Class LoadConfiguration

Namespace

AsmResolver.PE.Configuration

Assembly

AsmResolver.PE.dll

Defines options for the Windows PE loader.

public class LoadConfiguration : SegmentBase, ISegment, IOffsetProvider, IWritable, IRelocatable

Inheritance

object

SegmentBase

LoadConfiguration

Implements

ISegment

IOffsetProvider

IWritable

IRelocatable

Derived

SerializedLoadConfiguration

Inherited Members

SegmentBase.Offset

SegmentBase.Rva

SegmentBase.CanUpdateOffsets

SegmentBase.GetVirtualSize()

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Constructors

LoadConfiguration()

Creates a new empty minimal 32-bit load configuration.

public LoadConfiguration()

LoadConfiguration(LoadConfigurationField, bool)

Creates a new empty load configuration with the provided size.

public LoadConfiguration(LoadConfigurationField lastIncludedField, bool is32Bit = true)

Parameters

lastIncludedField LoadConfigurationField

Specifies the last field that is to be included in the new configuration.

is32Bit bool

true if a 32-bit directory is to be created, false for 64-bit.

LoadConfiguration(uint, bool)

Creates a new empty load configuration with the provided size.

public LoadConfiguration(uint size, bool is32Bit)

Parameters

size uint

The size of the configuration

is32Bit bool

true if a 32-bit directory is to be created, false for 64-bit.

Properties

CastGuardOsDeterminedFailureMode

Gets or sets a reference to the variable that holds a bitmask/enum dictating how the runtime reacts when an invalid cast is detected.

public ISegmentReference CastGuardOsDeterminedFailureMode { get; set; }

Property Value

ISegmentReference

ChpeMetadataPointer

Gets or sets a reference to Compiled Hybrid Portable Executable (CHPE) metadata for ARM64EC/ARM64X emulation.

public ISegmentReference ChpeMetadataPointer { get; set; }

Property Value

ISegmentReference

CodeIntegrityCatalog

Gets or sets the catalog index or ID.

public ushort CodeIntegrityCatalog { get; set; }

Property Value

ushort

Remarks

This value is set to 0xFFFF if unavailable.

CodeIntegrityFlags

Gets or sets flags regarding code integrity encofrement.

public ushort CodeIntegrityFlags { get; set; }

Property Value

ushort

CodeIntegrityOffset

Gets or sets the offset to the catalog location.

public uint CodeIntegrityOffset { get; set; }

Property Value

uint

CodeIntegrityReserved

Reserved for future OS/bitmask expansion

public uint CodeIntegrityReserved { get; set; }

Property Value

uint

CriticalSectionDefaultTimeout

Gets or sets the default timeout value to use for this process's critical sections that are abandoned.

public uint CriticalSectionDefaultTimeout { get; set; }

Property Value

uint

CsdVersion

Gets or sets the service pack version identifier.

public ushort CsdVersion { get; set; }

Property Value

ushort

DeCommitFreeBlockThreshold

Gets or sets the amount of memory that must be freed before it is returned to the system, in bytes.

public ulong DeCommitFreeBlockThreshold { get; set; }

Property Value

ulong

Remarks

On 32-bit platforms, this field is restricted to 32-bit sizes (max 4GB).

DeCommitTotalFreeThreshold

Gets or sets the total amount of free memory, in bytes.

public ulong DeCommitTotalFreeThreshold { get; set; }

Property Value

ulong

Remarks

On 32-bit platforms, this field is restricted to 32-bit sizes (max 4GB).

