Module lief::pe

Module for the PE file format support in LIEF.

The Binary structure exposes the main API to inspect a PE file. It can be instantiated, using either: crate::pe::parse, crate::pe::Binary::parse or crate::Binary::parse

let pe = lief::pe::parse("demo.exe").unwrap();
for section in pe.sections() {
    println!("section: {}", section.name());
}

Modules

• binary
• builder
• chpe_metadata_arm64
• chpe_metadata_x86
• code_integrity
• data_directory
  PE Data Directory module
• debug
  Module that wraps the different debug information structure we can find in a PE binary.
• delay_import
  PE Delayed import module
• dynamic_fixups
• dynamic_relocation
  Module related to dynamic relocations (DVRT)
• enclave_configuration
  PE enclave configuration
• exception
  Module for the PE exception support
• exception_aarch64
  This module contains structures related to the ARM64 exception support in PE files
• exception_x64
  Module related to the x86_64 exception unwinding support
• export
  PE export module
• factory
  PE Factory module for creating PE binaries from scratch
• headers
  This module exposes the different headers that we can find in a PE binary. It includes:
• import
  This module represents PE’s Imports
• load_configuration
• parser_config
• relocation
  This module includes the different structures related to the relocation process in a PE binary
• resources
  This module contains the different structures involved in the PE’s resource tree
• rich_header
  PE Rich Header module
• section
  PE section module
• signature
  This module wraps the PKCS #7 PE authenticode signature
• tls
  This module represents the PE’s Thread Local Storage (TLS)
• volatile_metadata
  PE volatile memory metadata

Structs

• Binary
  This is the main interface to read and write PE binary attributes.
• DataDirectory
• DelayImport
• DosHeader
  Structure which represents the DosHeader, the first structure presents at the beginning of a PE file.
• EnclaveConfiguration
  Defines an entry in the array of images that an enclave can import.
• EnclaveImport
  This structure represents an entry in the array of images that an enclave can import.
• Export
• Factory
  Factory for creating PE binaries from scratch
• Header
  Structure that represents the PE header (which follows the DosHeader)
• Import
• LoadConfiguration
  This structure represents the load configuration data associated with the IMAGE_LOAD_CONFIG_DIRECTORY.
• OptionalHeader
  Structure which represents the PE OptionalHeader (after Header).
• ParserConfig
  This structure is used to configure the behavior of the PE Parser: crate::pe::Binary::parse_with_config
• Relocation
  Class which represents the Base Relocation Block We usually find this structure in the .reloc section
• ResourceAccelerator
  Represents a PE accelerator resource entry
• ResourceIcon
  Represents a PE icon resource
• ResourceStringEntry
  Represents a string table entry from the ResourcesManager
• ResourceVersion
  Represents a PE version resource
• ResourcesManager
  This manager abstracts the tree representation to provide a comprehensive API over the information wrapped by the resources tree.
• RichEntry
• RichHeader
  Structure which represents the not-so-documented rich header
• Section
  This structure defines a regular PE section.
• Signature
• TLS
• VolatileMetadata
  This class represents volatile metadata which can be enabled at link time with /volatileMetadata.

Enums

• Algorithms
• CHPEMetadata
• DynamicFixup
  This enum wraps the different fixups that can be associated with a crate::pe::DynamicRelocation
• DynamicRelocation
  This enum wraps the different versions of dynamic relocations:
• ImphashMode
  Mode used for computing the import hash
• PE_TYPE
  PE type: 32-bit or 64-bit
• ResourceNode
  This enum represents a node in the resource tree which can be either: a directory node or a data (leaf) node.
• RuntimeExceptionFunction
  Enum that wraps the different kinds of runtime functions associated with exceptions

Traits

• ExceptionInfo
  Trait shared by all runtime functions

Functions

• check_layout
  Check that the layout of the given binary is correct from the Windows loader perspective
• get_imphash
  Compute the import hash of the given binary
• get_type
  Determine the PE type (PE32 or PE32+) of the given file
• oid_to_string
  Convert an OID string to a human-readable string
• parse
  Parse a PE file from the given file path
• parse_with_config
  Parse a PE file from the given file path and configuration
• resolve_ordinals
  Try to resolve import ordinals using the well-known ordinal lookup table