pe

package

Go to main page

Versions in this module

v1

v1.10.0

Mar 31, 2023

Changes in this version

+ const LangIDLength

+ const StringFileInfoLength

+ const StringFileInfoString

+ const StringLength

+ const StringTableLength

+ const VarFileInfoString

+ const VersionResourceType

+ const VsFileInfoSignature

+ const VsVersionInfoString

+ const VsVersionInfoStringLength

+ var ErrEmptyVArea = errors.New("va memory area is empty")

+ var MaxHeaderSize = uint(os.Getpagesize())

+ var MinHeaderSize = uint(0x100)

+ func AlignDword(offset, base uint32) uint32

+ func DecodeUTF16String(b []byte) (string, error)

+ func ParseVersionResources(pe *peparser.File) (map[string]string, error)

+ type Option func(o *opts)

+ func WithExcludedImages(images []string) Option

+ func WithSectionEntropy() Option

+ func WithSectionMD5() Option

+ func WithSections() Option

+ func WithSymbols() Option

+ func WithVersionResources() Option

type PE — windows/amd64

+ func ParseBytes(data []byte, opts ...Option) (*PE, error)

+ func ParseFile(path string, opts ...Option) (*PE, error)

+ func ParseFileWithConfig(path string, config Config) (*PE, error)

+ func ParseMem(pid uint32, base uintptr, changeProtection bool, opts ...Option) (*PE, error)

+ type String struct

+ Length uint16

+ Type uint16

+ ValueLength uint16

+ func (s *String) GetOffset(rva uint32, e peparser.ResourceDirectoryEntry, pe *peparser.File) uint32

+ func (s *String) Parse(rva uint32, e peparser.ResourceDirectoryEntry, pe *peparser.File) (string, string, error)

+ type StringFileInfo struct

+ Length uint16

+ Type uint16

+ ValueLength uint16

+ func (s *StringFileInfo) GetOffset(rva uint32, e peparser.ResourceDirectoryEntry, pe *peparser.File) uint32

+ func (s *StringFileInfo) GetStringTableOffset(offset uint32) uint32

+ func (s *StringFileInfo) Parse(rva uint32, e peparser.ResourceDirectoryEntry, pe *peparser.File) (string, error)

+ type StringTable struct

+ Length uint16

+ Type uint16

+ ValueLength uint16

+ func (s *StringTable) GetOffset(rva uint32, e peparser.ResourceDirectoryEntry, pe *peparser.File) uint32

+ func (s *StringTable) GetStringOffset(offset uint32, e peparser.ResourceDirectoryEntry) uint32

+ func (s *StringTable) Parse(rva uint32, e peparser.ResourceDirectoryEntry, pe *peparser.File) error

+ type VsFixedFileInfo struct

+ FileDateLS uint32

+ FileDateMS uint32

+ FileFlagMask uint32

+ FileFlags uint32

+ FileOS uint32

+ FileSubtype uint32

+ FileType uint32

+ FileVersionLS uint32

+ FileVersionMS uint32

+ ProductVersionLS uint32

+ ProductVersionMS uint32

+ Signature uint32

+ StructVer uint32

+ func (f *VsFixedFileInfo) GetOffset(e peparser.ResourceDirectoryEntry, pe *peparser.File) uint32

+ func (f *VsFixedFileInfo) GetStringFileInfoOffset(e peparser.ResourceDirectoryEntry) uint32

+ func (f *VsFixedFileInfo) Parse(e peparser.ResourceDirectoryEntry, pe *peparser.File) error

+ func (f *VsFixedFileInfo) Size() uint32

+ type VsVersionInfo struct

+ Length uint16

+ Type uint16

+ ValueLength uint16

+ func (v *VsVersionInfo) Parse(e peparser.ResourceDirectoryEntry, pe *peparser.File) error

v1.8.0

Nov 30, 2022

v1.6.0

Aug 31, 2022

v1.5.0

Apr 29, 2022

v1.4.2

Dec 25, 2021

v1.4.1

Sep 18, 2021

Changes in this version

+ const Company — windows/amd64

+ const FileDescription — windows/amd64

+ const FileVersion — windows/amd64

+ const LegalCopyright — windows/amd64

+ const OriginalFilename — windows/amd64

+ const ProductName — windows/amd64

+ const ProductVersion — windows/amd64

v1.4.0

Aug 24, 2021

v1.2.0

Apr 27, 2021

Changes in this version

+ func AddFlags(flags *pflag.FlagSet)

+ type Config struct

+ Enabled bool

+ ExcludedImages []string

+ ReadResources bool

+ ReadSections bool

+ ReadSymbols bool

+ func (c *Config) InitFromViper(v *viper.Viper)

+ type PE struct

+ EntryPoint string

+ ImageBase string

+ Imports []string

+ LinkTime time.Time

+ NumberOfSections uint16

+ NumberOfSymbols uint32

+ Sections []Sec

+ Symbols []string

+ VersionResources map[string]string

+ func NewFromKcap(b []byte) (*PE, error)

+ func (pe *PE) Marshal() []byte

+ func (pe *PE) Section(s string) *Sec

+ func (pe *PE) Unmarshal(b []byte) error

+ func (pe PE) String() string

+ type Reader interface

+ FindOffsetByRVA func(rva uint32) (int64, error)

+ FindSectionByRVA func(rva uint32) (*pe.Section, error)

+ Read func(filename string) (*PE, error)

+ func NewReader(config Config) Reader

+ type Sec struct

+ Entropy float64

+ Md5 string

+ Name string

+ Size uint32

+ func (s Sec) String() string

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL