All Implemented Interfaces:

Closeable, AutoCloseable, Signable
```
public class PEFile
extends Object
implements Signable, Closeable
```
Portable Executable File. This class is thread safe.

Since:

1.0

Author:

Emmanuel Bourg

See Also:

Microsoft PE and COFF Specification

Constructor Summary

Constructors
Constructor Description

PEFile(File file)
Create a PEFile from the specified file.

PEFile(SeekableByteChannel channel)
Create a PEFile from the specified channel.

Method Summary

All Methods Static Methods Instance Methods Concrete Methods
Modifier and Type	Method	Description
`void`	`close()`	Closes the file
`long`	`computeChecksum()`	Compute the checksum of the image file.
`byte[]`	`computeDigest(MessageDigest digest)`	Compute the digest of the file.
`byte[]`	`computeDigest(DigestAlgorithm algorithm)`	Compute the checksum of the file using the specified digest algorithm.
`ASN1Object`	`createIndirectData(DigestAlgorithm digestAlgorithm)`	Creates the SpcIndirectDataContent structure containing the digest of the file.
`long`	`getAddressOfEntryPoint()`	The address of the entry point relative to the image base when the executable file is loaded into memory.
`long`	`getBaseOfCode()`	The address that is relative to the image base of the beginning-of-code section when it is loaded into memory.
`long`	`getBaseOfData()`	The address that is relative to the image base of the beginning-of-data section when it is loaded into memory (PE32 only).
`int`	`getCharacteristics()`	The flags that indicate the attributes of the file.
`long`	`getCheckSum()`	The image file checksum.
`DataDirectory`	`getDataDirectory(DataDirectoryType type)`	Returns the data directory of the specified type.
`int`	`getDllCharacteristics()`
`long`	`getFileAlignment()`	The alignment factor (in bytes) that is used to align the raw data of sections in the image file.
`PEFormat`	`getFormat()`
`long`	`getImageBase()`	The preferred address of the first byte of image when loaded into memory; must be a multiple of 64 K.
`long`	`getLoaderFlags()`	Reserved, must be zero.
`MachineType`	`getMachineType()`
`int`	`getMajorImageVersion()`	The major version number of the image.
`int`	`getMajorLinkerVersion()`	The linker major version number.
`int`	`getMajorOperatingSystemVersion()`	The major version number of the required operating system.
`int`	`getMajorSubsystemVersion()`	The major version number of the subsystem.
`int`	`getMinorImageVersion()`	The minor version number of the image.
`int`	`getMinorLinkerVersion()`	The linker minor version number.
`int`	`getMinorOperatingSystemVersion()`	The minor version number of the required operating system.
`int`	`getMinorSubsystemVersion()`	The minor version number of the subsystem.
`int`	`getNumberOfRvaAndSizes()`	The number of data-directory entries in the remainder of the optional header.
`int`	`getNumberOfSections()`	The number of sections.
`long`	`getNumberOfSymbols()`	The number of entries in the symbol table.
`long`	`getPointerToSymbolTable()`	The file offset of the COFF symbol table, or zero if no COFF symbol table is present.
`long`	`getSectionAlignment()`	The alignment (in bytes) of sections when they are loaded into memory.
`List<Section>`	`getSections()`
`List<CMSSignedData>`	`getSignatures()`	Returns the Authenticode signatures on the file.
`long`	`getSizeOfCode()`	The size of the code (text) section, or the sum of all code sections if there are multiple sections.
`long`	`getSizeOfHeaders()`	The combined size of an MS DOS stub, PE header, and section headers rounded up to a multiple of FileAlignment.
`long`	`getSizeOfHeapCommit()`	The size of the local heap space to commit.
`long`	`getSizeOfHeapReserve()`	The size of the local heap space to reserve.
`long`	`getSizeOfImage()`	The size (in bytes) of the image, including all headers, as the image is loaded in memory.
`long`	`getSizeOfInitializedData()`	The size of the initialized data section, or the sum of all such sections if there are multiple data sections.
`int`	`getSizeOfOptionalHeader()`	The size of the optional header, which is required for executable files but not for object files.
`long`	`getSizeOfStackCommit()`	The size of the stack to commit.
`long`	`getSizeOfStackReserve()`	The size of the stack to reserve.
`long`	`getSizeOfUninitializedData()`	The size of the uninitialized data section (BSS), or the sum of all such sections if there are multiple BSS sections.
`Subsystem`	`getSubsystem()`	The subsystem that is required to run this image.
`Date`	`getTimeDateStamp()`	The low 32 bits of the number of seconds since 00:00 January 1, 1970 (a C runtime time_t value), that indicates when the file was created.
`long`	`getWin32VersionValue()`	Reserved, must be zero.
`static boolean`	`isPEFile(File file)`	Tells if the specified file is a Portable Executable file.
`void`	`pad(int multiple)`	Increase the size of the file up to a size that is a multiple of the specified value.
`void`	`printInfo(OutputStream out)`	Print detailed informations about the PE file.
`void`	`printInfo(PrintWriter out)`	Print detailed informations about the PE file.
`void`	`save()`	Saves the file.
`void`	`setSignature(CMSSignedData signature)`	Sets the signature of the file, overwriting the previous one.
`void`	`updateChecksum()`
`void`	`writeDataDirectory(DataDirectoryType type, byte[] data)`	Writes the data directory of the specified type.

