Class SectionHeader

  • All Implemented Interfaces:
    ByteArrayConverter, StructConverter

    public class SectionHeader
    extends java.lang.Object
    implements StructConverter, ByteArrayConverter
    A class to the represent the IMAGE_SECTION_HEADER struct as defined in winnt.h.
     typedef struct _IMAGE_SECTION_HEADER {
        BYTE    Name[IMAGE_SIZEOF_SHORT_NAME];
        union {
                DWORD   PhysicalAddress;
                DWORD   VirtualSize;                        // MANDATORY
        } Misc;
        DWORD   VirtualAddress;                             // MANDATORY
        DWORD   SizeOfRawData;                              // MANDATORY
        DWORD   PointerToRawData;                           // MANDATORY
        DWORD   PointerToRelocations;
        DWORD   PointerToLinenumbers;
        WORD    NumberOfRelocations;
        WORD    NumberOfLinenumbers;
        DWORD   Characteristics;                            // MANDATORY
     } IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER; * 
     

    #define IMAGE_SIZEOF_SECTION_HEADER 40 *
    • Field Detail

      • NAME

        public static final java.lang.String NAME
        The name to use when converting into a structure data type.
        See Also:
        Constant Field Values
      • IMAGE_SIZEOF_SHORT_NAME

        public static final int IMAGE_SIZEOF_SHORT_NAME
        The size of the section header short name.
        See Also:
        Constant Field Values
      • IMAGE_SIZEOF_SECTION_HEADER

        public static final int IMAGE_SIZEOF_SECTION_HEADER
        The size of the section header.
        See Also:
        Constant Field Values
      • IMAGE_SCN_CNT_CODE

        public static final int IMAGE_SCN_CNT_CODE
        Section contains code.
        See Also:
        Constant Field Values
      • IMAGE_SCN_CNT_INITIALIZED_DATA

        public static final int IMAGE_SCN_CNT_INITIALIZED_DATA
        Section contains initialized data.
        See Also:
        Constant Field Values
      • IMAGE_SCN_CNT_UNINITIALIZED_DATA

        public static final int IMAGE_SCN_CNT_UNINITIALIZED_DATA
        Section contains uninitialized data.
        See Also:
        Constant Field Values
      • IMAGE_SCN_LNK_INFO

        public static final int IMAGE_SCN_LNK_INFO
        Section contains information for use by the linker. Only exists in OBJs.
        See Also:
        Constant Field Values
      • IMAGE_SCN_LNK_REMOVE

        public static final int IMAGE_SCN_LNK_REMOVE
        Section contents will not become part of the image. This only appears in OBJ files.
        See Also:
        Constant Field Values
      • IMAGE_SCN_LNK_COMDAT

        public static final int IMAGE_SCN_LNK_COMDAT
        Section contents is communal data (comdat). Communal data is data (or code) that can be defined in multiple OBJs. The linker will select one copy to include in the executable. Comdats are vital for support of C++ template functions and function-level linking. Comdat sections only appear in OBJ files.
        See Also:
        Constant Field Values
      • IMAGE_SCN_NO_DEFER_SPEC_EXC

        public static final int IMAGE_SCN_NO_DEFER_SPEC_EXC
        Reset speculative exceptions handling bits in the TLB entries for this section.
        See Also:
        Constant Field Values
      • IMAGE_SCN_GPREL

        public static final int IMAGE_SCN_GPREL
        Section content can be accessed relative to GP.
        See Also:
        Constant Field Values
      • IMAGE_SCN_ALIGN_1BYTES

        public static final int IMAGE_SCN_ALIGN_1BYTES
        Align on 1-byte boundary.
        See Also:
        Constant Field Values
      • IMAGE_SCN_ALIGN_2BYTES

        public static final int IMAGE_SCN_ALIGN_2BYTES
        Align on 2-byte boundary.
        See Also:
        Constant Field Values
      • IMAGE_SCN_ALIGN_4BYTES

        public static final int IMAGE_SCN_ALIGN_4BYTES
        Align on 4-byte boundary.
        See Also:
        Constant Field Values
      • IMAGE_SCN_ALIGN_8BYTES

        public static final int IMAGE_SCN_ALIGN_8BYTES
        Align on 8-byte boundary.
        See Also:
        Constant Field Values
      • IMAGE_SCN_ALIGN_16BYTES

        public static final int IMAGE_SCN_ALIGN_16BYTES
        Align on 16-byte boundary.
        See Also:
        Constant Field Values
      • IMAGE_SCN_ALIGN_32BYTES

