Struct PeLoader 

pub struct PeLoader { /* private fields */ }

PE image loader for mapping Windows executables into the emulation address space.

PeLoader parses Portable Executable (PE) files and maps them into an AddressSpace with proper section alignment, memory protection, and optional relocation support.

Features

• Parses both PE32 (32-bit) and PE32+ (64-bit) formats
• Maps sections at their correct virtual addresses
• Applies section-specific memory protection flags
• Handles BSS (uninitialized data) sections
• Detects .NET assemblies via CLR header

Configuration

Loading behavior can be customized via PeLoaderConfig:

• Override the base address
• Disable memory protection enforcement
• Enable/disable import resolution
• Control relocation application

Thread Safety

PeLoader instances are not Sync due to internal state, but multiple loaders can operate on the same address space concurrently.

Example

use dotscope::emulation::loader::PeLoader;
use std::path::Path;

let loader = PeLoader::new();
let image = loader.load_file(
    Path::new("program.exe"),
    &address_space,
)?;

println!("Loaded {} ({} sections)", image.name, image.sections.len());

Implementations

impl PeLoader

pub fn new() -> Self

Creates a new PE loader with default configuration.

The default configuration uses the PE’s preferred base address, applies section permissions, and handles relocations automatically.

Returns

A new PeLoader instance with default settings.

Example

let loader = PeLoader::new();

pub fn with_config(config: PeLoaderConfig) -> Self

Creates a new PE loader with the specified configuration.

Use this constructor when you need to customize loading behavior, such as specifying a base address or disabling permissions.

Arguments

• config - The configuration to use for loading

Returns

A new PeLoader instance with the specified configuration.

Example

let config = PeLoaderConfig::new()
    .with_base_address(0x10000000)
    .without_permissions();
let loader = PeLoader::with_config(config);

pub fn load( &self, pe_bytes: &[u8], address_space: &AddressSpace, name: impl Into<String>, ) -> Result<LoadedImage>

Loads a PE image from a byte slice into the address space.

Parses the PE headers from the provided bytes, allocates space in the address space, and maps each section to its virtual address. The image is loaded according to the loader’s configuration.

Arguments

• pe_bytes - The raw bytes of the PE file
• address_space - The address space to map the image into
• name - A name/label for the loaded image (used for debugging)

Returns

Returns Ok(LoadedImage) containing metadata about the loaded image, or an error if parsing or mapping fails.

Errors

Returns an error if:

• The bytes are not a valid PE file
• The PE headers are malformed or unsupported
• The target address range is already mapped
• Memory allocation fails

Example

let pe_data = std::fs::read("program.exe")?;
let image = loader.load(&pe_data, &address_space, "program.exe")?;

pub fn load_file( &self, path: &Path, address_space: &AddressSpace, ) -> Result<LoadedImage>

Loads a PE image from a file path into the address space.

Convenience method that reads the file from disk and then calls load. The filename (without directory path) is used as the image name.

Arguments

• path - Path to the PE file to load
• address_space - The address space to map the image into

Returns

Returns Ok(LoadedImage) containing metadata about the loaded image, or an error if reading or loading fails.

Errors

Returns an error if:

• The file cannot be read (permission denied, not found, I/O error)
• The file is not a valid PE (see load for parsing errors)
• The address space cannot accommodate the image

Example

use std::path::Path;

let loader = PeLoader::new();
let image = loader.load_file(
    Path::new("C:\\Windows\\System32\\kernel32.dll"),
    &address_space,
)?;

println!("Loaded: {}", image.name);
println!("Base: 0x{:X}", image.base_address);
println!("Size: 0x{:X} bytes", image.size_of_image);

Trait Implementations

impl Default for PeLoader

fn default() -> Self

Returns the “default value” for a type.