Struct lief::pe::symbol::Symbol

pub struct Symbol<'a> { /* private fields */ }

Structure that represents a PE-COFF symbol.

Usually PE debug information (including symbols) are wrapped in a PDB file referenced by the CodeViewPDB object.

The PE format allows to define (by COFF inheritance) a symbol table that is different from the regular PDB symbols. This table contains COFF(16) symbols which can reference auxiliary symbols.

Warning: The crate::generic::Symbol::value should be interpreted in perspective of the Symbol::storage_class.

Reference: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#coff-symbol-table

Implementations

impl Symbol<'_>

pub fn auxiliary_symbols(&self) -> ItAuxiliarySymbols<'_>

Auxiliary symbols associated with this symbol.

pub fn storage_class(&self) -> StorageClass

Storage class of the symbol which indicates what kind of definition a symbol represents.

pub fn base_type(&self) -> BaseType

The simple (base) data type

pub fn complex_type(&self) -> ComplexType

The complex type (if any)

pub fn section_idx(&self) -> i16

The signed integer that identifies the section, using a one-based index into the section table. Some values have special meaning:

• 0: The symbol record is not yet assigned a section. A value of zero indicates that a reference to an external symbol is defined elsewhere. A value of non-zero is a common symbol with a size that is specified by the value.
• -1: The symbol has an absolute (non-relocatable) value and is not an address.
• -2: The symbol provides general type or debugging information but does not correspond to a section. Microsoft tools use this setting along with .file records

pub fn is_external(&self) -> bool

pub fn is_weak_external(&self) -> bool

pub fn is_undefined(&self) -> bool

pub fn is_function_line_info(&self) -> bool

pub fn is_file_record(&self) -> bool

Trait Implementations

impl Debug for Symbol<'_>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Symbol for Symbol<'_>

fn name(&self) -> String

Symbol’s name

fn value(&self) -> u64

Symbol’s value whose interpretation depends on the symbol’s kind. Usually this is the address of the symbol though.

fn size(&self) -> u64

Size of the symbol (can be 0)