Crate exe

exe-rs is a library for handling PE files, whether it be building them or analyzing them!

Getting started is easy:

use exe::PEImage;
use exe::types::{ImportDirectory, ImportData, CCharString};

let image = PEImage::from_disk_file("test/compiled.exe").unwrap();
let import_directory = ImportDirectory::parse(&image.pe).unwrap();

for descriptor in import_directory.descriptors {
   println!("Module: {}", descriptor.get_name(&image.pe).unwrap().as_str());
   println!("Imports:");

   for import in descriptor.get_imports(&image.pe).unwrap() {
      match import {
         ImportData::Ordinal(x) => println!("   #{}", x),
         ImportData::ImportByName(s) => println!("   {}", s)
      }
   }
}

Standard PE headers and other types can be found in the headers module, while helper types can be found in the types module. The buffer module contains low-level functionality for handling a PE buffer, such as hashing and collecting pointers. Further usage examples can be found in the test file.

Re-exports

pub use crate::buffer::*;

pub use crate::headers::*;

pub use crate::types::*;

pub use crate::imphash::*;

Modules

buffer

This module contains everything needed for representing a PE buffer. The buffer contains raw functionality necessary to cast objects from the data vector, as well as helper functions to perform calculations such as hashes and entropy.

headers

This module contains all the headers necessary to parse various aspects of a PE file.

imphash

This module only exports a single function. It’s used to contain metadata used to perform the imphash algorithm.

types

This module contains Rust types to help with the parsing of PE files.

Structs

PE

Represents PE data.

PEImage

Represents a PE object with owned data.

Enums

Error

Errors produced by the library.

PETranslation

An enum to translate between RVA and Offset addresses.

PEType

An enum to tag the PE file with what its memory map looks like.