claunia/libexeinfo
1
0
Fork 0
mirror of https://github.com/claunia/libexeinfo.git synced 2025-12-16 19:14:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

Convert classes to interface.

Browse Source
This commit is contained in:
Natalia Portillo
2018-02-25 18:42:56 +00:00
parent a58d4a636b
commit 7bfb6744f2
26 changed files with 1613 additions and 1586 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
exeinfo/Program.cs
View File

@@ -33,7 +33,7 @@ using libexeinfo;
namespace exeinfo
{
class MainClass
static class MainClass
{
public static void Main(string[] args)
{
@@ -48,25 +48,25 @@ namespace exeinfo
bool recognized = false;
MZ mzExe = new MZ(exeFs);
NE neExe = new NE(exeFs);
AtariST stExe = new AtariST(exeFs);
LX lxExe = new LX(exeFs);
COFF coffExe = new COFF(exeFs);
PE peExe = new PE(exeFs);
IExecutable mzExe = new MZ(exeFs);
IExecutable neExe = new NE(exeFs);
IExecutable stExe = new AtariST(exeFs);
IExecutable lxExe = new LX(exeFs);
IExecutable coffExe = new COFF(exeFs);
IExecutable peExe = new PE(exeFs);
if(mzExe.IsMZ)
if(mzExe.Recognized)
{
recognized = true;
Console.Write(mzExe.GetInfo());
Console.Write(mzExe.Information);
}
if(neExe.IsNE)
if(neExe.Recognized)
{
recognized = true;
Console.Write(neExe.GetInfo());
if(neExe.Versions != null)
foreach(NE.Version vers in neExe.Versions)
Console.Write(neExe.Information);
if(((NE)neExe).Versions != null)
foreach(NE.Version vers in ((NE)neExe).Versions)
{
Console.WriteLine("\tVersion resource {0}:", vers.Name);
Console.WriteLine("\t\tFile version: {0}", vers.FileVersion);
@@ -117,28 +117,28 @@ namespace exeinfo
}
}
if(stExe.IsAtariST)
if(stExe.Recognized)
{
recognized = true;
Console.Write(stExe.GetInfo());
Console.Write(stExe.Information);
}
if(lxExe.IsLX)
if(lxExe.Recognized)
{
recognized = true;
Console.Write(lxExe.GetInfo());
Console.Write(lxExe.Information);
}
if(coffExe.IsCOFF)
if(coffExe.Recognized)
{
recognized = true;
Console.Write(coffExe.GetInfo());
Console.Write(coffExe.Information);
}
if(peExe.IsPE)
if(peExe.Recognized)
{
recognized = true;
Console.Write(peExe.GetInfo());
Console.Write(peExe.Information);
}
if(!recognized) Console.WriteLine("Executable format not recognized");

48
exeinfogui/MainForm.xeto.cs
View File

@@ -57,44 +57,44 @@ namespace exeinfogui
FileStream exeFs = File.Open(dlgOpen.FileName, FileMode.Open, FileAccess.Read);
MZ mzExe = new MZ(exeFs);
NE neExe = new NE(exeFs);
AtariST stExe = new AtariST(exeFs);
LX lxExe = new LX(exeFs);
COFF coffExe = new COFF(exeFs);
PE peExe = new PE(exeFs);
IExecutable mzExe = new MZ(exeFs);
IExecutable neExe = new NE(exeFs);
IExecutable stExe = new AtariST(exeFs);
IExecutable lxExe = new LX(exeFs);
IExecutable coffExe = new COFF(exeFs);
IExecutable peExe = new PE(exeFs);
if(mzExe.IsMZ)
if(mzExe.Recognized)
{
if(neExe.IsNE)
if(neExe.Recognized)
{
txtType.Text = "New Executable (NE)";
txtInformation.Text = neExe.GetInfo();
txtType.Text = neExe.Type;
txtInformation.Text = neExe.Information;
}
else if(lxExe.IsLX)
else if(lxExe.Recognized)
{
txtType.Text = "Linear eXecutable (LX)";
txtInformation.Text = lxExe.GetInfo();
txtType.Text = lxExe.Type;
txtInformation.Text = lxExe.Information;
}
else if(peExe.IsPE)
else if(peExe.Recognized)
{
txtType.Text = "Portable Executable (PE)";
txtInformation.Text = peExe.GetInfo();
txtType.Text = peExe.Type;
txtInformation.Text = peExe.Information;
}
else
txtType.Text = "DOS Executable (MZ)";
txtType.Text = mzExe.Type;
txtInformation.Text += mzExe.GetInfo();
txtInformation.Text += mzExe.Information;
}
else if(stExe.IsAtariST)
else if(stExe.Recognized)
{
txtType.Text = "Atari ST executable";
txtInformation.Text = stExe.GetInfo();
txtType.Text = stExe.Type;
txtInformation.Text = stExe.Information;
}
else if(coffExe.IsCOFF)
else if(coffExe.Recognized)
{
txtType.Text = "Common Object File Format (COFF)";
txtInformation.Text = coffExe.GetInfo();
txtType.Text = coffExe.Type;
txtInformation.Text = coffExe.Information;
}
else
txtType.Text = "Format not recognized";

117
libexeinfo/AtariST/AtariST.cs
View File

@@ -29,71 +29,82 @@ using System.Runtime.InteropServices;
namespace libexeinfo
{
/// <summary>
/// Represents an Atari ST executable
/// </summary>
public partial class AtariST
/// <summary>
/// Represents an Atari ST executable
/// </summary>
public partial class AtariST : IExecutable
{
/// <summary>
/// The <see cref="FileStream" /> that contains the executable represented by this instance
/// </summary>
public readonly FileStream BaseStream;
/// <summary>
/// Header for this executable
/// </summary>
public readonly AtariHeader Header;
/// <summary>
/// If true this instance correctly represents an Atari ST executable
/// </summary>
public readonly bool IsAtariST;
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.AtariST" /> class.
/// </summary>
/// <param name="path">Executable path.</param>
public AtariST(string path)
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.AtariST" /> class.
/// </summary>
/// <param name="path">Executable path.</param>
public AtariST(string path)
{
byte[] buffer = new byte[Marshal.SizeOf(typeof(AtariHeader))];
BaseStream = File.Open(path, FileMode.Open, FileAccess.Read);
BaseStream.Position = 0;
BaseStream.Read(buffer, 0, buffer.Length);
Header = BigEndianMarshal.ByteArrayToStructureBigEndian<AtariHeader>(buffer);
IsAtariST = Header.signature == SIGNATURE;
BaseStream = File.Open(path, FileMode.Open, FileAccess.Read);
Initialize();
}
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.AtariST" /> class.
/// </summary>
/// <param name="stream">Stream containing the executable.</param>
public AtariST(FileStream stream)
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.AtariST" /> class.
/// </summary>
/// <param name="stream">Stream containing the executable.</param>
public AtariST(Stream stream)
{
byte[] buffer = new byte[Marshal.SizeOf(typeof(AtariHeader))];
BaseStream = stream;
BaseStream.Position = 0;
BaseStream.Read(buffer, 0, buffer.Length);
Header = BigEndianMarshal.ByteArrayToStructureBigEndian<AtariHeader>(buffer);
IsAtariST = Header.signature == SIGNATURE;
BaseStream = stream;
Initialize();
}
/// <summary>
/// Identifies if the specified executable is a Atari ST executable
/// </summary>
/// <returns><c>true</c> if the specified executable is a Atari ST executable, <c>false</c> otherwise.</returns>
/// <param name="path">Executable path.</param>
public static bool Identify(string path)
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.AtariST" /> class.
/// </summary>
/// <param name="data">Byte array containing the executable.</param>
public AtariST(byte[] data)
{
BaseStream = new MemoryStream(data);
Initialize();
}
/// <summary>
/// Header for this executable
/// </summary>
public AtariHeader Header { get; private set; }
public Stream BaseStream { get; }
public bool IsBigEndian => true;
public bool Recognized { get; private set; }
public string Type { get; private set; }
void Initialize()
{
Recognized = false;
if(BaseStream == null) return;
byte[] buffer = new byte[Marshal.SizeOf(typeof(AtariHeader))];
BaseStream.Position = 0;
BaseStream.Read(buffer, 0, buffer.Length);
Header = BigEndianMarshal.ByteArrayToStructureBigEndian<AtariHeader>(buffer);
Recognized = Header.signature == SIGNATURE;
if(Recognized) Type = "Atari ST executable";
}
/// <summary>
/// Identifies if the specified executable is a Atari ST executable
/// </summary>
/// <returns><c>true</c> if the specified executable is a Atari ST executable, <c>false</c> otherwise.</returns>
/// <param name="path">Executable path.</param>
public static bool Identify(string path)
{
FileStream exeFs = File.Open(path, FileMode.Open, FileAccess.Read);
return Identify(exeFs);
}
/// <summary>
/// Identifies if the specified executable is a Atari ST executable
/// </summary>
/// <returns><c>true</c> if the specified executable is a Atari ST executable, <c>false</c> otherwise.</returns>
/// <param name="stream">Stream containing the executable.</param>
public static bool Identify(FileStream stream)
/// <summary>
/// Identifies if the specified executable is a Atari ST executable
/// </summary>
/// <returns><c>true</c> if the specified executable is a Atari ST executable, <c>false</c> otherwise.</returns>
/// <param name="stream">Stream containing the executable.</param>
public static bool Identify(Stream stream)
{
byte[] buffer = new byte[Marshal.SizeOf(typeof(AtariHeader))];

27
libexeinfo/AtariST/Info.cs
View File

@@ -30,12 +30,18 @@ namespace libexeinfo
{
public partial class AtariST
{
/// <summary>
/// Gets a string with human readable information for a given Atari ST header
/// </summary>
/// <returns>Human readable information for given Atari ST header.</returns>
/// <param name="header">Atari ST executable header.</param>
public static string GetInfo(AtariHeader header)
/// <summary>
/// Gets a string with human readable information for the Atari ST executable represented by this instance
/// </summary>
/// <value>Human readable information for this instance.</value>
public string Information => GetInfo(Header);
/// <summary>
/// Gets a string with human readable information for a given Atari ST header
/// </summary>
/// <returns>Human readable information for given Atari ST header.</returns>
/// <param name="header">Atari ST executable header.</param>
static string GetInfo(AtariHeader header)
{
StringBuilder sb = new StringBuilder();
sb.AppendLine("Atari ST executable:");
@@ -45,14 +51,5 @@ namespace libexeinfo
sb.AppendFormat("\t{0} bytes in symbol table", header.symb_len).AppendLine();
return sb.ToString();
}
/// <summary>
/// Gets a string with human readable information for the Atari ST executable represented by this instance
/// </summary>
/// <returns>Human readable information for this instance.</returns>
public string GetInfo()
{
return GetInfo(Header);
}
}
}

165
libexeinfo/COFF/COFF.cs
View File

@@ -30,102 +30,105 @@ using System.Runtime.InteropServices;
namespace libexeinfo
{
/// <summary>
/// Represents a Common Object File Format
/// </summary>
public partial class COFF
/// <summary>
/// Represents a Common Object File Format
/// </summary>
public partial class COFF : IExecutable
{
/// <summary>
/// The <see cref="FileStream" /> that contains the executable represented by this instance
/// </summary>
public readonly FileStream BaseStream;
/// <summary>
/// Header for this executable
/// </summary>
public readonly COFFHeader Header;
public readonly bool IsBigEndian;
/// <summary>
/// If true this instance correctly represents a Common Object File Format
/// </summary>
public readonly bool IsCOFF;
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.COFF" /> class.
/// </summary>
/// <param name="path">Executable path.</param>
public COFF(string path)
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.COFF" /> class.
/// </summary>
/// <param name="path">Executable path.</param>
public COFF(string path)
{
BaseStream = File.Open(path, FileMode.Open, FileAccess.Read);
Initialize();
}
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.COFF" /> class.
/// </summary>
/// <param name="stream">Stream containing the executable.</param>
public COFF(Stream stream)
{
BaseStream = stream;
Initialize();
}
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.COFF" /> class.
/// </summary>
/// <param name="data">Byte array containing the executable.</param>
public COFF(byte[] data)
{
BaseStream = new MemoryStream(data);
Initialize();
}
/// <summary>
/// Header for this executable
/// </summary>
public COFFHeader Header { get; private set; }
/// <summary>
/// The <see cref="FileStream" /> that contains the executable represented by this instance
/// </summary>
public Stream BaseStream { get; }
public bool IsBigEndian { get; private set; }
/// <summary>
/// If true this instance correctly represents a Common Object File Format
/// </summary>
public bool Recognized { get; private set; }
public string Type { get; private set; }
void Initialize()
{
Recognized = false;
if(BaseStream == null) return;
byte[] buffer = new byte[Marshal.SizeOf(typeof(COFFHeader))];
BaseStream = File.Open(path, FileMode.Open, FileAccess.Read);
BaseStream.Position = 0;
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
Header = (COFFHeader)Marshal.PtrToStructure(hdrPtr, typeof(COFFHeader));
Marshal.FreeHGlobal(hdrPtr);
IsCOFF = Header.optionalHeader.magic == STMAGIC || Header.optionalHeader.magic == OMAGIC ||
Header.optionalHeader.magic == JMAGIC || Header.optionalHeader.magic == DMAGIC ||
Header.optionalHeader.magic == ZMAGIC || Header.optionalHeader.magic == SHMAGIC;
IsBigEndian = false;
if(!IsCOFF)
{
Header = SwapHeader(Header);
IsCOFF = Header.optionalHeader.magic == STMAGIC || Header.optionalHeader.magic == OMAGIC ||
Recognized = Header.optionalHeader.magic == STMAGIC || Header.optionalHeader.magic == OMAGIC ||
Header.optionalHeader.magic == JMAGIC || Header.optionalHeader.magic == DMAGIC ||
Header.optionalHeader.magic == ZMAGIC || Header.optionalHeader.magic == SHMAGIC;
IsBigEndian = !IsCOFF;
}
}
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.COFF" /> class.
/// </summary>
/// <param name="stream">Stream containing the executable.</param>
public COFF(FileStream stream)
{
byte[] buffer = new byte[Marshal.SizeOf(typeof(COFFHeader))];
BaseStream = stream;
BaseStream.Position = 0;
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
Header = (COFFHeader)Marshal.PtrToStructure(hdrPtr, typeof(COFFHeader));
Marshal.FreeHGlobal(hdrPtr);
IsCOFF = Header.optionalHeader.magic == STMAGIC || Header.optionalHeader.magic == OMAGIC ||
Header.optionalHeader.magic == JMAGIC || Header.optionalHeader.magic == DMAGIC ||
Header.optionalHeader.magic == ZMAGIC || Header.optionalHeader.magic == SHMAGIC;
IsBigEndian = false;
if(!IsCOFF)
if(!Recognized)
{
Header = SwapHeader(Header);
IsCOFF = Header.optionalHeader.magic == STMAGIC || Header.optionalHeader.magic == OMAGIC ||
Header.optionalHeader.magic == JMAGIC || Header.optionalHeader.magic == DMAGIC ||
Header.optionalHeader.magic == ZMAGIC || Header.optionalHeader.magic == SHMAGIC;
IsBigEndian = !IsCOFF;
Header = SwapHeader(Header);
Recognized = Header.optionalHeader.magic == STMAGIC || Header.optionalHeader.magic == OMAGIC ||
Header.optionalHeader.magic == JMAGIC || Header.optionalHeader.magic == DMAGIC ||
Header.optionalHeader.magic == ZMAGIC || Header.optionalHeader.magic == SHMAGIC;
IsBigEndian = !Recognized;
}
if(!Recognized) return;
Type = "Common Object File Format (COFF)";
}
/// <summary>
/// Identifies if the specified executable is a Common Object File Format
/// </summary>
/// <returns><c>true</c> if the specified executable is a Common Object File Format, <c>false</c> otherwise.</returns>
/// <param name="path">Executable path.</param>
public static bool Identify(string path)
/// <summary>
/// Identifies if the specified executable is a Common Object File Format
/// </summary>
/// <returns><c>true</c> if the specified executable is a Common Object File Format, <c>false</c> otherwise.</returns>
/// <param name="path">Executable path.</param>
public static bool Identify(string path)
{
FileStream exeFs = File.Open(path, FileMode.Open, FileAccess.Read);
return Identify(exeFs);
}
/// <summary>
/// Identifies if the specified executable is a Common Object File Format
/// </summary>
/// <returns><c>true</c> if the specified executable is a Common Object File Format, <c>false</c> otherwise.</returns>
/// <param name="stream">Stream containing the executable.</param>
public static bool Identify(FileStream stream)
/// <summary>
/// Identifies if the specified executable is a Common Object File Format
/// </summary>
/// <returns><c>true</c> if the specified executable is a Common Object File Format, <c>false</c> otherwise.</returns>
/// <param name="stream">Stream containing the executable.</param>
public static bool Identify(FileStream stream)
{
byte[] buffer = new byte[Marshal.SizeOf(typeof(COFFHeader))];
@@ -133,17 +136,17 @@ namespace libexeinfo
stream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
COFFHeader COFFHdr = (COFFHeader)Marshal.PtrToStructure(hdrPtr, typeof(COFFHeader));
COFFHeader coffHdr = (COFFHeader)Marshal.PtrToStructure(hdrPtr, typeof(COFFHeader));
Marshal.FreeHGlobal(hdrPtr);
if(COFFHdr.optionalHeader.magic == STMAGIC || COFFHdr.optionalHeader.magic == OMAGIC ||
COFFHdr.optionalHeader.magic == JMAGIC || COFFHdr.optionalHeader.magic == DMAGIC ||
COFFHdr.optionalHeader.magic == ZMAGIC || COFFHdr.optionalHeader.magic == SHMAGIC) return true;
if(coffHdr.optionalHeader.magic == STMAGIC || coffHdr.optionalHeader.magic == OMAGIC ||
coffHdr.optionalHeader.magic == JMAGIC || coffHdr.optionalHeader.magic == DMAGIC ||
coffHdr.optionalHeader.magic == ZMAGIC || coffHdr.optionalHeader.magic == SHMAGIC) return true;
COFFHdr = SwapHeader(COFFHdr);
return COFFHdr.optionalHeader.magic == STMAGIC || COFFHdr.optionalHeader.magic == OMAGIC ||
COFFHdr.optionalHeader.magic == JMAGIC || COFFHdr.optionalHeader.magic == DMAGIC ||
COFFHdr.optionalHeader.magic == ZMAGIC || COFFHdr.optionalHeader.magic == SHMAGIC;
coffHdr = SwapHeader(coffHdr);
return coffHdr.optionalHeader.magic == STMAGIC || coffHdr.optionalHeader.magic == OMAGIC ||
coffHdr.optionalHeader.magic == JMAGIC || coffHdr.optionalHeader.magic == DMAGIC ||
coffHdr.optionalHeader.magic == ZMAGIC || coffHdr.optionalHeader.magic == SHMAGIC;
}
static COFFHeader SwapHeader(COFFHeader header)

