diff --git a/BurnOutSharp.Models/PortableExecutable/COFFFileHeader.cs b/BurnOutSharp.Models/PortableExecutable/COFFFileHeader.cs new file mode 100644 index 00000000..fe2e084b --- /dev/null +++ b/BurnOutSharp.Models/PortableExecutable/COFFFileHeader.cs @@ -0,0 +1,56 @@ +using System.Runtime.InteropServices; + +namespace BurnOutSharp.Models.PortableExecutable +{ + /// + /// At the beginning of an object file, or immediately after the signature + /// of an image file, is a standard COFF file header in the following format. + /// Note that the Windows loader limits the number of sections to 96. + /// + /// + [StructLayout(LayoutKind.Sequential)] + public class COFFFileHeader + { + /// + /// The number that identifies the type of target machine. + /// + public MachineType Machine; + + /// + /// The number of sections. This indicates the size of the section table, + /// which immediately follows the headers. + /// + public ushort NumberOfSections; + + /// + /// The low 32 bits of the number of seconds since 00:00 January 1, 1970 + /// (a C run-time time_t value), which indicates when the file was created. + /// + public uint TimeDateStamp; + + /// + /// The file offset of the COFF symbol table, or zero if no COFF symbol table + /// is present. This value should be zero for an image because COFF debugging + /// information is deprecated. + /// + public uint PointerToSymbolTable; + + /// + /// The number of entries in the symbol table. This data can be used to locate + /// the string table, which immediately follows the symbol table. This value + /// should be zero for an image because COFF debugging information is deprecated. + /// + public uint NumberOfSymbols; + + /// + /// The size of the optional header, which is required for executable files but + /// not for object files. This value should be zero for an object file. + /// + public ushort SizeOfOptionalHeader; + + /// + /// The flags that indicate the attributes of the file. + /// + public Characteristics Characteristics; + } +} diff --git a/BurnOutSharp.Models/PortableExecutable/Enums.cs b/BurnOutSharp.Models/PortableExecutable/Enums.cs index bcfa6e6e..5a734a90 100644 --- a/BurnOutSharp.Models/PortableExecutable/Enums.cs +++ b/BurnOutSharp.Models/PortableExecutable/Enums.cs @@ -496,7 +496,7 @@ namespace BurnOutSharp.Models.PortableExecutable IMPORT_NAME_UNDECORATE = 3, } - public enum MachineTypes : ushort + public enum MachineType : ushort { /// /// The content of this field is assumed to be applicable to any machine type diff --git a/BurnOutSharp.Models/PortableExecutable/Executable.cs b/BurnOutSharp.Models/PortableExecutable/Executable.cs index 390c4679..7df9cf9d 100644 --- a/BurnOutSharp.Models/PortableExecutable/Executable.cs +++ b/BurnOutSharp.Models/PortableExecutable/Executable.cs @@ -13,5 +13,17 @@ namespace BurnOutSharp.Models.PortableExecutable /// MS-DOS executable stub /// public MSDOS.Executable Stub { get; set; } + + /// + /// After the MS-DOS stub, at the file offset specified at offset 0x3c, is a 4-byte + /// signature that identifies the file as a PE format image file. This signature is "PE\0\0" + /// (the letters "P" and "E" followed by two null bytes). + /// + public byte[] Signature { get; set; } + + /// + /// COFF file header + /// + public COFFFileHeader COFFFileHeader { get; set; } } }