Table of Contents

Class PEImage

Namespace
AsmResolver.PE
Assembly
AsmResolver.PE.dll

Represents an image of a portable executable (PE) file, exposing high level mutable structures.

public class PEImage
Inheritance
PEImage
Derived
Inherited Members
Extension Methods

Constructors

PEImage()

Initializes a new PE image.

public PEImage()

Properties

Certificates

Gets a collection of attribute certificates that were added to the executable.

public CertificateCollection Certificates { get; }

Property Value

CertificateCollection

Characteristics

Gets or sets the attributes assigned to the executable file.

public Characteristics Characteristics { get; set; }

Property Value

Characteristics

Remarks

This property is in direct relation with the characteristics field in the file header of a portable executable file.

DebugData

Gets a collection of data entries stored in the debug data directory of the PE image (if available).

public IList<DebugDataEntry> DebugData { get; }

Property Value

IList<DebugDataEntry>

DllCharacteristics

Gets or sets the dynamic linked library characteristics of the portable executable (PE) file.

public DllCharacteristics DllCharacteristics { get; set; }

Property Value

DllCharacteristics

Remarks

This property is in direct relation with the DLL characteristics field in the optional header of a portable executable file.

DotNetDirectory

Gets or sets the data directory containing the CLR 2.0 header of a .NET binary (if available).

public DotNetDirectory? DotNetDirectory { get; set; }

Property Value

DotNetDirectory

Exceptions

Gets or sets the exceptions directory in the PE, if available.

public IExceptionDirectory? Exceptions { get; set; }

Property Value

IExceptionDirectory

Exports

Gets or sets the exports directory in the PE, if available.

public ExportDirectory? Exports { get; set; }

Property Value

ExportDirectory

FilePath

When this PE image was read from the disk, gets the file path to the PE image.

public string? FilePath { get; protected set; }

Property Value

string

ImageBase

Gets or sets the preferred address of the first byte of the image when loaded into memory. Must be a multiple of 64,000.

public ulong ImageBase { get; set; }

Property Value

ulong

Remarks

This property is in direct relation with the image base field in the optional header of a portable executable file.

Imports

Gets a collection of modules that were imported into the PE, according to the import data directory.

public IList<ImportedModule> Imports { get; }

Property Value

IList<ImportedModule>

MachineType

Gets or sets the machine type that the PE image is targeting.

public MachineType MachineType { get; set; }

Property Value

MachineType

Remarks

This property is in direct relation with the machine type field in the file header of a portable executable file.

PEFile

Gets the underlying PE file (when available).

public virtual PEFile? PEFile { get; }

Property Value

PEFile

Remarks

When this property is null, the image is a new image that is not yet assembled.

Accessing and using this object file is considered an unsafe operation. Making any changes to this object while also using the PE image object can have unwanted side effects.

PEKind

Gets or sets the magic optional header signature, determining whether the image is a PE32 (32-bit) or a PE32+ (64-bit) image.

public OptionalHeaderMagic PEKind { get; set; }

Property Value

OptionalHeaderMagic

Remarks

This property is in direct relation with the magic field in the optional header of a portable executable file.

Relocations

Gets a collection of base relocations that are to be applied when loading the PE into memory for execution.

public IList<BaseRelocation> Relocations { get; }

Property Value

IList<BaseRelocation>

Resources

Gets or sets the root resource directory in the PE, if available.

public ResourceDirectory? Resources { get; set; }

Property Value

ResourceDirectory

SubSystem

Gets or sets the subsystem to use when running the portable executable (PE) file.

public SubSystem SubSystem { get; set; }

Property Value

SubSystem

Remarks

This property is in direct relation with the subsystem field in the optional header of a portable executable file.

TimeDateStamp

Gets or sets the date and time the portable executable file was created.

public DateTime TimeDateStamp { get; set; }

Property Value

DateTime

TlsDirectory

Gets or sets the data directory containing the Thread-Local Storage (TLS) data.

public TlsDirectory? TlsDirectory { get; set; }

Property Value

TlsDirectory

Methods

FromBytes(byte[])

Opens a PE image from a buffer.

public static PEImage FromBytes(byte[] bytes)

Parameters

bytes byte[]

The bytes to interpret.

Returns

PEImage

The PE image that was opened.

Exceptions

BadImageFormatException

Occurs when the file does not follow the PE file format.