160
libexeinfo/COFF/Consts.cs
View File

@@ -28,86 +28,86 @@ namespace libexeinfo
{
public partial class COFF
{
public const ushort STMAGIC = 0x101;
public const ushort OMAGIC = 0x104;
/// <summary>
/// dirty text and data image, can't share
/// </summary>
public const ushort JMAGIC = 0x107;
/// <summary>
/// dirty text segment, data aligned
/// </summary>
public const ushort DMAGIC = 0x108;
/// <summary>
/// The proper magic number for executables
/// </summary>
public const ushort ZMAGIC = 0x10b;
/// <summary>
/// shared library header
/// </summary>
public const ushort SHMAGIC = 0x123;
const ushort STMAGIC = 0x101;
const ushort OMAGIC = 0x104;
/// <summary>
/// dirty text and data image, can't share
/// </summary>
const ushort JMAGIC = 0x107;
/// <summary>
/// dirty text segment, data aligned
/// </summary>
const ushort DMAGIC = 0x108;
/// <summary>
/// The proper magic number for executables
/// </summary>
internal const ushort ZMAGIC = 0x10b;
/// <summary>
/// shared library header
/// </summary>
const ushort SHMAGIC = 0x123;
/// <summary>
/// Alpha architecture information
/// </summary>
public readonly string SectionAlpha = ".arch";
/// <summary>
/// Uninitialized data
/// </summary>
public readonly string SectionBss = ".bss";
/// <summary>
/// Initialized data
/// </summary>
public readonly string SectionData = ".data";
/// <summary>
/// Debug information
/// </summary>
public readonly string SectionDebug = ".debug";
/// <summary>
/// A .drectve section consists of a string of ASCII text. This string is
/// a series of linker options (each option containing hyphen, option
/// name, and any appropriate attribute) separated by spaces.The
/// .drectve section must not have relocations or line numbers.
/// </summary>
public readonly string SectionDirectives = ".drectve";
/// <summary>
/// Exception information
/// </summary>
public readonly string SectioneXception = ".xdata";
/// <summary>
/// Exception information
/// </summary>
public readonly string SectionException = ".pdata";
/// <summary>
/// Executable code
/// </summary>
public readonly string SectionExecutable = ".text";
/// <summary>
/// The export data section, named .edata, contains information about
/// symbols that other images can access through dynamic linking.
/// Exports are generally found in DLLs, but DLLs can import symbols as
/// well.
/// </summary>
public readonly string SectionExport = ".edata";
/// <summary>
/// Import tables
/// </summary>
public readonly string SectionImport = ".idata";
/// <summary>
/// Read-only initialized data
/// </summary>
public readonly string SectionReadOnly = ".rdata";
/// <summary>
/// Image relocations
/// </summary>
public readonly string SectionRelocations = ".reloc";
/// <summary>
/// Resource directory
/// </summary>
public readonly string SectionResource = ".rsrc";
/// <summary>
/// Thread-local storage
/// </summary>
public readonly string SectionTls = ".tls";
/// <summary>
/// Alpha architecture information
/// </summary>
public readonly string SectionAlpha = ".arch";
/// <summary>
/// Uninitialized data
/// </summary>
public readonly string SectionBss = ".bss";
/// <summary>
/// Initialized data
/// </summary>
public readonly string SectionData = ".data";
/// <summary>
/// Debug information
/// </summary>
public readonly string SectionDebug = ".debug";
/// <summary>
/// A .drectve section consists of a string of ASCII text. This string is
/// a series of linker options (each option containing hyphen, option
/// name, and any appropriate attribute) separated by spaces.The
/// .drectve section must not have relocations or line numbers.
/// </summary>
public readonly string SectionDirectives = ".drectve";
/// <summary>
/// Exception information
/// </summary>
public readonly string SectioneXception = ".xdata";
/// <summary>
/// Exception information
/// </summary>
public readonly string SectionException = ".pdata";
/// <summary>
/// Executable code
/// </summary>
public readonly string SectionExecutable = ".text";
/// <summary>
/// The export data section, named .edata, contains information about
/// symbols that other images can access through dynamic linking.
/// Exports are generally found in DLLs, but DLLs can import symbols as
/// well.
/// </summary>
public readonly string SectionExport = ".edata";
/// <summary>
/// Import tables
/// </summary>
public readonly string SectionImport = ".idata";
/// <summary>
/// Read-only initialized data
/// </summary>
public readonly string SectionReadOnly = ".rdata";
/// <summary>
/// Image relocations
/// </summary>
public readonly string SectionRelocations = ".reloc";
/// <summary>
/// Resource directory
/// </summary>
public readonly string SectionResource = ".rsrc";
/// <summary>
/// Thread-local storage
/// </summary>
public readonly string SectionTls = ".tls";
}
}

