Module pe

Expand description

Module for the PE file format support in LIEF.

The Binary structure exposes the main API to inspect a PE file. It can be instantiated, using either: crate::pe::parse, crate::pe::Binary::parse or crate::Binary::parse

let pe = lief::pe::parse("demo.exe").unwrap();
for section in pe.sections() {
    println!("section: {}", section.name());
}

Modules§

binary
builder
chpe_metadata_arm64
chpe_metadata_x86
code_integrity
data_directory: PE Data Directory module
debug: Module that wraps the different debug information structure we can find in a PE binary.
delay_import: PE Delayed import module
dynamic_fixups
dynamic_relocation: Module related to dynamic relocations (DVRT)
enclave_configuration: PE enclave configuration
exception: Module for the PE exception support
exception_aarch64: This module contains structures related to the ARM64 exception support in PE files
exception_x64: Module related to the x86_64 exception unwinding support
export: PE export module
headers: This module exposes the different headers that we can find in a PE binary. It includes:
import: This module represents PE’s Imports
load_configuration
parser_config
relocation: This module includes the different structures related to the relocation process in a PE binary
resources: This module contains the different structures involved in the PE’s resource tree
rich_header: PE Rich Header module
section: PE section module
signature: This module wraps the PKCS #7 PE authenticode signature
tls: This module represents the PE’s Thread Local Storage (TLS)
volatile_metadata: PE volatile memory metadata

Binary: This is the main interface to read and write PE binary attributes.
DataDirectory
DelayImport
DosHeader: Structure which represents the DosHeader, the first structure presents at the beginning of a PE file.
EnclaveConfiguration: Defines an entry in the array of images that an enclave can import.
EnclaveImport: This structure represents an entry in the array of images that an enclave can import.
Export
Header: Structure that represents the PE header (which follows the DosHeader)
Import
LoadConfiguration: This structure represents the load configuration data associated with the IMAGE_LOAD_CONFIG_DIRECTORY.
OptionalHeader: Structure which represents the PE OptionalHeader (after Header).
ParserConfig: This structure is used to tweak the PE parser: crate::pe::Binary::parse_with_config
Relocation: Class which represents the Base Relocation Block We usually find this structure in the .reloc section
ResourcesManager: This manager abstracts the tree representation to provide a comprehensive API over the information wrapped by the resources tree.
RichEntry
RichHeader: Structure which represents the not-so-documented rich header
Section: This structure defines a regular PE section.
Signature
TLS
VolatileMetadata: This class represents volatile metadata which can be enabled at link time with /volatileMetadata.

Algorithms
CHPEMetadata
DynamicFixup: This enum wraps the different fixups that can be associated with a crate::pe::DynamicRelocation
DynamicRelocation: This enum wraps the different versions of dynamic relocations:
ResourceNode: This enum represents a node in the resource tree which can be either: a directory node or a data (leaf) node.
RuntimeExceptionFunction: Enum that wraps the different kinds of runtime functions associated with exceptions

parse: Parse a PE file from the given file path
parse_with_config: Parse a PE file from the given file path and configuration