Struct Blob 

pub struct Blob {
    pub load_address: u64,
    pub data: Vec<u8>,
}

A generic binary blob: raw bytes loaded at a fixed virtual address.

This is the simplest possible BinaryFormat — it holds an arbitrary byte slice together with its load address and has no symbol information. Tests and other code that already work with raw bytes can use this instead of passing (address, bytes) tuples directly, enabling them to go through the same BinaryFormat-based pipeline as real ELF binaries.

Fields

load_address: u64

data: Vec<u8>

Implementations

impl Blob

pub fn new(load_address: u64, data: Vec<u8>) -> Self

pub fn from_slice(load_address: u64, bytes: &[u8]) -> Self

Borrow bytes directly without copying.

Trait Implementations

impl BinaryFormat for Blob

fn entry_points(&self) -> Vec<u64>

The only entry point is the load address itself.

fn mapped_regions(&self) -> Vec<(u64, Vec<u8>, bool, bool)>

A blob is one region; treat it as executable (raw code/data) so resolved jump targets in it are not filtered out.

fn load_address(&self) -> u64

The lowest virtual address mapped by this binary image.

fn architecture(&self) -> Arch

Name of the architecture, should use embedded information from known binary format, or raw values from the blob.

fn byte_at(&self, addr: u64) -> Option<u8>

Return the byte mapped at addr, or None if the address is unmapped.

fn bytes_at(&self, addr: u64) -> Option<&[u8]>

Return the contiguous bytes available at addr.

fn segment_bounds(&self, addr: u64) -> Option<(u64, u64)>

The [start, end) bounds of the mapped region containing addr, if any. Used to key per-segment facts (e.g. executability propositions) so repeated queries in one region collapse to a single entry. Defaults to None for formats that do not expose their segments.

fn entrypoint(&self) -> Option<u64>

The binary’s primary entry point (e.g. the ELF e_entry), if the format designates one. Unlike entry_points, this is the single address where execution begins. Returns None for formats with no distinguished entry.

fn os(&self) -> TargetOs

The operating system this binary targets, inferred from the container format. Defaults to TargetOs::Unknown; PE returns Windows, ELF Linux.

fn linked_libraries(&self) -> Vec<String>

Library names this binary links against: ELF DT_NEEDED sonames, PE import-directory DLL names (original case; matching is case-insensitive). Empty when the format has no such notion (Blob).

fn symbol_name(&self, _addr: u64) -> Option<&str>

Return the symbol name for the function starting at addr, if the binary format has one (e.g. from an ELF symbol table). Returns None for formats with no symbol information.

fn is_external_symbol(&self, _addr: u64) -> bool

Returns true if addr is an external (imported) function stub, e.g. a PLT thunk. The recursive disassembler will not lift the body of external functions. Defaults to false.

fn import_library(&self, _addr: u64) -> Option<&str>

Return the name of the library providing the external function stub at addr: the PE import-directory DLL, or the ELF .gnu.version_r soname the symbol’s version requirement points at. None when the format does not record a per-symbol source library (e.g. an unversioned ELF import).

fn import_symbol_name(&self, _addr: u64) -> Option<&str>

Return the imported symbol whose resolver slot lives at addr, if any.

fn hex_rows( &self, addr: u64, len: usize, width: usize, ) -> Vec<(u64, Vec<Option<u8>>)>

Return rows of bytes suitable for a hex viewer.

fn contains(&self, addr: u64) -> bool

Return true if addr is mapped by this binary image.

fn is_executable(&self, addr: u64) -> bool

Return true if addr lies in an executable region of this binary image. Defaults to “mapped” for formats that don’t track per-region permissions; formats with permission information (e.g. ELF segment flags) should override this.

fn is_known_writable(&self, _addr: u64) -> bool

Return true only if addr lies in a region known to be writable (from the container’s segment flags). Passes that fold a value out of initialized memory use this to refuse mutable memory — e.g. a GOT slot the dynamic linker overwrites at load time. Defaults to false (“not proven writable”); Blob keeps the default.

fn is_known_read_only(&self, _addr: u64) -> bool

Return true only if addr lies in a region proven read-only (mapped, and the container’s own permission data says the region is not writable).

fn read_bytes(&self, addr: u64, n: usize) -> Option<Vec<u8>>

Read n bytes at virtual address addr.

fn read_uint(&self, addr: u64, size: usize) -> Option<u64>

Read a little-endian unsigned integer of size bytes (1..=8) at addr.

fn read_cstring(&self, addr: u64, max_len: Option<usize>) -> Option<Vec<u8>>

Read a null-terminated C string at virtual address addr, returning the bytes up to (but not including) the null terminator.

fn read_printable_cstring( &self, addr: u64, max_len: Option<usize>, ) -> Option<Vec<u8>>

Read a null-terminated C string at virtual address addr, requiring every byte before the null terminator to be printable ASCII.

impl Clone for Blob

fn clone(&self) -> Blob

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.