public override bool View(ViewModels.TabPageModel tabPage)
{
tabPage.Title = Text.ToString();
tabPage.SupportsLanguageSwitching = false;
var view = Helpers.PrepareDataGrid(tabPage, this);
var metadata = module.Metadata;
var list = new List <DeclSecurityEntry>();
DeclSecurityEntry scrollTargetEntry = default;
foreach (var row in metadata.DeclarativeSecurityAttributes)
{
var entry = new DeclSecurityEntry(module, row);
if (scrollTarget == MetadataTokens.GetRowNumber(row))
{
scrollTargetEntry = entry;
}
list.Add(entry);
}
view.ItemsSource = list;
tabPage.Content = view;
if (scrollTargetEntry.RID > 0)
{
ScrollItemIntoView(view, scrollTargetEntry);
}
return(true);
}
public unsafe override bool View(ViewModels.TabPageModel tabPage)
{
tabPage.Title = Text.ToString();
tabPage.SupportsLanguageSwitching = false;
var view = Helpers.PrepareDataGrid(tabPage, this);
var metadata = module.Metadata;
var list = new List <ClassLayoutEntry>();
var length = metadata.GetTableRowCount(TableIndex.ClassLayout);
byte * ptr = metadata.MetadataPointer;
int metadataOffset = module.Reader.PEHeaders.MetadataStartOffset;
ClassLayoutEntry scrollTargetEntry = default;
for (int rid = 1; rid <= length; rid++)
{
ClassLayoutEntry entry = new ClassLayoutEntry(module, ptr, metadataOffset, rid);
if (scrollTarget == rid)
{
scrollTargetEntry = entry;
}
list.Add(entry);
}
view.ItemsSource = list;
tabPage.Content = view;
if (scrollTargetEntry.RID > 0)
{
ScrollItemIntoView(view, scrollTargetEntry);
}
return(true);
}
public override bool View(ViewModels.TabPageModel tabPage)
{
tabPage.Title = Text.ToString();
tabPage.SupportsLanguageSwitching = false;
var view = Helpers.PrepareDataGrid(tabPage, this);
var metadata = module.Metadata;
var list = new List <ExportedTypeEntry>();
ExportedTypeEntry scrollTargetEntry = default;
foreach (var row in metadata.ExportedTypes)
{
ExportedTypeEntry entry = new ExportedTypeEntry(module.Reader.PEHeaders.MetadataStartOffset, module, row, metadata.GetExportedType(row));
if (entry.RID == this.scrollTarget)
{
scrollTargetEntry = entry;
}
list.Add(entry);
}
view.ItemsSource = list;
tabPage.Content = view;
if (scrollTargetEntry.RID > 0)
{
ScrollItemIntoView(view, scrollTargetEntry);
}
return(true);
}
public unsafe override bool View(ViewModels.TabPageModel tabPage)
{
tabPage.Title = Text.ToString();
tabPage.SupportsLanguageSwitching = false;
var view = Helpers.PrepareDataGrid(tabPage, this);
var list = new List <StateMachineMethodEntry>();
StateMachineMethodEntry scrollTargetEntry = default;
var length = metadata.GetTableRowCount(TableIndex.StateMachineMethod);
var reader = new BlobReader(metadata.MetadataPointer, metadata.MetadataLength);
reader.Offset = +metadata.GetTableMetadataOffset(TableIndex.StateMachineMethod);
for (int rid = 1; rid <= length; rid++)
{
StateMachineMethodEntry entry = new StateMachineMethodEntry(module, ref reader, isEmbedded, rid);
if (scrollTarget == rid)
{
scrollTargetEntry = entry;
}
list.Add(entry);
}
view.ItemsSource = list;
tabPage.Content = view;
if (scrollTargetEntry.RID > 1)
{
ScrollItemIntoView(view, scrollTargetEntry);
}
return(true);
}
public override bool View(ViewModels.TabPageModel tabPage)
{
tabPage.Title = Text.ToString();
tabPage.SupportsLanguageSwitching = false;
var view = Helpers.PrepareDataGrid(tabPage, this);
var metadata = module.Metadata;
var list = new List <PropertyDefEntry>();
PropertyDefEntry scrollTargetEntry = default;
foreach (var row in metadata.PropertyDefinitions)
{
PropertyDefEntry entry = new PropertyDefEntry(module, row);
if (entry.RID == this.scrollTarget)
{
scrollTargetEntry = entry;
}
list.Add(entry);
}
view.ItemsSource = list;
tabPage.Content = view;
if (scrollTargetEntry.RID > 0)
{
ScrollItemIntoView(view, scrollTargetEntry);
}
return(true);
}
public override bool View(ViewModels.TabPageModel tabPage)
{
tabPage.Title = Text.ToString();
tabPage.SupportsLanguageSwitching = false;
var view = Helpers.PrepareDataGrid(tabPage, this);
var list = new List <StandAloneSigEntry>();
StandAloneSigEntry scrollTargetEntry = default;
