Portable Executable Parser Files

Added

• Permit more granular control over which data directories are parsed by rabbitstack #72.
• Support parsing the different retpoline types: Imported Address, Indirect Branch and Switchable retpoline #70.
• Unit tests for load config directory #70.
• Unit tests for TLS directory #69.
• Unit tests for debug directory #68.
• Unit tests for resource directory and add functions to prettify resource (sub)languages #66.
• Annotate PE structures with JSON tags during JSON encoding #64, #65 and #67.
• Improve PE dumper to print imports and unit test parsing imports data directory#63.
• Improve PE dumper to print section headers #62.
• Improve PE dumper to print PE headers #61.
• Add SerialNumber, SignatureAlgorithm and PubKeyAlgorithm to the CertInfo #60.
• Option to disable certificate validation #59.
• Improve PE dumper to print exceptions #57.
• Unit tests for debug directory #49.

Fixed

• Bug while iterating over VolatileInfoRangeTable entries #70.
• Bug while iterating (additional padding and loop condition) over DVRT relocation block entries #70.
• Bug while appending (twice) Control Flow Guard IAT entries #70.
• Bug while parsing POGO debug entry types #68.
• Authentihash() for instances w/o fd thanks to flanfly #47.

Changed

• Some fields has been renamed for consistency:
• RichHeader.XorKey -> RichHeader.XORKey.
• Any Rva substring -> RVA and any Iat substring -> IAT.
• And many more.
• Some fields used internally in imports parsing were changed from a slice of pointers to a simple slice.
• Certificate.Content changed from *pkcs7.PKCS7 to pkcs7.PKCS7.
• Section.Entropy changed from float64 to float64* to distinguish between the case when the section entropy is equal to zero and the case when the entropy is equal to nil - meaning that it was never calculated.
• Remove cobra dependency from cmd/pedumper #56.

New Contributors

• @flanfly made their first contribution in https://github.com/saferwall/pe/pull/47
• @smallzhong made their first contribution in https://github.com/saferwall/pe/pull/53
• @rabbitstack made their first contribution in https://github.com/saferwall/pe/pull/72

Full Changelog: https://github.com/saferwall/pe/compare/v1.3.0...v1.4.0