mirror of
https://github.com/SabreTools/BinaryObjectScanner.git
synced 2026-08-02 05:59:24 +00:00
Add PE COFF file header
This commit is contained in:
56
BurnOutSharp.Models/PortableExecutable/COFFFileHeader.cs
Normal file
56
BurnOutSharp.Models/PortableExecutable/COFFFileHeader.cs
Normal file
@@ -0,0 +1,56 @@
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace BurnOutSharp.Models.PortableExecutable
|
||||
{
|
||||
/// <summary>
|
||||
/// At the beginning of an object file, or immediately after the signature
|
||||
/// of an image file, is a standard COFF file header in the following format.
|
||||
/// Note that the Windows loader limits the number of sections to 96.
|
||||
/// </summary>
|
||||
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public class COFFFileHeader
|
||||
{
|
||||
/// <summary>
|
||||
/// The number that identifies the type of target machine.
|
||||
/// </summary>
|
||||
public MachineType Machine;
|
||||
|
||||
/// <summary>
|
||||
/// The number of sections. This indicates the size of the section table,
|
||||
/// which immediately follows the headers.
|
||||
/// </summary>
|
||||
public ushort NumberOfSections;
|
||||
|
||||
/// <summary>
|
||||
/// The low 32 bits of the number of seconds since 00:00 January 1, 1970
|
||||
/// (a C run-time time_t value), which indicates when the file was created.
|
||||
/// </summary>
|
||||
public uint TimeDateStamp;
|
||||
|
||||
/// <summary>
|
||||
/// The file offset of the COFF symbol table, or zero if no COFF symbol table
|
||||
/// is present. This value should be zero for an image because COFF debugging
|
||||
/// information is deprecated.
|
||||
/// </summary>
|
||||
public uint PointerToSymbolTable;
|
||||
|
||||
/// <summary>
|
||||
/// The number of entries in the symbol table. This data can be used to locate
|
||||
/// the string table, which immediately follows the symbol table. This value
|
||||
/// should be zero for an image because COFF debugging information is deprecated.
|
||||
/// </summary>
|
||||
public uint NumberOfSymbols;
|
||||
|
||||
/// <summary>
|
||||
/// The size of the optional header, which is required for executable files but
|
||||
/// not for object files. This value should be zero for an object file.
|
||||
/// </summary>
|
||||
public ushort SizeOfOptionalHeader;
|
||||
|
||||
/// <summary>
|
||||
/// The flags that indicate the attributes of the file.
|
||||
/// </summary>
|
||||
public Characteristics Characteristics;
|
||||
}
|
||||
}
|
||||
@@ -496,7 +496,7 @@ namespace BurnOutSharp.Models.PortableExecutable
|
||||
IMPORT_NAME_UNDECORATE = 3,
|
||||
}
|
||||
|
||||
public enum MachineTypes : ushort
|
||||
public enum MachineType : ushort
|
||||
{
|
||||
/// <summary>
|
||||
/// The content of this field is assumed to be applicable to any machine type
|
||||
|
||||
@@ -13,5 +13,17 @@ namespace BurnOutSharp.Models.PortableExecutable
|
||||
/// MS-DOS executable stub
|
||||
/// </summary>
|
||||
public MSDOS.Executable Stub { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// After the MS-DOS stub, at the file offset specified at offset 0x3c, is a 4-byte
|
||||
/// signature that identifies the file as a PE format image file. This signature is "PE\0\0"
|
||||
/// (the letters "P" and "E" followed by two null bytes).
|
||||
/// </summary>
|
||||
public byte[] Signature { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// COFF file header
|
||||
/// </summary>
|
||||
public COFFFileHeader COFFFileHeader { get; set; }
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user