🥮 mooncakes.io
    Sign in

    moonpe

    Pure-MoonBit Windows PE32/PE32+ reader: IAT, resources, .NET metadata tables, LoadConfig, JSON and recursive scanning, with precise errors instead of panics.

    pe
    coff
    windows
    executable
    dll
    binary
    parser
    dotnet
    json
    security
    reverse-engineering
    Download zip
    Version
    0.8.0
    License
    Apache-2.0
    Repository
    Last updated
    1 hour ago
    Downloads
    38

    #moonpe

    CI mooncakes.io

    A pure-MoonBit reader for Windows PE/COFF images — the format behind every .exe, .dll and .sys on Windows. It reads the DOS/NT headers, the section table, imports (including delay-loaded ones), exports, debug records with their PDB path, base relocations, resources and .NET metadata, and reports malformed input with the exact byte offset instead of panicking.

    #Why this exists

    MoonBit can already read Linux executables: moonbit-community/elf parses ELF object files. There is nothing for the other half of the world. Every Windows binary is a PE image, and tooling around those binaries — dependency checks, plugin validation, supply-chain triage — currently has no MoonBit building block.

    PE is also a format where "roughly right" is not enough. Offsets are relative to sections rather than the file, some bytes exist in memory but not on disk, and import tables mix name-based and ordinal-based references. Each of those is a place where a naive reader silently returns wrong data.

    #Relationship to xmyd0915/moonar

    moonar is an ar / COFF archive library: it handles .a, GNU thin archives and Microsoft .lib static or import libraries. moonpe handles PE images (.exe / .dll / .sys). They share only the 20-byte COFF file header and 40-byte section header that the format itself mandates; PE's DOS stub, optional header, data directories, import/export tables and RVA mapping are absent from moonar, and archive containers are absent from moonpe.

    Inputmoonar 0.6.1moonpe
    kernel32.dllAR001 at byte 0: expected ar archive magicPE64, 8 sections, 104 import libraries, 3 delay-loaded, 1697 exports
    demo.a0 118560 "bcheck.o"bad signature at 0x0: expected the 'MZ' DOS signature

    The full comparison, including the decisions a user can make from each output, is in docs/对比说明.md. The module layout and design decisions are in docs/架构说明.md, and examples/release_check is a runnable release gate.

    #What is parsed

    AreaStatus
    DOS header (MZ, e_lfanew) and PE\0\0✅
    COFF header and every standard optional-header field, PE32 and PE32+✅
    All 16 data directories, named and mapped to file offsets✅
    Section table (name, sizes, addresses, permissions)✅
    RVA → file offset, rejecting the zero-filled tail✅
    Imports by name and by ordinal✅
    Static and delay-loaded IAT slots with library, raw value and matching import✅
    Delay-load imports, RVA and VA descriptor forms✅
    Exports, including ordinal-only entries✅
    Debug directory, CodeView RSDS/NB10, PDB path and age✅
    Base relocations, counted by fixup type✅
    Section entropy and a release/triage check with a verdict✅
    TLS directory and callback count✅
    CLR header and .NET runtime version✅
    .NET metadata streams, table counts, assembly refs, types and methods✅
    Application manifest and requestedExecutionLevel✅
    Resource tree (type / name / language)✅
    STRING, bitmap/icon dimensions, icon groups and manifest content✅
    VERSIONINFO: file/product version and string table✅
    LoadConfig: security cookie, SafeSEH, CFG tables and flags✅
    Certificate table entries (presence and type, not verification)✅
    Exception function table and bound imports✅ summary
    Architecture, GlobalPtr and the reserved slotreserved by the PE specification

    Every directory the PE specification defines now has a declared semantic level: fully parsed, summarised, or reserved by the specification itself. What is not implemented: execution, disassembly, IL decoding, signature verification, icon pixel rendering, and writing or patching images.

