Crate exec_pe_core 

PE (Portable Executable) binary format parser.

Medium-agnostic: accepts raw &[u8] bytes from any source — disk file, memory dump page, AFF4 stream, network capture, or carved fragment.

Quick start

use exec_pe_core::{parse_pe, PeFile};

let bytes = std::fs::read("rbcw.exe").unwrap();
let pe = parse_pe(&bytes).expect("valid PE");
println!("machine: {:#06x}", pe.machine);
println!("imports: {:?}", pe.imports);

Re-exports

pub use anomalies::detect_structural_anomalies;

pub use anomalies::PeAnomaly;

pub use error::PeError;

pub use parser::parse_pe;

pub use parser::parse_pe_path;

pub use parser::PeFile;

pub use parser::PeSection;

pub use rich_header::parse_rich_header;

pub use rich_header::RichEntry;

pub use rich_header::RichHeader;

Modules

anomalies

Structural PE anomaly detection — pure computation over a parsed PeFile.

error

Error types for pe-core.

parser

Core PE parser: parse_pe(&[u8]) -> Result<PeFile, PeError>.

rich_header

Rich header parsing — compiler fingerprint between DOS stub and PE signature.

strings

String extraction from PE binary data.