r12f / libpe

PE file parser

LibPE

LibPE is a simple parser for PE file format under The BSD 2-Clause License.

Design principles (May be not achieved)

Easy-To-Use

• Get every part of PE file directly instead of RVA or FOA or even raw data structures.
• Using reference count to manage object's life circle.
• Support compilation to lib and dll.

Compatible with PE32(x86) and PE32+(x64)

• No doubt, it's a must-have ability.
• Get file info through IPEFile instead of IPEFile32 and IPEFile64, simplify your code.

Good performance

• Do not parse any content until you need it.
• Minimize the Disk IO.

Cross platform

• Support windows & linux.

Why / Why Not XXX?

• Why using basic types on windows?

  I presume most of the users are developing on Windows platform. So we should minimize the things you may learn.

• Why using COM-like interface?

  This is the problem I grapple with for most of the time. Althrough it makes LibPE harder to use, we still use it to avoid the use-after-free crashes and to solve the cross-dll problems. And we do not need QueryInterface due to the simple class hierarchy. And also we do not support COM in order to make LibPE easier to use.

• Why no boost?

  Boost is a very powerful tool. But you need checkout lots of code before you use LibPE. And of course, you should learn boost first before you see the code.

• Why so many template

  When you need a new type of PE parser, define your own PETrait and change the LIBPE_FORCE_TEMPLATE_REDUCTION_XXX macro. And wala!

Copyright

Copyright (c) 2012-2013, Jiang Jinzhou. See LICENSE for details.

libpe's Issues

Parse exception table

Parse bound import table

Parse import address

Adding CLR table without parsing the internal structures.

CLR table has very complex internal data structure, so now we only parse the location of CLR table.

Use SAL annotation to reduce the annoying null checks.

Enable export table test

内存问题

非常感谢libpe，为PE解析带来了极大的方便， 我这log发现DataLoaderDiskFile没有析构，带来了内存泄露，希望给予答复

Create basic framework

Add functions for getting pe type

Adding test for tls table

Parse line no table

Parse certification table

希望可以有写入或者重组PE文件的功能

我比较了一下Libpe和Pelib，libpe解析的结构比pelib要更多更详细。不过两者都只有读取没有写入文件的功能。如果方便的话，希望libpe能加入这个特性，比如我希望直接在PeFile中AddSection，或者重新生成一个新的重定位表，最后使用make()或者build()可以直接重组结构将其写入硬盘中。不过似乎您的接口并非为此设计，不知难度大吗？

Best wishes 👍 :)

Parse related import address block for import module.

Useful for bound module.

Ability to compile to dll.

Change LibPETest to PEDumper

Review the design.

Simple test project

Parse extra data

Set global IO block size

Change the IO into file mapping

Use file mapping instead of current IO layer, so we can save lots of works.

Allow parsing pefile from external DataLoader

Update README.

Parse architecture table

Parse relocation table

Create class for pe header

Create class for pe header

Parse load config table

Adding strict check for unexpected internal state.

To expose issues earlier, we crash instead of return E_UNEXPECTED.

Adding test for exception table

Fix PE parser bug by checking the dumping result

Investigating how to support parsing HModule

Add getter for raw pe struct fields

Parse debug table

Parse tls table

Parse delay import table

Adding test for resource table

Parse resource table

Parse global pointer table