Struct goblin::pe::PE

pub struct PE<'a> {
    pub header: Header,
    pub sections: Vec<SectionTable>,
    pub size: usize,
    pub name: Option<&'a str>,
    pub is_lib: bool,
    pub is_64: bool,
    pub entry: usize,
    pub image_base: usize,
    pub export_data: Option<ExportData<'a>>,
    pub import_data: Option<ImportData<'a>>,
    pub exports: Vec<Export<'a>>,
    pub imports: Vec<Import<'a>>,
    pub libraries: Vec<&'a str>,
    pub debug_data: Option<DebugData<'a>>,
}

An analyzed PE32/PE32+ binary

Fields

header: Header

The PE header

sections: Vec<SectionTable>

A list of the sections in this PE binary

size: usize

The size of the binary

name: Option<&'a str>

The name of this dll, if it has one

is_lib: bool

Whether this is a dll or not

is_64: bool

Whether the binary is 64-bit (PE32+)

entry: usize

the entry point of the binary

image_base: usize

The binary's RVA, or image base - useful for computing virtual addreses

export_data: Option<ExportData<'a>>

Data about any exported symbols in this binary (e.g., if it's a dll)

import_data: Option<ImportData<'a>>

Data for any imported symbols, and from which dll, etc., in this binary

exports: Vec<Export<'a>>

The list of exported symbols in this binary, contains synthetic information for easier analysis

imports: Vec<Import<'a>>

The list symbols imported by this binary from other dlls

libraries: Vec<&'a str>

The list of libraries which this binary imports symbols from

debug_data: Option<DebugData<'a>>

Debug information, if any, contained in the PE header

Methods

impl<'a> PE<'a>

fn parse(bytes: &'a [u8]) -> Result<Self>

Reads a PE binary from the underlying bytes

Trait Implementations

impl<'a> Debug for PE<'a>

fn fmt(&self, __arg_0: &mut Formatter) -> Result

Formats the value using the given formatter.