conversion.spec.yaml

# Control file for code generating pe_gen.go.
# This depends on www.velocidex.com/golang/binparsergen

# Generate like:
# binparsegen conversion.spec.yaml > pe_gen.go

Module: pe
Profile: PeProfile
Filename: pe_profile.json
GenerateDebugString: true
Structs:
  - _IMAGE_DOS_HEADER
  - _IMAGE_NT_HEADERS
  - _IMAGE_EXPORT_DIRECTORY
  - _IMAGE_IMPORT_DESCRIPTOR
  - _IMAGE_IMPORT_BY_NAME
  - _IMAGE_FILE_HEADER
  - _IMAGE_OPTIONAL_HEADER
  - _IMAGE_OPTIONAL_HEADER64
  - _IMAGE_DATA_DIRECTORY
  - _IMAGE_RESOURCE_DIRECTORY
  - _IMAGE_RESOURCE_DIRECTORY_ENTRY
  - _IMAGE_SECTION_HEADER
  - _IMAGE_THUNK_DATA32
  - _IMAGE_THUNK_DATA64
  # - _IMAGE_THUNK_DATA32_u1
  # - _IMAGE_THUNK_DATA64_u1
  - _GUID
  - CV_RSDS_HEADER
  - _IMAGE_DEBUG_DIRECTORY
  - _IMAGE_RESOURCE_DATA_ENTRY
  - PrefixedString
  - _GENERIC_DIRECTORY

  # The following are used to parse out the VersionInformation resource data.

  # https://docs.microsoft.com/en-au/windows/desktop/menurc/vs-versioninfo
  - VS_VERSIONINFO
  # https://docs.microsoft.com/en-us/windows/desktop/api/VerRsrc/ns-verrsrc-tagvs_fixedfileinfo
  - tagVS_FIXEDFILEINFO
  # https://docs.microsoft.com/en-au/windows/desktop/menurc/stringfileinfo
  - StringFileInfo
  # https://docs.microsoft.com/en-au/windows/desktop/menurc/stringtable
  - StringTable
  # https://docs.microsoft.com/en-au/windows/desktop/menurc/string-str
  - ResourceString

  - MESSAGE_RESOURCE_DATA
  - MESSAGE_RESOURCE_BLOCK
  - MESSAGE_RESOURCE_ENTRY
  - WIN_CERTIFICATE

# We only use specific fields in many structs. For efficiency, this
# code will only generate bindings for the fields we actually use.
FieldWhiteList:
  _IMAGE_DOS_HEADER: [E_magic, E_lfanew]
  _IMAGE_SECTION_HEADER: [PointerToRawData, VirtualAddress,
       Characteristics, SizeOfRawData, Name]
  _IMAGE_FILE_HEADER: [SizeOfOptionalHeader, TimeDateStamp, TimeDateStampRaw,
       NumberOfSections, Machine, Characteristics]
  _IMAGE_EXPORT_DIRECTORY: [Name, Base, NumberOfFunctions, NumberOfNames, AddressOfFunctions, AddressOfNames, AddressOfNameOrdinals, ordinals, names, funcs64, TimeDateStamp]
  _IMAGE_RESOURCE_DIRECTORY: [_Entries, NumberOfIdEntries, NumberOfNamedEntries, TimeDateStamp]
  _IMAGE_RESOURCE_DIRECTORY_ENTRY: [NameIsString, NameOffset, Type,
       DataIsDirectory, OffsetToDirectory, OffsetToData]
  _IMAGE_OPTIONAL_HEADER: [Magic, DataDirectory, ImageBase, CheckSum, SizeOfHeaders]
  _IMAGE_OPTIONAL_HEADER64: [Magic, DataDirectory, ImageBase, SizeOfHeaders]
  tagVS_FIXEDFILEINFO: []
  _IMAGE_IMPORT_DESCRIPTOR: [Name, Characteristics, OriginalFirstThunk]
  _IMAGE_IMPORT_BY_NAME: [Name]