Module pe 

Module for the PE file format support in LIEF.

The Binary structure exposes the main API to inspect a PE file. It can be instantiated, using either: crate::pe::parse, crate::pe::Binary::parse or crate::Binary::parse

let pe = lief::pe::parse("demo.exe").unwrap();
for section in pe.sections() {
    println!("section: {}", section.name());
}

Modules

binary

builder

chpe_metadata_arm64

chpe_metadata_x86

code_integrity

data_directory

PE Data Directory module

debug

Module that wraps the different debug information structure we can find in a PE binary.

delay_import

PE Delayed import module

dynamic_fixups

dynamic_relocation

Module related to dynamic relocations (DVRT)

enclave_configuration

PE enclave configuration

exception

Module for the PE exception support

exception_aarch64

This module contains structures related to the ARM64 exception support in PE files

exception_x64

Module related to the x86_64 exception unwinding support

export

PE export module

factory

PE Factory module for creating PE binaries from scratch

headers

This module exposes the different headers that we can find in a PE binary. It includes:

import

This module represents PE’s Imports

load_configuration

parser_config

relocation

This module includes the different structures related to the relocation process in a PE binary

resources

This module contains the different structures involved in the PE’s resource tree

rich_header

PE Rich Header module

section

PE section module

signature

This module wraps the PKCS #7 PE authenticode signature

tls

This module represents the PE’s Thread Local Storage (TLS)

volatile_metadata

PE volatile memory metadata

Structs

Binary

This is the main interface to read and write PE binary attributes.

DataDirectory

DelayImport

DosHeader

Structure which represents the DosHeader, the first structure presents at the beginning of a PE file.

EnclaveConfiguration

Defines an entry in the array of images that an enclave can import.

EnclaveImport

This structure represents an entry in the array of images that an enclave can import.

Export

Factory

Factory for creating PE binaries from scratch

Header

Structure that represents the PE header (which follows the DosHeader)

Import

LoadConfiguration

This structure represents the load configuration data associated with the IMAGE_LOAD_CONFIG_DIRECTORY.

OptionalHeader

Structure which represents the PE OptionalHeader (after Header).

ParserConfig

This structure is used to configure the behavior of the PE Parser: crate::pe::Binary::parse_with_config

Relocation

Class which represents the Base Relocation Block We usually find this structure in the .reloc section

ResourceAccelerator

Represents a PE accelerator resource entry

ResourceIcon

Represents a PE icon resource

ResourceStringEntry

Represents a string table entry from the ResourcesManager

ResourceVersion

Represents a PE version resource

ResourcesManager

This manager abstracts the tree representation to provide a comprehensive API over the information wrapped by the resources tree.

RichEntry

RichHeader

Structure which represents the not-so-documented rich header

Section

This structure defines a regular PE section.

Signature

TLS

VolatileMetadata

This class represents volatile metadata which can be enabled at link time with /volatileMetadata.

Enums

Algorithms

CHPEMetadata

DynamicFixup

This enum wraps the different fixups that can be associated with a crate::pe::DynamicRelocation

DynamicRelocation

This enum wraps the different versions of dynamic relocations:

ImphashMode

Mode used for computing the import hash

PE_TYPE

PE type: 32-bit or 64-bit

ResourceNode

This enum represents a node in the resource tree which can be either: a directory node or a data (leaf) node.

RuntimeExceptionFunction

Enum that wraps the different kinds of runtime functions associated with exceptions

Traits

ExceptionInfo

Trait shared by all runtime functions

Functions

check_layout

Check that the layout of the given binary is correct from the Windows loader perspective

get_imphash

Compute the import hash of the given binary

get_type

Determine the PE type (PE32 or PE32+) of the given file

oid_to_string

Convert an OID string to a human-readable string

parse

Parse a PE file from the given file path

parse_from_dump

Parse the PE binary from a memory dump located at path that was mapped at the virtual address addr

parse_from_dump_with_config

Same as parse_from_dump but with a provided configuration

parse_from_memory

Parse the PE binary at the given memory address

parse_from_memory_with_config

Parse the PE binary at the given memory address

parse_with_config

Parse a PE file from the given file path and configuration

resolve_ordinals

Try to resolve import ordinals using the well-known ordinal lookup table