DependentLoadFlags

Gets or sets the default load flags used when the operating system resolves the statically linked imports of a module.

public ushort DependentLoadFlags { get; set; }

Property Value

ushort

DynamicValueRelocTable

Gets or sets a reference to the extended dynamic relocation table used for security features like DVRT / Retpoline / Shadow Stacks / Address Space Layout Randomization (ASLR).

public ISegmentReference DynamicValueRelocTable { get; set; }

Property Value

ISegmentReference

DynamicValueRelocTableOffset

Gets or sets the byte offset relative to the beginning of the section specified by DynamicValueRelocTableSection where the dynamic relocation table starts.

public uint DynamicValueRelocTableOffset { get; set; }

Property Value

uint

DynamicValueRelocTableSection

Gets or sets the 1-based index of the PE section that contains the dynamic value table.

public ushort DynamicValueRelocTableSection { get; set; }

Property Value

ushort

EditList

Reserved for use by the system.

public ISegmentReference EditList { get; set; }

Property Value

ISegmentReference

EnclaveConfigurationPointer

Gets or sets the reference to the Intel SGX / VBS Enclave configuration directory.

public ISegmentReference EnclaveConfigurationPointer { get; set; }

Property Value

ISegmentReference

GlobalFlagsClear

Gets or sets the global loader flags to clear for this process as the loader starts the process.

public uint GlobalFlagsClear { get; set; }

Property Value

uint

GlobalFlagsSet

Gets or sets the global loader flags to set for this process as the loader starts the process.

public uint GlobalFlagsSet { get; set; }

Property Value

uint

GuardAddressTakenIatEntryTable

Gets or sets the Control Flow Guard address taken IAT table.

public ControlFlowGuardFunctionTable GuardAddressTakenIatEntryTable { get; }

Property Value

ControlFlowGuardFunctionTable

GuardCFCheckFunctionPointer

Gets or sets the address where the Control Flow Guard check-function pointer is stored.

public ISegmentReference GuardCFCheckFunctionPointer { get; set; }

Property Value

ISegmentReference

GuardCFDispatchFunctionPointer

Gets or sets the address where the Control Flow Guard dispatch-function pointer is stored.

public ISegmentReference GuardCFDispatchFunctionPointer { get; set; }

Property Value

ISegmentReference

GuardCFFunctionTable

Gets or sets the sorted table of RVAs of each Control Flow Guard function in the image.

public ControlFlowGuardFunctionTable GuardCFFunctionTable { get; }

Property Value

ControlFlowGuardFunctionTable

GuardEHContinuationTable

Gets a table of valid continuation targets for Exception Handling (XFG / EH Continuation Guard, protecting exception return points like catch blocks from ROP attacks).

public ControlFlowGuardFunctionTable GuardEHContinuationTable { get; }

Property Value

ControlFlowGuardFunctionTable

GuardFlags

Gets or sets Control Flow Guard related flags.

public GuardFlags GuardFlags { get; set; }

Property Value

GuardFlags

GuardLongJumpTargetTable

Gets or sets the Control Flow Guard long jump target table.

public ControlFlowGuardFunctionTable GuardLongJumpTargetTable { get; }

Property Value

ControlFlowGuardFunctionTable

GuardMemcpyFunctionPointer

Gets or sets the reference to the pointer that points to a high-performance, guarded memcpy routine provided by the OS.

public ISegmentReference GuardMemcpyFunctionPointer { get; set; }

Property Value

ISegmentReference

GuardRFFailureRoutine

Gets or sets a reference to the Return Flow Guard (RFG) failure handler routine.

public ISegmentReference GuardRFFailureRoutine { get; set; }

Property Value

ISegmentReference

GuardRFFailureRoutineFunctionPointer

Gets or sets a reference to the pointer variable holding the RFG failure routine.

public ISegmentReference GuardRFFailureRoutineFunctionPointer { get; set; }

Property Value

ISegmentReference

GuardRFVerifyStackPointerFunctionPointer

Gets or sets a reference to the function that verifies stack integrity under RFG.

public ISegmentReference GuardRFVerifyStackPointerFunctionPointer { get; set; }

Property Value

ISegmentReference

GuardXFGCheckFunctionPointer

Gets or sets the reference to the Extended Flow Guard (XFG) type-checking function pointer.

public ISegmentReference GuardXFGCheckFunctionPointer { get; set; }

Property Value

ISegmentReference

GuardXFGDispatchFunctionPointer

Gets or sets the reference to the XFG dispatch function pointer.

