/// <summary> /// Create new PE Object from strean /// </summary> /// <param name="stream"></param> public PE(Stream stream, bool load_full = false) { pe = new BinaryReaderEx(stream); try { pe.ReadStruct<IMAGE_DOS_HEADER>(out this.dosHeader); if (dosHeader.e_magic != 0x5A4D) // MZ throw new Exception("Invalid DOS header"); pe.Seek(dosHeader.e_lfanew); UInt32 nt_sign = pe.ReadUInt32(); if (nt_sign != 0x4550) // PE throw new Exception("Invalid PE signature"); pe.ReadStruct<IMAGE_FILE_HEADER>(out fileHeader); ushort magic = pe.ReadUInt16(); pe.Seek(-2, SeekOrigin.Current); switch (magic) { case (ushort)PeType.PE32: this.peType = PeType.PE32; pe.ReadStruct<IMAGE_OPTIONAL_HEADER32>(out this.optionalHeader32); break; case (ushort)PeType.PE64: this.peType = PeType.PE64; pe.ReadStruct<IMAGE_OPTIONAL_HEADER64>(out this.optionalHeader64); break; case (ushort)PeType.ROM: this.peType = PeType.ROM; break; default: throw new Exception("Invalid IMAGE_FILE_HEADER.Magic value"); } if (this.peType != PeType.ROM) { this.imageSectionHeaders = pe.ReadStructArray<IMAGE_SECTION_HEADER>(fileHeader.NumberOfSections); this.loadSections(); if (load_full) this.LoadFull(); } } catch (Exception e) { pe = null; throw e; } }