PEParser
extends Object| java.lang.Object | |
| ↳ | com.pnfsoftware.jeb.core.units.codeobject.PEParser |
Class Overview
A simple PE/PE64 parser (not relying on the IUnit interface) that may be used for
convenience purposes.
Summary
| Public Constructors | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| PEParser(IInput input) | |||||||||||
| Public Methods | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| long |
add(long address, long size)
Add an address (unsigned) to a size (unsigned) and return a sanitized address.
| ||||||||||
| long | convertFileOffsetToRelativeAddress(long offset) | ||||||||||
| long | convertRelativeAddressToFileOffset(long rva) | ||||||||||
| ICOFFHeader | getCOFFHeader() | ||||||||||
| IPEOptionalHeader | getPEOptionalHeader() | ||||||||||
| ICOFFSectionHeader[] | getSectionHeaders() | ||||||||||
| ISegmentInformation | getSegment(int index) | ||||||||||
| int | getSegmentCount() | ||||||||||
| List<ISegmentInformation> | getSegments() | ||||||||||
| boolean |
isAddressInside(long a)
Determine if a legal address is within the bounds of the mapped PE file.
| ||||||||||
| long |
sanitizeAddress(long address)
Sanitize a long to a legal address rel.
| ||||||||||
|
[Expand]
Inherited Methods | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
From class
java.lang.Object
| |||||||||||
Public Constructors
Public Methods
public long add (long address, long size)
Add an address (unsigned) to a size (unsigned) and return a sanitized address.
Theoretically, this method should be used throughout the processing of various areas, eg imports, exports, etc. however, sanitizations are costly and clutter the code. Therefore, we limit them to filters before starting processing. Processing of a an area of the PE are wrapped in try-catch to avoid killing processing of the entire PE, should an error (eg, due to malformed structures) arise. This has the drawback of semi-neutering (only semi, because the exceptions are displayed and silently reported) parsing bugs that may be present.
public long convertFileOffsetToRelativeAddress (long offset)
public long convertRelativeAddressToFileOffset (long rva)
public int getSegmentCount ()
public boolean isAddressInside (long a)
Determine if a legal address is within the bounds of the mapped PE file.
public long sanitizeAddress (long address)
Sanitize a long to a legal address rel. to the PE specifications (32-bit or 64-bit space).