        public static final int IMAGE_SCN_ALIGN_32BYTES
        Align on 32-byte boundary.
        See Also:
        Constant Field Values
      • IMAGE_SCN_ALIGN_64BYTES

        public static final int IMAGE_SCN_ALIGN_64BYTES
        Align on 64-byte boundary.
        See Also:
        Constant Field Values
      • IMAGE_SCN_ALIGN_128BYTES

        public static final int IMAGE_SCN_ALIGN_128BYTES
        Align on 128-byte boundary.
        See Also:
        Constant Field Values
      • IMAGE_SCN_ALIGN_256BYTES

        public static final int IMAGE_SCN_ALIGN_256BYTES
        Align on 256-byte boundary.
        See Also:
        Constant Field Values
      • IMAGE_SCN_ALIGN_512BYTES

        public static final int IMAGE_SCN_ALIGN_512BYTES
        Align on 512-byte boundary.
        See Also:
        Constant Field Values
      • IMAGE_SCN_ALIGN_1024BYTES

        public static final int IMAGE_SCN_ALIGN_1024BYTES
        Align on 1024-byte boundary.
        See Also:
        Constant Field Values
      • IMAGE_SCN_ALIGN_2048BYTES

        public static final int IMAGE_SCN_ALIGN_2048BYTES
        Align on 2048-byte boundary.
        See Also:
        Constant Field Values
      • IMAGE_SCN_ALIGN_4096BYTES

        public static final int IMAGE_SCN_ALIGN_4096BYTES
        Align on 4096-byte boundary.
        See Also:
        Constant Field Values
      • IMAGE_SCN_ALIGN_8192BYTES

        public static final int IMAGE_SCN_ALIGN_8192BYTES
        Align on 8192-byte boundary.
        See Also:
        Constant Field Values
      • IMAGE_SCN_LNK_NRELOC_OVFL

        public static final int IMAGE_SCN_LNK_NRELOC_OVFL
        Section contains extended relocations.
        See Also:
        Constant Field Values
      • IMAGE_SCN_MEM_DISCARDABLE

        public static final int IMAGE_SCN_MEM_DISCARDABLE
        The section can be discarded from the final executable. Used to hold information for the linker's use, including the .debug$ sections.
        See Also:
        Constant Field Values
      • IMAGE_SCN_MEM_NOT_CACHED

        public static final int IMAGE_SCN_MEM_NOT_CACHED
        Section is not cachable.
        See Also:
        Constant Field Values
      • IMAGE_SCN_MEM_NOT_PAGED

        public static final int IMAGE_SCN_MEM_NOT_PAGED
        The section is not pageable, so it should always be physically present in memory. Often used for kernel-mode drivers.
        See Also:
        Constant Field Values
      • IMAGE_SCN_MEM_SHARED

        public static final int IMAGE_SCN_MEM_SHARED
        Section is shareable. The physical pages containing this section's data will be shared between all processes that have this executable loaded. Thus, every process will see the exact same values for data in this section. Useful for making global variables shared between all instances of a process. To make a section shared, use the /section:name,S linker switch.
        See Also:
        Constant Field Values
      • IMAGE_SCN_MEM_EXECUTE

        public static final int IMAGE_SCN_MEM_EXECUTE
        Section is executable.
        See Also:
        Constant Field Values
      • IMAGE_SCN_MEM_READ

        public static final int IMAGE_SCN_MEM_READ
        Section is readable.
        See Also:
        Constant Field Values
      • IMAGE_SCN_MEM_WRITE

        public static final int IMAGE_SCN_MEM_WRITE
        Section is writeable.
        See Also:
        Constant Field Values
    • Constructor Detail

      • SectionHeader

        public SectionHeader()
        DO NOT USE THIS CONSTRUCTOR, USE create*(GenericFactory ...) FACTORY METHODS INSTEAD.
    • Method Detail

      • getName

        public java.lang.String getName()
        Returns the ASCII name of the section. A section name is not guaranteed to be null-terminated. If you specify a section name longer than eight characters, the linker truncates it to eight characters in the executable. A mechanism exists for allowing longer section names in OBJ files. Section names often start with a period, but this is not a requirement. Section names with a $ in the name get special treatment from the linker. Sections with identical names prior to the $ character are merged. The characters following the $ provide an alphabetic ordering for how the merged sections appear in the final section. There's quite a bit more to the subject of sections with $ in the name and how they're combined, but the details are outside the scope of this article
        Returns:
        the ASCII name of the section
      • getReadableName

        public java.lang.String getReadableName()
        Returns a readable ascii version of the name. All non-readable characters are replaced with underscores.
        Returns:
        a readable ascii version of the name
      • getPhysicalAddress

