Struct PE 

pub struct PE {
    pub base: *mut c_void,
}

Portable Executable (PE) abstraction over a module’s in-memory image.

Fields

base: *mut c_void

Base address of the loaded module.

Implementations

impl PE

pub fn parse(base: *mut c_void) -> Self

Creates a new PE instance from a module base.

pub fn dos_header(&self) -> *const IMAGE_DOS_HEADER

Returns the DOS header of the module.

pub fn nt_header(&self) -> Option<*const IMAGE_NT_HEADERS>

Returns a pointer to the IMAGE_NT_HEADERS, if valid.

pub fn sections(&self) -> Option<&[IMAGE_SECTION_HEADER]>

Returns all section headers in the PE.

pub fn section_name_by_rva(&self, rva: u32) -> Option<&str>

Finds the name of the section containing a specific RVA.

pub fn section_by_name(&self, name: &str) -> Option<&IMAGE_SECTION_HEADER>

Finds a section by its name.

pub fn exports(&self) -> Exports<'_>

Exports helper

Trait Implementations

impl Debug for PE

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.