Overview

Package pe implements access to PE (Microsoft Windows Portable Executable)
files.

Index

pe.go string.go

Constants

  1. const COFFSymbolSize = 18

type COFFSymbol

  1. type COFFSymbol struct {
  2.     Name               [8]uint8
  3.     Value              
  4.     SectionNumber      int16
  5.     Type               
  6.     StorageClass       uint8
  7.     NumberOfAuxSymbols 
  8. }

COFFSymbol represents single COFF symbol table record.

func (*COFFSymbol) FullName

  1. func (sym *COFFSymbol) FullName(st ) (string, )

FullName finds real name of symbol sym. Normally name is stored in sym.Name, but
if it is longer then 8 characters, it is stored in COFF string table st instead.

type DataDirectory

  1. type DataDirectory struct {
  2.     VirtualAddress uint32
  3.     Size           
  4. }

  1. type File struct {
  2.     FileHeader
  3.     OptionalHeader interface{} // of type *OptionalHeader32 or *OptionalHeader64
  4.     Sections       []*
  5.     Symbols        []*Symbol    // COFF symbols with auxiliary symbol records removed
  6.     COFFSymbols    [] // all COFF symbols (including auxiliary symbol records)
  7.     StringTable    StringTable
  8.     // contains filtered or unexported fields

A File represents an open PE file.

func 

  1. func NewFile(r .ReaderAt) (*, error)

NewFile creates a new File for accessing a PE binary in an underlying reader.

func 

  1. func Open(name ) (*File, )

Open opens the named file using os.Open and prepares it for use as a PE binary.

  1. func (f *File) Close()

Close closes the File. If the File was created using NewFile directly instead of
Open, Close has no effect.

func (*File) DWARF

func (*File) ImportedLibraries

  1. func (f *File) ImportedLibraries() ([], error)

ImportedLibraries returns the names of all libraries referred to by the binary f
that are expected to be linked with the binary at dynamic link time.

func (*File) 

  1. func (f *) ImportedSymbols() ([]string, )

ImportedSymbols returns the names of all symbols referred to by the binary f
that are expected to be satisfied by other libraries at dynamic load time. It
does not return weak symbols.

  1. func (f *File) Section(name ) *Section

Section returns the first section with the given name, or nil if no such section
exists.

type 

  1. type FileHeader struct {
  2.     Machine              
  3.     NumberOfSections     uint16
  4.     TimeDateStamp        
  5.     PointerToSymbolTable uint32
  6.     NumberOfSymbols      
  7.     SizeOfOptionalHeader uint16
  8.     Characteristics      
  9. }

type FormatError

  1. type FormatError struct {
  2. }

FormatError is unused. The type is retained for compatibility.

func (*FormatError) Error

  1. func (e *FormatError) Error()

type ImportDirectory

  1. type ImportDirectory struct {
  2.     OriginalFirstThunk uint32
  3.     TimeDateStamp      
  4.     ForwarderChain     uint32
  5.     Name               
  6.     FirstThunk         uint32
  7.     // contains filtered or unexported fields
  8. }

type 

  1. type OptionalHeader32 struct {
  2.     Magic                       
  3.     MajorLinkerVersion          uint8
  4.     MinorLinkerVersion          
  5.     SizeOfCode                  uint32
  6.     SizeOfInitializedData       
  7.     SizeOfUninitializedData     uint32
  8.     AddressOfEntryPoint         
  9.     BaseOfCode                  uint32
  10.     BaseOfData                  
  11.     ImageBase                   uint32
  12.     SectionAlignment            
  13.     FileAlignment               uint32
  14.     MajorOperatingSystemVersion 
  15.     MinorOperatingSystemVersion uint16
  16.     MajorImageVersion           
  17.     MinorImageVersion           uint16
  18.     MajorSubsystemVersion       
  19.     MinorSubsystemVersion       uint16
  20.     Win32VersionValue           
  21.     SizeOfImage                 uint32
  22.     SizeOfHeaders               
  23.     CheckSum                    uint32
  24.     Subsystem                   
  25.     DllCharacteristics          uint16
  26.     SizeOfStackReserve          
  27.     SizeOfHeapReserve           uint32
  28.     SizeOfHeapCommit            
  29.     LoaderFlags                 uint32
  30.     NumberOfRvaAndSizes         
  31.     DataDirectory               [16]DataDirectory
  32. }

type 

  1. type Reloc struct {
  2.     VirtualAddress   
  3.     SymbolTableIndex uint32
  4.     Type             
  5. }

type Section

  1. type Section struct {
  2.     SectionHeader
  3.     Relocs []
  4.  
  5.     // Embed ReaderAt for ReadAt method.
  6.     // Do not embed SectionReader directly
  7.     // to avoid having Read and Seek.
  8.     // If a client wants Read and Seek it must use
  9.     // Open() to avoid fighting over the seek offset
  10.     // with other clients.
  11.     io.
  12.     // contains filtered or unexported fields
  13. }

Section provides access to PE COFF section.

func (*Section) Data

  1. func (s *Section) Data() ([], error)

Data reads and returns the contents of the PE section s.

func (*Section) 

  1. func (s *) Open() io.

Open returns a new ReadSeeker reading the PE section s.

type SectionHeader

  1. type SectionHeader struct {
  2.     Name                 string
  3.     VirtualSize          
  4.     VirtualAddress       uint32
  5.     Size                 
  6.     Offset               uint32
  7.     PointerToRelocations 
  8.     PointerToLineNumbers uint32
  9.     NumberOfRelocations  
  10.     NumberOfLineNumbers  uint16
  11.     Characteristics      
  12. }

SectionHeader is similar to SectionHeader32 with Name field replaced by Go
string.

type SectionHeader32

  1. type SectionHeader32 struct {
  2.     Name                 [8]uint8
  3.     VirtualSize          
  4.     VirtualAddress       uint32
  5.     SizeOfRawData        
  6.     PointerToRawData     uint32
  7.     PointerToRelocations 
  8.     PointerToLineNumbers uint32
  9.     NumberOfRelocations  
  10.     NumberOfLineNumbers  uint16
  11.     Characteristics      
  12. }

SectionHeader32 represents real PE COFF section header.

type StringTable

  1. type StringTable []byte

StringTable is a COFF string table.

  1. func (st ) String(start uint32) (, error)

String extracts string from COFF string table st at offset start.

type

Symbol is similar to COFFSymbol with Name field replaced by Go string. Symbol
also does not have NumberOfAuxSymbols.