Methods inherited from class java.lang.Object
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- Constructor Detail
  - PEFile
```
public PEFile(File file)
       throws IOException
```
    Create a PEFile from the specified file.
    
    Parameters:
    
    file - the file to open
    
    Throws:
    
    IOException - if an I/O error occurs
  - PEFile
```
public PEFile(SeekableByteChannel channel)
       throws IOException
```
    Create a PEFile from the specified channel.
    
    Parameters:
    
    channel - the channel to read the file from
    
    Throws:
    
    IOException - if an I/O error occurs
    
    Since:
    
    2.0
- Method Detail
  - isPEFile
```
public static boolean isPEFile(File file)
                        throws IOException
```
    Tells if the specified file is a Portable Executable file.
    
    Parameters:
    
    file - the file to check
    
    Returns:
    
    true if the file is a Portable Executable, false otherwise
    
    Throws:
    
    IOException - if an I/O error occurs
    
    Since:
    
    3.0
  - save
```
public void save()
```
    Description copied from interface: Signable
    
    Saves the file.
    
    Specified by:
    
    save in interface Signable
  - close
```
public void close()
           throws IOException
```
    Closes the file
    
    Specified by:
    
    close in interface AutoCloseable
    
    Specified by:
    
    close in interface Closeable
    
    Throws:
    
    IOException - if an I/O error occurs
  - getMachineType
```
public MachineType getMachineType()
```
  - getNumberOfSections
```
public int getNumberOfSections()
```
    The number of sections. This indicates the size of the section table, which immediately follows the headers.
    
    Returns:
    
    the number of sections
  - getTimeDateStamp
```
public Date getTimeDateStamp()
```
    The low 32 bits of the number of seconds since 00:00 January 1, 1970 (a C runtime time_t value), that indicates when the file was created.
    
    Returns:
    
    the PE file creation date
  - getPointerToSymbolTable
```
public long getPointerToSymbolTable()
```
    The file offset of the COFF symbol table, or zero if no COFF symbol table is present. This value should be zero for an image because COFF debugging information is deprecated.
    
    Returns:
    
    the offset of the COFF symbol table
  - getNumberOfSymbols
```
public long getNumberOfSymbols()
```
    The number of entries in the symbol table. This data can be used to locate the string table, which immediately follows the symbol table. This value should be zero for an image because COFF debugging information is deprecated.
    
    Returns:
    
    the number of entries in the symbol table
  - getSizeOfOptionalHeader
```
public int getSizeOfOptionalHeader()
```
    The size of the optional header, which is required for executable files but not for object files. This value should be zero for an object file.
    
    Returns:
    
    the size of the optional header
  - getCharacteristics
```
public int getCharacteristics()
```
    The flags that indicate the attributes of the file.
    
    Returns:
    
    the characteristics flag
  - getFormat
```
public PEFormat getFormat()
```
  - getMajorLinkerVersion
```
public int getMajorLinkerVersion()
```
    The linker major version number.
    
    Returns:
    
    the linker major version number
  - getMinorLinkerVersion
```
public int getMinorLinkerVersion()
```
    The linker minor version number.
    
    Returns:
    
    the linker minor version number
  - getSizeOfCode
```
public long getSizeOfCode()
```
    The size of the code (text) section, or the sum of all code sections if there are multiple sections.
    
    Returns:
    
    the size of the code (text) section
  - getSizeOfInitializedData
```
public long getSizeOfInitializedData()
```
    The size of the initialized data section, or the sum of all such sections if there are multiple data sections.
    
    Returns:
    
    the size of the initialized data section
  - getSizeOfUninitializedData
```
public long getSizeOfUninitializedData()
```
    The size of the uninitialized data section (BSS), or the sum of all such sections if there are multiple BSS sections.
    
    Returns:
    
    the size of the uninitialized data section (BSS)
  - getAddressOfEntryPoint
```
public long getAddressOfEntryPoint()
```
    The address of the entry point relative to the image base when the executable file is loaded into memory. For program images, this is the starting address. For device drivers, this is the address of the initialization function. An entry point is optional for DLLs. When no entry point is present, this field must be zero.
    
    Returns:
    
    the address of the entry point
  - getBaseOfCode
```
public long getBaseOfCode()
```
    The address that is relative to the image base of the beginning-of-code section when it is loaded into memory.
    
