#moonpe

#Why this exists

#Relationship to xmyd0915/moonar

#What is parsed

#Install

moon add Rz-coder8848/moonpe

import { "Rz-coder8848/moonpe" @pe }

#Library usage

let pe = @pe.Pe::parse(bytes)

pe.bits()                 // 64
pe.machine()              // "AMD64"
pe.subsystem()            // "windows-console"
pe.optional.entry_point   // 0x2c5d0
pe.optional.image_base    // 0x180000000

for library in pe.imports() {
  println(library.name)
}
for library in pe.delay_imports() {     // the dependencies a naive reader misses
  println("delay: " + library.name)
}
for entry in pe.debug_entries() {
  println(entry.kind_name)
}
for resource in pe.resources() {
  println(resource.language.to_string())
}
match pe.version_info() {
  Some(info) => println(info.file_version)
  None => ()
}

#CLI

moon run cmd/moonpe --target js -- info C:/Windows/System32/kernel32.dll

file:      C:/Windows/System32/kernel32.dll
format:    PE64
machine:   AMD64
subsystem: windows-console
image:     base 0x180000000
           size 0xcb000
entry:     0x2c5d0
sections:  8
imports:   104 libraries
delay:     3 libraries
exports:   1697 symbols
pdb:       kernel32.pdb
version:   Microsoft® Windows® Operating System 10.0.26100.9444

$ moon run cmd/moonpe --target js -- resources C:/Windows/System32/kernel32.dll
TYPE              NAME          LANG  RVA/SIZE
MUI               1            0x409  0xc9458/200
VERSION           1            0x409  0xc90b0/932

$ moon run cmd/moonpe --target js -- relocations C:/Windows/System32/kernel32.dll
        PAGE  ENTRIES  DIR64  HIGHLOW  OTHER
     0x88000      218    217        0      0
     0x89000      222    222        0      0
...

The check deliberately treats those imports as a *capability*, not a verdict:
`kernel32.dll` imports most of the list and still comes out `ok`. It only
escalates when the imports appear together with writable-executable code or a
high-entropy section.
## Design notes

**Bounds-checked reads carry the offset.** `Reader::need` turns every overrun
into `OutOfBounds { offset, needed, available }`. The same applies to a bad
`e_lfanew`, a bogus optional-header magic, or a section table that declares more
entries than the file can hold.

**RVA mapping is not `rva + image_base`.** A section's `VirtualSize` and
`RawSize` differ; the bytes between them exist in memory (zero-filled by the
loader) but not in the file. `rva_to_offset` returns `None` for that tail rather
than reading whatever follows the section on disk.

**Ordinals and delay-load are preserved.** Real DLLs import and export symbols
by ordinal, and many ship a large delay-load table: `shell32.dll` has 79 static
imports and **138 delay-loaded** ones. A reader that only walks slot 1 reports
less than half of that file's dependencies while still claiming success.

**32-bit fields are read through `Int64` and range-checked.** The same source
must behave identically when compiled for a 32-bit `Int` target and a 64-bit
one; the reader rejects address-like values above 2 GiB instead of letting them
wrap differently on each platform. Pure constants such as the `VS_FIXEDFILEINFO`
signature go through a separate raw read, because they are not addresses.

## Testing

Thirty-one tests, all offline: hand-built PE32 and PE32+ images with sections,
imports, delay imports (both descriptor forms), exports, debug records,
relocations, a resource tree and `VERSIONINFO`; plus malformed inputs and a test
that truncates a valid image at every possible length and requires a clean error
every time.

```sh
moon test --target wasm-gc

#Completion criteria for v1.0

1. all PE32 and PE32+ optional-header fields readable, with cross-width tests;
2. all 16 data directories named, addressed, mapped and given a semantic level;
3. imports, delay imports, exports and the IAT readable;
4. sections, relocations, debug/PDB, resources, VERSIONINFO, LoadConfig/SafeSEH and certificates readable;
5. arbitrary truncation and malformed input raise PeError, never panic;
6. at least three real system binaries (PE32 and PE32+) validated;
7. this README documents the boundary, including the directories that are reported by address only.

#References

#License