    #Install

    moon add Rz-coder8848/moonpe

    import { "Rz-coder8848/moonpe" @pe }

    #Library usage

    let pe = @pe.Pe::parse(bytes)

    pe.bits()                 // 64
    pe.machine()              // "AMD64"
    pe.subsystem()            // "windows-console"
    pe.optional.entry_point   // 0x2c5d0
    pe.optional.image_base    // 0x180000000

    for library in pe.imports() {
      println(library.name)
    }
    for slot in pe.iat() {
      println(slot.library + " " + slot.slot_rva.to_string())
    }
    for library in pe.delay_imports() {     // the dependencies a naive reader misses
      println("delay: " + library.name)
    }
    for entry in pe.debug_entries() {
      println(entry.kind_name)
    }
    for resource in pe.resources() {
      let content = pe.decode_resource(resource)
      println(content.kind + ": " + content.summary)
    }
    match pe.version_info() {
      Some(info) => println(info.file_version)
      None => ()
    }
    match pe.clr_metadata() {
      Some(metadata) => println(metadata.assembly_name)
      None => println("native image")
    }

    #CLI

    The command uses moonbitlang/x to read the file — the library itself has no dependencies.

    moon run cmd/moonpe --target js -- info C:/Windows/System32/kernel32.dll

    file:      C:/Windows/System32/kernel32.dll
format:    PE64
machine:   AMD64
subsystem: windows-console
image:     base 0x180000000
           size 0xcb000
entry:     0x2c5d0
sections:  8
imports:   104 libraries
delay:     3 libraries
exports:   1697 symbols
pdb:       kernel32.pdb
version:   Microsoft® Windows® Operating System 10.0.26100.9444

    Commands: info, sections, imports, iat, exports, debug, relocations, resources, dotnet, loadconfig, check, all, and the recursive scan. Add --json before the command for automation.

    $ moon run cmd/moonpe --target js -- resources C:/Windows/System32/kernel32.dll
TYPE              NAME          LANG  RVA/SIZE  DETAIL
MUI               1            0x409  0xc9458/200  200 byte(s), not decoded
VERSION           1            0x409  0xc90b0/932  file 10.0.26100.9444, ...

$ moon run cmd/moonpe --target js -- relocations C:/Windows/System32/kernel32.dll
        PAGE  ENTRIES  DIR64  HIGHLOW  OTHER
     0x88000      218    217        0      0
     0x89000      222    222        0      0

$ moon run cmd/moonpe --target js -- check C:/Windows/System32/kernel32.dll
verdict:   ok
max entropy: 625 / 800
  [INFO] DELAY_IMPORTS     3 delay-loaded libraries; static-only dependency checks miss these
  [INFO] CAPABILITIES      imports CreateRemoteThreadEx, VirtualAllocEx, ... (loader APIs)

    JSON output is one object per invocation and uses hexadecimal strings for addresses. Directory scans recursively inspect .exe, .dll, .sys, .ocx, .cpl and .scr files:

    moon run cmd/moonpe --target js -- --json check C:/Windows/System32/notepad.exe
moon run cmd/moonpe --target js -- --json scan C:/Windows/System32/WindowsPowerShell

    The scan summary separates ok, review, suspicious, read/parse errors and PE32/PE64 counts. Each file entry also includes dependency, IAT, CFG and managed-assembly status.

    The check deliberately treats those imports as a capability, not a verdict: kernel32.dll imports most of the list and still comes out ok. It only escalates when the imports appear together with writable-executable code or a high-entropy section.

    #Design notes

    Bounds-checked reads carry the offset. Reader::need turns every overrun into OutOfBounds { offset, needed, available }. The same applies to a bad e_lfanew, a bogus optional-header magic, or a section table that declares more entries than the file can hold.

    RVA mapping is not rva + image_base. A section's VirtualSize and RawSize differ; the bytes between them exist in memory (zero-filled by the loader) but not in the file. rva_to_offset returns None for that tail rather than reading whatever follows the section on disk.

    Ordinals and delay-load are preserved. Real DLLs import and export symbols by ordinal, and many ship a large delay-load table: shell32.dll has 79 static imports and 138 delay-loaded ones. A reader that only walks slot 1 reports less than half of that file's dependencies while still claiming success.

    IAT values are exposed as raw bits, not guessed addresses. An unbound static IAT may still contain the lookup-table RVA or ordinal bit pattern, while a bound or delay-loaded image may contain a full virtual address. Pe::iat therefore returns the slot RVA, raw pointer-sized value, matching symbol and a delayed flag instead of assuming every slot is already resolved.

    32-bit fields are read through Int64 and range-checked. The same source must behave identically when compiled for a 32-bit Int target and a 64-bit one; the reader rejects address-like values above 2 GiB instead of letting them wrap differently on each platform. Pure constants such as the VS_FIXEDFILEINFO signature go through a separate raw read, because they are not addresses.

