Documentation ¶
Index ¶
- Constants
- Variables
- func FindBytes(src []byte, dst []byte) (int, error)
- func MatchBytes(src []byte, dst []byte) bool
- func PadBytes(bytes []byte, size int) []byte
- func ReadCOFFHeaderOffset(bytes []byte) (int, error)
- func ReadDDBytes(bytes []byte) ([]byte, error)
- func ReadDDEntryOffset(bytes []byte, entryVirtualAddress uint32, entrySize uint32) (int, error)
- func ReadSHBytes(bytes []byte, shSize int) ([]byte, error)
- func ReadSHEntryOffset(bytes []byte, address int) (int, error)
- func ReadSHSize(file pe.File) (int, error)
- func ReadSectionBytes(file *Data, sectionVirtualAddress uint32, sectionSize uint32) ([]byte, error)
- func Utf8ToUtf16(utf8str string) []byte
- func WriteBytes(bytes []byte, offset int, replace []byte) error
- type Data
- type DataDir
- type DataEntry
- type EncBlock
- type FileEntry
- type Import
- type OptionalHeader64X110
- type Reader
- func (r *Reader) Close() error
- func (r *Reader) IsValid() bool
- func (r *Reader) Position() (int64, error)
- func (r *Reader) Read(data []byte) (int, error)
- func (r *Reader) ReadChar() (byte, error)
- func (r *Reader) ReadUInt32() (uint32, error)
- func (r *Reader) ReadUInt64() (uint64, error)
- func (r *Reader) Seek(position int64, whence int) (int64, error)
- func (r *Reader) SeekFromBeginning(position int64) (int64, error)
- func (r *Reader) SeekFromCurrent(position int64) (int64, error)
- func (r *Reader) SeekFromEnd(position int64) (int64, error)
- func (r *Reader) Size() (int64, error)
- type Section
- type SectionHeader32X28
- type Thunk
- type Writer
- func (w *Writer) Close() error
- func (w *Writer) Position() (int64, error)
- func (w *Writer) Seek(position int64, whence int) (int64, error)
- func (w *Writer) SeekFromBeginning(position int64) (int64, error)
- func (w *Writer) SeekFromCurrent(position int64) (int64, error)
- func (w *Writer) SeekFromEnd(position int64) (int64, error)
- func (w *Writer) Size() (int64, error)
- func (w *Writer) Write(data []byte) (int, error)
- func (w *Writer) WriteChar(data string) (int, error)
- func (w *Writer) WriteUInt32(value uint32) error
- func (w *Writer) WriteUInt64(value uint64) error
Constants ¶
View Source
const ( COFFStartBytesLen = 4 COFFHeaderSize = 20 )
View Source
const ( DataDirSize = 128 DataDirEntrySize = 8 )
DataDirectory 16 entries * 8 bytes / entry.
View Source
const ( SH32EntrySize = 64 SH32NameSize = 8 SH32CharacteristicsSize = 4 )
Variables ¶
View Source
var COFFStartBytes = []byte{0x50, 0x45, 0x00, 0x00} //nolint:gochecknoglobals // wontfix
COFFHeader 0x50, 0x45 = PE COFF_START_BYTES_LEN == len(COFFStartBytes).
View Source
var OH64ByteSize = binary.Size(OptionalHeader64X110{}) //nolint:exhaustruct,gochecknoglobals // wontfix
OptionalHeader64 https://github.com/golang/go/blob/master/src/debug/pe/pe.go uint byte size of OptionalHeader64 without magic mumber(2 bytes) or data directory(128 bytes) OptionalHeader64 size is 240 (110).
View Source
var SH32ByteSize = binary.Size(SectionHeader32X28{}) //nolint:exhaustruct,gochecknoglobals // wontfix
SectionHeader32 https://github.com/golang/go/blob/master/src/debug/pe/section.go uint byte size of SectionHeader32 without name(8 bytes) or characteristics(4 bytes) (28).
Functions ¶
func MatchBytes ¶
func ReadCOFFHeaderOffset ¶
func ReadDDBytes ¶
func ReadDDEntryOffset ¶
func ReadSectionBytes ¶
func Utf8ToUtf16 ¶
Types ¶
type EncBlock ¶
type EncBlock struct { VA uint32 RawSize uint32 VirtualSize uint32 Unk uint32 CRC uint32 Unk2 uint32 CRC2 uint32 Pad uint32 FileOffset uint32 Pad2 uint64 Pad3 uint32 }
EncBlock structure (.ooa).
type Import ¶
type Import struct { Characteristics uint32 Timedatestamp uint32 ForwarderChain uint32 Name uint32 FThunk uint32 }
Import structure (.ooa).
type OptionalHeader64X110 ¶
type OptionalHeader64X110 struct { MajorLinkerVersion uint8 MinorLinkerVersion uint8 SizeOfCode uint32 SizeOfInitializedData uint32 SizeOfUninitializedData uint32 AddressOfEntryPoint uint32 BaseOfCode uint32 ImageBase uint64 SectionAlignment uint32 FileAlignment uint32 MajorOperatingSystemVersion uint16 MinorOperatingSystemVersion uint16 MajorImageVersion uint16 MinorImageVersion uint16 MajorSubsystemVersion uint16 MinorSubsystemVersion uint16 Win32VersionValue uint32 SizeOfImage uint32 SizeOfHeaders uint32 CheckSum uint32 Subsystem uint16 DllCharacteristics uint16 SizeOfStackReserve uint64 SizeOfStackCommit uint64 SizeOfHeapReserve uint64 SizeOfHeapCommit uint64 LoaderFlags uint32 NumberOfRvaAndSizes uint32 }
type Reader ¶
type Reader struct {
// contains filtered or unexported fields
}
func (*Reader) ReadUInt32 ¶
func (*Reader) ReadUInt64 ¶
func (*Reader) SeekFromBeginning ¶
type Section ¶
type Section struct { ContentID string OEP uint64 EncBlocks []EncBlock ImageBase uint64 SizeOfImage uint32 ImportDir DataDir IATDir DataDir RelocDir DataDir }
Section structure (.ooa).
type SectionHeader32X28 ¶
type Writer ¶
type Writer struct {
// contains filtered or unexported fields
}
func (*Writer) SeekFromBeginning ¶
func (*Writer) WriteUInt32 ¶
func (*Writer) WriteUInt64 ¶
Click to show internal directories.
Click to hide internal directories.