Module pe
Expand description
Module for the PE file format support in LIEF.
The Binary structure exposes the main API to inspect a PE file. It can be instantiated,
using either: crate::pe::parse, crate::pe::Binary::parse or crate::Binary::parse
let pe = lief::pe::parse("demo.exe").unwrap();
for section in pe.sections() {
println!("section: {}", section.name());
}Modules§
- PE Data Directory module
- Module that wraps the different debug information structure we can find in a PE binary.
- PE Delayed import module
- Module related to dynamic relocations (DVRT)
- PE enclave configuration
- Module for the PE exception support
- This module contains structures related to the ARM64 exception support in PE files
- Module related to the x86_64 exception unwinding support
- PE export module
- PE Factory module for creating PE binaries from scratch
- This module exposes the different headers that we can find in a PE binary. It includes:
- This module represents PE’s Imports
- This module includes the different structures related to the relocation process in a PE binary
- This module contains the different structures involved in the PE’s resource tree
- PE Rich Header module
- PE section module
- This module wraps the PKCS #7 PE authenticode signature
- This module represents the PE’s Thread Local Storage (TLS)
- PE volatile memory metadata
Structs§
- This is the main interface to read and write PE binary attributes.
- Structure which represents the DosHeader, the first structure presents at the beginning of a PE file.
- Defines an entry in the array of images that an enclave can import.
- This structure represents an entry in the array of images that an enclave can import.
- Factory for creating PE binaries from scratch
- Structure that represents the PE header (which follows the
DosHeader) - This structure represents the load configuration data associated with the
IMAGE_LOAD_CONFIG_DIRECTORY. - Structure which represents the PE OptionalHeader (after
Header). - This structure is used to configure the behavior of the PE Parser:
crate::pe::Binary::parse_with_config - Class which represents the Base Relocation Block We usually find this structure in the
.relocsection - Represents a PE accelerator resource entry
- Represents a PE icon resource
- Represents a string table entry from the ResourcesManager
- Represents a PE version resource
- This manager abstracts the tree representation to provide a comprehensive API over the information wrapped by the resources tree.
- Structure which represents the not-so-documented rich header
- This structure defines a regular PE section.
- This class represents volatile metadata which can be enabled at link time with
/volatileMetadata.
Enums§
- This enum wraps the different fixups that can be associated with a
crate::pe::DynamicRelocation - This enum wraps the different versions of dynamic relocations:
- Mode used for computing the import hash
- PE type: 32-bit or 64-bit
- This enum represents a node in the resource tree which can be either: a directory node or a data (leaf) node.
- Enum that wraps the different kinds of runtime functions associated with exceptions
Traits§
- Trait shared by all runtime functions
Functions§
- Check that the layout of the given binary is correct from the Windows loader perspective
- Compute the import hash of the given binary
- Determine the PE type (PE32 or PE32+) of the given file
- Convert an OID string to a human-readable string
- Parse a PE file from the given file path
- Parse the PE binary from a memory dump located at
paththat was mapped at the virtual addressaddr - Same as
parse_from_dumpbut with a provided configuration - Parse the PE binary at the given memory address
- Parse the PE binary at the given memory address
- Parse a PE file from the given file path and configuration
- Try to resolve import ordinals using the well-known ordinal lookup table