README
¶
go-pefile
Parsing Pefile (Portable Executable) in Golang
Documentation
¶
Index ¶
Constants ¶
View Source
const ( MAX_STRING_LENGTH = 0x100000 // 2^20 IMAGE_DOS_SIGNATURE = 0x5A4D IMAGE_DOSZM_SIGNATURE = 0x4D5A IMAGE_NE_SIGNATURE = 0x454E IMAGE_LE_SIGNATURE = 0x454C IMAGE_LX_SIGNATURE = 0x584C IMAGE_TE_SIGNATURE = 0x5A56 // Terse Executables have a 'VZ' signature IMAGE_NT_SIGNATURE = 0x00004550 IMAGE_NUMBEROF_DIRECTORY_ENTRIES = 16 IMAGE_ORDINAL_FLAG = uint32(0x80000000) IMAGE_ORDINAL_FLAG64 = uint64(0x8000000000000000) OPTIONAL_HEADER_MAGIC_PE = 0x10b OPTIONAL_HEADER_MAGIC_PE_PLUS = 0x20b FILE_ALIGNMENT_HARDCODED_VALUE = 0x200 )
This will set a maximum length of a string to be retrieved from the file.
It's there to prevent loading massive amounts of data from memory mapped files. Strings longer than 1MB should be rather rare.
Variables ¶
View Source
var INVALID_IMP_NAME = []byte("*invalid*")
View Source
var OLEAUT_32_ORD_NAMES = map[uint64]string{}/* 398 elements not displayed */
View Source
var OrdNames = map[string]map[uint64]string{ "ws2_32.dll": WS2_32_ORD_NAMES, "wsock32.dll": WS2_32_ORD_NAMES, "oleaut32.dll": OLEAUT_32_ORD_NAMES, }
View Source
var VALID_DOS_NAME = regexp.MustCompile("^[\\pL\\pN!//$%&'\\(\\)`\\-@^_\\{\\}~+,.;=\\[\\]]+$")
Valid FAT32 8.3 short filename characters according to:
http://en.wikipedia.org/wiki/8.3_filename
This will help decide whether DLL ASCII names are likely to be valid or otherwise corrupt data
The filename length is not checked because the DLLs filename can be longer that the 8.3
View Source
var VALID_FUNC_NAME = regexp.MustCompile(`^[\pL\pN_\?@$\(\)]+$`)
Check if a imported name uses the valid accepted characters expected in mangled function names. If the symbol's characters don't fall within this charset we will assume the name is invalid
View Source
var WS2_32_ORD_NAMES = map[uint64]string{}/* 117 elements not displayed */
Functions ¶
Types ¶
type ByVAddr ¶
type ByVAddr []*lib.SectionHeader
type PEFile ¶
type PEFile struct {
Filename string
DosHeader *lib.DosHeader
NTHeader *lib.NTHeader
FileHeader *lib.FileHeader
OptionalHeader *lib.OptionalHeader
OptionalHeader64 *lib.OptionalHeader64
Sections []*lib.SectionHeader
ImportDescriptors []*lib.ImportDescriptor
ExportDirectory *lib.ExportDirectory
// contains filtered or unexported fields
}
The representation of the PEFile with some helpful abstractions
func (*PEFile) GetImpHash ¶
Source Files
¶
Directories
Click to show internal directories.
Click to hide internal directories.