer
public boolean checkPointer(long ptr)
- Specified by:
checkPointerin interfaceOffsetValidator
-
checkRVA
public boolean checkRVA(long rva)
- Specified by:
checkRVAin interfaceOffsetValidator
-
vaToPointer
public int vaToPointer(int va)
Converts a virtual address (VA) into a pointer.- See Also:
vaToPointer(long)
-
vaToPointer
public long vaToPointer(long va)
- Parameters:
va- the virtual address- Returns:
- the pointer into binary image, 0 if not valid
-
-