public class

PEParser

extends Object
java.lang.Object
   ↳ com.pnfsoftware.jeb.core.units.codeobject.PEParser

Class Overview

A simple PE/PE64 parser (not relying on the IUnit interface) that may be used for convenience purposes.

Summary

Public Constructors
PEParser(IInput input)
Public Methods
long add(long address, long size)
Add an address (unsigned) to a size (unsigned) and return a sanitized address.
long convertFileOffsetToRelativeAddress(long offset)
long convertRelativeAddressToFileOffset(long rva)
ICOFFHeader getCOFFHeader()
IPEOptionalHeader getPEOptionalHeader()
ICOFFSectionHeader[] getSectionHeaders()
ISegmentInformation getSegment(int index)
int getSegmentCount()
List<ISegmentInformation> getSegments()
boolean isAddressInside(long a)
Determine if a legal address is within the bounds of the mapped PE file.
long sanitizeAddress(long address)
Sanitize a long to a legal address rel.
[Expand]
Inherited Methods
From class java.lang.Object

Public Constructors

public PEParser (IInput input)

Throws
IOException

Public Methods

public long add (long address, long size)

Add an address (unsigned) to a size (unsigned) and return a sanitized address.

Theoretically, this method should be used throughout the processing of various areas, eg imports, exports, etc. however, sanitizations are costly and clutter the code. Therefore, we limit them to filters before starting processing. Processing of a an area of the PE are wrapped in try-catch to avoid killing processing of the entire PE, should an error (eg, due to malformed structures) arise. This has the drawback of semi-neutering (only semi, because the exceptions are displayed and silently reported) parsing bugs that may be present.

public long convertFileOffsetToRelativeAddress (long offset)

public long convertRelativeAddressToFileOffset (long rva)

public ICOFFHeader getCOFFHeader ()

public IPEOptionalHeader getPEOptionalHeader ()

public ICOFFSectionHeader[] getSectionHeaders ()

public ISegmentInformation getSegment (int index)

public int getSegmentCount ()

public List<ISegmentInformation> getSegments ()

public boolean isAddressInside (long a)

Determine if a legal address is within the bounds of the mapped PE file.

public long sanitizeAddress (long address)

Sanitize a long to a legal address rel. to the PE specifications (32-bit or 64-bit space).