Class PEImage
- Namespace
- AsmResolver.PE
- Assembly
- AsmResolver.PE.dll
Represents an image of a portable executable (PE) file, exposing high level mutable structures.
public class PEImage
- Inheritance
-
PEImage
- Derived
- Inherited Members
- Extension Methods
Constructors
PEImage()
Initializes a new PE image.
public PEImage()
Properties
Certificates
Gets a collection of attribute certificates that were added to the executable.
public CertificateCollection Certificates { get; }
Property Value
Characteristics
Gets or sets the attributes assigned to the executable file.
public Characteristics Characteristics { get; set; }
Property Value
Remarks
This property is in direct relation with the characteristics field in the file header of a portable executable file.
DebugData
Gets a collection of data entries stored in the debug data directory of the PE image (if available).
public IList<DebugDataEntry> DebugData { get; }
Property Value
DllCharacteristics
Gets or sets the dynamic linked library characteristics of the portable executable (PE) file.
public DllCharacteristics DllCharacteristics { get; set; }
Property Value
Remarks
This property is in direct relation with the DLL characteristics field in the optional header of a portable executable file.
DotNetDirectory
Gets or sets the data directory containing the CLR 2.0 header of a .NET binary (if available).
public DotNetDirectory? DotNetDirectory { get; set; }
Property Value
Exceptions
Gets or sets the exceptions directory in the PE, if available.
public IExceptionDirectory? Exceptions { get; set; }
Property Value
Exports
Gets or sets the exports directory in the PE, if available.
public ExportDirectory? Exports { get; set; }
Property Value
FilePath
When this PE image was read from the disk, gets the file path to the PE image.
public string? FilePath { get; protected set; }
Property Value
ImageBase
Gets or sets the preferred address of the first byte of the image when loaded into memory. Must be a multiple of 64,000.
public ulong ImageBase { get; set; }
Property Value
Remarks
This property is in direct relation with the image base field in the optional header of a portable executable file.
Imports
Gets a collection of modules that were imported into the PE, according to the import data directory.
public IList<ImportedModule> Imports { get; }
Property Value
MachineType
Gets or sets the machine type that the PE image is targeting.
public MachineType MachineType { get; set; }
Property Value
Remarks
This property is in direct relation with the machine type field in the file header of a portable executable file.
PEFile
Gets the underlying PE file (when available).
public virtual PEFile? PEFile { get; }
Property Value
Remarks
When this property is null
, the image is a new image that is not yet assembled.
Accessing and using this object file is considered an unsafe operation. Making any changes to this object while also using the PE image object can have unwanted side effects.
PEKind
Gets or sets the magic optional header signature, determining whether the image is a PE32 (32-bit) or a PE32+ (64-bit) image.
public OptionalHeaderMagic PEKind { get; set; }
Property Value
Remarks
This property is in direct relation with the magic field in the optional header of a portable executable file.
Relocations
Gets a collection of base relocations that are to be applied when loading the PE into memory for execution.
public IList<BaseRelocation> Relocations { get; }
Property Value
Resources
Gets or sets the root resource directory in the PE, if available.
public ResourceDirectory? Resources { get; set; }
Property Value
SubSystem
Gets or sets the subsystem to use when running the portable executable (PE) file.
public SubSystem SubSystem { get; set; }
Property Value
Remarks
This property is in direct relation with the subsystem field in the optional header of a portable executable file.
TimeDateStamp
Gets or sets the date and time the portable executable file was created.
public DateTime TimeDateStamp { get; set; }
Property Value
TlsDirectory
Gets or sets the data directory containing the Thread-Local Storage (TLS) data.
public TlsDirectory? TlsDirectory { get; set; }
Property Value
Methods
FromBytes(byte[])
Opens a PE image from a buffer.
public static PEImage FromBytes(byte[] bytes)
Parameters
bytes
byte[]The bytes to interpret.
Returns
- PEImage
The PE image that was opened.
Exceptions
- BadImageFormatException
Occurs when the file does not follow the PE file format.
FromBytes(byte[], PEReaderParameters)
Opens a PE image from a buffer.
public static PEImage FromBytes(byte[] bytes, PEReaderParameters readerParameters)
Parameters
bytes
byte[]The bytes to interpret.
readerParameters
PEReaderParametersThe parameters to use while reading the PE image.
