Exemple #1
0
        public ImageFileHeaderVM(object owner, HexBuffer buffer, HexPosition startOffset)
            : base(owner)
        {
            MachineVM = new UInt16FlagsHexField(buffer, Name, "Machine", startOffset + 0);
            MachineVM.Add(new IntegerHexBitField("Machine", 0, 16, MachineInfos));
            NumberOfSectionsVM = new UInt16HexField(buffer, Name, "NumberOfSections", startOffset + 2);
            TimeDateStampVM    = new UInt32HexField(buffer, Name, "TimeDateStamp", startOffset + 4);
            TimeDateStampVM.DataFieldVM.PropertyChanged += (s, e) => OnPropertyChanged(nameof(TimeDateStampString));
            PointerToSymbolTableVM = new UInt32HexField(buffer, Name, "PointerToSymbolTable", startOffset + 8);
            NumberOfSymbolsVM      = new UInt32HexField(buffer, Name, "NumberOfSymbols", startOffset + 0x0C);
            SizeOfOptionalHeaderVM = new UInt16HexField(buffer, Name, "SizeOfOptionalHeader", startOffset + 0x10);
            CharacteristicsVM      = new UInt16FlagsHexField(buffer, Name, "Characteristics", startOffset + 0x12);
            CharacteristicsVM.Add(new BooleanHexBitField("Relocs Stripped", 0));
            CharacteristicsVM.Add(new BooleanHexBitField("Executable Image", 1));
            CharacteristicsVM.Add(new BooleanHexBitField("Line Nums Stripped", 2));
            CharacteristicsVM.Add(new BooleanHexBitField("Local Syms Stripped", 3));
            CharacteristicsVM.Add(new BooleanHexBitField("Aggressive WS Trim", 4));
            CharacteristicsVM.Add(new BooleanHexBitField("Large Address Aware", 5));
            CharacteristicsVM.Add(new BooleanHexBitField("Reserved 0040h", 6));
            CharacteristicsVM.Add(new BooleanHexBitField("Bytes Reversed Lo", 7));
            CharacteristicsVM.Add(new BooleanHexBitField("32-Bit Machine", 8));
            CharacteristicsVM.Add(new BooleanHexBitField("Debug Stripped", 9));
            CharacteristicsVM.Add(new BooleanHexBitField("Removable Run From Swap", 10));
            CharacteristicsVM.Add(new BooleanHexBitField("Net Run From Swap", 11));
            CharacteristicsVM.Add(new BooleanHexBitField("System", 12));
            CharacteristicsVM.Add(new BooleanHexBitField("Dll", 13));
            CharacteristicsVM.Add(new BooleanHexBitField("Up System Only", 14));
            CharacteristicsVM.Add(new BooleanHexBitField("Bytes Reversed Hi", 15));

            hexFields = new HexField[] {
                MachineVM,
                NumberOfSectionsVM,
                TimeDateStampVM,
                PointerToSymbolTableVM,
                NumberOfSymbolsVM,
                SizeOfOptionalHeaderVM,
                CharacteristicsVM,
            };
        }
		protected ImageOptionalHeaderVM(object owner, HexDocument doc, ulong startOffset, ulong endOffset, ulong offs1, ulong offs2)
			: base(owner) {
			this.magicVM = new UInt16HexField(doc, Name, "Magic", startOffset + 0);
			this.majorLinkerVersionVM = new ByteHexField(doc, Name, "MajorLinkerVersion", startOffset + 2, true);
			this.minorLinkerVersionVM = new ByteHexField(doc, Name, "MinorLinkerVersion", startOffset + 3, true);
			this.sizeOfCodeVM = new UInt32HexField(doc, Name, "SizeOfCode", startOffset + 4);
			this.sizeOfInitializedDataVM = new UInt32HexField(doc, Name, "SizeOfInitializedData", startOffset + 8);
			this.sizeOfUninitializedDataVM = new UInt32HexField(doc, Name, "SizeOfUninitializedData", startOffset + 0x0C);
			this.addressOfEntryPointVM = new UInt32HexField(doc, Name, "AddressOfEntryPoint", startOffset + 0x10);
			this.baseOfCodeVM = new UInt32HexField(doc, Name, "BaseOfCode", startOffset + 0x14);