for (int row = 1; row <= module.Metadata.GetTableRowCount(TableIndex.StandAloneSig); row++)
{
StandAloneSigEntry entry = new StandAloneSigEntry(module, MetadataTokens.StandaloneSignatureHandle(row));
if (entry.RID == this.scrollTarget)
{
scrollTargetEntry = entry;
}
list.Add(entry);
}
view.ItemsSource = list;
tabPage.Content = view;
if (scrollTargetEntry.RID > 0)
{
ScrollItemIntoView(view, scrollTargetEntry);
}
return(true);
}
public override bool View(ViewModels.TabPageModel tabPage)
{
tabPage.Title = Text.ToString();
tabPage.SupportsLanguageSwitching = false;
var view = Helpers.PrepareDataGrid(tabPage, this);
var list = new List <CustomDebugInformationEntry>();
CustomDebugInformationEntry scrollTargetEntry = default;
foreach (var row in metadata.CustomDebugInformation)
{
CustomDebugInformationEntry entry = new CustomDebugInformationEntry(module, metadata, isEmbedded, row);
if (entry.RID == scrollTarget)
{
scrollTargetEntry = entry;
}
list.Add(entry);
}
view.ItemsSource = list;
tabPage.Content = view;
if (scrollTargetEntry.RID > 1)
{
ScrollItemIntoView(view, scrollTargetEntry);
}
return(true);
}
public override bool View(ViewModels.TabPageModel tabPage)
{
tabPage.Title = Text.ToString();
tabPage.SupportsLanguageSwitching = false;
var view = Helpers.PrepareDataGrid(tabPage, this);
var metadata = module.Metadata;
var list = new List <MethodSemanticsEntry>();
MethodSemanticsEntry scrollTargetEntry = default;
foreach (var row in metadata.GetMethodSemantics())
{
MethodSemanticsEntry entry = new MethodSemanticsEntry(module, row.Handle, row.Semantics, row.Method, row.Association);
if (entry.RID == this.scrollTarget)
{
scrollTargetEntry = entry;
}
list.Add(entry);
}
view.ItemsSource = list;
tabPage.Content = view;
if (scrollTargetEntry.RID > 0)
{
ScrollItemIntoView(view, scrollTargetEntry);
}
return(true);
}
public override bool View(ViewModels.TabPageModel tabPage)
{
tabPage.Title = Text.ToString();
tabPage.SupportsLanguageSwitching = false;
var view = Helpers.PrepareDataGrid(tabPage, this);
view.ItemsSource = new[] { new AssemblyEntry(module) };
tabPage.Content = view;
return(true);
}
public override bool Save(ViewModels.TabPageModel tabPage)
{
SaveFileDialog dlg = new SaveFileDialog();
dlg.FileName = Path.GetFileName(WholeProjectDecompiler.SanitizeFileName(key));
if (dlg.ShowDialog() == true)
{
using var data = OpenStream();
using var fs = dlg.OpenFile();
data.CopyTo(fs);
}
return(true);
}
public override bool Save(ViewModels.TabPageModel tabPage)
{
SaveFileDialog dlg = new SaveFileDialog();
dlg.FileName = Path.GetFileName(DecompilerTextView.CleanUpName(key));
if (dlg.ShowDialog() == true)
{
data.Position = 0;
using (var fs = dlg.OpenFile()) {
data.CopyTo(fs);
}
}
return(true);
}
public override bool View(ViewModels.TabPageModel tabPage)
{
tabPage.Title = Text.ToString();
tabPage.SupportsLanguageSwitching = false;
var dataGrid = Helpers.PrepareDataGrid(tabPage, this);
var entries = new List <DebugDirectoryEntryView>();
foreach (var entry in module.Reader.ReadDebugDirectory())
{
entries.Add(new DebugDirectoryEntryView(entry));
}
dataGrid.ItemsSource = entries.ToArray();
tabPage.Content = dataGrid;
return(true);
}
public override bool View(ViewModels.TabPageModel tabPage)
{
tabPage.Title = Text.ToString();
tabPage.SupportsLanguageSwitching = false;
var dataGrid = Helpers.PrepareDataGrid(tabPage, this);
var entries = new List <DebugDirectoryEntryView>();
foreach (var entry in module.Reader.ReadDebugDirectory())
{
int dataOffset = module.Reader.IsLoadedImage ? entry.DataRelativeVirtualAddress : entry.DataPointer;
var data = module.Reader.GetEntireImage().GetContent(dataOffset, entry.DataSize);
entries.Add(new DebugDirectoryEntryView(entry, data.ToHexString(data.Length)));
}
dataGrid.ItemsSource = entries.ToArray();
tabPage.Content = dataGrid;
return(true);
}
public override bool View(ViewModels.TabPageModel tabPage)
{
tabPage.Title = Text.ToString();
tabPage.SupportsLanguageSwitching = false;
var view = Helpers.PrepareDataGrid(tabPage, this);
