Struct goblin::pe::header::CoffHeader

#[repr(C)]
pub struct CoffHeader {
    pub machine: u16,
    pub number_of_sections: u16,
    pub time_date_stamp: u32,
    pub pointer_to_symbol_table: u32,
    pub number_of_symbol_table: u32,
    pub size_of_optional_header: u16,
    pub characteristics: u16,
}

In winnt.h, it’s IMAGE_FILE_HEADER. COFF Header.

Together with the Header::signature and the Header::optional_header, it forms the IMAGE_NT_HEADERS.

Position in a modern PE file

The COFF header is located after the Header::signature, which in turn is located after the non-standard “Rich header”, if present, and after the DosStub, according to the standard.

COFF header is followed by the Header::optional_header.

Fields

machine: u16

The architecture type of the computer. An image file can only be run on the specified computer or a system that emulates the specified computer.

Can be one of the following values:

• COFF_MACHINE_UNKNOWN,
• COFF_MACHINE_ALPHA,
• COFF_MACHINE_ALPHA64,
• COFF_MACHINE_AM33,
• COFF_MACHINE_X86_64,
• COFF_MACHINE_ARM,
• COFF_MACHINE_ARM64,
• COFF_MACHINE_ARMNT,
• COFF_MACHINE_EBC,
• COFF_MACHINE_X86,
• COFF_MACHINE_IA64,
• COFF_MACHINE_LOONGARCH32,
• COFF_MACHINE_LOONGARCH64,
• COFF_MACHINE_M32R,
• COFF_MACHINE_MIPS16,
• COFF_MACHINE_MIPSFPU,
• COFF_MACHINE_MIPSFPU16,
• COFF_MACHINE_POWERPC,
• COFF_MACHINE_POWERPCFP,
• COFF_MACHINE_R4000,
• COFF_MACHINE_RISCV32,
• COFF_MACHINE_RISCV64,
• COFF_MACHINE_RISCV128,
• COFF_MACHINE_SH3,
• COFF_MACHINE_SH3DSP,
• COFF_MACHINE_SH4,
• COFF_MACHINE_SH5,
• COFF_MACHINE_THUMB,
• COFF_MACHINE_WCEMIPSV2,

or any other value that is not listed here.

The constants above are sourced from https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#machine-types. If there’s a missing constant, please open an issue or a pull request.

number_of_sections: u16

The number of sections. This indicates the size of the section table, which immediately follows the headers. Note that the Windows loader limits the number of sections to 96. Source.

time_date_stamp: u32

The low 32 bits of the time stamp of the image. This represents the date and time the image was created by the linker. The value is represented in the number of seconds elapsed since midnight (00:00:00), January 1, 1970, Universal Coordinated Time, according to the system clock.

pointer_to_symbol_table: u32

The offset of the symbol table, in bytes, or zero if no COFF symbol table exists.

Typically, this field is set to 0 because COFF debugging information is deprecated. Source.

number_of_symbol_table: u32

The number of symbols in the symbol table.

Typically, this field is set to 0 because COFF debugging information is deprecated. Source.

size_of_optional_header: u16

The size of the optional header, in bytes. This value should be zero for object files.

The goblin::pe::optional_header::OptionalHeader is meant to represent either the 32-bit or the 64-bit optional header. The size of the optional header is used to determine which one it is.

characteristics: u16

The characteristics of the image.

The constants for the characteristics are available in the goblin::pe::characteristic module.

Implementations

impl CoffHeader

pub fn parse(bytes: &[u8], offset: &mut usize) -> Result<Self>

pub fn sections( &self, bytes: &[u8], offset: &mut usize ) -> Result<Vec<SectionTable>>

Parse the COFF section headers.

For COFF, these immediately follow the COFF header. For PE, these immediately follow the optional header.

pub fn symbols<'a>(&self, bytes: &'a [u8]) -> Result<Option<SymbolTable<'a>>>

Return the COFF symbol table.

pub fn strings<'a>(&self, bytes: &'a [u8]) -> Result<Option<Strtab<'a>>>

Return the COFF string table.

Trait Implementations

impl Clone for CoffHeader

fn clone(&self) -> CoffHeader

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CoffHeader

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CoffHeader

fn default() -> CoffHeader

Returns the “default value” for a type.

impl FromCtx<Endian> for CoffHeader

fn from_ctx(src: &[u8], ctx: Endian) -> Self

impl<'a> IntoCtx<Endian> for &'a CoffHeader

fn into_ctx(self, dst: &mut [u8], ctx: Endian)

impl IntoCtx<Endian> for CoffHeader

fn into_ctx(self, dst: &mut [u8], ctx: Endian)

impl PartialEq for CoffHeader

fn eq(&self, other: &CoffHeader) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

This method tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl SizeWith<Endian> for CoffHeader

fn size_with(ctx: &Endian) -> usize

impl<'a> TryFromCtx<'a, Endian> for CoffHeader

where CoffHeader: 'a,

type Error = Error

fn try_from_ctx( src: &'a [u8], ctx: Endian ) -> Result<(Self, usize), Self::Error>

impl<'a> TryIntoCtx<Endian> for &'a CoffHeader

type Error = Error

fn try_into_ctx(self, dst: &mut [u8], ctx: Endian) -> Result<usize, Self::Error>

impl TryIntoCtx<Endian> for CoffHeader

type Error = Error

fn try_into_ctx(self, dst: &mut [u8], ctx: Endian) -> Result<usize, Self::Error>

impl Copy for CoffHeader

impl StructuralPartialEq for CoffHeader