Package ghidra.app.util.bin.format.pe

# Class NTHeader

java.lang.Object
ghidra.app.util.bin.format.pe.NTHeader

All Implemented Interfaces:
  `OffsetValidator`, `StructConverter`

public class NTHeader extends Object implements StructConverter, OffsetValidator
A class to represent the `IMAGE_NT_HEADERS32` and IMAGE_NT_HEADERS64 structs as defined in `winnt.h`.

     typedef struct _IMAGE_NT_HEADERS {
        DWORD Signature;
        IMAGE_FILE_HEADER FileHeader;
        IMAGE_OPTIONAL_HEADER32 OptionalHeader;
     };

- ## Field Summary

  Fields
  Modifier and Type
  Field
  Description
  `static final int`
  `MAX_SANE_COUNT`
  `static final int`
  `SIZEOF_SIGNATURE`
  The size of the NT header signature.

  ### Fields inherited from interface ghidra.app.util.bin.StructConverter

  `ASCII, BYTE, DWORD, IBO32, IBO64, POINTER, QWORD, SLEB128, STRING, ULEB128, UTF16, UTF8, VOID, WORD`

- ## Constructor Summary

  Constructors
  Constructor
  Description
  `NTHeader(BinaryReader reader, int index, PortableExecutable.SectionLayout layout, boolean advancedProcess, boolean parseCliHeaders)`
  Constructs a new NT header.

- ## Method Summary

  Modifier and Type
  Method
  Description
  `boolean`
  `checkPointer(long ptr)`
  `boolean`
  `checkRVA(long rva)`
  `FileHeader`
  `getFileHeader()`
  Returns the file header.
  `String`
  `getName()`
  Returns the name to use when converting into a structure data type.
  `OptionalHeader`
  `getOptionalHeader()`
  Returns the optional header.
  `boolean`
  `isRVAResoltionSectionAligned()`
  `int`
  `rvaToPointer(int rva)`
  Converts a relative virtual address (RVA) into a pointer.
  `long`
  `rvaToPointer(long rva)`
  Converts a relative virtual address (RVA) into a pointer.
  `DataType`
  `toDataType()`
  Returns a structure datatype representing the contents of the implementor of this interface.
  `int`
  `vaToPointer(int va)`
  Converts a virtual address (VA) into a pointer.
  `long`
  `vaToPointer(long va)`
  Converts a virtual address (VA) into a pointer.

  ### Methods inherited from class java.lang.Object

  `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- ## Field Details

  - ### SIZEOF_SIGNATURE

    public static final int SIZEOF_SIGNATURE
    The size of the NT header signature.
    See Also:
      - Constant Field Values

  - ### MAX_SANE_COUNT

    public static final int MAX_SANE_COUNT
    See Also:
      - Constant Field Values

- ## Constructor Details

  - ### NTHeader

    public NTHeader(BinaryReader reader, int index, PortableExecutable.SectionLayout layout, boolean advancedProcess, boolean parseCliHeaders) throws InvalidNTHeaderException, IOException
    Constructs a new NT header.
    Parameters:
      `reader` - the binary reader
      `index` - the index into the reader to the start of the NT header
      `layout` - The `PortableExecutable.SectionLayout`
      `advancedProcess` - if true, information outside of the base header will be processed
      `parseCliHeaders` - if true, CLI headers are parsed (if present)
    Throws:
      `InvalidNTHeaderException` - if the bytes the specified index
      `IOException` - if an IO-related exception occurred do not constitute an accurate NT header.

- ## Method Details

  - ### getName

    public String getName()
    Returns the name to use when converting into a structure data type.
    Returns:
      the name to use when converting into a structure data type

  - ### isRVAResoltionSectionAligned

    public boolean isRVAResoltionSectionAligned()

  - ### getFileHeader

    public FileHeader getFileHeader()
    Returns the file header.
    Returns:
      the file header

  - ### getOptionalHeader

    public OptionalHeader getOptionalHeader()
    Returns the optional header.
    Returns:
      the optional header

  - ### toDataType

    public DataType toDataType() throws DuplicateNameException, IOException
    Description copied from interface: `StructConverter`
    Returns a structure datatype representing the contents of the implementor of this interface.

    For example, given:

         class A {
             int foo;
             double bar;
         }

    The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.

    Specified by:
      `toDataType` in interface `StructConverter`
    Returns:
      returns a structure datatype representing the implementor of this interface
    Throws:
      `DuplicateNameException` - when a datatype of the same name already exists
      `IOException`
    See Also:
      - `StructConverter.toDataType()`

  - ### rvaToPointer

    public int rvaToPointer(int rva)
    Converts a relative virtual address (RVA) into a pointer.
    Parameters:
      `rva` - the relative virtual address
    Returns:
      the pointer into binary image, 0 if not valid

  - ### rvaToPointer

    public long rvaToPointer(long rva)
    Converts a relative virtual address (RVA) into a pointer.
    Parameters:
      `rva` - the relative virtual address
    Returns:
      the pointer into binary image, 0 if not valid

  - ### checkPointer

    public boolean checkPointer(long ptr)
    Specified by:
      `checkPointer` in interface `OffsetValidator`

  - ### checkRVA

    public boolean checkRVA(long rva)
    Specified by:
      `checkRVA` in interface `OffsetValidator`

  - ### vaToPointer

    public int vaToPointer(int va)
    Converts a virtual address (VA) into a pointer.
    Parameters:
      `va` - the virtual address
    Returns:
      the pointer into binary image, 0 if not valid

  - ### vaToPointer

    public long vaToPointer(long va)
    Converts a virtual address (VA) into a pointer.
    Parameters:
      `va` - the virtual address
    Returns:
      the pointer into binary image, 0 if not valid