// ReSharper restore MemberCanBePrivate.Global public static PEDataDirectory Parse(BinaryReader reader) { var dir = new PEDataDirectory { VirtualAddress = reader.ReadUInt32(), Size = reader.ReadUInt32(), }; return(dir); }
public static PEHeader Parse(BinaryReader reader) { var signature = (PEHeaderType)reader.ReadUInt16(); if (!Enum.IsDefined(typeof(PEHeaderType), signature)) { throw new Exception("Invalid PE header signature"); } var header = new PEHeader { Type = signature, LinkerVersion = new Version(reader.ReadByte(), reader.ReadByte()), SizeOfCode = reader.ReadUInt32(), SizeOfInitializedData = reader.ReadUInt32(), SizeOfUninitializedData = reader.ReadUInt32(), AddressOfEntryPoint = reader.ReadUInt32(), BaseOfCode = reader.ReadUInt32() }; if (signature == PEHeaderType.PE64) { header.ImageBase = reader.ReadUInt64(); } else { header.BaseOfData = reader.ReadUInt32(); header.ImageBase = reader.ReadUInt32(); } header.SectionAlignment = reader.ReadUInt32(); header.FileAlignment = reader.ReadUInt32(); header.OperatingSystemVersion = new Version(reader.ReadUInt16(), reader.ReadUInt16()); header.ImageVersion = new Version(reader.ReadUInt16(), reader.ReadUInt16()); header.SubsystemVersion = new Version(reader.ReadUInt16(), reader.ReadUInt16()); header.Win32VersionValue = reader.ReadUInt32(); header.SizeOfImage = reader.ReadUInt32(); header.SizeOfHeaders = reader.ReadUInt32(); header.Checksum = reader.ReadUInt32(); header.Subsystem = (PESubsystem)reader.ReadUInt16(); header.DllCharacteristics = (PEDllCharacteristics)reader.ReadUInt16(); if (signature == PEHeaderType.PE64) { header.SizeOfStackReserve = reader.ReadUInt64(); header.SizeOfStackCommit = reader.ReadUInt64(); header.SizeOfHeapReserve = reader.ReadUInt64(); header.SizeOfHeapCommit = reader.ReadUInt64(); } else { header.SizeOfStackReserve = reader.ReadUInt32(); header.SizeOfStackCommit = reader.ReadUInt32(); header.SizeOfHeapReserve = reader.ReadUInt32(); header.SizeOfHeapCommit = reader.ReadUInt32(); } header.LoaderFlags = reader.ReadUInt32(); header.DataDirectories = new PEDataDirectory[reader.ReadUInt32()]; for (var i = 0; i < header.DataDirectories.Length; i++) { header.DataDirectories[i] = PEDataDirectory.Parse(reader); } return(header); }