// ReSharper restore MemberCanBePrivate.Global
public static PEDataDirectory Parse(BinaryReader reader)
{
var dir = new PEDataDirectory
{
VirtualAddress = reader.ReadUInt32(),
Size = reader.ReadUInt32(),
};
return(dir);
}
public static PEHeader Parse(BinaryReader reader)
{
var signature = (PEHeaderType)reader.ReadUInt16();
if (!Enum.IsDefined(typeof(PEHeaderType), signature))
{
throw new Exception("Invalid PE header signature");
}
var header = new PEHeader
{
Type = signature,
LinkerVersion = new Version(reader.ReadByte(), reader.ReadByte()),
SizeOfCode = reader.ReadUInt32(),
SizeOfInitializedData = reader.ReadUInt32(),
SizeOfUninitializedData = reader.ReadUInt32(),
AddressOfEntryPoint = reader.ReadUInt32(),
BaseOfCode = reader.ReadUInt32()
};
if (signature == PEHeaderType.PE64)
{
header.ImageBase = reader.ReadUInt64();
}
else
{
header.BaseOfData = reader.ReadUInt32();
header.ImageBase = reader.ReadUInt32();
}
header.SectionAlignment = reader.ReadUInt32();
header.FileAlignment = reader.ReadUInt32();
header.OperatingSystemVersion = new Version(reader.ReadUInt16(), reader.ReadUInt16());
header.ImageVersion = new Version(reader.ReadUInt16(), reader.ReadUInt16());
header.SubsystemVersion = new Version(reader.ReadUInt16(), reader.ReadUInt16());
header.Win32VersionValue = reader.ReadUInt32();
header.SizeOfImage = reader.ReadUInt32();
header.SizeOfHeaders = reader.ReadUInt32();
header.Checksum = reader.ReadUInt32();
header.Subsystem = (PESubsystem)reader.ReadUInt16();
header.DllCharacteristics = (PEDllCharacteristics)reader.ReadUInt16();
if (signature == PEHeaderType.PE64)
{
header.SizeOfStackReserve = reader.ReadUInt64();
header.SizeOfStackCommit = reader.ReadUInt64();
header.SizeOfHeapReserve = reader.ReadUInt64();
header.SizeOfHeapCommit = reader.ReadUInt64();
}
else
{
header.SizeOfStackReserve = reader.ReadUInt32();
header.SizeOfStackCommit = reader.ReadUInt32();
header.SizeOfHeapReserve = reader.ReadUInt32();
header.SizeOfHeapCommit = reader.ReadUInt32();
}
header.LoaderFlags = reader.ReadUInt32();
header.DataDirectories = new PEDataDirectory[reader.ReadUInt32()];
for (var i = 0; i < header.DataDirectories.Length; i++)
{
header.DataDirectories[i] = PEDataDirectory.Parse(reader);
}
return(header);
}
