Method parserOpts

pkg/filter/accessor_windows.go:1033–1071

parserOpts traverses all fields/segments declared in the expression and dynamically determines what aspects of the PE need to be parsed.

()

// parserOpts traverses all fields/segments declared in the expression and
// dynamically determines what aspects of the PE need to be parsed.
func (pa *peAccessor) parserOpts() []pe.Option {
	var opts []pe.Option
	var peSections bool

	for _, f := range pa.fields {
		if f.Name.IsPeSectionsPseudo() {
			peSections = true
		}
		if f.Name.IsPeSection() || f.Name.IsPeModified() {
			opts = append(opts, pe.WithSections())
		}
		if f.Name.IsPeSymbol() {
			opts = append(opts, pe.WithSymbols())
		}
		if f.Name.IsPeVersionResource() || f.Name.IsPeVersionResources() {
			opts = append(opts, pe.WithVersionResources())
		}
		if f.Name.IsPeImphash() {
			opts = append(opts, pe.WithImphash())
		}
		if f.Name.IsPeDotnet() || f.Name.IsPeModified() {
			opts = append(opts, pe.WithCLR())
		}
		if f.Name.IsPeAnomalies() {
			opts = append(opts, pe.WithSections(), pe.WithSymbols())
		}
		if f.Name.IsPeSignature() {
			opts = append(opts, pe.WithSecurity())
		}
	}

	for _, s := range pa.segments {
		if peSections && s.IsEntropy() {
			opts = append(opts, pe.WithSections(), pe.WithSectionEntropy())
		}
	}

	return opts
}

// ErrPeNilCertificate indicates the PE certificate is not available
var ErrPeNilCertificate = errors.New("pe certificate is nil")