using System; using System.IO; using System.Reflection; namespace Win32PE { [ StructLayout( LayoutKind.Explicit )] public struct ImageDosHeader { [FieldOffset(0)] public ushort magic; // WORD - Magic number [FieldOffset(2)] public ushort cblp; // WORD - Bytes on last page of file [FieldOffset(4)] public ushort cp; // WORD - Pages in file [FieldOffset(6)] public ushort crlc; // WORD - Relocations [FieldOffset(8)] public ushort cparhdr; // WORD - Size of header in paragraphs [FieldOffset(10)] public ushort minalloc; // WORD - Minimum extra paragraphs needed [FieldOffset(12)] public ushort maxalloc; // WORD - Maximum extra paragraphs needed [FieldOffset(14)] public ushort ss; // WORD - Initial (relative) SS value [FieldOffset(16)] public ushort sp; // WORD - Initial SP value [FieldOffset(18)] public ushort csum; // WORD - Checksum [FieldOffset(20)] public ushort ip; // WORD - Initial IP value [FieldOffset(22)] public ushort cs; // WORD - Initial (relative) CS value [FieldOffset(24)] public ushort lfarlc; // WORD - File address of relocation table [FieldOffset(26)] public ushort ovno; // WORD - Overlay number //[FieldOffset(28)] // WORD[4] = 2x4 = 8 // public ushort[] e_res; // WORD[4] - Reserved words [FieldOffset(36)] public ushort oemid; // WORD - OEM identifier (for e_oeminfo) [FieldOffset(38)] public ushort oeminfo; // WORD - OEM information (e_oemid specific) //[FieldOffset(40)] // WORD[10] = 2x10 = 20 //public ushort[] d_res2; // WORD[10] - Reserved words [FieldOffset(60)] public int lfanew; // LONG - File address of new exe header } [ StructLayout( LayoutKind.Explicit )] public struct IMAGE_NT_HEADERS32 { [FieldOffset(0)] public uint Signature; [FieldOffset(4)] public IMAGE_FILE_HEADER FileHeader; [FieldOffset(24)] public IMAGE_OPTIONAL_HEADER32 OptionalHeader; } [ StructLayout( LayoutKind.Explicit )] public struct IMAGE_NT_HEADERS64 { [FieldOffset(0)] public uint Signature; [FieldOffset(4)] public IMAGE_FILE_HEADER FileHeader; [FieldOffset(24)] public IMAGE_OPTIONAL_HEADER64 OptionalHeader; } [ StructLayout( LayoutKind.Explicit )] public struct IMAGE_FILE_HEADER { [FieldOffset(0)] public ushort Machine; [FieldOffset(2)] public ushort NumberOfSections; [FieldOffset(4)] public uint TimeDateStamp; [FieldOffset(8)] public uint PointerToSymbolTable; [FieldOffset(12)] public uint NumberOfSymbols; [FieldOffset(16)] public ushort SizeOfOptionalHeader; [FieldOffset(18)] public ushort Characteristics; } [ StructLayout( LayoutKind.Explicit )] public struct IMAGE_OPTIONAL_HEADER32 { public ushort Magic; public byte MajorLinkerVersion; public byte MinorLinkerVersion; public uint SizeOfCode; public uint SizeOfInitializedData; public uint SizeOfUninitializedData; public uint AddressOfEntryPoint; public uint BaseOfCode; public uint BaseOfData; public uint ImageBase; public uint SectionAlignment; public uint FileAlignment; public ushort MajorOperatingSystemVersion; public ushort MinorOperatingSystemVersion; public ushort MajorImageVersion; public ushort MinorImageVersion; public ushort MajorSubsystemVersion; public ushort MinorSubsystemVersion; public uint Win32VersionValue; public uint SizeOfImage; public uint SizeOfHeaders; public uint CheckSum; public ushort Subsystem; public ushort DllCharacteristics; public uint SizeOfStackReserve; public uint SizeOfStackCommit; public uint SizeOfHeapReserve; public uint SizeOfHeapCommit; public uint LoaderFlags; public uint NumberOfRvaAndSizes; public IMAGE_DATA_DIRECTORY[] DataDirectory; } [ StructLayout( LayoutKind.Explicit )] public struct IMAGE_OPTIONAL_HEADER64 { public ushort Magic; public byte MajorLinkerVersion; public byte MinorLinkerVersion; public uint SizeOfCode; public uint SizeOfInitializedData; public uint SizeOfUninitializedData; public uint AddressOfEntryPoint; public uint BaseOfCode; public ulong ImageBase; public uint SectionAlignment; public uint FileAlignment; public ushort MajorOperatingSystemVersion; public ushort MinorOperatingSystemVersion; public ushort MajorImageVersion; public ushort MinorImageVersion; public ushort MajorSubsystemVersion; public ushort MinorSubsystemVersion; public uint Win32VersionValue; public uint SizeOfImage; public uint SizeOfHeaders; public uint CheckSum; public ushort Subsystem; public ushort DllCharacteristics; public ulong SizeOfStackReserve; public ulong SizeOfStackCommit; public ulong SizeOfHeapReserve; public ulong SizeOfHeapCommit; public uint LoaderFlags; public uint NumberOfRvaAndSizes; public IMAGE_DATA_DIRECTORY[] DataDirectory; } [ StructLayout( LayoutKind.Explicit )] public struct IMAGE_DATA_DIRECTORY { public uint VirtualAddress; public uint Size; } public enum MachineType { Native = 0, I386 = 0x014c, Itanium = 0x0200, x64 = 0x8664 } }