diff --git a/VTIL-Common/formats/image_descriptor.hpp b/VTIL-Common/formats/image_descriptor.hpp index f18b71d..e63353c 100644 --- a/VTIL-Common/formats/image_descriptor.hpp +++ b/VTIL-Common/formats/image_descriptor.hpp @@ -177,6 +177,10 @@ namespace vtil // virtual uint64_t get_image_base() const = 0; + // Returns the entry point if relevant. + // + virtual std::optional get_entry_point() const = 0; + // Returns the image size and the raw byte array. // virtual size_t get_image_size() const = 0; diff --git a/VTIL-Common/formats/winpe.cpp b/VTIL-Common/formats/winpe.cpp index 9b57174..991ccec 100644 --- a/VTIL-Common/formats/winpe.cpp +++ b/VTIL-Common/formats/winpe.cpp @@ -626,6 +626,18 @@ namespace vtil return dos_header->get_nt_headers()->optional_header.image_base; } + std::optional pe_image::get_entry_point() const + { + // Get the entry point from optional header, return nullopt if zero. + // + auto dos_header = ( const dos_header_t* ) cdata(); + uint64_t ep = is_pe64() + ? dos_header->get_nt_headers()->optional_header.entry_point + : dos_header->get_nt_headers()->optional_header.entry_point; + if ( ep ) return ep; + return std::nullopt; + } + bool pe_image::is_valid() const { // Get image boundaries and the dos header. diff --git a/VTIL-Common/formats/winpe.hpp b/VTIL-Common/formats/winpe.hpp index 5ff5b8b..9a1d3eb 100644 --- a/VTIL-Common/formats/winpe.hpp +++ b/VTIL-Common/formats/winpe.hpp @@ -56,6 +56,7 @@ namespace vtil virtual void add_section( section_descriptor& in_out, const void* data, size_t size ) override; virtual void enum_relocations( const function_view& fn ) const override; virtual uint64_t get_image_base() const override; + virtual std::optional get_entry_point() const override; virtual size_t get_image_size() const override { return raw_bytes.size(); } virtual void* data() override { return raw_bytes.data(); } virtual const void* cdata() const override { return raw_bytes.data(); }