Package ghidra.app.util.bin.format.pe

Class ThunkData

  • All Implemented Interfaces:
    ByteArrayConverter, StructConverter
    public class ThunkData
extends java.lang.Object
implements StructConverter, ByteArrayConverter
    A class to represent the IMAGE_THUNK_DATA32 struct as defined in winnt.h. 
     typedef struct _IMAGE_THUNK_DATA32 {
     union {
         DWORD ForwarderString;  // PBYTE
         DWORD Function;         // PDWORD
         DWORD Ordinal;
         DWORD AddressOfData;    // PIMAGE_IMPORT_BY_NAME
     } u1;
 } IMAGE_THUNK_DATA32;
 typedef IMAGE_THUNK_DATA32 * PIMAGE_THUNK_DATA32;
 
     typedef struct _IMAGE_THUNK_DATA64 {
     union {
         PBYTE  ForwarderString;
         PDWORD Function;
         ULONGLONG Ordinal;
         PIMAGE_IMPORT_BY_NAME  AddressOfData;
     } u1;
 } IMAGE_THUNK_DATA64;
 typedef IMAGE_THUNK_DATA64 * PIMAGE_THUNK_DATA64;

    • Constructor Detail

      • ThunkData

        public ThunkData()
        DO NOT USE THIS CONSTRUCTOR, USE create*(GenericFactory ...) FACTORY METHODS INSTEAD.

      • ThunkData

        public ThunkData​(int value)
        Constructs a new thunk data with the specified value
        Parameters:
        value - the new thunk value

    • Method Detail

      • getStructSize

        public int getStructSize()
        Returns the size of the thunk (in bytes) based on the size of the executable (32 vs 64 bit).
        Returns:
        the size of the thunk (in bytes)

      • getStructName

        public java.lang.String getStructName()
        Returns the struct name.
        Returns:
        the struct name

      • setValue

        public void setValue​(int value)
        Sets the value of the thunk.
        Parameters:
        value - the new thunk value

      • getForwarderString

        public long getForwarderString()
        Returns the forward string pointer.
        Returns:
        the forward string pointer

      • getFunction

        public long getFunction()
        Returns the function pointer.
        Returns:
        the function pointer

      • getOrdinal

        public long getOrdinal()
        Returns the ordinal.
        Returns:
        the ordinal

      • isOrdinal

        public boolean isOrdinal()

      • getAddressOfData

        public long getAddressOfData()
        Returns the address of the data.
        Returns:
        the address of the data

      • getImportByName

        public ImportByName getImportByName()
        Returns the underlying import by name structure.
        Returns:
        the underlying import by name structure

      • toDataType

        public DataType toDataType()
                    throws DuplicateNameException
        Description copied from interface: StructConverter
        Returns a structure datatype representing the contents of the implementor of this interface.

        For example, given: 

         class A {
     int foo;
     double bar;
 }

        The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.

        Specified by:
        toDataType in interface StructConverter
        Returns:
        returns a structure datatype representing the implementor of this interface
        Throws:
        DuplicateNameException - when a datatype of the same name already exists
        See Also:
        StructConverter.toDataType()