Goblin crate and PE OrginalFilename

Using the Goblin crate to parse binary files, PE files specifically. I'm trying to find how to access the OrginalFilename field you can see in Windows properties of a binary file. But can't figure out how to access this field.

I found this documentation: VERSIONINFO resource - Win32 apps | Microsoft Learn. Still can't figure it out though.

Appreciate any help in understanding how to do this in Rust.

thanks

I don't know much about the PE format, but based on what I found it doesn't look like goblin has any builtin support for this. It goesas far as getting the resource table (DataDirectories in goblin::pe::data_directories - Rust) but doesn't have anything to then parse this resource table to get the VERSIONINFO resource.

1 Like

Thanks, I thought the same from my research but was afraid I didn't understand what I was looking at well enough.

This topic was automatically closed 90 days after the last reply. We invite you to open a new topic if you have further questions or comments.