Method PEHeaders

examples/triage/headers.cpp:106–300

PEHeaders::PEHeaders(BinaryViewRef data)
{
	uint64_t peOffset = data->GetStart() + GetValueOfStructMember(data, "DOS_Header", data->GetStart(), "e_lfanew");
	uint64_t optHeaderStart = GetAddressAfterStruct(data, "COFF_Header", peOffset);

	BinaryNinja::DataBuffer peMagic = data->ReadBuffer(optHeaderStart, 2);
	bool is64bit;
	std::string optHeaderName;
	if ((peMagic.GetLength() == 2) && (peMagic[0] == 0x0b) && (peMagic[1] == 0x01))
	{
		optHeaderName = "PE32_Optional_Header";
		AddField("Type", "PE 32-bit");
		is64bit = false;
	}
	else if ((peMagic.GetLength() == 2) && (peMagic[0] == 0x0b) && (peMagic[1] == 0x02))
	{
		optHeaderName = "PE64_Optional_Header";
		AddField("Type", "PE 64-bit");
		is64bit = true;
	}
	else
	{
		AddField("Type", QString::fromStdString(data->GetTypeName()));
		if (data->GetDefaultPlatform())
			AddField("Platform", QString::fromStdString(data->GetDefaultPlatform()->GetName()));
		if (data->IsValidOffset(data->GetEntryPoint()))
			AddField("Entry Point", QString("0x") + QString::number(data->GetEntryPoint(), 16), CodeHeaderField);
		return;
	}

	uint64_t machineValue = GetValueOfStructMember(data, "COFF_Header", peOffset, "machine");
	QString machineName = GetNameOfEnumerationMember(data, "coff_machine", machineValue);
	if (machineName.startsWith("IMAGE_FILE_MACHINE_"))
		machineName = machineName.mid((int)strlen("IMAGE_FILE_MACHINE_"));
	AddField("Machine", machineName);

	AddField("Endianness", data->GetDefaultEndianness() == BigEndian ? "Big" : "Little");

	uint64_t subsysValue = GetValueOfStructMember(data, optHeaderName, optHeaderStart, "subsystem");
	QString subsysName = GetNameOfEnumerationMember(data, "pe_subsystem", subsysValue);
	if (subsysName.startsWith("IMAGE_SUBSYSTEM_"))
		subsysName = subsysName.mid((int)strlen("IMAGE_SUBSYSTEM_"));
	AddField("Subsystem", subsysName);

	uint64_t secs = GetValueOfStructMember(data, "COFF_Header", peOffset, "timeDateStamp");
	QDateTime t = QDateTime::fromSecsSinceEpoch(secs);
	AddField("Timestamp", t.toString());
	AddField("Timestamp (Hex)", QString::number(secs, 16).prepend("0x"));

	uint64_t currentBase = data->GetStart();
	AddField("Current Base", QString("0x") + QString::number(currentBase, 16), AddressHeaderField);

	uint64_t base = GetValueOfStructMember(data, optHeaderName, optHeaderStart, "imageBase");
	AddField("Image Base", QString("0x") + QString::number(base, 16), AddressHeaderField);

	uint64_t entryPoint = currentBase + GetValueOfStructMember(data, optHeaderName, optHeaderStart, "addressOfEntryPoint");
	AddField("Entry Point", QString("0x") + QString::number(entryPoint, 16), CodeHeaderField);