m4b / goblin

An impish, cross-platform binary parsing crate, written in Rust
MIT License
1.19k stars 160 forks source link

pe: add Terse Executable (TE) support #397

Closed Javagedes closed 7 months ago

Javagedes commented 8 months ago

Add terse executable (TE) support to the PE module. A terse executable is a PE32/PE32+ binary with a reduced header size containing only the fields necessary for the binary to be properly executed by a Platform Initialization (PI) architecture compliant loader and executor. Terse executables are most commonly used by UEFI compliant firmware to reduce the overall size of the binary.

Only the header is replaced, and no other data is changed in a terse executable, resulting in all address values being invalid. The TE parser must take appropriate action to fix up addresses during parsing by adjusting the existing value by the difference between the stripped_size and the new size of the header.

closes #398

Javagedes commented 8 months ago

this generally looks very good, thank you! i'm 50/50 on the fence about whether it should be it's own module, just so it's slightly more encapsulated, but it's such little code it may not be worth it. only minor nits, I'll give a chance to anyone else who wants to review, then i'm ok to merge this basically :)

@m4b I'm not against moving it to it's own module if you prefer. At a minimum, it would clean up the #[cfg(feature = "te")] that I sprinkled throughout pe/mod.rs and pe/header.rs. Additionally, if more capabilities were added later, it would remove the possibility of having a bloated pe module, and the need of moving it to another module down the road.

m4b commented 7 months ago

thanks @Javagedes this is great

note: non-breaking

m4b commented 6 months ago

release in 0.8.1

m4b commented 1 month ago

released in 0.9.0, thank you for your patience!