Implement PE Section Classification and Import/Export Table Parsing

Summary

Enhance the PE (Portable Executable) parser to intelligently classify sections based on string likelihood and implement import/export table parsing to extract meaningful symbols and metadata from Windows executables.

Context

PE binaries structure data differently than ELF or Mach-O formats. Windows executables typically store:

Read-only strings in .rdata (read-only data) sections - high value for string extraction
Initialized data in .data sections - lower priority, often contains runtime state
Import tables listing DLL dependencies and function names - valuable for understanding program behavior
Export tables defining public API surfaces - critical for DLL analysis

Currently, StringyMcStringFace lacks PE-specific intelligence to prioritize these sections appropriately, which means:

We treat all sections equally, missing optimization opportunities
We don't extract import/export symbols that provide high-signal strings
UTF-16LE strings common in PE binaries aren't prioritized correctly
Section scoring doesn't account for PE-specific characteristics

Proposed Solution

1. Section Classification Enhancement

Implement section weight assignment based on PE characteristics:

// Proposed section scoring for PE
fn classify_pe_section(section: &PESection) -> SectionWeight {
    match section.name.as_str() {
        ".rdata" | ".text" => SectionWeight::High,      // Read-only, likely strings
        ".rsrc" => SectionWeight::Medium,                // Resources, may contain strings
        ".data" => SectionWeight::Low,                   // Writable, runtime state
        ".bss" | ".reloc" => SectionWeight::VeryLow,    // Unlikely to contain strings
        _ => SectionWeight::Medium                         // Default for unknown sections
    }
}

2. Import/Export Table Parsing

Extract symbol names from PE import and export directories:

Parse import directory to extract DLL names and imported function names
Parse export directory to extract exported function names (for DLL analysis)
Tag extracted symbols with appropriate metadata (source: ImportTable, source: ExportTable)
Assign high scores to these strings as they represent high-confidence identifiers

3. Integration Points

Update PEParser in crates/stringy-analyzer/src/parsers/pe.rs
Extend SectionInfo to include PE-specific weight heuristics
Add import/export extraction to the symbol extraction pipeline
Ensure UTF-16LE detection prioritizes .rdata sections

Technical Requirements

Requirement 1.2: Section classification by string likelihood
Requirement 1.4: Import/export table parsing

Dependencies

goblin PE parser capabilities
Existing SectionWeight enum may need extension
StringSource enum needs ImportTable and ExportTable variants

Performance Considerations

Import/export parsing is typically fast (small tables)
Section classification is O(n) where n = number of sections (usually < 10)
No significant performance impact expected

Acceptance Criteria

Test Cases

Unit Tests

Section weight assignment for known PE section names
Section weight for unknown/custom section names
Empty import/export table handling

Integration Tests

Parse a PE binary with imports (e.g., kernel32.dll functions)
Parse a DLL with exports
Verify UTF-16LE strings from .rdata score higher than .data

Snapshot Tests (insta)

Import table extraction output
Export table extraction output
Section classification results

Related Work

Builds on existing goblin PE parser foundation
Complements ELF/Mach-O section classification (issues Implement Intelligent ELF Section Classification for Targeted String Extraction #1, Enhance ELF Dynamic Symbol Extraction with Library Mapping and Comprehensive Symbol Classification #2)
Feeds into ranking system (Requirement 2.1)
Enables better YARA rule generation for PE binaries

References

Task-ID: stringy-analyzer/pe-section-classification
Requirements: 1.2, 1.4
Milestone: v0.1
@traycerai branch:3-implement-pe-section-classification-and-importexport-table-parsing

@coderabbitai Enhance this issue body with additional context and a proposed solution. Improve the issue title and assign the proper labels and other metadata.

@unclesp1d3r

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Fetch the current issue details
gh issue view 3 --json title,body,labels,assignees,milestone,state,author

# Also get the repository context to understand the project better
cat README.md 2>/dev/null || echo "No README found"

Length of output: 7747

🏁 Script executed:

#!/bin/bash

# Update the issue with enhanced title and body
gh issue edit 3 \
  --title "Implement PE Section Classification and Import/Export Table Parsing" \
  --body "## Summary

Enhance the PE (Portable Executable) parser to intelligently classify sections based on string likelihood and implement import/export table parsing to extract meaningful symbols and metadata from Windows executables.

## Context

PE binaries structure data differently than ELF or Mach-O formats. Windows executables typically store:
- **Read-only strings** in \`.rdata\` (read-only data) sections - high value for string extraction
- **Initialized data** in \`.data\` sections - lower priority, often contains runtime state
- **Import tables** listing DLL dependencies and function names - valuable for understanding program behavior
- **Export tables** defining public API surfaces - critical for DLL analysis

Currently, StringyMcStringFace lacks PE-specific intelligence to prioritize these sections appropriately, which means:
- We treat all sections equally, missing optimization opportunities
- We don't extract import/export symbols that provide high-signal strings
- UTF-16LE strings common in PE binaries aren't prioritized correctly
- Section scoring doesn't account for PE-specific characteristics

## Proposed Solution

### 1. Section Classification Enhancement

Implement section weight assignment based on PE characteristics:

\`\`\`rust
// Proposed section scoring for PE
fn classify_pe_section(section: &PESection) -> SectionWeight {
    match section.name.as_str() {
        \".rdata\" | \".text\" => SectionWeight::High,      // Read-only, likely strings
        \".rsrc\" => SectionWeight::Medium,                // Resources, may contain strings
        \".data\" => SectionWeight::Low,                   // Writable, runtime state
        \".bss\" | \".reloc\" => SectionWeight::VeryLow,    // Unlikely to contain strings
        _ => SectionWeight::Medium                         // Default for unknown sections
    }
}
\`\`\`

### 2. Import/Export Table Parsing

Extract symbol names from PE import and export directories:

- Parse import directory to extract DLL names and imported function names
- Parse export directory to extract exported function names (for DLL analysis)
- Tag extracted symbols with appropriate metadata (\`source: ImportTable\`, \`source: ExportTable\`)
- Assign high scores to these strings as they represent high-confidence identifiers

### 3. Integration Points

- Update \`PEParser\` in \`crates/stringy-analyzer/src/parsers/pe.rs\`
- Extend \`SectionInfo\` to include PE-specific weight heuristics
- Add import/export extraction to the symbol extraction pipeline
- Ensure UTF-16LE detection prioritizes \`.rdata\` sections

## Technical Requirements

**Requirement 1.2**: Section classification by string likelihood  
**Requirement 1.4**: Import/export table parsing

### Dependencies
- \`goblin\` PE parser capabilities
- Existing \`SectionWeight\` enum may need extension
- \`StringSource\` enum needs \`ImportTable\` and \`ExportTable\` variants

### Performance Considerations
- Import/export parsing is typically fast (small tables)
- Section classification is O(n) where n = number of sections (usually < 10)
- No significant performance impact expected

## Acceptance Criteria

- [ ] Implement section weight classification for PE-specific sections (\`.rdata\`, \`.data\`, \`.rsrc\`, \`.text\`, \`.bss\`, \`.reloc\`)
- [ ] Parse PE import directory and extract DLL names and imported function names
- [ ] Parse PE export directory and extract exported function names
- [ ] Add \`ImportTable\` and \`ExportTable\` variants to \`StringSource\` enum
- [ ] Assign appropriate scores to import/export strings (high priority)
- [ ] Add unit tests for section classification logic
- [ ] Add integration tests using sample PE binaries (e.g., a simple DLL with exports)
- [ ] \`cargo clippy -- -D warnings\` passes without errors
- [ ] Add benchmarks with criterion for PE parsing performance
- [ ] Use insta for snapshot testing of import/export extraction results
- [ ] Update justfile recipes for PE-specific test cases
- [ ] Ensure CI pipeline passes all checks
- [ ] Document PE-specific behavior in module-level docs

## Test Cases

### Unit Tests
- Section weight assignment for known PE section names
- Section weight for unknown/custom section names
- Empty import/export table handling

### Integration Tests
- Parse a PE binary with imports (e.g., \`kernel32.dll\` functions)
- Parse a DLL with exports
- Verify UTF-16LE strings from \`.rdata\` score higher than \`.data\`

### Snapshot Tests (insta)
- Import table extraction output
- Export table extraction output
- Section classification results

## Related Work

- Builds on existing \`goblin\` PE parser foundation
- Complements ELF/Mach-O section classification (issues #1, #2)
- Feeds into ranking system (Requirement 2.1)
- Enables better YARA rule generation for PE binaries

## References

- [PE Format Specification (Microsoft)](https://learn.microsoft.com/en-us/windows/win32/debug/pe-format)
- [goblin PE documentation](https://docs.rs/goblin/latest/goblin/pe/index.html)

---

**Task-ID**: stringy-analyzer/pe-section-classification  
**Requirements**: 1.2, 1.4  
**Milestone**: v0.1"

echo "✅ Issue #3 enhanced successfully"

Length of output: 93

@unclesp1d3r I've successfully enhanced issue #3 with comprehensive improvements:

What Was Updated

✅ Title Enhanced

Before: "PE Section Classification"
After: "Implement PE Section Classification and Import/Export Table Parsing"

✅ Body Enhanced With

Additional Context:

Explained PE binary structure and why section classification matters
Detailed the current gaps in StringyMcStringFace's PE handling
Clarified the importance of .rdata, .data, import/export tables

Proposed Solution:

Section classification logic with code example
Import/export table parsing approach
Integration points in the codebase
Technical dependencies and performance considerations

Enhanced Acceptance Criteria:

Expanded from 6 generic criteria to 13 specific, actionable checkboxes
Added concrete implementation targets
Included documentation requirements

New Sections Added:

Test Cases: Unit, integration, and snapshot testing strategies
Related Work: Cross-references to other issues and requirements
References: Links to Microsoft PE format docs and goblin documentation

✅ Metadata

The existing labels and metadata were already well-configured:

Labels: area:analyzer, type:enhancement, status:backlog, lang:rust, needs:tests
Assignee: unclesp1d3r
Milestone: v0.1

The enhanced issue now provides clear technical direction for implementation and serves as comprehensive documentation for anyone working on PE parser enhancements. You can view the updated issue at: #3

@coderabbitai Enhance this issue body with additional context and a proposed solution. Improve the issue title and assign the proper labels and other metadata.

@unclesp1d3r

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Fetch the current state of issue #3 to see if enhancements were already applied
gh issue view 3 --json title,body,labels,assignees,milestone | jq -r '.title, .body' | head -100

Length of output: 4538

@unclesp1d3r Issue #3 has already been fully enhanced!

The issue currently has:

✅ Enhanced Title: "Implement PE Section Classification and Import/Export Table Parsing"

✅ Comprehensive Body including:

Summary and context explaining PE binary structure
Detailed proposed solution with code examples
Technical requirements and dependencies
Performance considerations
13 specific acceptance criteria checkboxes
Test cases (unit, integration, snapshot)
Related work cross-references
References to Microsoft PE docs and goblin documentation

✅ Metadata properly configured:

Labels: area:analyzer, type:enhancement, status:backlog, lang:rust, needs:tests
Assignee: unclesp1d3r
Milestone: v0.1

The issue is ready for development work. Is there something specific you'd like me to modify or improve further?

@traycerai generate

@unclesp1d3r

Hi @unclesp1d3r, I have updated the Implementation Plan to reflect the recent changes in the ticket.

New Plan

Observations

The PE section classification and import/export parsing functionality is already fully implemented in src/container/pe.rs. The core features include:

Section classification with proper SectionType assignment (.rdata, .data, .rsrc, .text, .bss, .reloc)

Section weight calculation based on string likelihood (10.0 for .rdata, 9.0 for .rsrc, etc.)

Import table parsing via extract_imports method extracting DLL names and function names

Export table parsing via extract_exports method extracting exported function names

Unit tests for section classification and weight calculation

Integration tests for PE parsing

However, the issue requests additional polish and testing infrastructure:

PE-specific benchmarks (currently only ELF benchmarks exist)

Snapshot tests using insta for import/export extraction (ELF has snapshot tests, PE doesn't)

Enhanced module-level documentation

Project tracking updates in tasks.md

The StringSource enum already has ImportName and ExportName variants (not ImportTable/ExportTable as suggested in the issue, but functionally equivalent). The test fixture test_binary_pe.exe exists and is compiled from test_binary.c which includes imports (printf, malloc, free) and exports (exported_function, helper_function).

Approach

Follow the established patterns from ELF implementation to add PE-specific testing and documentation:

Benchmarks: Create benches/pe.rs mirroring the structure of benches/elf.rs with benchmarks for full parse, import extraction, and export extraction

Snapshot tests: Add snapshot test to tests/integration_pe.rs following the pattern from tests/integration_elf.rs

Documentation: Enhance module-level docs in src/container/pe.rs and update docs/src/binary-formats.md with PE-specific implementation details

Project tracking: Update .kiro/specs/stringy-binary-analyzer/tasks.md to mark task 4 as complete

Cargo configuration: Add PE benchmark entry to Cargo.toml (if not auto-discovered)

Reasoning

I explored the repository structure, examined the existing PE parser implementation in src/container/pe.rs, reviewed the types and data structures in src/types.rs, analyzed the ELF parser and its comprehensive testing approach including benchmarks and snapshot tests, checked the test fixtures and their source code, reviewed the documentation structure, and compared patterns across ELF, PE, and Mach-O parsers to understand the established conventions.

Proposed File Changes

📄 benches/pe.rs ^(NEW) 🔗

References

📄 benches/elf.rs

📄 src/container/pe.rs ^(MODIFY)

Create a new benchmark file for PE parsing performance testing, following the exact pattern established in benches/elf.rs.

Structure:

Import criterion framework components (Criterion, criterion_group, criterion_main)

Import black_box for preventing compiler optimizations

Import ContainerParser and PeParser from stringy::container

Benchmark functions to implement:

bench_pe_full_parse: Benchmark complete PE parsing including all sections, imports, and exports

Read the PE fixture from tests/fixtures/test_binary_pe.exe

Verify it's a PE file using PeParser::detect

Benchmark the full parse operation using parser.parse()

Use black_box to prevent optimization

bench_pe_parse_with_imports: Benchmark PE parsing with focus on import extraction

Parse the PE binary

Access imports to ensure extraction is performed

Count imports and filter by library presence

Measure performance of import enumeration

bench_pe_parse_with_exports: Benchmark PE parsing with focus on export extraction

Parse the PE binary

Access exports to ensure extraction is performed

Count exports

Measure performance of export enumeration

Criterion configuration:

Use criterion_group! macro to group all three benchmarks

Use criterion_main! macro to set up the benchmark harness

Notes:

Follow the exact error handling pattern from ELF benchmarks (expect with descriptive messages)

Include early return if PE detection fails (for cross-platform compatibility)

Add println! statements for debugging output similar to ELF benchmarks
📄 Cargo.toml ^(MODIFY) 🔗
Add a benchmark entry for PE parsing to ensure Cargo recognizes and runs the PE benchmarks.

Location: After the existing [[bench]] entry for ELF (around line 40)

Add:
[[bench]]
name = "pe"
harness = false
This follows the same pattern as the existing ELF benchmark entry and ensures the PE benchmarks are discovered and can be run with cargo bench or just bench.
📄 tests/integration_pe.rs ^(MODIFY) 🔗

References

📄 tests/integration_elf.rs

Add a snapshot test for PE import/export extraction following the pattern established in tests/integration_elf.rs.

Add new test function: test_pe_symbol_extraction_snapshot

Implementation details:

Import insta::assert_snapshot at the top of the file

Read the PE fixture from tests/fixtures/test_binary_pe.exe

Verify it's a PE file using PeParser::detect

Parse the binary using PeParser

Create formatted output string with two sections:

IMPORTS section:

Header: "=== IMPORTS ==="

Total count: "Total: {count}"

For each import (limit to first 10):

"Import {i}: {name}"

" Library: {library}" (if present)

" Address: 0x{address:x}" (if present)

If more than 10: "... and {remaining} more imports"

EXPORTS section:

Header: "=== EXPORTS ==="

Total count: "Total: {count}"

For each export (limit to first 10):

"Export {i}: {name}"

" Address: 0x{address:x}"

" Ordinal: {ordinal}" (if present)

If more than 10: "... and {remaining} more exports"

Use assert_snapshot!("pe_symbol_extraction", output) to create/verify snapshot

Notes:

Follow the exact formatting pattern from test_elf_symbol_extraction_snapshot in tests/integration_elf.rs

PE executables typically don't export symbols (only DLLs do), so the exports section may be empty or minimal

The snapshot will be stored in tests/snapshots/integration_pe__pe_symbol_extraction.snap

Run cargo insta review after first run to accept the baseline snapshot

📄 src/container/pe.rs ^(MODIFY) 🔗

References

📄 src/container/macho.rs

Enhance module-level documentation to describe PE-specific parsing behavior, section classification strategy, and import/export extraction.

Add comprehensive module documentation at the top of the file (before the use statements):

Module overview:

Brief description of PE format and its use on Windows

Purpose of this parser in the stringy ecosystem

Section Classification Strategy:

Document the section weight system (10.0 for .rdata, 9.0 for .rsrc, etc.)

