Struct goblin::pe::header::CoffHeader
source · #[repr(C)]pub struct CoffHeader {
pub machine: u16,
pub number_of_sections: u16,
pub time_date_stamp: u32,
pub pointer_to_symbol_table: u32,
pub number_of_symbol_table: u32,
pub size_of_optional_header: u16,
pub characteristics: u16,
}
Expand description
In winnt.h
, it’s IMAGE_FILE_HEADER
. COFF Header.
Together with the Header::signature and the Header::optional_header, it forms the
IMAGE_NT_HEADERS
.
§Position in a modern PE file
The COFF header is located after the Header::signature, which in turn is located after the non-standard “Rich header”, if present, and after the DosStub, according to the standard.
COFF header is followed by the Header::optional_header.
Fields§
§machine: u16
The architecture type of the computer. An image file can only be run on the specified computer or a system that emulates the specified computer.
Can be one of the following values:
COFF_MACHINE_UNKNOWN
,COFF_MACHINE_ALPHA
,COFF_MACHINE_ALPHA64
,COFF_MACHINE_AM33
,COFF_MACHINE_X86_64
,COFF_MACHINE_ARM
,COFF_MACHINE_ARM64
,COFF_MACHINE_ARMNT
,COFF_MACHINE_EBC
,COFF_MACHINE_X86
,COFF_MACHINE_IA64
,COFF_MACHINE_LOONGARCH32
,COFF_MACHINE_LOONGARCH64
,COFF_MACHINE_M32R
,COFF_MACHINE_MIPS16
,COFF_MACHINE_MIPSFPU
,COFF_MACHINE_MIPSFPU16
,COFF_MACHINE_POWERPC
,COFF_MACHINE_POWERPCFP
,COFF_MACHINE_R4000
,COFF_MACHINE_RISCV32
,COFF_MACHINE_RISCV64
,COFF_MACHINE_RISCV128
,COFF_MACHINE_SH3
,COFF_MACHINE_SH3DSP
,COFF_MACHINE_SH4
,COFF_MACHINE_SH5
,COFF_MACHINE_THUMB
,COFF_MACHINE_WCEMIPSV2
,
or any other value that is not listed here.
The constants above are sourced from https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#machine-types. If there’s a missing constant, please open an issue or a pull request.
number_of_sections: u16
The number of sections. This indicates the size of the section table, which immediately follows the headers. Note that the Windows loader limits the number of sections to 96. Source.
time_date_stamp: u32
The low 32 bits of the time stamp of the image. This represents the date and time the image was created by the linker. The value is represented in the number of seconds elapsed since midnight (00:00:00), January 1, 1970, Universal Coordinated Time, according to the system clock.
pointer_to_symbol_table: u32
The offset of the symbol table, in bytes, or zero if no COFF symbol table exists.
Typically, this field is set to 0 because COFF debugging information is deprecated. Source.
number_of_symbol_table: u32
The number of symbols in the symbol table.
Typically, this field is set to 0 because COFF debugging information is deprecated. Source.
size_of_optional_header: u16
The size of the optional header, in bytes. This value should be zero for object files.
The goblin::pe::optional_header::OptionalHeader
is meant to
represent either the 32-bit or the 64-bit optional header. The size of the optional header is used to determine
which one it is.
characteristics: u16
The characteristics of the image.
The constants for the characteristics are available in the goblin::pe::characteristic
module.
Implementations§
source§impl CoffHeader
impl CoffHeader
pub fn parse(bytes: &[u8], offset: &mut usize) -> Result<Self>
sourcepub fn sections(
&self,
bytes: &[u8],
offset: &mut usize
) -> Result<Vec<SectionTable>>
pub fn sections( &self, bytes: &[u8], offset: &mut usize ) -> Result<Vec<SectionTable>>
Parse the COFF section headers.
For COFF, these immediately follow the COFF header. For PE, these immediately follow the optional header.
Trait Implementations§
source§impl Clone for CoffHeader
impl Clone for CoffHeader
source§fn clone(&self) -> CoffHeader
fn clone(&self) -> CoffHeader
1.0.0 · source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source
. Read moresource§impl Debug for CoffHeader
impl Debug for CoffHeader
source§impl Default for CoffHeader
impl Default for CoffHeader
source§fn default() -> CoffHeader
fn default() -> CoffHeader
source§impl<'a> IntoCtx<Endian> for &'a CoffHeader
impl<'a> IntoCtx<Endian> for &'a CoffHeader
source§impl PartialEq for CoffHeader
impl PartialEq for CoffHeader
source§fn eq(&self, other: &CoffHeader) -> bool
fn eq(&self, other: &CoffHeader) -> bool
self
and other
values to be equal, and is used
by ==
.