758
libexeinfo/COFF/Enums.cs
View File

@@ -26,398 +26,400 @@
using System;
// ReSharper disable InconsistentNaming
namespace libexeinfo
{
public partial class COFF
{
/// <summary>
/// The Characteristics field contains flags that indicate attributes of the object or image file.
/// </summary>
[Flags]
/// <summary>
/// The Characteristics field contains flags that indicate attributes of the object or image file.
/// </summary>
[Flags]
public enum Characteristics : ushort
{
/// <summary>
/// Image only, Windows CE, and Microsoft Windows NT and later. This indicates that the file does not contain base
/// relocations and must therefore be loaded at its preferred base address. If the base address is not available, the
/// loader reports an error. The default behavior of the linker is to strip base relocations from executable (EXE)
/// files.
/// </summary>
IMAGE_FILE_RELOCS_STRIPPED = 0x0001,
/// <summary>
/// Image only. This indicates that the image file is valid and can be run. If this flag is not set, it indicates a
/// linker error.
/// </summary>
IMAGE_FILE_EXECUTABLE_IMAGE = 0x0002,
/// <summary>
/// COFF line numbers have been removed. This flag is deprecated and should be zero.
/// </summary>
IMAGE_FILE_LINE_NUMS_STRIPPED = 0x0004,
/// <summary>
/// COFF symbol table entries for local symbols have been removed. This flag is deprecated and should be zero.
/// </summary>
IMAGE_FILE_LOCAL_SYMS_STRIPPED = 0x0008,
/// <summary>
/// Obsolete. Aggressively trim working set. This flag is deprecated for Windows 2000 and later and must be zero.
/// </summary>
IMAGE_FILE_AGGRESSIVE_WS_TRIM = 0x0010,
/// <summary>
/// Application can handle > 2-GB addresses.
/// </summary>
IMAGE_FILE_LARGE_ADDRESS_AWARE = 0x0020,
/// <summary>
/// Machine is based on a 16-bit-word architecture.
/// </summary>
IMAGE_FILE_16BIT_MACHINE = 0x0040,
/// <summary>
/// Little endian: the least significant bit (LSB) precedes the most significant bit (MSB) in memory. This flag is
/// deprecated and should be zero.
/// </summary>
IMAGE_FILE_BYTES_REVERSED_LO = 0x0080,
/// <summary>
/// Machine is based on a 32-bit-word architecture.
/// </summary>
IMAGE_FILE_32BIT_MACHINE = 0x0100,
/// <summary>
/// Debugging information is removed from the image file.
/// </summary>
IMAGE_FILE_DEBUG_STRIPPED = 0x0200,
/// <summary>
/// If the image is on removable media, fully load it and copy it to the swap file.
/// </summary>
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP = 0x0400,
/// <summary>
/// If the image is on network media, fully load it and copy it to the swap file.
/// </summary>
IMAGE_FILE_NET_RUN_FROM_SWAP = 0x0800,
/// <summary>
/// The image file is a system file, not a user program.
/// </summary>
IMAGE_FILE_SYSTEM = 0x1000,
/// <summary>
/// The image file is a dynamic-link library (DLL). Such files are considered executable files for almost all purposes,
/// although they cannot be directly run.
/// </summary>
IMAGE_FILE_DLL = 0x2000,
/// <summary>
/// The file should be run only on a uniprocessor machine.
/// </summary>
IMAGE_FILE_UP_SYSTEM_ONLY = 0x4000,
/// <summary>
/// Big endian: the MSB precedes the LSB in memory. This flag is deprecated and should be zero.
/// </summary>
IMAGE_FILE_BYTES_REVERSED_HI = 0x8000
/// <summary>
/// Image only, Windows CE, and Microsoft Windows NT and later. This indicates that the file does not contain base
/// relocations and must therefore be loaded at its preferred base address. If the base address is not available, the
/// loader reports an error. The default behavior of the linker is to strip base relocations from executable (EXE)
/// files.
/// </summary>
IMAGE_FILE_RELOCS_STRIPPED = 0x0001,
/// <summary>
/// Image only. This indicates that the image file is valid and can be run. If this flag is not set, it indicates a
/// linker error.
/// </summary>
IMAGE_FILE_EXECUTABLE_IMAGE = 0x0002,
/// <summary>
/// COFF line numbers have been removed. This flag is deprecated and should be zero.
/// </summary>
IMAGE_FILE_LINE_NUMS_STRIPPED = 0x0004,
/// <summary>
/// COFF symbol table entries for local symbols have been removed. This flag is deprecated and should be zero.
/// </summary>
IMAGE_FILE_LOCAL_SYMS_STRIPPED = 0x0008,
/// <summary>
/// Obsolete. Aggressively trim working set. This flag is deprecated for Windows 2000 and later and must be zero.
/// </summary>
IMAGE_FILE_AGGRESSIVE_WS_TRIM = 0x0010,
/// <summary>
/// Application can handle > 2-GB addresses.
/// </summary>
IMAGE_FILE_LARGE_ADDRESS_AWARE = 0x0020,
/// <summary>
/// Machine is based on a 16-bit-word architecture.
/// </summary>
IMAGE_FILE_16BIT_MACHINE = 0x0040,
/// <summary>
/// Little endian: the least significant bit (LSB) precedes the most significant bit (MSB) in memory. This flag is
/// deprecated and should be zero.
/// </summary>
IMAGE_FILE_BYTES_REVERSED_LO = 0x0080,
/// <summary>
/// Machine is based on a 32-bit-word architecture.
/// </summary>
IMAGE_FILE_32BIT_MACHINE = 0x0100,
/// <summary>
/// Debugging information is removed from the image file.
/// </summary>
IMAGE_FILE_DEBUG_STRIPPED = 0x0200,
/// <summary>
/// If the image is on removable media, fully load it and copy it to the swap file.
/// </summary>
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP = 0x0400,
/// <summary>
/// If the image is on network media, fully load it and copy it to the swap file.
/// </summary>
IMAGE_FILE_NET_RUN_FROM_SWAP = 0x0800,
/// <summary>
/// The image file is a system file, not a user program.
/// </summary>
IMAGE_FILE_SYSTEM = 0x1000,
/// <summary>
/// The image file is a dynamic-link library (DLL). Such files are considered executable files for almost all purposes,
/// although they cannot be directly run.
/// </summary>
IMAGE_FILE_DLL = 0x2000,
/// <summary>
/// The file should be run only on a uniprocessor machine.
/// </summary>
IMAGE_FILE_UP_SYSTEM_ONLY = 0x4000,
/// <summary>
/// Big endian: the MSB precedes the LSB in memory. This flag is deprecated and should be zero.
/// </summary>
IMAGE_FILE_BYTES_REVERSED_HI = 0x8000
}
/// <summary>
/// The Machine field has one of the following values that specifies its CPU type. An image file can be run only on the
/// specified machine or on a system that emulates the specified machine.
/// </summary>
public enum MachineTypes : ushort
/// <summary>
/// The Machine field has one of the following values that specifies its CPU type. An image file can be run only on the
/// specified machine or on a system that emulates the specified machine.
/// </summary>
public enum MachineTypes : ushort
{
/// <summary>
/// The contents of this field are assumed to be applicable to any machine type
/// </summary>
IMAGE_FILE_MACHINE_UNKNOWN = 0x0,
/// <summary>
/// Alpha AXP
/// </summary>
IMAGE_FILE_MACHINE_ALPHA = 0x184,
/// <summary>
/// Alpha AXP 64-bit.
/// </summary>
IMAGE_FILE_MACHINE_ALPHA64 = 0x284,
/// <summary>
/// Matsushita AM33
/// </summary>
IMAGE_FILE_MACHINE_AM33 = 0x1d3,
/// <summary>
/// x64
/// </summary>
IMAGE_FILE_MACHINE_AMD64 = 0x8664,
/// <summary>
/// ARM little endian
/// </summary>
IMAGE_FILE_MACHINE_ARM = 0x1c0,
/// <summary>
/// ARM64 little endian
/// </summary>
IMAGE_FILE_MACHINE_ARM64 = 0xaa64,
/// <summary>
/// ARM Thumb-2 little endian
/// </summary>
IMAGE_FILE_MACHINE_ARMNT = 0x1c4,
/// <summary>
/// Clipper
/// </summary>
IMAGE_FILE_MACHINE_CLIPPER = 0x17f,
/// <summary>
/// EFI byte code
/// </summary>
IMAGE_FILE_MACHINE_EBC = 0xebc,
/// <summary>
/// Intel 386 or later processors and compatible processors
/// </summary>
IMAGE_FILE_MACHINE_I386 = 0x14c,
/// <summary>
/// Intel 386 or later processors and compatible processors, used by AIX
/// </summary>
IMAGE_FILE_MACHINE_I386_AIX = 0x175,
/// <summary>
/// Intel Itanium processor family
/// </summary>
IMAGE_FILE_MACHINE_IA64 = 0x200,
/// <summary>
/// Mitsubishi M32R little endian
/// </summary>
IMAGE_FILE_MACHINE_M32R = 0x9041,
/// <summary>
/// Motorola 68000 series
/// </summary>
IMAGE_FILE_MACHINE_M68K = 0x268,
/// <summary>
/// Motorola 68000 series
/// </summary>
IMAGE_FILE_MACHINE_M68K_OTHER = 0x150,
/// <summary>
/// MIPS16
/// </summary>
IMAGE_FILE_MACHINE_MIPS16 = 0x266,
/// <summary>
/// MIPS with FPU
/// </summary>
IMAGE_FILE_MACHINE_MIPSFPU = 0x366,
/// <summary>
/// MIPS16 with FPU
/// </summary>
IMAGE_FILE_MACHINE_MIPSFPU16 = 0x466,
/// <summary>
/// PowerPC little endian
/// </summary>
IMAGE_FILE_MACHINE_POWERPC = 0x1f0,
/// <summary>
/// Power PC with floating point support
/// </summary>
IMAGE_FILE_MACHINE_POWERPCFP = 0x1f1,
/// <summary>
/// MIPS big endian
/// </summary>
IMAGE_FILE_MACHINE_MIPSEB = 0x160,
/// <summary>
/// MIPS little endian
/// </summary>
IMAGE_FILE_MACHINE_R3000 = 0x162,
/// <summary>
/// MIPS little endian
/// </summary>
IMAGE_FILE_MACHINE_R4000 = 0x166,
/// <summary>
/// MIPS little endian
/// </summary>
IMAGE_FILE_MACHINE_R10000 = 0x168,
/// <summary>
/// RISC-V 32-bit address space
/// </summary>
IMAGE_FILE_MACHINE_RISCV32 = 0x5032,
/// <summary>
/// RISC-V 64-bit address space
/// </summary>
IMAGE_FILE_MACHINE_RISCV64 = 0x5064,
/// <summary>
/// RISC-V 128-bit address space
/// </summary>
IMAGE_FILE_MACHINE_RISCV128 = 0x5128,
/// <summary>
/// Hitachi SH3
/// </summary>
IMAGE_FILE_MACHINE_SH3 = 0x1a2,
/// <summary>
/// Hitachi SH3 DSP
/// </summary>
IMAGE_FILE_MACHINE_SH3DSP = 0x1a3,
/// <summary>
/// Hitachi SH4
/// </summary>
IMAGE_FILE_MACHINE_SH4 = 0x1a6,
/// <summary>
/// Hitachi SH5
/// </summary>
IMAGE_FILE_MACHINE_SH5 = 0x1a8,
/// <summary>
/// Thumb
/// </summary>
IMAGE_FILE_MACHINE_THUMB = 0x1c2,
/// <summary>
/// MIPS little-endian WCE v2
/// </summary>
IMAGE_FILE_MACHINE_WCEMIPSV2 = 0x169,
/// <summary>
/// WE32000
/// </summary>
IMAGE_FILE_MACHINE_WE32000 = 0x170
/// <summary>
/// The contents of this field are assumed to be applicable to any machine type
/// </summary>
IMAGE_FILE_MACHINE_UNKNOWN = 0x0,
/// <summary>
/// Alpha AXP
/// </summary>
IMAGE_FILE_MACHINE_ALPHA = 0x184,
/// <summary>
/// Alpha AXP 64-bit.
/// </summary>
IMAGE_FILE_MACHINE_ALPHA64 = 0x284,
/// <summary>
/// Matsushita AM33
/// </summary>
IMAGE_FILE_MACHINE_AM33 = 0x1d3,
/// <summary>
/// x64
/// </summary>
IMAGE_FILE_MACHINE_AMD64 = 0x8664,
/// <summary>
/// ARM little endian
/// </summary>
IMAGE_FILE_MACHINE_ARM = 0x1c0,
/// <summary>
/// ARM64 little endian
/// </summary>
IMAGE_FILE_MACHINE_ARM64 = 0xaa64,
/// <summary>
/// ARM Thumb-2 little endian
/// </summary>
IMAGE_FILE_MACHINE_ARMNT = 0x1c4,
/// <summary>
/// Clipper
/// </summary>
IMAGE_FILE_MACHINE_CLIPPER = 0x17f,
/// <summary>
/// EFI byte code
/// </summary>
IMAGE_FILE_MACHINE_EBC = 0xebc,
/// <summary>
/// Intel 386 or later processors and compatible processors
/// </summary>
IMAGE_FILE_MACHINE_I386 = 0x14c,
/// <summary>
/// Intel 386 or later processors and compatible processors, used by AIX
/// </summary>
IMAGE_FILE_MACHINE_I386_AIX = 0x175,
/// <summary>
/// Intel Itanium processor family
/// </summary>
IMAGE_FILE_MACHINE_IA64 = 0x200,
/// <summary>
/// Mitsubishi M32R little endian
/// </summary>
IMAGE_FILE_MACHINE_M32R = 0x9041,
/// <summary>
/// Motorola 68000 series
/// </summary>
IMAGE_FILE_MACHINE_M68K = 0x268,
/// <summary>
/// Motorola 68000 series
/// </summary>
IMAGE_FILE_MACHINE_M68K_OTHER = 0x150,
/// <summary>
/// MIPS16
/// </summary>
IMAGE_FILE_MACHINE_MIPS16 = 0x266,
/// <summary>
/// MIPS with FPU
/// </summary>
IMAGE_FILE_MACHINE_MIPSFPU = 0x366,
/// <summary>
/// MIPS16 with FPU
/// </summary>
IMAGE_FILE_MACHINE_MIPSFPU16 = 0x466,
/// <summary>
/// PowerPC little endian
/// </summary>
IMAGE_FILE_MACHINE_POWERPC = 0x1f0,
/// <summary>
/// Power PC with floating point support
/// </summary>
IMAGE_FILE_MACHINE_POWERPCFP = 0x1f1,
/// <summary>
/// MIPS big endian
/// </summary>
IMAGE_FILE_MACHINE_MIPSEB = 0x160,
/// <summary>
/// MIPS little endian
/// </summary>
IMAGE_FILE_MACHINE_R3000 = 0x162,
/// <summary>
/// MIPS little endian
/// </summary>
IMAGE_FILE_MACHINE_R4000 = 0x166,
/// <summary>
/// MIPS little endian
/// </summary>
IMAGE_FILE_MACHINE_R10000 = 0x168,
/// <summary>
/// RISC-V 32-bit address space
/// </summary>
IMAGE_FILE_MACHINE_RISCV32 = 0x5032,
/// <summary>
/// RISC-V 64-bit address space
/// </summary>
IMAGE_FILE_MACHINE_RISCV64 = 0x5064,
/// <summary>
/// RISC-V 128-bit address space
/// </summary>
IMAGE_FILE_MACHINE_RISCV128 = 0x5128,
/// <summary>
/// Hitachi SH3
/// </summary>
IMAGE_FILE_MACHINE_SH3 = 0x1a2,
/// <summary>
/// Hitachi SH3 DSP
/// </summary>
IMAGE_FILE_MACHINE_SH3DSP = 0x1a3,
/// <summary>
/// Hitachi SH4
/// </summary>
IMAGE_FILE_MACHINE_SH4 = 0x1a6,
/// <summary>
/// Hitachi SH5
/// </summary>
IMAGE_FILE_MACHINE_SH5 = 0x1a8,
/// <summary>
/// Thumb
/// </summary>
IMAGE_FILE_MACHINE_THUMB = 0x1c2,
/// <summary>
/// MIPS little-endian WCE v2
/// </summary>
IMAGE_FILE_MACHINE_WCEMIPSV2 = 0x169,
/// <summary>
/// WE32000
/// </summary>
IMAGE_FILE_MACHINE_WE32000 = 0x170
}
[Flags]
public enum SectionFlags : uint
{
/// <summary>
/// Reserved for future use.
/// </summary>
IMAGE_SCN_TYPE_DSECT = 0x00000001,
/// <summary>
/// Reserved for future use.
/// </summary>
IMAGE_SCN_TYPE_NOLOAD = 0x00000002,
/// <summary>
/// Reserved for future use.
/// </summary>
IMAGE_SCN_TYPE_GROUP = 0x00000004,
/// <summary>
/// Section should not be padded to next boundary.
/// This is obsolete and replaced by <see cref="IMAGE_SCN_ALIGN_1BYTES" />.
/// This is valid for object files only.
/// </summary>
IMAGE_SCN_TYPE_NO_PAD = 0x00000008,
/// <summary>
/// Reserved for future use.
/// </summary>
IMAGE_SCN_TYPE_COPY = 0x00000010,
/// <summary>
/// Section contains executable code.
/// </summary>
IMAGE_SCN_CNT_CODE = 0x00000020,
/// <summary>
/// Section contains initialized data.
/// </summary>
IMAGE_SCN_CNT_INITIALIZED_DATA = 0x00000040,
/// <summary>
/// Section contains uninitialized data.
/// </summary>
IMAGE_SCN_CNT_UNINITIALIZED_DATA = 0x00000080,
/// <summary>
/// Reserved for future use.
/// </summary>
IMAGE_SCN_LNK_OTHER = 0x00000100,
/// <summary>
/// Section contains comments or other information. The .drectve section has this type. This is valid for object files
/// only.
/// </summary>
IMAGE_SCN_LNK_INFO = 0x00000200,
/// <summary>
/// Reserved for future use.
/// </summary>
IMAGE_SCN_TYPE_OVER = 0x00000400,
/// <summary>
/// Section will not become part of the image. This is valid for object files only.
/// </summary>
IMAGE_SCN_LNK_REMOVE = 0x00000800,
/// <summary>
/// Section contains COMDAT data. This is valid for object files only.
/// </summary>
IMAGE_SCN_LNK_COMDAT = 0x00001000,
/// <summary>
/// Reserved for future use.
/// </summary>
IMAGE_SCN_MEM_FARDATA = 0x00008000,
/// <summary>
/// Reserved for future use.
/// </summary>
IMAGE_SCN_MEM_16BIT = 0x00020000,
/// <summary>
/// Reserved for future use.
/// </summary>
IMAGE_SCN_MEM_LOCKED = 0x00040000,
/// <summary>
/// Reserved for future use.
/// </summary>
IMAGE_SCN_MEM_PRELOAD = 0x00080000,
/// <summary>
/// Align data on a 1-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_1BYTES = 0x00100000,
/// <summary>
/// Align data on a 2-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_2BYTES = 0x00200000,
/// <summary>
/// Align data on a 4-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_4BYTES = 0x00300000,
/// <summary>
/// Align data on a 8-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_8BYTES = 0x00400000,
/// <summary>
/// Align data on a 16-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_16BYTES = 0x00500000,
/// <summary>
/// Align data on a 32-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_32BYTES = 0x00600000,
/// <summary>
/// Align data on a 64-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_64BYTES = 0x00700000,
/// <summary>
/// Align data on a 128-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_128BYTES = 0x00800000,
/// <summary>
/// Align data on a 256-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_256BYTES = 0x00900000,
/// <summary>
/// Align data on a 512-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_512BYTES = 0x00A00000,
/// <summary>
/// Align data on a 1024-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_1024BYTES = 0x00B00000,
/// <summary>
/// Align data on a 2048-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_2048BYTES = 0x00C00000,
/// <summary>
/// Align data on a 4096-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_4096BYTES = 0x00D00000,
/// <summary>
/// Align data on a 8192-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_8192BYTES = 0x00E00000,
/// <summary>
/// Section contains extended relocations.
/// </summary>
IMAGE_SCN_LNK_NRELOC_OVFL = 0x01000000,
/// <summary>
/// Section can be discarded as needed.
/// </summary>
IMAGE_SCN_MEM_DISCARDABLE = 0x02000000,
/// <summary>
/// Section cannot be cached.
/// </summary>
IMAGE_SCN_MEM_NOT_CACHED = 0x04000000,
/// <summary>
/// Section is not pageable.
/// </summary>
IMAGE_SCN_MEM_NOT_PAGED = 0x08000000,
/// <summary>
/// Section can be shared in memory.
/// </summary>
IMAGE_SCN_MEM_SHARED = 0x10000000,
/// <summary>
/// Section can be executed as code.
/// </summary>
IMAGE_SCN_MEM_EXECUTE = 0x20000000,
/// <summary>
/// Section can be read.
/// </summary>
IMAGE_SCN_MEM_READ = 0x40000000,
/// <summary>
/// Section can be written to.
/// </summary>
IMAGE_SCN_MEM_WRITE = 0x80000000
/// <summary>
/// Reserved for future use.
/// </summary>
IMAGE_SCN_TYPE_DSECT = 0x00000001,
/// <summary>
/// Reserved for future use.
/// </summary>
IMAGE_SCN_TYPE_NOLOAD = 0x00000002,
/// <summary>
/// Reserved for future use.
/// </summary>
IMAGE_SCN_TYPE_GROUP = 0x00000004,
/// <summary>
/// Section should not be padded to next boundary.
/// This is obsolete and replaced by <see cref="IMAGE_SCN_ALIGN_1BYTES" />.
/// This is valid for object files only.
/// </summary>
IMAGE_SCN_TYPE_NO_PAD = 0x00000008,
/// <summary>
/// Reserved for future use.
/// </summary>
IMAGE_SCN_TYPE_COPY = 0x00000010,
/// <summary>
/// Section contains executable code.
/// </summary>
IMAGE_SCN_CNT_CODE = 0x00000020,
/// <summary>
/// Section contains initialized data.
/// </summary>
IMAGE_SCN_CNT_INITIALIZED_DATA = 0x00000040,
/// <summary>
/// Section contains uninitialized data.
/// </summary>
IMAGE_SCN_CNT_UNINITIALIZED_DATA = 0x00000080,
/// <summary>
/// Reserved for future use.
/// </summary>
IMAGE_SCN_LNK_OTHER = 0x00000100,
/// <summary>
/// Section contains comments or other information. The .drectve section has this type. This is valid for object files
/// only.
/// </summary>
IMAGE_SCN_LNK_INFO = 0x00000200,
/// <summary>
/// Reserved for future use.
/// </summary>
IMAGE_SCN_TYPE_OVER = 0x00000400,
/// <summary>
/// Section will not become part of the image. This is valid for object files only.
/// </summary>
IMAGE_SCN_LNK_REMOVE = 0x00000800,
/// <summary>
/// Section contains COMDAT data. This is valid for object files only.
/// </summary>
IMAGE_SCN_LNK_COMDAT = 0x00001000,
/// <summary>
/// Reserved for future use.
/// </summary>
IMAGE_SCN_MEM_FARDATA = 0x00008000,
/// <summary>
/// Reserved for future use.
/// </summary>
IMAGE_SCN_MEM_16BIT = 0x00020000,
/// <summary>
/// Reserved for future use.
/// </summary>
IMAGE_SCN_MEM_LOCKED = 0x00040000,
/// <summary>
/// Reserved for future use.
/// </summary>
IMAGE_SCN_MEM_PRELOAD = 0x00080000,
/// <summary>
/// Align data on a 1-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_1BYTES = 0x00100000,
/// <summary>
/// Align data on a 2-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_2BYTES = 0x00200000,
/// <summary>
/// Align data on a 4-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_4BYTES = 0x00300000,
/// <summary>
/// Align data on a 8-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_8BYTES = 0x00400000,
/// <summary>
/// Align data on a 16-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_16BYTES = 0x00500000,
/// <summary>
/// Align data on a 32-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_32BYTES = 0x00600000,
/// <summary>
/// Align data on a 64-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_64BYTES = 0x00700000,
/// <summary>
/// Align data on a 128-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_128BYTES = 0x00800000,
/// <summary>
/// Align data on a 256-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_256BYTES = 0x00900000,
/// <summary>
/// Align data on a 512-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_512BYTES = 0x00A00000,
/// <summary>
/// Align data on a 1024-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_1024BYTES = 0x00B00000,
/// <summary>
/// Align data on a 2048-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_2048BYTES = 0x00C00000,
/// <summary>
/// Align data on a 4096-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_4096BYTES = 0x00D00000,
/// <summary>
/// Align data on a 8192-byte boundary. This is valid for object files only.
/// </summary>
IMAGE_SCN_ALIGN_8192BYTES = 0x00E00000,
/// <summary>
/// Section contains extended relocations.
/// </summary>
IMAGE_SCN_LNK_NRELOC_OVFL = 0x01000000,
/// <summary>
/// Section can be discarded as needed.
/// </summary>
IMAGE_SCN_MEM_DISCARDABLE = 0x02000000,
/// <summary>
/// Section cannot be cached.
/// </summary>
IMAGE_SCN_MEM_NOT_CACHED = 0x04000000,
/// <summary>
/// Section is not pageable.
/// </summary>
IMAGE_SCN_MEM_NOT_PAGED = 0x08000000,
/// <summary>
/// Section can be shared in memory.
/// </summary>
IMAGE_SCN_MEM_SHARED = 0x10000000,
/// <summary>
/// Section can be executed as code.
/// </summary>
IMAGE_SCN_MEM_EXECUTE = 0x20000000,
/// <summary>
/// Section can be read.
/// </summary>
IMAGE_SCN_MEM_READ = 0x40000000,
/// <summary>
/// Section can be written to.
/// </summary>
IMAGE_SCN_MEM_WRITE = 0x80000000
}
public const uint IMAGE_SCN_ALIGN_MASK = 0x00F00000;