Explain why certain sections are prioritized for string extraction

List all recognized section types and their classifications:

.rdata / .rodata: StringData (weight 10.0) - primary string section

.rsrc: Resources (weight 9.0) - version info, string tables

.data (read-only): ReadOnlyData (weight 7.0)

.data (writable): WritableData (weight 5.0)

.text: Code (weight 1.0)

.bss, .reloc: Other/VeryLow priority

Import/Export Table Parsing:

Explain that imports are extracted from the PE import directory

Document that each import includes: function name, DLL name, and RVA

Explain that exports are extracted from the PE export directory

Note that PE executables typically don't export symbols (only DLLs do)

Document the ordinal handling (using index as ordinal since goblin doesn't expose it directly)

UTF-16LE Considerations:

Note that Windows APIs favor wide strings (UTF-16LE)

Mention that .rdata sections should be prioritized for UTF-16LE extraction

Reference the encoding detection in the future extraction pipeline

Example usage:

Show basic usage pattern with PeParser::detect and parse

Demonstrate accessing sections, imports, and exports from ContainerInfo

Format: Use Rust doc comments (///) with proper markdown formatting, code blocks, and sections similar to the comprehensive documentation in src/container/macho.rs

📄 docs/src/binary-formats.md ^(MODIFY) 🔗

Expand the PE section in the binary formats documentation to include implementation details matching the level of detail provided for ELF.

Location: In the "## PE (Portable Executable)" section (around line 147)

Enhancements to add:

After "### PE-Specific Features" section, add "### Enhanced Import/Export Extraction":

Document that the PE parser provides comprehensive import/export extraction

Explain import extraction:

Extracts from PE import directory using goblin's pe.imports

Each import includes: function name, DLL name, and RVA

Example: printf from msvcrt.dll

Explain export extraction:

Extracts from PE export directory using goblin's pe.exports

Each export includes: function name, address, and ordinal

Note: PE executables typically don't export symbols (only DLLs)

Ordinal is derived from index since goblin doesn't expose it directly

Update "### Implementation Details" section:

Add extract_imports method documentation:

Iterates through pe.imports

Creates ImportInfo with name, library (DLL), and address (RVA)

Add extract_exports method documentation:

Iterates through pe.exports

Creates ExportInfo with name, address, and ordinal

Handles unnamed exports with "ordinal_{i}" naming

Add calculate_section_weight method documentation:

Shows the weight values for each section type

Explains the rationale (string likelihood)

Add "### Section Weight Calculation" subsection:

Create a table showing section types and their weights:
| Section Type | Weight | Rationale |
| StringData (.rdata) | 10.0 | Primary string storage |
| Resources (.rsrc) | 9.0 | Version info, string tables |
| ReadOnlyData | 7.0 | May contain constants |
| WritableData (.data) | 5.0 | Runtime state, lower priority |
| Code (.text) | 1.0 | Unlikely to contain strings |
| Debug | 2.0 | Internal metadata |
| Other | 1.0 | Minimal priority |

Add "### Limitations" subsection:

Note that resource extraction (VERSIONINFO, STRINGTABLE) is planned but not yet implemented

Mention that the current implementation focuses on import/export tables and section classification

Reference future enhancements for PE resource parsing

Format: Follow the markdown structure and detail level of the ELF section, including code blocks, tables, and clear subsection headers
📄 .kiro/specs/stringy-binary-analyzer/tasks.md ^(MODIFY) 🔗
Update the task tracking to reflect that PE section classification and import/export parsing are complete.

Location: Task 4 section (around line 36)

Changes:

Change the task 4 checkbox from [ ] to [x] to mark it as complete

Update the task description to note that implementation is complete

Add a note about the completed features:

Section classification for .rdata, .data, .rsrc, .text, .bss, .reloc

Section weight assignment based on string likelihood

Import table parsing extracting DLL names and function names

Export table parsing extracting exported function names

Unit tests for section classification and weight calculation

Integration tests for PE parsing

Benchmarks for PE parsing performance

Snapshot tests for import/export extraction

Keep subtasks 4.1 and 4.2 (PE resource extraction) as unchecked since those are future work

Add a completion note with date and reference to issue Implement PE Section Classification and Import/Export Table Parsing #3

Format:
- [x] 4. Implement PE section classification

 - Enhance PE parser to classify sections (.rdata, .data) by string likelihood ✅
 - Add section weight assignment for PE-specific sections ✅
 - Implement basic PE import/export table parsing ✅
 - Add benchmarks and snapshot tests ✅
 - _Requirements: 1.2, 1.4_
 - _Completed: [Date] - Issue #3_

 - [ ] 4.1 Add PE resource extraction foundation
 ...
Diagram
sequenceDiagram
 participant Dev as Developer
 participant Bench as Benchmark Suite
 participant Test as Test Suite
 participant Parser as PeParser
 participant Docs as Documentation

 Note over Dev,Docs: PE Testing & Documentation Enhancement

 Dev->>Bench: Create benches/pe.rs
 Bench->>Parser: bench_pe_full_parse()
 Bench->>Parser: bench_pe_parse_with_imports()
 Bench->>Parser: bench_pe_parse_with_exports()
 Note over Bench: Measures parsing performance

 Dev->>Test: Add snapshot test to integration_pe.rs
 Test->>Parser: parse(test_binary_pe.exe)
 Parser-->>Test: ContainerInfo with imports/exports
 Test->>Test: Format output string
 Test->>Test: assert_snapshot!("pe_symbol_extraction")
 Note over Test: Creates baseline snapshot

 Dev->>Parser: Enhance module docs
 Note over Parser: Document section weights, import/export extraction, UTF-16LE considerations

 Dev->>Docs: Update binary-formats.md
 Note over Docs: Add PE implementation details, section weight table, limitations

 Dev->>Docs: Update tasks.md
 Note over Docs: Mark task 4 complete

 Note over Dev,Docs: All changes follow established patterns from ELF implementation
Loading
Import In IDE
🤖 Prompt for AI Agents
I have created the following plan after thorough exploration and analysis of the codebase. Follow the below plan verbatim. Trust the files and references. Do not re-verify what's written in the plan. Explore only when absolutely necessary. First implement all the proposed file changes and then I'll review all the changes together at the end.

### Observations

The PE section classification and import/export parsing functionality is **already fully implemented** in `src/container/pe.rs`. The core features include:

- Section classification with proper `SectionType` assignment (`.rdata`, `.data`, `.rsrc`, `.text`, `.bss`, `.reloc`)
- Section weight calculation based on string likelihood (10.0 for `.rdata`, 9.0 for `.rsrc`, etc.)
- Import table parsing via `extract_imports` method extracting DLL names and function names
- Export table parsing via `extract_exports` method extracting exported function names
- Unit tests for section classification and weight calculation
- Integration tests for PE parsing

However, the issue requests additional **polish and testing infrastructure**:
1. PE-specific benchmarks (currently only ELF benchmarks exist)
2. Snapshot tests using `insta` for import/export extraction (ELF has snapshot tests, PE doesn't)
3. Enhanced module-level documentation
4. Project tracking updates in `tasks.md`

The `StringSource` enum already has `ImportName` and `ExportName` variants (not `ImportTable`/`ExportTable` as suggested in the issue, but functionally equivalent). The test fixture `test_binary_pe.exe` exists and is compiled from `test_binary.c` which includes imports (`printf`, `malloc`, `free`) and exports (`exported_function`, `helper_function`).

### Approach

Follow the established patterns from ELF implementation to add PE-specific testing and documentation:

1. **Benchmarks**: Create `benches/pe.rs` mirroring the structure of `benches/elf.rs` with benchmarks for full parse, import extraction, and export extraction
2. **Snapshot tests**: Add snapshot test to `tests/integration_pe.rs` following the pattern from `tests/integration_elf.rs` 
3. **Documentation**: Enhance module-level docs in `src/container/pe.rs` and update `docs/src/binary-formats.md` with PE-specific implementation details
4. **Project tracking**: Update `.kiro/specs/stringy-binary-analyzer/tasks.md` to mark task 4 as complete
5. **Cargo configuration**: Add PE benchmark entry to `Cargo.toml` (if not auto-discovered)

### Reasoning

I explored the repository structure, examined the existing PE parser implementation in `src/container/pe.rs`, reviewed the types and data structures in `src/types.rs`, analyzed the ELF parser and its comprehensive testing approach including benchmarks and snapshot tests, checked the test fixtures and their source code, reviewed the documentation structure, and compared patterns across ELF, PE, and Mach-O parsers to understand the established conventions.

## Mermaid Diagram

sequenceDiagram
 participant Dev as Developer
 participant Bench as Benchmark Suite
 participant Test as Test Suite
 participant Parser as PeParser
 participant Docs as Documentation

 Note over Dev,Docs: PE Testing & Documentation Enhancement

 Dev->>Bench: Create benches/pe.rs
 Bench->>Parser: bench_pe_full_parse()
 Bench->>Parser: bench_pe_parse_with_imports()
 Bench->>Parser: bench_pe_parse_with_exports()
 Note over Bench: Measures parsing performance

 Dev->>Test: Add snapshot test to integration_pe.rs
 Test->>Parser: parse(test_binary_pe.exe)
 Parser-->>Test: ContainerInfo with imports/exports
 Test->>Test: Format output string
 Test->>Test: assert_snapshot!("pe_symbol_extraction")
 Note over Test: Creates baseline snapshot

 Dev->>Parser: Enhance module docs
 Note over Parser: Document section weights, import/export extraction, UTF-16LE considerations

 Dev->>Docs: Update binary-formats.md
 Note over Docs: Add PE implementation details, section weight table, limitations

 Dev->>Docs: Update tasks.md
 Note over Docs: Mark task 4 complete

 Note over Dev,Docs: All changes follow established patterns from ELF implementation

## Proposed File Changes

### benches/pe.rs(NEW)

References: 

- benches/elf.rs
- src/container/pe.rs(MODIFY)

Create a new benchmark file for PE parsing performance testing, following the exact pattern established in `benches/elf.rs`.

**Structure:**
- Import criterion framework components (Criterion, criterion_group, criterion_main)
- Import black_box for preventing compiler optimizations
- Import ContainerParser and PeParser from stringy::container

**Benchmark functions to implement:**

1. `bench_pe_full_parse`: Benchmark complete PE parsing including all sections, imports, and exports
 - Read the PE fixture from `tests/fixtures/test_binary_pe.exe`
 - Verify it's a PE file using PeParser::detect
 - Benchmark the full parse operation using parser.parse()
 - Use black_box to prevent optimization

2. `bench_pe_parse_with_imports`: Benchmark PE parsing with focus on import extraction
 - Parse the PE binary
 - Access imports to ensure extraction is performed
 - Count imports and filter by library presence
 - Measure performance of import enumeration

3. `bench_pe_parse_with_exports`: Benchmark PE parsing with focus on export extraction
 - Parse the PE binary
 - Access exports to ensure extraction is performed
 - Count exports
 - Measure performance of export enumeration

**Criterion configuration:**
- Use criterion_group! macro to group all three benchmarks
- Use criterion_main! macro to set up the benchmark harness

**Notes:**
- Follow the exact error handling pattern from ELF benchmarks (expect with descriptive messages)
- Include early return if PE detection fails (for cross-platform compatibility)
- Add println! statements for debugging output similar to ELF benchmarks

### Cargo.toml(MODIFY)

Add a benchmark entry for PE parsing to ensure Cargo recognizes and runs the PE benchmarks.

**Location:** After the existing `[[bench]]` entry for ELF (around line 40)

**Add:**
```toml
[[bench]]
name = "pe"
harness = false
```

This follows the same pattern as the existing ELF benchmark entry and ensures the PE benchmarks are discovered and can be run with `cargo bench` or `just bench`.

### tests/integration_pe.rs(MODIFY)

References: 

- tests/integration_elf.rs

Add a snapshot test for PE import/export extraction following the pattern established in `tests/integration_elf.rs`.

**Add new test function:** `test_pe_symbol_extraction_snapshot`

**Implementation details:**
1. Import insta::assert_snapshot at the top of the file
2. Read the PE fixture from `tests/fixtures/test_binary_pe.exe`
3. Verify it's a PE file using PeParser::detect
4. Parse the binary using PeParser
5. Create formatted output string with two sections:

 **IMPORTS section:**
 - Header: "=== IMPORTS ==="
 - Total count: "Total: {count}"
 - For each import (limit to first 10):
 - "Import {i}: {name}"
 - " Library: {library}" (if present)
 - " Address: 0x{address:x}" (if present)
 - If more than 10: "... and {remaining} more imports"

 **EXPORTS section:**
 - Header: "=== EXPORTS ==="
 - Total count: "Total: {count}"
 - For each export (limit to first 10):
 - "Export {i}: {name}"
 - " Address: 0x{address:x}"
 - " Ordinal: {ordinal}" (if present)
 - If more than 10: "... and {remaining} more exports"

6. Use assert_snapshot!("pe_symbol_extraction", output) to create/verify snapshot

**Notes:**
- Follow the exact formatting pattern from `test_elf_symbol_extraction_snapshot` in `tests/integration_elf.rs`
- PE executables typically don't export symbols (only DLLs do), so the exports section may be empty or minimal
- The snapshot will be stored in `tests/snapshots/integration_pe__pe_symbol_extraction.snap`
- Run `cargo insta review` after first run to accept the baseline snapshot

### src/container/pe.rs(MODIFY)

References: 

- src/container/macho.rs

Enhance module-level documentation to describe PE-specific parsing behavior, section classification strategy, and import/export extraction.

**Add comprehensive module documentation at the top of the file (before the use statements):**

1. **Module overview:**
 - Brief description of PE format and its use on Windows
 - Purpose of this parser in the stringy ecosystem

2. **Section Classification Strategy:**
 - Document the section weight system (10.0 for .rdata, 9.0 for .rsrc, etc.)
 - Explain why certain sections are prioritized for string extraction
 - List all recognized section types and their classifications:
 - `.rdata` / `.rodata`: StringData (weight 10.0) - primary string section
 - `.rsrc`: Resources (weight 9.0) - version info, string tables
 - `.data` (read-only): ReadOnlyData (weight 7.0)
 - `.data` (writable): WritableData (weight 5.0)
 - `.text`: Code (weight 1.0)
 - `.bss`, `.reloc`: Other/VeryLow priority

3. **Import/Export Table Parsing:**
 - Explain that imports are extracted from the PE import directory
 - Document that each import includes: function name, DLL name, and RVA
 - Explain that exports are extracted from the PE export directory
 - Note that PE executables typically don't export symbols (only DLLs do)
 - Document the ordinal handling (using index as ordinal since goblin doesn't expose it directly)

4. **UTF-16LE Considerations:**
 - Note that Windows APIs favor wide strings (UTF-16LE)
 - Mention that `.rdata` sections should be prioritized for UTF-16LE extraction
 - Reference the encoding detection in the future extraction pipeline

5. **Example usage:**
 - Show basic usage pattern with PeParser::detect and parse
 - Demonstrate accessing sections, imports, and exports from ContainerInfo

**Format:** Use Rust doc comments (///) with proper markdown formatting, code blocks, and sections similar to the comprehensive documentation in `src/container/macho.rs`

### docs/src/binary-formats.md(MODIFY)

Expand the PE section in the binary formats documentation to include implementation details matching the level of detail provided for ELF.

**Location:** In the "## PE (Portable Executable)" section (around line 147)

**Enhancements to add:**

1. **After "### PE-Specific Features" section, add "### Enhanced Import/Export Extraction":**
 - Document that the PE parser provides comprehensive import/export extraction
 - Explain import extraction:
 - Extracts from PE import directory using goblin's pe.imports
 - Each import includes: function name, DLL name, and RVA
 - Example: `printf` from `msvcrt.dll`
 - Explain export extraction:
 - Extracts from PE export directory using goblin's pe.exports
 - Each export includes: function name, address, and ordinal
 - Note: PE executables typically don't export symbols (only DLLs)
 - Ordinal is derived from index since goblin doesn't expose it directly

2. **Update "### Implementation Details" section:**
 - Add extract_imports method documentation:
 - Iterates through pe.imports
 - Creates ImportInfo with name, library (DLL), and address (RVA)
 - Add extract_exports method documentation:
 - Iterates through pe.exports
 - Creates ExportInfo with name, address, and ordinal
 - Handles unnamed exports with "ordinal_{i}" naming
 - Add calculate_section_weight method documentation:
 - Shows the weight values for each section type
 - Explains the rationale (string likelihood)

3. **Add "### Section Weight Calculation" subsection:**
 - Create a table showing section types and their weights:
 | Section Type | Weight | Rationale |
 | StringData (.rdata) | 10.0 | Primary string storage |
 | Resources (.rsrc) | 9.0 | Version info, string tables |
 | ReadOnlyData | 7.0 | May contain constants |
 | WritableData (.data) | 5.0 | Runtime state, lower priority |
 | Code (.text) | 1.0 | Unlikely to contain strings |
 | Debug | 2.0 | Internal metadata |
 | Other | 1.0 | Minimal priority |

4. **Add "### Limitations" subsection:**
 - Note that resource extraction (VERSIONINFO, STRINGTABLE) is planned but not yet implemented
 - Mention that the current implementation focuses on import/export tables and section classification
 - Reference future enhancements for PE resource parsing

**Format:** Follow the markdown structure and detail level of the ELF section, including code blocks, tables, and clear subsection headers

### .kiro/specs/stringy-binary-analyzer/tasks.md(MODIFY)

Update the task tracking to reflect that PE section classification and import/export parsing are complete.

