pub struct PeFile { /* private fields */ }Expand description
An owning wrapper around a PE/EFI image (UKI).
Holds the file bytes, parses with goblin on demand, and returns
borrowed slices tied to &self. This avoids lifetimes in the
public API and side-steps self-referential types.
Implementations§
Source§impl PeFile
impl PeFile
Sourcepub fn from_bytes(bytes: Vec<u8>) -> Result<Self>
pub fn from_bytes(bytes: Vec<u8>) -> Result<Self>
Construct from a caller-provided byte vector.
Sourcepub fn arch_summary(&self) -> Result<(&'static str, bool)>
pub fn arch_summary(&self) -> Result<(&'static str, bool)>
Return a human-oriented architecture label and PE32+ flag.
Common results:
("x86_64", true)for amd64 UKIs("aarch64", true)for ARM64 UKIs("i386", false)for 32-bit x86
Sourcepub fn section_info(&self, name: &str) -> Result<Option<(usize, usize)>>
pub fn section_info(&self, name: &str) -> Result<Option<(usize, usize)>>
Offset and file size of a named section, if it exists. (file_offset, file_size)
Sourcepub fn section_bytes(&self, name: &str) -> Result<Option<&[u8]>>
pub fn section_bytes(&self, name: &str) -> Result<Option<&[u8]>>
Borrow raw bytes of a named section (e.g., “.initrd”, “.linux”, “.cmdline”).
Returns Ok(None) if the section is missing or coordinates are invalid.
Sourcepub fn read_text(&self, name: &str) -> Result<Option<String>>
pub fn read_text(&self, name: &str) -> Result<Option<String>>
Read a section as text (trim at first NUL). Ideal for .cmdline / .osrel.
Sourcepub fn is_signed(&self) -> Result<bool>
pub fn is_signed(&self) -> Result<bool>
True if the image contains one or more Attribute Certificates.
Presence indicates a Certificate Table exists; it does not mean
the signature is valid. Modifying sections (e.g., .initrd) will typically
invalidate verification in Secure Boot.
Sourcepub fn certificate_metadata(&self) -> Result<Vec<(u32, u16, u16)>>
pub fn certificate_metadata(&self) -> Result<Vec<(u32, u16, u16)>>
Lightweight metadata for each attribute certificate: (length, revision, type).
revision and typ come from the WIN_CERTIFICATE header. The blob itself is
usually PKCS#7 SignedData (typ 0x0002).
Sourcepub fn certificate_blobs(&self) -> Result<Vec<&[u8]>>
pub fn certificate_blobs(&self) -> Result<Vec<&[u8]>>
The raw certificate blobs (&[u8]) for each attribute certificate.