    Returns:
    
    the code base address
  - getBaseOfData
```
public long getBaseOfData()
```
    The address that is relative to the image base of the beginning-of-data section when it is loaded into memory (PE32 only).
    
    Returns:
    
    the data base address
  - getImageBase
```
public long getImageBase()
```
    The preferred address of the first byte of image when loaded into memory; must be a multiple of 64 K. The default for DLLs is 0x10000000. The default for Windows CE EXEs is 0x00010000. The default for Windows NT, Windows 2000, Windows XP, Windows 95, Windows 98, and Windows Me is 0x00400000.
    
    Returns:
    
    the image base address
  - getSectionAlignment
```
public long getSectionAlignment()
```
    The alignment (in bytes) of sections when they are loaded into memory. It must be greater than or equal to FileAlignment. The default is the page size for the architecture.
    
    Returns:
    
    the size of the sections memory alignment (in bytes)
  - getFileAlignment
```
public long getFileAlignment()
```
    The alignment factor (in bytes) that is used to align the raw data of sections in the image file. The value should be a power of 2 between 512 and 64 K, inclusive. The default is 512. If the SectionAlignment is less than the architecture?s page size, then FileAlignment must match SectionAlignment.
    
    Returns:
    
    the alignment factor (in bytes)
  - getMajorOperatingSystemVersion
```
public int getMajorOperatingSystemVersion()
```
    The major version number of the required operating system.
    
    Returns:
    
    the major version number of the required operating system
  - getMinorOperatingSystemVersion
```
public int getMinorOperatingSystemVersion()
```
    The minor version number of the required operating system.
    
    Returns:
    
    the minor version number of the required operating system
  - getMajorImageVersion
```
public int getMajorImageVersion()
```
    The major version number of the image.
    
    Returns:
    
    the major version number of the image
  - getMinorImageVersion
```
public int getMinorImageVersion()
```
    The minor version number of the image.
    
    Returns:
    
    the minor version number of the image
  - getMajorSubsystemVersion
```
public int getMajorSubsystemVersion()
```
    The major version number of the subsystem.
    
    Returns:
    
    the major version number of the subsystem
  - getMinorSubsystemVersion
```
public int getMinorSubsystemVersion()
```
    The minor version number of the subsystem.
    
    Returns:
    
    the minor version number of the subsystem
  - getWin32VersionValue
```
public long getWin32VersionValue()
```
    Reserved, must be zero.
    
    Returns:
    
    zero
  - getSizeOfImage
```
public long getSizeOfImage()
```
    The size (in bytes) of the image, including all headers, as the image is loaded in memory. It must be a multiple of SectionAlignment.
    
    Returns:
    
    the size of the image (in bytes)
  - getSizeOfHeaders
```
public long getSizeOfHeaders()
```
    The combined size of an MS DOS stub, PE header, and section headers rounded up to a multiple of FileAlignment.
    
    Returns:
    
    the combined size of the headers
  - getCheckSum
```
public long getCheckSum()
```
    The image file checksum.
    
    Returns:
    
    the checksum of the image
  - computeChecksum
```
public long computeChecksum()
```
    Compute the checksum of the image file. The algorithm for computing the checksum is incorporated into IMAGHELP.DLL.
    
    Returns:
    
    the checksum of the image
  - updateChecksum
```
public void updateChecksum()
```
  - getSubsystem
```
public Subsystem getSubsystem()
```
    The subsystem that is required to run this image.
    
    Returns:
    
    the required subsystem
  - getDllCharacteristics
```
public int getDllCharacteristics()
```
  - getSizeOfStackReserve
```
public long getSizeOfStackReserve()
```
    The size of the stack to reserve. Only SizeOfStackCommit is committed; the rest is made available one page at a time until the reserve size is reached.
    
    Returns:
    
    the size of the stack to reserve
  - getSizeOfStackCommit
```
public long getSizeOfStackCommit()
```
    The size of the stack to commit.
    
    Returns:
    
    the size of the stack to commit
  - getSizeOfHeapReserve
```
public long getSizeOfHeapReserve()
```
    The size of the local heap space to reserve. Only SizeOfHeapCommit is committed; the rest is made available one page at a time until the reserve size is reached.
    
    Returns:
    
    the size of the local heap space to reserve
  - getSizeOfHeapCommit
```
public long getSizeOfHeapCommit()
```
    The size of the local heap space to commit.
    
    Returns:
    
    the size of the local heap space to commit
  - getLoaderFlags
```
public long getLoaderFlags()
```
    Reserved, must be zero.
    
    Returns:
    
    zero
  - getNumberOfRvaAndSizes
```
public int getNumberOfRvaAndSizes()
```
    The number of data-directory entries in the remainder of the optional header. Each describes a location and size.
    
