using System.Runtime.InteropServices; namespace BinaryObjectScanner.Models.PortableExecutable { /// /// At the beginning of an object file, or immediately after the signature /// of an image file, is a standard COFF file header in the following format. /// Note that the Windows loader limits the number of sections to 96. /// /// [StructLayout(LayoutKind.Sequential)] public sealed class COFFFileHeader { /// /// The number that identifies the type of target machine. /// public MachineType Machine; /// /// The number of sections. This indicates the size of the section table, /// which immediately follows the headers. /// public ushort NumberOfSections; /// /// The low 32 bits of the number of seconds since 00:00 January 1, 1970 /// (a C run-time time_t value), which indicates when the file was created. /// public uint TimeDateStamp; /// /// The file offset of the COFF symbol table, or zero if no COFF symbol table /// is present. This value should be zero for an image because COFF debugging /// information is deprecated. /// public uint PointerToSymbolTable; /// /// The number of entries in the symbol table. This data can be used to locate /// the string table, which immediately follows the symbol table. This value /// should be zero for an image because COFF debugging information is deprecated. /// public uint NumberOfSymbols; /// /// The size of the optional header, which is required for executable files but /// not for object files. This value should be zero for an object file. /// public ushort SizeOfOptionalHeader; /// /// The flags that indicate the attributes of the file. /// public Characteristics Characteristics; } }