/// <summary>
/// Opens a PE image from a file.
/// </summary>
/// <param name="peFile">The file to base the image from.</param>
/// <param name="readerParameters">The parameters to use while reading the PE image.</param>
public SerializedPEImage(IPEFile peFile, PEReaderParameters readerParameters)
{
PEFile = peFile ?? throw new ArgumentNullException(nameof(peFile));
ReaderContext = new PEReaderContext(peFile, readerParameters);
FilePath = peFile.FilePath;
MachineType = PEFile.FileHeader.Machine;
Characteristics = PEFile.FileHeader.Characteristics;
TimeDateStamp = new DateTime(1970, 1, 1) + TimeSpan.FromSeconds(peFile.FileHeader.TimeDateStamp);
PEKind = PEFile.OptionalHeader.Magic;
SubSystem = PEFile.OptionalHeader.SubSystem;
DllCharacteristics = PEFile.OptionalHeader.DllCharacteristics;
ImageBase = PEFile.OptionalHeader.ImageBase;
}
/// <summary> /// Reads a mapped PE image starting at the provided module base address (HINSTANCE). /// </summary> /// <param name="hInstance">The HINSTANCE or base address of the module.</param> /// <param name="readerParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was read.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromModuleBaseAddress(IntPtr hInstance, PEReaderParameters readerParameters) => FromFile(PEFile.FromModuleBaseAddress(hInstance), readerParameters);
/// <summary> /// Opens a PE image from a specific file on the disk. /// </summary> /// <param name="filePath">The </param> /// <param name="readerParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromFile(string filePath, PEReaderParameters readerParameters) => FromFile(PEFile.FromFile(readerParameters.FileService.OpenFile(filePath)), readerParameters);
/// <summary> /// Opens a PE image from a buffer. /// </summary> /// <param name="bytes">The bytes to interpret.</param> /// <param name="readerParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromBytes(byte[] bytes, PEReaderParameters readerParameters) => FromFile(PEFile.FromBytes(bytes), readerParameters);
/// <summary> /// Reads a PE image from the provided data source. /// </summary> /// <param name="dataSource">The data source to read from.</param> /// <param name="mode">Indicates how the input PE file is mapped.</param> /// <param name="readerParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was read.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromDataSource(IDataSource dataSource, PEMappingMode mode, PEReaderParameters readerParameters) => FromReader(new BinaryStreamReader(dataSource, dataSource.BaseAddress, 0, (uint)dataSource.Length), mode, readerParameters);
/// <summary> /// Opens a PE image from a PE file object. /// </summary> /// <param name="peFile">The PE file object.</param> /// <param name="readerParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromFile(IPEFile peFile, PEReaderParameters readerParameters) => new SerializedPEImage(peFile, readerParameters);
/// <summary> /// Opens a PE image from an input stream. /// </summary> /// <param name="reader">The input stream.</param> /// <param name="mode">Indicates the input PE is in its mapped or unmapped form.</param> /// <param name="readerParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromReader(IBinaryStreamReader reader, PEMappingMode mode, PEReaderParameters readerParameters) => FromFile(PEFile.FromReader(reader, mode), readerParameters);
/// <summary> /// Opens a PE image from a specific file on the disk. /// </summary> /// <param name="filePath">The </param> /// <param name="readerParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromFile(string filePath, PEReaderParameters readerParameters) => FromFile(PEFile.FromFile(filePath), readerParameters);
/// <summary>
/// Creates a new instance of the <see cref="PEReaderContext"/> class.
/// </summary>
/// <param name="file">The original PE file.</param>
/// <param name="parameters">The reader parameters.</param>
public PEReaderContext(IPEFile file, PEReaderParameters parameters)
{
File = file;
Parameters = parameters;
}