Struct Pe 

pub struct Pe {
    pub image_base: u64,
    /* private fields */
}

A loaded PE image: the raw file plus the parsed section table.

Fields

image_base: u64

Implementations

impl Pe

pub fn load(path: &str) -> Result<Pe, String>

pub fn parse(data: Vec<u8>) -> Result<Pe, String>

pub fn id(&self) -> u64

Process-unique id assigned at parse time (see the field docs).

pub fn section_of(&self, va: u64) -> Option<&Section>

The section containing va, if any.

pub fn read(&self, va: u64, len: usize) -> Option<&[u8]>

Read up to len bytes of file data starting at virtual address va. Returns fewer bytes near the end of a section’s raw data (never reads across a section boundary or into uninitialized/BSS tail).

pub fn sections(&self) -> &[Section]

Iterate over all sections in the PE

pub fn is_executable_va(&self, va: u64) -> bool

pub fn is_executable_section_va(&self, va: u64) -> bool

True if va lies inside a section whose PE32 Characteristics mark it as code (CNT_CODE or MEM_EXECUTE) — the STRICT counterpart of Pe::is_executable_va. Use this when deciding whether an immediate / stored dword plausibly denotes a FUNCTION (it lives in .text), as opposed to data (a .rdata vtable VA, a string address) that merely happens to sit inside the image.

pub fn describe_sections(&self, va: u64) -> String

Pretty-print every section as name [RVA..RVA+size) with the image base baked in, plus a hint pointing at the closest section to va (by VA distance) so the user can immediately tell whether they mistyped an address or used the wrong file.

pub fn image_range(&self) -> (u64, u64)

The image’s VA range [image_base, end) (end = highest section end).

pub fn referenced_addrs(&self) -> HashSet<u32>

Every VA the image itself “knows about”: targets of every rel32 CALL / JMP / Jcc byte pattern in .text, plus every little-endian u32 (read at EVERY byte offset of every section’s raw data) that lands inside the image — vtable slots, switch jump tables, baked function pointers, data refs.

Purpose: catch a MISATTRIBUTED or invented origin address. A real function entry is always reachable somehow (called, tail-jumped — long OR short form — or its address stored in a table), so an address referenced NOWHERE cannot be one. Over-approximate by construction (a spurious 0xE8 inside another instruction adds a junk target; a random data dword may collide) — that only ever widens the accept set, so it can’t false-positive a real entry.