Struct PeHeaders

pub struct PeHeaders {
    pub dos: DosHeader,
    pub coff: CoffHeader,
    pub optional: OptionalHeader64,
}

Complete PE headers structure

Fields

dos: DosHeader

coff: CoffHeader

optional: OptionalHeader64

Implementations

impl PeHeaders

pub unsafe fn parse(image_base: *const u8, image_size: usize) -> PeResult<Self>

Parse all PE headers from image in memory

Safety

Caller must ensure image_base points to valid PE file of given size

pub fn arch(&self) -> PeResult<PeArch>

Get the architecture of this PE file

pub fn relocation_delta(&self, actual_load_address: u64) -> i64

Calculate relocation delta between loaded address and ImageBase WARNING: ImageBase in memory is PATCHED by UEFI loader - this will always return 0!

pub unsafe fn reconstruct_original_image_base( &self, image_base: *const u8, image_size: usize, actual_load_address: u64, ) -> PeResult<(u64, u32, u32)>

Reconstruct original ImageBase using proper validation

Strategy:

1. Check for compile-time hint (LINKER_IMAGE_BASE constant)
2. Parse section table to know valid RVA ranges
3. Collect DIR64 relocations from memory
4. For each candidate ImageBase:
   • Calculate what the ORIGINAL pointer values would have been
   • Check if those original values = candidate + valid_section_RVA
   • Original value MUST point within a valid section’s RVA range
5. Return candidate with highest validation rate

This fixes the circular logic bug by validating against section boundaries, not against our own derived values!

Returns: (original_image_base, validated_relocs, total_relocs)

Safety

Caller must ensure image_base points to valid relocated PE image

pub unsafe fn unrelocate_image( &self, image_data: &mut [u8], actual_load_address: u64, ) -> PeResult<i64>

Create bootable PE image from relocated memory image

This is the main function for extracting the running bootloader and making it bootable again.

Steps:

1. Reconstruct original ImageBase (validated)
2. Calculate relocation delta
3. Reverse all DIR64 relocations (using embedded metadata if available)
4. Patch ImageBase field in header

Returns the delta used for unrelocating (for logging)

Safety

Caller must ensure image_data is valid relocated PE image

pub unsafe fn rva_to_file_layout(&self, rva_image: &[u8]) -> PeResult<Vec<u8>>

Convert memory-layout (RVA-based) PE image to file-layout (PointerToRawData-based)

UEFI loads PE files into memory with sections at their VirtualAddress (RVA) offsets. But PE files on disk have sections at PointerToRawData (file) offsets. This function converts from memory layout back to file layout.

Safety

Caller must ensure rva_image is valid PE image in memory layout