diff --git a/BurnOutSharp.Models/PortableExecutable/COFFFileHeader.cs b/BurnOutSharp.Models/PortableExecutable/COFFFileHeader.cs
new file mode 100644
index 00000000..fe2e084b
--- /dev/null
+++ b/BurnOutSharp.Models/PortableExecutable/COFFFileHeader.cs
@@ -0,0 +1,56 @@
+using System.Runtime.InteropServices;
+
+namespace BurnOutSharp.Models.PortableExecutable
+{
+ ///
+ /// At the beginning of an object file, or immediately after the signature
+ /// of an image file, is a standard COFF file header in the following format.
+ /// Note that the Windows loader limits the number of sections to 96.
+ ///
+ ///
+ [StructLayout(LayoutKind.Sequential)]
+ public class COFFFileHeader
+ {
+ ///
+ /// The number that identifies the type of target machine.
+ ///
+ public MachineType Machine;
+
+ ///
+ /// The number of sections. This indicates the size of the section table,
+ /// which immediately follows the headers.
+ ///
+ public ushort NumberOfSections;
+
+ ///
+ /// The low 32 bits of the number of seconds since 00:00 January 1, 1970
+ /// (a C run-time time_t value), which indicates when the file was created.
+ ///
+ public uint TimeDateStamp;
+
+ ///
+ /// The file offset of the COFF symbol table, or zero if no COFF symbol table
+ /// is present. This value should be zero for an image because COFF debugging
+ /// information is deprecated.
+ ///
+ public uint PointerToSymbolTable;
+
+ ///
+ /// The number of entries in the symbol table. This data can be used to locate
+ /// the string table, which immediately follows the symbol table. This value
+ /// should be zero for an image because COFF debugging information is deprecated.
+ ///
+ public uint NumberOfSymbols;
+
+ ///
+ /// The size of the optional header, which is required for executable files but
+ /// not for object files. This value should be zero for an object file.
+ ///
+ public ushort SizeOfOptionalHeader;
+
+ ///
+ /// The flags that indicate the attributes of the file.
+ ///
+ public Characteristics Characteristics;
+ }
+}
diff --git a/BurnOutSharp.Models/PortableExecutable/Enums.cs b/BurnOutSharp.Models/PortableExecutable/Enums.cs
index bcfa6e6e..5a734a90 100644
--- a/BurnOutSharp.Models/PortableExecutable/Enums.cs
+++ b/BurnOutSharp.Models/PortableExecutable/Enums.cs
@@ -496,7 +496,7 @@ namespace BurnOutSharp.Models.PortableExecutable
IMPORT_NAME_UNDECORATE = 3,
}
- public enum MachineTypes : ushort
+ public enum MachineType : ushort
{
///
/// The content of this field is assumed to be applicable to any machine type
diff --git a/BurnOutSharp.Models/PortableExecutable/Executable.cs b/BurnOutSharp.Models/PortableExecutable/Executable.cs
index 390c4679..7df9cf9d 100644
--- a/BurnOutSharp.Models/PortableExecutable/Executable.cs
+++ b/BurnOutSharp.Models/PortableExecutable/Executable.cs
@@ -13,5 +13,17 @@ namespace BurnOutSharp.Models.PortableExecutable
/// MS-DOS executable stub
///
public MSDOS.Executable Stub { get; set; }
+
+ ///
+ /// After the MS-DOS stub, at the file offset specified at offset 0x3c, is a 4-byte
+ /// signature that identifies the file as a PE format image file. This signature is "PE\0\0"
+ /// (the letters "P" and "E" followed by two null bytes).
+ ///
+ public byte[] Signature { get; set; }
+
+ ///
+ /// COFF file header
+ ///
+ public COFFFileHeader COFFFileHeader { get; set; }
}
}