Package com.pnfsoftware.jeb.core.units.codeobject

Class PEParser

java.lang.Object
com.pnfsoftware.jeb.core.units.codeobject.PEParser
public class PEParser extends Object
A simple PE/PE64 parser (not relying on the IUnit interface) that may be used for convenience purposes.

  • Constructor Details

    • PEParser

      public PEParser(IInput input) throws IOException
      Parse a PE file.
      Parameters:
      input - input file
      Throws:
      IOException - if the input cannot be parsed as a PE file

  • Method Details

    • add

      public long add(long address, long size)
      Add an address (unsigned) to a size (unsigned) and return a sanitized address.

      Theoretically, this method should be used throughout the processing of various areas, eg imports, exports, etc. however, sanitizations are costly and clutter the code. Therefore, we limit them to filters before starting processing. Processing of a an area of the PE are wrapped in try-catch to avoid killing processing of the entire PE, should an error (eg, due to malformed structures) arise. This has the drawback of semi-neutering (only semi, because the exceptions are displayed and silently reported) parsing bugs that may be present.

      Parameters:
      address - base address
      size - size to add
      Returns:
      sanitized address

    • sanitizeAddress

      public long sanitizeAddress(long address)
      Sanitize a long to a legal address rel. to the PE specifications (32-bit or 64-bit space).
      Parameters:
      address - address to sanitize
      Returns:
      sanitized address

    • isAddressInside

      public boolean isAddressInside(long a)
      Determine if a legal address is within the bounds of the mapped PE file.
      Parameters:
      a - address to test
      Returns:
      true if the address is inside the mapped image

    • convertFileOffsetToRelativeAddress

      public long convertFileOffsetToRelativeAddress(long offset)
      Convert a file offset to a relative virtual address.
      Parameters:
      offset - file offset
      Returns:
      relative virtual address, or -1 if none maps to the offset

    • convertRelativeAddressToFileOffset

      public long convertRelativeAddressToFileOffset(long rva)
      Convert a relative virtual address to a file offset.
      Parameters:
      rva - relative virtual address
      Returns:
      file offset, or -1 if none maps to the address

    • getCOFFHeader

      public ICOFFHeader getCOFFHeader()
      Get the COFF header.
      Returns:
      COFF header

    • getPEOptionalHeader

      public IPEOptionalHeader getPEOptionalHeader()
      Get the PE optional header.
      Returns:
      PE optional header

    • getSectionHeaders

      public ICOFFSectionHeader[] getSectionHeaders()
      Get the COFF section headers.
      Returns:
      section headers

    • getSegments

      public List<ISegmentInformation> getSegments()
      Get the generic segment information.
      Returns:
      segment information

    • getSegmentCount

      public int getSegmentCount()
      Get the number of generic segments.
      Returns:
      segment count

    • getSegment

      public ISegmentInformation getSegment(int index)
      Get generic segment information by index.
      Parameters:
      index - segment index
      Returns:
      segment information