/// <summary> /// Opens a PE image from a file. /// </summary> /// <param name="peFile">The file to base the image from.</param> /// <param name="readParameters">The parameters to use while reading the PE image.</param> public SerializedPEImage(PEFile peFile, PEReadParameters readParameters) { PEFile = peFile ?? throw new ArgumentNullException(nameof(peFile)); ReadParameters = readParameters; MachineType = PEFile.FileHeader.Machine; Characteristics = PEFile.FileHeader.Characteristics; TimeDateStamp = new DateTime(1970, 1, 1) + TimeSpan.FromSeconds(peFile.FileHeader.TimeDateStamp); PEKind = PEFile.OptionalHeader.Magic; SubSystem = PEFile.OptionalHeader.SubSystem; DllCharacteristics = PEFile.OptionalHeader.DllCharacteristics; ImageBase = PEFile.OptionalHeader.ImageBase; }
/// <summary> /// Opens a PE image from an input stream. /// </summary> /// <param name="reader">The input stream.</param> /// <param name="mode">Indicates the input PE is in its mapped or unmapped form.</param> /// <param name="readParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromReader(IBinaryStreamReader reader, PEMappingMode mode, PEReadParameters readParameters) => FromFile(PEFile.FromReader(reader, mode), readParameters);
/// <summary> /// Opens a PE image from a buffer. /// </summary> /// <param name="bytes">The bytes to interpret.</param> /// <param name="readParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromBytes(byte[] bytes, PEReadParameters readParameters) => FromFile(PEFile.FromBytes(bytes), readParameters);
/// <summary> /// Opens a PE image from a specific file on the disk. /// </summary> /// <param name="filePath">The </param> /// <param name="readParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromFile(string filePath, PEReadParameters readParameters) => FromFile(PEFile.FromFile(filePath), readParameters);
/// <summary> /// Opens a PE image from a PE file object. /// </summary> /// <param name="peFile">The PE file object.</param> /// <param name="readParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromFile(IPEFile peFile, PEReadParameters readParameters) => new SerializedPEImage(peFile, readParameters);
/// <summary> /// Opens a PE image from an input stream. /// </summary> /// <param name="reader">The input stream.</param> /// <param name="readParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromReader(IBinaryStreamReader reader, PEReadParameters readParameters) => FromFile(PEFile.FromReader(reader), readParameters);