			this.sectionAlignmentVM = new UInt32HexField(doc, Name, "SectionAlignment", startOffset + offs1 + 0);
			this.fileAlignmentVM = new UInt32HexField(doc, Name, "FileAlignment", startOffset + offs1 + 4);
			this.majorOperatingSystemVersionVM = new UInt16HexField(doc, Name, "MajorOperatingSystemVersion", startOffset + offs1 + 8, true);
			this.minorOperatingSystemVersionVM = new UInt16HexField(doc, Name, "MinorOperatingSystemVersion", startOffset + offs1 + 0x0A, true);
			this.majorImageVersionVM = new UInt16HexField(doc, Name, "MajorImageVersion", startOffset + offs1 + 0x0C, true);
			this.minorImageVersionVM = new UInt16HexField(doc, Name, "MinorImageVersion", startOffset + offs1 + 0x0E, true);
			this.majorSubsystemVersionVM = new UInt16HexField(doc, Name, "MajorSubsystemVersion", startOffset + offs1 + 0x10, true);
			this.minorSubsystemVersionVM = new UInt16HexField(doc, Name, "MinorSubsystemVersion", startOffset + offs1 + 0x12, true);
			this.win32VersionValueVM = new UInt32HexField(doc, Name, "Win32VersionValue", startOffset + offs1 + 0x14, true);
			this.sizeOfImageVM = new UInt32HexField(doc, Name, "SizeOfImage", startOffset + offs1 + 0x18);
			this.sizeOfHeadersVM = new UInt32HexField(doc, Name, "SizeOfHeaders", startOffset + offs1 + 0x1C);
			this.checkSumVM = new UInt32HexField(doc, Name, "CheckSum", startOffset + offs1 + 0x20);
			this.subsystemVM = new UInt16FlagsHexField(doc, Name, "Subsystem", startOffset + offs1 + 0x24);
			this.subsystemVM.Add(new IntegerHexBitField("Subsystem", 0, 16, SubsystemInfos));
			this.dllCharacteristicsVM = new UInt16FlagsHexField(doc, Name, "DllCharacteristics", startOffset + offs1 + 0x26);
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("Reserved1", 0));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("Reserved2", 1));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("Reserved3", 2));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("Reserved4", 3));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("Reserved5", 4));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("High Entropy VA", 5));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("Dynamic Base", 6));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("Force Integrity", 7));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("NX Compat", 8));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("No Isolation", 9));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("No SEH", 10));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("No Bind", 11));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("AppContainer", 12));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("WDM Driver", 13));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("Guard CF", 14));
			this.dllCharacteristicsVM.Add(new BooleanHexBitField("Terminal Server Aware", 15));
			this.loaderFlagsVM = new UInt32HexField(doc, Name, "LoaderFlags", startOffset + offs2 + 0);
			this.numberOfRvaAndSizesVM = new UInt32HexField(doc, Name, "NumberOfRvaAndSizes", startOffset + offs2 + 4);

			ulong doffs = offs2 + 8;
			this.dataDir0VM = new DataDirVM(doc, Name, "Export", startOffset + doffs + 0);
			this.dataDir1VM = new DataDirVM(doc, Name, "Import", startOffset + doffs + 8);
			this.dataDir2VM = new DataDirVM(doc, Name, "Resource", startOffset + doffs + 0x10);
			this.dataDir3VM = new DataDirVM(doc, Name, "Exception", startOffset + doffs + 0x18);
			this.dataDir4VM = new DataDirVM(doc, Name, "Security", startOffset + doffs + 0x20);
			this.dataDir5VM = new DataDirVM(doc, Name, "Base Reloc", startOffset + doffs + 0x28);
			this.dataDir6VM = new DataDirVM(doc, Name, "Debug", startOffset + doffs + 0x30);