FromBytes(byte[], PEReaderParameters)

Opens a PE image from a buffer.

public static PEImage FromBytes(byte[] bytes, PEReaderParameters readerParameters)

Parameters

bytes byte[]

The bytes to interpret.

readerParameters PEReaderParameters

The parameters to use while reading the PE image.

Returns

PEImage

The PE image that was opened.

Exceptions

BadImageFormatException

Occurs when the file does not follow the PE file format.

FromDataSource(IDataSource, PEMappingMode)

Reads a PE image from the provided data source.

public static PEImage FromDataSource(IDataSource dataSource, PEMappingMode mode = PEMappingMode.Unmapped)

Parameters

dataSource IDataSource

The data source to read from.

mode PEMappingMode

Indicates how the input PE file is mapped.

Returns

PEImage

The PE image that was read.

Exceptions

BadImageFormatException

Occurs when the file does not follow the PE file format.

FromDataSource(IDataSource, PEMappingMode, PEReaderParameters)

Reads a PE image from the provided data source.

public static PEImage FromDataSource(IDataSource dataSource, PEMappingMode mode, PEReaderParameters readerParameters)

Parameters

dataSource IDataSource

The data source to read from.

mode PEMappingMode

Indicates how the input PE file is mapped.

readerParameters PEReaderParameters

The parameters to use while reading the PE image.

Returns

PEImage

The PE image that was read.

Exceptions

BadImageFormatException

Occurs when the file does not follow the PE file format.

FromFile(IInputFile)

Opens a PE image from an input file object.

public static PEImage FromFile(IInputFile inputFile)

Parameters

inputFile IInputFile

The file representing the PE.

Returns

PEImage

The PE image that was opened.

Exceptions

BadImageFormatException

Occurs when the file does not follow the PE file format.

FromFile(IInputFile, PEReaderParameters)

Opens a PE image from an input file object.

public static PEImage FromFile(IInputFile inputFile, PEReaderParameters readerParameters)

Parameters

inputFile IInputFile

The file representing the PE.

readerParameters PEReaderParameters

The parameters to use while reading the PE image.

Returns

PEImage

The PE image that was opened.

Exceptions

BadImageFormatException

Occurs when the file does not follow the PE file format.

FromFile(PEFile)

Opens a PE image from a PE file object.

public static PEImage FromFile(PEFile peFile)

Parameters

peFile PEFile

The PE file object.

Returns

PEImage

The PE image that was opened.

Exceptions

BadImageFormatException

Occurs when the file does not follow the PE file format.

FromFile(PEFile, PEReaderParameters)

Opens a PE image from a PE file object.

public static PEImage FromFile(PEFile peFile, PEReaderParameters readerParameters)

Parameters

peFile PEFile

The PE file object.

readerParameters PEReaderParameters

The parameters to use while reading the PE image.

Returns

PEImage

The PE image that was opened.

Exceptions

BadImageFormatException

Occurs when the file does not follow the PE file format.

FromFile(string)

Opens a PE image from a specific file on the disk.

public static PEImage FromFile(string filePath)

Parameters

filePath string

The

Returns

PEImage

The PE image that was opened.

Exceptions

BadImageFormatException

Occurs when the file does not follow the PE file format.

FromFile(string, PEReaderParameters)

Opens a PE image from a specific file on the disk.

public static PEImage FromFile(string filePath, PEReaderParameters readerParameters)

Parameters

filePath string

The

readerParameters PEReaderParameters

The parameters to use while reading the PE image.

Returns

PEImage

The PE image that was opened.

Exceptions

BadImageFormatException

Occurs when the file does not follow the PE file format.

FromModuleBaseAddress(nint)

Reads a mapped PE image starting at the provided module base address (HINSTANCE).

public static PEImage FromModuleBaseAddress(nint hInstance)

Parameters

hInstance nint

The HINSTANCE or base address of the module.

Returns

PEImage

The PE image that was read.

Exceptions

BadImageFormatException

Occurs when the file does not follow the PE file format.

FromModuleBaseAddress(nint, PEMappingMode, PEReaderParameters)

Reads a PE image starting at the provided module base address (HINSTANCE).

public static PEImage FromModuleBaseAddress(nint hInstance, PEMappingMode mode, PEReaderParameters readerParameters)

Parameters

hInstance nint

The HINSTANCE or base address of the module.

mode PEMappingMode

Indicates how the input PE file is mapped.

readerParameters PEReaderParameters

The parameters to use while reading the PE image.

