goblin::pe

Struct PE

Source
pub struct PE<'a> {
Show 17 fields pub header: Header, pub sections: Vec<SectionTable>, pub size: usize, pub name: Option<&'a str>, pub is_lib: bool, pub is_64: bool, pub entry: usize, pub image_base: usize, pub export_data: Option<ExportData<'a>>, pub import_data: Option<ImportData<'a>>, pub exports: Vec<Export<'a>>, pub imports: Vec<Import<'a>>, pub libraries: Vec<&'a str>, pub debug_data: Option<DebugData<'a>>, pub tls_data: Option<TlsData<'a>>, pub exception_data: Option<ExceptionData<'a>>, pub certificates: CertificateDirectoryTable<'a>, /* private fields */
}
Expand description

An analyzed PE32/PE32+ binary

Fields§

§header: Header

The PE header

§sections: Vec<SectionTable>

A list of the sections in this PE binary

§size: usize

The size of the binary

§name: Option<&'a str>

The name of this dll, if it has one

§is_lib: bool

Whether this is a dll or not

§is_64: bool

Whether the binary is 64-bit (PE32+)

§entry: usize

the entry point of the binary

§image_base: usize

The binary’s RVA, or image base - useful for computing virtual addreses

§export_data: Option<ExportData<'a>>

Data about any exported symbols in this binary (e.g., if it’s a dll)

§import_data: Option<ImportData<'a>>

Data for any imported symbols, and from which dll, etc., in this binary

§exports: Vec<Export<'a>>

The list of exported symbols in this binary, contains synthetic information for easier analysis

§imports: Vec<Import<'a>>

The list symbols imported by this binary from other dlls

§libraries: Vec<&'a str>

The list of libraries which this binary imports symbols from

§debug_data: Option<DebugData<'a>>

Debug information, if any, contained in the PE header

§tls_data: Option<TlsData<'a>>

TLS information, if any, contained in the PE header

§exception_data: Option<ExceptionData<'a>>

Exception handling and stack unwind information, if any, contained in the PE header

§certificates: CertificateDirectoryTable<'a>

Certificates present, if any, described by the Certificate Table

Implementations§

Source§

impl PE<'_>

Source

pub fn authenticode_ranges(&self) -> ExcludedSectionsIter<'_>

Returns the various ranges of the binary that are relevant for signature.

Source§

impl<'a> PE<'a>

Source

pub fn parse(bytes: &'a [u8]) -> Result<Self>

Reads a PE binary from the underlying bytes

Source

pub fn parse_with_opts(bytes: &'a [u8], opts: &ParseOptions) -> Result<Self>

Reads a PE binary from the underlying bytes

Source

pub fn write_sections( &self, bytes: &mut [u8], offset: &mut usize, file_alignment: Option<usize>, ctx: Endian, ) -> Result<usize, Error>

Source

pub fn write_certificates( &self, bytes: &mut [u8], ctx: Endian, ) -> Result<usize, Error>

Trait Implementations§

Source§

impl<'a> Debug for PE<'a>

Source§

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter. Read more
Source§

impl<'a> TryIntoCtx<Endian> for PE<'a>

Source§

type Error = Error

Source§

fn try_into_ctx( self, bytes: &mut [u8], ctx: Endian, ) -> Result<usize, Self::Error>

Auto Trait Implementations§

§

impl<'a> Freeze for PE<'a>

§

impl<'a> RefUnwindSafe for PE<'a>

§

impl<'a> Send for PE<'a>

§

impl<'a> Sync for PE<'a>

§

impl<'a> Unpin for PE<'a>

§

impl<'a> UnwindSafe for PE<'a>

Blanket Implementations§

Source§

impl<T> Any for T
where T: 'static + ?Sized,

Source§

fn type_id(&self) -> TypeId

Gets the TypeId of self. Read more
Source§

impl<T> Borrow<T> for T
where T: ?Sized,

Source§

fn borrow(&self) -> &T

Immutably borrows from an owned value. Read more
Source§

impl<T> BorrowMut<T> for T
where T: ?Sized,

Source§

fn borrow_mut(&mut self) -> &mut T

Mutably borrows from an owned value. Read more
Source§

impl<T> From<T> for T

Source§

fn from(t: T) -> T

Returns the argument unchanged.

Source§

impl<T, U> Into<U> for T
where U: From<T>,

Source§

fn into(self) -> U

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

Source§

impl<T, U> TryFrom<U> for T
where U: Into<T>,

Source§

type Error = Infallible

The type returned in the event of a conversion error.
Source§

fn try_from(value: U) -> Result<T, <T as TryFrom<U>>::Error>

Performs the conversion.
Source§

impl<T, U> TryInto<U> for T
where U: TryFrom<T>,

Source§

type Error = <U as TryFrom<T>>::Error

The type returned in the event of a conversion error.
Source§

fn try_into(self) -> Result<U, <U as TryFrom<T>>::Error>

Performs the conversion.