var list = new List <ModuleEntry>();
ModuleEntry scrollTargetEntry = default;
list.Add(new ModuleEntry(module, EntityHandle.ModuleDefinition));
view.ItemsSource = list;
tabPage.Content = view;
if (scrollTargetEntry.RID > 0)
{
ScrollItemIntoView(view, scrollTargetEntry);
}
return(true);
}
public override bool View(ViewModels.TabPageModel tabPage)
{
tabPage.Title = Text.ToString();
tabPage.SupportsLanguageSwitching = false;
var dataGrid = Helpers.PrepareDataGrid(tabPage, this);
//dataGrid.AutoGenerateColumns = false;
//dataGrid.Columns.Add(new DataGridTextColumn { IsReadOnly = true, Header = "Name", Binding = new Binding("Name") });
//dataGrid.Columns.Add(new DataGridTextColumn { IsReadOnly = true, Header = "RVA", Binding = new Binding("RVA") { StringFormat = "X8" } });
//dataGrid.Columns.Add(new DataGridTextColumn { IsReadOnly = true, Header = "Size", Binding = new Binding("Size") { StringFormat = "X8" } });
//dataGrid.Columns.Add(new DataGridTextColumn { IsReadOnly = true, Header = "Section", Binding = new Binding("Section") });
var headers = module.Reader.PEHeaders;
var header = headers.PEHeader;
var entries = new DataDirectoryEntry[] {
new DataDirectoryEntry(headers, "Export Table", header.ExportTableDirectory),
new DataDirectoryEntry(headers, "Import Table", header.ImportTableDirectory),
new DataDirectoryEntry(headers, "Resource Table", header.ResourceTableDirectory),
new DataDirectoryEntry(headers, "Exception Table", header.ExceptionTableDirectory),
new DataDirectoryEntry(headers, "Certificate Table", header.CertificateTableDirectory),
new DataDirectoryEntry(headers, "Base Relocation Table", header.BaseRelocationTableDirectory),
new DataDirectoryEntry(headers, "Debug Table", header.DebugTableDirectory),
new DataDirectoryEntry(headers, "Copyright Table", header.CopyrightTableDirectory),
new DataDirectoryEntry(headers, "Global Pointer Table", header.GlobalPointerTableDirectory),
new DataDirectoryEntry(headers, "Thread Local Storage Table", header.ThreadLocalStorageTableDirectory),
new DataDirectoryEntry(headers, "Load Config", header.LoadConfigTableDirectory),
new DataDirectoryEntry(headers, "Bound Import", header.BoundImportTableDirectory),
new DataDirectoryEntry(headers, "Import Address Table", header.ImportAddressTableDirectory),
new DataDirectoryEntry(headers, "Delay Import Descriptor", header.DelayImportTableDirectory),
new DataDirectoryEntry(headers, "CLI Header", header.CorHeaderTableDirectory),
};
dataGrid.ItemsSource = entries;
tabPage.Content = dataGrid;
return(true);
}
public override bool View(ViewModels.TabPageModel tabPage)
{
tabPage.Title = Text.ToString();
tabPage.SupportsLanguageSwitching = false;
var dataGrid = Helpers.PrepareDataGrid(tabPage, this);
dataGrid.RowDetailsTemplateSelector = new DllCharacteristicsDataTemplateSelector();
dataGrid.RowDetailsVisibilityMode = DataGridRowDetailsVisibilityMode.Visible;
dataGrid.AutoGenerateColumns = false;
dataGrid.Columns.Add(new DataGridCustomTextColumn {
Header = "Member", Binding = new Binding("Member")
{
Mode = BindingMode.OneWay
}
});
dataGrid.Columns.Add(new DataGridCustomTextColumn {
Header = "Offset", Binding = new Binding("Offset")
{
StringFormat = "X8", Mode = BindingMode.OneWay
}
});
dataGrid.Columns.Add(new DataGridCustomTextColumn {
Header = "Size", Binding = new Binding("Size")
{
Mode = BindingMode.OneWay
}
});
dataGrid.Columns.Add(new DataGridCustomTextColumn {
Header = "Value", Binding = new Binding(".")
{
Converter = ByteWidthConverter.Instance, Mode = BindingMode.OneWay
}
});
dataGrid.Columns.Add(new DataGridCustomTextColumn {
Header = "Meaning", Binding = new Binding("Meaning")
{
Mode = BindingMode.OneWay
}
});
var headers = module.Reader.PEHeaders;
var reader = module.Reader.GetEntireImage().GetReader(headers.PEHeaderStartOffset, 128);
var header = headers.PEHeader;
var entries = new List <Entry>();