**Location:** Task 4 section (around line 36)

**Changes:**
1. Change the task 4 checkbox from `[ ]` to `[x]` to mark it as complete
2. Update the task description to note that implementation is complete
3. Add a note about the completed features:
 - Section classification for .rdata, .data, .rsrc, .text, .bss, .reloc
 - Section weight assignment based on string likelihood
 - Import table parsing extracting DLL names and function names
 - Export table parsing extracting exported function names
 - Unit tests for section classification and weight calculation
 - Integration tests for PE parsing
 - Benchmarks for PE parsing performance
 - Snapshot tests for import/export extraction

4. Keep subtasks 4.1 and 4.2 (PE resource extraction) as unchecked since those are future work

5. Add a completion note with date and reference to issue #3

**Format:**
```markdown
- [x] 4. Implement PE section classification

 - Enhance PE parser to classify sections (.rdata, .data) by string likelihood ✅
 - Add section weight assignment for PE-specific sections ✅
 - Implement basic PE import/export table parsing ✅
 - Add benchmarks and snapshot tests ✅
 - _Requirements: 1.2, 1.4_
 - _Completed: [Date] - Issue #3_

 - [ ] 4.1 Add PE resource extraction foundation
 ...
```
Developer Humor

🔍 The PE parser was already there,\n> Extracting imports with care,\n> Now with benchmarks so bright,\n> And snapshots just right,\n> Documentation beyond compare! 📚✨

Execution Information

Branch: main
Commit: 37cfc7c

Plan

Observations

The PE parser in src/container/pe.rs already implements comprehensive section classification (.rdata as StringData weight 10.0, .rsrc Resources 9.0, etc.), import extraction from pe.imports (with DLL, RVA, ordinal handling), and export extraction from pe.exports (with base ordinal calculation, forwarded exports). Unit tests cover classification and weights. Integration tests in tests/integration_pe.rs verify parsing, sections, and include an insta snapshot for symbols. StringSource uses ImportName/ExportName (needs rename to ImportTable/ExportTable). Missing: PE benchmarks, fixture build recipe, Cargo.toml bench config, task update, expanded docs in binary-formats.md.

Approach

Complete PE implementation per acceptance criteria:\n\n1. Rename ImportName/ExportName to ImportTable/ExportTable in types.rs for exact match.\n2. Add benches/pe.rs with criterion benchmarks for parsing, imports, exports mirroring ELF.\n3. Add [[bench]] for PE in Cargo.toml.\n4. Enhance justfile with build-fixtures-pe recipe using zig/mingw for test_binary_pe.exe from test_binary.c.\n5. Expand PE docs in docs/src/binary-formats.md with weights table, import/export details.\n6. Update .kiro/specs/.../tasks.md marking task 4 complete.\n7. Ensure high scores for import/export strings via weights (already integrated).\n\nMaintain existing tests/docs; run clippy/CI post-changes.

Reasoning

I examined the repository structure to locate key files, read src/container/pe.rs to assess existing PE parser features including classification, weights, and symbol extraction, reviewed src/types.rs for StringSource variants, inspected tests/integration_pe.rs for current tests and snapshots, listed benches directory to confirm missing PE benchmarks, and checked for documentation and task files to identify completion gaps.

Proposed File Changes

📄 src/types.rs ^(MODIFY) 🔗

References

📄 src/container/pe.rs

Rename ImportName and ExportName variants in StringSource enum to ImportTable and ExportTable respectively for precise terminology matching acceptance criteria.

Location: Around line 66-68 in the StringSource enum definition.

Changes:

Change ImportName, to ImportTable,

Change ExportName, to ExportTable,

Update the doc comment above to reflect: /// String from import table and /// String from export table

No other changes needed; this aligns with import/export table parsing focus. Preserve serialization and all other variants.

📄 benches/pe.rs ^(MODIFY) 🔗

References

📄 benches/elf.rs

📄 tests/fixtures/test_binary_pe.exe

Create new PE benchmark file mirroring benches/elf.rs structure.

Imports:

use criterion::{black_box, criterion_group, criterion_main, Criterion};

use std::fs;

use stringy::container::{ContainerParser, PeParser};

Benchmark Functions:

fn bench_pe_full_parse(c: &mut Criterion): Load tests/fixtures/test_binary_pe.exe, detect PE, time parse(), black_box input/output.

fn bench_pe_imports(c: &mut Criterion): Parse, extract/count imports, black_box results.

fn bench_pe_exports(c: &mut Criterion): Parse, extract/count exports, black_box results.

Group and Main:

criterion_group! { name = benches; value = (bench_pe_full_parse, bench_pe_imports, bench_pe_exports); }

criterion_main!(benches);

Include debug prints like ELF; handle fixture errors.

📄 Cargo.toml ^(MODIFY) 🔗

References

📄 benches/elf.rs

Add PE benchmark configuration.

Location: After existing [[bench]] for elf (around line 40).

Add:
[[bench]]
name = "pe"
harness = false
Enables cargo bench --bench pe; criterion already in dev-deps.

📄 justfile ^(MODIFY) 🔗

References

📄 tests/fixtures/test_binary.c

Add recipe for building PE fixture.

New Recipe: build-fixtures-pe after existing build sections.

For Unix:
zig cc tests/fixtures/test_binary.c -o tests/fixtures/test_binary_pe.exe -target x86_64-windows-gnu

For Windows:
x86_64-w64-mingw32-gcc tests/fixtures/test_binary.c -o tests/fixtures/test_binary_pe.exe

Update default build-fixtures to include build-fixtures-pe. Ensure test_binary.c has imports/exports for testing.

📄 docs/src/binary-formats.md ^(MODIFY) 🔗

References

📄 src/container/pe.rs

Expand PE section with implementation details.

Enhance: Add subsections for section classification (name/characteristics logic), weight table (|Type|Sections|Weight|Rationale|), import extraction (DLL/function/RVA), export extraction (name/address/ordinal/forwarders).

Add: Limitations (UTF-16 future, resources partial), examples using PeParser::parse.

Match ELF/Mach-O doc style with markdown tables/code blocks.

📄 .kiro/specs/stringy-binary-analyzer/tasks.md ^(MODIFY) 🔗

Update task 4 status.

Changes: Mark [x] for task 4, update description to note completion of classification, weights, imports/exports. List implemented features: sections (.rdata 10.0 etc.), parsing, tests, benchmarks, snapshots, docs. Keep subtasks open if any.

Import In IDE

🤖 Prompt for AI Agents

I have created the following plan after thorough exploration and analysis of the codebase. Follow the below plan verbatim. Trust the files and references. Do not re-verify what's written in the plan. Explore only when absolutely necessary. First implement all the proposed file changes and then I'll review all the changes together at the end.

### Observations

The PE parser in `src/container/pe.rs` already implements comprehensive section classification (`.rdata` as StringData weight 10.0, `.rsrc` Resources 9.0, etc.), import extraction from `pe.imports` (with DLL, RVA, ordinal handling), and export extraction from `pe.exports` (with base ordinal calculation, forwarded exports). Unit tests cover classification and weights. Integration tests in `tests/integration_pe.rs` verify parsing, sections, and include an insta snapshot for symbols. `StringSource` uses `ImportName`/`ExportName` (needs rename to `ImportTable`/`ExportTable`). Missing: PE benchmarks, fixture build recipe, `Cargo.toml` bench config, task update, expanded docs in `binary-formats.md`.

### Approach

Complete PE implementation per acceptance criteria:\n\n1. Rename `ImportName`/`ExportName` to `ImportTable`/`ExportTable` in `types.rs` for exact match.\n2. Add `benches/pe.rs` with criterion benchmarks for parsing, imports, exports mirroring ELF.\n3. Add `[[bench]]` for PE in `Cargo.toml`.\n4. Enhance `justfile` with `build-fixtures-pe` recipe using zig/mingw for `test_binary_pe.exe` from `test_binary.c`.\n5. Expand PE docs in `docs/src/binary-formats.md` with weights table, import/export details.\n6. Update `.kiro/specs/.../tasks.md` marking task 4 complete.\n7. Ensure high scores for import/export strings via weights (already integrated).\n\nMaintain existing tests/docs; run clippy/CI post-changes.

### Reasoning

I examined the repository structure to locate key files, read `src/container/pe.rs` to assess existing PE parser features including classification, weights, and symbol extraction, reviewed `src/types.rs` for `StringSource` variants, inspected `tests/integration_pe.rs` for current tests and snapshots, listed benches directory to confirm missing PE benchmarks, and checked for documentation and task files to identify completion gaps.

## Proposed File Changes

### src/types.rs(MODIFY)

References: 

- src/container/pe.rs

Rename `ImportName` and `ExportName` variants in `StringSource` enum to `ImportTable` and `ExportTable` respectively for precise terminology matching acceptance criteria.

**Location:** Around line 66-68 in the `StringSource` enum definition.

**Changes:**
- Change `ImportName,` to `ImportTable,`
- Change `ExportName,` to `ExportTable,`
- Update the doc comment above to reflect: `/// String from import table` and `/// String from export table`

No other changes needed; this aligns with import/export table parsing focus. Preserve serialization and all other variants.

### benches/pe.rs(MODIFY)

References: 

- benches/elf.rs
- tests/fixtures/test_binary_pe.exe

Create new PE benchmark file mirroring `benches/elf.rs` structure.

**Imports:**
- `use criterion::{black_box, criterion_group, criterion_main, Criterion};`
- `use std::fs;`
- `use stringy::container::{ContainerParser, PeParser};`

**Benchmark Functions:**
1. `fn bench_pe_full_parse(c: &mut Criterion)`: Load `tests/fixtures/test_binary_pe.exe`, detect PE, time `parse()`, black_box input/output.
2. `fn bench_pe_imports(c: &mut Criterion)`: Parse, extract/count imports, black_box results.
3. `fn bench_pe_exports(c: &mut Criterion)`: Parse, extract/count exports, black_box results.

**Group and Main:**
- `criterion_group! { name = benches; value = (bench_pe_full_parse, bench_pe_imports, bench_pe_exports); }`
- `criterion_main!(benches);`

Include debug prints like ELF; handle fixture errors.

### Cargo.toml(MODIFY)

References: 

- benches/elf.rs

Add PE benchmark configuration.

**Location:** After existing `[[bench]]` for elf (around line 40).

**Add:**
```toml
[[bench]]
name = "pe"
harness = false
```

Enables `cargo bench --bench pe`; criterion already in dev-deps.

### justfile(MODIFY)

References: 

- tests/fixtures/test_binary.c

Add recipe for building PE fixture.

**New Recipe:** `build-fixtures-pe` after existing build sections.

For Unix:
zig cc tests/fixtures/test_binary.c -o tests/fixtures/test_binary_pe.exe -target x86_64-windows-gnu

For Windows:
x86_64-w64-mingw32-gcc tests/fixtures/test_binary.c -o tests/fixtures/test_binary_pe.exe

Update default `build-fixtures` to include `build-fixtures-pe`. Ensure `test_binary.c` has imports/exports for testing.

### docs/src/binary-formats.md(MODIFY)

References: 

- src/container/pe.rs

Expand PE section with implementation details.

**Enhance:** Add subsections for section classification (name/characteristics logic), weight table (|Type|Sections|Weight|Rationale|), import extraction (DLL/function/RVA), export extraction (name/address/ordinal/forwarders).

**Add:** Limitations (UTF-16 future, resources partial), examples using `PeParser::parse`.

Match ELF/Mach-O doc style with markdown tables/code blocks.

### .kiro/specs/stringy-binary-analyzer/tasks.md(MODIFY)

Update task 4 status.

**Changes:** Mark `[x]` for task 4, update description to note completion of classification, weights, imports/exports. List implemented features: sections (.rdata 10.0 etc.), parsing, tests, benchmarks, snapshots, docs. Keep subtasks open if any.

Developer Humor

> Why did the PE parser go to therapy?\n> It had too many unresolved imports and couldn't export its feelings! 😂

Execution Information

Branch: 3-implement-pe-section-classification-and-importexport-table-parsing
Commit: 5ac6f0c

💡 Tips

Supported Commands (Inside Comments)

Use @traycerai generate to iterate on the previous version of the implementation plan.

Supported Commands (Inside Description)

Add @traycerai ignore anywhere in the ticket description to prevent this ticket from being processed.
Add @traycerai branch:<branch-name> anywhere in the ticket description to specify the target branch for the implementation plan.

Community

Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

I have updated the Implementation Plan to reflect the recent changes in the ticket.

Previous Plan

Observations

The PE section classification and import/export parsing functionality is already fully implemented in src/container/pe.rs. The core features include:

Section classification with proper SectionType assignment (.rdata, .data, .rsrc, .text, .bss, .reloc)

Section weight calculation based on string likelihood (10.0 for .rdata, 9.0 for .rsrc, etc.)

Import table parsing via extract_imports method extracting DLL names and function names

Export table parsing via extract_exports method extracting exported function names

Unit tests for section classification and weight calculation

Integration tests for PE parsing

However, the issue requests additional polish and testing infrastructure:

PE-specific benchmarks (currently only ELF benchmarks exist)

Snapshot tests using insta for import/export extraction (ELF has snapshot tests, PE doesn't)

Enhanced module-level documentation

Project tracking updates in tasks.md

The StringSource enum already has ImportName and ExportName variants (not ImportTable/ExportTable as suggested in the issue, but functionally equivalent). The test fixture test_binary_pe.exe exists and is compiled from test_binary.c which includes imports (printf, malloc, free) and exports (exported_function, helper_function).

Approach

Follow the established patterns from ELF implementation to add PE-specific testing and documentation:

Benchmarks: Create benches/pe.rs mirroring the structure of benches/elf.rs with benchmarks for full parse, import extraction, and export extraction

Snapshot tests: Add snapshot test to tests/integration_pe.rs following the pattern from tests/integration_elf.rs

Documentation: Enhance module-level docs in src/container/pe.rs and update docs/src/binary-formats.md with PE-specific implementation details

Project tracking: Update .kiro/specs/stringy-binary-analyzer/tasks.md to mark task 4 as complete

Cargo configuration: Add PE benchmark entry to Cargo.toml (if not auto-discovered)

Reasoning

I explored the repository structure, examined the existing PE parser implementation in src/container/pe.rs, reviewed the types and data structures in src/types.rs, analyzed the ELF parser and its comprehensive testing approach including benchmarks and snapshot tests, checked the test fixtures and their source code, reviewed the documentation structure, and compared patterns across ELF, PE, and Mach-O parsers to understand the established conventions.

Proposed File Changes

📄 benches/pe.rs ^(NEW) 🔗

References

📄 benches/elf.rs

📄 src/container/pe.rs ^(MODIFY)

Create a new benchmark file for PE parsing performance testing, following the exact pattern established in benches/elf.rs.

Structure:

Import criterion framework components (Criterion, criterion_group, criterion_main)

Import black_box for preventing compiler optimizations

Import ContainerParser and PeParser from stringy::container

Benchmark functions to implement:

bench_pe_full_parse: Benchmark complete PE parsing including all sections, imports, and exports

Read the PE fixture from tests/fixtures/test_binary_pe.exe

Verify it's a PE file using PeParser::detect

Benchmark the full parse operation using parser.parse()

Use black_box to prevent optimization

bench_pe_parse_with_imports: Benchmark PE parsing with focus on import extraction

Parse the PE binary

Access imports to ensure extraction is performed

Count imports and filter by library presence

Measure performance of import enumeration

bench_pe_parse_with_exports: Benchmark PE parsing with focus on export extraction

Parse the PE binary

Access exports to ensure extraction is performed

Count exports

Measure performance of export enumeration

Criterion configuration:

Use criterion_group! macro to group all three benchmarks

Use criterion_main! macro to set up the benchmark harness

Notes:

Follow the exact error handling pattern from ELF benchmarks (expect with descriptive messages)

Include early return if PE detection fails (for cross-platform compatibility)

Add println! statements for debugging output similar to ELF benchmarks
📄 Cargo.toml ^(MODIFY) 🔗
Add a benchmark entry for PE parsing to ensure Cargo recognizes and runs the PE benchmarks.

Location: After the existing [[bench]] entry for ELF (around line 40)

Add:
[[bench]]
name = "pe"
harness = false
This follows the same pattern as the existing ELF benchmark entry and ensures the PE benchmarks are discovered and can be run with cargo bench or just bench.
📄 tests/integration_pe.rs ^(MODIFY) 🔗

References

📄 tests/integration_elf.rs

Add a snapshot test for PE import/export extraction following the pattern established in tests/integration_elf.rs.