Returns
- PEImage
The PE image that was opened.
Exceptions
- BadImageFormatException
Occurs when the file does not follow the PE file format.
FromDataSource(IDataSource, PEMappingMode)
Reads a PE image from the provided data source.
public static PEImage FromDataSource(IDataSource dataSource, PEMappingMode mode = PEMappingMode.Unmapped)
Parameters
dataSource
IDataSourceThe data source to read from.
mode
PEMappingModeIndicates how the input PE file is mapped.
Returns
- PEImage
The PE image that was read.
Exceptions
- BadImageFormatException
Occurs when the file does not follow the PE file format.
FromDataSource(IDataSource, PEMappingMode, PEReaderParameters)
Reads a PE image from the provided data source.
public static PEImage FromDataSource(IDataSource dataSource, PEMappingMode mode, PEReaderParameters readerParameters)
Parameters
dataSource
IDataSourceThe data source to read from.
mode
PEMappingModeIndicates how the input PE file is mapped.
readerParameters
PEReaderParametersThe parameters to use while reading the PE image.
Returns
- PEImage
The PE image that was read.
Exceptions
- BadImageFormatException
Occurs when the file does not follow the PE file format.
FromFile(IInputFile)
Opens a PE image from an input file object.
public static PEImage FromFile(IInputFile inputFile)
Parameters
inputFile
IInputFileThe file representing the PE.
Returns
- PEImage
The PE image that was opened.
Exceptions
- BadImageFormatException
Occurs when the file does not follow the PE file format.
FromFile(IInputFile, PEReaderParameters)
Opens a PE image from an input file object.
public static PEImage FromFile(IInputFile inputFile, PEReaderParameters readerParameters)
Parameters
inputFile
IInputFileThe file representing the PE.
readerParameters
PEReaderParametersThe parameters to use while reading the PE image.
Returns
- PEImage
The PE image that was opened.
Exceptions
- BadImageFormatException
Occurs when the file does not follow the PE file format.
FromFile(PEFile)
Opens a PE image from a PE file object.
public static PEImage FromFile(PEFile peFile)
Parameters
peFile
PEFileThe PE file object.
Returns
- PEImage
The PE image that was opened.
Exceptions
- BadImageFormatException
Occurs when the file does not follow the PE file format.
FromFile(PEFile, PEReaderParameters)
Opens a PE image from a PE file object.
public static PEImage FromFile(PEFile peFile, PEReaderParameters readerParameters)
Parameters
peFile
PEFileThe PE file object.
readerParameters
PEReaderParametersThe parameters to use while reading the PE image.
Returns
- PEImage
The PE image that was opened.
Exceptions
- BadImageFormatException
Occurs when the file does not follow the PE file format.
FromFile(string)
Opens a PE image from a specific file on the disk.
public static PEImage FromFile(string filePath)
Parameters
filePath
stringThe
Returns
- PEImage
The PE image that was opened.
Exceptions
- BadImageFormatException
Occurs when the file does not follow the PE file format.
FromFile(string, PEReaderParameters)
Opens a PE image from a specific file on the disk.
public static PEImage FromFile(string filePath, PEReaderParameters readerParameters)
Parameters
filePath
stringThe
readerParameters
PEReaderParametersThe parameters to use while reading the PE image.
Returns
- PEImage
The PE image that was opened.
Exceptions
- BadImageFormatException
Occurs when the file does not follow the PE file format.
FromModuleBaseAddress(nint)
Reads a mapped PE image starting at the provided module base address (HINSTANCE).
public static PEImage FromModuleBaseAddress(nint hInstance)
Parameters
hInstance
nintThe HINSTANCE or base address of the module.
Returns
- PEImage
The PE image that was read.
Exceptions
- BadImageFormatException
Occurs when the file does not follow the PE file format.
FromModuleBaseAddress(nint, PEMappingMode, PEReaderParameters)
Reads a PE image starting at the provided module base address (HINSTANCE).
public static PEImage FromModuleBaseAddress(nint hInstance, PEMappingMode mode, PEReaderParameters readerParameters)
Parameters
hInstance
nintThe HINSTANCE or base address of the module.
mode
PEMappingModeIndicates how the input PE file is mapped.
readerParameters
PEReaderParametersThe parameters to use while reading the PE image.
