in src/extract_execute.rs [153:202]
fn parse_pe(pe: &pe::PE) -> BinaryInfo {
let mut sections = Vec::new();
for s in &pe.sections {
let name = String::from_utf8_lossy(&s.name);
let trimmed_name = name.trim_end_matches('\0');
let section_info = SectionInfo {
name: trimmed_name.to_string(),
virtual_address: s.virtual_address as u64,
virtual_size: s.virtual_size as u64,
raw_address: s.pointer_to_raw_data as u64,
raw_size: s.size_of_raw_data as u64,
characteristics_num: s.characteristics,
characteristics_str: decode_characteristics(s.characteristics),
};
sections.push(section_info);
}
let mut imports: HashMap<String, HashSet<String>> = HashMap::new();
for import in &pe.imports {
let dll_name = import.dll.to_string();
if !imports.contains_key(&dll_name) {
imports.insert(dll_name.clone(), HashSet::new());
}
if let Some(entry) = imports.get_mut(&dll_name) {
entry.insert(import.name.to_string());
}
}
let mut exports = HashSet::new();
for export in &pe.exports {
if let Some(name) = &export.name {
exports.insert(name.to_string());
}
}
let architecture = pe::header::machine_to_str(pe.header.coff_header.machine);
BinaryInfo {
format: "PE".to_string(),
entry: format!("0x{:x}", pe.entry),
architecture: architecture.to_string(),
size: pe.header.optional_header.map_or(0, |h| h.windows_fields.size_of_image as u64),
sections,
imports,
exports,
}
}