Add new test function: test_pe_symbol_extraction_snapshot

Implementation details:

Import insta::assert_snapshot at the top of the file

Read the PE fixture from tests/fixtures/test_binary_pe.exe

Verify it's a PE file using PeParser::detect

Parse the binary using PeParser

Create formatted output string with two sections:

IMPORTS section:

Header: "=== IMPORTS ==="

Total count: "Total: {count}"

For each import (limit to first 10):

"Import {i}: {name}"

" Library: {library}" (if present)

" Address: 0x{address:x}" (if present)

If more than 10: "... and {remaining} more imports"

EXPORTS section:

Header: "=== EXPORTS ==="

Total count: "Total: {count}"

For each export (limit to first 10):

"Export {i}: {name}"

" Address: 0x{address:x}"

" Ordinal: {ordinal}" (if present)

If more than 10: "... and {remaining} more exports"

Use assert_snapshot!("pe_symbol_extraction", output) to create/verify snapshot

Notes:

Follow the exact formatting pattern from test_elf_symbol_extraction_snapshot in tests/integration_elf.rs

PE executables typically don't export symbols (only DLLs do), so the exports section may be empty or minimal

The snapshot will be stored in tests/snapshots/integration_pe__pe_symbol_extraction.snap

Run cargo insta review after first run to accept the baseline snapshot

📄 src/container/pe.rs ^(MODIFY) 🔗

References

📄 src/container/macho.rs

Enhance module-level documentation to describe PE-specific parsing behavior, section classification strategy, and import/export extraction.

Add comprehensive module documentation at the top of the file (before the use statements):

Module overview:

Brief description of PE format and its use on Windows

Purpose of this parser in the stringy ecosystem

Section Classification Strategy:

Document the section weight system (10.0 for .rdata, 9.0 for .rsrc, etc.)

Explain why certain sections are prioritized for string extraction

List all recognized section types and their classifications:

.rdata / .rodata: StringData (weight 10.0) - primary string section

.rsrc: Resources (weight 9.0) - version info, string tables

.data (read-only): ReadOnlyData (weight 7.0)

.data (writable): WritableData (weight 5.0)

.text: Code (weight 1.0)

.bss, .reloc: Other/VeryLow priority

Import/Export Table Parsing:

Explain that imports are extracted from the PE import directory

Document that each import includes: function name, DLL name, and RVA

Explain that exports are extracted from the PE export directory

Note that PE executables typically don't export symbols (only DLLs do)

Document the ordinal handling (using index as ordinal since goblin doesn't expose it directly)

UTF-16LE Considerations:

Note that Windows APIs favor wide strings (UTF-16LE)

Mention that .rdata sections should be prioritized for UTF-16LE extraction

Reference the encoding detection in the future extraction pipeline

Example usage:

Show basic usage pattern with PeParser::detect and parse

Demonstrate accessing sections, imports, and exports from ContainerInfo

Format: Use Rust doc comments (///) with proper markdown formatting, code blocks, and sections similar to the comprehensive documentation in src/container/macho.rs

📄 docs/src/binary-formats.md ^(MODIFY) 🔗

Expand the PE section in the binary formats documentation to include implementation details matching the level of detail provided for ELF.

Location: In the "## PE (Portable Executable)" section (around line 147)

Enhancements to add:

After "### PE-Specific Features" section, add "### Enhanced Import/Export Extraction":

Document that the PE parser provides comprehensive import/export extraction

Explain import extraction:

Extracts from PE import directory using goblin's pe.imports

Each import includes: function name, DLL name, and RVA

Example: printf from msvcrt.dll

Explain export extraction:

Extracts from PE export directory using goblin's pe.exports

Each export includes: function name, address, and ordinal

Note: PE executables typically don't export symbols (only DLLs)

Ordinal is derived from index since goblin doesn't expose it directly

Update "### Implementation Details" section:

Add extract_imports method documentation:

Iterates through pe.imports

Creates ImportInfo with name, library (DLL), and address (RVA)

Add extract_exports method documentation:

Iterates through pe.exports

Creates ExportInfo with name, address, and ordinal

Handles unnamed exports with "ordinal_{i}" naming

Add calculate_section_weight method documentation:

Shows the weight values for each section type

Explains the rationale (string likelihood)

Add "### Section Weight Calculation" subsection:

Create a table showing section types and their weights:
| Section Type | Weight | Rationale |
| StringData (.rdata) | 10.0 | Primary string storage |
| Resources (.rsrc) | 9.0 | Version info, string tables |
| ReadOnlyData | 7.0 | May contain constants |
| WritableData (.data) | 5.0 | Runtime state, lower priority |
| Code (.text) | 1.0 | Unlikely to contain strings |
| Debug | 2.0 | Internal metadata |
| Other | 1.0 | Minimal priority |

Add "### Limitations" subsection:

Note that resource extraction (VERSIONINFO, STRINGTABLE) is planned but not yet implemented

Mention that the current implementation focuses on import/export tables and section classification

Reference future enhancements for PE resource parsing

Format: Follow the markdown structure and detail level of the ELF section, including code blocks, tables, and clear subsection headers
📄 .kiro/specs/stringy-binary-analyzer/tasks.md ^(MODIFY) 🔗
Update the task tracking to reflect that PE section classification and import/export parsing are complete.

Location: Task 4 section (around line 36)

Changes:

Change the task 4 checkbox from [ ] to [x] to mark it as complete

Update the task description to note that implementation is complete

Add a note about the completed features:

Section classification for .rdata, .data, .rsrc, .text, .bss, .reloc

Section weight assignment based on string likelihood

Import table parsing extracting DLL names and function names

Export table parsing extracting exported function names

Unit tests for section classification and weight calculation

Integration tests for PE parsing

Benchmarks for PE parsing performance

Snapshot tests for import/export extraction

Keep subtasks 4.1 and 4.2 (PE resource extraction) as unchecked since those are future work

Add a completion note with date and reference to issue Implement PE Section Classification and Import/Export Table Parsing #3

Format:
- [x] 4. Implement PE section classification

 - Enhance PE parser to classify sections (.rdata, .data) by string likelihood ✅
 - Add section weight assignment for PE-specific sections ✅
 - Implement basic PE import/export table parsing ✅
 - Add benchmarks and snapshot tests ✅
 - _Requirements: 1.2, 1.4_
 - _Completed: [Date] - Issue #3_

 - [ ] 4.1 Add PE resource extraction foundation
 ...
Diagram
sequenceDiagram
 participant Dev as Developer
 participant Bench as Benchmark Suite
 participant Test as Test Suite
 participant Parser as PeParser
 participant Docs as Documentation

 Note over Dev,Docs: PE Testing & Documentation Enhancement

 Dev->>Bench: Create benches/pe.rs
 Bench->>Parser: bench_pe_full_parse()
 Bench->>Parser: bench_pe_parse_with_imports()
 Bench->>Parser: bench_pe_parse_with_exports()
 Note over Bench: Measures parsing performance

 Dev->>Test: Add snapshot test to integration_pe.rs
 Test->>Parser: parse(test_binary_pe.exe)
 Parser-->>Test: ContainerInfo with imports/exports
 Test->>Test: Format output string
 Test->>Test: assert_snapshot!("pe_symbol_extraction")
 Note over Test: Creates baseline snapshot

 Dev->>Parser: Enhance module docs
 Note over Parser: Document section weights, import/export extraction, UTF-16LE considerations

 Dev->>Docs: Update binary-formats.md
 Note over Docs: Add PE implementation details, section weight table, limitations

 Dev->>Docs: Update tasks.md
 Note over Docs: Mark task 4 complete

 Note over Dev,Docs: All changes follow established patterns from ELF implementation
Loading
Import In IDE
🤖 Prompt for AI Agents
I have created the following plan after thorough exploration and analysis of the codebase. Follow the below plan verbatim. Trust the files and references. Do not re-verify what's written in the plan. Explore only when absolutely necessary. First implement all the proposed file changes and then I'll review all the changes together at the end.

### Observations

The PE section classification and import/export parsing functionality is **already fully implemented** in `src/container/pe.rs`. The core features include:

- Section classification with proper `SectionType` assignment (`.rdata`, `.data`, `.rsrc`, `.text`, `.bss`, `.reloc`)
- Section weight calculation based on string likelihood (10.0 for `.rdata`, 9.0 for `.rsrc`, etc.)
- Import table parsing via `extract_imports` method extracting DLL names and function names
- Export table parsing via `extract_exports` method extracting exported function names
- Unit tests for section classification and weight calculation
- Integration tests for PE parsing

However, the issue requests additional **polish and testing infrastructure**:
1. PE-specific benchmarks (currently only ELF benchmarks exist)
2. Snapshot tests using `insta` for import/export extraction (ELF has snapshot tests, PE doesn't)
3. Enhanced module-level documentation
4. Project tracking updates in `tasks.md`

The `StringSource` enum already has `ImportName` and `ExportName` variants (not `ImportTable`/`ExportTable` as suggested in the issue, but functionally equivalent). The test fixture `test_binary_pe.exe` exists and is compiled from `test_binary.c` which includes imports (`printf`, `malloc`, `free`) and exports (`exported_function`, `helper_function`).

### Approach

Follow the established patterns from ELF implementation to add PE-specific testing and documentation:

1. **Benchmarks**: Create `benches/pe.rs` mirroring the structure of `benches/elf.rs` with benchmarks for full parse, import extraction, and export extraction
2. **Snapshot tests**: Add snapshot test to `tests/integration_pe.rs` following the pattern from `tests/integration_elf.rs` 
3. **Documentation**: Enhance module-level docs in `src/container/pe.rs` and update `docs/src/binary-formats.md` with PE-specific implementation details
4. **Project tracking**: Update `.kiro/specs/stringy-binary-analyzer/tasks.md` to mark task 4 as complete
5. **Cargo configuration**: Add PE benchmark entry to `Cargo.toml` (if not auto-discovered)

### Reasoning

I explored the repository structure, examined the existing PE parser implementation in `src/container/pe.rs`, reviewed the types and data structures in `src/types.rs`, analyzed the ELF parser and its comprehensive testing approach including benchmarks and snapshot tests, checked the test fixtures and their source code, reviewed the documentation structure, and compared patterns across ELF, PE, and Mach-O parsers to understand the established conventions.

## Mermaid Diagram

sequenceDiagram
 participant Dev as Developer
 participant Bench as Benchmark Suite
 participant Test as Test Suite
 participant Parser as PeParser
 participant Docs as Documentation

 Note over Dev,Docs: PE Testing & Documentation Enhancement

 Dev->>Bench: Create benches/pe.rs
 Bench->>Parser: bench_pe_full_parse()
 Bench->>Parser: bench_pe_parse_with_imports()
 Bench->>Parser: bench_pe_parse_with_exports()
 Note over Bench: Measures parsing performance

 Dev->>Test: Add snapshot test to integration_pe.rs
 Test->>Parser: parse(test_binary_pe.exe)
 Parser-->>Test: ContainerInfo with imports/exports
 Test->>Test: Format output string
 Test->>Test: assert_snapshot!("pe_symbol_extraction")
 Note over Test: Creates baseline snapshot

 Dev->>Parser: Enhance module docs
 Note over Parser: Document section weights, import/export extraction, UTF-16LE considerations

 Dev->>Docs: Update binary-formats.md
 Note over Docs: Add PE implementation details, section weight table, limitations

 Dev->>Docs: Update tasks.md
 Note over Docs: Mark task 4 complete

 Note over Dev,Docs: All changes follow established patterns from ELF implementation

## Proposed File Changes

### benches/pe.rs(NEW)

References: 

- benches/elf.rs
- src/container/pe.rs(MODIFY)

Create a new benchmark file for PE parsing performance testing, following the exact pattern established in `benches/elf.rs`.

**Structure:**
- Import criterion framework components (Criterion, criterion_group, criterion_main)
- Import black_box for preventing compiler optimizations
- Import ContainerParser and PeParser from stringy::container

**Benchmark functions to implement:**

1. `bench_pe_full_parse`: Benchmark complete PE parsing including all sections, imports, and exports
 - Read the PE fixture from `tests/fixtures/test_binary_pe.exe`
 - Verify it's a PE file using PeParser::detect
 - Benchmark the full parse operation using parser.parse()
 - Use black_box to prevent optimization

2. `bench_pe_parse_with_imports`: Benchmark PE parsing with focus on import extraction
 - Parse the PE binary
 - Access imports to ensure extraction is performed
 - Count imports and filter by library presence
 - Measure performance of import enumeration

3. `bench_pe_parse_with_exports`: Benchmark PE parsing with focus on export extraction
 - Parse the PE binary
 - Access exports to ensure extraction is performed
 - Count exports
 - Measure performance of export enumeration

**Criterion configuration:**
- Use criterion_group! macro to group all three benchmarks
- Use criterion_main! macro to set up the benchmark harness

**Notes:**
- Follow the exact error handling pattern from ELF benchmarks (expect with descriptive messages)
- Include early return if PE detection fails (for cross-platform compatibility)
- Add println! statements for debugging output similar to ELF benchmarks

### Cargo.toml(MODIFY)

Add a benchmark entry for PE parsing to ensure Cargo recognizes and runs the PE benchmarks.

**Location:** After the existing `[[bench]]` entry for ELF (around line 40)

**Add:**
```toml
[[bench]]
name = "pe"
harness = false
```

This follows the same pattern as the existing ELF benchmark entry and ensures the PE benchmarks are discovered and can be run with `cargo bench` or `just bench`.

### tests/integration_pe.rs(MODIFY)

References: 

- tests/integration_elf.rs

Add a snapshot test for PE import/export extraction following the pattern established in `tests/integration_elf.rs`.

**Add new test function:** `test_pe_symbol_extraction_snapshot`

**Implementation details:**
1. Import insta::assert_snapshot at the top of the file
2. Read the PE fixture from `tests/fixtures/test_binary_pe.exe`
3. Verify it's a PE file using PeParser::detect
4. Parse the binary using PeParser
5. Create formatted output string with two sections:

 **IMPORTS section:**
 - Header: "=== IMPORTS ==="
 - Total count: "Total: {count}"
 - For each import (limit to first 10):
 - "Import {i}: {name}"
 - " Library: {library}" (if present)
 - " Address: 0x{address:x}" (if present)
 - If more than 10: "... and {remaining} more imports"

 **EXPORTS section:**
 - Header: "=== EXPORTS ==="
 - Total count: "Total: {count}"
 - For each export (limit to first 10):
 - "Export {i}: {name}"
 - " Address: 0x{address:x}"
 - " Ordinal: {ordinal}" (if present)
 - If more than 10: "... and {remaining} more exports"

6. Use assert_snapshot!("pe_symbol_extraction", output) to create/verify snapshot

**Notes:**
- Follow the exact formatting pattern from `test_elf_symbol_extraction_snapshot` in `tests/integration_elf.rs`
- PE executables typically don't export symbols (only DLLs do), so the exports section may be empty or minimal
- The snapshot will be stored in `tests/snapshots/integration_pe__pe_symbol_extraction.snap`
- Run `cargo insta review` after first run to accept the baseline snapshot

### src/container/pe.rs(MODIFY)

References: 

- src/container/macho.rs

Enhance module-level documentation to describe PE-specific parsing behavior, section classification strategy, and import/export extraction.

**Add comprehensive module documentation at the top of the file (before the use statements):**

1. **Module overview:**
 - Brief description of PE format and its use on Windows
 - Purpose of this parser in the stringy ecosystem

2. **Section Classification Strategy:**
 - Document the section weight system (10.0 for .rdata, 9.0 for .rsrc, etc.)
 - Explain why certain sections are prioritized for string extraction
 - List all recognized section types and their classifications:
 - `.rdata` / `.rodata`: StringData (weight 10.0) - primary string section
 - `.rsrc`: Resources (weight 9.0) - version info, string tables
 - `.data` (read-only): ReadOnlyData (weight 7.0)
 - `.data` (writable): WritableData (weight 5.0)
 - `.text`: Code (weight 1.0)
 - `.bss`, `.reloc`: Other/VeryLow priority

3. **Import/Export Table Parsing:**
 - Explain that imports are extracted from the PE import directory
 - Document that each import includes: function name, DLL name, and RVA
 - Explain that exports are extracted from the PE export directory
 - Note that PE executables typically don't export symbols (only DLLs do)
 - Document the ordinal handling (using index as ordinal since goblin doesn't expose it directly)

4. **UTF-16LE Considerations:**
 - Note that Windows APIs favor wide strings (UTF-16LE)
 - Mention that `.rdata` sections should be prioritized for UTF-16LE extraction
 - Reference the encoding detection in the future extraction pipeline

5. **Example usage:**
 - Show basic usage pattern with PeParser::detect and parse
 - Demonstrate accessing sections, imports, and exports from ContainerInfo

**Format:** Use Rust doc comments (///) with proper markdown formatting, code blocks, and sections similar to the comprehensive documentation in `src/container/macho.rs`

### docs/src/binary-formats.md(MODIFY)

Expand the PE section in the binary formats documentation to include implementation details matching the level of detail provided for ELF.

