public void TestMappingExecutable() { var stream = File.OpenRead(Path.Combine("Files", "firefox.exe")); var mapper = new ExecutableMapper(); var executable = mapper.ReadExecutable(stream); Assert.Equal(COFF_MACHINE_TYPE.IMAGE_FILE_MACHINE_AMD64, executable.CoffHeader.Machine); Assert.Equal(COFF_CHARACTERISTICS.IMAGE_FILE_EXECUTABLE_IMAGE | COFF_CHARACTERISTICS.IMAGE_FILE_LARGE_ADDRESS_AWARE, executable.CoffHeader.Characteristics); Assert.Equal(new DateTimeOffset(2018, 3, 23, 16, 51, 44, TimeSpan.Zero), executable.CoffHeader.TimeDateStampMarshaled); Assert.Equal("MZ", executable.DosHeader.e_magic); Assert.Equal("PE", executable.PeHeader.PeHeader); Assert.Null(executable.OptionalHeader); Assert.Equal(new Version(), executable.OptionalHeader64.ImageVersion); Assert.Equal(new Version(6, 1), executable.OptionalHeader64.SubsystemVersion); Assert.Equal(new Version(14, 11), executable.OptionalHeader64.LinkerVersion); Assert.Equal(new Version(6, 1), executable.OptionalHeader64.OperatingSystemVersion); Assert.Equal(16, executable.OptionalHeader64.DataDirectory.Length); Assert.Equal(6, executable.ImageSectionHeaders.Length); Assert.Equal(".text", executable.ImageSectionHeaders[0].Name); Assert.Equal(".rdata", executable.ImageSectionHeaders[1].Name); Assert.Equal(".data", executable.ImageSectionHeaders[2].Name); Assert.Equal(".pdata", executable.ImageSectionHeaders[3].Name); Assert.Equal(".rsrc", executable.ImageSectionHeaders[4].Name); Assert.Equal(".reloc", executable.ImageSectionHeaders[5].Name); }
static void Main() { using (var stream = File.OpenRead(@"C:\Program Files\Mozilla Firefox\firefox.exe")) { var executable = new ExecutableMapper().ReadExecutable(stream); } using (var stream = File.OpenRead(@"C:\Users\ae\Downloads\9fbb25caf5e868e909ccc987c32ddde88ad13ca6.dmp")) { var minidump = new MinidumpMapper().ReadMinidump(stream); Console.WriteLine($"This minidump is of type {minidump.Header.Flags}. Press enter to see a list of loaded modules."); Console.ReadLine(); foreach (var module in minidump.Modules) { Console.WriteLine(module.Name); } } Console.ReadLine(); }