PE_Analyzer Rust

A Rust-based PE (Portable Executable) file analyzer that provides detailed information about Windows executable files.

Features

• Parse and analyze PE file headers
• Display file characteristics
• Show section information
• Extract import and export tables
• Analyze PE file structure

Requirements

• Rust (latest stable version)
• Cargo package manager

Installation

Clone the repository and build the project:

cargo build --release

Usage

Run the analyzer with a PE file path as an argument:

cargo run -- <path-to-pe-file>

How does it work

• This Analyzer Currently Supports

  • DOS Header
    • It proceeds to read fields from the DOS header at their respective offsets.
    • e_lfanew: It specifically reads the e_lfanew field at offset 0x3C. This field, as mentioned, is crucial for locating the NT headers.
  • File Header
  • NT Header
  • Section Header
  • Rich Header

• Important Notes

  • Little-Endian: PE files use little-endian byte order.
  • Offsets: File offsets are used to locate data within the file.
  • RVA: Relative Virtual Addresses (RVAs) are used within the PE file and sometimes need to be converted to file offsets.

Credits Section

For more PoC. Please visit: https://github.com/Whitecat18/Rust-for-Malware-Development/

@5mukx