Unify the PE header types created by the PE view and that from the Platform types

[xusheng6]

A recurring situation during Windows malware analysis is that the code parse the PE for certain purposes. To deal with the code, often times we would like to apply appropriate types to the variables, e.g., setting the type of the variable that holds the PE header or the NT header. However, there are two cases where this workflow is not as smooth as we wish it to be:

1. The user navigates to the start of the PE view and see what the type is and then apply it. In binja, we put a COFF header followed by a PE64_Optional_Header (or PE32_Optional_Header). We did this for good -- some object files may not have the PE64_Optional_Header. However, the problem is if the user sets the variable type to COFF_Header, then he would not be able to resolve offsets to the optional header, e.g., the export directory
   

2. The user is aware of the situation described in 1), and he knows there is a IMAGE_NT_HEADERS64 from the type library that we can use. Setting the variable to IMAGE_NT_HEADERS64 will produce better output, however, a few things can be improved, e.g., the IMAGE_NT_HEADERS64 has the data directory as IMAGE_DATA_DIRECTORY DataDirectory[0x10], which is NOT as descruptive as what we do in PE64_Optional_Header, which we define 16 separate members each with their name. Besides, various enums are just defined as WORD or DWORD, which is also not the best. See the below screenshot for an illustration on what I am talking about:

As such, I think a possible route is to combine the two types and have the PE view directly use the type from the type library instead of defining its own. Alternatively, if this is not viable, then maybe we can at least change the IMAGE_NT_HEADERS64 type in the type library to make it look closer to the COFF_Header+IMAGE_NT_HEADERS64, but have them sit in one larger structure, so that the code can resolve references to offsets into IMAGE_NT_HEADERS64 properly

[utkonos]

I think this may be a duplicate, or very closely related issue to #4377

[xusheng6]

IMHO, the only reason that we are doing things in the current way is that the COFF_Header is used by both PE and COFF, and COFF only has a COFF_Header, and not a PE32_Optional_Header or PE64_Optional_Header after it. But there are multiple ways to fix this:

1. We can create a NT_Header (32/64) that contains the coff header and the optional header
2. We can create a new NT_Header (32/64) that includes all of the contains of the coff header + optional header

[xusheng6]

We added/updated types like IMAGE_NT_HEADERS in the x86/x64 platform types, and these should be ready for use for analysis:

However, the PE view is still creating these types in its own way, mainly because the number of data directories is not fixed (there could be at most 16 of them, but it could be fewer), so the PE view creates the appropriate type dynamically during parsing

This issue is left open to track the issue that the types used by PE view is still different from the ones in the platform type. But this do not really affect analysis