    #Testing

    Forty-two tests, all offline: hand-built PE32 and PE32+ images with every optional-header field, static/delay IAT slots, resources and CLR metadata tables. Every successfully parsed truncation/mutation is sent through all public table parsers; 500 deterministic mutation rounds must never panic.

    moon test --deny-warn --target wasm-gc
moon test --deny-warn --target wasm

    Real-binary validation (output compared against system tools):

    FileResult
    System32\kernel32.dllPE64, 8 sections, 104 imports, 1292 IAT slots (18 delay), 1697 exports
    SysWOW64\kernel32.dllPE32, 6 sections, 102 imports, 1283 IAT slots (18 delay), 1669 exports
    System32\shell32.dllPE64, 79 imports, 138 delay, 843 exports
    System32\notepad.exePE64, 50 imports, 6 delay, 0 exports
    mscorlib.dll31 tables, 3356 types, 29257 methods, assembly mscorlib 4.0.0.0
    System.Core.dll33 tables, 1176 types, 498 type refs, 5 assembly refs
    WindowsPowerShell\v1.0 scan59/59 files recognised, 40 PE32 and 19 PE64

    #Completion criteria for v1.0

    This project defines "complete format support" as a checklist rather than a feeling:

    1. all PE32 and PE32+ optional-header fields readable, with cross-width tests;
    2. all 16 data directories named, addressed, mapped and given a semantic level;
    3. imports, delay imports, exports and the IAT readable;
    4. sections, relocations, debug/PDB, resources, VERSIONINFO, LoadConfig/SafeSEH and certificates readable;
    5. common resource payloads and .NET metadata tables decoded, not just addressed;
    6. arbitrary truncation and malformed input raise PeError, never panic;
    7. at least three real system binaries (native and managed, PE32 and PE32+) validated;
    8. this README documents the boundary, including summary-only and specification-reserved slots.

    All eight are met in 0.8.0.

    #References

    moonpe is an original implementation, not a port, and contains no third-party code. Its behaviour is aligned with the published format documentation and with the behaviour of established readers:

    ReferenceUsed forLicense
    PE format specificationheader, section, import, export, resource layoutsMicrosoft documentation
    ECMA-335 metadataCLR streams, tables and coded indexesECMA standard
    goblin → pe modulebehaviour cross-checkMIT
    pefilebehaviour cross-checkMIT
    xmyd0915/moonaradjacent archive library; relationship documented aboveApache-2.0

    #License

    Apache-2.0. See LICENSE.

    PeError

    source
    pub(all) suberror PeError {
      OutOfBounds(Int, Int, Int)
      BadMagic(String, Int)
      Malformed(String, Int)
      Unsupported(String)
    }

    PeError::message

    source
    fn PeError::message(self : PeError) -> String

    A one-line description with the offset rendered in hex.

    Certificate

    source
    pub(all) struct Certificate {
      length : Int
      revision : Int
      kind : Int
    } derive(
    Debug    )

    CheckReport

    source
    pub(all) struct CheckReport {
      findings : Array[Finding]
      verdict : String
      max_section_entropy : Double
    } derive(
    Debug    )

    ClrInfo

    source
    pub(all) struct ClrInfo {
      runtime_version : String
      metadata_size : Int
      flags : Int
      entry_point_token : Int
    } derive(
    Debug    )

    ClrInfo::to_repr

    source

    ClrMetadata

    source
    pub(all) struct ClrMetadata {
      streams : Array[MetadataStream]
      tables : Array[MetadataTable]
      module_name : String?
      assembly_name : String?
      assembly_version : String?
      assembly_flags : Int
      assembly_references : Array[MetadataAssemblyReference]
      type_definitions : Array[MetadataType]
      type_references : Array[MetadataType]
      method_definitions : Array[MetadataMethod]
      member_reference_names : Array[String]
    } derive(
    Debug    )

    CoffHeader

    source
    pub(all) struct CoffHeader {
      machine : Int
      number_of_sections : Int
      timestamp : Int64
      characteristics : Int
    } derive(
    Debug    )

    The COFF file header that follows the PE\0\0 signature.

    CoffHeader::is_32bit_machine

    source
    fn CoffHeader::is_32bit_machine(self : CoffHeader) -> Bool

    IMAGE_FILE_32BIT_MACHINE.

    CoffHeader::is_dll

    source
    fn CoffHeader::is_dll(self : CoffHeader) -> Bool

    IMAGE_FILE_DLL — the image is a library, not an executable.