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadUInt16(), 2, "Magic", header.Magic.ToString()));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadByte(), 1, "Major Linker Version", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadByte(), 1, "Minor Linker Version", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "Code Size", "Size of the code (text) section, or the sum of all code sections if there are multiple sections."));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "Initialized Data Size", "Size of the initialized data section, or the sum of all initialized data sections if there are multiple data sections."));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "Uninitialized Data Size", "Size of the uninitialized data section, or the sum of all uninitialized data sections if there are multiple uninitialized data sections."));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "Entry Point RVA", "RVA of entry point, needs to point to bytes 0xFF 0x25 followed by the RVA in a section marked execute / read for EXEs or 0 for DLLs"));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "Base Of Code", "RVA of the code section."));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, header.Magic == PEMagic.PE32Plus ? reader.ReadUInt64() : reader.ReadUInt32(), header.Magic == PEMagic.PE32Plus ? 8 : 4, "Base Of Data", "RVA of the data section."));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, header.Magic == PEMagic.PE32Plus ? reader.ReadUInt64() : reader.ReadUInt32(), header.Magic == PEMagic.PE32Plus ? 8 : 4, "Image Base", "Shall be a multiple of 0x10000."));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "Section Alignment", "Shall be greater than File Alignment."));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "File Alignment", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadUInt16(), 2, "Major OS Version", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadUInt16(), 2, "Minor OS Version", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadUInt16(), 2, "Major Image Version", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadUInt16(), 2, "Minor Image Version", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadUInt16(), 2, "Major Subsystem Version", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadUInt16(), 2, "Minor Subsystem Version", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadUInt32(), 4, "Win32VersionValue", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "Image Size", "Size, in bytes, of image, including all headers and padding; shall be a multiple of Section Alignment."));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "Header Size", "Combined size of MS-DOS Header, PE Header, PE Optional Header and padding; shall be a multiple of the file alignment."));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "File Checksum", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadUInt16(), 2, "Subsystem", header.Subsystem.ToString()));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadUInt16(), 2, "DLL Characteristics", header.DllCharacteristics.ToString()));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, header.Magic == PEMagic.PE32Plus ? reader.ReadUInt64() : reader.ReadUInt32(), header.Magic == PEMagic.PE32Plus ? 8 : 4, "Stack Reserve Size", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, header.Magic == PEMagic.PE32Plus ? reader.ReadUInt64() : reader.ReadUInt32(), header.Magic == PEMagic.PE32Plus ? 8 : 4, "Stack Commit Size", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, header.Magic == PEMagic.PE32Plus ? reader.ReadUInt64() : reader.ReadUInt32(), header.Magic == PEMagic.PE32Plus ? 8 : 4, "Heap Reserve Size", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, header.Magic == PEMagic.PE32Plus ? reader.ReadUInt64() : reader.ReadUInt32(), header.Magic == PEMagic.PE32Plus ? 8 : 4, "Heap Commit Size", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadUInt32(), 4, "Loader Flags", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "Number of Data Directories", ""));
dataGrid.ItemsSource = entries;
tabPage.Content = dataGrid;
return(true);
}
/// <summary>
/// Used to implement special view logic for some items.