public ISegmentReference GuardXFGDispatchFunctionPointer { get; set; }

Property Value

ISegmentReference

GuardXFGTableDispatchFunctionPointer

Gets or sets the reference to the XFG table-based dispatch function pointer.

public ISegmentReference GuardXFGTableDispatchFunctionPointer { get; set; }

Property Value

ISegmentReference

HotPatchTableOffset

Gets or sets the location of the binary's Hotpatch Header / Table, relative to the beginning of the load configuration directory.

public uint HotPatchTableOffset { get; set; }

Property Value

uint

Is32Bit

Gets a value indicating whether this configuration directory is using the 32-bit or 64-bit format.

public bool Is32Bit { get; }

Property Value

bool

LockPrefixTable

Gets or sets a list of addresses where the LOCK prefix is used so that they can be replaced with NOP on single processor machines.

public ReferenceTable LockPrefixTable { get; }

Property Value

ReferenceTable

Remarks

This field is only used in x86 PE images.

MajorVersion

Gets or sets the major version number of the loader configuration data.

public ushort MajorVersion { get; set; }

Property Value

ushort

MaximumAllocationSize

Gets or sets the maximum allocation size, in bytes.

public ulong MaximumAllocationSize { get; set; }

Property Value

ulong

Remarks

On 32-bit platforms, this field is restricted to 32-bit sizes (max 4GB).

MinorVersion

Gets or sets the minor version number of the loader configuration data.

public ushort MinorVersion { get; set; }

Property Value

ushort

ProcessAffinityMask

When non-zero, gets or sets the affinity mask during process startup (executables only).

public ulong ProcessAffinityMask { get; set; }

Property Value

ulong

Remarks

On 32-bit platforms, this field is restricted to 32-bit sizes.

ProcessHeapFlags

Gets or sets the process heap flags that correspond to the first argument of the HeapCreate function. These flags apply to the process heap that is created during process startup.

public uint ProcessHeapFlags { get; set; }

Property Value

uint

Reserved2

Reserved

public ushort Reserved2 { get; set; }

Property Value

ushort

Reserved3

Reserved

public uint Reserved3 { get; set; }

Property Value

uint

SEHandlerTable

Gets the sorted table of RVAs of each valid, unique SE handler in the image.

public ReferenceTable SEHandlerTable { get; }

Property Value

ReferenceTable

Remarks

This field is only used in x86 PE images.

SecurityCookie

Gets or sets the cookie that is used by Visual C++ or GS implementation.

public ISegment? SecurityCookie { get; set; }

Property Value

ISegment

Remarks

For valid PEs, this is always either pointing to a 32-bits or a 64-bits cookie.

Size

Gets or sets the size in bytes of the load configuration that is persisted.

public uint Size { get; set; }

Property Value

uint

Remarks

This value determines which fields are included in the configuration. Use HasField(LoadConfigurationField) and GetFieldOffset(LoadConfigurationField) to inspect which fields are included based on this value.

TimeDateStamp

Date and time stamp value. The value is represented in the number of seconds that have elapsed since midnight (00:00:00), January 1, 1970, Universal Coordinated Time, according to the system clock. The time stamp can be printed by using the C runtime (CRT) time function.

public uint TimeDateStamp { get; set; }

Property Value

uint

UmaFunctionPointers

Gets or sets the reference to the pointer to User-Mode Application / User-Mode Execution pointers (reserved for specialized OS runtime hooks).

public ISegmentReference UmaFunctionPointers { get; set; }

Property Value

ISegmentReference

VirtualMemoryThreshold

Gets or sets the maximum virtual memory size, in bytes.

public ulong VirtualMemoryThreshold { get; set; }

Property Value

ulong

Remarks

On 32-bit platforms, this field is restricted to 32-bit sizes (max 4GB).

VolatileMetadataPointer

Gets or sets the reference to metadata describing volatile code/data regions for hot-patching.

public ISegmentReference VolatileMetadataPointer { get; set; }

Property Value

ISegmentReference

Methods

EnsureFieldIsIncluded(LoadConfigurationField)

Ensures the directory Size is large enough to include the provided field in the configuration.

public void EnsureFieldIsIncluded(LoadConfigurationField field)

Parameters

field LoadConfigurationField

The field to include.