    CoffHeader::is_executable

    source
    fn CoffHeader::is_executable(self : CoffHeader) -> Bool

    IMAGE_FILE_EXECUTABLE_IMAGE.

    CoffHeader::to_repr

    source

    DataDirectory

    source
    pub(all) struct DataDirectory {
      index : Int
      virtual_address : Int
      size : Int
    } derive(
    Debug    )

    One entry of the optional header's data-directory array. index is the documented slot number (0 = export table, 1 = import table, ...).

    DataDirectory::to_repr

    source

    DebugEntry

    source
    pub(all) struct DebugEntry {
      kind : Int
      kind_name : String
      timestamp : Int
      size : Int
      address : Int
      pdb_signature : String?
      pdb_age : Int?
      pdb_path : String?
    } derive(
    Debug    )

    DelayImportLibrary

    source
    pub(all) struct DelayImportLibrary {
      name : String
      entries : Array[ImportEntry]
      rva_based : Bool
      iat_rva : Int?
    } derive(
    Debug    )

    Export

    source
    pub(all) struct Export {
      name : String?
      ordinal : Int
      rva : Int
    } derive(
    Debug    )

    Export::to_repr

    source

    ExportTable

    source
    pub(all) struct ExportTable {
      dll_name : String
      exports : Array[Export]
    } derive(
    Debug    )

    A parsed export directory.

    ExportTable::to_repr

    source

    Finding

    source
    pub(all) struct Finding {
      severity : Severity
      code : String
      message : String
    } derive(
    Debug    )

    Finding::to_repr

    source

    FunctionTable

    source
    pub(all) struct FunctionTable {
      entries : Int
      first_rva : Int
      last_rva : Int
    } derive(
    Debug    )

    GroupIconMember

    source
    pub(all) struct GroupIconMember {
      width : Int
      height : Int
      color_count : Int
      planes : Int
      bit_count : Int
      resource_id : Int
      bytes : Int
    } derive(
    Debug    )

    IatEntry

    source
    pub(all) struct IatEntry {
      library : String
      delayed : Bool
      slot_rva : Int
      raw_value : Int64
      symbol : ImportEntry
    } derive(
    Debug    )

    IatEntry::to_repr

    source

    ImportEntry

    source
    pub(all) struct ImportEntry {
      name : String?
      ordinal : Int?
    } derive(
    Debug    )

    ImportLibrary

    source
    pub(all) struct ImportLibrary {
      name : String
      entries : Array[ImportEntry]
    } derive(
    Debug    )

    One DLL and everything imported from it.

    ImportLibrary::to_repr

    source

    LoadConfig

    source
    pub(all) struct LoadConfig {
      size : Int
      timestamp : Int
      global_flags_clear : Int
      global_flags_set : Int
      critical_section_timeout : Int
      process_heap_flags : Int
      csd_version : Int
      dependent_load_flags : Int
      security_cookie : Int64
      seh_handler_table : Int64
      seh_handler_count : Int64
      guard_cf_check : Int64
      guard_cf_dispatch : Int64
      guard_cf_function_table : Int64
      guard_cf_function_count : Int64
      guard_flags : Int
      code_integrity_flags : Int
      code_integrity_catalog : Int
    } derive(
    Debug    )

    MetadataAssemblyReference

    source
    pub(all) struct MetadataAssemblyReference {
      name : String
      version : String
      flags : Int
      public_key_or_token : Int
    } derive(
    Debug    )

    MetadataMethod

    source
    pub(all) struct MetadataMethod {
      name : String
      rva : Int
      flags : Int
      impl_flags : Int
    } derive(
    Debug    )

    MetadataStream

    source
    pub(all) struct MetadataStream {
      name : String
      offset : Int
      size : Int
    } derive(
    Debug    )

    MetadataTable

    source
    pub(all) struct MetadataTable {
      id : Int
      name : String
      rows : Int
    } derive(
    Debug    )

    MetadataType

    source
    pub(all) struct MetadataType {
      namespace_name : String
      name : String
      flags : Int
    } derive(
    Debug    )