**Location:** In the "## PE (Portable Executable)" section (around line 147)

**Enhancements to add:**

1. **After "### PE-Specific Features" section, add "### Enhanced Import/Export Extraction":**
 - Document that the PE parser provides comprehensive import/export extraction
 - Explain import extraction:
 - Extracts from PE import directory using goblin's pe.imports
 - Each import includes: function name, DLL name, and RVA
 - Example: `printf` from `msvcrt.dll`
 - Explain export extraction:
 - Extracts from PE export directory using goblin's pe.exports
 - Each export includes: function name, address, and ordinal
 - Note: PE executables typically don't export symbols (only DLLs)
 - Ordinal is derived from index since goblin doesn't expose it directly

2. **Update "### Implementation Details" section:**
 - Add extract_imports method documentation:
 - Iterates through pe.imports
 - Creates ImportInfo with name, library (DLL), and address (RVA)
 - Add extract_exports method documentation:
 - Iterates through pe.exports
 - Creates ExportInfo with name, address, and ordinal
 - Handles unnamed exports with "ordinal_{i}" naming
 - Add calculate_section_weight method documentation:
 - Shows the weight values for each section type
 - Explains the rationale (string likelihood)

3. **Add "### Section Weight Calculation" subsection:**
 - Create a table showing section types and their weights:
 | Section Type | Weight | Rationale |
 | StringData (.rdata) | 10.0 | Primary string storage |
 | Resources (.rsrc) | 9.0 | Version info, string tables |
 | ReadOnlyData | 7.0 | May contain constants |
 | WritableData (.data) | 5.0 | Runtime state, lower priority |
 | Code (.text) | 1.0 | Unlikely to contain strings |
 | Debug | 2.0 | Internal metadata |
 | Other | 1.0 | Minimal priority |

4. **Add "### Limitations" subsection:**
 - Note that resource extraction (VERSIONINFO, STRINGTABLE) is planned but not yet implemented
 - Mention that the current implementation focuses on import/export tables and section classification
 - Reference future enhancements for PE resource parsing

**Format:** Follow the markdown structure and detail level of the ELF section, including code blocks, tables, and clear subsection headers

### .kiro/specs/stringy-binary-analyzer/tasks.md(MODIFY)

Update the task tracking to reflect that PE section classification and import/export parsing are complete.

**Location:** Task 4 section (around line 36)

**Changes:**
1. Change the task 4 checkbox from `[ ]` to `[x]` to mark it as complete
2. Update the task description to note that implementation is complete
3. Add a note about the completed features:
 - Section classification for .rdata, .data, .rsrc, .text, .bss, .reloc
 - Section weight assignment based on string likelihood
 - Import table parsing extracting DLL names and function names
 - Export table parsing extracting exported function names
 - Unit tests for section classification and weight calculation
 - Integration tests for PE parsing
 - Benchmarks for PE parsing performance
 - Snapshot tests for import/export extraction

4. Keep subtasks 4.1 and 4.2 (PE resource extraction) as unchecked since those are future work

5. Add a completion note with date and reference to issue #3

**Format:**
```markdown
- [x] 4. Implement PE section classification

 - Enhance PE parser to classify sections (.rdata, .data) by string likelihood ✅
 - Add section weight assignment for PE-specific sections ✅
 - Implement basic PE import/export table parsing ✅
 - Add benchmarks and snapshot tests ✅
 - _Requirements: 1.2, 1.4_
 - _Completed: [Date] - Issue #3_

 - [ ] 4.1 Add PE resource extraction foundation
 ...
```
Developer Humor

🔍 The PE parser was already there,\n> Extracting imports with care,\n> Now with benchmarks so bright,\n> And snapshots just right,\n> Documentation beyond compare! 📚✨

Execution Information

Branch: main
Commit: 37cfc7c
New Plan

Observations

The core PE section classification and import/export parsing functionality is already fully implemented in src/container/pe.rs. Key features include:\n\n- Comprehensive section classification covering .rdata (StringData, weight 10.0), .rsrc (Resources, 9.0), .data (ReadOnlyData 7.0 or WritableData 5.0 based on characteristics), .text (Code, 1.0), .bss (WritableData), .debug (Debug, 2.0), and others (1.0)\n- Import extraction from pe.imports creating ImportInfo with name, library (DLL), and RVA\n- Export extraction from pe.exports creating ExportInfo with name (fallback to ordinal), address, and ordinal (index-based)\n- Integration into ContainerParser::parse populating ContainerInfo with sections, imports, and exports\n- Unit tests for classification and weight calculation\n- Basic integration tests in tests/integration_pe.rs for parsing and section verification\n\nThe StringSource enum already includes ImportName and ExportName variants (functionally equivalent to requested ImportTable/ExportTable). However, string extraction pipeline (src/extraction/mod.rs) is not yet implemented to utilize these for FoundString sources.\n\nMissing elements from acceptance criteria:\n1. PE-specific benchmarks (only ELF benchmarks exist in benches/elf.rs)\n2. Insta snapshot tests for import/export extraction results\n3. Enhanced module-level documentation in pe.rs\n4. Detailed PE documentation in docs/src/binary-formats.md\n5. Update task tracking in .kiro/specs/stringy-binary-analyzer/tasks.md\n6. PE benchmark configuration in Cargo.toml\n7. PE fixture tests/fixtures/test_binary_pe.exe (referenced in tests but not present; needs generation from test_binary.c using cross-compilation)\n\nThe test fixture compilation for PE requires cross-compilation (e.g., using zig or mingw), which should be added to a build script or justfile recipe.

Approach

To complete the PE implementation per acceptance criteria while building on existing functionality:\n\n1. Fixture Generation: Add a justfile recipe or build.rs to cross-compile test_binary.c to PE format using mingw-w64 or zig, ensuring the fixture includes imports (printf, malloc) and exports (exported_function).\n2. Benchmarks: Create benches/pe.rs mirroring benches/elf.rs with criterion benchmarks for full parsing, import extraction, and export extraction using the PE fixture.\n3. Snapshot Tests: Enhance tests/integration_pe.rs with an insta snapshot test for formatted import/export output, following the ELF pattern.\n4. Documentation: Add comprehensive module docs to src/container/pe.rs covering classification strategy, weight calculation, and import/export details. Expand the PE section in docs/src/binary-formats.md with implementation specifics, weight table, and limitations.\n5. Project Tracking: Update .kiro/specs/stringy-binary-analyzer/tasks.md to mark task 4 as complete, noting implemented features.\n6. Cargo Config: Add [[bench]] entry for PE in Cargo.toml to enable cargo bench.\n7. StringSource Alignment: Consider renaming ImportName/ExportName to ImportTable/ExportTable in src/types.rs for exact match, but current variants are sufficient.\n\nEnsure all changes maintain existing test coverage and follow ELF/Mach-O patterns for consistency.

Reasoning

I listed the repository directory structure to understand the project layout, read src/container/pe.rs to examine the existing PE parser implementation including section classification, weight calculation, and import/export extraction methods, reviewed src/types.rs to confirm StringSource variants and data structures, inspected tests/integration_pe.rs for current integration tests and fixture usage, checked src/extraction/mod.rs to assess integration with string extraction pipeline, examined docs/src/binary-formats.md for existing PE documentation, reviewed .kiro/specs/stringy-binary-analyzer/tasks.md for task status, and analyzed justfile for build recipes to identify fixture generation needs.

Proposed File Changes

📄 benches/pe.rs ^(NEW) 🔗

References

📄 benches/elf.rs

📄 src/container/pe.rs ^(MODIFY)

📄 tests/fixtures/test_binary_pe.exe

Create PE benchmark suite following the exact structure and patterns from benches/elf.rs.

Imports:

use criterion::{black_box, criterion_group, criterion_main, Criterion};

use std::fs;

use stringy::container::{ContainerParser, PeParser};

Benchmark Functions:

fn bench_pe_full_parse(c: &mut Criterion):

Read PE fixture from tests/fixtures/test_binary_pe.exe

Verify PE detection with PeParser::detect

Time full parser.parse() operation

Use black_box on input and output to prevent optimization

Early return if not PE

Group name: benches::pe::full_parse

fn bench_pe_imports_extraction(c: &mut Criterion):

Parse the PE binary

Extract and count imports

Filter imports by library (e.g., msvcrt.dll)

Use black_box on results

Group name: benches::pe::imports

fn bench_pe_exports_extraction(c: &mut Criterion):

Parse the PE binary

Extract and count exports

Use black_box on results

Group name: benches::pe::exports

Configuration:

criterion_group! { name = benches; value = (bench_pe_full_parse, bench_pe_imports_extraction, bench_pe_exports_extraction); }

criterion_main!(benches);

Notes:

Include println! for debug output similar to ELF benchmarks

Handle fixture reading errors with descriptive messages

Ensure cross-platform compatibility by checking fixture existence
📄 Cargo.toml ^(MODIFY) 🔗
References

📄 benches/elf.rs

Add PE benchmark configuration to enable discovery by Cargo.

Location: After the existing [[bench]] section for ELF (around line 40-42).

Add:
[[bench]]
name = "pe"
harness = false
This mirrors the ELF benchmark entry and allows running PE benchmarks with cargo bench or just bench. No other changes needed as criterion is already a dev-dependency.
📄 tests/integration_pe.rs ^(MODIFY) 🔗

References

📄 tests/integration_elf.rs

📄 src/types.rs

Add insta snapshot test for PE import/export extraction, following the exact pattern from tests/integration_elf.rs.

Add Import: use insta::assert_snapshot;

New Test Function: #[test] fn test_pe_symbol_extraction_snapshot() { ... }

Implementation:

Read PE fixture from tests/fixtures/test_binary_pe.exe

Verify PE detection

Parse with PeParser::new().parse()

Format output as multi-line string:

=== IMPORTS ===

Total: {imports.len()}

For first 10 imports: Import {i}: {name}

Library: {library.unwrap_or("N/A")}

Address: 0x{address.unwrap_or(0):x}

If more: ... and {imports.len() - 10} more imports

=== EXPORTS ===

Total: {exports.len()}

For first 10 exports: Export {i}: {name}

Address: 0x{address:x}

Ordinal: {ordinal.unwrap_or(0)}

If more: ... and {exports.len() - 10} more exports

assert_snapshot!("pe_symbol_extraction", output);

Notes:

Handle empty exports (common for EXEs, typical for DLLs)

Snapshot file: tests/snapshots/integration_pe__pe_symbol_extraction.snap

Run cargo insta review post-implementation to accept baseline

Ensure test skips gracefully if fixture missing, but assume fixture exists after build

📄 src/container/pe.rs ^(MODIFY) 🔗

References

📄 src/container/elf.rs

Enhance module documentation with comprehensive details on PE-specific implementation.

Add at Module Top (before use statements): /// doc comment block:

Module Overview

Describe PE format role in Windows ecosystem

Explain integration with stringy for section prioritization and symbol extraction

Section Classification Strategy

Detail classify_section logic: characteristics check (e.g., IMAGE_SCN_CNT_CODE for Code), then name matching

List classifications: .rdata/.rodata → StringData, .rsrc → Resources, .data (non-writable) → ReadOnlyData, .data/.bss (writable) → WritableData, .debug* → Debug, others → Other

Section Weight Calculation

Explain calculate_section_weight: StringData (.rdata: 10.0, others: 8.0), Resources: 9.0, ReadOnlyData: 7.0, WritableData: 5.0, Code: 1.0, Debug: 2.0, Other: 1.0

Rationale: Prioritize read-only string storage over writable/runtime data

Import/Export Extraction

Document extract_imports: Iterates pe.imports, creates ImportInfo with name, dll (library), rva (address)

Document extract_exports: Iterates pe.exports, handles unnamed via ordinal_{i}, uses index as ordinal

Note: EXEs rarely export; DLLs do. UTF-16LE common in Windows strings

Integration and Usage

Example: let info = PeParser::new().parse(&data)?;

Access info.sections, info.imports, info.exports

Reference future UTF-16 prioritization in extraction

Format: Use markdown with code blocks, tables for weights, similar to src/container/elf.rs docs.

📄 docs/src/binary-formats.md ^(MODIFY) 🔗

Expand the PE section (starting ~line 147) to match ELF documentation depth.

Enhance '### PE-Specific Features':

Add import/export table parsing details

Explain UTF-16LE prevalence and section prioritization

New Subsection: '### Enhanced Import/Export Extraction':

Imports: From PE import directory via goblin::pe::imports; each ImportInfo has name, library (DLL), RVA

Example: printf from msvcrt.dll

Exports: From export directory via goblin::pe::exports; each ExportInfo has name (or ordinal_{i}), address, ordinal (index)

Note: Primarily for DLLs; EXEs typically empty

Update '### Implementation Details':

Document extract_imports and extract_exports methods with code snippets

Detail classify_section with characteristics and name matching

Explain calculate_section_weight with PE-specific values

New Subsection: '### Section Weight Calculation':

Table:

Section Type Example Sections Weight Rationale

StringData .rdata, .rodata 10.0 Primary string literals

Resources .rsrc 9.0 Version info, UI strings

ReadOnlyData .data (RO) 7.0 Constants, read-only vars

WritableData .data (RW), .bss 5.0 Runtime data, lower priority

Code .text 1.0 Executable code, minimal strings

Debug .debug*, .pdata 2.0 Metadata, some strings

Other Custom 1.0 Unknown, low priority

New Subsection: '### Limitations':

Resource extraction (VERSIONINFO, etc.) planned but not implemented

Focus on sections/imports/exports; full resource parsing future work

Ordinal derivation from index (goblin limitation)

UTF-16 detection to be handled in extraction pipeline

Format: Markdown with code blocks, tables, subsections matching ELF style.

📄 .kiro/specs/stringy-binary-analyzer/tasks.md ^(MODIFY) 🔗

Mark task 4 as complete and update description to reflect implemented features.

Location: Task 4 section (~line 36).

Changes:

Change [ ] to [x] for task 4

Update description: 'Implement PE section classification ✅ - Enhanced PE parser with section classification by string likelihood, weight assignment, and import/export table parsing'

Add completion note: 'Completed: PE section classification, weights, imports/exports extraction, unit/integration tests, benchmarks, snapshots - Issue Implement PE Section Classification and Import/Export Table Parsing #3'

Keep subtasks 4.1 and 4.2 unchecked (future resource work)

List implemented features:

Section classification for .rdata, .rsrc, .data (RO/RW), .text, .bss, .debug, others

Weight calculation: 10.0 (.rdata), 9.0 (.rsrc), etc.

Import parsing: DLL names, function names, RVAs

Export parsing: function names, addresses, ordinals

Unit tests for classification/weights

Integration tests for parsing/sections/imports/exports

Benchmarks for performance

Snapshot tests for symbol extraction

Documentation updates

Format: Markdown checkboxes, preserve structure.

📄 justfile ^(MODIFY) 🔗

References

📄 tests/fixtures/test_binary.c

Add recipe to generate PE test fixture from test_binary.c using cross-compilation.

New Recipe: build-fixtures-pe (after build section ~line 200):

[unix]
build-fixtures-pe:
cd {{ root }}
# Use zig for cross-compilation to Windows PE
zig cc tests/fixtures/test_binary.c -o tests/fixtures/test_binary_pe.exe -target x86_64-windows-gnu -rdynamic -shared # Adjust for EXE vs DLL if needed

[windows]
build-fixtures-pe:
# On Windows, use mingw or cl.exe
cd {{ root }}
x86_64-w64-mingw32-gcc tests/fixtures/test_binary.c -o tests/fixtures/test_binary_pe.exe -Wl,--export-all-symbols # For exports

Notes:

Ensure test_binary.c includes imports (e.g., #include <stdio.h>, malloc) and exports (e.g., __declspec(dllexport) void exported_function()) for testing

Add to default build recipe if needed: build-fixtures: build-fixtures-elf build-fixtures-macho build-fixtures-pe

Alternative: Use build.rs with cc crate for automated compilation

Verify output with file tests/fixtures/test_binary_pe.exe (should be PE32+ executable)

Import In IDE
🤖 Prompt for AI Agents
I have created the following plan after thorough exploration and analysis of the codebase. Follow the below plan verbatim. Trust the files and references. Do not re-verify what's written in the plan. Explore only when absolutely necessary. First implement all the proposed file changes and then I'll review all the changes together at the end.

### Observations

The core PE section classification and import/export parsing functionality is already fully implemented in `src/container/pe.rs`. Key features include:\n\n- Comprehensive section classification covering `.rdata` (StringData, weight 10.0), `.rsrc` (Resources, 9.0), `.data` (ReadOnlyData 7.0 or WritableData 5.0 based on characteristics), `.text` (Code, 1.0), `.bss` (WritableData), `.debug` (Debug, 2.0), and others (1.0)\n- Import extraction from `pe.imports` creating `ImportInfo` with name, library (DLL), and RVA\n- Export extraction from `pe.exports` creating `ExportInfo` with name (fallback to ordinal), address, and ordinal (index-based)\n- Integration into `ContainerParser::parse` populating `ContainerInfo` with sections, imports, and exports\n- Unit tests for classification and weight calculation\n- Basic integration tests in `tests/integration_pe.rs` for parsing and section verification\n\nThe `StringSource` enum already includes `ImportName` and `ExportName` variants (functionally equivalent to requested `ImportTable`/`ExportTable`). However, string extraction pipeline (`src/extraction/mod.rs`) is not yet implemented to utilize these for `FoundString` sources.\n\nMissing elements from acceptance criteria:\n1. PE-specific benchmarks (only ELF benchmarks exist in `benches/elf.rs`)\n2. Insta snapshot tests for import/export extraction results\n3. Enhanced module-level documentation in `pe.rs`\n4. Detailed PE documentation in `docs/src/binary-formats.md`\n5. Update task tracking in `.kiro/specs/stringy-binary-analyzer/tasks.md`\n6. PE benchmark configuration in `Cargo.toml`\n7. PE fixture `tests/fixtures/test_binary_pe.exe` (referenced in tests but not present; needs generation from `test_binary.c` using cross-compilation)\n\nThe test fixture compilation for PE requires cross-compilation (e.g., using `zig` or `mingw`), which should be added to a build script or justfile recipe.

