Struct goblin::pe::TE

pub struct TE<'a> {
    pub header: TeHeader,
    pub sections: Vec<SectionTable>,
    pub debug_data: DebugData<'a>,
    pub rva_offset: usize,
}

An analyzed TE binary

A TE binary is a PE/PE32+ binary that has had it’s header stripped and re-formatted to the TE specification. This presents a challenge for parsing, as all relative addresses (RVAs) are not updated to take this into account, and are thus incorrect. The parsing of a TE must take this into account by using the header::TeHeader::stripped_size` field of the TE header to adjust the RVAs during parsing.

Fields

header: TeHeader

The TE header

sections: Vec<SectionTable>

A list of the sections in this TE binary

debug_data: DebugData<'a>

Debug information, contained in the PE header

rva_offset: usize

The offset to apply to addresses not parsed by the TE parser itself: header::TeHeader::stripped_size - size_of::<header::TeHeader>()

Implementations

impl<'a> TE<'a>

pub fn parse(bytes: &'a [u8]) -> Result<Self>

Reads a TE binary from the underlying bytes

Trait Implementations

impl<'a> Debug for TE<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.