			this.dataDir7VM = new DataDirVM(doc, Name, "Architecture", startOffset + doffs + 0x38);
			this.dataDir8VM = new DataDirVM(doc, Name, "Global Ptr", startOffset + doffs + 0x40);
			this.dataDir9VM = new DataDirVM(doc, Name, "TLS", startOffset + doffs + 0x48);
			this.dataDir10VM = new DataDirVM(doc, Name, "Load Config", startOffset + doffs + 0x50);
			this.dataDir11VM = new DataDirVM(doc, Name, "Bound Import", startOffset + doffs + 0x58);
			this.dataDir12VM = new DataDirVM(doc, Name, "IAT", startOffset + doffs + 0x60);
			this.dataDir13VM = new DataDirVM(doc, Name, "Delay Import", startOffset + doffs + 0x68);
			this.dataDir14VM = new DataDirVM(doc, Name, ".NET", startOffset + doffs + 0x70);
			this.dataDir15VM = new DataDirVM(doc, Name, "Reserved15", startOffset + doffs + 0x78);
		}
		protected override HexField CreateField(ColumnInfo colInfo) {
			if (colInfo.Index == 0) {
				var field = new UInt16FlagsHexField(mdVM.Document, Name, colInfo.Name, StartOffset + (uint)colInfo.Offset);
				field.Add(new BooleanHexBitField("Setter", 0));
				field.Add(new BooleanHexBitField("Getter", 1));
				field.Add(new BooleanHexBitField("Other", 2));
				field.Add(new BooleanHexBitField("AddOn", 3));
				field.Add(new BooleanHexBitField("RemoveOn", 4));
				field.Add(new BooleanHexBitField("Fire", 5));
				return field;
			}
			return base.CreateField(colInfo);
		}
		protected override HexField CreateField(ColumnInfo colInfo) {
			if (colInfo.Index == 0) {
				var field = new UInt16FlagsHexField(mdVM.Document, Name, colInfo.Name, StartOffset + (uint)colInfo.Offset);
				field.Add(new BooleanHexBitField("NoMangle", 0));
				field.Add(new IntegerHexBitField("CharSet", 1, 2, CharSetInfos));
				field.Add(new IntegerHexBitField("BestFit", 4, 2, BestFitInfos));
				field.Add(new BooleanHexBitField("SupportsLastError", 6));
				field.Add(new IntegerHexBitField("CallConv", 8, 3, CallConvInfos));
				field.Add(new IntegerHexBitField("ThrowOnUnmappableChar", 12, 2, ThrowOnUnmappableCharInfos));
				return field;
			}
			return base.CreateField(colInfo);
		}
		protected override HexField CreateField(ColumnInfo colInfo) {
			if (colInfo.Index == 0) {
				var field = new UInt16FlagsHexField(mdVM.Document, Name, colInfo.Name, StartOffset + (uint)colInfo.Offset);
				field.Add(new BooleanHexBitField("In", 0));
				field.Add(new BooleanHexBitField("Out", 1));
				field.Add(new BooleanHexBitField("Optional", 4));
				field.Add(new BooleanHexBitField("HasDefault", 12));
				field.Add(new BooleanHexBitField("HasFieldMarshal", 13));
				return field;
			}
			return base.CreateField(colInfo);
		}
		protected override HexField CreateField(ColumnInfo colInfo) {
			if (colInfo.Index == 0) {
				var field = new UInt16FlagsHexField(mdVM.Document, Name, colInfo.Name, StartOffset + (uint)colInfo.Offset);
				field.Add(new BooleanHexBitField("SpecialName", 9));
				field.Add(new BooleanHexBitField("RTSpecialName", 10));
				field.Add(new BooleanHexBitField("HasDefault", 12));
				return field;
			}
			return base.CreateField(colInfo);
		}
		protected override HexField CreateField(ColumnInfo colInfo) {
			if (colInfo.Index == 1) {
				var field = new UInt16FlagsHexField(mdVM.Document, Name, colInfo.Name, StartOffset + (uint)colInfo.Offset);
				field.Add(new IntegerHexBitField("CodeType", 0, 2, CodeTypeInfos));
				field.Add(new IntegerHexBitField("ManagedType", 2, 1, ManagedInfos));
				field.Add(new BooleanHexBitField("NoInlining", 3));
				field.Add(new BooleanHexBitField("ForwardRef", 4));
				field.Add(new BooleanHexBitField("Synchronized", 5));
				field.Add(new BooleanHexBitField("NoOptimization", 6));
				field.Add(new BooleanHexBitField("PreserveSig", 7));
