AwesomeREA.org

Tool

goblin

Rust crate for zero-copy, endian-aware parsing of ELF32/64, 32/64-bit Mach-O and multi-architecture fat containers, PE32/PE32+, COFF objects, Terse Executable (TE) images and Unix/BSD archives; Object::parse picks the format from its magic bytes. Parsed structures cover ELF headers, sections, symbols, dynamic entries, relocations and notes, Mach-O load commands, imports and exports, and PE imports, exports, relocations, TLS, resources, exception and unwind data, Authenticode certificates and the .NET CLR header. Feature flags can reduce it to std-free #[repr(C)] struct definitions for kernels and other no_std code.

Requirements and limitations

  • Latest tag at review: 0.10.6 (also tagged v0.10.6) on the 2026-05-25 version-bump commit; the project publishes no GitHub releases. crates.io also lists 0.10.7, published 2026-05-28, which has no matching tag or changelog entry. The reviewed master commit (2026-08-30) still declares 0.10.6, and this entry pins it for documentation only.
  • Used as a Cargo dependency; it needs rustc 1.85.0+ (Rust 2024 edition) and depends on plain, scroll and an optional log. Default features enable every format with std; elf32/elf64, mach32/mach64, pe32/pe64, te and archive select backends, endian_fd parses by the binary's own byte order, and Mach-O, PE and TE parsing requires alloc and endian_fd.
  • Input is a byte slice holding an executable, object file or archive the user supplies. goblin parses format metadata only and includes no disassembler, so code needs a separate instruction decoder. PE parse options can skip RVA resolution, attribute certificates, TLS data, resources or imports, and the changelog describes an ELF and PE permissive mode for packed, broken or malware samples.
  • MIT license. The README quotes a report of 100 million fuzzing runs, and the repository holds cargo-fuzz and AFL harnesses; neither was rerun, and no binaries were parsed.

About this entry

Type
Tool
Category
Binary analysis libraries
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · m4b/goblin · Revision 24a6260
  2. Cargo.toml GitHub · m4b/goblin · Revision 24a6260
  3. CHANGELOG.md GitHub · m4b/goblin · Revision 24a6260
  4. src/lib.rs#L286-L323 GitHub · m4b/goblin · Revision 24a6260
  5. src/pe/options.rs GitHub · m4b/goblin · Revision 24a6260
  6. src/pe GitHub · m4b/goblin · Revision 24a6260
  7. src/mach GitHub · m4b/goblin · Revision 24a6260
  8. src/elf GitHub · m4b/goblin · Revision 24a6260
  9. LICENSE GitHub · m4b/goblin · Revision 24a6260
  10. https://github.com/m4b/goblin/tree/0.10.6
  11. https://docs.rs/crate/goblin/0.10.7