PE

Parses a Portable Executable file.

struct PE {

ubyte[] data;

PIMAGE_DOS_HEADER dosHeader;

PIMAGE_NT_HEADERS32 ntHeaders;

IMAGE_SECTION_HEADER[] sectionHeaders;

IMAGE_DATA_DIRECTORY[] dataDirectories;

this(void[] exe);

size_t fileToRva(size_t offset);

size_t rvaToFile(size_t offset);

size_t fileToImage(size_t offset);

size_t imageToFile(size_t offset);

auto imageData [@property getter];

ubyte[] sectionData(IMAGE_SECTION_HEADER section);

ubyte[] directoryData(USHORT entry);

}

Constructors

this this(void[] exe): Undocumented in source.

Members

Functions

directoryData ubyte[] directoryData(USHORT entry): Get the image data for the given directory entry.
fileToImage size_t fileToImage(size_t offset): Translate a file offset to the corresponding virtual address (the in-memory image address at the default image base).
fileToRva size_t fileToRva(size_t offset): Translate a file offset to the relative virtual address (address relative to the image base).
imageToFile size_t imageToFile(size_t offset): Reverse of fileToImage
rvaToFile size_t rvaToFile(size_t offset): Reverse of fileToRva
sectionData ubyte[] sectionData(IMAGE_SECTION_HEADER section): Get the image data for the given section header.

Properties

imageData auto imageData [@property getter]: Provide an array-like view of the in-memory layout.

Variables

data ubyte[] data;: File data bytes.
dataDirectories IMAGE_DATA_DIRECTORY[] dataDirectories;: Extracted headers.
dosHeader PIMAGE_DOS_HEADER dosHeader;
ntHeaders PIMAGE_NT_HEADERS32 ntHeaders;
sectionHeaders IMAGE_SECTION_HEADER[] sectionHeaders;: Extracted headers.

Meta

Source

See Implementation

ae sys windows pe pe properties

name

structs

PE