PeOpenFromMemoryCopy

Documentation

API Reference

Description

Parse a PE image from an in-memory byte range – R-value / copy form (mirrors VecInsertR).

Parser allocates its own buffer through alloc and MemCopys the caller’s bytes in. Caller’s pointer is never retained.

Success

Returns true; out owns an independent copy of data.

Failure

Returns false; out zeroed; caller’s data untouched.

Usage example (Cross-references)

Usage examples (Cross-references)

In Pe.c:544:

    bool pe_open_from_memory_copy(Pe *out, const u8 *data, size data_size, Allocator *alloc) {
        if (!out || !data || !alloc) {
            LOG_FATAL("PeOpenFromMemoryCopy: NULL argument (contract violation)");
        }
        Buf copy = BufInit(alloc);

In Pe.c:548:

        Buf copy = BufInit(alloc);
        if (!BufReserve(&copy, (u64)data_size)) {
            LOG_ERROR("PeOpenFromMemoryCopy: allocation failed ({} bytes)", (u64)data_size);
            return false;
        }

In Pe.c:487:

    
        Pe   pe;
        bool ok = PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), base);
        if (!ok) {
            DefaultAllocatorDeinit(&alloc);

In Pe.c:513:

        build_pe_blob();
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), base)) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:541:

    
        Pe   pe;
        bool ok = !PeOpenFromMemoryCopy(&pe, garbage, sizeof(garbage), base);
    
        DefaultAllocatorDeinit(&alloc);

In Pe.c:555:

        build_pe_blob();
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), base)) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:579:

        build_pe_blob();
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), base)) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:603:

        DefaultAllocator alloc = DefaultAllocatorInit();
        Pe               pe;
        bool             opened = PeOpenFromMemoryCopy(&pe, bytes, len, ALLOCATOR_OF(&alloc));
        if (opened)
            PeDeinit(&pe);

In Pe.c:659:

        build_pe_blob_m1();
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:680:

        wr_u64(&blob[OPT_HDR_OFF + 24], 0x7766554433221100ull);
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:696:

        build_pe32_blob();
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:716:

        wr_u32(&blob[OPT_HDR_OFF + 28], 0x00410000u);
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:742:

        // confirm the normal (well-within-file) blob is accepted.
        Pe   pe;
        bool ok = PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc));
        if (ok)
            PeDeinit(&pe);

In Pe.c:764:

        wr_u16(&bad[FILE_HDR_OFF + 16], 1900);
        Pe   pe;
        bool opened = PeOpenFromMemoryCopy(&pe, bad, sizeof(bad), ALLOCATOR_OF(&alloc));
        if (opened)
            PeDeinit(&pe);

In Pe.c:792:

        u64  want_len = (u64)OPT_HDR_OFF + OPT_HDR_SIZE_PEPP; // exact fit to EOF
        Pe   pe;
        bool ok = PeOpenFromMemoryCopy(&pe, exact, want_len, ALLOCATOR_OF(&alloc));
        if (ok) {
            ok = ok && pe.size_of_image == PE_SIZE_OF_IMAGE;

In Pe.c:813:

        wr_u32(&blob[OPT_HDR_OFF + 108], 7); // NumberOfRvaAndSizes = 7
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:839:

        // absent kills that mutation.
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:860:

        build_pe_blob_m1();
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:881:

        blob[CV_REC_RAW_OFF] = 'N';
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:898:

        wr_u32(&blob[DEBUG_RAW_OFF + 12], 9); // Type != CODEVIEW
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:928:

            cv[24 + i] = (u8)('A' + i); // no NUL anywhere in the region
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:956:

        cv[28] = '\0'; // terminator is the last in-region byte
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:981:

        cv[24] = '\0';                         // empty path, NUL-terminated
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:997:

        wr_u32(&blob[DEBUG_RAW_OFF + 16], 24); // one below minimum
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:1021:

        wr_u32(&blob[DEBUG_RAW_OFF + 16], (u32)(BLOB_SIZE - CV_REC_RAW_OFF + 4));
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:1045:

        put_cv_entry_sz(0x300, 0x200, 0x300);
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:1065:

        put_cv_entry_sz(0x300, 0x500, 0x300);
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:1089:

        wr_u32(&blob[OPT_HDR_OFF + 112 + 6 * 8 + 4], BLOB_SIZE);
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:1119:

        put_cv_entry(DIR_RAW, 0x500); // CodeView in entry 0, record at 0x500
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:1142:

        put_cv_entry(DIR_RAW, 0x500); // record at 0x500 (in-bounds)
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:1170:

        cv[28] = '\0'; // NUL sits exactly AT region_end (one past the region)
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:1197:

        put_cv_entry(0x300 + 28, 0x500); // entry1 (just past declared count)
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:1238:

        MemCopy(&cv2[24], kPdbPath, plen + 1);
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:1274:

    
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:1310:

    
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, total, ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:1336:

    
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:1368:

    
        Pe   pe;
        bool opened = PeOpenFromMemoryCopy(&pe, blob, total, ALLOCATOR_OF(&alloc));
        if (opened)
            PeDeinit(&pe);

In Pe.c:1402:

    
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:1436:

    
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:1475:

    
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, total, ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:1507:

    
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:1541:

    
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc))) {
            DefaultAllocatorDeinit(&alloc);
            return false;

In Pe.c:1582:

    
        Pe pe;
        if (!PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), base)) {
            DebugAllocatorDeinit(&alloc);
            return false;

In Pe.c:1619:

    
        Pe   pe;
        bool opened = PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc));
        // Real code: rejected AND `out` zeroed by PeDeinit on the fail path.
        bool ok = !opened && BufData(&pe.data) == NULL && BufLength(&pe.data) == 0 && VecLen(&pe.sections) == 0;

In Pe.c:1735:

    
        Pe   pe;
        bool ok = PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc));
        if (ok)
            PeDeinit(&pe);

In Pe.c:1756:

    
        Pe   pe;
        bool opened = PeOpenFromMemoryCopy(&pe, blob, sizeof(blob), ALLOCATOR_OF(&alloc));
        if (opened)
            PeDeinit(&pe);

Last updated on July 1, 2026

PeOpenFromMemory PeRvaToOffset