parse with goblin

This commit is contained in:
🪞👃🪞 2024-10-28 00:33:18 +02:00
parent 52f5c58519
commit 3d29608171

View file

@ -1,5 +1,6 @@
use clap::Parser;
use std::path::Path;
use goblin::{error, Object};
use exe::pe::{PE, VecPE};
use exe::types::{ImportDirectory, ImportData, CCharString};
@ -25,18 +26,29 @@ impl VestalCli {
}
}
fn inspect (&self, path: impl AsRef<Path>) -> Usually<()> {
let image = VecPE::from_disk_file(path)?;
let import_directory = ImportDirectory::parse(&image)?;
for descriptor in import_directory.descriptors {
let name = descriptor.get_name(&image)?.as_str()?;
println!("\n{name}:");
for import in descriptor.get_imports(&image).unwrap() {
match import {
ImportData::Ordinal(x) => println!("{name} #{}", x),
ImportData::ImportByName(s) => println!("{name} {}", s)
}
}
let buffer = std::fs::read(path.as_ref())?;
match Object::parse(&buffer)? {
Object::PE(pe) => {
println!("PE: {}", path.as_ref().display());
//println!("Exports: {:#?}", &pe.export_data);
println!("Exports: {:#?}", &pe.exports.len());
//println!("Imports: {:#?}", &pe.import_data);
println!("Imports: {:#?}", &pe.imports.len());
},
_ => panic!("not a PE")
}
//let image = VecPE::from_disk_file(path)?;
//let import_directory = ImportDirectory::parse(&image)?;
//for descriptor in import_directory.descriptors {
//let name = descriptor.get_name(&image)?.as_str()?;
//println!("\n{name}:");
//for import in descriptor.get_imports(&image).unwrap() {
//match import {
//ImportData::Ordinal(x) => println!("{name} #{x}"),
//ImportData::ImportByName(s) => println!("{name} {s}")
//}
//}
//}
Ok(())
}
}