public interface

ISymbolInformation

com.pnfsoftware.jeb.core.units.codeobject.ISymbolInformation
Known Indirect Subclasses

Class Overview

Generic representation of a code symbol information. Method results are all optional; methods may return 0 or null if the data is irrelevant to the loader type they are part of.

Summary

Constants
int FLAG_ABSOLUTE the symbol address is absolute
int FLAG_EXPORTED the symbol represent an object that is exported (publicly exposed) by the code unit
int FLAG_FUNCTION_CODE_CONTIGUOUS this flag may be used with FUNCTION symbols that have a non-zero symbol size: it serves to indicate that the routine code is a contiguous list of instructions (no inner data or undefined bytes, no loose basic blocks)
int FLAG_IMPORTED the symbol represent an object that is imported by the code unit
int FLAG_METADATA metadata symbols for linker or compiler, whose name is not useful
Public Methods
abstract int getFlags()
Get the symbol flags.
abstract long getIdentifier()
Get the symbol identifier.
abstract String getName()
Get the symbol name.
abstract int getProcessorMode()
Retrieve the optional processor mode associated to this symbol, if the address points to code.
abstract long getRelativeAddress()
Get the base-relative address of the description of the symbol.
abstract String getSymbolDataTypeInformation()
abstract long getSymbolRelativeAddress()
Get the base-relative address of the symbol.
abstract long getSymbolSize()
Get the size of the symbol.
abstract SymbolType getType()
Get the symbol type.

Constants

public static final int FLAG_ABSOLUTE

the symbol address is absolute

Constant Value: 8 (0x00000008)

public static final int FLAG_EXPORTED

the symbol represent an object that is exported (publicly exposed) by the code unit

Constant Value: 2 (0x00000002)

public static final int FLAG_FUNCTION_CODE_CONTIGUOUS

this flag may be used with FUNCTION symbols that have a non-zero symbol size: it serves to indicate that the routine code is a contiguous list of instructions (no inner data or undefined bytes, no loose basic blocks)

Constant Value: 4 (0x00000004)

public static final int FLAG_IMPORTED

the symbol represent an object that is imported by the code unit

Constant Value: 1 (0x00000001)

public static final int FLAG_METADATA

metadata symbols for linker or compiler, whose name is not useful

Constant Value: 16 (0x00000010)

Public Methods

public abstract int getFlags ()

Get the symbol flags. A valid combination of FLAG_xxx.

Returns
  • the flags

public abstract long getIdentifier ()

Get the symbol identifier. Optional.

Returns
  • the symbol identifier

public abstract String getName ()

Get the symbol name.

Special syntax for imported functions: the function name may be prefixed by the library name that contains it. A bang character is used as a separator. Example: kernel32.dll!Sleep
Note: the method name may be mangled; it may be fully qualified. The library name is optional; its extension is optional (eg, .dll, .so); it may be a full path.

Returns
  • the symbol name

public abstract int getProcessorMode ()

Retrieve the optional processor mode associated to this symbol, if the address points to code. This value is optional, implementations may return 0.

Returns
  • the optional processor mode (refer to IProcessor for standard values)

public abstract long getRelativeAddress ()

Get the base-relative address of the description of the symbol. Informative and optional.

Returns
  • the base-relative address of the symbol description

public abstract String getSymbolDataTypeInformation ()

Returns
  • may be null

public abstract long getSymbolRelativeAddress ()

Get the base-relative address of the symbol.

Returns
  • the symbol RVA

public abstract long getSymbolSize ()

Get the size of the symbol. May not be known.

Returns
  • the symbol size

public abstract SymbolType getType ()

Get the symbol type.

Returns
  • the type