goblin
goblin copied to clipboard
m4b
An impish, cross-platform binary parsing crate, written in Rust
Turns out, a PE file can have more than one ImageDebugDirectory. Thus far, goblin only looks at the very first one, trying to interpret it as a CV record. This...
Adds support for archives entries in a fat binary. I ended up going down the breaking change route because I wasn't sure of a good way of doing it without...
[Error file](https://github.com/m4b/goblin/files/6559897/mips64.txt) ``` target_mips64: ELF 64-bit LSB pie executable, MIPS, MIPS64 rel2 version 1 (SYSV), dynamically linked, interpreter /lib64/ld.so.1, BuildID[sha1]=bacc6abf4a4687c897f7b49b78a9fcbb710a107c, for GNU/Linux 3.2.0, with debug_info, not stripped ``` This is...
I've been try to write a little toy linker for MacOS using goblin. So far it has been a great experience and thanks for all the hard work you've put...
Thanks for this great crate. Using it in a forensic file tool here: https://github.com/theflakes/fmd I'm trying to figure out how to query the optional_header for this: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR Trying to identify...
Goblin currently parses the first debug directory and ignores any subsequent entries. A PE debug directory can have multiple entries, for example, a C# program compiled with the option `/debug:embedded`...
i'm using goblin to get the required info from PE headers to construct path of pdb on symbol server. `cv.filename` retains the NUL terminator and was screwing stuff up. It...
Most image formats handled by goblin are stored on disk in a different layout than they'd actually appear in memory if mapped for execution. At least for PE, pointing goblin...
Hi, I've been using winedump to parse a whole bunch of Windows library files to check whether they export certain functions. This has been working fine, but shelling out for...
I've added an extra function called `get_imports_rva` To be honest I'm not sure about the correct interface so I'm leaving it like this and opening it to the discussion. I've...
