github.com/saferwall/pe@v1.5.2/globalptr.go (about)

     1  // Copyright 2022 Saferwall. All rights reserved.
     2  // Use of this source code is governed by Apache v2 license
     3  // license that can be found in the LICENSE file.
     4  
     5  package pe
     6  
     7  const (
     8  	// AnoInvalidGlobalPtrReg is reported when the global pointer register offset is outide the image.
     9  	AnoInvalidGlobalPtrReg = "Global pointer register offset outside of PE image"
    10  )
    11  
    12  // RVA of the value to be stored in the global pointer register. The size must
    13  // be set to 0. This data directory is set to all zeros if the target
    14  // architecture (for example, I386 or AMD64) does not use the concept of a
    15  // global pointer.
    16  func (pe *File) parseGlobalPtrDirectory(rva, size uint32) error {
    17  
    18  	var err error
    19  
    20  	// RVA of the value to be stored in the global pointer register.
    21  	offset := pe.GetOffsetFromRva(rva)
    22  	if offset == ^uint32(0) {
    23  		// Fake global pointer data directory
    24  		// sample: 0101f36de484fbc7bfbe6cb942a1ecf6fac0c3acd9f65b88b19400582d7e7007
    25  		pe.Anomalies = append(pe.Anomalies, AnoInvalidGlobalPtrReg)
    26  		return nil
    27  	}
    28  
    29  	pe.GlobalPtr, err = pe.ReadUint32(offset)
    30  	if err != nil {
    31  		return err
    32  	}
    33  
    34  	pe.HasGlobalPtr = true
    35  	return nil
    36  }