### Approach

To complete the PE implementation per acceptance criteria while building on existing functionality:\n\n1. **Fixture Generation**: Add a justfile recipe or build.rs to cross-compile `test_binary.c` to PE format using mingw-w64 or zig, ensuring the fixture includes imports (printf, malloc) and exports (exported_function).\n2. **Benchmarks**: Create `benches/pe.rs` mirroring `benches/elf.rs` with criterion benchmarks for full parsing, import extraction, and export extraction using the PE fixture.\n3. **Snapshot Tests**: Enhance `tests/integration_pe.rs` with an insta snapshot test for formatted import/export output, following the ELF pattern.\n4. **Documentation**: Add comprehensive module docs to `src/container/pe.rs` covering classification strategy, weight calculation, and import/export details. Expand the PE section in `docs/src/binary-formats.md` with implementation specifics, weight table, and limitations.\n5. **Project Tracking**: Update `.kiro/specs/stringy-binary-analyzer/tasks.md` to mark task 4 as complete, noting implemented features.\n6. **Cargo Config**: Add `[[bench]]` entry for PE in `Cargo.toml` to enable `cargo bench`.\n7. **StringSource Alignment**: Consider renaming `ImportName`/`ExportName` to `ImportTable`/`ExportTable` in `src/types.rs` for exact match, but current variants are sufficient.\n\nEnsure all changes maintain existing test coverage and follow ELF/Mach-O patterns for consistency.

### Reasoning

I listed the repository directory structure to understand the project layout, read `src/container/pe.rs` to examine the existing PE parser implementation including section classification, weight calculation, and import/export extraction methods, reviewed `src/types.rs` to confirm `StringSource` variants and data structures, inspected `tests/integration_pe.rs` for current integration tests and fixture usage, checked `src/extraction/mod.rs` to assess integration with string extraction pipeline, examined `docs/src/binary-formats.md` for existing PE documentation, reviewed `.kiro/specs/stringy-binary-analyzer/tasks.md` for task status, and analyzed `justfile` for build recipes to identify fixture generation needs.

## Proposed File Changes

### benches/pe.rs(NEW)

References: 

- benches/elf.rs
- src/container/pe.rs(MODIFY)
- tests/fixtures/test_binary_pe.exe

Create PE benchmark suite following the exact structure and patterns from `benches/elf.rs`.

**Imports:**
- `use criterion::{black_box, criterion_group, criterion_main, Criterion};`
- `use std::fs;`
- `use stringy::container::{ContainerParser, PeParser};`

**Benchmark Functions:**

1. `fn bench_pe_full_parse(c: &mut Criterion)`:
 - Read PE fixture from `tests/fixtures/test_binary_pe.exe`
 - Verify PE detection with `PeParser::detect`
 - Time full `parser.parse()` operation
 - Use `black_box` on input and output to prevent optimization
 - Early return if not PE
 - Group name: `benches::pe::full_parse`

2. `fn bench_pe_imports_extraction(c: &mut Criterion)`:
 - Parse the PE binary
 - Extract and count imports
 - Filter imports by library (e.g., msvcrt.dll)
 - Use `black_box` on results
 - Group name: `benches::pe::imports`

3. `fn bench_pe_exports_extraction(c: &mut Criterion)`:
 - Parse the PE binary
 - Extract and count exports
 - Use `black_box` on results
 - Group name: `benches::pe::exports`

**Configuration:**
- `criterion_group! { name = benches; value = (bench_pe_full_parse, bench_pe_imports_extraction, bench_pe_exports_extraction); }`
- `criterion_main!(benches);`

**Notes:**
- Include `println!` for debug output similar to ELF benchmarks
- Handle fixture reading errors with descriptive messages
- Ensure cross-platform compatibility by checking fixture existence

### Cargo.toml(MODIFY)

References: 

- benches/elf.rs

Add PE benchmark configuration to enable discovery by Cargo.

**Location:** After the existing `[[bench]]` section for ELF (around line 40-42).

**Add:**
```toml
[[bench]]
name = "pe"
harness = false
```

This mirrors the ELF benchmark entry and allows running PE benchmarks with `cargo bench` or `just bench`. No other changes needed as criterion is already a dev-dependency.

### tests/integration_pe.rs(MODIFY)

References: 

- tests/integration_elf.rs
- src/types.rs

Add insta snapshot test for PE import/export extraction, following the exact pattern from `tests/integration_elf.rs`.

**Add Import:** `use insta::assert_snapshot;`

**New Test Function:** `#[test] fn test_pe_symbol_extraction_snapshot() { ... }`

**Implementation:**
1. Read PE fixture from `tests/fixtures/test_binary_pe.exe`
2. Verify PE detection
3. Parse with `PeParser::new().parse()`
4. Format output as multi-line string:
 - `=== IMPORTS ===`
 - `Total: {imports.len()}`
 - For first 10 imports: `Import {i}: {name}`
 - ` Library: {library.unwrap_or("N/A")}`
 - ` Address: 0x{address.unwrap_or(0):x}`
 - If more: `... and {imports.len() - 10} more imports`
 - `=== EXPORTS ===`
 - `Total: {exports.len()}`
 - For first 10 exports: `Export {i}: {name}`
 - ` Address: 0x{address:x}`
 - ` Ordinal: {ordinal.unwrap_or(0)}`
 - If more: `... and {exports.len() - 10} more exports`
5. `assert_snapshot!("pe_symbol_extraction", output);`

**Notes:**
- Handle empty exports (common for EXEs, typical for DLLs)
- Snapshot file: `tests/snapshots/integration_pe__pe_symbol_extraction.snap`
- Run `cargo insta review` post-implementation to accept baseline
- Ensure test skips gracefully if fixture missing, but assume fixture exists after build

### src/container/pe.rs(MODIFY)

References: 

- src/container/elf.rs

Enhance module documentation with comprehensive details on PE-specific implementation.

**Add at Module Top (before `use` statements):** `///` doc comment block:

### Module Overview
- Describe PE format role in Windows ecosystem
- Explain integration with stringy for section prioritization and symbol extraction

### Section Classification Strategy
- Detail `classify_section` logic: characteristics check (e.g., `IMAGE_SCN_CNT_CODE` for Code), then name matching
- List classifications: `.rdata`/`.rodata` → StringData, `.rsrc` → Resources, `.data` (non-writable) → ReadOnlyData, `.data`/`.bss` (writable) → WritableData, `.debug*` → Debug, others → Other

### Section Weight Calculation
- Explain `calculate_section_weight`: StringData (.rdata: 10.0, others: 8.0), Resources: 9.0, ReadOnlyData: 7.0, WritableData: 5.0, Code: 1.0, Debug: 2.0, Other: 1.0
- Rationale: Prioritize read-only string storage over writable/runtime data

### Import/Export Extraction
- Document `extract_imports`: Iterates `pe.imports`, creates `ImportInfo` with name, dll (library), rva (address)
- Document `extract_exports`: Iterates `pe.exports`, handles unnamed via `ordinal_{i}`, uses index as ordinal
- Note: EXEs rarely export; DLLs do. UTF-16LE common in Windows strings

### Integration and Usage
- Example: `let info = PeParser::new().parse(&data)?;`
- Access `info.sections`, `info.imports`, `info.exports`
- Reference future UTF-16 prioritization in extraction

**Format:** Use markdown with code blocks, tables for weights, similar to `src/container/elf.rs` docs.

### docs/src/binary-formats.md(MODIFY)

Expand the PE section (starting ~line 147) to match ELF documentation depth.

**Enhance '### PE-Specific Features':**
- Add import/export table parsing details
- Explain UTF-16LE prevalence and section prioritization

**New Subsection: '### Enhanced Import/Export Extraction':**
- Imports: From PE import directory via `goblin::pe::imports`; each `ImportInfo` has name, library (DLL), RVA
 - Example: `printf` from `msvcrt.dll`
- Exports: From export directory via `goblin::pe::exports`; each `ExportInfo` has name (or `ordinal_{i}`), address, ordinal (index)
 - Note: Primarily for DLLs; EXEs typically empty

**Update '### Implementation Details':**
- Document `extract_imports` and `extract_exports` methods with code snippets
- Detail `classify_section` with characteristics and name matching
- Explain `calculate_section_weight` with PE-specific values

**New Subsection: '### Section Weight Calculation':**
- Table:
 | Section Type | Example Sections | Weight | Rationale |
 |--------------|------------------|--------|-----------|
 | StringData | .rdata, .rodata | 10.0 | Primary string literals |
 | Resources | .rsrc | 9.0 | Version info, UI strings |
 | ReadOnlyData | .data (RO) | 7.0 | Constants, read-only vars |
 | WritableData | .data (RW), .bss | 5.0 | Runtime data, lower priority |
 | Code | .text | 1.0 | Executable code, minimal strings |
 | Debug | .debug*, .pdata | 2.0 | Metadata, some strings |
 | Other | Custom | 1.0 | Unknown, low priority |

**New Subsection: '### Limitations':**
- Resource extraction (VERSIONINFO, etc.) planned but not implemented
- Focus on sections/imports/exports; full resource parsing future work
- Ordinal derivation from index (goblin limitation)
- UTF-16 detection to be handled in extraction pipeline

**Format:** Markdown with code blocks, tables, subsections matching ELF style.

### .kiro/specs/stringy-binary-analyzer/tasks.md(MODIFY)

Mark task 4 as complete and update description to reflect implemented features.

**Location:** Task 4 section (~line 36).

**Changes:**
- Change `[ ]` to `[x]` for task 4
- Update description: 'Implement PE section classification ✅ - Enhanced PE parser with section classification by string likelihood, weight assignment, and import/export table parsing'
- Add completion note: '_Completed: PE section classification, weights, imports/exports extraction, unit/integration tests, benchmarks, snapshots - Issue #3_'
- Keep subtasks 4.1 and 4.2 unchecked (future resource work)
- List implemented features:
 - Section classification for .rdata, .rsrc, .data (RO/RW), .text, .bss, .debug, others
 - Weight calculation: 10.0 (.rdata), 9.0 (.rsrc), etc.
 - Import parsing: DLL names, function names, RVAs
 - Export parsing: function names, addresses, ordinals
 - Unit tests for classification/weights
 - Integration tests for parsing/sections/imports/exports
 - Benchmarks for performance
 - Snapshot tests for symbol extraction
 - Documentation updates

**Format:** Markdown checkboxes, preserve structure.

### justfile(MODIFY)

References: 

- tests/fixtures/test_binary.c

Add recipe to generate PE test fixture from `test_binary.c` using cross-compilation.

**New Recipe:** `build-fixtures-pe` (after build section ~line 200):

[unix]
build-fixtures-pe:
 cd {{ root }}
 # Use zig for cross-compilation to Windows PE
 zig cc tests/fixtures/test_binary.c -o tests/fixtures/test_binary_pe.exe -target x86_64-windows-gnu -rdynamic -shared # Adjust for EXE vs DLL if needed

[windows]
build-fixtures-pe:
 # On Windows, use mingw or cl.exe
 cd {{ root }}
 x86_64-w64-mingw32-gcc tests/fixtures/test_binary.c -o tests/fixtures/test_binary_pe.exe -Wl,--export-all-symbols # For exports

**Notes:**
- Ensure `test_binary.c` includes imports (e.g., #include <stdio.h>, malloc) and exports (e.g., __declspec(dllexport) void exported_function()) for testing
- Add to default build recipe if needed: `build-fixtures: build-fixtures-elf build-fixtures-macho build-fixtures-pe`
- Alternative: Use build.rs with cc crate for automated compilation
- Verify output with `file tests/fixtures/test_binary_pe.exe` (should be PE32+ executable)
Developer Humor

> 🎉 PE parser's all set and grand,\n> Sections classified, imports in hand!\n> Weights assigned with care,\n> Exports ready to share,\n> Now benchmarks show it's lightning-fast! ⚡📊

Execution Information

Branch: main
Commit: 37cfc7c

I have updated the Implementation Plan to reflect the recent changes in the ticket.

Previous Plan

Observations

The core PE section classification and import/export parsing functionality is already fully implemented in src/container/pe.rs. Key features include:\n\n- Comprehensive section classification covering .rdata (StringData, weight 10.0), .rsrc (Resources, 9.0), .data (ReadOnlyData 7.0 or WritableData 5.0 based on characteristics), .text (Code, 1.0), .bss (WritableData), .debug (Debug, 2.0), and others (1.0)\n- Import extraction from pe.imports creating ImportInfo with name, library (DLL), and RVA\n- Export extraction from pe.exports creating ExportInfo with name (fallback to ordinal), address, and ordinal (index-based)\n- Integration into ContainerParser::parse populating ContainerInfo with sections, imports, and exports\n- Unit tests for classification and weight calculation\n- Basic integration tests in tests/integration_pe.rs for parsing and section verification\n\nThe StringSource enum already includes ImportName and ExportName variants (functionally equivalent to requested ImportTable/ExportTable). However, string extraction pipeline (src/extraction/mod.rs) is not yet implemented to utilize these for FoundString sources.\n\nMissing elements from acceptance criteria:\n1. PE-specific benchmarks (only ELF benchmarks exist in benches/elf.rs)\n2. Insta snapshot tests for import/export extraction results\n3. Enhanced module-level documentation in pe.rs\n4. Detailed PE documentation in docs/src/binary-formats.md\n5. Update task tracking in .kiro/specs/stringy-binary-analyzer/tasks.md\n6. PE benchmark configuration in Cargo.toml\n7. PE fixture tests/fixtures/test_binary_pe.exe (referenced in tests but not present; needs generation from test_binary.c using cross-compilation)\n\nThe test fixture compilation for PE requires cross-compilation (e.g., using zig or mingw), which should be added to a build script or justfile recipe.

Approach

To complete the PE implementation per acceptance criteria while building on existing functionality:\n\n1. Fixture Generation: Add a justfile recipe or build.rs to cross-compile test_binary.c to PE format using mingw-w64 or zig, ensuring the fixture includes imports (printf, malloc) and exports (exported_function).\n2. Benchmarks: Create benches/pe.rs mirroring benches/elf.rs with criterion benchmarks for full parsing, import extraction, and export extraction using the PE fixture.\n3. Snapshot Tests: Enhance tests/integration_pe.rs with an insta snapshot test for formatted import/export output, following the ELF pattern.\n4. Documentation: Add comprehensive module docs to src/container/pe.rs covering classification strategy, weight calculation, and import/export details. Expand the PE section in docs/src/binary-formats.md with implementation specifics, weight table, and limitations.\n5. Project Tracking: Update .kiro/specs/stringy-binary-analyzer/tasks.md to mark task 4 as complete, noting implemented features.\n6. Cargo Config: Add [[bench]] entry for PE in Cargo.toml to enable cargo bench.\n7. StringSource Alignment: Consider renaming ImportName/ExportName to ImportTable/ExportTable in src/types.rs for exact match, but current variants are sufficient.\n\nEnsure all changes maintain existing test coverage and follow ELF/Mach-O patterns for consistency.

Reasoning

I listed the repository directory structure to understand the project layout, read src/container/pe.rs to examine the existing PE parser implementation including section classification, weight calculation, and import/export extraction methods, reviewed src/types.rs to confirm StringSource variants and data structures, inspected tests/integration_pe.rs for current integration tests and fixture usage, checked src/extraction/mod.rs to assess integration with string extraction pipeline, examined docs/src/binary-formats.md for existing PE documentation, reviewed .kiro/specs/stringy-binary-analyzer/tasks.md for task status, and analyzed justfile for build recipes to identify fixture generation needs.

Proposed File Changes

📄 benches/pe.rs ^(NEW) 🔗

References

📄 benches/elf.rs

📄 src/container/pe.rs ^(MODIFY)

📄 tests/fixtures/test_binary_pe.exe

Create PE benchmark suite following the exact structure and patterns from benches/elf.rs.

Imports:

use criterion::{black_box, criterion_group, criterion_main, Criterion};

use std::fs;

use stringy::container::{ContainerParser, PeParser};

Benchmark Functions:

fn bench_pe_full_parse(c: &mut Criterion):

Read PE fixture from tests/fixtures/test_binary_pe.exe

Verify PE detection with PeParser::detect

Time full parser.parse() operation

Use black_box on input and output to prevent optimization

Early return if not PE

Group name: benches::pe::full_parse

fn bench_pe_imports_extraction(c: &mut Criterion):

Parse the PE binary

Extract and count imports

Filter imports by library (e.g., msvcrt.dll)

Use black_box on results

Group name: benches::pe::imports

fn bench_pe_exports_extraction(c: &mut Criterion):

Parse the PE binary

Extract and count exports

Use black_box on results

Group name: benches::pe::exports

Configuration:

criterion_group! { name = benches; value = (bench_pe_full_parse, bench_pe_imports_extraction, bench_pe_exports_extraction); }

criterion_main!(benches);

Notes:

Include println! for debug output similar to ELF benchmarks

Handle fixture reading errors with descriptive messages

Ensure cross-platform compatibility by checking fixture existence
📄 Cargo.toml ^(MODIFY) 🔗
References

📄 benches/elf.rs

Add PE benchmark configuration to enable discovery by Cargo.