    OptionalHeader

    source
    pub(all) struct OptionalHeader {
      kind : PeKind
      major_linker_version : Int
      minor_linker_version : Int
      size_of_code : Int
      size_of_initialized_data : Int
      size_of_uninitialized_data : Int
      entry_point : Int
      base_of_code : Int
      base_of_data : Int?
      image_base : Int64
      section_alignment : Int
      file_alignment : Int
      major_operating_system_version : Int
      minor_operating_system_version : Int
      major_image_version : Int
      minor_image_version : Int
      major_subsystem_version : Int
      minor_subsystem_version : Int
      win32_version_value : Int
      size_of_image : Int
      size_of_headers : Int
      checksum : Int
      subsystem : Int
      dll_characteristics : Int
      size_of_stack_reserve : Int64
      size_of_stack_commit : Int64
      size_of_heap_reserve : Int64
      size_of_heap_commit : Int64
      loader_flags : Int
      number_of_rva_and_sizes : Int
      directories : Array[DataDirectory]
    } derive(
    Debug    )

    The parsed optional header fields this library cares about.

    OptionalHeader::to_repr

    source

    pub(all) struct Pe {
      bytes : Bytes
      coff : CoffHeader
      optional : OptionalHeader
      sections : Array[Section]
    }

    Pe::bits

    source
    fn Pe::bits(self : Pe) -> Int

    32 or 64.

    Pe::bound_imports

    source
    fn Pe::bound_imports(self : Pe) -> Array[String] raise PeError

    The module names listed in the bound-import directory.

    Pe::certificates

    source
    fn Pe::certificates(self : Pe) -> Array[Certificate] raise PeError

    Walk the certificate table.

    Pe::check

    source
    fn Pe::check(self : Pe) -> CheckReport

    Run the built-in checks.

    Pe::clr

    source
    fn Pe::clr(self : Pe) -> ClrInfo? raise PeError

    Read the CLR header, or None for a native image.

    Pe::clr_metadata

    source
    fn Pe::clr_metadata(self : Pe) -> ClrMetadata? raise PeError

    Read and decode the CLR metadata root and its #~ / #- tables.

    Pe::debug_entries

    source
    fn Pe::debug_entries(self : Pe) -> Array[DebugEntry] raise PeError

    Read every debug-directory entry.

    Pe::decode_resource

    source
    fn Pe::decode_resource(self : Pe, entry : ResourceEntry) -> ResourceContent raise PeError

    Decode one resource leaf. Unsupported data content is returned as raw with its byte size, while malformed data for a recognised type is an error.

    Pe::delay_imports

    source
    fn Pe::delay_imports(self : Pe) -> Array[DelayImportLibrary] raise PeError

    Read the delay-load import directory.

    Pe::directory

    source
    fn Pe::directory(self : Pe, index : Int) -> DataDirectory?

    The data directory with the given slot number, if the header declares it.

    Pe::exports

    source
    fn Pe::exports(self : Pe) -> ExportTable? raise PeError

    Read the export directory.

    Returns None when the image exports nothing, which is the normal case for executables and for many DLLs.

    Pe::function_table

    source
    fn Pe::function_table(self : Pe) -> FunctionTable? raise PeError

    Read the runtime-function table, if the image has one.

    Pe::iat

    source
    fn Pe::iat(self : Pe) -> Array[IatEntry] raise PeError

    Read every current IAT slot in descriptor order.

    Static imports use data-directory slot 12, but delay-loaded libraries carry independent IATs inside slot 13. Both are returned and distinguished by delayed; reading only the normal IAT silently misses the latter.

    Pe::imports

    source
    fn Pe::imports(self : Pe) -> Array[ImportLibrary] raise PeError

    Read the import directory.

    Returns an empty array when the image has no imports. Structural problems — a descriptor or thunk table that points outside the file — are reported as errors rather than skipped, because a silently truncated import list is worse than a loud failure.

    Pe::load_config

    source
    fn Pe::load_config(self : Pe) -> LoadConfig? raise PeError

    Read the load-configuration directory, or None when absent.

    Pe::machine

    source
    fn Pe::machine(self : Pe) -> String

    The CPU architecture name.

    Pe::manifest

    source
    fn Pe::manifest(self : Pe) -> String? raise PeError

    The raw manifest text, if the image carries one.

    Pe::manifest_execution_level

    source
    fn Pe::manifest_execution_level(self : Pe) -> String? raise PeError

    The requestedExecutionLevel value from the manifest, e.g. asInvoker, highestAvailable or requireAdministrator.

    Pe::parse

    source
    fn Pe::parse(bytes : Bytes) -> Pe raise PeError

    Parse a PE image from memory.

    Every failure is a PeError carrying the offset it was detected at; the parser never panics on hostile input.