Returns

PEImage

The PE image that was read.

Exceptions

BadImageFormatException

Occurs when the file does not follow the PE file format.

FromModuleBaseAddress(nint, PEReaderParameters)

Reads a mapped PE image starting at the provided module base address (HINSTANCE).

public static PEImage FromModuleBaseAddress(nint hInstance, PEReaderParameters readerParameters)

Parameters

hInstance nint

The HINSTANCE or base address of the module.

readerParameters PEReaderParameters

The parameters to use while reading the PE image.

Returns

PEImage

The PE image that was read.

Exceptions

BadImageFormatException

Occurs when the file does not follow the PE file format.

FromReader(in BinaryStreamReader, PEMappingMode)

Opens a PE image from an input stream.

public static PEImage FromReader(in BinaryStreamReader reader, PEMappingMode mode = PEMappingMode.Unmapped)

Parameters

reader BinaryStreamReader

The input stream.

mode PEMappingMode

Indicates the input PE is in its mapped or unmapped form.

Returns

PEImage

The PE image that was opened.

Exceptions

BadImageFormatException

Occurs when the file does not follow the PE file format.

FromReader(in BinaryStreamReader, PEMappingMode, PEReaderParameters)

Opens a PE image from an input stream.

public static PEImage FromReader(in BinaryStreamReader reader, PEMappingMode mode, PEReaderParameters readerParameters)

Parameters

reader BinaryStreamReader

The input stream.

mode PEMappingMode

Indicates the input PE is in its mapped or unmapped form.

readerParameters PEReaderParameters

The parameters to use while reading the PE image.

Returns

PEImage

The PE image that was opened.

Exceptions

BadImageFormatException

Occurs when the file does not follow the PE file format.

GetCertificates()

Obtains the data directory containing the attribute certificates table of the executable.

protected virtual CertificateCollection GetCertificates()

Returns

CertificateCollection

The attribute certificates.

Remarks

This method is called upon initialization of the Certificates property.

GetDebugData()

Obtains the debug data entries in the PE.

protected virtual IList<DebugDataEntry> GetDebugData()

Returns

IList<DebugDataEntry>

The debug data entries.

Remarks

This method is called upon initialization of the DebugData property.

GetDotNetDirectory()

Obtains the data directory containing the CLR 2.0 header of a .NET binary.

protected virtual DotNetDirectory? GetDotNetDirectory()

Returns

DotNetDirectory

The data directory.

Remarks

This method is called upon initialization of the DotNetDirectory property.

GetExceptions()

Obtains the contents of the exceptions data directory in the PE.

protected virtual IExceptionDirectory? GetExceptions()

Returns

IExceptionDirectory

The entries in the exceptions directory.

Remarks

This method is called upon initialization of the Exceptions property.

GetExports()

Obtains the list of symbols that were exported from the PE.

protected virtual ExportDirectory? GetExports()

Returns

ExportDirectory

The exported symbols.

Remarks

This method is called upon initialization of the Exports property.

GetImports()

Obtains the list of modules that were imported into the PE.

protected virtual IList<ImportedModule> GetImports()

Returns

IList<ImportedModule>

The imported modules.

Remarks

This method is called upon initialization of the Imports property.

GetRelocations()

Obtains the base relocation blocks in the PE.

protected virtual IList<BaseRelocation> GetRelocations()

Returns

IList<BaseRelocation>

The base relocation blocks.

Remarks

This method is called upon initialization of the Relocations property.

GetResources()

Obtains the root resource directory in the PE.

protected virtual ResourceDirectory? GetResources()

Returns

ResourceDirectory

The root resource directory.

Remarks

This method is called upon initialization of the Resources property.

GetTlsDirectory()

Obtains the data directory containing the Thread-Local Storage (TLS) data.

protected virtual TlsDirectory? GetTlsDirectory()

Returns

TlsDirectory

The data directory.

Remarks

This method is called upon initialization of the TlsDirectory property.

ToPEFile(IPEFileBuilder)

Constructs a PE file from the image.

public PEFile ToPEFile(IPEFileBuilder builder)

Parameters

builder IPEFileBuilder

The builder to use for constructing the image.

Returns

PEFile

The constructed file.