    Returns:
    
    the number of data-directory entries
  - getDataDirectory
```
public DataDirectory getDataDirectory(DataDirectoryType type)
```
    Returns the data directory of the specified type.
    
    Parameters:
    
    type - the type of data directory
    
    Returns:
    
    the data directory of the specified type
  - writeDataDirectory
```
public void writeDataDirectory(DataDirectoryType type,
                               byte[] data)
                        throws IOException
```
    Writes the data directory of the specified type. The data is either appended at the end of the file or written over the previous data of the same type if there is enough space.
    
    Parameters:
    
    type - the type of the data directory
    
    data - the content of the data directory
    
    Throws:
    
    IOException - if an I/O error occurs
  - getSignatures
```
public List<CMSSignedData> getSignatures()
```
    Description copied from interface: Signable
    
    Returns the Authenticode signatures on the file.
    
    Specified by:
    
    getSignatures in interface Signable
    
    Returns:
    
    the signatures
  - setSignature
```
public void setSignature(CMSSignedData signature)
                  throws IOException
```
    Description copied from interface: Signable
    
    Sets the signature of the file, overwriting the previous one.
    
    Specified by:
    
    setSignature in interface Signable
    
    Parameters:
    
    signature - the signature to put
    
    Throws:
    
    IOException - if an I/O error occurs
  - getSections
```
public List<Section> getSections()
```
  - printInfo
```
public void printInfo(OutputStream out)
```
    Print detailed informations about the PE file.
    
    Parameters:
    
    out - the output stream where the info is printed
  - printInfo
```
public void printInfo(PrintWriter out)
```
    Print detailed informations about the PE file.
    
    Parameters:
    
    out - the output writer where the info is printed
  - computeDigest
```
public byte[] computeDigest(MessageDigest digest)
                     throws IOException
```
    Compute the digest of the file. The checksum field, the certificate directory table entry and the certificate table are excluded from the digest.
    
    Specified by:
    
    computeDigest in interface Signable
    
    Parameters:
    
    digest - the message digest to update
    
    Returns:
    
    the digest of the file
    
    Throws:
    
    IOException - if an I/O error occurs
  - computeDigest
```
public byte[] computeDigest(DigestAlgorithm algorithm)
                     throws IOException
```
    Compute the checksum of the file using the specified digest algorithm.
    
    Parameters:
    
    algorithm - the digest algorithm, typically SHA1
    
    Returns:
    
    the checksum of the file
    
    Throws:
    
    IOException - if an I/O error occurs
  - createIndirectData
```
public ASN1Object createIndirectData(DigestAlgorithm digestAlgorithm)
                              throws IOException
```
    Description copied from interface: Signable
    
    Creates the SpcIndirectDataContent structure containing the digest of the file.
    
    Specified by:
    
    createIndirectData in interface Signable
    
    Parameters:
    
    digestAlgorithm - the digest algorithm to use
    
    Returns:
    
    the SpcIndirectDataContent structure in ASN.1 format
    
    Throws:
    
    IOException - if an I/O error occurs
  - pad
```
public void pad(int multiple)
         throws IOException
```
    Increase the size of the file up to a size that is a multiple of the specified value.
    
    Parameters:
    
    multiple - the size of the byte alignment
    
    Throws:
    
    IOException - if an I/O error occurs

Constructor	Description
`PEFile(File file)`	Create a PEFile from the specified file.
`PEFile(SeekableByteChannel channel)`	Create a PEFile from the specified channel.

Class PEFile

Constructor Summary

Method Summary

Methods inherited from class java.lang.Object

Constructor Detail

PEFile

PEFile

Method Detail

isPEFile

save

close

getMachineType

getNumberOfSections

getTimeDateStamp

getPointerToSymbolTable

getNumberOfSymbols

getSizeOfOptionalHeader

getCharacteristics

getFormat

getMajorLinkerVersion

getMinorLinkerVersion

getSizeOfCode

getSizeOfInitializedData

getSizeOfUninitializedData

getAddressOfEntryPoint

getBaseOfCode

getBaseOfData

getImageBase

getSectionAlignment

getFileAlignment

getMajorOperatingSystemVersion

getMinorOperatingSystemVersion

getMajorImageVersion

getMinorImageVersion

getMajorSubsystemVersion

getMinorSubsystemVersion

getWin32VersionValue

getSizeOfImage

getSizeOfHeaders

getCheckSum

computeChecksum

updateChecksum

getSubsystem

getDllCharacteristics

getSizeOfStackReserve

getSizeOfStackCommit

getSizeOfHeapReserve

getSizeOfHeapCommit

getLoaderFlags

getNumberOfRvaAndSizes

getDataDirectory

writeDataDirectory

getSignatures

setSignature

getSections

printInfo

printInfo

computeDigest

computeDigest

createIndirectData

pad