Struct symbolic::debuginfo::pe::PeObject

pub struct PeObject<'data> { /* private fields */ }

Portable Executable, an extension of COFF used on Windows.

This file format is used to carry program code. Debug information is usually moved to a separate container, PdbObject. The PE file contains a reference to the PDB and vice versa to verify that the files belong together.

In rare instances, PE files might contain debug information. This is supported for DWARF debug information.

Implementations

impl<'data> PeObject<'data>

pub fn test(data: &[u8]) -> bool

Tests whether the buffer could contain an PE object.

pub fn parse(data: &'data [u8]) -> Result<PeObject<'data>, PeError>

Tries to parse a PE object from the given slice.

pub fn file_format(&self) -> FileFormat

The container file format, which is always FileFormat::Pe.

pub fn code_id(&self) -> Option<CodeId>

The code identifier of this object.

The code identifier consists of the time_date_stamp field id the COFF header, followed by the size_of_image field in the optional header. If the optional PE header is not present, this identifier is None.

pub fn debug_id(&self) -> DebugId

The debug information identifier of this PE.

Since debug information is usually stored in an external PdbObject, this identifier actually refers to the PDB. While strictly the filename of the PDB would also be necessary fully resolve it, in most instances the GUID and age contained in this identifier are sufficient.

pub fn debug_file_name(&self) -> Option<Cow<'_, str>>

The name of the referenced PDB file.

pub fn arch(&self) -> Arch

The CPU architecture of this object, as specified in the COFF header.

pub fn kind(&self) -> ObjectKind

The kind of this object, as specified in the PE header.

pub fn load_address(&self) -> u64

The address at which the image prefers to be loaded into memory.

ELF files store all internal addresses as if it was loaded at that address. When the image is actually loaded, that spot might already be taken by other images and so it must be relocated to a new address. During load time, the loader rewrites all addresses in the program code to match the new load address so that there is no runtime overhead when executing the code.

Addresses used in symbols or debug_session have already been rebased relative to that load address, so that the caller only has to deal with addresses relative to the actual start of the image.

pub fn has_symbols(&self) -> bool

Determines whether this object exposes a public symbol table.

pub fn symbols(&self) -> PeSymbolIterator<'data, '_>

Returns an iterator over symbols in the public symbol table.

pub fn symbol_map(&self) -> SymbolMap<'data>

Returns an ordered map of symbols in the symbol table.

pub fn has_debug_info(&self) -> bool

Determines whether this object contains debug information.

Not usually the case, except for PE’s generated by some alternative toolchains which contain DWARF debug info.

pub fn has_sources(&self) -> bool

Determines whether this object contains embedded source.

pub fn is_malformed(&self) -> bool

Determines whether this object is malformed and was only partially parsed

pub fn debug_session(&self) -> Result<DwarfDebugSession<'data>, DwarfError>

Constructs a debugging session.

A debugging session loads certain information from the object file and creates caches for efficient access to various records in the debug information. Since this can be quite a costly process, try to reuse the debugging session as long as possible.

PE files usually don’t have embedded debugging information, but some toolchains (e.g. MinGW) generate DWARF debug info.

Constructing this session will also work if the object does not contain debugging information, in which case the session will be a no-op. This can be checked via has_debug_info.

pub fn has_unwind_info(&self) -> bool

Determines whether this object contains stack unwinding information.

pub fn data(&self) -> &'data [u8]

Returns the raw data of the PE file.

pub fn sections(&self) -> &[SectionTable]

A list of the sections in this PE binary, used to resolve virtual addresses.

pub fn section(&self, name: &str) -> Option<SectionTable>

Returns the SectionTable for the section with this name, if present.

pub fn exception_data(&self) -> Option<&ExceptionData<'_>>

Returns exception data containing unwind information.

pub fn embedded_ppdb( &self ) -> Result<Option<PeEmbeddedPortablePDB<'data>>, PeError>

Returns the raw buffer of Embedded Portable PDB Debug directory entry, if any.

Trait Implementations

impl<'slf, 'data> AsSelf<'slf> for PeObject<'data>where 'data: 'slf,

type Ref = PeObject<'slf>

The Self type with 'slf lifetimes, returned by as_self.

fn as_self(&'slf self) -> &'slf <PeObject<'data> as AsSelf<'slf>>::Ref

Returns a reference to self with downcasted lifetime.

impl Debug for PeObject<'_>

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'data> Dwarf<'data> for PeObject<'data>

fn endianity(&self) -> RunTimeEndian

Returns whether the file was compiled for a big-endian or little-endian machine.

fn raw_section(&self, name: &str) -> Option<DwarfSection<'data>>

Returns information and raw data of a section.

fn section(&self, name: &str) -> Option<DwarfSection<'data>>

Returns information and data of a section.

fn has_section(&self, name: &str) -> bool

Determines whether the specified section exists.

impl<'data, 'object> ObjectLike<'data, 'object> for PeObject<'data>where 'data: 'object,

type Error = DwarfError

Errors thrown when reading information from this object.

type Session = DwarfDebugSession<'data>

A session that allows optimized access to debugging information.

type SymbolIterator = PeSymbolIterator<'data, 'object>

The iterator over the symbols in the public symbol table.

fn file_format(&self) -> FileFormat

The container format of this file.

fn code_id(&self) -> Option<CodeId>

The code identifier of this object.

fn debug_id(&self) -> DebugId

The debug information identifier of this object.

fn arch(&self) -> Arch

The CPU architecture of this object.

fn kind(&self) -> ObjectKind

The kind of this object.

fn load_address(&self) -> u64

The address at which the image prefers to be loaded into memory.

fn has_symbols(&self) -> bool

Determines whether this object exposes a public symbol table.

fn symbols( &'object self ) -> <PeObject<'data> as ObjectLike<'data, 'object>>::SymbolIterator

Returns an iterator over symbols in the public symbol table.

fn symbol_map(&self) -> SymbolMap<'data>

Returns an ordered map of symbols in the symbol table.

fn has_debug_info(&self) -> bool

Determines whether this object contains debug information.

fn debug_session( &self ) -> Result<<PeObject<'data> as ObjectLike<'data, 'object>>::Session, <PeObject<'data> as ObjectLike<'data, 'object>>::Error>

Constructs a debugging session.

fn has_unwind_info(&self) -> bool

Determines whether this object contains stack unwinding information.

fn has_sources(&self) -> bool

Determines whether this object contains embedded sources.

fn is_malformed(&self) -> bool

Determines whether this object is malformed and was only partially parsed