1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
use lief_ffi as ffi;
/// This structure is used to configure the behavior of the PE Parser: [`crate::pe::Binary::parse_with_config`]
#[derive(Debug, Clone, PartialEq, Eq, Hash)]
pub struct Config {
/// Whether to parse the PE Authenticode signature.
pub parse_signature: bool,
/// Whether to parse the PE Export Directory.
pub parse_exports: bool,
/// Whether to parse the PE Import Directory.
pub parse_imports: bool,
/// Whether to parse the PE resources tree.
pub parse_rsrc: bool,
/// Whether to parse PE relocations.
pub parse_reloc: bool,
/// Whether to parse in-depth exception metadata.
///
/// This option is disabled by default because it can introduce significant
/// parsing overhead.
pub parse_exceptions: bool,
/// Whether to parse nested ARM64X binaries.
///
/// This option is disabled by default because it can introduce significant
/// parsing overhead.
pub parse_arm64x_binary: bool,
/// If set, this value holds the original image base from which the binary
/// should be rebased. This is used to *undo* relocations and IAT bindings
/// when parsing a PE loaded in memory.
pub rebase: Option<u64>,
}
impl Default for Config {
fn default() -> Config {
Config {
parse_signature: true,
parse_exports: true,
parse_imports: true,
parse_rsrc: true,
parse_reloc: true,
parse_exceptions: false,
parse_arm64x_binary: false,
rebase: None,
}
}
}
impl Config {
#[doc(hidden)]
pub fn to_ffi(&self) -> cxx::UniquePtr<ffi::PE_ParserConfig> {
let mut ptr = ffi::PE_ParserConfig::create();
ptr.pin_mut().set_parse_signature(self.parse_signature);
ptr.pin_mut().set_parse_exports(self.parse_exports);
ptr.pin_mut().set_parse_imports(self.parse_imports);
ptr.pin_mut().set_parse_rsrc(self.parse_rsrc);
ptr.pin_mut().set_parse_reloc(self.parse_reloc);
ptr.pin_mut().set_parse_exceptions(self.parse_exceptions);
ptr.pin_mut()
.set_parse_arm64x_binary(self.parse_arm64x_binary);
if let Some(rebase_val) = self.rebase {
ptr.pin_mut().set_rebase(rebase_val);
} else {
ptr.pin_mut().clear_rebase();
}
ptr
}
/// Configuration that enables all optional parsing features.
pub fn with_all_options() -> Self {
Self {
parse_signature: true,
parse_exports: true,
parse_imports: true,
parse_rsrc: true,
parse_reloc: true,
parse_exceptions: true,
parse_arm64x_binary: true,
rebase: None,
}
}
}