/// <summary> /// Initializes a new instance of the <see cref="PortableExecutableHeader"/> class using the specified path of a portable executable image."/> /// </summary> /// <param name="path">The path of the executable image.</param> public PortableExecutableHeader(string path) { Path = path; ImageDosHeader = IMAGE_DOS_HEADER.Read(path); ReadImageNTHeaders(); if (IsValidNTHeader) { ReadImageSectionHeaders(); if (CLRRuntimeHeader.VirtualAddress != 0) { IMAGE_SECTION_HEADER section = GetSectionFromRva(CLRRuntimeHeader.VirtualAddress); uint clrOffset = CLRRuntimeHeader.VirtualAddress - section.VirtualAddress + section.PointerToRawData; _imageCor20Header = IMAGE_COR20_HEADER.Read(Path, clrOffset); } } }
/// <summary> /// Reads the <see cref="IMAGE_DOS_HEADER"/> of an executable file. /// </summary> /// <param name="path">The path of the executable.</param> /// <returns>The <see cref="IMAGE_DOS_HEADER"/> of the executable file.</returns> public static IMAGE_DOS_HEADER Read(string path) { if (String.IsNullOrEmpty(path)) { throw new ArgumentNullException("path"); } using (FileStream stream = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.Read)) using (BinaryReader reader = new BinaryReader(stream)) { reader.BaseStream.Seek(0, SeekOrigin.Begin); var _imageDOSHeader = new IMAGE_DOS_HEADER { e_magic = reader.ReadUInt16(), e_cblp = reader.ReadUInt16(), e_cp = reader.ReadUInt16(), e_crlc = reader.ReadUInt16(), e_cparhdr = reader.ReadUInt16(), e_minalloc = reader.ReadUInt16(), e_maxalloc = reader.ReadUInt16(), e_ss = reader.ReadUInt16(), e_sp = reader.ReadUInt16(), e_csum = reader.ReadUInt16(), e_ip = reader.ReadUInt16(), e_cs = reader.ReadUInt16(), elfarlc = reader.ReadUInt16(), e_ovno = reader.ReadUInt16(), e_res = new UInt16[] { reader.ReadUInt16(), reader.ReadUInt16(), reader.ReadUInt16(), reader.ReadUInt16() }, e_oemid = reader.ReadUInt16(), e_oeminfo = reader.ReadUInt16(), e_res2 = new UInt16[] { reader.ReadUInt16(), reader.ReadUInt16(), reader.ReadUInt16(), reader.ReadUInt16(), reader.ReadUInt16(), reader.ReadUInt16(), reader.ReadUInt16(), reader.ReadUInt16(), reader.ReadUInt16(), reader.ReadUInt16() }, e_lfanew = reader.ReadUInt32(), }; return(_imageDOSHeader); } }