Documentation
¶
Index ¶
- Constants
- Variables
- func FindBytes(src []byte, dst []byte) (int, error)
- func MatchBytes(src []byte, dst []byte) bool
- func PadBytes(bytes []byte, size int) []byte
- func ReadCOFFHeaderOffset(bytes []byte) (int, error)
- func ReadDDBytes(bytes []byte) ([]byte, error)
- func ReadDDEntryOffset(bytes []byte, entryVirtualAddress uint32, entrySize uint32) (int, error)
- func ReadSHBytes(bytes []byte, shSize int) ([]byte, error)
- func ReadSHEntryOffset(bytes []byte, address int) (int, error)
- func ReadSHSize(file pe.File) (int, error)
- func ReadSectionBytes(file *Data, sectionVirtualAddress uint32, sectionSize uint32) ([]byte, error)
- func Utf8ToUtf16(utf8str string) []byte
- func WriteBytes(bytes []byte, offset int, replace []byte) error
- type Data
- type DataDir
- type DataEntry
- type EncBlock
- type FileEntry
- type Import
- type OptionalHeader64X110
- type Reader
- func (r *Reader) Close() error
- func (r *Reader) IsValid() bool
- func (r *Reader) Position() (int64, error)
- func (r *Reader) Read(data []byte) (int, error)
- func (r *Reader) ReadChar() (byte, error)
- func (r *Reader) ReadUInt32() (uint32, error)
- func (r *Reader) ReadUInt64() (uint64, error)
- func (r *Reader) Seek(position int64, whence int) (int64, error)
- func (r *Reader) SeekFromBeginning(position int64) (int64, error)
- func (r *Reader) SeekFromCurrent(position int64) (int64, error)
- func (r *Reader) SeekFromEnd(position int64) (int64, error)
- func (r *Reader) Size() (int64, error)
- type Section
- type SectionHeader32X28
- type Thunk
- type Writer
- func (w *Writer) Close() error
- func (w *Writer) Position() (int64, error)
- func (w *Writer) Seek(position int64, whence int) (int64, error)
- func (w *Writer) SeekFromBeginning(position int64) (int64, error)
- func (w *Writer) SeekFromCurrent(position int64) (int64, error)
- func (w *Writer) SeekFromEnd(position int64) (int64, error)
- func (w *Writer) Size() (int64, error)
- func (w *Writer) Write(data []byte) (int, error)
- func (w *Writer) WriteChar(data string) (int, error)
- func (w *Writer) WriteUInt32(value uint32) error
- func (w *Writer) WriteUInt64(value uint64) error
Constants ¶
View Source
const ( COFFStartBytesLen = 4 COFFHeaderSize = 20 )
View Source
const ( DataDirSize = 128 DataDirEntrySize = 8 )
DataDirectory 16 entries * 8 bytes / entry.
View Source
const ( SH32EntrySize = 64 SH32NameSize = 8 SH32CharacteristicsSize = 4 )
Variables ¶
View Source
var COFFStartBytes = []byte{0x50, 0x45, 0x00, 0x00} //nolint:gochecknoglobals // wontfix
COFFHeader 0x50, 0x45 = PE COFF_START_BYTES_LEN == len(COFFStartBytes).
View Source
var OH64ByteSize = binary.Size(OptionalHeader64X110{}) //nolint:exhaustruct,gochecknoglobals // wontfix
OptionalHeader64 https://github.com/golang/go/blob/master/src/debug/pe/pe.go uint byte size of OptionalHeader64 without magic mumber(2 bytes) or data directory(128 bytes) OptionalHeader64 size is 240 (110).
View Source
var SH32ByteSize = binary.Size(SectionHeader32X28{}) //nolint:exhaustruct,gochecknoglobals // wontfix
SectionHeader32 https://github.com/golang/go/blob/master/src/debug/pe/section.go uint byte size of SectionHeader32 without name(8 bytes) or characteristics(4 bytes) (28).
Functions ¶
func MatchBytes ¶
func ReadCOFFHeaderOffset ¶
func ReadDDBytes ¶
func ReadDDEntryOffset ¶
func ReadSectionBytes ¶
func Utf8ToUtf16 ¶
Types ¶
type EncBlock ¶
type EncBlock struct {
VA uint32
RawSize uint32
VirtualSize uint32
Unk uint32
CRC uint32
Unk2 uint32
CRC2 uint32
Pad uint32
FileOffset uint32
Pad2 uint64
Pad3 uint32
}
EncBlock structure (.ooa).
type Import ¶
type Import struct {
Characteristics uint32
Timedatestamp uint32
ForwarderChain uint32
Name uint32
FThunk uint32
}
Import structure (.ooa).
type OptionalHeader64X110 ¶
type OptionalHeader64X110 struct {
MajorLinkerVersion uint8
MinorLinkerVersion uint8
SizeOfCode uint32
SizeOfInitializedData uint32
SizeOfUninitializedData uint32
AddressOfEntryPoint uint32
BaseOfCode uint32
ImageBase uint64
SectionAlignment uint32
FileAlignment uint32
MajorOperatingSystemVersion uint16
MinorOperatingSystemVersion uint16
MajorImageVersion uint16
MinorImageVersion uint16
MajorSubsystemVersion uint16
MinorSubsystemVersion uint16
Win32VersionValue uint32
SizeOfImage uint32
SizeOfHeaders uint32
CheckSum uint32
Subsystem uint16
DllCharacteristics uint16
SizeOfStackReserve uint64
SizeOfStackCommit uint64
SizeOfHeapReserve uint64
SizeOfHeapCommit uint64
LoaderFlags uint32
NumberOfRvaAndSizes uint32
}
type Reader ¶
type Reader struct {
// contains filtered or unexported fields
}
func (*Reader) ReadUInt32 ¶
func (*Reader) ReadUInt64 ¶
func (*Reader) SeekFromBeginning ¶
type Section ¶
type Section struct {
ContentID string
OEP uint64
EncBlocks []EncBlock
ImageBase uint64
SizeOfImage uint32
ImportDir DataDir
IATDir DataDir
RelocDir DataDir
}
Section structure (.ooa).
type SectionHeader32X28 ¶
type Writer ¶
type Writer struct {
// contains filtered or unexported fields
}
func (*Writer) SeekFromBeginning ¶
func (*Writer) WriteUInt32 ¶
func (*Writer) WriteUInt64 ¶
Click to show internal directories.
Click to hide internal directories.