Location: After the existing [[bench]] section for ELF (around line 40-42).

Add:
[[bench]]
name = "pe"
harness = false
This mirrors the ELF benchmark entry and allows running PE benchmarks with cargo bench or just bench. No other changes needed as criterion is already a dev-dependency.
📄 tests/integration_pe.rs ^(MODIFY) 🔗

References

📄 tests/integration_elf.rs

📄 src/types.rs

Add insta snapshot test for PE import/export extraction, following the exact pattern from tests/integration_elf.rs.

Add Import: use insta::assert_snapshot;

New Test Function: #[test] fn test_pe_symbol_extraction_snapshot() { ... }

Implementation:

Read PE fixture from tests/fixtures/test_binary_pe.exe

Verify PE detection

Parse with PeParser::new().parse()

Format output as multi-line string:

=== IMPORTS ===

Total: {imports.len()}

For first 10 imports: Import {i}: {name}

Library: {library.unwrap_or("N/A")}

Address: 0x{address.unwrap_or(0):x}

If more: ... and {imports.len() - 10} more imports

=== EXPORTS ===

Total: {exports.len()}

For first 10 exports: Export {i}: {name}

Address: 0x{address:x}

Ordinal: {ordinal.unwrap_or(0)}

If more: ... and {exports.len() - 10} more exports

assert_snapshot!("pe_symbol_extraction", output);

Notes:

Handle empty exports (common for EXEs, typical for DLLs)

Snapshot file: tests/snapshots/integration_pe__pe_symbol_extraction.snap

Run cargo insta review post-implementation to accept baseline

Ensure test skips gracefully if fixture missing, but assume fixture exists after build

📄 src/container/pe.rs ^(MODIFY) 🔗

References

📄 src/container/elf.rs

Enhance module documentation with comprehensive details on PE-specific implementation.

Add at Module Top (before use statements): /// doc comment block:

Module Overview

Describe PE format role in Windows ecosystem

Explain integration with stringy for section prioritization and symbol extraction

Section Classification Strategy

Detail classify_section logic: characteristics check (e.g., IMAGE_SCN_CNT_CODE for Code), then name matching

List classifications: .rdata/.rodata → StringData, .rsrc → Resources, .data (non-writable) → ReadOnlyData, .data/.bss (writable) → WritableData, .debug* → Debug, others → Other

Section Weight Calculation

Explain calculate_section_weight: StringData (.rdata: 10.0, others: 8.0), Resources: 9.0, ReadOnlyData: 7.0, WritableData: 5.0, Code: 1.0, Debug: 2.0, Other: 1.0

Rationale: Prioritize read-only string storage over writable/runtime data

Import/Export Extraction

Document extract_imports: Iterates pe.imports, creates ImportInfo with name, dll (library), rva (address)

Document extract_exports: Iterates pe.exports, handles unnamed via ordinal_{i}, uses index as ordinal

Note: EXEs rarely export; DLLs do. UTF-16LE common in Windows strings

Integration and Usage

Example: let info = PeParser::new().parse(&data)?;

Access info.sections, info.imports, info.exports

Reference future UTF-16 prioritization in extraction

Format: Use markdown with code blocks, tables for weights, similar to src/container/elf.rs docs.

📄 docs/src/binary-formats.md ^(MODIFY) 🔗

Expand the PE section (starting ~line 147) to match ELF documentation depth.

Enhance '### PE-Specific Features':

Add import/export table parsing details

Explain UTF-16LE prevalence and section prioritization

New Subsection: '### Enhanced Import/Export Extraction':

Imports: From PE import directory via goblin::pe::imports; each ImportInfo has name, library (DLL), RVA

Example: printf from msvcrt.dll

Exports: From export directory via goblin::pe::exports; each ExportInfo has name (or ordinal_{i}), address, ordinal (index)

Note: Primarily for DLLs; EXEs typically empty

Update '### Implementation Details':

Document extract_imports and extract_exports methods with code snippets

Detail classify_section with characteristics and name matching

Explain calculate_section_weight with PE-specific values

New Subsection: '### Section Weight Calculation':

Table:

Section Type Example Sections Weight Rationale

StringData .rdata, .rodata 10.0 Primary string literals

Resources .rsrc 9.0 Version info, UI strings

ReadOnlyData .data (RO) 7.0 Constants, read-only vars

WritableData .data (RW), .bss 5.0 Runtime data, lower priority

Code .text 1.0 Executable code, minimal strings

Debug .debug*, .pdata 2.0 Metadata, some strings

Other Custom 1.0 Unknown, low priority

New Subsection: '### Limitations':

Resource extraction (VERSIONINFO, etc.) planned but not implemented

Focus on sections/imports/exports; full resource parsing future work

Ordinal derivation from index (goblin limitation)

UTF-16 detection to be handled in extraction pipeline

Format: Markdown with code blocks, tables, subsections matching ELF style.

📄 .kiro/specs/stringy-binary-analyzer/tasks.md ^(MODIFY) 🔗

Mark task 4 as complete and update description to reflect implemented features.

Location: Task 4 section (~line 36).

Changes:

Change [ ] to [x] for task 4

Update description: 'Implement PE section classification ✅ - Enhanced PE parser with section classification by string likelihood, weight assignment, and import/export table parsing'

Add completion note: 'Completed: PE section classification, weights, imports/exports extraction, unit/integration tests, benchmarks, snapshots - Issue Implement PE Section Classification and Import/Export Table Parsing #3'

Keep subtasks 4.1 and 4.2 unchecked (future resource work)

List implemented features:

Section classification for .rdata, .rsrc, .data (RO/RW), .text, .bss, .debug, others

Weight calculation: 10.0 (.rdata), 9.0 (.rsrc), etc.

Import parsing: DLL names, function names, RVAs

Export parsing: function names, addresses, ordinals

Unit tests for classification/weights

Integration tests for parsing/sections/imports/exports

Benchmarks for performance

Snapshot tests for symbol extraction

Documentation updates

Format: Markdown checkboxes, preserve structure.

📄 justfile ^(MODIFY) 🔗

References

📄 tests/fixtures/test_binary.c

Add recipe to generate PE test fixture from test_binary.c using cross-compilation.

New Recipe: build-fixtures-pe (after build section ~line 200):

[unix]
build-fixtures-pe:
cd {{ root }}
# Use zig for cross-compilation to Windows PE
zig cc tests/fixtures/test_binary.c -o tests/fixtures/test_binary_pe.exe -target x86_64-windows-gnu -rdynamic -shared # Adjust for EXE vs DLL if needed

[windows]
build-fixtures-pe:
# On Windows, use mingw or cl.exe
cd {{ root }}
x86_64-w64-mingw32-gcc tests/fixtures/test_binary.c -o tests/fixtures/test_binary_pe.exe -Wl,--export-all-symbols # For exports

Notes:

Ensure test_binary.c includes imports (e.g., #include <stdio.h>, malloc) and exports (e.g., __declspec(dllexport) void exported_function()) for testing

Add to default build recipe if needed: build-fixtures: build-fixtures-elf build-fixtures-macho build-fixtures-pe

Alternative: Use build.rs with cc crate for automated compilation

Verify output with file tests/fixtures/test_binary_pe.exe (should be PE32+ executable)

Import In IDE
🤖 Prompt for AI Agents
I have created the following plan after thorough exploration and analysis of the codebase. Follow the below plan verbatim. Trust the files and references. Do not re-verify what's written in the plan. Explore only when absolutely necessary. First implement all the proposed file changes and then I'll review all the changes together at the end.

### Observations

The core PE section classification and import/export parsing functionality is already fully implemented in `src/container/pe.rs`. Key features include:\n\n- Comprehensive section classification covering `.rdata` (StringData, weight 10.0), `.rsrc` (Resources, 9.0), `.data` (ReadOnlyData 7.0 or WritableData 5.0 based on characteristics), `.text` (Code, 1.0), `.bss` (WritableData), `.debug` (Debug, 2.0), and others (1.0)\n- Import extraction from `pe.imports` creating `ImportInfo` with name, library (DLL), and RVA\n- Export extraction from `pe.exports` creating `ExportInfo` with name (fallback to ordinal), address, and ordinal (index-based)\n- Integration into `ContainerParser::parse` populating `ContainerInfo` with sections, imports, and exports\n- Unit tests for classification and weight calculation\n- Basic integration tests in `tests/integration_pe.rs` for parsing and section verification\n\nThe `StringSource` enum already includes `ImportName` and `ExportName` variants (functionally equivalent to requested `ImportTable`/`ExportTable`). However, string extraction pipeline (`src/extraction/mod.rs`) is not yet implemented to utilize these for `FoundString` sources.\n\nMissing elements from acceptance criteria:\n1. PE-specific benchmarks (only ELF benchmarks exist in `benches/elf.rs`)\n2. Insta snapshot tests for import/export extraction results\n3. Enhanced module-level documentation in `pe.rs`\n4. Detailed PE documentation in `docs/src/binary-formats.md`\n5. Update task tracking in `.kiro/specs/stringy-binary-analyzer/tasks.md`\n6. PE benchmark configuration in `Cargo.toml`\n7. PE fixture `tests/fixtures/test_binary_pe.exe` (referenced in tests but not present; needs generation from `test_binary.c` using cross-compilation)\n\nThe test fixture compilation for PE requires cross-compilation (e.g., using `zig` or `mingw`), which should be added to a build script or justfile recipe.

### Approach

To complete the PE implementation per acceptance criteria while building on existing functionality:\n\n1. **Fixture Generation**: Add a justfile recipe or build.rs to cross-compile `test_binary.c` to PE format using mingw-w64 or zig, ensuring the fixture includes imports (printf, malloc) and exports (exported_function).\n2. **Benchmarks**: Create `benches/pe.rs` mirroring `benches/elf.rs` with criterion benchmarks for full parsing, import extraction, and export extraction using the PE fixture.\n3. **Snapshot Tests**: Enhance `tests/integration_pe.rs` with an insta snapshot test for formatted import/export output, following the ELF pattern.\n4. **Documentation**: Add comprehensive module docs to `src/container/pe.rs` covering classification strategy, weight calculation, and import/export details. Expand the PE section in `docs/src/binary-formats.md` with implementation specifics, weight table, and limitations.\n5. **Project Tracking**: Update `.kiro/specs/stringy-binary-analyzer/tasks.md` to mark task 4 as complete, noting implemented features.\n6. **Cargo Config**: Add `[[bench]]` entry for PE in `Cargo.toml` to enable `cargo bench`.\n7. **StringSource Alignment**: Consider renaming `ImportName`/`ExportName` to `ImportTable`/`ExportTable` in `src/types.rs` for exact match, but current variants are sufficient.\n\nEnsure all changes maintain existing test coverage and follow ELF/Mach-O patterns for consistency.

### Reasoning

I listed the repository directory structure to understand the project layout, read `src/container/pe.rs` to examine the existing PE parser implementation including section classification, weight calculation, and import/export extraction methods, reviewed `src/types.rs` to confirm `StringSource` variants and data structures, inspected `tests/integration_pe.rs` for current integration tests and fixture usage, checked `src/extraction/mod.rs` to assess integration with string extraction pipeline, examined `docs/src/binary-formats.md` for existing PE documentation, reviewed `.kiro/specs/stringy-binary-analyzer/tasks.md` for task status, and analyzed `justfile` for build recipes to identify fixture generation needs.

## Proposed File Changes

### benches/pe.rs(NEW)

References: 

- benches/elf.rs
- src/container/pe.rs(MODIFY)
- tests/fixtures/test_binary_pe.exe

Create PE benchmark suite following the exact structure and patterns from `benches/elf.rs`.

**Imports:**
- `use criterion::{black_box, criterion_group, criterion_main, Criterion};`
- `use std::fs;`
- `use stringy::container::{ContainerParser, PeParser};`

**Benchmark Functions:**

1. `fn bench_pe_full_parse(c: &mut Criterion)`:
 - Read PE fixture from `tests/fixtures/test_binary_pe.exe`
 - Verify PE detection with `PeParser::detect`
 - Time full `parser.parse()` operation
 - Use `black_box` on input and output to prevent optimization
 - Early return if not PE
 - Group name: `benches::pe::full_parse`

2. `fn bench_pe_imports_extraction(c: &mut Criterion)`:
 - Parse the PE binary
 - Extract and count imports
 - Filter imports by library (e.g., msvcrt.dll)
 - Use `black_box` on results
 - Group name: `benches::pe::imports`

3. `fn bench_pe_exports_extraction(c: &mut Criterion)`:
 - Parse the PE binary
 - Extract and count exports
 - Use `black_box` on results
 - Group name: `benches::pe::exports`

**Configuration:**
- `criterion_group! { name = benches; value = (bench_pe_full_parse, bench_pe_imports_extraction, bench_pe_exports_extraction); }`
- `criterion_main!(benches);`

**Notes:**
- Include `println!` for debug output similar to ELF benchmarks
- Handle fixture reading errors with descriptive messages
- Ensure cross-platform compatibility by checking fixture existence

### Cargo.toml(MODIFY)

References: 

- benches/elf.rs

Add PE benchmark configuration to enable discovery by Cargo.

**Location:** After the existing `[[bench]]` section for ELF (around line 40-42).

**Add:**
```toml
[[bench]]
name = "pe"
harness = false
```

This mirrors the ELF benchmark entry and allows running PE benchmarks with `cargo bench` or `just bench`. No other changes needed as criterion is already a dev-dependency.

### tests/integration_pe.rs(MODIFY)

References: 

- tests/integration_elf.rs
- src/types.rs

Add insta snapshot test for PE import/export extraction, following the exact pattern from `tests/integration_elf.rs`.

**Add Import:** `use insta::assert_snapshot;`

**New Test Function:** `#[test] fn test_pe_symbol_extraction_snapshot() { ... }`

**Implementation:**
1. Read PE fixture from `tests/fixtures/test_binary_pe.exe`
2. Verify PE detection
3. Parse with `PeParser::new().parse()`
4. Format output as multi-line string:
 - `=== IMPORTS ===`
 - `Total: {imports.len()}`
 - For first 10 imports: `Import {i}: {name}`
 - ` Library: {library.unwrap_or("N/A")}`
 - ` Address: 0x{address.unwrap_or(0):x}`
 - If more: `... and {imports.len() - 10} more imports`
 - `=== EXPORTS ===`
 - `Total: {exports.len()}`
 - For first 10 exports: `Export {i}: {name}`
 - ` Address: 0x{address:x}`
 - ` Ordinal: {ordinal.unwrap_or(0)}`
 - If more: `... and {exports.len() - 10} more exports`
5. `assert_snapshot!("pe_symbol_extraction", output);`

**Notes:**
- Handle empty exports (common for EXEs, typical for DLLs)
- Snapshot file: `tests/snapshots/integration_pe__pe_symbol_extraction.snap`
- Run `cargo insta review` post-implementation to accept baseline
- Ensure test skips gracefully if fixture missing, but assume fixture exists after build

### src/container/pe.rs(MODIFY)

References: 

- src/container/elf.rs

Enhance module documentation with comprehensive details on PE-specific implementation.

**Add at Module Top (before `use` statements):** `///` doc comment block:

### Module Overview
- Describe PE format role in Windows ecosystem
- Explain integration with stringy for section prioritization and symbol extraction

### Section Classification Strategy
- Detail `classify_section` logic: characteristics check (e.g., `IMAGE_SCN_CNT_CODE` for Code), then name matching
- List classifications: `.rdata`/`.rodata` → StringData, `.rsrc` → Resources, `.data` (non-writable) → ReadOnlyData, `.data`/`.bss` (writable) → WritableData, `.debug*` → Debug, others → Other

### Section Weight Calculation
- Explain `calculate_section_weight`: StringData (.rdata: 10.0, others: 8.0), Resources: 9.0, ReadOnlyData: 7.0, WritableData: 5.0, Code: 1.0, Debug: 2.0, Other: 1.0
- Rationale: Prioritize read-only string storage over writable/runtime data

### Import/Export Extraction
- Document `extract_imports`: Iterates `pe.imports`, creates `ImportInfo` with name, dll (library), rva (address)
- Document `extract_exports`: Iterates `pe.exports`, handles unnamed via `ordinal_{i}`, uses index as ordinal
- Note: EXEs rarely export; DLLs do. UTF-16LE common in Windows strings

### Integration and Usage
- Example: `let info = PeParser::new().parse(&data)?;`
- Access `info.sections`, `info.imports`, `info.exports`
- Reference future UTF-16 prioritization in extraction

**Format:** Use markdown with code blocks, tables for weights, similar to `src/container/elf.rs` docs.

### docs/src/binary-formats.md(MODIFY)

Expand the PE section (starting ~line 147) to match ELF documentation depth.

