peview 0.2.3

A minimal and fast zero-copy parser for the PE32+ file format.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114

use peview::{
    dir::{ExportValue, Import, Relocation},
    file::PeView,
};
use std::{error::Error, fs::File, io::Read};

#[test]
fn it_parses_relocations() -> Result<(), Box<dyn Error>> {
    let mut buf = Vec::new();
    File::open("etc/exe/ntoskrnl.exe")?.read_to_end(&mut buf)?;
    let pe = PeView::parse(&buf)?;

    const CHECKED_INDEX: usize = 560;

    let mut reloc_count = 0;
    for i in pe.relocations()? {
        let block = i?;

        if reloc_count == CHECKED_INDEX {
            assert_eq!(block.page_rva(), 0x3000);
        }

        for j in block {
            if let Relocation::Dir64(v) = j? {
                reloc_count += 1;

                if reloc_count == CHECKED_INDEX {
                    assert_eq!(v, 0x18);
                }
            }
        }
    }

    assert_eq!(reloc_count, 10048);

    Ok(())
}

#[test]
fn it_parses_imports() -> Result<(), Box<dyn Error>> {
    let mut buf = Vec::new();
    File::open("etc/exe/ntoskrnl.exe")?.read_to_end(&mut buf)?;
    let pe = PeView::parse(&buf)?;

    const CHECKED_INDEX: usize = 118;

    let mut import_count = 0;
    for i in pe.imports()? {
        let module = i?;

        if import_count == CHECKED_INDEX {
            assert_eq!(module.name()?, "kdcom.dll");
        }

        for j in module {
            if let Import::Name(h, n) = j? {
                import_count += 1;

                if import_count == CHECKED_INDEX {
                    assert_eq!(n, "KdPower");
                    assert_eq!(h, 1);
                }
            }
        }
    }

    assert_eq!(import_count, 179);

    Ok(())
}

#[test]
fn it_parses_exports() -> Result<(), Box<dyn Error>> {
    let mut buf = Vec::new();
    File::open("etc/exe/ntoskrnl.exe")?.read_to_end(&mut buf)?;
    let pe = PeView::parse(&buf)?;

    const CHECKED_INDEX: usize = 1987;

    let mut export_count = 0;
    for i in pe.exports()? {
        let export = i?;
        if let Some(n) = export.name {
            if let ExportValue::Rva(v) = export.value {
                export_count += 1;

                if export_count == CHECKED_INDEX {
                    assert_eq!(n, "RtlClearBit");
                    assert_eq!(v, 0x338560);
                }
            }
        }
    }

    assert_eq!(export_count, 3064);

    Ok(())
}

#[test]
fn it_parses_cert() -> Result<(), Box<dyn Error>> {
    let mut buf = Vec::new();
    File::open("etc/exe/ntoskrnl.exe")?.read_to_end(&mut buf)?;
    let pe = PeView::parse(&buf)?;

    for i in pe.certificates()? {
        let cert = i?;
        assert_eq!(cert.value().bytes().len(), 0x2560);
        assert_eq!(cert.revision(), 0x200);
        assert_eq!(cert.typ(), 2);
    }

    Ok(())
}