/// This method is called on the main thread when only a single item is selected.
/// If it returns false, normal decompilation is used to view the item.
/// </summary>
public virtual bool View(ViewModels.TabPageModel tabPage)
{
return false;
}
/// <summary>
/// Used to implement special save logic for some items.
/// This method is called on the main thread when only a single item is selected.
/// If it returns false, normal decompilation is used to save the item.
/// </summary>
public virtual bool Save(ViewModels.TabPageModel tabPage)
{
return(false);
}
public override bool View(ViewModels.TabPageModel tabPage)
{
tabPage.Title = Text.ToString();
tabPage.SupportsLanguageSwitching = false;
var dataGrid = Helpers.PrepareDataGrid(tabPage, this);
dataGrid.RowDetailsTemplateSelector = new CharacteristicsDataTemplateSelector("DLL Characteristics");
dataGrid.RowDetailsVisibilityMode = DataGridRowDetailsVisibilityMode.Collapsed;
dataGrid.Columns.Clear();
dataGrid.AutoGenerateColumns = false;
dataGrid.Columns.AddRange(
new[] {
new DataGridTextColumn {
IsReadOnly = true, Header = "Member", Binding = new Binding("Member")
},
new DataGridTextColumn {
IsReadOnly = true, Header = "Offset", Binding = new Binding("Offset")
{
StringFormat = "X8"
}
},
new DataGridTextColumn {
IsReadOnly = true, Header = "Size", Binding = new Binding("Size")
},
new DataGridTextColumn {
IsReadOnly = true, Header = "Value", Binding = new Binding(".")
{
Converter = ByteWidthConverter.Instance
}
},
new DataGridTextColumn {
IsReadOnly = true, Header = "Meaning", Binding = new Binding("Meaning")
}
}
);
var headers = module.Reader.PEHeaders;
var reader = module.Reader.GetEntireImage().GetReader(headers.PEHeaderStartOffset, 128);
var header = headers.PEHeader;
var isPE32Plus = (header.Magic == PEMagic.PE32Plus);
var entries = new List <Entry>();
ushort dllCharacteristics;
Entry characteristics;
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadUInt16(), 2, "Magic", header.Magic.ToString()));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadByte(), 1, "Major Linker Version", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadByte(), 1, "Minor Linker Version", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "Code Size", "Size of the code (text) section, or the sum of all code sections if there are multiple sections."));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "Initialized Data Size", "Size of the initialized data section, or the sum of all initialized data sections if there are multiple data sections."));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "Uninitialized Data Size", "Size of the uninitialized data section, or the sum of all uninitialized data sections if there are multiple uninitialized data sections."));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "Entry Point RVA", "RVA of entry point, needs to point to bytes 0xFF 0x25 followed by the RVA in a section marked execute / read for EXEs or 0 for DLLs"));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "Base Of Code", "RVA of the code section."));
entries.Add(new Entry(isPE32Plus ? 0 : headers.PEHeaderStartOffset + reader.Offset, isPE32Plus ? 0UL : reader.ReadUInt32(), isPE32Plus ? 0 : 4, "Base Of Data", "PE32 only (not present in PE32Plus): RVA of the data section, relative to the Image Base."));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, isPE32Plus ? reader.ReadUInt64() : reader.ReadUInt32(), isPE32Plus ? 