lief 1.0.0

Official Rust bindings for LIEF
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105

//! PE Rich Header module
use std::marker::PhantomData;

use lief_ffi as ffi;

use crate::{common::FromFFI, declare_iterator};

/// Structure which represents the not-so-documented rich header
///
/// This structure is usually located at the end of the [`crate::pe::Binary::dos_stub`]
/// and contains information about the build environment.
/// It is generated by the Microsoft linker `link.exe` and there are no options to disable
/// or remove this information.
pub struct RichHeader<'a> {
    ptr: cxx::UniquePtr<ffi::PE_RichHeader>,
    _owner: PhantomData<&'a ffi::PE_Binary>,
}

impl std::fmt::Debug for RichHeader<'_> {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.debug_struct("RichHeader")
            .field("key", &self.key())
            .finish()
    }
}

impl<'a> FromFFI<ffi::PE_RichHeader> for RichHeader<'a> {
    fn from_ffi(ptr: cxx::UniquePtr<ffi::PE_RichHeader>) -> Self {
        RichHeader {
            ptr,
            _owner: PhantomData,
        }
    }
}

impl<'a> RichHeader<'a> {
    /// Key used to encode the header (xor operation)
    pub fn key(&self) -> u32 {
        self.ptr.key()
    }

    /// Return the raw bytes of the Rich header (decoded, without xor-encoding)
    pub fn raw(&self) -> Vec<u8> {
        Vec::from(self.ptr.raw().as_slice())
    }

    /// Return the raw bytes of the Rich header XOR-ed with the given key
    pub fn raw_with_key(&self, xor_key: u32) -> Vec<u8> {
        Vec::from(self.ptr.raw_with_key(xor_key).as_slice())
    }

    /// Return an iterator over the [`RichEntry`] within the header
    pub fn entries(&self) -> Entries<'_> {
        Entries::new(self.ptr.entries())
    }
}

pub struct RichEntry<'a> {
    ptr: cxx::UniquePtr<ffi::PE_RichEntry>,
    _owner: PhantomData<&'a ffi::PE_RichHeader>,
}

impl RichEntry<'_> {
    /// Entry type
    pub fn id(&self) -> u16 {
        self.ptr.id()
    }

    /// Build number of the tool (if any)
    pub fn build_id(&self) -> u16 {
        self.ptr.build_id()
    }

    /// *Occurrence* count.
    pub fn count(&self) -> u32 {
        self.ptr.count()
    }
}

impl std::fmt::Debug for RichEntry<'_> {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.debug_struct("RichEntry")
            .field("id", &self.id())
            .field("build_id", &self.build_id())
            .field("count", &self.count())
            .finish()
    }
}

impl<'a> FromFFI<ffi::PE_RichEntry> for RichEntry<'a> {
    fn from_ffi(ptr: cxx::UniquePtr<ffi::PE_RichEntry>) -> Self {
        RichEntry {
            ptr,
            _owner: PhantomData,
        }
    }
}

declare_iterator!(
    Entries,
    RichEntry<'a>,
    ffi::PE_RichEntry,
    ffi::PE_RichHeader,
    ffi::PE_RichHeader_it_entries
);