public void PEHeader()
{
var peh = new PEHeader();
peh.Machine = Machine.I386;
peh.Characteristics = ImageCharacteristics.Bit32Machine;
Assert.AreEqual("I386 Bit32Machine Sections[0]", peh.ToString());
}
public PEHeaderModel(PEHeader peHeader, DosHeaderModel dosHeaderModel)
: base("PE header")
{
this.peHeader = peHeader;
this.Address = dosHeaderModel.lfanew;
this.Length = PEHeader.Size;
BindAddressToDosHeaderlfanew(dosHeaderModel);
}
static void WritePEHeader(PEHeader peHeader, BinaryStreamWriter writer)
{
writer.WriteUInt32((uint)PESignature.PE00);
writer.WriteUInt16((ushort)peHeader.Machine);
writer.WriteUInt16(peHeader.NumberOfSections);
double timestampDouble = (peHeader.Timestamp - TimestampEpochUTC).TotalSeconds;
uint timestampNum = checked((uint)timestampDouble);
if (timestampDouble - timestampNum > 0.5)
timestampNum++;
writer.WriteUInt32(timestampNum);
writer.WriteUInt32(peHeader.PointerToSymbolTable);
writer.WriteUInt32(peHeader.NumberOfSymbols);
writer.WriteUInt16(peHeader.SizeOfOptionalHeader);
writer.WriteUInt16((ushort)peHeader.Characteristics);
}
static void AssertPEHeader(PEHeader header, Machine machine, ushort expectedNumberOfSections, DateTime timestampOffset, bool isExe)
{
Assert.AreEqual(machine, header.Machine, "machine");
Assert.AreEqual(expectedNumberOfSections, header.NumberOfSections, "number of sections");
Assert.IsTrue(Math.Abs((timestampOffset - header.Timestamp).TotalHours) < 2, "PE timestamp is " + header.Timestamp +", off by " + ((timestampOffset - header.Timestamp).TotalHours).ToString("0") + " hours.");
Assert.AreEqual((uint)0, header.PointerToSymbolTable, "pointer to symbol table");
Assert.AreEqual((uint)0, header.NumberOfSymbols, "number of symbols");
uint expectedSizeOfOptionalHeader = machine == Machine.I386 ?
(uint)224 :
(uint)240;
Assert.AreEqual(expectedSizeOfOptionalHeader, header.SizeOfOptionalHeader);
ImageCharacteristics expectedCharacteristics = machine == Machine.I386 ?
ImageCharacteristics.ExecutableImage | ImageCharacteristics.Bit32Machine | (isExe ? 0 : ImageCharacteristics.Dll) :
ImageCharacteristics.ExecutableImage | ImageCharacteristics.LargeAddressAware | (isExe ? 0 : ImageCharacteristics.Dll);
Assert.AreEqual(expectedCharacteristics, header.Characteristics, "characteristics");
}