Struct HeaderExt

#[repr(C)]
pub struct HeaderExt {
    pub res: [u8; 8],
    pub oemid: Integer<LittleEndian<u16>, AlignAs<2>>,
    pub oeminfo: Integer<LittleEndian<u16>, AlignAs<2>>,
    pub res2: [u8; 20],
    pub lfanew: Integer<LittleEndian<u32>, AlignAs<4>>,
}

Extended Header

The extended header optionally follows the static header without any padding. The presence of an extended header is suggested by the relocation offset being beyond the extended header, as well as the header size being big enough to include the extended header.

The only meaningful field of the extended header is lfanew, which is a 32-bit offset into the file where further header information can be found. Depending on the format that uses this extended header, a different signature can be found at that offset.

The other fields of this extended header are very scarcely documented and thus usually set to 0.

Fields

res: [u8; 8]

Reserved field which must be cleared to 0, yet must not be relied on to be 0.

oemid: Integer<LittleEndian<u16>, AlignAs<2>>

OEM ID, usually cleared to 0.

oeminfo: Integer<LittleEndian<u16>, AlignAs<2>>

OEM Information, usually cleared to 0.

res2: [u8; 20]

Reserved field which must be cleared to 0, yet must not be relied on to be 0.

lfanew: Integer<LittleEndian<u32>, AlignAs<4>>

File offset of the new file format (abbr: logical-file-address-new)

This contains an offset into the file relative to the start of the static header where to find a newer format of this file. No further information can be deduced from this.

Any format using this must place its own signature at the specified offset and thus allow separate verification of its validity. In particular, Portable Executable (PE) files will place “PE\0\0” at this offset to denote a PE/COFF header.

Implementations

impl HeaderExt

pub fn from_bytes(data: &[u8; 36]) -> Self

Import a header extension from a byte slice

Create a new header extension structure from data copied from a byte slice. No byte-order conversions are applied.

pub fn as_bytes(&self) -> &[u8; 36]

Convert to byte slice

Return a byte-slice reference to the header extension. This can be used to export the structure into a file. No byte-order conversions are applied.