    Pe::relocations

    source
    fn Pe::relocations(self : Pe) -> RelocationSummary raise PeError

    Read and summarise the relocation directory.

    Pe::resolved_directories

    source
    fn Pe::resolved_directories(self : Pe) -> Array[ResolvedDirectory]

    Every declared data directory, in slot order.

    Pe::resources

    source
    fn Pe::resources(self : Pe) -> Array[ResourceEntry] raise PeError

    Every resource leaf in the image.

    Pe::rva_to_offset

    source
    fn Pe::rva_to_offset(self : Pe, rva : Int) -> Int?

    Map a relative virtual address to an offset in the file.

    Returns None for addresses inside a section's zero-filled tail: those bytes exist in memory but not on disk, and reading them would return whatever happened to be next in the file.

    Pe::safe_seh_handlers

    source
    fn Pe::safe_seh_handlers(self : Pe) -> Array[Int]? raise PeError

    The SafeSEH handler table: the RVAs of the exception handlers the image was built with.

    SafeSEH is an x86 mitigation. On x64 the table is unused, so this returns None; on x86 it returns Some([]) when the image has a load config but records no handlers, which is exactly the state a mitigation check wants to distinguish from "no load config at all".

    Pe::section

    source
    fn Pe::section(self : Pe, name : String) -> Section?

    Look a section up by its (NUL-trimmed) name.

    Pe::section_bytes

    source
    fn Pe::section_bytes(self : Pe, section : Section) -> Bytes?

    The raw bytes backing a section, or None when the section has no file contents (.bss-style) or its declared range lies outside the file.

    Pe::section_entropy

    source
    fn Pe::section_entropy(self : Pe, section : Section) -> Double?

    Entropy of a section's file-backed bytes.

    The range is scanned in place: a packed section can be hundreds of megabytes, and copying it just to count bytes would dominate the scan.

    Pe::section_for_rva

    source
    fn Pe::section_for_rva(self : Pe, rva : Int) -> Section?

    The section that contains an RVA, if any.

    Pe::string_at_rva

    source
    fn Pe::string_at_rva(self : Pe, rva : Int, limit : Int) -> String raise PeError

    Read a NUL-terminated ASCII string located at an RVA.

    Pe::subsystem

    source
    fn Pe::subsystem(self : Pe) -> String

    The subsystem name.

    Pe::suspicious_imports

    source
    fn Pe::suspicious_imports(self : Pe) -> Array[String]

    Imported function names that are common in loader and injection code.

    Pe::tls

    source
    fn Pe::tls(self : Pe) -> TlsInfo? raise PeError

    Read the TLS directory, or None when the image has none.

    Pe::va_to_rva

    source
    fn Pe::va_to_rva(self : Pe, address : Int) -> Int?

    Convert a virtual address to an RVA using the image base.

    Pe::version_info

    source
    fn Pe::version_info(self : Pe) -> VersionInfo? raise PeError

    Read the version resource, if the image has one.

    The string table is checked first; the numeric fixed-file-info version is used as the fallback for file_version, because some build systems omit the FileVersion string.

    PeKind

    source
    pub(all) enum PeKind {
      Pe32
      Pe32Plus
    } derive(Eq, 
    Debug    )

    The two optional-header layouts. Everything before the image base is identical between them; PE32+ widens the image base and the four stack/heap sizes from 4 to 8 bytes.

    PeKind::bits

    source
    fn PeKind::bits(self : PeKind) -> Int

    32 or 64, the question every loader asks first.

    PeKind::equal

    source
    fn PeKind::equal(PeKind, PeKind) -> Bool

    PeKind::not_equal

    source
    fn PeKind::not_equal(x : PeKind, y : PeKind) -> Bool

    PeKind::to_repr

    source

    RelocationBlock

    source
    pub(all) struct RelocationBlock {
      page_rva : Int
      entries : Int
      absolute : Int
      high : Int
      low : Int
      highlow : Int
      dir64 : Int
      other : Int
    } derive(
    Debug    )

    RelocationSummary

    source
    pub(all) struct RelocationSummary {
      blocks : Array[RelocationBlock]
      total_entries : Int
      absolute : Int
      high : Int
      low : Int
      highlow : Int
      dir64 : Int
      other : Int
    } derive(
    Debug    )

    ResolvedDirectory

    source
    pub(all) struct ResolvedDirectory {
      index : Int
      name : String
      virtual_address : Int
      size : Int
      file_offset : Int?
    } derive(
    Debug    )

    One data directory together with its name and file mapping.