8 : 4, "Image Base", "Shall be a multiple of 0x10000."));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "Section Alignment", "Shall be greater than File Alignment."));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "File Alignment", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadUInt16(), 2, "Major OS Version", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadUInt16(), 2, "Minor OS Version", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadUInt16(), 2, "Major Image Version", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadUInt16(), 2, "Minor Image Version", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadUInt16(), 2, "Major Subsystem Version", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadUInt16(), 2, "Minor Subsystem Version", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadUInt32(), 4, "Win32VersionValue", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "Image Size", "Size, in bytes, of image, including all headers and padding; shall be a multiple of Section Alignment."));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "Header Size", "Combined size of MS-DOS Header, PE Header, PE Optional Header and padding; shall be a multiple of the file alignment."));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "File Checksum", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadUInt16(), 2, "Subsystem", header.Subsystem.ToString()));
entries.Add(characteristics = new Entry(headers.PEHeaderStartOffset + reader.Offset, dllCharacteristics = reader.ReadUInt16(), 2, "DLL Characteristics", header.DllCharacteristics.ToString(), new[] {
new BitEntry((dllCharacteristics & 0x0001) != 0, "<0001> Process Init (Reserved)"),
new BitEntry((dllCharacteristics & 0x0002) != 0, "<0002> Process Term (Reserved)"),
new BitEntry((dllCharacteristics & 0x0004) != 0, "<0004> Thread Init (Reserved)"),
new BitEntry((dllCharacteristics & 0x0008) != 0, "<0008> Thread Term (Reserved)"),
new BitEntry((dllCharacteristics & 0x0010) != 0, "<0010> Unused"),
new BitEntry((dllCharacteristics & 0x0020) != 0, "<0020> Image can handle a high entropy 64-bit virtual address space (ASLR)"),
new BitEntry((dllCharacteristics & 0x0040) != 0, "<0040> DLL can be relocated at load time"),
new BitEntry((dllCharacteristics & 0x0080) != 0, "<0080> Code integrity checks are enforced"),
new BitEntry((dllCharacteristics & 0x0100) != 0, "<0100> Image is NX compatible"),
new BitEntry((dllCharacteristics & 0x0200) != 0, "<0200> Isolation aware, but do not isolate the image"),
new BitEntry((dllCharacteristics & 0x0400) != 0, "<0400> Does not use structured exception handling (SEH)"),
new BitEntry((dllCharacteristics & 0x0800) != 0, "<0800> Do not bind the image"),
new BitEntry((dllCharacteristics & 0x1000) != 0, "<1000> Image must execute in an AppContainer"),
new BitEntry((dllCharacteristics & 0x2000) != 0, "<2000> Driver is a WDM Driver"),
new BitEntry((dllCharacteristics & 0x4000) != 0, "<4000> Image supports Control Flow Guard"),
new BitEntry((dllCharacteristics & 0x8000) != 0, "<8000> Image is Terminal Server aware"),
}));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, isPE32Plus ? reader.ReadUInt64() : reader.ReadUInt32(), isPE32Plus ? 8 : 4, "Stack Reserve Size", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, isPE32Plus ? reader.ReadUInt64() : reader.ReadUInt32(), isPE32Plus ? 8 : 4, "Stack Commit Size", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, isPE32Plus ? reader.ReadUInt64() : reader.ReadUInt32(), isPE32Plus ? 8 : 4, "Heap Reserve Size", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, isPE32Plus ? reader.ReadUInt64() : reader.ReadUInt32(), isPE32Plus ? 8 : 4, "Heap Commit Size", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadUInt32(), 4, "Loader Flags", ""));
entries.Add(new Entry(headers.PEHeaderStartOffset + reader.Offset, reader.ReadInt32(), 4, "Number of Data Directories", ""));
dataGrid.ItemsSource = entries;
dataGrid.SetDetailsVisibilityForItem(characteristics, Visibility.Visible);
tabPage.Content = dataGrid;
return(true);
}
