Struct PeFile 

pub struct PeFile {

    pub machine: u16,
    pub compile_timestamp: u32,
    pub is_dll: bool,
    pub is_exe: bool,
    pub entry_point_rva: u32,
    pub image_base: u64,
    pub checksum: u32,
    pub is_dotnet: bool,
    pub tls_callback_count: usize,
    pub has_reloc: bool,
    pub is_signed: bool,
    pub pdb_path: Option<String>,
    pub overlay_offset: Option<u64>,
    pub overlay_size: Option<u64>,
    pub rich_header: Option<RichHeader>,
    pub imports: Vec<String>,
    pub exports: Vec<String>,
    pub sections: Vec<PeSection>,
    pub ascii_strings: Vec<String>,
    pub utf16_strings: Vec<String>,
    pub sha256: String,
    pub size: usize,
}

All forensically-relevant fields extracted from a PE binary.

Fields

machine: u16

COFF machine type (0x8664 AMD64, 0x014C x86, 0xAA64 ARM64).

compile_timestamp: u32

COFF compile timestamp (Unix seconds; note: frequently zeroed or faked).

is_dll: bool

True when IMAGE_FILE_DLL characteristic is set.

is_exe: bool

True when IMAGE_FILE_EXECUTABLE_IMAGE characteristic is set.

entry_point_rva: u32

Entry-point as an RVA (relative virtual address from image base). Zero for DLLs with no explicit entry point.

image_base: u64

Preferred load address for the image.

checksum: u32

Optional header CheckSum field (0 = not set; OS drivers must have a valid checksum).

is_dotnet: bool

True when the CLR runtime header (directory[14]) is present — the binary is a .NET assembly.

tls_callback_count: usize

Number of TLS callback functions registered. > 0 means code runs before the entry point.

has_reloc: bool

True when a base-relocation table is present.

is_signed: bool

True when a non-empty Authenticode certificate table is present.

pdb_path: Option<String>

PDB file path embedded in the CodeView debug directory entry. Contains the full build-machine path, e.g. C:\Users\attacker\Desktop\payload.pdb.

overlay_offset: Option<u64>

File offset where overlay data begins (byte immediately after the last section’s raw data).

overlay_size: Option<u64>

Size of the overlay in bytes.

rich_header: Option<RichHeader>

Decoded Rich header, if present. None means the header was absent or deliberately stripped — a potential anti-attribution indicator on large files.

imports: Vec<String>

Flat list of imported symbol names from all import descriptors.

exports: Vec<String>

Exported symbol names (populated for DLLs).

sections: Vec<PeSection>

Section table with per-section attributes and entropy.

ascii_strings: Vec<String>

ASCII strings (≥ 6 printable chars) extracted from all raw data.

utf16_strings: Vec<String>

UTF-16LE strings (≥ 6 printable chars) extracted from all raw data.

sha256: String

SHA-256 hash of the full binary (hex-encoded).

size: usize

Size of the binary in bytes.

Implementations

impl PeFile

pub fn all_strings(&self) -> impl Iterator<Item = &str>

Combined string table: all ASCII and UTF-16 strings.

Trait Implementations

impl Clone for PeFile

fn clone(&self) -> PeFile

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PeFile

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for PeFile

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.