GetFieldEndOffset(LoadConfigurationField)

Gets the end offset of the provided field, relative to the start of the directory.

public uint GetFieldEndOffset(LoadConfigurationField field)

Parameters

field LoadConfigurationField

The field

Returns

uint

The end offset

GetFieldOffset(LoadConfigurationField)

Gets the offset of the provided field, relative to the start of the directory.

public uint GetFieldOffset(LoadConfigurationField field)

Parameters

field LoadConfigurationField

The field

Returns

uint

The offset

GetGuardAddressTakenIatEntryTable()

Obtains the control flow guard IAT function table.

protected virtual ControlFlowGuardFunctionTable GetGuardAddressTakenIatEntryTable()

Returns

ControlFlowGuardFunctionTable

The function table.

Remarks

This method is called upon initialization of the GuardAddressTakenIatEntryTable property.

GetGuardCFFunctionTable()

Obtains the Guard CF function table.

protected virtual ControlFlowGuardFunctionTable GetGuardCFFunctionTable()

Returns

ControlFlowGuardFunctionTable

The function table.

Remarks

This method is called upon initialization of the GuardCFFunctionTable property.

GetGuardEHContinuationTable()

Obtains the control flow guard continuation table.

protected virtual ControlFlowGuardFunctionTable GetGuardEHContinuationTable()

Returns

ControlFlowGuardFunctionTable

The table.

Remarks

This method is called upon initialization of the GuardEHContinuationTable property.

GetGuardLongJumpTargetTable()

Obtains the control flow guard jump target table.

protected virtual ControlFlowGuardFunctionTable GetGuardLongJumpTargetTable()

Returns

ControlFlowGuardFunctionTable

The jump target table.

Remarks

This method is called upon initialization of the GuardLongJumpTargetTable property.

GetLockPrefixTable()

Obtains the lock prefix table.

protected virtual ReferenceTable GetLockPrefixTable()

Returns

ReferenceTable

The lock prefix table.

Remarks

This method is called upon initialization of the LockPrefixTable property.

GetPhysicalSize()

Computes the number of bytes that the structure contains.

public override uint GetPhysicalSize()

Returns

uint

The number of bytes.

GetRequiredBaseRelocations()

Obtains a collection of base address relocations that need to be applied to the object after the image was loaded into memory.

public IEnumerable<BaseRelocation> GetRequiredBaseRelocations()

Returns

IEnumerable<BaseRelocation>

The required base relocations.

GetSEHandlerTable()

Obtains the SEH handler table.

protected virtual ReferenceTable GetSEHandlerTable()

Returns

ReferenceTable

The function table.

Remarks

This method is called upon initialization of the SEHandlerTable property.

GetSecurityCookie()

Obtains the security cookie table.

protected virtual ISegment? GetSecurityCookie()

Returns

ISegment

The cookie.

Remarks

This method is called upon initialization of the SecurityCookie property.

HasField(LoadConfigurationField)

Gets a value indicating whether the field is captured by the load configuration based on its Size.

public bool HasField(LoadConfigurationField field)

Parameters

field LoadConfigurationField

The field

Returns

bool

true if the field was defined by this configuration, false otherwise.

Resize(LoadConfigurationField)

Resizes the directory to include exactly up to the provided field in the configuration.

public void Resize(LoadConfigurationField lastIncludedField)

Parameters

lastIncludedField LoadConfigurationField

The last field to include in the configuration.

UpdateOffsets(in RelocationParameters)

Assigns a new file and virtual offset to the segment and all its sub-components.

public override void UpdateOffsets(in RelocationParameters parameters)

Parameters

parameters RelocationParameters

The parameters containing the new offset information for the segment.

Write(BinaryStreamWriter)

Serializes the structure to an output stream.

public override void Write(BinaryStreamWriter writer)

Parameters

writer BinaryStreamWriter

The output stream to write the data to.