				field.Add(new BooleanHexBitField("AggressiveInlining", 8));
				field.Add(new BooleanHexBitField("InternalCall", 12));
				return field;
			}
			else if (colInfo.Index == 2) {
				var field = new UInt16FlagsHexField(mdVM.Document, Name, colInfo.Name, StartOffset + (uint)colInfo.Offset);
				field.Add(new IntegerHexBitField("Access", 0, 3, AccessInfos));
				field.Add(new BooleanHexBitField("UnmanagedExport", 3));
				field.Add(new BooleanHexBitField("Static", 4));
				field.Add(new BooleanHexBitField("Final", 5));
				field.Add(new BooleanHexBitField("Virtual", 6));
				field.Add(new BooleanHexBitField("HideBySig", 7));
				field.Add(new IntegerHexBitField("VtableLayout", 8, 1, VtableLayoutInfos));
				field.Add(new BooleanHexBitField("CheckAccessOnOverride", 9));
				field.Add(new BooleanHexBitField("Abstract", 10));
				field.Add(new BooleanHexBitField("SpecialName", 11));
				field.Add(new BooleanHexBitField("RTSpecialName", 12));
				field.Add(new BooleanHexBitField("PinvokeImpl", 13));
				field.Add(new BooleanHexBitField("HasSecurity", 14));
				field.Add(new BooleanHexBitField("RequireSecObject", 15));
				return field;
			}
			return base.CreateField(colInfo);
		}
		protected override HexField CreateField(ColumnInfo colInfo) {
			if (colInfo.Index == 0) {
				var field = new UInt16FlagsHexField(mdVM.Document, Name, colInfo.Name, StartOffset + (uint)colInfo.Offset);
				field.Add(new IntegerHexBitField("Access", 0, 3, AccessInfos));
				field.Add(new BooleanHexBitField("Static", 4));
				field.Add(new BooleanHexBitField("InitOnly", 5));
				field.Add(new BooleanHexBitField("Literal", 6));
				field.Add(new BooleanHexBitField("NotSerialized", 7));
				field.Add(new BooleanHexBitField("HasFieldRVA", 8));
				field.Add(new BooleanHexBitField("SpecialName", 9));
				field.Add(new BooleanHexBitField("RTSpecialName", 10));
				field.Add(new BooleanHexBitField("HasFieldMarshal", 12));
				field.Add(new BooleanHexBitField("PinvokeImpl", 13));
				field.Add(new BooleanHexBitField("HasDefault", 15));
				return field;
			}
			return base.CreateField(colInfo);
		}
		internal static UInt16FlagsHexField CreateGenericParamAttributesField(ColumnInfo colInfo, HexDocument doc, string name, ulong startOffset) {
			var field = new UInt16FlagsHexField(doc, name, colInfo.Name, startOffset + (uint)colInfo.Offset);
			field.Add(new IntegerHexBitField("Variance", 0, 2, VarianceInfos));
			field.Add(new BooleanHexBitField("Reference", 2));
			field.Add(new BooleanHexBitField("Struct", 3));
			field.Add(new BooleanHexBitField("Default ctor", 4));
			return field;
		}
Exemple #10
0
        protected ImageOptionalHeaderVM(object owner, HexDocument doc, ulong startOffset, ulong endOffset, ulong offs1, ulong offs2)
            : base(owner)
        {
            this.magicVM = new UInt16HexField(doc, Name, "Magic", startOffset + 0);
            this.majorLinkerVersionVM      = new ByteHexField(doc, Name, "MajorLinkerVersion", startOffset + 2, true);
            this.minorLinkerVersionVM      = new ByteHexField(doc, Name, "MinorLinkerVersion", startOffset + 3, true);
            this.sizeOfCodeVM              = new UInt32HexField(doc, Name, "SizeOfCode", startOffset + 4);
            this.sizeOfInitializedDataVM   = new UInt32HexField(doc, Name, "SizeOfInitializedData", startOffset + 8);
            this.sizeOfUninitializedDataVM = new UInt32HexField(doc, Name, "SizeOfUninitializedData", startOffset + 0x0C);
            this.addressOfEntryPointVM     = new UInt32HexField(doc, Name, "AddressOfEntryPoint", startOffset + 0x10);
            this.baseOfCodeVM              = new UInt32HexField(doc, Name, "BaseOfCode", startOffset + 0x14);

