/// <summary> /// Opens a PE image from a file. /// </summary> /// <param name="peFile">The file to base the image from.</param> /// <param name="readerParameters">The parameters to use while reading the PE image.</param> public SerializedPEImage(IPEFile peFile, PEReaderParameters readerParameters) { PEFile = peFile ?? throw new ArgumentNullException(nameof(peFile)); ReaderContext = new PEReaderContext(peFile, readerParameters); FilePath = peFile.FilePath; MachineType = PEFile.FileHeader.Machine; Characteristics = PEFile.FileHeader.Characteristics; TimeDateStamp = new DateTime(1970, 1, 1) + TimeSpan.FromSeconds(peFile.FileHeader.TimeDateStamp); PEKind = PEFile.OptionalHeader.Magic; SubSystem = PEFile.OptionalHeader.SubSystem; DllCharacteristics = PEFile.OptionalHeader.DllCharacteristics; ImageBase = PEFile.OptionalHeader.ImageBase; }
/// <summary> /// Reads a mapped PE image starting at the provided module base address (HINSTANCE). /// </summary> /// <param name="hInstance">The HINSTANCE or base address of the module.</param> /// <param name="readerParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was read.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromModuleBaseAddress(IntPtr hInstance, PEReaderParameters readerParameters) => FromFile(PEFile.FromModuleBaseAddress(hInstance), readerParameters);
/// <summary> /// Opens a PE image from a specific file on the disk. /// </summary> /// <param name="filePath">The </param> /// <param name="readerParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromFile(string filePath, PEReaderParameters readerParameters) => FromFile(PEFile.FromFile(readerParameters.FileService.OpenFile(filePath)), readerParameters);
/// <summary> /// Opens a PE image from a buffer. /// </summary> /// <param name="bytes">The bytes to interpret.</param> /// <param name="readerParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromBytes(byte[] bytes, PEReaderParameters readerParameters) => FromFile(PEFile.FromBytes(bytes), readerParameters);
/// <summary> /// Reads a PE image from the provided data source. /// </summary> /// <param name="dataSource">The data source to read from.</param> /// <param name="mode">Indicates how the input PE file is mapped.</param> /// <param name="readerParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was read.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromDataSource(IDataSource dataSource, PEMappingMode mode, PEReaderParameters readerParameters) => FromReader(new BinaryStreamReader(dataSource, dataSource.BaseAddress, 0, (uint)dataSource.Length), mode, readerParameters);
/// <summary> /// Opens a PE image from a PE file object. /// </summary> /// <param name="peFile">The PE file object.</param> /// <param name="readerParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromFile(IPEFile peFile, PEReaderParameters readerParameters) => new SerializedPEImage(peFile, readerParameters);
/// <summary> /// Opens a PE image from an input stream. /// </summary> /// <param name="reader">The input stream.</param> /// <param name="mode">Indicates the input PE is in its mapped or unmapped form.</param> /// <param name="readerParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromReader(IBinaryStreamReader reader, PEMappingMode mode, PEReaderParameters readerParameters) => FromFile(PEFile.FromReader(reader, mode), readerParameters);
/// <summary> /// Opens a PE image from a specific file on the disk. /// </summary> /// <param name="filePath">The </param> /// <param name="readerParameters">The parameters to use while reading the PE image.</param> /// <returns>The PE image that was opened.</returns> /// <exception cref="BadImageFormatException">Occurs when the file does not follow the PE file format.</exception> public static IPEImage FromFile(string filePath, PEReaderParameters readerParameters) => FromFile(PEFile.FromFile(filePath), readerParameters);
/// <summary> /// Creates a new instance of the <see cref="PEReaderContext"/> class. /// </summary> /// <param name="file">The original PE file.</param> /// <param name="parameters">The reader parameters.</param> public PEReaderContext(IPEFile file, PEReaderParameters parameters) { File = file; Parameters = parameters; }