Struct goblin::pe::optional_header::StandardFields

pub struct StandardFields {
    pub magic: u16,
    pub major_linker_version: u8,
    pub minor_linker_version: u8,
    pub size_of_code: u64,
    pub size_of_initialized_data: u64,
    pub size_of_uninitialized_data: u64,
    pub address_of_entry_point: u64,
    pub base_of_code: u64,
    pub base_of_data: u32,
}

Unified 32/64-bit standard COFF fields (for PE32 and PE32+).

Notably, a value of this type is a member of goblin::pe::optional_header::OptionalHeader, which in turn represents either

• IMAGE_OPTIONAL_HEADER32; or
• IMAGE_OPTIONAL_HEADER64

from winnt.h, depending on the value of StandardFields::magic.

Position in PE binary

Standard COFF fields are located at the beginning of the OptionalHeader and before the WindowsFields.

Related structures

• For 32-bit version, see StandardFields32.
• For 64-bit version, see StandardFields64.

Fields

magic: u16

The state of the image file. This member can be one of the following values:

• IMAGE_NT_OPTIONAL_HDR32_MAGIC.
• IMAGE_NT_OPTIONAL_HDR64_MAGIC.
• IMAGE_ROM_OPTIONAL_HDR_MAGIC.

major_linker_version: u8

The major version number of the linker.

minor_linker_version: u8

The minor version number of the linker.

size_of_code: u64

The size of the code section (.text), in bytes, or the sum of all such sections if there are multiple code sections.

size_of_initialized_data: u64

The size of the initialized data section (.data), in bytes, or the sum of all such sections if there are multiple initialized data sections.

size_of_uninitialized_data: u64

The size of the uninitialized data section (.bss), in bytes, or the sum of all such sections if there are multiple uninitialized data sections.

address_of_entry_point: u64

A pointer to the entry point function, relative to the image base address.

• For executable files, this is the starting address.
• For device drivers, this is the address of the initialization function.

The entry point function is optional for DLLs. When no entry point is present, this member is zero.

base_of_code: u64

A pointer to the beginning of the code section (.text), relative to the image base.

base_of_data: u32

A pointer to the beginning of the data section (.data), relative to the image base. Absent in 64-bit PE32+.

In other words, it is a Relative virtual address (RVA) of the start of the data (.data) section when the PE is loaded into memory.

Trait Implementations

impl Clone for StandardFields

fn clone(&self) -> StandardFields

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for StandardFields

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for StandardFields

fn default() -> StandardFields

Returns the “default value” for a type.

impl From<StandardFields> for StandardFields32

fn from(fields: StandardFields) -> Self

Converts to this type from the input type.

impl From<StandardFields> for StandardFields64

fn from(fields: StandardFields) -> Self

Converts to this type from the input type.

impl From<StandardFields32> for StandardFields

fn from(fields: StandardFields32) -> Self

Converts to this type from the input type.

impl From<StandardFields64> for StandardFields

fn from(fields: StandardFields64) -> Self

Converts to this type from the input type.

impl PartialEq for StandardFields

fn eq(&self, other: &StandardFields) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

This method tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Copy for StandardFields

impl StructuralPartialEq for StandardFields