public PeHeader(MainType mainType, PeImage peImage) { uint headerOffset; version = getHeaderOffsetAndVersion(peImage, out headerOffset); headerData = peImage.offsetReadBytes(headerOffset, 0x1000); }
static void readTo(PeImage peImage, byte[] data, int destOffset, uint imageOffset, uint maxLength) { if (destOffset > data.Length) return; int len = Math.Min(data.Length - destOffset, (int)maxLength); var newData = peImage.offsetReadBytes(imageOffset, len); Array.Copy(newData, 0, data, destOffset, newData.Length); }
public static bool detect(PeImage peImage) { try { uint codeHeaderOffset = getCodeHeaderOffset(peImage); if (isValidSignature(peImage.offsetReadBytes(codeHeaderOffset, 16))) return true; } catch { } try { uint codeHeaderOffset = getOldCodeHeaderOffset(peImage); if (codeHeaderOffset != 0 && isValidSignature(peImage.offsetReadBytes(codeHeaderOffset, 16))) return true; } catch { } return false; }