        public int getPhysicalAddress()
        Returns the physical (file) address of this section.
        Returns:
        the physical (file) address of this section
      • getVirtualAddress

        public int getVirtualAddress()
        In executables, returns the RVA where the section begins in memory. Should be set to 0 in OBJs. this section should be loaded into memory.
        Returns:
        the RVA where the section begins in memory.
      • getVirtualSize

        public int getVirtualSize()
        Returns the actual, used size of the section. This field may be larger or smaller than the SizeOfRawData field. If the VirtualSize is larger, the SizeOfRawData field is the size of the initialized data from the executable, and the remaining bytes up to the VirtualSize should be zero-padded. This field is set to 0 in OBJ files.
        Returns:
        the actual, used size of the section
      • getSizeOfRawData

        public int getSizeOfRawData()
        Returns the size (in bytes) of data stored for the section in the executable or OBJ.
        Returns:
        the size (in bytes) of data stored for the section
      • getPointerToRawData

        public int getPointerToRawData()
        Returns the file offset where the data for the section begins. For executables, this value must be a multiple of the file alignment given in the PE header.
        Returns:
        the file offset where the data for the section begins
      • getPointerToRelocations

        public int getPointerToRelocations()
        Returns the file offset of relocations for this section.
        Returns:
        the file offset of relocations for this section
      • getNumberOfRelocations

        public short getNumberOfRelocations()
        Returns the number of relocations pointed to by the PointerToRelocations field.
        Returns:
        the number of relocations
      • getPointerToLinenumbers

        public int getPointerToLinenumbers()
        Return the file offset for COFF-style line numbers for this section.
        Returns:
        the file offset for COFF-style line numbers for this section
      • getCharacteristics

        public int getCharacteristics()
        Returns the flags OR'ed together, indicating the attributes of this section. Many of these flags can be set with the linker's /SECTION option. Common values include those listed in Figure 7.
        Returns:
        the flags OR'ed together, indicating the attributes of this section
      • getNumberOfLinenumbers

        public short getNumberOfLinenumbers()
        Returns the number of line numbers pointed to by the NumberOfRelocations field.
        Returns:
        the number of line numbers
      • toBytes

        public byte[] toBytes​(DataConverter dc)
                       throws java.io.IOException
        Description copied from interface: ByteArrayConverter
        Returns a byte array representing this implementor of this interface.
        Specified by:
        toBytes in interface ByteArrayConverter
        Parameters:
        dc - the data converter to use
        Returns:
        a byte array representing this object
        Throws:
        java.io.IOException
      • getDataStream

        public java.io.InputStream getDataStream()
                                          throws java.io.IOException
        Returns an input stream to underlying bytes of this section.
        Returns:
        an input stream to underlying bytes of this section
        Throws:
        java.io.IOException - if an i/o error occurs.
      • toString

        public java.lang.String toString()
        Overrides:
        toString in class java.lang.Object
        See Also:
        Object.toString()
      • toDataType

        public DataType toDataType()
                            throws DuplicateNameException
        Description copied from interface: StructConverter
        Returns a structure datatype representing the contents of the implementor of this interface.

        For example, given:

         class A {
             int foo;
             double bar;
         }
         

        The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.

        Specified by:
        toDataType in interface StructConverter
        Returns:
        returns a structure datatype representing the implementor of this interface
        Throws:
        DuplicateNameException - when a datatype of the same name already exists
        See Also:
        StructureDataType
      • writeHeader

        public void writeHeader​(java.io.RandomAccessFile raf,
                                DataConverter dc)
                         throws java.io.IOException
        Writes this section header to the specified random access file.
        Parameters:
        raf - the random access file
        dc - the data converter
        Throws:
        java.io.IOException - if an I/O error occurs
      • writeBytes

        public void writeBytes​(java.io.RandomAccessFile raf,
                               int rafIndex,
                               DataConverter dc,
                               MemoryBlock block,
                               boolean useBlockBytes)
                        throws java.io.IOException,
                               MemoryAccessException
        Writes the bytes from this section into the specified random access file. The bytes will be written starting at the byte position specified by getPointerToRawData().
        Parameters:
        raf - the random access file
        rafIndex - the index into the RAF where the bytes will be written
        dc - the data converter
        block - the memory block corresponding to this section
        useBlockBytes - if true, then use the bytes from the memory block, otherwise use the bytes from this section.
        Throws:
        java.io.IOException - if there are errors writing to the file
        MemoryAccessException - if the byte from the memory block cannot be accesses
      • setVirtualSize

        public void setVirtualSize​(int size)
      • setSizeOfRawData

        public void setSizeOfRawData​(int size)