peview 0.1.1

A minimal and fast zero-copy parser for the PE32+ file format.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154

use crate::{dir::*, error::*, impl_from_bytes, mem::*};
use alloc::format;
use core::mem;

/// Relocation entry of a relocation block
/// Values are defined by [MSDN](https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#base-relocation-types)
pub enum Relocation {
    Absolute(u16),
    High(u16),
    Low(u16),
    HighLow(u16),
    HighAdj(u16),
    MipsArmRiscv(u16),
    ThumbRiscv(u16),
    RiscvLoong(u16),
    JmpAddr(u16),
    Dir64(u16),
}

/// Iterator over the entries of a single relocation block
pub struct RelocationBlock<'a> {
    data: ByteReader<'a>,
    head: &'a RelocationHead,
}

impl<'a> RelocationBlock<'a> {
    pub fn new(data: &'a [u8], head: &'a RelocationHead) -> Self {
        Self {
            data: ByteReader::new(data),
            head,
        }
    }

    /// Returns the `page_rva` field of the [`RelocationHead`].
    pub fn page_rva(&self) -> u32 {
        self.head.page_rva
    }

    /// Returns the number of entries in this [`RelocationBlock`].
    pub fn entry_count(&self) -> usize {
        (self.head.block_size as usize - mem::size_of::<RelocationHead>())
            / mem::size_of::<RelocationEntry>()
    }
}

impl<'a> Iterator for RelocationBlock<'a> {
    type Item = Result<Relocation>;

    fn next(&mut self) -> Option<Self::Item> {
        match (|| {
            // Read and convert the next BR entry
            let entry = self.data.read::<RelocationEntry>()?;
            Relocation::try_from(entry)
        })() {
            Ok(v) => Some(Ok(v)),
            Err(Error::InsufficientBuffer) => None,
            Err(e) => Some(Err(e)),
        }
    }
}

/// Iterator over the relocation table located in .reloc
pub struct RelocationTable<'a> {
    data: ByteReader<'a>,
}

impl<'a> DataDirectoryTable<'a> for RelocationTable<'a> {
    fn new(bytes: &'a [u8], _dir: &'a DataDirectory) -> Self {
        Self {
            data: ByteReader::new(bytes),
        }
    }

    fn typ() -> DataDirectoryType {
        DataDirectoryType::RelocationTable
    }
}

impl<'a> Iterator for RelocationTable<'a> {
    type Item = Result<RelocationBlock<'a>>;

    fn next(&mut self) -> Option<Self::Item> {
        // Read the next BRB entry
        match self.data.read::<RelocationHead>() {
            Ok(head) => {
                // Check if we reached the end of the table
                if head.block_size == 0
                    || head.block_size as usize % mem::size_of::<u32>() != 0
                {
                    return None;
                }

                let data = &self.data.remaining_bytes()
                    [..head.block_size as usize - mem::size_of::<RelocationHead>()];
                self.data.skip(SkipPos::Cur(data.len()));

                Some(Ok(RelocationBlock::new(data, head)))
            }
            Err(Error::InsufficientBuffer) => None,
            Err(e) => Some(Err(e)),
        }
    }
}

/// Native structure define by [MSDN](https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#base-relocation-block)
#[derive(Clone, Copy)]
#[repr(C)]
pub struct RelocationHead {
    pub page_rva: u32,
    pub block_size: u32,
}

/// Native structure define by [MSDN](https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#base-relocation-block)
#[derive(Clone, Copy)]
pub struct RelocationEntry(u16);

impl RelocationEntry {
    pub fn offset(&self) -> u16 {
        self.0 & 0x0FFF
    }

    pub fn kind(&self) -> u16 {
        self.0 >> 12
    }
}

impl TryFrom<&RelocationEntry> for Relocation {
    type Error = Error;

    fn try_from(value: &RelocationEntry) -> core::result::Result<Self, Self::Error> {
        use Relocation::*;

        Ok(match value.kind() {
            0x0 => Absolute(value.offset()),
            0x1 => High(value.offset()),
            0x2 => Low(value.offset()),
            0x3 => HighLow(value.offset()),
            0x4 => HighAdj(value.offset()),
            0x5 => MipsArmRiscv(value.offset()),
            0x7 => ThumbRiscv(value.offset()),
            0x8 => RiscvLoong(value.offset()),
            0x9 => JmpAddr(value.offset()),
            0xA => Dir64(value.offset()),
            _ => {
                return Error::make_malformed::<RelocationEntry, _>(format!(
                    "has invalid type ({})",
                    value.kind()
                ))
            }
        })
    }
}

impl_from_bytes!(RelocationHead, RelocationEntry);