Download Latest Version v1.5.0 source code.zip (18.5 MB)
Email in envelope

Get an email when there's a new version of Portable Executable Parser

Home / v1.4.0
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2023-03-17 3.3 kB
v1.4.0 source code.tar.gz 2023-03-17 13.6 MB
v1.4.0 source code.zip 2023-03-17 13.6 MB
Totals: 3 Items   27.2 MB 0

Added

  • Permit more granular control over which data directories are parsed by rabbitstack #72.
  • Support parsing the different retpoline types: Imported Address, Indirect Branch and Switchable retpoline #70.
  • Unit tests for load config directory #70.
  • Unit tests for TLS directory #69.
  • Unit tests for debug directory #68.
  • Unit tests for resource directory and add functions to prettify resource (sub)languages #66.
  • Annotate PE structures with JSON tags during JSON encoding #64, #65 and #67.
  • Improve PE dumper to print imports and unit test parsing imports data directory#63.
  • Improve PE dumper to print section headers #62.
  • Improve PE dumper to print PE headers #61.
  • Add SerialNumber, SignatureAlgorithm and PubKeyAlgorithm to the CertInfo #60.
  • Option to disable certificate validation #59.
  • Improve PE dumper to print exceptions #57.
  • Unit tests for debug directory #49.

Fixed

  • Bug while iterating over VolatileInfoRangeTable entries #70.
  • Bug while iterating (additional padding and loop condition) over DVRT relocation block entries #70.
  • Bug while appending (twice) Control Flow Guard IAT entries #70.
  • Bug while parsing POGO debug entry types #68.
  • Authentihash() for instances w/o fd thanks to flanfly #47.

Changed

  • Some fields has been renamed for consistency:
  • RichHeader.XorKey -> RichHeader.XORKey.
  • Any Rva substring -> RVA and any Iat substring -> IAT.
  • And many more.
  • Some fields used internally in imports parsing were changed from a slice of pointers to a simple slice.
  • Certificate.Content changed from *pkcs7.PKCS7 to pkcs7.PKCS7.
  • Section.Entropy changed from float64 to float64* to distinguish between the case when the section entropy is equal to zero and the case when the entropy is equal to nil - meaning that it was never calculated.
  • Remove cobra dependency from cmd/pedumper #56.

New Contributors

Full Changelog: https://github.com/saferwall/pe/compare/v1.3.0...v1.4.0

Source: README.md, updated 2023-03-17