Struct PeFile 

pub struct PeFile<'a> { /* private fields */ }

A parsed Portable Executable file borrowing its data.

The DOS and NT headers are parsed by PeFile::parse, everything else on access. Accessors of optional structures return Ok(None) if the structure is absent and an error if it is malformed.

Implementations

impl<'a> PeFile<'a>

pub fn authenticode_info(&self) -> Result<Option<&AuthenticodeInfo<'a>>>

Available on crate feature authenticode only.

The Authenticode signature, Ok(None) for unsigned files and an error if the certificate data cannot be decoded.

pub fn signing_certificate(&self) -> Result<Option<&Certificate>>

Available on crate feature authenticode only.

The certificate the file was signed with.

pub fn is_signed(&self) -> bool

Available on crate feature authenticode only.

True if the file is signed. The signature is not validated.

pub fn has_valid_signature(&self) -> bool

Available on crate feature authenticode only.

True if the signature is valid. The trust of the certificate chain is not checked.

pub fn crl_url_list(&self) -> Result<Option<CrlUrlList>>

Available on crate feature authenticode only.

The CRL URLs of the signing certificate, Ok(None) if the file is not signed.

pub fn authenticode_hash(&self, algorithm: HashAlgorithm) -> Result<Vec<u8>>

Available on crate feature authenticode only.

The Authenticode hash: the hash of the file without the checksum, the certificate table entry and the certificate data.

impl<'a> PeFile<'a>

pub fn data_directory(&self, t: DataDirectoryType) -> &'a ImageDataDirectory

pub fn export_directory(&self) -> Result<Option<&'a ImageExportDirectory>>

pub fn exported_functions(&self) -> Result<Option<Vec<ExportFunction<'a>>>>

pub fn import_descriptors( &self, ) -> Result<Option<Vec<&'a ImageImportDescriptor>>>

pub fn imported_functions(&self) -> Result<Option<Vec<ImportFunction<'a>>>>

pub fn delay_import_descriptors( &self, ) -> Result<Option<Vec<&'a ImageDelayImportDescriptor>>>

pub fn delay_imported_functions( &self, ) -> Result<Option<Vec<ImportFunction<'a>>>>

pub fn bound_import_descriptor( &self, ) -> Result<Option<&'a ImageBoundImportDescriptor>>

pub fn base_relocations(&self) -> Result<Option<BaseRelocations<'a>>>

The blocks of the relocation directory.

pub fn exception_directory(&self) -> Result<Option<&'a [RuntimeFunction]>>

The runtime functions of the exception directory, Ok(None) for 32 bit files.

pub fn debug_directory(&self) -> Result<Option<&'a [ImageDebugDirectory]>>

pub fn tls_directory(&self) -> Result<Option<TlsDirectory<'a>>>

pub fn tls_callbacks(&self) -> Result<Option<Vec<Va>>>

The virtual addresses of the TLS callbacks.

pub fn load_config_directory(&self) -> Result<Option<LoadConfigDirectory>>

pub fn com_descriptor(&self) -> Result<Option<&'a ImageCor20Header>>

The COM descriptor (CLI header) of .NET assemblies.

pub fn win_certificate(&self) -> Result<Option<WinCertificate<'a>>>

The WIN_CERTIFICATE of the security directory, whose address is a file offset.

pub fn resource_directory(&self) -> Result<Option<ResourceDirectory<'a>>>

The root of the resource tree.

pub fn imp_hash(&self) -> Result<Option<[u8; 16]>>

The import hash (ImpHash) of the imported functions, Ok(None) without imports.

pub fn is_driver(&self) -> bool

True if the file is a kernel driver: native subsystem and imports from ntoskrnl.exe.

impl<'a> PeFile<'a>

pub fn is_dot_net(&self) -> bool

Available on crate feature dotnet only.

True if the file has a CLI (COM descriptor) header.

pub fn metadata_header(&self) -> Result<Option<&MetadataHeader<'a>>>

Available on crate feature dotnet only.

The metadata root referenced by the CLI header.

pub fn metadata_strings(&self) -> Result<Option<StringsHeap<'a>>>

Available on crate feature dotnet only.

The #Strings heap.

pub fn metadata_user_strings(&self) -> Result<Option<UserStringsHeap<'a>>>

Available on crate feature dotnet only.

The #US (user strings) heap.

pub fn metadata_guids(&self) -> Result<Option<GuidHeap<'a>>>

Available on crate feature dotnet only.

The #GUID heap.

pub fn metadata_blob(&self) -> Result<Option<BlobHeap<'a>>>

Available on crate feature dotnet only.

The #Blob heap.

pub fn metadata_tables_header( &self, ) -> Result<Option<&MetadataTablesHeader<'a>>>

Available on crate feature dotnet only.

The header of the #~ stream with all metadata tables.

pub fn type_ref_hash(&self) -> Result<Option<[u8; 32]>>

Available on crate feature dotnet only.

The TypeRefHash, Ok(None) for files without metadata tables or #Strings heap.

pub fn clr_module_version_ids(&self) -> Result<Option<&[Uuid]>>

Available on crate feature dotnet only.

The module version ID of each module, Ok(None) for files without metadata tables.

pub fn clr_com_type_lib_id(&self) -> Result<Option<Uuid>>

Available on crate feature dotnet only.

The COM TypeLib ID of the assembly, Ok(None) if it is not specified.

impl<'a> PeFile<'a>

pub fn resources(&self) -> Result<Option<Resources<'a>>>

Available on crate feature resources only.

The version information and icons, Ok(None) if the file has none of them.

pub fn icons(&self) -> Result<impl Iterator<Item = Cow<'a, [u8]>> + use<'a>>

Available on crate feature resources only.

All icons as .ico files, independent of group icon directories.

pub fn group_icons(&self) -> Result<Vec<Vec<Cow<'a, [u8]>>>>

Available on crate feature resources only.

The icons of every group icon directory as .ico files. Entries referencing missing or invalid icons are skipped.

impl<'a> PeFile<'a>

pub fn parse(data: &'a [u8]) -> Result<Self>

Parse a PE file. Fails with Error::NotAPeFile if the NT signature is not PE\0\0.

pub fn is_pe(data: &[u8]) -> bool

True if the data starts with the MZ magic. The rest of the data is not checked.

pub fn is_pe_reader(reader: &mut impl Read) -> Result<bool>

Available on crate feature std only.

True if the reader starts with the MZ magic. The rest of the data is not checked.

pub fn data(&self) -> &'a [u8]

The file data.

pub fn dos_header(&self) -> &'a ImageDosHeader

pub fn nt_headers(&self) -> &NtHeaders<'a>

pub fn section_headers(&self) -> Result<&SectionTable<'a>>

The section headers sorted by virtual address.

pub fn is_64_bit(&self) -> bool

True if the optional header has the 64 bit magic.

pub fn is_32_bit(&self) -> bool

True if the optional header has the 32 bit magic.

pub fn is_dll(&self) -> bool

pub fn is_exe(&self) -> bool

pub fn md5(&self) -> [u8; 16]

pub fn sha1(&self) -> [u8; 20]

pub fn sha256(&self) -> [u8; 32]

Trait Implementations

impl<'a> Debug for PeFile<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a> TryFrom<&'a [u8]> for PeFile<'a>

type Error = Error

The type returned in the event of a conversion error.

fn try_from(data: &'a [u8]) -> Result<Self>

Performs the conversion.