#moonpe

#Why this exists

#Relationship to xmyd0915/moonar

#What is parsed

#Install

moon add Rz-coder8848/moonpe

import { "Rz-coder8848/moonpe" @pe }

#Library usage

let pe = @pe.Pe::parse(bytes)

pe.bits()                 // 64
pe.machine()              // "AMD64"
pe.subsystem()            // "windows-console"
pe.optional.entry_point   // 0x2c5d0
pe.optional.image_base    // 0x180000000

for library in pe.imports() {
  println(library.name)
}
for slot in pe.iat() {
  println(slot.library + " " + slot.slot_rva.to_string())
}
for library in pe.delay_imports() {     // the dependencies a naive reader misses
  println("delay: " + library.name)
}
for entry in pe.debug_entries() {
  println(entry.kind_name)
}
for resource in pe.resources() {
  println(resource.language.to_string())
}
match pe.version_info() {
  Some(info) => println(info.file_version)
  None => ()
}

#CLI

moon run cmd/moonpe --target js -- info C:/Windows/System32/kernel32.dll

file:      C:/Windows/System32/kernel32.dll
format:    PE64
machine:   AMD64
subsystem: windows-console
image:     base 0x180000000
           size 0xcb000
entry:     0x2c5d0
sections:  8
imports:   104 libraries
delay:     3 libraries
exports:   1697 symbols
pdb:       kernel32.pdb
version:   Microsoft® Windows® Operating System 10.0.26100.9444

$ moon run cmd/moonpe --target js -- resources C:/Windows/System32/kernel32.dll
TYPE              NAME          LANG  RVA/SIZE
MUI               1            0x409  0xc9458/200
VERSION           1            0x409  0xc90b0/932

$ moon run cmd/moonpe --target js -- relocations C:/Windows/System32/kernel32.dll
        PAGE  ENTRIES  DIR64  HIGHLOW  OTHER
     0x88000      218    217        0      0
     0x89000      222    222        0      0
...

The check deliberately treats those imports as a *capability*, not a verdict:
`kernel32.dll` imports most of the list and still comes out `ok`. It only
escalates when the imports appear together with writable-executable code or a
high-entropy section.
## Design notes

**Bounds-checked reads carry the offset.** `Reader::need` turns every overrun
into `OutOfBounds { offset, needed, available }`. The same applies to a bad
`e_lfanew`, a bogus optional-header magic, or a section table that declares more
entries than the file can hold.

**RVA mapping is not `rva + image_base`.** A section's `VirtualSize` and
`RawSize` differ; the bytes between them exist in memory (zero-filled by the
loader) but not in the file. `rva_to_offset` returns `None` for that tail rather
than reading whatever follows the section on disk.

**Ordinals and delay-load are preserved.** Real DLLs import and export symbols
by ordinal, and many ship a large delay-load table: `shell32.dll` has 79 static
imports and **138 delay-loaded** ones. A reader that only walks slot 1 reports
less than half of that file's dependencies while still claiming success.

**IAT values are exposed as raw bits, not guessed addresses.** An unbound
static IAT may still contain the lookup-table RVA or ordinal bit pattern, while
a bound or delay-loaded image may contain a full virtual address. `Pe::iat`
therefore returns the slot RVA, raw pointer-sized value, matching symbol and a
`delayed` flag instead of assuming every slot is already resolved.

**32-bit fields are read through `Int64` and range-checked.** The same source
must behave identically when compiled for a 32-bit `Int` target and a 64-bit
one; the reader rejects address-like values above 2 GiB instead of letting them
wrap differently on each platform. Pure constants such as the `VS_FIXEDFILEINFO`
signature go through a separate raw read, because they are not addresses.

## Testing

Thirty-five tests, all offline: hand-built PE32 and PE32+ images with every
optional-header field, imports and IAT slots, delay imports (both descriptor
forms), exports, debug records, relocations, a resource tree and `VERSIONINFO`;
plus malformed inputs and a test that truncates a valid image at every possible
length and requires a clean error every time.

```sh
moon test --target wasm-gc

#Completion criteria for v1.0

1. all PE32 and PE32+ optional-header fields readable, with cross-width tests;
2. all 16 data directories named, addressed, mapped and given a semantic level;
3. imports, delay imports, exports and the IAT readable;
4. sections, relocations, debug/PDB, resources, VERSIONINFO, LoadConfig/SafeSEH and certificates readable;
5. arbitrary truncation and malformed input raise PeError, never panic;
6. at least three real system binaries (PE32 and PE32+) validated;
7. this README documents the boundary, including summary-only and specification-reserved slots.

#References

#License