Struct pe_parser::optional::optional_header_64

#[repr(C)]
pub struct optional_header_64 {

    pub magic: u16,
    pub major_linker_version: u8,
    pub minor_linker_version: u8,
    pub size_of_code: u32,
    pub size_of_initialized_data: u32,
    pub size_of_uninitialized_data: u32,
    pub address_of_entry_point: u32,
    pub base_of_code: u32,
    pub image_base: u64,
    pub section_alignment: u32,
    pub file_alignment: u32,
    pub major_operating_system_version: u16,
    pub minor_operating_system_version: u16,
    pub major_image_version: u16,
    pub minor_image_version: u16,
    pub major_subsystem_version: u16,
    pub minor_subsystem_version: u16,
    pub win32_version_value: u32,
    pub size_of_image: u32,
    pub size_of_headers: u32,
    pub check_sum: u32,
    pub subsystem: u16,
    pub dll_characteristics: u16,
    pub size_of_stack_reserve: u64,
    pub size_of_stack_commit: u64,
    pub size_of_heap_reserve: u64,
    pub size_of_heap_commit: u64,
    pub loader_flags: u32,
    pub number_of_rva_and_sizes: u32,
    pub data_directories: data_directories,
}

PE32+ Optional Header (Image Only)

Fields

magic: u16

The unsigned integer that identifies the state of the image file. The most common number is 0x10B, which identifies it as a normal executable file. 0x107 identifies it as a ROM image, and 0x20B identifies it as a PE32+ executable.

major_linker_version: u8

The linker major version number.

minor_linker_version: u8

The linker minor version number.

size_of_code: u32

The size of the code (text) section, or the sum of all code sections if there are multiple sections.

size_of_initialized_data: u32

The size of the initialized data section, or the sum of all such sections if there are multiple data sections.

size_of_uninitialized_data: u32

The size of the uninitialized data section (BSS), or the sum of all such sections if there are multiple BSS sections.

address_of_entry_point: u32

The address of the entry point relative to the image base when the executable file is loaded into memory. For program images, this is the starting address. For device drivers, this is the address of the initialization function. An entry point is optional for DLLs. When no entry point is present, this field must be zero.

base_of_code: u32

The address that is relative to the image base of the beginning-of-code section when it is loaded into memory.

image_base: u64

The preferred address of the first byte of image when loaded into memory; must be a multiple of 64 K. The default for DLLs is 0x10000000. The default for Windows CE EXEs is 0x00010000. The default for Windows NT, Windows 2000, Windows XP, Windows 95, Windows 98, and Windows Me is 0x00400000.

section_alignment: u32

The alignment (in bytes) of sections when they are loaded into memory. It must be greater than or equal to file_alignment. The default is the page size for the architecture.

file_alignment: u32

The alignment factor (in bytes) that is used to align the raw data of sections in the image file. The value should be a power of 2 between 512 and 64 K, inclusive. The default is 512. If the section_alignment is less than the architecture’s page size, then file_alignment must match section_alignment.

major_operating_system_version: u16

The major version number of the required operating system.

minor_operating_system_version: u16

The minor version number of the required operating system.

major_image_version: u16

The major version number of the image.

minor_image_version: u16

The minor version number of the image.

major_subsystem_version: u16

The major version number of the subsystem.

minor_subsystem_version: u16

The minor version number of the subsystem.

win32_version_value: u32

Reserved, must be zero.

size_of_image: u32

The size (in bytes) of the image, including all headers, as the image is loaded in memory. It must be a multiple of section_alignment.

size_of_headers: u32

The combined size of an MS-DOS stub, PE header, and section headers rounded up to a multiple of file_alignment.

check_sum: u32

The image file checksum. The algorithm for computing the checksum is incorporated into IMAGHELP.DLL. The following are checked for validation at load time: all drivers, any DLL loaded at boot time, and any DLL that is loaded into a critical Windows process.

subsystem: u16

The subsystem that is required to run this image.

dll_characteristics: u16

Bitflag characteristics that describe how a DLL should be loaded.

size_of_stack_reserve: u64

The size of the stack to reserve. Only size_of_stack_commit is committed; the rest is made available one page at a time until the reserve size is reached.

size_of_stack_commit: u64

The size of the stack to commit.

size_of_heap_reserve: u64

The size of the local heap space to reserve. Only size_of_heap_commit is committed; the rest is made available one page at a time until the reserve size is reached.

size_of_heap_commit: u64

The size of the local heap space to commit.

loader_flags: u32

Reserved, must be zero.

number_of_rva_and_sizes: u32

The number of data-directory entries in the remainder of the optional header. Each describes a location and size.

data_directories: data_directories

Struct containing basic information (address and size) of each table.

Trait Implementations

impl Clone for optional_header_64

fn clone(&self) -> optional_header_64

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Default for optional_header_64

fn default() -> optional_header_64

Returns the “default value” for a type.

impl Display for optional_header_64

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Optional for optional_header_64

fn get_subsystem(&self) -> Option<Subsystem>

Returns the subsystem as an enum

fn get_dll_characteristics(&self) -> Option<DLLCharacteristics>

Returns the DLL Characteristics as bitflags

fn parse_optional_header( binary: &[u8], offset: &mut usize ) -> Result<Self, Error>

Parse optional header (either PE32, or PE32+) starting at the given offset.

impl Zeroable for optional_header_64

fn zeroed() -> Self

Calls zeroed.

impl Copy for optional_header_64

impl Pod for optional_header_64