Goblin crate and PE OrginalFilename

1

Using the Goblin crate to parse binary files, PE files specifically. I'm trying to find how to access the OrginalFilename field you can see in Windows properties of a binary file. But can't figure out how to access this field.

I found this documentation: VERSIONINFO resource - Win32 apps | Microsoft Learn. Still can't figure it out though.

Appreciate any help in understanding how to do this in Rust.

thanks

2

I don't know much about the PE format, but based on what I found it doesn't look like goblin has any builtin support for this. It goesas far as getting the resource table (DataDirectories in goblin::pe::data_directories - Rust) but doesn't have anything to then parse this resource table to get the VERSIONINFO resource.

1 Like
3

Thanks, I thought the same from my research but was afraid I didn't understand what I was looking at well enough.

4

This topic was automatically closed 90 days after the last reply. We invite you to open a new topic if you have further questions or comments.