java.lang.Object
com.pnfsoftware.jeb.core.units.codeobject.PEParser

public class PEParser extends Object
A simple PE/PE64 parser (not relying on the IUnit interface) that may be used for convenience purposes.
  • Constructor Details

  • Method Details

    • add

      public long add(long address, long size)
      Add an address (unsigned) to a size (unsigned) and return a sanitized address.

      Theoretically, this method should be used throughout the processing of various areas, eg imports, exports, etc. however, sanitizations are costly and clutter the code. Therefore, we limit them to filters before starting processing. Processing of a an area of the PE are wrapped in try-catch to avoid killing processing of the entire PE, should an error (eg, due to malformed structures) arise. This has the drawback of semi-neutering (only semi, because the exceptions are displayed and silently reported) parsing bugs that may be present.

      Parameters:
      address -
      size -
      Returns:
    • sanitizeAddress

      public long sanitizeAddress(long address)
      Sanitize a long to a legal address rel. to the PE specifications (32-bit or 64-bit space).
      Parameters:
      address -
      Returns:
    • isAddressInside

      public boolean isAddressInside(long a)
      Determine if a legal address is within the bounds of the mapped PE file.
      Parameters:
      a -
      Returns:
    • convertFileOffsetToRelativeAddress

      public long convertFileOffsetToRelativeAddress(long offset)
    • convertRelativeAddressToFileOffset

      public long convertRelativeAddressToFileOffset(long rva)
    • getCOFFHeader

      public ICOFFHeader getCOFFHeader()
    • getPEOptionalHeader

      public IPEOptionalHeader getPEOptionalHeader()
    • getSectionHeaders

      public ICOFFSectionHeader[] getSectionHeaders()
    • getSegments

      public List<ISegmentInformation> getSegments()
    • getSegmentCount

      public int getSegmentCount()
    • getSegment

      public ISegmentInformation getSegment(int index)