pe

type Config struct {
	Enabled        bool     `json:"pe.enabled" yaml:"pe.enabled"`
	ReadResources  bool     `json:"pe.read-resources" yaml:"pe.read-resources"`
	ReadSymbols    bool     `json:"pe.read-symbols" yaml:"pe.read-symbols"`
	ReadSections   bool     `json:"pe.read-sections" yaml:"pe.read-sections"`
	ExcludedImages []string `json:"pe.excluded-images" yaml:"pe.excluded-images"`
}

type PE struct {
	// NumberOfSections designates the total number of sections found withing the binary.
	NumberOfSections uint16 `json:"nsections"`
	// NumberOfSymbols represents the total number of symbols.
	NumberOfSymbols uint32 `json:"nsymbols"`
	// ImageBase designates the base address of the process' image.
	ImageBase string `json:"image_base"`
	// Entrypoint is the address of the entry point function.
	EntryPoint string `json:"entry_point"`
	// LinkTime represents the time that the image was created by the linker.
	LinkTime time.Time `json:"link_time"`
	// Sections contains all distinct sections and their metadata.
	Sections []Sec `json:"sections"`
	// Symbols contains the list of imported symbols.
	Symbols []string `json:"symbols"`
	// Imports contains the imported libraries.
	Imports []string `json:"imports"`
	// VersionResources holds the version resources
	VersionResources map[string]string `json:"resources"`
}

type Reader interface {
	// Read is the main method that reads the PE metadata for the specified image file.
	Read(filename string) (*PE, error)
	// FindSectionByRVA gets the section containing the given address.
	FindSectionByRVA(rva uint32) (*pe.Section, error)
	// FindOffsetByRVA returns the file offset that maps to the given RVA.
	FindOffsetByRVA(rva uint32) (int64, error)
}

type Sec struct {
	Name    string
	Size    uint32
	Entropy float64
	Md5     string
}