Module goblin::pe::header

Structs

• CoffHeader
  In winnt.h, it’s IMAGE_FILE_HEADER. COFF Header.
• DosHeader
  In winnt.h and pe.h, it’s IMAGE_DOS_HEADER. It’s a DOS header present in all PE binaries.
• DosStub
  The DOS stub program which should be executed in DOS mode. It prints the message “This program cannot be run in DOS mode” and exits.
• Header
  The PE header.

Constants

• COFF_MACHINE_ALPHA
  Alpha AXP, 32-bit address space.
• COFF_MACHINE_ALPHA64
  Alpha AXP, 64-bit address space.
• COFF_MACHINE_AM33
  Matsushita AM33.
• COFF_MACHINE_ARM
  ARM little endian.
• COFF_MACHINE_ARM64
  ARM64 little endian.
• COFF_MACHINE_ARMNT
  ARM Thumb-2 little endian.
• COFF_MACHINE_EBC
  EFI byte code.
• COFF_MACHINE_IA64
  Intel Itanium processor family.
• COFF_MACHINE_LOONGARCH32
  LoongArch 32-bit processor family.
• COFF_MACHINE_LOONGARCH64
  LoongArch 64-bit processor family.
• COFF_MACHINE_M32R
  Mitsubishi M32R little endian.
• COFF_MACHINE_MIPS16
  MIPS16.
• COFF_MACHINE_MIPSFPU
  MIPS with FPU.
• COFF_MACHINE_MIPSFPU16
  MIPS16 with FPU.
• COFF_MACHINE_POWERPC
  Power PC little endian.
• COFF_MACHINE_POWERPCFP
  Power PC with floating point support.
• COFF_MACHINE_R4000
  MIPS little endian.
• COFF_MACHINE_RISCV32
  RISC-V 32-bit address space.
• COFF_MACHINE_RISCV64
  RISC-V 64-bit address space.
• COFF_MACHINE_RISCV128
  RISC-V 128-bit address space
• COFF_MACHINE_SH3
  Hitachi SH3.
• COFF_MACHINE_SH3DSP
  Hitachi SH3 DSP.
• COFF_MACHINE_SH4
  Hitachi SH4.
• COFF_MACHINE_SH5
  Hitachi SH5.
• COFF_MACHINE_THUMB
  Thumb.
• COFF_MACHINE_UNKNOWN
  The contents of this field are assumed to be applicable to any machine type.
• COFF_MACHINE_WCEMIPSV2
  MIPS little-endian WCE v2.
• COFF_MACHINE_X86
  Intel 386 or later processors and compatible processors.
• COFF_MACHINE_X86_64
  x64 aka amd64.
• DOS_MAGIC
• DOS_STUB_OFFSET
• PE_MAGIC
  PE\0\0, little endian
• PE_POINTER_OFFSET
• SIZEOF_COFF_HEADER
• SIZEOF_PE_MAGIC

Functions

• machine_to_str
  Convert machine to str representation. Any case of “COFF_UNKNOWN” should be expected to change to a more specific value.