Struct WindowsFields 

pub struct WindowsFields {

    pub image_base: u64,
    pub section_alignment: u32,
    pub file_alignment: u32,
    pub major_operating_system_version: u16,
    pub minor_operating_system_version: u16,
    pub major_image_version: u16,
    pub minor_image_version: u16,
    pub major_subsystem_version: u16,
    pub minor_subsystem_version: u16,
    pub win32_version_value: u32,
    pub size_of_image: u32,
    pub size_of_headers: u32,
    pub checksum: u32,
    pub subsystem: Subsystem,
    pub dll_characteristics: u16,
    pub size_of_stack_reserve: u64,
    pub size_of_stack_commit: u64,
    pub size_of_heap_reserve: u64,
    pub size_of_heap_commit: u64,
    pub loader_flags: u32,
    pub number_of_rva_and_sizes: u32,
}

Provides access to low-level file and memory parsing utilities.

The crate::Parser type is used for decoding CIL bytecode and metadata streams.

Usage Examples

use dotscope::{Parser, assembly::decode_instruction};
let code = [0x2A]; // ret
let mut parser = Parser::new(&code);
let instr = decode_instruction(&mut parser, 0x1000)?;
assert_eq!(instr.mnemonic, "ret");

Windows-specific fields.

Fields

image_base: u64

Image base address

section_alignment: u32

Section alignment in memory

file_alignment: u32

File alignment

major_operating_system_version: u16

Major OS version

minor_operating_system_version: u16

Minor OS version

major_image_version: u16

Major image version

minor_image_version: u16

Minor image version

major_subsystem_version: u16

Major subsystem version

minor_subsystem_version: u16

Minor subsystem version

win32_version_value: u32

Win32 version value

size_of_image: u32

Size of image

size_of_headers: u32

Size of headers

checksum: u32

Checksum

subsystem: Subsystem

Subsystem

dll_characteristics: u16

DLL characteristics

size_of_stack_reserve: u64

Size of stack reserve

size_of_stack_commit: u64

Size of stack commit

size_of_heap_reserve: u64

Size of heap reserve

size_of_heap_commit: u64

Size of heap commit

loader_flags: u32

Loader flags

number_of_rva_and_sizes: u32

Number of RVA and sizes

Implementations

impl WindowsFields

pub const SIZE_FOR_FORMAT: [usize; 2]

Size of Windows-specific fields: [PE32, PE32+]

• PE32: 68 bytes (4-byte image_base and stack/heap sizes)
• PE32+: 88 bytes (8-byte image_base and stack/heap sizes)

pub fn write_to<W: Write>( &self, writer: &mut W, is_pe32_plus: bool, ) -> Result<()>

Writes this Windows-specific fields structure to the writer.

Arguments

• writer - The writer to output the fields to
• is_pe32_plus - true for PE32+ (64-bit), false for PE32 (32-bit)

Errors

Returns an error if writing fails or if PE32 format has values exceeding u32 range.

Trait Implementations

impl Clone for WindowsFields

fn clone(&self) -> WindowsFields

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for WindowsFields

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.