pe-parse

pe-parse copied to clipboard

We should add a high-level iter-style API for the debug data directory entry vector, similar to the other iter-style APIs.

One challenge: the contents of the debug entries are heterogeneously typed and have drastically different contents. Maybe a visitor pattern instead, where IterDebug is registered with a struct of callbacks, one per type.

See https://github.com/trailofbits/winchecksec/issues/44.

One downside to the visitor-style iter design: most entries in the vector will probably be one of a kind, so there isn't much of a point in "iterating" over them.

Some options:

1. VFS-style visitor pattern:

visitors = { .extended_dll_characteristics = some_func, /* ... */ };
VisitDebugEntries(pe, visitors);

2. Individual iter-style interfaces for each type:

IterDebugCodeviewEntries(pe, /* ... */);
IterDebugReproEntries(pe, /* ... */);

3. Others?

cc @yardenshafir for visibility: this is the backing work we'll need for CET detection in winchecksec.

I think we can consider this closed. Users can use the functionality in #173 to iterate over the referenced debug entries.