Struct malwaredb_types::exec::pef::Pef

pub struct Pef<'a> {
    pub arch: Architecture,
    pub ordering: Ordering,
    pub os: OperatingSystem,
    pub sections: Option<Vec<Section<'a>>>,
    pub timestamp: u32,
    pub contents: &'a [u8],
}

The struct for Preferred Executables.

This was the binary format for “Classic” Mac OS, and BeOS on PowerPC. Some of the data is only on the “resource fork”, which is not available on modern systems, so we can’t the entire file. :(

Fields

arch: Architecture

Instruction set architecture for this binary

ordering: Ordering

Byte ordering for this binary

os: OperatingSystem

Operating System for this binary, likely Classic Mac OS

sections: Option<Vec<Section<'a>>>

Sections of this binary

timestamp: u32

Seconds since 1 January 1904

contents: &'a [u8]

The array containing the raw bytes used to parse this program

Implementations

impl<'a> Pef<'a>

pub fn from(contents: &'a [u8]) -> Result<Self>

pub fn compiled_date(&self) -> DateTime<Utc>

Trait Implementations

impl<'a> Clone for Pef<'a>

fn clone(&self) -> Pef<'a>

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'a> Debug for Pef<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a> Display for Pef<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a> ExecutableFile for Pef<'a>

fn architecture(&self) -> &Architecture

fn pointer_size(&self) -> usize

fn operating_system(&self) -> &OperatingSystem

fn compiled_timestamp(&self) -> Option<DateTime<Utc>>

fn num_sections(&self) -> u32

fn sections(&self) -> Option<&Vec<Section<'_>>>

impl<'a> PartialEq for Pef<'a>

fn eq(&self, other: &Pef<'a>) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

This method tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<'a> SpecimenFile for Pef<'a>

const MAGIC: &'static [&'static [u8]] = _

fn type_name(&self) -> &'static str

impl<'a> StructuralPartialEq for Pef<'a>