15
libexeinfo/COFF/Info.cs
View File

@@ -31,7 +31,9 @@ namespace libexeinfo
{
public partial class COFF
{
public static string GetInfo(COFFHeader header)
public string Information => GetInfo(Header);
internal static string GetInfo(COFFHeader header)
{
DateTime epoch = new DateTime(1970, 1, 1);
StringBuilder sb = new StringBuilder();
@@ -63,9 +65,9 @@ namespace libexeinfo
if(header.characteristics.HasFlag(Characteristics.IMAGE_FILE_RELOCS_STRIPPED))
sb.AppendLine("\tExecutable contains no relocations.");
if(header.characteristics.HasFlag(Characteristics.IMAGE_FILE_EXECUTABLE_IMAGE))
sb.AppendLine("\tExecutable is valid.");
else sb.AppendLine("\tExecutable is invalid, contains errors or has not been linked correctly.");
sb.AppendLine(header.characteristics.HasFlag(Characteristics.IMAGE_FILE_EXECUTABLE_IMAGE)
? "\tExecutable is valid."
: "\tExecutable is invalid, contains errors or has not been linked correctly.");
if(!header.characteristics.HasFlag(Characteristics.IMAGE_FILE_LINE_NUMS_STRIPPED))
sb.AppendLine("\tExecutable contains line numbers.");
if(!header.characteristics.HasFlag(Characteristics.IMAGE_FILE_LOCAL_SYMS_STRIPPED))
@@ -114,10 +116,5 @@ namespace libexeinfo
sb.AppendFormat("\tData starts at {0}", header.optionalHeader.baseOfData).AppendLine();
return sb.ToString();
}
public string GetInfo()
{
return GetInfo(Header);
}
}
}

4
libexeinfo/COFF/MachineTypes.cs
View File

@@ -28,7 +28,7 @@ namespace libexeinfo
{
public partial class COFF
{
public static string MachineTypeToString(MachineTypes machine)
static string MachineTypeToString(MachineTypes machine)
{
switch(machine)
{
@@ -69,7 +69,7 @@ namespace libexeinfo
case MachineTypes.IMAGE_FILE_MACHINE_CLIPPER: return "Clipper";
case MachineTypes.IMAGE_FILE_MACHINE_WE32000: return "WE32000 series";
default:
return string.Format("Unknown machine type with code {0}", (ushort)machine);
return $"Unknown machine type with code {(ushort)machine}";
}
}
}

28
libexeinfo/IExecutable.cs Normal file
View File

@@ -0,0 +1,28 @@
using System.IO;
namespace libexeinfo
{
public interface IExecutable
{
/// <summary>
/// If <c>true</c> the executable is recognized by this instance
/// </summary>
bool Recognized { get; }
/// <summary>
/// Name of executable format
/// </summary>
string Type { get; }
/// <summary>
/// The <see cref="Stream" /> that contains the executable represented by this instance
/// </summary>
Stream BaseStream { get; }
/// <summary>
/// If <c>true</c> the executable is for a big-endian architecture
/// </summary>
bool IsBigEndian { get; }
/// <summary>
/// General description of executable contents
/// </summary>
string Information { get; }
}
}

16
libexeinfo/LX/Consts.cs
View File

@@ -28,13 +28,13 @@ namespace libexeinfo
{
public partial class LX
{
/// <summary>
/// Linear Executable signature, "LE"
/// </summary>
public const ushort Signature16 = 0x454C;
/// <summary>
/// Linear eXecutable signature, "LX"
/// </summary>
public const ushort Signature = 0x584C;
/// <summary>
/// Linear Executable signature, "LE"
/// </summary>
public const ushort Signature16 = 0x454C;
/// <summary>
/// Linear eXecutable signature, "LX"
/// </summary>
public const ushort Signature = 0x584C;
}
}

112
libexeinfo/LX/Enums.cs
View File

@@ -30,60 +30,60 @@ namespace libexeinfo
{
public partial class LX
{
/// <summary>
/// Executable module flags.
/// </summary>
[Flags]
/// <summary>
/// Executable module flags.
/// </summary>
[Flags]
public enum ModuleFlags : uint
{
/// <summary>
/// Per-Process Library Initialization
/// </summary>
PerProcessLibrary = 0x04,
/// <summary>
/// Internal fixups for the module have been applied
/// </summary>
InternalFixups = 0x10,
/// <summary>
/// External fixups for the module have been applied
/// </summary>
ExternalFixups = 0x20,
/// <summary>
/// Incompatible with Presentation Manager
/// </summary>
PMIncompatible = 0x100,
/// <summary>
/// Compatible with Presentation Manager
/// </summary>
PMCompatible = 0x200,
/// <summary>
/// Uses Presentation Manager
/// </summary>
UsesPM = 0x300,
/// <summary>
/// Module is not loadable. Contains errors or is being linked
/// </summary>
NotLoadable = 0x2000,
/// <summary>
/// Library module
/// </summary>
Library = 0x8000,
/// <summary>
/// Protected Memory Library module
/// </summary>
ProtectedMemoryLibrary = 0x18000,
/// <summary>
/// Physical Device Driver module
/// </summary>
PhysicalDeviceDriver = 0x20000,
/// <summary>
/// Virtual Device Driver module
/// </summary>
VirtualDeviceDriver = 0x28000,
/// <summary>
/// Per-process Library Termination
/// </summary>
PerProcessTermination = 0x40000000
/// <summary>
/// Per-Process Library Initialization
/// </summary>
PerProcessLibrary = 0x04,
/// <summary>
/// Internal fixups for the module have been applied
/// </summary>
InternalFixups = 0x10,
/// <summary>
/// External fixups for the module have been applied
/// </summary>
ExternalFixups = 0x20,
/// <summary>
/// Incompatible with Presentation Manager
/// </summary>
PMIncompatible = 0x100,
/// <summary>
/// Compatible with Presentation Manager
/// </summary>
PMCompatible = 0x200,
/// <summary>
/// Uses Presentation Manager
/// </summary>
UsesPM = 0x300,
/// <summary>
/// Module is not loadable. Contains errors or is being linked
/// </summary>
NotLoadable = 0x2000,
/// <summary>
/// Library module
/// </summary>
Library = 0x8000,
/// <summary>
/// Protected Memory Library module
/// </summary>
ProtectedMemoryLibrary = 0x18000,
/// <summary>
/// Physical Device Driver module
/// </summary>
PhysicalDeviceDriver = 0x20000,
/// <summary>
/// Virtual Device Driver module
/// </summary>
VirtualDeviceDriver = 0x28000,
/// <summary>
/// Per-process Library Termination
/// </summary>
PerProcessTermination = 0x40000000
}
public enum TargetCpu : ushort
@@ -100,10 +100,10 @@ namespace libexeinfo
MIPS3 = 0x42
}
/// <summary>
/// Target operating system.
/// </summary>
public enum TargetOS : ushort
/// <summary>
/// Target operating system.
/// </summary>
public enum TargetOS : ushort
{
Unknown = 0,
OS2 = 1,

7
libexeinfo/LX/Info.cs
View File

@@ -30,6 +30,8 @@ namespace libexeinfo
{
public partial class LX
{
public string Information => GetInfo(Header);
public static string GetInfo(LXHeader header)
{
StringBuilder sb = new StringBuilder();
@@ -187,10 +189,5 @@ namespace libexeinfo
sb.AppendFormat("\tHeap size added to the auto ds object: {0}", header.heap_size).AppendLine();
return sb.ToString();
}
public string GetInfo()
{
return GetInfo(Header);
}
}
}

127
libexeinfo/LX/LX.cs
View File

@@ -34,21 +34,23 @@ namespace libexeinfo
/// Represents a Microsoft/IBM Linear EXecutable
/// </summary>
// TODO: Big-endian (really needed?)
public partial class LX
public partial class LX : IExecutable
{
public readonly MZ BaseExecutable;
MZ BaseExecutable;
/// <summary>
/// The <see cref="FileStream" /> that contains the executable represented by this instance
/// </summary>
public readonly FileStream BaseStream;
public Stream BaseStream { get; }
public bool IsBigEndian => false;
/// <summary>
/// Header for this executable
/// </summary>
public readonly LXHeader Header;
LXHeader Header;
/// <summary>
/// If true this instance correctly represents a Microsoft/IBM Linear EXecutable
/// </summary>
public readonly bool IsLX;
public bool Recognized { get; private set;}
public string Type { get; private set;}
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.NE" /> class.
@@ -56,46 +58,53 @@ namespace libexeinfo
/// <param name="path">Executable path.</param>
public LX(string path)
{
IsLX = false;
BaseStream = File.Open(path, FileMode.Open, FileAccess.Read);
BaseExecutable = new MZ(BaseStream);
if(BaseExecutable.IsMZ)
if(BaseExecutable.Header.new_offset < BaseStream.Length)
{
BaseStream.Seek(BaseExecutable.Header.new_offset, SeekOrigin.Begin);
byte[] buffer = new byte[Marshal.SizeOf(typeof(LXHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
Header = (LXHeader)Marshal.PtrToStructure(hdrPtr, typeof(LXHeader));
Marshal.FreeHGlobal(hdrPtr);
IsLX = Header.signature == Signature || Header.signature == Signature16;
}
Initialize();
}
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.NE" /> class.
/// </summary>
/// <param name="stream">Stream containing the executable.</param>
public LX(FileStream stream)
public LX(Stream stream)
{
IsLX = false;
BaseStream = stream;
BaseExecutable = new MZ(BaseStream);
if(BaseExecutable.IsMZ)
if(BaseExecutable.Header.new_offset < BaseStream.Length)
{
BaseStream.Seek(BaseExecutable.Header.new_offset, SeekOrigin.Begin);
byte[] buffer = new byte[Marshal.SizeOf(typeof(LXHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
Header = (LXHeader)Marshal.PtrToStructure(hdrPtr, typeof(LXHeader));
Marshal.FreeHGlobal(hdrPtr);
IsLX = Header.signature == Signature || Header.signature == Signature16;
}
Initialize();
}
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.NE" /> class.
/// </summary>
/// <param name="data">Byte array containing the executable.</param>
public LX(byte[] data)
{
BaseStream = new MemoryStream(data);
Initialize();
}
void Initialize()
{
Recognized = false;
if(BaseStream == null) return;
BaseExecutable = new MZ(BaseStream);
if(!BaseExecutable.Recognized) return;
if(BaseExecutable.Header.new_offset >= BaseStream.Length) return;
BaseStream.Seek(BaseExecutable.Header.new_offset, SeekOrigin.Begin);
byte[] buffer = new byte[Marshal.SizeOf(typeof(LXHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
Header = (LXHeader)Marshal.PtrToStructure(hdrPtr, typeof(LXHeader));
Marshal.FreeHGlobal(hdrPtr);
Recognized = Header.signature == Signature || Header.signature == Signature16;
if(!Recognized) return;
Type = Header.signature == Signature16 ? "Linear Executable (LE)" : "Linear eXecutable (LX)";
}
/// <summary>
/// Identifies if the specified executable is a Microsoft/IBM Linear EXecutable
/// </summary>
@@ -105,20 +114,19 @@ namespace libexeinfo
{
FileStream BaseStream = File.Open(path, FileMode.Open, FileAccess.Read);
MZ BaseExecutable = new MZ(BaseStream);
if(BaseExecutable.IsMZ)
if(BaseExecutable.Header.new_offset < BaseStream.Length)
{
BaseStream.Seek(BaseExecutable.Header.new_offset, SeekOrigin.Begin);
byte[] buffer = new byte[Marshal.SizeOf(typeof(LXHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
LXHeader Header = (LXHeader)Marshal.PtrToStructure(hdrPtr, typeof(LXHeader));
Marshal.FreeHGlobal(hdrPtr);
return Header.signature == Signature || Header.signature == Signature16;
}
if(!BaseExecutable.Recognized) return false;
if(BaseExecutable.Header.new_offset >= BaseStream.Length) return false;
BaseStream.Seek(BaseExecutable.Header.new_offset, SeekOrigin.Begin);
byte[] buffer = new byte[Marshal.SizeOf(typeof(LXHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
LXHeader Header = (LXHeader)Marshal.PtrToStructure(hdrPtr, typeof(LXHeader));
Marshal.FreeHGlobal(hdrPtr);
return Header.signature == Signature || Header.signature == Signature16;
return false;
}
/// <summary>
@@ -130,20 +138,19 @@ namespace libexeinfo
{
FileStream BaseStream = stream;
MZ BaseExecutable = new MZ(BaseStream);
if(BaseExecutable.IsMZ)
if(BaseExecutable.Header.new_offset < BaseStream.Length)
{
BaseStream.Seek(BaseExecutable.Header.new_offset, SeekOrigin.Begin);
byte[] buffer = new byte[Marshal.SizeOf(typeof(LXHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
LXHeader Header = (LXHeader)Marshal.PtrToStructure(hdrPtr, typeof(LXHeader));
Marshal.FreeHGlobal(hdrPtr);
return Header.signature == Signature || Header.signature == Signature16;
}
if(!BaseExecutable.Recognized) return false;
if(BaseExecutable.Header.new_offset >= BaseStream.Length) return false;
BaseStream.Seek(BaseExecutable.Header.new_offset, SeekOrigin.Begin);
byte[] buffer = new byte[Marshal.SizeOf(typeof(LXHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
LXHeader Header = (LXHeader)Marshal.PtrToStructure(hdrPtr, typeof(LXHeader));
Marshal.FreeHGlobal(hdrPtr);
return Header.signature == Signature || Header.signature == Signature16;
return false;
}
}
}