    ResolvedDirectory::to_repr

    source

    ResourceContent

    source
    pub(all) struct ResourceContent {
      kind : String
      summary : String
      strings : Array[ResourceString]
      group_icons : Array[GroupIconMember]
      width : Int?
      height : Int?
      bit_count : Int?
      image_bytes : Int?
      png : Bool
      text : String?
      version : VersionInfo?
    } derive(
    Debug    )

    ResourceEntry

    source
    pub(all) struct ResourceEntry {
      type_id : Int?
      type_name : String?
      name_id : Int?
      name_name : String?
      language : Int
      rva : Int
      size : Int
      code_page : Int
    } derive(
    Debug    )

    ResourceString

    source
    pub(all) struct ResourceString {
      id : Int
      text : String
    } derive(
    Debug    )

    Section

    source
    pub(all) struct Section {
      name : String
      virtual_size : Int
      virtual_address : Int
      raw_size : Int
      raw_pointer : Int
      characteristics : Int
    } derive(
    Debug    )

    Section::is_executable

    source
    fn Section::is_executable(self : Section) -> Bool

    IMAGE_SCN_MEM_EXECUTE.

    Section::is_readable

    source
    fn Section::is_readable(self : Section) -> Bool

    IMAGE_SCN_MEM_READ.

    Section::is_writable

    source
    fn Section::is_writable(self : Section) -> Bool

    IMAGE_SCN_MEM_WRITE.

    Section::permissions

    source
    fn Section::permissions(self : Section) -> String

    A short rwx rendering of the section permissions, the way objdump prints them. A section that is both writable and executable deserves a second look, which is why w and x are shown together rather than collapsed into a single "flags" number.

    Section::to_repr

    source

    Severity

    source
    pub(all) enum Severity {
      Info
      Warning
      High
    } derive(Eq, 
    Debug    )

    Severity::equal

    source
    fn Severity::equal(Severity, Severity) -> Bool

    Severity::not_equal

    source
    fn Severity::not_equal(x : Severity, y : Severity) -> Bool

    Severity::to_repr

    source

    TlsInfo

    source
    pub(all) struct TlsInfo {
      callbacks : Int
      zero_fill_size : Int
      raw_data_size : Int
    } derive(
    Debug    )

    TlsInfo::to_repr

    source

    VersionInfo

    source
    pub(all) struct VersionInfo {
      file_version : String
      product_version : String
      company_name : String?
      product_name : String?
      file_description : String?
      original_filename : String?
    } derive(
    Debug    )

    The fields a caller usually wants out of a VS_VERSIONINFO resource.

    VersionInfo::to_repr

    source

    byte_entropy

    source
    fn byte_entropy(bytes : Bytes) -> Double?

    debug_type_name

    source
    fn debug_type_name(kind : Int) -> String

    The documented name of a debug-directory type.

    directory_name

    source
    fn directory_name(index : Int) -> String

    entropy_range

    source
    fn entropy_range(bytes : Bytes, start : Int, end : Int) -> Double

    Entropy over bytes[start..end).

    has_flag

    source
    fn has_flag(flags : Int, mask : Int) -> Bool

    Machine-independent helper for the COFF characteristic bits.

    hex

    source
    fn hex(value : Int) -> String

    Lowercase hexadecimal without the 0x prefix. Offsets are never negative.

    hex64

    source
    fn hex64(value : Int64) -> String

    Trimmed lowercase hexadecimal for a 64-bit value, used for image bases.

    hex_upper

    source
    fn hex_upper(value : Int) -> String

    Uppercase hexadecimal, for machine names such as AMD64.

    machine_name

    source
    fn machine_name(machine : Int) -> String

    The processor the image was built for.

    metadata_table_name

    source
    fn metadata_table_name(id : Int) -> String

    relocation_type_name

    source
    fn relocation_type_name(kind : Int) -> String

    The documented name of a relocation type.

    resource_type_name

    source
    fn resource_type_name(id : Int) -> String

    The documented name of a well-known resource type id.

    subsystem_name

    source
    fn subsystem_name(subsystem : Int) -> String

    The subsystem the image targets.

    Source Files

    Powered by MoonBit

    Site sourceReport issuePackagesBuild queueSkillsStatistics

    © 2026 mooncakes.io