pe

package
v1.31.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 13, 2025 License: Apache-2.0 Imports: 12 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type CLREvidence

type CLREvidence struct {
	// HasClrResourceNames is true if there are CLR resource names found in the PE file (e.g. "CLRDEBUGINFO").
	HasClrResourceNames bool

	// MajorVersion is the minimum supported major version of the CLR.
	MajorVersion uint16

	// MinorVersion is the minimum supported minor version of the CLR.
	MinorVersion uint16
}

CLREvidence is basic info about the CLR (common language runtime) version from the COM descriptor. This is not a complete representation of the CLR version, but rather a subset of the information that is useful to us.

func (*CLREvidence) HasEvidenceOfCLR

func (c *CLREvidence) HasEvidenceOfCLR() bool

HasEvidenceOfCLR returns true if the PE file has evidence of a CLR (common language runtime) version.

type File

type File struct {
	// Location is where the PE file was found
	Location file.Location

	// CLR is the information about the CLR (common language runtime) version found in the PE file which helps
	// understand if this executable is even a .NET application.
	CLR *CLREvidence

	// VersionResources is a map of version resource keys to their values found in the VERSIONINFO resource directory.
	VersionResources map[string]string
}

File does not directly represent a binary shape to be parsed, instead it represents the information of interest extracted from a PE file.

func Read

func Read(f file.LocationReadCloser) (*File, error)

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL