public static bool IsValidPEFile(FileStream stream)
{
try
{
IMAGE_DOS_HEADER dosHeader = GetDosHeader(stream);
if (dosHeader.e_magic != IMAGE_DOS_SIGNATURE)
{
return(false);
}
IMAGE_NT_HEADERS_COMMON ntHeader = GetCommonNtHeader(stream, dosHeader);
if (ntHeader.Signature != IMAGE_NT_SIGNATURE)
{
return(false);
}
switch ((MachineType)ntHeader.FileHeader.Machine)
{
case MachineType.IMAGE_FILE_MACHINE_I386:
return(IsValidExe32(GetNtHeader32(stream, dosHeader)));
case MachineType.IMAGE_FILE_MACHINE_IA64:
case MachineType.IMAGE_FILE_MACHINE_AMD64:
return(IsValidExe64(GetNtHeader64(stream, dosHeader)));
}
}
catch (InvalidOperationException)
{
return(false);
}
return(true);
}
static IMAGE_NT_HEADERS64 GetNtHeader64(Stream stream, IMAGE_DOS_HEADER dosHeader)
{
stream.Seek(dosHeader.e_lfanew, SeekOrigin.Begin);
return(ReadStructFromStream <IMAGE_NT_HEADERS64>(stream));
}
static IMAGE_NT_HEADERS_COMMON GetCommonNtHeader(Stream stream, IMAGE_DOS_HEADER dosHeader)
{
stream.Seek(dosHeader.e_lfanew, SeekOrigin.Begin);
return(ReadStructFromStream <IMAGE_NT_HEADERS_COMMON>(stream));
}