AlphaOmega.PEReader

Portable Executable (+), Common Language Infrastructure format reader


Keywords
File
License
Apache-1.0
Install
Install-Package AlphaOmega.PEReader -Version 1.3.2

Documentation

Portable Executable reader

Auto build Nuget

PE/PE+/CLI executable reader assembly. Compatible with .NET Framework 2.0 & .NET Standard 2.0

Usage (See Wiki for details):

String filePath=@"C:\Windows\System32\kernel32.dll";
using(PEFile file = new PEFile(filePath, StreamLoader.FromFile(filePath)))
{
    if(file.Header.IsValid)
    {
        if(!file.Resource.IsEmpty)
        {//IMAGE_RESOURCE_DIRECTORY
            //...
        }

        if(!file.Export.IsEmpty)
        {//IMAGE_EXPORT_DIRECTORY
            //...
        }

        if(!file.Import.IsEmpty)
        {//IMAGE_IMPORT_DESCRIPTOR
            //...
        }

        if(!file.Certificate.IsEmpty)
        {//WIN_CERTIFICATE
            X509Certificate2 cert = file.Certificate.X509;
            //...
        }

        if(file.ComDescriptor != null)
        {//CLI
            var metaData = file.ComDescriptor.MetaData;
            //...
        }
    }
}
  • DOS header (IMAGE_DOS_HEADER)
    • PE/PE+ header (IMAGE_NT_HEADERS)
    • File header (IMAGE_FILE_HEADER)
    • Optional header (IMAGE_OPTIONAL_HEADER)
    • COFF header (IMAGE_COFF_SYMBOLS_HEADER)
    • Sections header (IMAGE_SECTION_HEADER[])
    • Directories:
      • Architecture
      • Bound import
      • Certificate
      • CLR runtime header
        • MetaData
          • #~
            • Module
            • TypeRef
            • TypeDef
            • FieldPtr
            • Field
            • MethodPtr
            • MethodDef
              • Signature
              • IL Instructions
            • ParamPtr
            • Param
            • InterfaceImpl
            • MemberRef
              • Signature
            • Constant
            • CustomAttribute
              • Signature
            • FieldMarshal
            • DeclSecurity
            • ClassLayout
            • FieldLayout
            • StandAloneSig
            • EventMap
            • EventPtr
            • Event
            • PropertyMap
            • PropertyPtr
            • Property
              • Signature
            • MethodSemantics
            • MethodImpl
            • ModuleRef
            • TypeSpec
            • ImplMap
            • FieldRVA
            • ENCLog
            • ENCMap
            • Assembly
            • AssemblyProcessor
            • AssemblyOS
            • AssemblyRef
            • AssemblyRefProcessor
            • AssemblyRefOS
            • File
            • ExportedType
            • ManifestResource
            • NestedClass
            • GenericParam
            • MethodSpec
            • GenericParamConstraint
          • #Strings
          • #US
          • #Guid
          • #Blob
        • Resource Table (Linked to ManifestResource MetaData table)
        • VTable fixup
        • Code Manager Table
        • Export Address Table
        • Managed Native Header
        • Strong Name Signature
      • Debug
        • CodeView PDB2
        • CodeView PDB7
        • Misc (IMAGE_DEBUG_MISC)
      • Delay Import Descriptor
        • List of delay load imported libraries
        • List of delay load imported functions
      • Exception Table
      • Export Table
        • List of exported functions
      • Global Ptr
      • IAT
      • Import Table
        • List of imported libraries
        • List of imported functions
      • Load Config Table
      • Base Relocation Table
        • Relocation Blocks
        • Relocation Sections
      • Resource Table. Supported resource types:
        • RT_STRING
        • RT_HTML
        • RT_MANIFEST
        • RT_ACCELERATOR
        • RT_MESSAGETABLE
        • RT_DIALOG (Without DLU conversion)
        • RT_BITMAP
        • RT_MENU
        • RT_VERSION
      • TLS Table

Few supported structures:

  • DOS Header
    • IMAGE_DOS_HEADER
  • PE/PE+ Headers
    • IMAGE_FILE_HEADER
    • IMAGE_OPTIONAL_HEADER32
    • IMAGE_OPTIONAL_HEADER64
    • IMAGE_NT_HEADERS32
    • IMAGE_NT_HEADERS64
    • IMAGE_SECTION_HEADER
    • Unmanaged resources
      • IMAGE_RESOURCE_DIRECTORY
      • IMAGE_RESOURCE_DIRECTORY_ENTRY
      • IMAGE_RESOURCE_DATA_ENTRY
      • IMAGE_RESOURCE_DIRECTORY_STRING
      • ACCELTABLEENTRY
      • DLGTEMPLATE
      • DLGITEMTEMPLATE
      • DLGTEMPLATEEX
      • DLGITEMTEMPLATEEX
      • MENUHEADER
      • MENUITEM
      • MENUITEMPOPUP
      • MENUITEMEX
      • BITMAPINFOHEADER
      • VS_VERSIONINFO
      • VS_FIXEDFILEINFO
      • VarFileInfo
      • StringTable
      • V_STRING
      • FONTDIRENTRY
      • MESSAGE_RESOURCE_BLOCK
      • MESSAGE_RESOURCE_ENTRY
    • IMAGE_IMPORT_DESCRIPTOR
    • IMAGE_THUNK_DATA32
    • IMAGE_THUNK_DATA64
    • IMAGE_IMPORT_BY_NAME
    • IMAGE_RUNTIME_FUNCTION_ENTRY
    • IMAGE_DATA_DIRECTORY
    • IMAGE_EXPORT_DIRECTORY
    • IMAGE_BOUND_IMPORT_DESCRIPTOR
    • IMAGE_BOUND_FORWARDER_REF
    • WIN_CERTIFICATE
    • ImgDelayDescr
    • IMAGE_BASE_RELOCATION
    • IMAGE_LOAD_CONFIG_DIRECTORY32
    • IMAGE_LOAD_CONFIG_DIRECTORY64
    • IMAGE_TLS_DIRECTORY32
    • IMAGE_TLS_DIRECTORY64
    • Debug directory
      • IMAGE_DEBUG_DIRECTORY
      • CV_INFO_PDB70
      • CV_HEADER
      • CV_INFO_PDB20
      • IMAGE_DEBUG_MISC
    • .NET CLI
      • IMAGE_COR20_HEADER
      • IMAGE_COR20_METADATA
      • IMAGE_COR20_VTABLE
      • ResourceManagerHeader
      • ResourceSetHeader
      • STREAM_HEADER
      • STREAM_TABLE_HEADER