8
libexeinfo/MZ/Consts.cs
View File

@@ -28,9 +28,9 @@ namespace libexeinfo
{
public partial class MZ
{
/// <summary>
/// MZ executable signature, "MZ"
/// </summary>
public const ushort Signature = 0x5A4D;
/// <summary>
/// MZ executable signature, "MZ"
/// </summary>
public const ushort Signature = 0x5A4D;
}
}

27
libexeinfo/MZ/Info.cs
View File

@@ -30,12 +30,18 @@ namespace libexeinfo
{
public partial class MZ
{
/// <summary>
/// Gets a string with human readable information for a given MZ header
/// </summary>
/// <returns>Human readable information for given MZ header.</returns>
/// <param name="header">MZ executable header.</param>
public static string GetInfo(MZHeader header)
/// <summary>
/// Gets a string with human readable information for the MZ executable represented by this instance
/// </summary>
/// <value>Human readable information for this instance.</value>
public string Information => GetInfo(Header);
/// <summary>
/// Gets a string with human readable information for a given MZ header
/// </summary>
/// <returns>Human readable information for given MZ header.</returns>
/// <param name="header">MZ executable header.</param>
public static string GetInfo(MZHeader header)
{
StringBuilder sb = new StringBuilder();
sb.AppendLine("DOS MZ executable:");
@@ -60,14 +66,5 @@ namespace libexeinfo
sb.AppendFormat("\tOffset to new header: {0}", header.new_offset).AppendLine();
return sb.ToString();
}
/// <summary>
/// Gets a string with human readable information for the MZ executable represented by this instance
/// </summary>
/// <returns>Human readable information for this instance.</returns>
public string GetInfo()
{
return GetInfo(Header);
}
}
}

123
libexeinfo/MZ/MZ.cs
View File

@@ -30,77 +30,94 @@ using System.Runtime.InteropServices;
namespace libexeinfo
{
/// <summary>
/// Represents a DOS relocatable executable
/// </summary>
public partial class MZ
/// <summary>
/// Represents a DOS relocatable executable
/// </summary>
public partial class MZ : IExecutable
{
/// <summary>
/// The <see cref="FileStream" /> that contains the executable represented by this instance
/// </summary>
public readonly FileStream BaseStream;
/// <summary>
/// Header for this executable
/// </summary>
public readonly MZHeader Header;
/// <summary>
/// If true this instance correctly represents a DOS relocatable executable
/// </summary>
public readonly bool IsMZ;
/// <summary>
/// Header for this executable
/// </summary>
internal MZHeader Header;
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.MZ" /> class.
/// </summary>
/// <param name="path">Executable path.</param>
public MZ(string path)
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.MZ" /> class.
/// </summary>
/// <param name="path">Executable path.</param>
public MZ(string path)
{
BaseStream = File.Open(path, FileMode.Open, FileAccess.Read);
Initialize();
}
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.MZ" /> class.
/// </summary>
/// <param name="stream">Stream containing the executable.</param>
public MZ(Stream stream)
{
BaseStream = stream;
Initialize();
}
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.MZ" /> class.
/// </summary>
/// <param name="data">Byte array containing the executable.</param>
public MZ(byte[] data)
{
BaseStream = new MemoryStream(data);
Initialize();
}
/// <summary>
/// The <see cref="FileStream" /> that contains the executable represented by this instance
/// </summary>
public Stream BaseStream { get; }
public bool IsBigEndian => false;
/// <summary>
/// If true this instance correctly represents a DOS relocatable executable
/// </summary>
public bool Recognized { get; private set; }
public string Type { get; private set; }
void Initialize()
{
Recognized = false;
if(BaseStream == null) return;
byte[] buffer = new byte[Marshal.SizeOf(typeof(MZHeader))];
BaseStream = File.Open(path, FileMode.Open, FileAccess.Read);
BaseStream.Position = 0;
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
Header = (MZHeader)Marshal.PtrToStructure(hdrPtr, typeof(MZHeader));
Marshal.FreeHGlobal(hdrPtr);
IsMZ = Header.signature == Signature;
Recognized = Header.signature == Signature;
if(!Recognized) return;
Type = "DOS Executable (MZ)";
}
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.MZ" /> class.
/// </summary>
/// <param name="stream">Stream containing the executable.</param>
public MZ(FileStream stream)
{
byte[] buffer = new byte[Marshal.SizeOf(typeof(MZHeader))];
BaseStream = stream;
BaseStream.Position = 0;
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
Header = (MZHeader)Marshal.PtrToStructure(hdrPtr, typeof(MZHeader));
Marshal.FreeHGlobal(hdrPtr);
IsMZ = Header.signature == Signature;
}
/// <summary>
/// Identifies if the specified executable is a DOS relocatable executable
/// </summary>
/// <returns><c>true</c> if the specified executable is a DOS relocatable executable, <c>false</c> otherwise.</returns>
/// <param name="path">Executable path.</param>
public static bool Identify(string path)
/// <summary>
/// Identifies if the specified executable is a DOS relocatable executable
/// </summary>
/// <returns><c>true</c> if the specified executable is a DOS relocatable executable, <c>false</c> otherwise.</returns>
/// <param name="path">Executable path.</param>
public static bool Identify(string path)
{
FileStream exeFs = File.Open(path, FileMode.Open, FileAccess.Read);
return Identify(exeFs);
}
/// <summary>
/// Identifies if the specified executable is a DOS relocatable executable
/// </summary>
/// <returns><c>true</c> if the specified executable is a DOS relocatable executable, <c>false</c> otherwise.</returns>
/// <param name="stream">Stream containing the executable.</param>
public static bool Identify(FileStream stream)
/// <summary>
/// Identifies if the specified executable is a DOS relocatable executable
/// </summary>
/// <returns><c>true</c> if the specified executable is a DOS relocatable executable, <c>false</c> otherwise.</returns>
/// <param name="stream">Stream containing the executable.</param>
public static bool Identify(FileStream stream)
{
byte[] buffer = new byte[Marshal.SizeOf(typeof(MZHeader))];

36
libexeinfo/NE/Consts.cs
View File

@@ -28,25 +28,25 @@ namespace libexeinfo
{
public partial class NE
{
/// <summary>
/// New Executable signature, "NE"
/// </summary>
public const ushort Signature = 0x454E;
/// <summary>
/// Signature for a <see cref="FixedFileInfo" />
/// </summary>
public static readonly string FixedFileInfoSig = "VS_VERSION_INFO";
/// <summary>
/// Signature for list of name=value strings inside a version resource
/// </summary>
public static readonly string StringFileInfo = "StringFileInfo";
/// <summary>
/// New Executable signature, "NE"
/// </summary>
public const ushort Signature = 0x454E;
/// <summary>
/// Signature for a <see cref="FixedFileInfo" />
/// </summary>
public static readonly string FixedFileInfoSig = "VS_VERSION_INFO";
/// <summary>
/// Signature for list of name=value strings inside a version resource
/// </summary>
public static readonly string StringFileInfo = "StringFileInfo";
/// <summary>
/// Gets the name of a resource type according to its identifier
/// </summary>
/// <returns>The resource type name.</returns>
/// <param name="id">Resource type identifier.</param>
public static string ResourceIdToName(ushort id)
/// <summary>
/// Gets the name of a resource type according to its identifier
/// </summary>
/// <returns>The resource type name.</returns>
/// <param name="id">Resource type identifier.</param>
public static string ResourceIdToName(ushort id)
{
switch(id & 0x7FFF)
{

9
libexeinfo/NE/Info.cs
View File

@@ -33,6 +33,8 @@ namespace libexeinfo
{
public partial class NE
{
public string Information => GetInfo(Header);
public static string GetInfo(NEHeader header)
{
StringBuilder sb = new StringBuilder();
@@ -192,12 +194,7 @@ namespace libexeinfo
return sb.ToString();
}
public string GetInfo()
{
return GetInfo(Header);
}
public static ResourceTable GetResources(FileStream stream, uint neStart, ushort tableOff)
public static ResourceTable GetResources(Stream stream, uint neStart, ushort tableOff)
{
long oldPosition = stream.Position;
byte[] DW = new byte[2];

222
libexeinfo/NE/NE.cs
View File

@@ -30,139 +30,131 @@ using System.Runtime.InteropServices;
namespace libexeinfo
{
/// <summary>
/// Represents a Microsoft New Executable
/// </summary>
public partial class NE
/// <summary>
/// Represents a Microsoft New Executable
/// </summary>
public partial class NE : IExecutable
{
public readonly MZ BaseExecutable;
/// <summary>
/// The <see cref="FileStream" /> that contains the executable represented by this instance
/// </summary>
public readonly FileStream BaseStream;
/// <summary>
/// Header for this executable
/// </summary>
public readonly NEHeader Header;
/// <summary>
/// If true this instance correctly represents a Microsoft New Executable
/// </summary>
public readonly bool IsNE;
public readonly ResourceTable Resources;
public readonly Version[] Versions;
MZ BaseExecutable;
/// <summary>
/// Header for this executable
/// </summary>
public NEHeader Header;
public ResourceTable Resources;
public Version[] Versions;
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.NE" /> class.
/// </summary>
/// <param name="path">Executable path.</param>
public NE(string path)
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.NE" /> class.
/// </summary>
/// <param name="path">Executable path.</param>
public NE(string path)
{
IsNE = false;
BaseStream = File.Open(path, FileMode.Open, FileAccess.Read);
BaseExecutable = new MZ(BaseStream);
if(BaseExecutable.IsMZ)
if(BaseExecutable.Header.new_offset < BaseStream.Length)
{
BaseStream.Seek(BaseExecutable.Header.new_offset, SeekOrigin.Begin);
byte[] buffer = new byte[Marshal.SizeOf(typeof(NEHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
Header = (NEHeader)Marshal.PtrToStructure(hdrPtr, typeof(NEHeader));
Marshal.FreeHGlobal(hdrPtr);
if(Header.signature == Signature)
{
IsNE = true;
if(Header.resource_entries > 0)
{
Resources = GetResources(BaseStream, BaseExecutable.Header.new_offset,
Header.resource_table_offset);
Versions = GetVersions().ToArray();
}
}
}
BaseStream = File.Open(path, FileMode.Open, FileAccess.Read);
Initialize();
}
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.NE" /> class.
/// </summary>
/// <param name="stream">Stream containing the executable.</param>
public NE(FileStream stream)
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.NE" /> class.
/// </summary>
/// <param name="stream">Stream containing the executable.</param>
public NE(Stream stream)
{
IsNE = false;
BaseStream = stream;
BaseExecutable = new MZ(BaseStream);
if(BaseExecutable.IsMZ)
if(BaseExecutable.Header.new_offset < BaseStream.Length)
{
BaseStream.Seek(BaseExecutable.Header.new_offset, SeekOrigin.Begin);
byte[] buffer = new byte[Marshal.SizeOf(typeof(NEHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
Header = (NEHeader)Marshal.PtrToStructure(hdrPtr, typeof(NEHeader));
Marshal.FreeHGlobal(hdrPtr);
if(Header.signature == Signature)
{
IsNE = true;
if(Header.resource_entries > 0)
{
Resources = GetResources(BaseStream, BaseExecutable.Header.new_offset,
Header.resource_table_offset);
Versions = GetVersions().ToArray();
}
}
}
BaseStream = stream;
Initialize();
}
/// <summary>
/// Identifies if the specified executable is a Microsoft New Executable
/// </summary>
/// <returns><c>true</c> if the specified executable is a Microsoft New Executable, <c>false</c> otherwise.</returns>
/// <param name="path">Executable path.</param>
public static bool Identify(string path)
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.NE" /> class.
/// </summary>
/// <param name="data">Stream containing the executable.</param>
public NE(byte[] data)
{
BaseStream = new MemoryStream(data);
Initialize();
}
/// <summary>
/// The <see cref="FileStream" /> that contains the executable represented by this instance
/// </summary>
public Stream BaseStream { get; }
public bool IsBigEndian => false;
/// <summary>
/// If true this instance correctly represents a Microsoft New Executable
/// </summary>
public bool Recognized { get; private set; }
public string Type { get; }
void Initialize()
{
Recognized = false;
if(BaseStream == null) return;
BaseExecutable = new MZ(BaseStream);
if(!BaseExecutable.Recognized) return;
if(BaseExecutable.Header.new_offset >= BaseStream.Length) return;
BaseStream.Seek(BaseExecutable.Header.new_offset, SeekOrigin.Begin);
byte[] buffer = new byte[Marshal.SizeOf(typeof(NEHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
Header = (NEHeader)Marshal.PtrToStructure(hdrPtr, typeof(NEHeader));
Marshal.FreeHGlobal(hdrPtr);
if(Header.signature != Signature) return;
Recognized = true;
if(Header.resource_entries <= 0) return;
Resources = GetResources(BaseStream, BaseExecutable.Header.new_offset, Header.resource_table_offset);
Versions = GetVersions().ToArray();
}
/// <summary>
/// Identifies if the specified executable is a Microsoft New Executable
/// </summary>
/// <returns><c>true</c> if the specified executable is a Microsoft New Executable, <c>false</c> otherwise.</returns>
/// <param name="path">Executable path.</param>
public static bool Identify(string path)
{
FileStream BaseStream = File.Open(path, FileMode.Open, FileAccess.Read);
MZ BaseExecutable = new MZ(BaseStream);
if(BaseExecutable.IsMZ)
if(BaseExecutable.Header.new_offset < BaseStream.Length)
{
BaseStream.Seek(BaseExecutable.Header.new_offset, SeekOrigin.Begin);
byte[] buffer = new byte[Marshal.SizeOf(typeof(NEHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
NEHeader Header = (NEHeader)Marshal.PtrToStructure(hdrPtr, typeof(NEHeader));
Marshal.FreeHGlobal(hdrPtr);
return Header.signature == Signature;
}
if(!BaseExecutable.Recognized) return false;
return false;
if(BaseExecutable.Header.new_offset >= BaseStream.Length) return false;
BaseStream.Seek(BaseExecutable.Header.new_offset, SeekOrigin.Begin);
byte[] buffer = new byte[Marshal.SizeOf(typeof(NEHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
NEHeader Header = (NEHeader)Marshal.PtrToStructure(hdrPtr, typeof(NEHeader));
Marshal.FreeHGlobal(hdrPtr);
return Header.signature == Signature;
}
/// <summary>
/// Identifies if the specified executable is a Microsoft New Executable
/// </summary>
/// <returns><c>true</c> if the specified executable is a Microsoft New Executable, <c>false</c> otherwise.</returns>
/// <param name="stream">Stream containing the executable.</param>
public static bool Identify(FileStream stream)
/// <summary>
/// Identifies if the specified executable is a Microsoft New Executable
/// </summary>
/// <returns><c>true</c> if the specified executable is a Microsoft New Executable, <c>false</c> otherwise.</returns>
/// <param name="stream">Stream containing the executable.</param>
public static bool Identify(FileStream stream)
{
FileStream BaseStream = stream;
MZ BaseExecutable = new MZ(BaseStream);
if(BaseExecutable.IsMZ)
if(BaseExecutable.Header.new_offset < BaseStream.Length)
{
BaseStream.Seek(BaseExecutable.Header.new_offset, SeekOrigin.Begin);
byte[] buffer = new byte[Marshal.SizeOf(typeof(NEHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
NEHeader Header = (NEHeader)Marshal.PtrToStructure(hdrPtr, typeof(NEHeader));
Marshal.FreeHGlobal(hdrPtr);
return Header.signature == Signature;
}
if(!BaseExecutable.Recognized) return false;
return false;
if(BaseExecutable.Header.new_offset >= BaseStream.Length) return false;
BaseStream.Seek(BaseExecutable.Header.new_offset, SeekOrigin.Begin);
byte[] buffer = new byte[Marshal.SizeOf(typeof(NEHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
NEHeader Header = (NEHeader)Marshal.PtrToStructure(hdrPtr, typeof(NEHeader));
Marshal.FreeHGlobal(hdrPtr);
return Header.signature == Signature;
}
}
}

