fn parse_pe()

in src/extract_execute.rs [153:202]


fn parse_pe(pe: &pe::PE) -> BinaryInfo {
    let mut sections = Vec::new();

    for s in &pe.sections {
        let name = String::from_utf8_lossy(&s.name);
        let trimmed_name = name.trim_end_matches('\0');
        let section_info = SectionInfo {
            name: trimmed_name.to_string(),
            virtual_address: s.virtual_address as u64,
            virtual_size: s.virtual_size as u64,
            raw_address: s.pointer_to_raw_data as u64,
            raw_size: s.size_of_raw_data as u64,
            characteristics_num: s.characteristics,
            characteristics_str: decode_characteristics(s.characteristics),
        };

        sections.push(section_info);
    }

    let mut imports: HashMap<String, HashSet<String>> = HashMap::new();
    for import in &pe.imports {
        let dll_name = import.dll.to_string();
        if !imports.contains_key(&dll_name) {
            imports.insert(dll_name.clone(), HashSet::new());
        }

        if let Some(entry) = imports.get_mut(&dll_name) {
            entry.insert(import.name.to_string());
        }
    }

    let mut exports = HashSet::new();
    for export in &pe.exports {
        if let Some(name) = &export.name {
            exports.insert(name.to_string());
        }
    }

    let architecture = pe::header::machine_to_str(pe.header.coff_header.machine);

    BinaryInfo {
        format: "PE".to_string(),
        entry: format!("0x{:x}", pe.entry),
        architecture: architecture.to_string(),
        size: pe.header.optional_header.map_or(0, |h| h.windows_fields.size_of_image as u64),
        sections,
        imports,
        exports,
    }
}