**Enhance '### PE-Specific Features':**
- Add import/export table parsing details
- Explain UTF-16LE prevalence and section prioritization

**New Subsection: '### Enhanced Import/Export Extraction':**
- Imports: From PE import directory via `goblin::pe::imports`; each `ImportInfo` has name, library (DLL), RVA
 - Example: `printf` from `msvcrt.dll`
- Exports: From export directory via `goblin::pe::exports`; each `ExportInfo` has name (or `ordinal_{i}`), address, ordinal (index)
 - Note: Primarily for DLLs; EXEs typically empty

**Update '### Implementation Details':**
- Document `extract_imports` and `extract_exports` methods with code snippets
- Detail `classify_section` with characteristics and name matching
- Explain `calculate_section_weight` with PE-specific values

**New Subsection: '### Section Weight Calculation':**
- Table:
 | Section Type | Example Sections | Weight | Rationale |
 |--------------|------------------|--------|-----------|
 | StringData | .rdata, .rodata | 10.0 | Primary string literals |
 | Resources | .rsrc | 9.0 | Version info, UI strings |
 | ReadOnlyData | .data (RO) | 7.0 | Constants, read-only vars |
 | WritableData | .data (RW), .bss | 5.0 | Runtime data, lower priority |
 | Code | .text | 1.0 | Executable code, minimal strings |
 | Debug | .debug*, .pdata | 2.0 | Metadata, some strings |
 | Other | Custom | 1.0 | Unknown, low priority |

**New Subsection: '### Limitations':**
- Resource extraction (VERSIONINFO, etc.) planned but not implemented
- Focus on sections/imports/exports; full resource parsing future work
- Ordinal derivation from index (goblin limitation)
- UTF-16 detection to be handled in extraction pipeline

**Format:** Markdown with code blocks, tables, subsections matching ELF style.

### .kiro/specs/stringy-binary-analyzer/tasks.md(MODIFY)

Mark task 4 as complete and update description to reflect implemented features.

**Location:** Task 4 section (~line 36).

**Changes:**
- Change `[ ]` to `[x]` for task 4
- Update description: 'Implement PE section classification ✅ - Enhanced PE parser with section classification by string likelihood, weight assignment, and import/export table parsing'
- Add completion note: '_Completed: PE section classification, weights, imports/exports extraction, unit/integration tests, benchmarks, snapshots - Issue #3_'
- Keep subtasks 4.1 and 4.2 unchecked (future resource work)
- List implemented features:
 - Section classification for .rdata, .rsrc, .data (RO/RW), .text, .bss, .debug, others
 - Weight calculation: 10.0 (.rdata), 9.0 (.rsrc), etc.
 - Import parsing: DLL names, function names, RVAs
 - Export parsing: function names, addresses, ordinals
 - Unit tests for classification/weights
 - Integration tests for parsing/sections/imports/exports
 - Benchmarks for performance
 - Snapshot tests for symbol extraction
 - Documentation updates

**Format:** Markdown checkboxes, preserve structure.

### justfile(MODIFY)

References: 

- tests/fixtures/test_binary.c

Add recipe to generate PE test fixture from `test_binary.c` using cross-compilation.

**New Recipe:** `build-fixtures-pe` (after build section ~line 200):

[unix]
build-fixtures-pe:
 cd {{ root }}
 # Use zig for cross-compilation to Windows PE
 zig cc tests/fixtures/test_binary.c -o tests/fixtures/test_binary_pe.exe -target x86_64-windows-gnu -rdynamic -shared # Adjust for EXE vs DLL if needed

[windows]
build-fixtures-pe:
 # On Windows, use mingw or cl.exe
 cd {{ root }}
 x86_64-w64-mingw32-gcc tests/fixtures/test_binary.c -o tests/fixtures/test_binary_pe.exe -Wl,--export-all-symbols # For exports

**Notes:**
- Ensure `test_binary.c` includes imports (e.g., #include <stdio.h>, malloc) and exports (e.g., __declspec(dllexport) void exported_function()) for testing
- Add to default build recipe if needed: `build-fixtures: build-fixtures-elf build-fixtures-macho build-fixtures-pe`
- Alternative: Use build.rs with cc crate for automated compilation
- Verify output with `file tests/fixtures/test_binary_pe.exe` (should be PE32+ executable)
Developer Humor

> 🎉 PE parser's all set and grand,\n> Sections classified, imports in hand!\n> Weights assigned with care,\n> Exports ready to share,\n> Now benchmarks show it's lightning-fast! ⚡📊

Execution Information

Branch: main
Commit: 37cfc7c
New Plan

Observations

The PE parser in src/container/pe.rs already implements comprehensive section classification (.rdata as StringData weight 10.0, .rsrc Resources 9.0, etc.), import extraction from pe.imports (with DLL, RVA, ordinal handling), and export extraction from pe.exports (with base ordinal calculation, forwarded exports). Unit tests cover classification and weights. Integration tests in tests/integration_pe.rs verify parsing, sections, and include an insta snapshot for symbols. StringSource uses ImportName/ExportName (needs rename to ImportTable/ExportTable). Missing: PE benchmarks, fixture build recipe, Cargo.toml bench config, task update, expanded docs in binary-formats.md.

Approach

Complete PE implementation per acceptance criteria:\n\n1. Rename ImportName/ExportName to ImportTable/ExportTable in types.rs for exact match.\n2. Add benches/pe.rs with criterion benchmarks for parsing, imports, exports mirroring ELF.\n3. Add [[bench]] for PE in Cargo.toml.\n4. Enhance justfile with build-fixtures-pe recipe using zig/mingw for test_binary_pe.exe from test_binary.c.\n5. Expand PE docs in docs/src/binary-formats.md with weights table, import/export details.\n6. Update .kiro/specs/.../tasks.md marking task 4 complete.\n7. Ensure high scores for import/export strings via weights (already integrated).\n\nMaintain existing tests/docs; run clippy/CI post-changes.

Reasoning

I examined the repository structure to locate key files, read src/container/pe.rs to assess existing PE parser features including classification, weights, and symbol extraction, reviewed src/types.rs for StringSource variants, inspected tests/integration_pe.rs for current tests and snapshots, listed benches directory to confirm missing PE benchmarks, and checked for documentation and task files to identify completion gaps.

Proposed File Changes

📄 src/types.rs ^(MODIFY) 🔗

References

📄 src/container/pe.rs

Rename ImportName and ExportName variants in StringSource enum to ImportTable and ExportTable respectively for precise terminology matching acceptance criteria.

Location: Around line 66-68 in the StringSource enum definition.

Changes:

Change ImportName, to ImportTable,

Change ExportName, to ExportTable,

Update the doc comment above to reflect: /// String from import table and /// String from export table

No other changes needed; this aligns with import/export table parsing focus. Preserve serialization and all other variants.

📄 benches/pe.rs ^(MODIFY) 🔗

References

📄 benches/elf.rs

📄 tests/fixtures/test_binary_pe.exe

Create new PE benchmark file mirroring benches/elf.rs structure.

Imports:

use criterion::{black_box, criterion_group, criterion_main, Criterion};

use std::fs;

use stringy::container::{ContainerParser, PeParser};

Benchmark Functions:

fn bench_pe_full_parse(c: &mut Criterion): Load tests/fixtures/test_binary_pe.exe, detect PE, time parse(), black_box input/output.

fn bench_pe_imports(c: &mut Criterion): Parse, extract/count imports, black_box results.

fn bench_pe_exports(c: &mut Criterion): Parse, extract/count exports, black_box results.

Group and Main:

criterion_group! { name = benches; value = (bench_pe_full_parse, bench_pe_imports, bench_pe_exports); }

criterion_main!(benches);

Include debug prints like ELF; handle fixture errors.
📄 Cargo.toml ^(MODIFY) 🔗
References

📄 benches/elf.rs

Add PE benchmark configuration.

Location: After existing [[bench]] for elf (around line 40).

Add:
[[bench]]
name = "pe"
harness = false
Enables cargo bench --bench pe; criterion already in dev-deps.
📄 justfile ^(MODIFY) 🔗

References

📄 tests/fixtures/test_binary.c

Add recipe for building PE fixture.

New Recipe: build-fixtures-pe after existing build sections.

For Unix:
zig cc tests/fixtures/test_binary.c -o tests/fixtures/test_binary_pe.exe -target x86_64-windows-gnu

For Windows:
x86_64-w64-mingw32-gcc tests/fixtures/test_binary.c -o tests/fixtures/test_binary_pe.exe

Update default build-fixtures to include build-fixtures-pe. Ensure test_binary.c has imports/exports for testing.

📄 docs/src/binary-formats.md ^(MODIFY) 🔗

References

📄 src/container/pe.rs

Expand PE section with implementation details.

Enhance: Add subsections for section classification (name/characteristics logic), weight table (|Type|Sections|Weight|Rationale|), import extraction (DLL/function/RVA), export extraction (name/address/ordinal/forwarders).

Add: Limitations (UTF-16 future, resources partial), examples using PeParser::parse.

Match ELF/Mach-O doc style with markdown tables/code blocks.

📄 .kiro/specs/stringy-binary-analyzer/tasks.md ^(MODIFY) 🔗

Update task 4 status.

Changes: Mark [x] for task 4, update description to note completion of classification, weights, imports/exports. List implemented features: sections (.rdata 10.0 etc.), parsing, tests, benchmarks, snapshots, docs. Keep subtasks open if any.

Import In IDE
🤖 Prompt for AI Agents
I have created the following plan after thorough exploration and analysis of the codebase. Follow the below plan verbatim. Trust the files and references. Do not re-verify what's written in the plan. Explore only when absolutely necessary. First implement all the proposed file changes and then I'll review all the changes together at the end.

### Observations

The PE parser in `src/container/pe.rs` already implements comprehensive section classification (`.rdata` as StringData weight 10.0, `.rsrc` Resources 9.0, etc.), import extraction from `pe.imports` (with DLL, RVA, ordinal handling), and export extraction from `pe.exports` (with base ordinal calculation, forwarded exports). Unit tests cover classification and weights. Integration tests in `tests/integration_pe.rs` verify parsing, sections, and include an insta snapshot for symbols. `StringSource` uses `ImportName`/`ExportName` (needs rename to `ImportTable`/`ExportTable`). Missing: PE benchmarks, fixture build recipe, `Cargo.toml` bench config, task update, expanded docs in `binary-formats.md`.

### Approach

Complete PE implementation per acceptance criteria:\n\n1. Rename `ImportName`/`ExportName` to `ImportTable`/`ExportTable` in `types.rs` for exact match.\n2. Add `benches/pe.rs` with criterion benchmarks for parsing, imports, exports mirroring ELF.\n3. Add `[[bench]]` for PE in `Cargo.toml`.\n4. Enhance `justfile` with `build-fixtures-pe` recipe using zig/mingw for `test_binary_pe.exe` from `test_binary.c`.\n5. Expand PE docs in `docs/src/binary-formats.md` with weights table, import/export details.\n6. Update `.kiro/specs/.../tasks.md` marking task 4 complete.\n7. Ensure high scores for import/export strings via weights (already integrated).\n\nMaintain existing tests/docs; run clippy/CI post-changes.

### Reasoning

I examined the repository structure to locate key files, read `src/container/pe.rs` to assess existing PE parser features including classification, weights, and symbol extraction, reviewed `src/types.rs` for `StringSource` variants, inspected `tests/integration_pe.rs` for current tests and snapshots, listed benches directory to confirm missing PE benchmarks, and checked for documentation and task files to identify completion gaps.

## Proposed File Changes

### src/types.rs(MODIFY)

References: 

- src/container/pe.rs

Rename `ImportName` and `ExportName` variants in `StringSource` enum to `ImportTable` and `ExportTable` respectively for precise terminology matching acceptance criteria.

**Location:** Around line 66-68 in the `StringSource` enum definition.

**Changes:**
- Change `ImportName,` to `ImportTable,`
- Change `ExportName,` to `ExportTable,`
- Update the doc comment above to reflect: `/// String from import table` and `/// String from export table`

No other changes needed; this aligns with import/export table parsing focus. Preserve serialization and all other variants.

### benches/pe.rs(MODIFY)

References: 

- benches/elf.rs
- tests/fixtures/test_binary_pe.exe

Create new PE benchmark file mirroring `benches/elf.rs` structure.

**Imports:**
- `use criterion::{black_box, criterion_group, criterion_main, Criterion};`
- `use std::fs;`
- `use stringy::container::{ContainerParser, PeParser};`

**Benchmark Functions:**
1. `fn bench_pe_full_parse(c: &mut Criterion)`: Load `tests/fixtures/test_binary_pe.exe`, detect PE, time `parse()`, black_box input/output.
2. `fn bench_pe_imports(c: &mut Criterion)`: Parse, extract/count imports, black_box results.
3. `fn bench_pe_exports(c: &mut Criterion)`: Parse, extract/count exports, black_box results.

**Group and Main:**
- `criterion_group! { name = benches; value = (bench_pe_full_parse, bench_pe_imports, bench_pe_exports); }`
- `criterion_main!(benches);`

Include debug prints like ELF; handle fixture errors.

### Cargo.toml(MODIFY)

References: 

- benches/elf.rs

Add PE benchmark configuration.

**Location:** After existing `[[bench]]` for elf (around line 40).

**Add:**
```toml
[[bench]]
name = "pe"
harness = false
```

Enables `cargo bench --bench pe`; criterion already in dev-deps.

### justfile(MODIFY)

References: 

- tests/fixtures/test_binary.c

Add recipe for building PE fixture.

**New Recipe:** `build-fixtures-pe` after existing build sections.

For Unix:
zig cc tests/fixtures/test_binary.c -o tests/fixtures/test_binary_pe.exe -target x86_64-windows-gnu

For Windows:
x86_64-w64-mingw32-gcc tests/fixtures/test_binary.c -o tests/fixtures/test_binary_pe.exe

Update default `build-fixtures` to include `build-fixtures-pe`. Ensure `test_binary.c` has imports/exports for testing.

### docs/src/binary-formats.md(MODIFY)

References: 

- src/container/pe.rs

Expand PE section with implementation details.

**Enhance:** Add subsections for section classification (name/characteristics logic), weight table (|Type|Sections|Weight|Rationale|), import extraction (DLL/function/RVA), export extraction (name/address/ordinal/forwarders).

**Add:** Limitations (UTF-16 future, resources partial), examples using `PeParser::parse`.

Match ELF/Mach-O doc style with markdown tables/code blocks.

### .kiro/specs/stringy-binary-analyzer/tasks.md(MODIFY)

Update task 4 status.

**Changes:** Mark `[x]` for task 4, update description to note completion of classification, weights, imports/exports. List implemented features: sections (.rdata 10.0 etc.), parsing, tests, benchmarks, snapshots, docs. Keep subtasks open if any.
Developer Humor

> Why did the PE parser go to therapy?\n> It had too many unresolved imports and couldn't export its feelings! 😂

Execution Information

Branch: 3-implement-pe-section-classification-and-importexport-table-parsing
Commit: 5ac6f0c

Section Type	Example Sections	Weight	Rationale
StringData	.rdata, .rodata	10.0	Primary string literals
Resources	.rsrc	9.0	Version info, UI strings
ReadOnlyData	.data (RO)	7.0	Constants, read-only vars
WritableData	.data (RW), .bss	5.0	Runtime data, lower priority
Code	.text	1.0	Executable code, minimal strings
Debug	.debug*, .pdata	2.0	Metadata, some strings
Other	Custom	1.0	Unknown, low priority

Implement PE Section Classification and Import/Export Table Parsing #3

Description

Summary

Context

Proposed Solution

1. Section Classification Enhancement

2. Import/Export Table Parsing

3. Integration Points

Technical Requirements

Dependencies

Performance Considerations

Acceptance Criteria

Test Cases

Unit Tests

Integration Tests

Snapshot Tests (insta)

Related Work

References

Activity

unclesp1d3r commented on Sep 30, 2025

coderabbitai commented on Sep 30, 2025

What Was Updated

✅ Title Enhanced

✅ Body Enhanced With

✅ Metadata

unclesp1d3r commented on Nov 10, 2025

coderabbitai commented on Nov 10, 2025

unclesp1d3r commented on Nov 10, 2025

traycerai commented on Nov 10, 2025

Observations

Approach

Reasoning

Proposed File Changes

Diagram

Import In IDE

Developer Humor

traycerai commented on Nov 10, 2025

Plan

Observations

Approach

Reasoning

Proposed File Changes

Import In IDE

Developer Humor

Supported Commands (Inside Comments)

Supported Commands (Inside Description)

Community

traycerai commented on Nov 10, 2025

Observations

Approach

Reasoning

Proposed File Changes

Diagram

Import In IDE

Developer Humor

Observations

Approach

Reasoning

Proposed File Changes

Module Overview

Section Classification Strategy

Section Weight Calculation

Import/Export Extraction

Integration and Usage

Import In IDE

Developer Humor

traycerai commented on Nov 10, 2025

Observations

Approach

Reasoning

Proposed File Changes

Module Overview

Section Classification Strategy

Section Weight Calculation

Import/Export Extraction

Integration and Usage

Import In IDE

Developer Humor

Observations

Approach