8
libexeinfo/PE/Consts.cs
View File

@@ -28,10 +28,10 @@ namespace libexeinfo
{
public partial class PE
{
/// <summary>
/// Portable Executable signature, "PE\0\0"
/// </summary>
public const ushort Signature = 0x00004550;
/// <summary>
/// Portable Executable signature, "PE\0\0"
/// </summary>
public const ushort Signature = 0x00004550;
public const ushort PE32 = COFF.ZMAGIC;
public const ushort PE32Plus = 0x20b;
}

258
libexeinfo/PE/Enums.cs
View File

@@ -32,26 +32,26 @@ namespace libexeinfo
{
public enum DebugTypes : uint
{
/// <summary>
/// Unknown value, ignored by all tools.
/// </summary>
IMAGE_DEBUG_TYPE_UNKNOWN = 0,
/// <summary>
/// COFF debug information (line numbers, symbol table, and string table).
/// This type of debug information is also pointed to by fields in the file headers.
/// </summary>
IMAGE_DEBUG_TYPE_COFF = 1,
/// <summary>
/// CodeView debug information. The format of the data block is described
/// by the CV4 specification.
/// </summary>
IMAGE_DEBUG_TYPE_CODEVIEW = 2,
/// <summary>
/// Frame Pointer Omission (FPO) information. This information tells the
/// debugger how to interpret non-standard stack frames, which use the
/// EBP register for a purpose other than as a frame pointer.
/// </summary>
IMAGE_DEBUG_TYPE_FPO = 3,
/// <summary>
/// Unknown value, ignored by all tools.
/// </summary>
IMAGE_DEBUG_TYPE_UNKNOWN = 0,
/// <summary>
/// COFF debug information (line numbers, symbol table, and string table).
/// This type of debug information is also pointed to by fields in the file headers.
/// </summary>
IMAGE_DEBUG_TYPE_COFF = 1,
/// <summary>
/// CodeView debug information. The format of the data block is described
/// by the CV4 specification.
/// </summary>
IMAGE_DEBUG_TYPE_CODEVIEW = 2,
/// <summary>
/// Frame Pointer Omission (FPO) information. This information tells the
/// debugger how to interpret non-standard stack frames, which use the
/// EBP register for a purpose other than as a frame pointer.
/// </summary>
IMAGE_DEBUG_TYPE_FPO = 3,
IMAGE_DEBUG_TYPE_MISC = 4,
IMAGE_DEBUG_TYPE_EXCEPTION = 5,
IMAGE_DEBUG_TYPE_FIXUP = 6,
@@ -60,120 +60,120 @@ namespace libexeinfo
IMAGE_DEBUG_TYPE_BORLAND = 9
}
/// <summary>
/// The following values are defined for the DllCharacteristics field of the optional header.
/// </summary>
[Flags]
/// <summary>
/// The following values are defined for the DllCharacteristics field of the optional header.
/// </summary>
[Flags]
public enum DllCharacteristics : ushort
{
/// <summary>
/// Image can handle a high entropy 64-bit virtual address space.
/// </summary>
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA = 0x0020,
/// <summary>
/// DLL can be relocated at load time.
/// </summary>
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE = 0x0040,
/// <summary>
/// Code Integrity checks are enforced.
/// </summary>
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY = 0x0080,
/// <summary>
/// Image is NX compatible.
/// </summary>
IMAGE_DLLCHARACTERISTICS_NX_COMPAT = 0x0100,
/// <summary>
/// Isolation aware, but do not isolate the image.
/// </summary>
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION = 0x0200,
/// <summary>
/// Does not use structured exception (SE) handling. No SE handler may be called in this image.
/// </summary>
IMAGE_DLLCHARACTERISTICS_NO_SEH = 0x0400,
/// <summary>
/// Do not bind the image.
/// </summary>
IMAGE_DLLCHARACTERISTICS_NO_BIND = 0x0800,
/// <summary>
/// Image must execute in an AppContainer.
/// </summary>
IMAGE_DLLCHARACTERISTICS_APPCONTAINER = 0x1000,
/// <summary>
/// A WDM driver.
/// </summary>
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER = 0x2000,
/// <summary>
/// Image supports Control Flow Guard.
/// </summary>
IMAGE_DLLCHARACTERISTICS_GUARD_CF = 0x4000,
/// <summary>
/// Terminal Server aware.
/// </summary>
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = 0x8000
/// <summary>
/// Image can handle a high entropy 64-bit virtual address space.
/// </summary>
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA = 0x0020,
/// <summary>
/// DLL can be relocated at load time.
/// </summary>
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE = 0x0040,
/// <summary>
/// Code Integrity checks are enforced.
/// </summary>
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY = 0x0080,
/// <summary>
/// Image is NX compatible.
/// </summary>
IMAGE_DLLCHARACTERISTICS_NX_COMPAT = 0x0100,
/// <summary>
/// Isolation aware, but do not isolate the image.
/// </summary>
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION = 0x0200,
/// <summary>
/// Does not use structured exception (SE) handling. No SE handler may be called in this image.
/// </summary>
IMAGE_DLLCHARACTERISTICS_NO_SEH = 0x0400,
/// <summary>
/// Do not bind the image.
/// </summary>
IMAGE_DLLCHARACTERISTICS_NO_BIND = 0x0800,
/// <summary>
/// Image must execute in an AppContainer.
/// </summary>
IMAGE_DLLCHARACTERISTICS_APPCONTAINER = 0x1000,
/// <summary>
/// A WDM driver.
/// </summary>
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER = 0x2000,
/// <summary>
/// Image supports Control Flow Guard.
/// </summary>
IMAGE_DLLCHARACTERISTICS_GUARD_CF = 0x4000,
/// <summary>
/// Terminal Server aware.
/// </summary>
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = 0x8000
}
/// <summary>
/// The following values defined for the Subsystem field of the optional header determine which Windows subsystem (if
/// any) is required to run the image.
/// </summary>
public enum Subsystems : ushort
/// <summary>
/// The following values defined for the Subsystem field of the optional header determine which Windows subsystem (if
/// any) is required to run the image.
/// </summary>
public enum Subsystems : ushort
{
/// <summary>
/// An unknown subsystem
/// </summary>
IMAGE_SUBSYSTEM_UNKNOWN = 0,
/// <summary>
/// Device drivers and native Windows processes
/// </summary>
IMAGE_SUBSYSTEM_NATIVE = 1,
/// <summary>
/// The Windows graphical user interface (GUI) subsystem
/// </summary>
IMAGE_SUBSYSTEM_WINDOWS_GUI = 2,
/// <summary>
/// The Windows character subsystem
/// </summary>
IMAGE_SUBSYSTEM_WINDOWS_CUI = 3,
/// <summary>
/// The OS/2 character subsystem
/// </summary>
IMAGE_SUBSYSTEM_OS2_CUI = 5,
/// <summary>
/// The Posix character subsystem
/// </summary>
IMAGE_SUBSYSTEM_POSIX_CUI = 7,
/// <summary>
/// Native Win9x driver
/// </summary>
IMAGE_SUBSYSTEM_NATIVE_WINDOWS = 8,
/// <summary>
/// Windows CE
/// </summary>
IMAGE_SUBSYSTEM_WINDOWS_CE_GUI = 9,
/// <summary>
/// An Extensible Firmware Interface (EFI) application
/// </summary>
IMAGE_SUBSYSTEM_EFI_APPLICATION = 10,
/// <summary>
/// An EFI driver with boot services
/// </summary>
IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER = 11,
/// <summary>
/// An EFI driver with run-time services
/// </summary>
IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER = 12,
/// <summary>
/// An EFI ROM image
/// </summary>
IMAGE_SUBSYSTEM_EFI_ROM = 13,
/// <summary>
/// XBOX
/// </summary>
IMAGE_SUBSYSTEM_XBOX = 14,
/// <summary>
/// Windows boot application
/// </summary>
IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION = 16
/// <summary>
/// An unknown subsystem
/// </summary>
IMAGE_SUBSYSTEM_UNKNOWN = 0,
/// <summary>
/// Device drivers and native Windows processes
/// </summary>
IMAGE_SUBSYSTEM_NATIVE = 1,
/// <summary>
/// The Windows graphical user interface (GUI) subsystem
/// </summary>
IMAGE_SUBSYSTEM_WINDOWS_GUI = 2,
/// <summary>
/// The Windows character subsystem
/// </summary>
IMAGE_SUBSYSTEM_WINDOWS_CUI = 3,
/// <summary>
/// The OS/2 character subsystem
/// </summary>
IMAGE_SUBSYSTEM_OS2_CUI = 5,
/// <summary>
/// The Posix character subsystem
/// </summary>
IMAGE_SUBSYSTEM_POSIX_CUI = 7,
/// <summary>
/// Native Win9x driver
/// </summary>
IMAGE_SUBSYSTEM_NATIVE_WINDOWS = 8,
/// <summary>
/// Windows CE
/// </summary>
IMAGE_SUBSYSTEM_WINDOWS_CE_GUI = 9,
/// <summary>
/// An Extensible Firmware Interface (EFI) application
/// </summary>
IMAGE_SUBSYSTEM_EFI_APPLICATION = 10,
/// <summary>
/// An EFI driver with boot services
/// </summary>
IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER = 11,
/// <summary>
/// An EFI driver with run-time services
/// </summary>
IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER = 12,
/// <summary>
/// An EFI ROM image
/// </summary>
IMAGE_SUBSYSTEM_EFI_ROM = 13,
/// <summary>
/// XBOX
/// </summary>
IMAGE_SUBSYSTEM_XBOX = 14,
/// <summary>
/// Windows boot application
/// </summary>
IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION = 16
}
}
}

7
libexeinfo/PE/Info.cs
View File

@@ -30,6 +30,8 @@ namespace libexeinfo
{
public partial class PE
{
public string Information => GetInfo(Header, WinHeader);
public static string GetInfo(PEHeader header, WindowsHeader64 winheader)
{
StringBuilder sb = new StringBuilder();
@@ -97,10 +99,5 @@ namespace libexeinfo
return sb.ToString();
}
public string GetInfo()
{
return GetInfo(Header, WinHeader);
}
}
}

