The IMAGE_DOS_HEADER with which every PE file starts.
Inheritance: AbstractStructure
Exemplo n.º 1
0
 public void ImageDosHeaderConstructorWorks_Test()
 {
     var idh = new IMAGE_DOS_HEADER(RawStructures.RawDosHeader, 0);
     Assert.AreEqual((uint) 0x1100, idh.e_magic);
     Assert.AreEqual((uint) 0x3322, idh.e_cblp);
     Assert.AreEqual((uint) 0x5544, idh.e_cp);
     Assert.AreEqual((uint) 0x7766, idh.e_crlc);
     Assert.AreEqual((uint) 0x9988, idh.e_cparhdr);
     Assert.AreEqual((uint) 0xbbaa, idh.e_minalloc);
     Assert.AreEqual((uint) 0xddcc, idh.e_maxalloc);
     Assert.AreEqual((uint) 0x00ff, idh.e_ss);
     Assert.AreEqual((uint) 0x2211, idh.e_sp);
     Assert.AreEqual((uint) 0x4433, idh.e_csum);
     Assert.AreEqual((uint) 0x6655, idh.e_ip);
     Assert.AreEqual((uint) 0x8877, idh.e_cs);
     Assert.AreEqual((uint) 0xaa99, idh.e_lfarlc);
     Assert.AreEqual((uint) 0xccbb, idh.e_ovno);
     AssertEqual(new ushort[]
     {
         0xeedd,
         0x00ff,
         0x2211,
         0x4433
     }, idh.e_res);
     Assert.AreEqual((uint) 0x6655, idh.e_oemid);
     Assert.AreEqual((uint) 0x8877, idh.e_oeminfo);
     AssertEqual(new ushort[]
     {
         0xaa99,
         0xccbb,
         0xeedd,
         0x11ff,
         0x3322,
         0x5544,
         0x7766,
         0x9988,
         0xbbaa,
         0xbbcc
     }, idh.e_res2);
 }
Exemplo n.º 2
0
        /// <summary>
        ///     Tests is a file is a PE file based on the MZ
        ///     header. It is not checked if the PE file is correct
        ///     in all other parts.
        /// </summary>
        /// <param name="file">Path to a possible PE file.</param>
        /// <returns>True if the MZ header is set.</returns>
        public static bool IsPEFile(string file)
        {
            var buff = File.ReadAllBytes(file);
            IMAGE_DOS_HEADER dosHeader = null;
            try
            {
                dosHeader = new IMAGE_DOS_HEADER(buff, 0);
            }
            catch (Exception)
            {
                return false;
            }

            try
            {
                return dosHeader.e_magic == 0x5a4d;
            }
            catch (Exception)
            {
                return false;
            }
        }
Exemplo n.º 3
0
        /// <summary>
        ///     Returns if the file is a PE file and 64 Bit.
        /// </summary>
        /// <param name="file">Path to a possible PE file.</param>
        /// <returns>True if file is PE and x64.</returns>
        public static bool Is64BitPeFile(string file)
        {
            var buff = File.ReadAllBytes(file);
            IMAGE_DOS_HEADER dosHeader;
            bool is64;
            try
            {
                dosHeader = new IMAGE_DOS_HEADER(buff, 0);
                is64 = buff.BytesToUInt16(dosHeader.e_lfanew + 0x4) ==
                       (ushort) Constants.FileHeaderMachine.IMAGE_FILE_MACHINE_AMD64;
            }
            catch (Exception)
            {
                return false;
            }

            return (dosHeader.e_magic == 0x5a4d) && is64;
        }