{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/m4b/goblin/blob/24a62600a4a75c145c08ec9dd82964acf1bb833b/Cargo.toml",
    "https://github.com/m4b/goblin/blob/24a62600a4a75c145c08ec9dd82964acf1bb833b/CHANGELOG.md",
    "https://github.com/m4b/goblin/blob/24a62600a4a75c145c08ec9dd82964acf1bb833b/src/lib.rs#L286-L323",
    "https://github.com/m4b/goblin/blob/24a62600a4a75c145c08ec9dd82964acf1bb833b/src/pe/options.rs",
    "https://github.com/m4b/goblin/tree/24a62600a4a75c145c08ec9dd82964acf1bb833b/src/pe",
    "https://github.com/m4b/goblin/tree/24a62600a4a75c145c08ec9dd82964acf1bb833b/src/mach",
    "https://github.com/m4b/goblin/tree/24a62600a4a75c145c08ec9dd82964acf1bb833b/src/elf",
    "https://github.com/m4b/goblin/blob/24a62600a4a75c145c08ec9dd82964acf1bb833b/LICENSE",
    "https://github.com/m4b/goblin/tree/0.10.6",
    "https://docs.rs/crate/goblin/0.10.7"
  ],
  "category": "binary-libraries",
  "description_en": "Rust crate for zero-copy, endian-aware parsing of ELF32/64, 32/64-bit Mach-O and multi-architecture fat containers, PE32/PE32+, COFF objects, Terse Executable (TE) images and Unix/BSD archives; Object::parse picks the format from its magic bytes. Parsed structures cover ELF headers, sections, symbols, dynamic entries, relocations and notes, Mach-O load commands, imports and exports, and PE imports, exports, relocations, TLS, resources, exception and unwind data, Authenticode certificates and the .NET CLR header. Feature flags can reduce it to std-free #[repr(C)] struct definitions for kernels and other no_std code.",
  "description_zh": "以零拷贝、感知字节序的方式解析二进制格式的 Rust crate，支持 ELF32/64、32/64 位 Mach-O 及多架构 fat 容器、PE32/PE32+、COFF 目标文件、Terse Executable（TE）镜像以及 Unix/BSD 归档；Object::parse 根据魔数自动识别格式。解析结果涵盖 ELF 的文件头、节区、符号、动态段条目、重定位和 note，Mach-O 的加载命令及导入导出，以及 PE 的导入导出、重定位、TLS、资源、异常与展开信息、Authenticode 证书和 .NET CLR 头。借助特性开关，它还可精简为不依赖 std 的 #[repr(C)] 结构体定义，供内核等 no_std 代码使用。",
  "entry_url": "https://awesomerea.org/resources/goblin/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/goblin/",
  "evidence_url": "https://github.com/m4b/goblin/blob/24a62600a4a75c145c08ec9dd82964acf1bb833b/README.md",
  "group": "tools",
  "id": "goblin",
  "json_url": "https://awesomerea.org/resources/goblin/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/goblin/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/goblin/index.md",
  "name": "goblin",
  "name_zh": "goblin 二进制格式解析库",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest tag at review: 0.10.6 (also tagged v0.10.6) on the 2026-05-25 version-bump commit; the project publishes no GitHub releases. crates.io also lists 0.10.7, published 2026-05-28, which has no matching tag or changelog entry. The reviewed master commit (2026-08-30) still declares 0.10.6.",
    "Used as a Cargo dependency; it needs rustc 1.85.0+ (Rust 2024 edition) and depends on plain, scroll and an optional log. Default features enable every format with std; elf32/elf64, mach32/mach64, pe32/pe64, te and archive select backends, endian_fd parses by the binary's own byte order, and Mach-O, PE and TE parsing requires alloc and endian_fd.",
    "Input is a byte slice holding an executable, object file or archive the user supplies. goblin parses format metadata only and includes no disassembler, so code needs a separate instruction decoder. PE parse options can skip RVA resolution, attribute certificates, TLS data, resources or imports, and the changelog describes an ELF and PE permissive mode for packed, broken or malware samples.",
    "MIT license. The README quotes a report of 100 million fuzzing runs, and the repository holds cargo-fuzz and AFL harnesses."
  ],
  "requirements_zh": [
    "审阅时最新标签为 0.10.6（另有同名的 v0.10.6 标签），位于 2026-05-25 的版本号更新提交；项目不发布 GitHub Release。crates.io 另列有 0.10.7，发布于 2026-05-28，但仓库中没有对应的标签或更新日志条目。所审阅的 master 提交（2026-08-30）仍声明版本 0.10.6。",
    "作为 Cargo 依赖使用，需要 rustc 1.85.0+（Rust 2024 edition），依赖 plain、scroll 和可选的 log。默认特性启用全部格式及 std；elf32/elf64、mach32/mach64、pe32/pe64、te 和 archive 用于选择后端，endian_fd 按二进制自身的字节序解析，而 Mach-O、PE 和 TE 解析需要 alloc 与 endian_fd。",
    "输入为用户自行提供的可执行文件、目标文件或归档的字节切片。goblin 只解析格式元数据，不包含反汇编器，代码部分需另用指令解码器处理。PE 解析选项可跳过 RVA 解析、属性证书、TLS 数据、资源或导入表；更新日志还提到 ELF 与 PE 的宽松解析模式，用于处理加壳、损坏或恶意软件样本。",
    "MIT 许可证。README 引用了一份 1 亿次模糊测试的报告，仓库中也有 cargo-fuzz 与 AFL 测试框架。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/m4b/goblin",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}