264
libexeinfo/PE/PE.cs
View File

@@ -30,164 +30,148 @@ using System.Runtime.InteropServices;
namespace libexeinfo
{
/// <summary>
/// Represents a Microsoft Portable Executable
/// </summary>
public partial class PE
/// <summary>
/// Represents a Microsoft Portable Executable
/// </summary>
public partial class PE : IExecutable
{
public readonly MZ BaseExecutable;
/// <summary>
/// The <see cref="FileStream" /> that contains the executable represented by this instance
/// </summary>
public readonly FileStream BaseStream;
/// <summary>
/// Header for this executable
/// </summary>
public readonly PEHeader Header;
/// <summary>
/// If true this instance correctly represents a Microsoft Portable Executable
/// </summary>
public readonly bool IsPE;
public readonly WindowsHeader64 WinHeader;
MZ BaseExecutable;
/// <summary>
/// Header for this executable
/// </summary>
PEHeader Header;
WindowsHeader64 WinHeader;
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.PE" /> class.
/// </summary>
/// <param name="path">Executable path.</param>
public PE(string path)
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.PE" /> class.
/// </summary>
/// <param name="path">Executable path.</param>
public PE(string path)
{
IsPE = false;
BaseStream = File.Open(path, FileMode.Open, FileAccess.Read);
BaseExecutable = new MZ(BaseStream);
if(BaseExecutable.IsMZ)
if(BaseExecutable.Header.new_offset < BaseStream.Length)
{
BaseStream.Seek(BaseExecutable.Header.new_offset, SeekOrigin.Begin);
byte[] buffer = new byte[Marshal.SizeOf(typeof(PEHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
Header = (PEHeader)Marshal.PtrToStructure(hdrPtr, typeof(PEHeader));
Marshal.FreeHGlobal(hdrPtr);
IsPE = Header.signature == Signature;
if(IsPE)
if(Header.coff.optionalHeader.magic == PE32Plus)
{
BaseStream.Position -= 4;
buffer = new byte[Marshal.SizeOf(typeof(WindowsHeader64))];
BaseStream.Read(buffer, 0, buffer.Length);
hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
WinHeader = (WindowsHeader64)Marshal.PtrToStructure(hdrPtr, typeof(WindowsHeader64));
Marshal.FreeHGlobal(hdrPtr);
}
else
{
buffer = new byte[Marshal.SizeOf(typeof(WindowsHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
WindowsHeader hdr32 = (WindowsHeader)Marshal.PtrToStructure(hdrPtr, typeof(WindowsHeader));
Marshal.FreeHGlobal(hdrPtr);
WinHeader = ToPlus(hdr32);
}
}
BaseStream = File.Open(path, FileMode.Open, FileAccess.Read);
Initialize();
}
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.PE" /> class.
/// </summary>
/// <param name="stream">Stream containing the executable.</param>
public PE(FileStream stream)
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.PE" /> class.
/// </summary>
/// <param name="stream">Stream containing the executable.</param>
public PE(Stream stream)
{
IsPE = false;
BaseStream = stream;
BaseExecutable = new MZ(BaseStream);
if(BaseExecutable.IsMZ)
if(BaseExecutable.Header.new_offset < BaseStream.Length)
{
BaseStream.Seek(BaseExecutable.Header.new_offset, SeekOrigin.Begin);
byte[] buffer = new byte[Marshal.SizeOf(typeof(PEHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
Header = (PEHeader)Marshal.PtrToStructure(hdrPtr, typeof(PEHeader));
Marshal.FreeHGlobal(hdrPtr);
IsPE = Header.signature == Signature;
if(IsPE)
if(Header.coff.optionalHeader.magic == PE32Plus)
{
BaseStream.Position -= 4;
buffer = new byte[Marshal.SizeOf(typeof(WindowsHeader64))];
BaseStream.Read(buffer, 0, buffer.Length);
hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
WinHeader = (WindowsHeader64)Marshal.PtrToStructure(hdrPtr, typeof(WindowsHeader64));
Marshal.FreeHGlobal(hdrPtr);
}
else
{
buffer = new byte[Marshal.SizeOf(typeof(WindowsHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
WindowsHeader hdr32 = (WindowsHeader)Marshal.PtrToStructure(hdrPtr, typeof(WindowsHeader));
Marshal.FreeHGlobal(hdrPtr);
WinHeader = ToPlus(hdr32);
}
}
BaseStream = stream;
Initialize();
}
/// <summary>
/// Identifies if the specified executable is a Microsoft Portable Executable
/// </summary>
/// <returns><c>true</c> if the specified executable is a Microsoft Portable Executable, <c>false</c> otherwise.</returns>
/// <param name="path">Executable path.</param>
public static bool Identify(string path)
/// <summary>
/// Initializes a new instance of the <see cref="T:libexeinfo.PE" /> class.
/// </summary>
/// <param name="data">Byte array containing the executable.</param>
public PE(byte[] data)
{
BaseStream = new MemoryStream(data);
Initialize();
}
/// <summary>
/// The <see cref="FileStream" /> that contains the executable represented by this instance
/// </summary>
public Stream BaseStream { get; }
public bool IsBigEndian => false;
/// <summary>
/// If true this instance correctly represents a Microsoft Portable Executable
/// </summary>
public bool Recognized { get; private set; }
public string Type { get; private set; }
void Initialize()
{
Recognized = false;
if(BaseStream == null) return;
BaseExecutable = new MZ(BaseStream);
if(!BaseExecutable.Recognized) return;
if(BaseExecutable.Header.new_offset >= BaseStream.Length) return;
BaseStream.Seek(BaseExecutable.Header.new_offset, SeekOrigin.Begin);
byte[] buffer = new byte[Marshal.SizeOf(typeof(PEHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
Header = (PEHeader)Marshal.PtrToStructure(hdrPtr, typeof(PEHeader));
Marshal.FreeHGlobal(hdrPtr);
Recognized = Header.signature == Signature;
if(!Recognized) return;
Type = "Portable Executable (PE)";
if(Header.coff.optionalHeader.magic == PE32Plus)
{
BaseStream.Position -= 4;
buffer = new byte[Marshal.SizeOf(typeof(WindowsHeader64))];
BaseStream.Read(buffer, 0, buffer.Length);
hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
WinHeader = (WindowsHeader64)Marshal.PtrToStructure(hdrPtr, typeof(WindowsHeader64));
Marshal.FreeHGlobal(hdrPtr);
}
else
{
buffer = new byte[Marshal.SizeOf(typeof(WindowsHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
WindowsHeader hdr32 = (WindowsHeader)Marshal.PtrToStructure(hdrPtr, typeof(WindowsHeader));
Marshal.FreeHGlobal(hdrPtr);
WinHeader = ToPlus(hdr32);
}
}
/// <summary>
/// Identifies if the specified executable is a Microsoft Portable Executable
/// </summary>
/// <returns><c>true</c> if the specified executable is a Microsoft Portable Executable, <c>false</c> otherwise.</returns>
/// <param name="path">Executable path.</param>
public static bool Identify(string path)
{
FileStream BaseStream = File.Open(path, FileMode.Open, FileAccess.Read);
MZ BaseExecutable = new MZ(BaseStream);
if(BaseExecutable.IsMZ)
if(BaseExecutable.Header.new_offset < BaseStream.Length)
{
BaseStream.Seek(BaseExecutable.Header.new_offset, SeekOrigin.Begin);
byte[] buffer = new byte[Marshal.SizeOf(typeof(PEHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
PEHeader Header = (PEHeader)Marshal.PtrToStructure(hdrPtr, typeof(PEHeader));
Marshal.FreeHGlobal(hdrPtr);
return Header.signature == Signature;
}
if(!BaseExecutable.Recognized) return false;
return false;
if(BaseExecutable.Header.new_offset >= BaseStream.Length) return false;
BaseStream.Seek(BaseExecutable.Header.new_offset, SeekOrigin.Begin);
byte[] buffer = new byte[Marshal.SizeOf(typeof(PEHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
PEHeader Header = (PEHeader)Marshal.PtrToStructure(hdrPtr, typeof(PEHeader));
Marshal.FreeHGlobal(hdrPtr);
return Header.signature == Signature;
}
/// <summary>
/// Identifies if the specified executable is a Microsoft Portable Executable
/// </summary>
/// <returns><c>true</c> if the specified executable is a Microsoft Portable Executable, <c>false</c> otherwise.</returns>
/// <param name="stream">Stream containing the executable.</param>
public static bool Identify(FileStream stream)
/// <summary>
/// Identifies if the specified executable is a Microsoft Portable Executable
/// </summary>
/// <returns><c>true</c> if the specified executable is a Microsoft Portable Executable, <c>false</c> otherwise.</returns>
/// <param name="stream">Stream containing the executable.</param>
public static bool Identify(FileStream stream)
{
FileStream BaseStream = stream;
MZ BaseExecutable = new MZ(BaseStream);
if(BaseExecutable.IsMZ)
if(BaseExecutable.Header.new_offset < BaseStream.Length)
{
BaseStream.Seek(BaseExecutable.Header.new_offset, SeekOrigin.Begin);
byte[] buffer = new byte[Marshal.SizeOf(typeof(PEHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
PEHeader Header = (PEHeader)Marshal.PtrToStructure(hdrPtr, typeof(PEHeader));
Marshal.FreeHGlobal(hdrPtr);
return Header.signature == Signature;
}
if(!BaseExecutable.Recognized) return false;
return false;
if(BaseExecutable.Header.new_offset >= BaseStream.Length) return false;
BaseStream.Seek(BaseExecutable.Header.new_offset, SeekOrigin.Begin);
byte[] buffer = new byte[Marshal.SizeOf(typeof(PEHeader))];
BaseStream.Read(buffer, 0, buffer.Length);
IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length);
Marshal.Copy(buffer, 0, hdrPtr, buffer.Length);
PEHeader Header = (PEHeader)Marshal.PtrToStructure(hdrPtr, typeof(PEHeader));
Marshal.FreeHGlobal(hdrPtr);
return Header.signature == Signature;
}
static WindowsHeader64 ToPlus(WindowsHeader header)

