Struct Pe 

pub struct Pe {
    pub image_base: u64,
    /* private fields */
}

A loaded PE image: the raw file plus the parsed section table.

Fields

image_base: u64

Implementations

impl Pe

pub fn load(path: &str) -> Result<Pe, String>

pub fn parse(data: Vec<u8>) -> Result<Pe, String>

pub fn id(&self) -> u64

Process-unique id assigned at parse time (see the field docs).

pub fn is_le(&self) -> bool

Whether the loaded executable uses the DOS4GW LE container format.

pub fn fixup_post_images(&self, pres: &BTreeSet<u64>) -> BTreeSet<u64>

Runtime (post-fixup) images of link-time (pre-fixup) addresses: for every pre in pres that an LE 07 fixup record patches, the mapped runtime value. Empty for PE (no fixup tables) and for binaries whose tables hold no 07 records. Used to widen address accept-sets (a body may bake the runtime value of a referenced address); never a demand.

pub fn fixup_post_image(&self, pre: u64) -> Option<u64>

Runtime (post-fixup) image of a single link-time address, if that address is an LE 07 fixup site. None for PE, for LE binaries with no absolute fixups, and for pre values that are not fixup sites.

Used by the jump-table reader: an LE table’s base and its entries are stored pre-fixup, so a displacement/entry must be translated to its runtime VA before it can be range-checked or read through the page map. Widening only: PE (and LE non-fixup values) are unchanged.

pub fn fixup_count(&self) -> usize

How many 07 absolute fixup records were absorbed at load (0 for PE and for LE binaries without absolute fixups). Diagnostic/test use.

pub fn fixup_pairs(&self) -> &[(u64, u64)]

The absorbed (pre, post) content pairs for every 07 absolute fixup (empty for PE). Diagnostic/test use; the gates go through Pe::fixup_post_images.

pub fn fixup_rel32_pairs(&self) -> &[(u64, u64)]

The LE 08 self-relative records as (operand_va, target_va).

pub fn fixup_rel32_target(&self, loc: u64) -> Option<u64>

Runtime target of a rel32 branch/call whose operand sits at loc, if an LE 08 self-relative fixup patches it. None for PE and non-sites.

pub fn fixup_status(&self) -> &FixupStatus

What happened with the LE fixup tables (see FixupStatus).

pub fn section_of(&self, va: u64) -> Option<&Section>

The section containing va, if any.

pub fn read(&self, va: u64, len: usize) -> Option<&[u8]>

Read up to len bytes of file data starting at virtual address va. Returns fewer bytes near the end of a section’s raw data (never reads across a section boundary or into uninitialized/BSS tail).

pub fn sections(&self) -> &[Section]

Iterate over all sections in the PE

pub fn is_executable_va(&self, va: u64) -> bool

pub fn is_executable_section_va(&self, va: u64) -> bool

True if va lies inside a section whose PE32 Characteristics mark it as code (CNT_CODE or MEM_EXECUTE) — the STRICT counterpart of Pe::is_executable_va. Use this when deciding whether an immediate / stored dword plausibly denotes a FUNCTION (it lives in .text), as opposed to data (a .rdata vtable VA, a string address) that merely happens to sit inside the image.

pub fn describe_sections(&self, va: u64) -> String

Pretty-print every section as name [RVA..RVA+size) with the image base baked in, plus a hint pointing at the closest section to va (by VA distance) so the user can immediately tell whether they mistyped an address or used the wrong file.

pub fn image_range(&self) -> (u64, u64)

The image’s VA range [image_base, end) (end = highest section end).

pub fn referenced_addrs(&self) -> HashSet<u32>

Every VA the image itself “knows about”: targets of every rel32 CALL / JMP / Jcc byte pattern in .text, plus every little-endian u32 (read at EVERY byte offset of every section’s raw data) that lands inside the image — vtable slots, switch jump tables, baked function pointers, data refs.

Purpose: catch a MISATTRIBUTED or invented origin address. A real function entry is always reachable somehow (called, tail-jumped — long OR short form — or its address stored in a table), so an address referenced NOWHERE cannot be one. Over-approximate by construction (a spurious 0xE8 inside another instruction adds a junk target; a random data dword may collide) — that only ever widens the accept set, so it can’t false-positive a real entry.