/// <summary>
/// Opens a PE image from a file.
/// </summary>
/// <param name="peFile">The file to base the image from.</param>
/// <param name="readParameters">The parameters to use while reading the PE image.</param>
public SerializedPEImage(PEFile peFile, PEReadParameters readParameters)
{
PEFile = peFile ?? throw new ArgumentNullException(nameof(peFile));
ReadParameters = readParameters;
MachineType = PEFile.FileHeader.Machine;
Characteristics = PEFile.FileHeader.Characteristics;
TimeDateStamp = new DateTime(1970, 1, 1) + TimeSpan.FromSeconds(peFile.FileHeader.TimeDateStamp);
PEKind = PEFile.OptionalHeader.Magic;
SubSystem = PEFile.OptionalHeader.SubSystem;
DllCharacteristics = PEFile.OptionalHeader.DllCharacteristics;
ImageBase = PEFile.OptionalHeader.ImageBase;
}
/// <summary> /// Opens a PE image from an input stream. /// </summary> /// <param name="reader">The input stream.</param> /// <param name="mode">Indicates the input PE is in its mapped or unmapped form.</param> /// <param name="readParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromReader(IBinaryStreamReader reader, PEMappingMode mode, PEReadParameters readParameters) => FromFile(PEFile.FromReader(reader, mode), readParameters);
/// <summary> /// Opens a PE image from a buffer. /// </summary> /// <param name="bytes">The bytes to interpret.</param> /// <param name="readParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromBytes(byte[] bytes, PEReadParameters readParameters) => FromFile(PEFile.FromBytes(bytes), readParameters);
/// <summary> /// Opens a PE image from a specific file on the disk. /// </summary> /// <param name="filePath">The </param> /// <param name="readParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromFile(string filePath, PEReadParameters readParameters) => FromFile(PEFile.FromFile(filePath), readParameters);
/// <summary> /// Opens a PE image from a PE file object. /// </summary> /// <param name="peFile">The PE file object.</param> /// <param name="readParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromFile(IPEFile peFile, PEReadParameters readParameters) => new SerializedPEImage(peFile, readParameters);
/// <summary>
/// Opens a PE image from an input stream.
/// </summary>
/// <param name="reader">The input stream.</param>
/// <param name="readParameters">The parameters to use while reading the PE image.</param>
/// <returns>The PE image that was opened.</returns>
/// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception>
public static IPEImage FromReader(IBinaryStreamReader reader, PEReadParameters readParameters) =>
FromFile(PEFile.FromReader(reader), readParameters);