Struct PE 

pub struct PE<'a> { /* private fields */ }

PE struct.

Implementations

impl<'a> PE<'a>

pub fn from_path<P: AsRef<Path>>(filename: P) -> Result<Self, PeSignError>

Parse PE struct from disk path.

Example

use pesign::{PE, structs::{ImageNtHeaders, HDR64_MAGIC}};

let mut image = PE::from_path("test/normal64.exe").unwrap();
let headers = image.get_nt_headers().unwrap();

let magic = match headers {
   ImageNtHeaders::ImageNTHeaders32(hdr32) => hdr32.optional_header.magic,
   ImageNtHeaders::ImageNTHeaders64(hdr64) => hdr64.optional_header.magic,
};

assert_eq!(magic, HDR64_MAGIC);

pub fn from_bytes(bytes: &'a [u8]) -> Result<Self, PeSignError>

Parse PE struct from memory bytes.

Example

use pesign::{PE, structs::{ImageNtHeaders, HDR64_MAGIC}};

let bytes = std::fs::read("test/normal64.exe").unwrap();

let mut image = PE::from_bytes(&bytes).unwrap();
let headers = image.get_nt_headers().unwrap();

let magic = match headers {
   ImageNtHeaders::ImageNTHeaders32(hdr32) => hdr32.optional_header.magic,
   ImageNtHeaders::ImageNTHeaders64(hdr64) => hdr64.optional_header.magic,
};

assert_eq!(magic, HDR64_MAGIC);

pub fn from_reader( reader: Box<dyn ReadAndSeek + 'a>, ) -> Result<Self, PeSignError>

Parse PE struct from reader.

The reader must implement both the Read and Seek traits.

Example

use pesign::{PE, structs::{ImageNtHeaders, HDR64_MAGIC}};

let file = Box::new(std::fs::File::open("test/normal64.exe").unwrap());

let mut image = PE::from_reader(file).unwrap();
let headers = image.get_nt_headers().unwrap();

let magic = match headers {
   ImageNtHeaders::ImageNTHeaders32(hdr32) => hdr32.optional_header.magic,
   ImageNtHeaders::ImageNTHeaders64(hdr64) => hdr64.optional_header.magic,
};

assert_eq!(magic, HDR64_MAGIC);

pub fn get_dos_header(&mut self) -> Result<ImageDOSHeader, PeSignError>

Get the DOS header of the PE file.

pub fn e_lfanew(&mut self) -> Result<u32, PeSignError>

Get the offset of NTHeaders within the PE file.

pub fn get_arch(&mut self) -> Result<Arch, PeSignError>

Get the architecture of the PE file.

pub fn get_nt_headers(&mut self) -> Result<ImageNtHeaders, PeSignError>

Get the NT headers of this PE file, inferring from the content of the file which architecture it is.

Example

use pesign::{PE, structs::{ImageNtHeaders, HDR64_MAGIC}};

let mut image = PE::from_path("test/normal64.exe").unwrap();
let headers = image.get_nt_headers().unwrap();

let magic = match headers {
   ImageNtHeaders::ImageNTHeaders32(hdr32) => hdr32.optional_header.magic,
   ImageNtHeaders::ImageNTHeaders64(hdr64) => hdr64.optional_header.magic,
};

assert_eq!(magic, HDR64_MAGIC);

pub fn get_nt_headers_32(&mut self) -> Result<ImageNTHeaders32, PeSignError>

Get 32-bit NT Headers

pub fn get_nt_headers_64(&mut self) -> Result<ImageNTHeaders64, PeSignError>

Get 64-bit NT Headers

pub fn get_nt_magic(&mut self) -> Result<u16, PeSignError>

Get the NT magic from the optional header of the NT headers.

pub fn get_data_directory_offset(&mut self) -> Result<u64, PeSignError>

Get the offset to the data directory within the PE file.

pub fn get_data_directory_size(&mut self) -> Result<u64, PeSignError>

Get the size of the data directory.

Rounds down number_of_rva_and_sizes to 16, which is what the Windows loader does.

pub fn get_data_directory_table( &mut self, ) -> Result<Vec<ImageDataDirectory>, PeSignError>

Get the data directory table.

Normally one would expect this to be a part of ImageOptionalHeader, but ImageOptionalHeader::number_of_rva_and_sizes controls the size of the array. Therefore, we can’t stick it in the optional header, because that would produce a variable-sized structure, which Rust doesn’t support.

pub fn get_data_directory( &mut self, idx: ImageDirectoryEntry, ) -> Result<ImageDataDirectory, PeSignError>

Get the data directory reference represented by the ImageDirectoryEntry enum. Returns PeSignError if the given directory is inaccessible due to the directory size.

pub fn get_section_table_offset(&mut self) -> Result<u64, PeSignError>

Get the offset to the section table within the PE file.

pub fn get_section_table_size(&mut self) -> Result<u64, PeSignError>

Get the size of the section table within the PE file.

pub fn get_section_table( &mut self, ) -> Result<Vec<ImageSectionHeader>, PeSignError>

Get the section table of the PE file.

pub fn get_header_size(&mut self) -> Result<u64, PeSignError>

Get the size of the header within the PE file.

SizeOfHeaders > dosHeader + ntHeader + dataDirectory + sectionTable.

pub fn get_size(&mut self) -> Result<u64, PeSignError>

Get the PE file size.

pub fn get_security_data(&mut self) -> Result<Option<Vec<u8>>, PeSignError>

Get security data within the PE file.

pub fn calc_authenticode( &mut self, algorithm: Algorithm, ) -> Result<String, PeSignError>

Calculate authenticode of the PE file.

pub unsafe fn cast_c_struct<T: Castable>( &mut self, offset: u64, ) -> Result<T, PeSignError>

Cast c struct bytes to rust struct.

pub unsafe fn cast_c_array<T: Castable>( &mut self, offset: u64, size: u64, ) -> Result<Vec<T>, PeSignError>

Cast c array bytes to rust struct.

pub fn read_exact_at( &mut self, offset: u64, buf: &mut [u8], ) -> Result<(), PeSignError>

Read bytes into a fixed-size buffer.

If the end is reached and there is not enough data to fill the buffer, it will return an Err.