Method get_OptionalHeader

windows/pe_parse.py:341–357

(self)

    )

    def get_OptionalHeader(self):
        # We can have a 32bits PE with a 64 bits OptionalHeader
        # Ex  : PE32 .NET that allow to be loaded in 64b process
        # See: https://github.com/dotnet/runtime/blob/8bbe33819464216becffb7cf8b7ea8dd3bab5836/src/coreclr/src/vm/peimagelayout.cpp#L599
        # In this case the OptionalHeader is transformed in 64bits & OptionalHeader.Magic is changed accordingly
        # So we cannot just rely on get_NT_HEADER() to give us the correct OptionalHeader type. some re-check are required
        default_opth = self.get_NT_HEADER().OptionalHeader
        # Cannot juste compare types with type(default_opth) as it may be a remoteType
        current_opth_infos = (default_opth.Magic, ctypes.sizeof(default_opth))
        if current_opth_infos in self.STANDARD_OPTIONAL_HEADER_SIZE_PER_MAGIC:
            # The default OptionalHeader structure match what we expect based on the magic (most of the cases)
            return default_opth
        # Mismatch -> PE32 remapped as 64b (with OptionalHeader rewrite)
        # Remap the correct OptionalHeader
        opt_header_real_type = self.STANDARD_OPTIONAL_HEADER_TYPE_PER_MAGIC[default_opth.Magic]
        opt_header_addr = default_opth._base_addr if self.target else ctypes.addressof(default_opth)
        return self.transformers.create_structure_at(opt_header_real_type, opt_header_addr)

    def get_DataDirectory(self):
        return self.get_OptionalHeader().DataDirectory