Returns
- PEImage
The PE image that was read.
Exceptions
- BadImageFormatException
Occurs when the file does not follow the PE file format.
FromModuleBaseAddress(nint, PEReaderParameters)
Reads a mapped PE image starting at the provided module base address (HINSTANCE).
public static PEImage FromModuleBaseAddress(nint hInstance, PEReaderParameters readerParameters)
Parameters
hInstance
nintThe HINSTANCE or base address of the module.
readerParameters
PEReaderParametersThe parameters to use while reading the PE image.
Returns
- PEImage
The PE image that was read.
Exceptions
- BadImageFormatException
Occurs when the file does not follow the PE file format.
FromReader(in BinaryStreamReader, PEMappingMode)
Opens a PE image from an input stream.
public static PEImage FromReader(in BinaryStreamReader reader, PEMappingMode mode = PEMappingMode.Unmapped)
Parameters
reader
BinaryStreamReaderThe input stream.
mode
PEMappingModeIndicates the input PE is in its mapped or unmapped form.
Returns
- PEImage
The PE image that was opened.
Exceptions
- BadImageFormatException
Occurs when the file does not follow the PE file format.
FromReader(in BinaryStreamReader, PEMappingMode, PEReaderParameters)
Opens a PE image from an input stream.
public static PEImage FromReader(in BinaryStreamReader reader, PEMappingMode mode, PEReaderParameters readerParameters)
Parameters
reader
BinaryStreamReaderThe input stream.
mode
PEMappingModeIndicates the input PE is in its mapped or unmapped form.
readerParameters
PEReaderParametersThe parameters to use while reading the PE image.
Returns
- PEImage
The PE image that was opened.
Exceptions
- BadImageFormatException
Occurs when the file does not follow the PE file format.
GetCertificates()
Obtains the data directory containing the attribute certificates table of the executable.
protected virtual CertificateCollection GetCertificates()
Returns
- CertificateCollection
The attribute certificates.
Remarks
This method is called upon initialization of the Certificates property.
GetDebugData()
Obtains the debug data entries in the PE.
protected virtual IList<DebugDataEntry> GetDebugData()
Returns
- IList<DebugDataEntry>
The debug data entries.
Remarks
This method is called upon initialization of the DebugData property.
GetDotNetDirectory()
Obtains the data directory containing the CLR 2.0 header of a .NET binary.
protected virtual DotNetDirectory? GetDotNetDirectory()
Returns
- DotNetDirectory
The data directory.
Remarks
This method is called upon initialization of the DotNetDirectory property.
GetExceptions()
Obtains the contents of the exceptions data directory in the PE.
protected virtual IExceptionDirectory? GetExceptions()
Returns
- IExceptionDirectory
The entries in the exceptions directory.
Remarks
This method is called upon initialization of the Exceptions property.
GetExports()
Obtains the list of symbols that were exported from the PE.
protected virtual ExportDirectory? GetExports()
Returns
- ExportDirectory
The exported symbols.
Remarks
This method is called upon initialization of the Exports property.
GetImports()
Obtains the list of modules that were imported into the PE.
protected virtual IList<ImportedModule> GetImports()
Returns
- IList<ImportedModule>
The imported modules.
Remarks
This method is called upon initialization of the Imports property.
GetRelocations()
Obtains the base relocation blocks in the PE.
protected virtual IList<BaseRelocation> GetRelocations()
Returns
- IList<BaseRelocation>
The base relocation blocks.
Remarks
This method is called upon initialization of the Relocations property.
GetResources()
Obtains the root resource directory in the PE.
protected virtual ResourceDirectory? GetResources()
Returns
- ResourceDirectory
The root resource directory.
Remarks
This method is called upon initialization of the Resources property.
GetTlsDirectory()
Obtains the data directory containing the Thread-Local Storage (TLS) data.
protected virtual TlsDirectory? GetTlsDirectory()
Returns
- TlsDirectory
The data directory.
Remarks
This method is called upon initialization of the TlsDirectory property.
ToPEFile(IPEFileBuilder)
Constructs a PE file from the image.
public PEFile ToPEFile(IPEFileBuilder builder)
Parameters
builder
IPEFileBuilderThe builder to use for constructing the image.
Returns
- PEFile
The constructed file.