Tool
goblin
Rust crate for zero-copy, endian-aware parsing of ELF32/64, 32/64-bit Mach-O and multi-architecture fat containers, PE32/PE32+, COFF objects, Terse Executable (TE) images and Unix/BSD archives; Object::parse picks the format from its magic bytes. Parsed structures cover ELF headers, sections, symbols, dynamic entries, relocations and notes, Mach-O load commands, imports and exports, and PE imports, exports, relocations, TLS, resources, exception and unwind data, Authenticode certificates and the .NET CLR header. Feature flags can reduce it to std-free #[repr(C)] struct definitions for kernels and other no_std code.
- Targets
- Binary
- Category
- Binary analysis libraries
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Latest tag at review: 0.10.6 (also tagged v0.10.6) on the 2026-05-25 version-bump commit; the project publishes no GitHub releases. crates.io also lists 0.10.7, published 2026-05-28, which has no matching tag or changelog entry. The reviewed master commit (2026-08-30) still declares 0.10.6.
- Used as a Cargo dependency; it needs rustc 1.85.0+ (Rust 2024 edition) and depends on plain, scroll and an optional log. Default features enable every format with std; elf32/elf64, mach32/mach64, pe32/pe64, te and archive select backends, endian_fd parses by the binary's own byte order, and Mach-O, PE and TE parsing requires alloc and endian_fd.
- Input is a byte slice holding an executable, object file or archive the user supplies. goblin parses format metadata only and includes no disassembler, so code needs a separate instruction decoder. PE parse options can skip RVA resolution, attribute certificates, TLS data, resources or imports, and the changelog describes an ELF and PE permissive mode for packed, broken or malware samples.
- MIT license. The README quotes a report of 100 million fuzzing runs, and the repository holds cargo-fuzz and AFL harnesses.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · m4b/goblin · Revision 24a6260
- Cargo.toml GitHub · m4b/goblin · Revision 24a6260
- CHANGELOG.md GitHub · m4b/goblin · Revision 24a6260
- src/lib.rs#L286-L323 GitHub · m4b/goblin · Revision 24a6260
- src/pe/options.rs GitHub · m4b/goblin · Revision 24a6260
- src/pe GitHub · m4b/goblin · Revision 24a6260
- src/mach GitHub · m4b/goblin · Revision 24a6260
- src/elf GitHub · m4b/goblin · Revision 24a6260
- LICENSE GitHub · m4b/goblin · Revision 24a6260
- https://github.com/m4b/goblin/tree/0.10.6
- https://docs.rs/crate/goblin/0.10.7