            this.sectionAlignmentVM            = new UInt32HexField(doc, Name, "SectionAlignment", startOffset + offs1 + 0);
            this.fileAlignmentVM               = new UInt32HexField(doc, Name, "FileAlignment", startOffset + offs1 + 4);
            this.majorOperatingSystemVersionVM = new UInt16HexField(doc, Name, "MajorOperatingSystemVersion", startOffset + offs1 + 8, true);
            this.minorOperatingSystemVersionVM = new UInt16HexField(doc, Name, "MinorOperatingSystemVersion", startOffset + offs1 + 0x0A, true);
            this.majorImageVersionVM           = new UInt16HexField(doc, Name, "MajorImageVersion", startOffset + offs1 + 0x0C, true);
            this.minorImageVersionVM           = new UInt16HexField(doc, Name, "MinorImageVersion", startOffset + offs1 + 0x0E, true);
            this.majorSubsystemVersionVM       = new UInt16HexField(doc, Name, "MajorSubsystemVersion", startOffset + offs1 + 0x10, true);
            this.minorSubsystemVersionVM       = new UInt16HexField(doc, Name, "MinorSubsystemVersion", startOffset + offs1 + 0x12, true);
            this.win32VersionValueVM           = new UInt32HexField(doc, Name, "Win32VersionValue", startOffset + offs1 + 0x14, true);
            this.sizeOfImageVM   = new UInt32HexField(doc, Name, "SizeOfImage", startOffset + offs1 + 0x18);
            this.sizeOfHeadersVM = new UInt32HexField(doc, Name, "SizeOfHeaders", startOffset + offs1 + 0x1C);
            this.checkSumVM      = new UInt32HexField(doc, Name, "CheckSum", startOffset + offs1 + 0x20);
            this.subsystemVM     = new UInt16FlagsHexField(doc, Name, "Subsystem", startOffset + offs1 + 0x24);
            this.subsystemVM.Add(new IntegerHexBitField("Subsystem", 0, 16, SubsystemInfos));
            this.dllCharacteristicsVM = new UInt16FlagsHexField(doc, Name, "DllCharacteristics", startOffset + offs1 + 0x26);
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("Reserved1", 0));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("Reserved2", 1));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("Reserved3", 2));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("Reserved4", 3));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("Reserved5", 4));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("High Entropy VA", 5));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("Dynamic Base", 6));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("Force Integrity", 7));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("NX Compat", 8));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("No Isolation", 9));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("No SEH", 10));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("No Bind", 11));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("AppContainer", 12));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("WDM Driver", 13));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("Guard CF", 14));
            this.dllCharacteristicsVM.Add(new BooleanHexBitField("Terminal Server Aware", 15));
            this.loaderFlagsVM         = new UInt32HexField(doc, Name, "LoaderFlags", startOffset + offs2 + 0);
            this.numberOfRvaAndSizesVM = new UInt32HexField(doc, Name, "NumberOfRvaAndSizes", startOffset + offs2 + 4);

            ulong doffs = offs2 + 8;

            this.dataDir0VM  = new DataDirVM(doc, Name, "Export", startOffset + doffs + 0);
            this.dataDir1VM  = new DataDirVM(doc, Name, "Import", startOffset + doffs + 8);
            this.dataDir2VM  = new DataDirVM(doc, Name, "Resource", startOffset + doffs + 0x10);
