Class NTHeader

java.lang.Object
ghidra.app.util.bin.format.pe.NTHeader
All Implemented Interfaces:
OffsetValidator, StructConverter
public class NTHeader extends Object implements StructConverter, OffsetValidator

A class to represent the IMAGE_NT_HEADERS32 and IMAGE_NT_HEADERS64 structures as defined in winnt.h

typedef struct _IMAGE_NT_HEADERS {
    DWORD Signature;
    IMAGE_FILE_HEADER FileHeader;
    IMAGE_OPTIONAL_HEADER32 OptionalHeader;
};

  • Field Details

    • SIZEOF_SIGNATURE

      public static final int SIZEOF_SIGNATURE
      The size of the NT header signature.
      See Also:

    • MAX_SANE_COUNT

      public static final int MAX_SANE_COUNT
      See Also:

  • Constructor Details

  • Method Details

    • getName

      public String getName()
      Returns the name to use when converting into a structure data type.
      Returns:
      the name to use when converting into a structure data type

    • isRVAResoltionSectionAligned

      public boolean isRVAResoltionSectionAligned()

    • getFileHeader

      public FileHeader getFileHeader()
      Returns the file header.
      Returns:
      the file header

    • getOptionalHeader

      public OptionalHeader getOptionalHeader()
      Returns the optional header.
      Returns:
      the optional header

    • toDataType

      public DataType toDataType() throws DuplicateNameException, IOException
      Description copied from interface: StructConverter
      Returns a structure datatype representing the contents of the implementor of this interface.

      For example, given: 

      class A {
    int foo;
    double bar;
}

      The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.

      Specified by:
      toDataType in interface StructConverter
      Returns:
      returns a structure datatype representing the implementor of this interface
      Throws:
      DuplicateNameException - when a datatype of the same name already exists
      IOException - if an IO-related error occurs
      See Also:

    • rvaToPointer

      public int rvaToPointer(int rva)
      Returns the given relative virtual address (RVA) converted into a pointer into the binary image, or -1 if not valid.
      Parameters:
      rva - the relative virtual address
      Returns:
      the given relative virtual address (RVA) converted into a pointer into the binary image, or -1 if not valid

    • rvaToPointer

      public long rvaToPointer(long rva)
      Returns the given relative virtual address (RVA) converted into a pointer into the binary image, or -1 if not valid.
      Parameters:
      rva - the relative virtual address
      Returns:
      the given relative virtual address (RVA) converted into a pointer into the binary image, or -1 if not valid

    • checkPointer

      public boolean checkPointer(long ptr)
      Description copied from interface: OffsetValidator
      Returns whether or not the specified pointer is contained within the PE file.
      Specified by:
      checkPointer in interface OffsetValidator
      Parameters:
      ptr - the pointer value to check
      Returns:
      whether or not the specified pointer is contained within the PE file

    • checkRVA

      public boolean checkRVA(long rva)
      Description copied from interface: OffsetValidator
      Returns whether or not the specified RVA value is contained within the PE image.
      Specified by:
      checkRVA in interface OffsetValidator
      Parameters:
      rva - the RVA to check
      Returns:
      whether or not the specified RVA value is contained within the PE image

    • getSectionAlignment NEW

      public int getSectionAlignment()
      Description copied from interface: OffsetValidator
      Returns the PE's sectionAlignment, or 0 if unknown/unused.
      Specified by:
      getSectionAlignment in interface OffsetValidator
      Returns:
      the PE's sectionAlignment, or 0 if unknown/unused

    • getFileAlignment NEW

      public int getFileAlignment()
      Description copied from interface: OffsetValidator
      Returns the PE's file alignment, or 0 if unknown/unused.
      Specified by:
      getFileAlignment in interface OffsetValidator
      Returns:
      the PE's file alignment, or 0 if unknown/unused

    • vaToPointer

      public int vaToPointer(int va)
      Returns the given virtual address (VA) converted into a pointer into the binary image, or -1 if not valid.
      Parameters:
      va - the virtual address
      Returns:
      the given virtual address (VA) converted into a pointer into the binary image, or -1 if not valid

    • vaToPointer

      public long vaToPointer(long va)
      Returns the given virtual address (VA) converted into a pointer into the binary image, or -1 if not valid.
      Parameters:
      va - the virtual address
      Returns:
      the given virtual address (VA) converted into a pointer into the binary image, or -1 if not valid