606
libexeinfo/PE/Structs.cs
View File

@@ -31,345 +31,345 @@ namespace libexeinfo
{
public partial class PE
{
/// <summary>
/// Header for a Microsoft New Executable
/// </summary>
[StructLayout(LayoutKind.Sequential /*, Pack = 2*/)]
/// <summary>
/// Header for a Microsoft New Executable
/// </summary>
[StructLayout(LayoutKind.Sequential /*, Pack = 2*/)]
public struct PEHeader
{
/// <summary>
/// After the MS-DOS stub, at the file offset specified at offset 0x3c, is a 4-byte signature that identifies the file
/// as a PE format image file. This signature is "PE\0\0" (the letters "P" and "E" followed by two null bytes).
/// </summary>
public uint signature;
/// <summary>
/// After the MS-DOS stub, at the file offset specified at offset 0x3c, is a 4-byte signature that identifies the file
/// as a PE format image file. This signature is "PE\0\0" (the letters "P" and "E" followed by two null bytes).
/// </summary>
public uint signature;
public COFFHeader coff;
}
/// <summary>
/// The next 21 fields are an extension to the COFF optional header format. They contain additional information that is
/// required by the linker and loader in Windows.
/// </summary>
[StructLayout(LayoutKind.Sequential /*, Pack = 2*/)]
/// <summary>
/// The next 21 fields are an extension to the COFF optional header format. They contain additional information that is
/// required by the linker and loader in Windows.
/// </summary>
[StructLayout(LayoutKind.Sequential /*, Pack = 2*/)]
public struct WindowsHeader
{
/// <summary>
/// The preferred address of the first byte of image when loaded into memory; must be a multiple of 64 K. The default
/// for DLLs is 0x10000000. The default for Windows CE EXEs is 0x00010000. The default for Windows NT, Windows 2000,
/// Windows XP, Windows 95, Windows 98, and Windows Me is 0x00400000.
/// </summary>
public uint imageBase;
/// <summary>
/// The alignment (in bytes) of sections when they are loaded into memory. It must be greater than or equal to
/// FileAlignment. The default is the page size for the architecture.
/// </summary>
public uint sectionAlignment;
/// <summary>
/// The alignment factor (in bytes) that is used to align the raw data of sections in the image file. The value should
/// be a power of 2 between 512 and 64 K, inclusive. The default is 512. If the SectionAlignment is less than the
/// architecture's page size, then FileAlignment must match SectionAlignment.
/// </summary>
public uint fileAlignment;
/// <summary>
/// The major version number of the required operating system.
/// </summary>
public ushort majorOperatingSystemVersion;
/// <summary>
/// The minor version number of the required operating system.
/// </summary>
public ushort minorOperatingSystemVersion;
/// <summary>
/// The major version number of the image.
/// </summary>
public ushort majorImageVersion;
/// <summary>
/// The minor version number of the image.
/// </summary>
public ushort minorImageVersion;
/// <summary>
/// The major version number of the subsystem.
/// </summary>
public ushort majorSubsystemVersion;
/// <summary>
/// The minor version number of the subsystem.
/// </summary>
public ushort minorSubsystemVersion;
/// <summary>
/// Reserved, must be zero.
/// </summary>
public uint win32VersionValue;
/// <summary>
/// The size (in bytes) of the image, including all headers, as the image is loaded in memory. It must be a multiple of
/// SectionAlignment.
/// </summary>
public uint sizeOfImage;
/// <summary>
/// The combined size of an MS-DOS stub, PE header, and section headers rounded up to a multiple of FileAlignment.
/// </summary>
public uint sizeOfHeaders;
/// <summary>
/// The image file checksum. The algorithm for computing the checksum is incorporated into IMAGHELP.DLL. The following
/// are checked for validation at load time: all drivers, any DLL loaded at boot time, and any DLL that is loaded into
/// a critical Windows process.
/// </summary>
public uint checksum;
/// <summary>
/// The subsystem that is required to run this image. For more information, <see cref="Subsystems" />.
/// </summary>
public Subsystems subsystem;
/// <summary>
/// For more information, <see cref="DllCharacteristics" />.
/// </summary>
public DllCharacteristics dllCharacteristics;
/// <summary>
/// The size of the stack to reserve. Only SizeOfStackCommit is committed; the rest is made available one page at a
/// time until the reserve size is reached.
/// </summary>
public uint sizeOfStackReserve;
/// <summary>
/// The size of the stack to commit.
/// </summary>
public uint sizeOfStackCommit;
/// <summary>
/// The size of the local heap space to reserve. Only SizeOfHeapCommit is committed; the rest is made available one
/// page at a time until the reserve size is reached.
/// </summary>
public uint sizeOfHeapReserve;
/// <summary>
/// The size of the local heap space to commit.
/// </summary>
public uint sizeOfHeapCommit;
/// <summary>
/// Reserved, must be zero.
/// </summary>
public uint loaderFlags;
/// <summary>
/// The number of data-directory entries in the remainder of the optional header. Each describes a location and size.
/// </summary>
public uint numberOfRvaAndSizes;
/// <summary>
/// The preferred address of the first byte of image when loaded into memory; must be a multiple of 64 K. The default
/// for DLLs is 0x10000000. The default for Windows CE EXEs is 0x00010000. The default for Windows NT, Windows 2000,
/// Windows XP, Windows 95, Windows 98, and Windows Me is 0x00400000.
/// </summary>
public uint imageBase;
/// <summary>
/// The alignment (in bytes) of sections when they are loaded into memory. It must be greater than or equal to
/// FileAlignment. The default is the page size for the architecture.
/// </summary>
public uint sectionAlignment;
/// <summary>
/// The alignment factor (in bytes) that is used to align the raw data of sections in the image file. The value should
/// be a power of 2 between 512 and 64 K, inclusive. The default is 512. If the SectionAlignment is less than the
/// architecture's page size, then FileAlignment must match SectionAlignment.
/// </summary>
public uint fileAlignment;
/// <summary>
/// The major version number of the required operating system.
/// </summary>
public ushort majorOperatingSystemVersion;
/// <summary>
/// The minor version number of the required operating system.
/// </summary>
public ushort minorOperatingSystemVersion;
/// <summary>
/// The major version number of the image.
/// </summary>
public ushort majorImageVersion;
/// <summary>
/// The minor version number of the image.
/// </summary>
public ushort minorImageVersion;
/// <summary>
/// The major version number of the subsystem.
/// </summary>
public ushort majorSubsystemVersion;
/// <summary>
/// The minor version number of the subsystem.
/// </summary>
public ushort minorSubsystemVersion;
/// <summary>
/// Reserved, must be zero.
/// </summary>
public uint win32VersionValue;
/// <summary>
/// The size (in bytes) of the image, including all headers, as the image is loaded in memory. It must be a multiple of
/// SectionAlignment.
/// </summary>
public uint sizeOfImage;
/// <summary>
/// The combined size of an MS-DOS stub, PE header, and section headers rounded up to a multiple of FileAlignment.
/// </summary>
public uint sizeOfHeaders;
/// <summary>
/// The image file checksum. The algorithm for computing the checksum is incorporated into IMAGHELP.DLL. The following
/// are checked for validation at load time: all drivers, any DLL loaded at boot time, and any DLL that is loaded into
/// a critical Windows process.
/// </summary>
public uint checksum;
/// <summary>
/// The subsystem that is required to run this image. For more information, <see cref="Subsystems" />.
/// </summary>
public Subsystems subsystem;
/// <summary>
/// For more information, <see cref="DllCharacteristics" />.
/// </summary>
public DllCharacteristics dllCharacteristics;
/// <summary>
/// The size of the stack to reserve. Only SizeOfStackCommit is committed; the rest is made available one page at a
/// time until the reserve size is reached.
/// </summary>
public uint sizeOfStackReserve;
/// <summary>
/// The size of the stack to commit.
/// </summary>
public uint sizeOfStackCommit;
/// <summary>
/// The size of the local heap space to reserve. Only SizeOfHeapCommit is committed; the rest is made available one
/// page at a time until the reserve size is reached.
/// </summary>
public uint sizeOfHeapReserve;
/// <summary>
/// The size of the local heap space to commit.
/// </summary>
public uint sizeOfHeapCommit;
/// <summary>
/// Reserved, must be zero.
/// </summary>
public uint loaderFlags;
/// <summary>
/// The number of data-directory entries in the remainder of the optional header. Each describes a location and size.
/// </summary>
public uint numberOfRvaAndSizes;
}
/// <summary>
/// The next 21 fields are an extension to the COFF optional header format. They contain additional information that is
/// required by the linker and loader in Windows.
/// </summary>
[StructLayout(LayoutKind.Sequential /*, Pack = 2*/)]
/// <summary>
/// The next 21 fields are an extension to the COFF optional header format. They contain additional information that is
/// required by the linker and loader in Windows.
/// </summary>
[StructLayout(LayoutKind.Sequential /*, Pack = 2*/)]
public struct WindowsHeader64
{
/// <summary>
/// The preferred address of the first byte of image when loaded into memory; must be a multiple of 64 K. The default
/// for DLLs is 0x10000000. The default for Windows CE EXEs is 0x00010000. The default for Windows NT, Windows 2000,
/// Windows XP, Windows 95, Windows 98, and Windows Me is 0x00400000.
/// </summary>
public ulong imageBase;
/// <summary>
/// The alignment (in bytes) of sections when they are loaded into memory. It must be greater than or equal to
/// FileAlignment. The default is the page size for the architecture.
/// </summary>
public uint sectionAlignment;
/// <summary>
/// The alignment factor (in bytes) that is used to align the raw data of sections in the image file. The value should
/// be a power of 2 between 512 and 64 K, inclusive. The default is 512. If the SectionAlignment is less than the
/// architecture's page size, then FileAlignment must match SectionAlignment.
/// </summary>
public uint fileAlignment;
/// <summary>
/// The major version number of the required operating system.
/// </summary>
public ushort majorOperatingSystemVersion;
/// <summary>
/// The minor version number of the required operating system.
/// </summary>
public ushort minorOperatingSystemVersion;
/// <summary>
/// The major version number of the image.
/// </summary>
public ushort majorImageVersion;
/// <summary>
/// The minor version number of the image.
/// </summary>
public ushort minorImageVersion;
/// <summary>
/// The major version number of the subsystem.
/// </summary>
public ushort majorSubsystemVersion;
/// <summary>
/// The minor version number of the subsystem.
/// </summary>
public ushort minorSubsystemVersion;
/// <summary>
/// Reserved, must be zero.
/// </summary>
public uint win32VersionValue;
/// <summary>
/// The size (in bytes) of the image, including all headers, as the image is loaded in memory. It must be a multiple of
/// SectionAlignment.
/// </summary>
public uint sizeOfImage;
/// <summary>
/// The combined size of an MS-DOS stub, PE header, and section headers rounded up to a multiple of FileAlignment.
/// </summary>
public uint sizeOfHeaders;
/// <summary>
/// The image file checksum. The algorithm for computing the checksum is incorporated into IMAGHELP.DLL. The following
/// are checked for validation at load time: all drivers, any DLL loaded at boot time, and any DLL that is loaded into
/// a critical Windows process.
/// </summary>
public uint checksum;
/// <summary>
/// The subsystem that is required to run this image. For more information, <see cref="Subsystems" />.
/// </summary>
public Subsystems subsystem;
/// <summary>
/// For more information, <see cref="DllCharacteristics" />.
/// </summary>
public DllCharacteristics dllCharacteristics;
/// <summary>
/// The size of the stack to reserve. Only SizeOfStackCommit is committed; the rest is made available one page at a
/// time until the reserve size is reached.
/// </summary>
public ulong sizeOfStackReserve;
/// <summary>
/// The size of the stack to commit.
/// </summary>
public ulong sizeOfStackCommit;
/// <summary>
/// The size of the local heap space to reserve. Only SizeOfHeapCommit is committed; the rest is made available one
/// page at a time until the reserve size is reached.
/// </summary>
public ulong sizeOfHeapReserve;
/// <summary>
/// The size of the local heap space to commit.
/// </summary>
public ulong sizeOfHeapCommit;
/// <summary>
/// Reserved, must be zero.
/// </summary>
public uint loaderFlags;
/// <summary>
/// The number of data-directory entries in the remainder of the optional header. Each describes a location and size.
/// </summary>
public uint numberOfRvaAndSizes;
/// <summary>
/// The preferred address of the first byte of image when loaded into memory; must be a multiple of 64 K. The default
/// for DLLs is 0x10000000. The default for Windows CE EXEs is 0x00010000. The default for Windows NT, Windows 2000,
/// Windows XP, Windows 95, Windows 98, and Windows Me is 0x00400000.
/// </summary>
public ulong imageBase;
/// <summary>
/// The alignment (in bytes) of sections when they are loaded into memory. It must be greater than or equal to
/// FileAlignment. The default is the page size for the architecture.
/// </summary>
public uint sectionAlignment;
/// <summary>
/// The alignment factor (in bytes) that is used to align the raw data of sections in the image file. The value should
/// be a power of 2 between 512 and 64 K, inclusive. The default is 512. If the SectionAlignment is less than the
/// architecture's page size, then FileAlignment must match SectionAlignment.
/// </summary>
public uint fileAlignment;
/// <summary>
/// The major version number of the required operating system.
/// </summary>
public ushort majorOperatingSystemVersion;
/// <summary>
/// The minor version number of the required operating system.
/// </summary>
public ushort minorOperatingSystemVersion;
/// <summary>
/// The major version number of the image.
/// </summary>
public ushort majorImageVersion;
/// <summary>
/// The minor version number of the image.
/// </summary>
public ushort minorImageVersion;
/// <summary>
/// The major version number of the subsystem.
/// </summary>
public ushort majorSubsystemVersion;
/// <summary>
/// The minor version number of the subsystem.
/// </summary>
public ushort minorSubsystemVersion;
/// <summary>
/// Reserved, must be zero.
/// </summary>
public uint win32VersionValue;
/// <summary>
/// The size (in bytes) of the image, including all headers, as the image is loaded in memory. It must be a multiple of
/// SectionAlignment.
/// </summary>
public uint sizeOfImage;
/// <summary>
/// The combined size of an MS-DOS stub, PE header, and section headers rounded up to a multiple of FileAlignment.
/// </summary>
public uint sizeOfHeaders;
/// <summary>
/// The image file checksum. The algorithm for computing the checksum is incorporated into IMAGHELP.DLL. The following
/// are checked for validation at load time: all drivers, any DLL loaded at boot time, and any DLL that is loaded into
/// a critical Windows process.
/// </summary>
public uint checksum;
/// <summary>
/// The subsystem that is required to run this image. For more information, <see cref="Subsystems" />.
/// </summary>
public Subsystems subsystem;
/// <summary>
/// For more information, <see cref="DllCharacteristics" />.
/// </summary>
public DllCharacteristics dllCharacteristics;
/// <summary>
/// The size of the stack to reserve. Only SizeOfStackCommit is committed; the rest is made available one page at a
/// time until the reserve size is reached.
/// </summary>
public ulong sizeOfStackReserve;
/// <summary>
/// The size of the stack to commit.
/// </summary>
public ulong sizeOfStackCommit;
/// <summary>
/// The size of the local heap space to reserve. Only SizeOfHeapCommit is committed; the rest is made available one
/// page at a time until the reserve size is reached.
/// </summary>
public ulong sizeOfHeapReserve;
/// <summary>
/// The size of the local heap space to commit.
/// </summary>
public ulong sizeOfHeapCommit;
/// <summary>
/// Reserved, must be zero.
/// </summary>
public uint loaderFlags;
/// <summary>
/// The number of data-directory entries in the remainder of the optional header. Each describes a location and size.
/// </summary>
public uint numberOfRvaAndSizes;
}
[StructLayout(LayoutKind.Sequential /*, Pack = 2*/)]
public struct ImageDataDirectory
{
/// <summary>
/// Relative virtual address of the table
/// </summary>
uint rva;
/// <summary>
/// The size in bytes
/// </summary>
uint size;
/// <summary>
/// Relative virtual address of the table
/// </summary>
uint rva;
/// <summary>
/// The size in bytes
/// </summary>
uint size;
}
[StructLayout(LayoutKind.Sequential /*, Pack = 2*/)]
public struct DebugDirectory
{
/// <summary>
/// A reserved field intended to be used for flags, set to zero for now.
/// </summary>
public uint characteristics;
/// <summary>
/// Time and date the debug data was created.
/// </summary>
public uint timeDateStamp;
/// <summary>
/// Major version number of the debug data format.
/// </summary>
public ushort majorVersion;
/// <summary>
/// Minor version number of the debug data format.
/// </summary>
public ushort minorVersion;
/// <summary>
/// Format of debugging information: this field enables support of multiple debuggers. <see cref="DebugTypes" /> for
/// more information.
/// </summary>
public DebugTypes type;
/// <summary>
/// Size of the debug data (not including the debug directory itself).
/// </summary>
public uint sizeOfData;
/// <summary>
/// Address of the debug data when loaded, relative to the image base.
/// </summary>
public uint addressOfRawData;
/// <summary>
/// File pointer to the debug data.
/// </summary>
public uint pointerToRawData;
/// <summary>
/// A reserved field intended to be used for flags, set to zero for now.
/// </summary>
public uint characteristics;
/// <summary>
/// Time and date the debug data was created.
/// </summary>
public uint timeDateStamp;
/// <summary>
/// Major version number of the debug data format.
/// </summary>
public ushort majorVersion;
/// <summary>
/// Minor version number of the debug data format.
/// </summary>
public ushort minorVersion;
/// <summary>
/// Format of debugging information: this field enables support of multiple debuggers. <see cref="DebugTypes" /> for
/// more information.
/// </summary>
public DebugTypes type;
/// <summary>
/// Size of the debug data (not including the debug directory itself).
/// </summary>
public uint sizeOfData;
/// <summary>
/// Address of the debug data when loaded, relative to the image base.
/// </summary>
public uint addressOfRawData;
/// <summary>
/// File pointer to the debug data.
/// </summary>
public uint pointerToRawData;
}
[StructLayout(LayoutKind.Sequential /*, Pack = 2*/)]
public struct ResourceDirectoryTable
{
/// <summary>
/// Resource flags, reserved for future use; currently set to zero.
/// </summary>
public uint characteristics;
/// <summary>
/// Time the resource data was created by the resource compiler.
/// </summary>
public uint timeDateStamp;
/// <summary>
/// Major version number, set by the user.
/// </summary>
public ushort majorVersion;
/// <summary>
/// Minor version number.
/// </summary>
public ushort minorVersion;
/// <summary>
/// Number of directory entries, immediately following the table,
/// that use strings to identify Type, Name, or Language
/// (depending on the level of the table).
/// </summary>
public ushort nameEntries;
/// <summary>
/// Number of directory entries, immediately following the Name
/// entries, that use numeric identifiers for Type, Name, or Language.
/// </summary>
public ushort idEntries;
/// <summary>
/// Resource flags, reserved for future use; currently set to zero.
/// </summary>
public uint characteristics;
/// <summary>
/// Time the resource data was created by the resource compiler.
/// </summary>
public uint timeDateStamp;
/// <summary>
/// Major version number, set by the user.
/// </summary>
public ushort majorVersion;
/// <summary>
/// Minor version number.
/// </summary>
public ushort minorVersion;
/// <summary>
/// Number of directory entries, immediately following the table,
/// that use strings to identify Type, Name, or Language
/// (depending on the level of the table).
/// </summary>
public ushort nameEntries;
/// <summary>
/// Number of directory entries, immediately following the Name
/// entries, that use numeric identifiers for Type, Name, or Language.
/// </summary>
public ushort idEntries;
}
[StructLayout(LayoutKind.Sequential /*, Pack = 2*/)]
public struct ResourceDirectoryEntries
{
/// <summary>
/// Address of string that gives the Type, Name, or Language identifier, depending on level of table.
/// or
/// 32-bit integer that identifies Type, Name, or Language.
/// </summary>
public uint nameOrID;
/// <summary>
/// High bit 0: Address of a Resource Data Entry(a leaf).
/// High bit 1: Lower 31 bits are the address of another Resource Directory Table(the next level down).
/// </summary>
public uint rva;
/// <summary>
/// Address of string that gives the Type, Name, or Language identifier, depending on level of table.
/// or
/// 32-bit integer that identifies Type, Name, or Language.
/// </summary>
public uint nameOrID;
/// <summary>
/// High bit 0: Address of a Resource Data Entry(a leaf).
/// High bit 1: Lower 31 bits are the address of another Resource Directory Table(the next level down).
/// </summary>
public uint rva;
}
[StructLayout(LayoutKind.Sequential /*, Pack = 2*/)]
public struct ResourceDataEntry
{
/// <summary>
/// Address of a unit of resource data in the Resource Data area.
/// </summary>
public uint rva;
/// <summary>
/// Size, in bytes, of the resource data pointed to by the Data RVA field.
/// </summary>
public uint size;
/// <summary>
/// Code page used to decode code point values within the resource data.Typically, the code page would be the Unicode
/// code page.
/// </summary>
public uint codepage;
/// <summary>
/// Reserved (must be set to 0)
/// </summary>
public uint reserved;
/// <summary>
/// Address of a unit of resource data in the Resource Data area.
/// </summary>
public uint rva;
/// <summary>
/// Size, in bytes, of the resource data pointed to by the Data RVA field.
/// </summary>
public uint size;
/// <summary>
/// Code page used to decode code point values within the resource data.Typically, the code page would be the Unicode
/// code page.
/// </summary>
public uint codepage;
/// <summary>
/// Reserved (must be set to 0)
/// </summary>
public uint reserved;
}
}
}

3
libexeinfo/libexeinfo.csproj
View File

@@ -1,4 +1,4 @@
<?xml version="1.0" encoding="utf-8"?>
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<Import Project="..\packages\NuGet.Build.Packaging.0.1.276\build\NuGet.Build.Packaging.props" Condition="Exists('..\packages\NuGet.Build.Packaging.0.1.276\build\NuGet.Build.Packaging.props')" />
<PropertyGroup>
@@ -43,6 +43,7 @@
<Reference Include="System" />
</ItemGroup>
<ItemGroup>
<Compile Include="IExecutable.cs" />
<Compile Include="Properties\AssemblyInfo.cs" />
<Compile Include="MZ\Consts.cs" />
<Compile Include="MZ\Info.cs" />