            this.dataDir3VM  = new DataDirVM(doc, Name, "Exception", startOffset + doffs + 0x18);
            this.dataDir4VM  = new DataDirVM(doc, Name, "Security", startOffset + doffs + 0x20);
            this.dataDir5VM  = new DataDirVM(doc, Name, "Base Reloc", startOffset + doffs + 0x28);
            this.dataDir6VM  = new DataDirVM(doc, Name, "Debug", startOffset + doffs + 0x30);
            this.dataDir7VM  = new DataDirVM(doc, Name, "Architecture", startOffset + doffs + 0x38);
            this.dataDir8VM  = new DataDirVM(doc, Name, "Global Ptr", startOffset + doffs + 0x40);
            this.dataDir9VM  = new DataDirVM(doc, Name, "TLS", startOffset + doffs + 0x48);
            this.dataDir10VM = new DataDirVM(doc, Name, "Load Config", startOffset + doffs + 0x50);
            this.dataDir11VM = new DataDirVM(doc, Name, "Bound Import", startOffset + doffs + 0x58);
            this.dataDir12VM = new DataDirVM(doc, Name, "IAT", startOffset + doffs + 0x60);
            this.dataDir13VM = new DataDirVM(doc, Name, "Delay Import", startOffset + doffs + 0x68);
            this.dataDir14VM = new DataDirVM(doc, Name, ".NET", startOffset + doffs + 0x70);
            this.dataDir15VM = new DataDirVM(doc, Name, "Reserved15", startOffset + doffs + 0x78);
        }
Exemple #11
0
		public ImageFileHeaderVM(object owner, HexDocument doc, ulong startOffset)
			: base(owner) {
			this.machineVM = new UInt16FlagsHexField(doc, Name, "Machine", startOffset + 0);
			this.machineVM.Add(new IntegerHexBitField("Machine", 0, 16, MachineInfos));
			this.numberOfSectionsVM = new UInt16HexField(doc, Name, "NumberOfSections", startOffset + 2);
			this.timeDateStampVM = new UInt32HexField(doc, Name, "TimeDateStamp", startOffset + 4);
			this.timeDateStampVM.DataFieldVM.PropertyChanged += (s, e) => OnPropertyChanged("TimeDateStampString");
			this.pointerToSymbolTableVM = new UInt32HexField(doc, Name, "PointerToSymbolTable", startOffset + 8);
			this.numberOfSymbolsVM = new UInt32HexField(doc, Name, "NumberOfSymbols", startOffset + 0x0C);
			this.sizeOfOptionalHeaderVM = new UInt16HexField(doc, Name, "SizeOfOptionalHeader", startOffset + 0x10);
			this.characteristicsVM = new UInt16FlagsHexField(doc, Name, "Characteristics", startOffset + 0x12);
			this.characteristicsVM.Add(new BooleanHexBitField("Relocs Stripped", 0));
			this.characteristicsVM.Add(new BooleanHexBitField("Executable Image", 1));
			this.characteristicsVM.Add(new BooleanHexBitField("Line Nums Stripped", 2));
			this.characteristicsVM.Add(new BooleanHexBitField("Local Syms Stripped", 3));
			this.characteristicsVM.Add(new BooleanHexBitField("Aggressive WS Trim", 4));
			this.characteristicsVM.Add(new BooleanHexBitField("Large Address Aware", 5));
			this.characteristicsVM.Add(new BooleanHexBitField("Reserved 0040h", 6));
			this.characteristicsVM.Add(new BooleanHexBitField("Bytes Reversed Lo", 7));
			this.characteristicsVM.Add(new BooleanHexBitField("32-Bit Machine", 8));
			this.characteristicsVM.Add(new BooleanHexBitField("Debug Stripped", 9));
			this.characteristicsVM.Add(new BooleanHexBitField("Removable Run From Swap", 10));
			this.characteristicsVM.Add(new BooleanHexBitField("Net Run From Swap", 11));
			this.characteristicsVM.Add(new BooleanHexBitField("System", 12));
			this.characteristicsVM.Add(new BooleanHexBitField("Dll", 13));
			this.characteristicsVM.Add(new BooleanHexBitField("Up System Only", 14));
			this.characteristicsVM.Add(new BooleanHexBitField("Bytes Reversed Hi", 15));

			this.hexFields = new HexField[] {
				machineVM,
				numberOfSectionsVM,
				timeDateStampVM,
				pointerToSymbolTableVM,
				numberOfSymbolsVM,
				sizeOfOptionalHeaderVM,
				characteristicsVM,
			};
		}