# goblin

> Rust crate for zero-copy, endian-aware parsing of ELF32/64, 32/64-bit Mach-O and multi-architecture fat containers, PE32/PE32+, COFF objects, Terse Executable (TE) images and Unix/BSD archives; Object::parse picks the format from its magic bytes. Parsed structures cover ELF headers, sections, symbols, dynamic entries, relocations and notes, Mach-O load commands, imports and exports, and PE imports, exports, relocations, TLS, resources, exception and unwind data, Authenticode certificates and the .NET CLR header. Feature flags can reduce it to std-free #[repr(C)] struct definitions for kernels and other no_std code.

- Type: Tool
- Targets: Binary
- Category: Binary analysis libraries
- Relationship: Foundation tool
- Sources reviewed: 2026-10-19
- Added to the catalog: 2026-10-19
- Original resource: <https://github.com/m4b/goblin>
- Primary source: <https://github.com/m4b/goblin/blob/24a62600a4a75c145c08ec9dd82964acf1bb833b/README.md>
- Catalog page: <https://awesomerea.org/resources/goblin/>
- Record JSON: <https://awesomerea.org/resources/goblin/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/goblin/index.md)

## Requirements & limits

- Latest tag at review: 0.10.6 (also tagged v0.10.6) on the 2026-05-25 version-bump commit; the project publishes no GitHub releases. crates.io also lists 0.10.7, published 2026-05-28, which has no matching tag or changelog entry. The reviewed master commit (2026-08-30) still declares 0.10.6.
- Used as a Cargo dependency; it needs rustc 1.85.0+ (Rust 2024 edition) and depends on plain, scroll and an optional log. Default features enable every format with std; elf32/elf64, mach32/mach64, pe32/pe64, te and archive select backends, endian_fd parses by the binary's own byte order, and Mach-O, PE and TE parsing requires alloc and endian_fd.
- Input is a byte slice holding an executable, object file or archive the user supplies. goblin parses format metadata only and includes no disassembler, so code needs a separate instruction decoder. PE parse options can skip RVA resolution, attribute certificates, TLS data, resources or imports, and the changelog describes an ELF and PE permissive mode for packed, broken or malware samples.
- MIT license. The README quotes a report of 100 million fuzzing runs, and the repository holds cargo-fuzz and AFL harnesses.

## Primary sources

1. <https://github.com/m4b/goblin/blob/24a62600a4a75c145c08ec9dd82964acf1bb833b/README.md>
2. <https://github.com/m4b/goblin/blob/24a62600a4a75c145c08ec9dd82964acf1bb833b/Cargo.toml>
3. <https://github.com/m4b/goblin/blob/24a62600a4a75c145c08ec9dd82964acf1bb833b/CHANGELOG.md>
4. <https://github.com/m4b/goblin/blob/24a62600a4a75c145c08ec9dd82964acf1bb833b/src/lib.rs#L286-L323>
5. <https://github.com/m4b/goblin/blob/24a62600a4a75c145c08ec9dd82964acf1bb833b/src/pe/options.rs>
6. <https://github.com/m4b/goblin/tree/24a62600a4a75c145c08ec9dd82964acf1bb833b/src/pe>
7. <https://github.com/m4b/goblin/tree/24a62600a4a75c145c08ec9dd82964acf1bb833b/src/mach>
8. <https://github.com/m4b/goblin/tree/24a62600a4a75c145c08ec9dd82964acf1bb833b/src/elf>
9. <https://github.com/m4b/goblin/blob/24a62600a4a75c145c08ec9dd82964acf1bb833b/LICENSE>
10. <https://github.com/m4b/goblin/tree/0.10.6>
11. <https://docs.rs/crate/goblin/0.10.7>

## More in Native binaries

- [FLOSS (FLARE Obfuscated String Solver)](https://awesomerea.org/resources/flare-floss/index.md) · Tool
- [Zydis](https://awesomerea.org/resources/zydis/index.md) · Tool
- [QBDI](https://awesomerea.org/resources/qbdi/index.md) · Tool
- [binsider](https://awesomerea.org/resources/binsider/index.md) · Tool
- [iced](https://awesomerea.org/resources/iced/index.md) · Tool
- [hrtng](https://awesomerea.org/resources/hrtng/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.