petriage 0.5.0

Cross-platform PE file surface analysis tool for malware analysts
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

pub mod rich_db;
pub mod analysis;
pub mod output;
#[cfg(feature = "gui")]
pub mod gui;

/// Parse a PE with lenient fallback: if strict parsing fails (e.g. malformed
/// certificate table), retry with `parse_attribute_certificates: false`.
/// Returns `(PE, Option<warning_message>)` on success.
pub fn parse_pe_lenient<'a>(data: &'a [u8], label: &str) -> Result<(goblin::pe::PE<'a>, Option<String>), String> {
    match goblin::pe::PE::parse(data) {
        Ok(pe) => Ok((pe, None)),
        Err(first_err) => {
            let opts = goblin::pe::options::ParseOptions {
                resolve_rva: true,
                parse_attribute_certificates: false,
            };
            match goblin::pe::PE::parse_with_opts(data, &opts) {
                Ok(pe) => {
                    let warning = format!(
                        "{} had a parse issue ({}); continuing with certificate table parsing disabled",
                        label, first_err
                    );
                    Ok((pe, Some(warning)))
                }
                Err(e) => Err(format!("Failed to parse PE '{}': {}", label, e)),
            }
        }
    }
}