AsmResolver.PE.File

Provides valid attributes for describing a portable executable file.

Indicates that the file does not contain base relocations and must therefore be loaded at its preferred base address.

Indicates that the image file is valid and can be run. If this flag is not set, it indicates a linker error.

Indicates COFF line numbers have been removed. This flag is deprecated and should be zero.

Indicates COFF symbol table entries for local symbols have been removed. This flag is deprecated and should be zero.

Indicates an aggressively trim working set is used. This flag is deprecated for Windows 2000 and later and must be zero.

Indicates the application can handle larger than 2GB addresses.

Indicates the file uses little endian. This flag is deprecated and should be zero.

Indicates the target machine is based on a 32-bit-word architecture.

Indicates debugging information is removed from the image file.

Indicates the image should be fully loaded and copied to the swap file if the image is on removable media.

Indicates the image should be fully loaded and copied to the swap file if the image is on a network media.

Indicates the image file is a system file, not a user program.

Indicates the image file is a dynamic-link library (DLL). Such files are considered executable files for almost all purposes, although they cannot be directly run.

Indicates the file should be run only on a uniprocessor machine.

Indicates the file uses big endian. This flag is deprecated and should be zero.

Represents a data directory header, consisting of the starting address, and the size.

This structure does not contain the actual contents of the data directory.

Indicates the size of a single data directory header.

Reads a single data directory at the current position of the provided input stream.

The input stream to read from. The data directory that was read.

Creates a new data directory header.

The starting virtual address (RVA) of the directory. The size in bytes of the directory.

Gets the relative virtual address (RVA) of the directory.

Gets the size of the directory.

Gets a value indicating the data directory is present in the portable executable file.

Deconstructs the data directory into a 2-tuple.

The virtual address. The size.

Provides members describing the semantics of each data directory entry in an optional header.

Indicates the data directory entry containing exported symbols.

Indicates the directory entry containing a register of imported symbols.

Indicates the directory entry referencing the root win32 resource directory.

Indicates the directory entry containing a register of exception handlers.

Indicates the directory entry containing authentication signatures.

Indicates the directory entry containing base relocations that need to be applied to the image after loading.

Indicates the directory entry containing debug information.

Reserved.

The RVA of the value to be stored in the global pointer register. The size member of this structure must be set to zero.

Indicates the directory entry containing the thread local storage (TLS) table.

Indicates the directory entry containing the load configuration table.

Indicates the directory entry containing the bound import directory.

Indicates the directory entry containing the import address table.

Indicates the directory entry containing the delay import descriptor table.

Indicates the directory entry containing the CLR runtime headers.

Reserved.

Provides members describing all possible flags that can be set in the field.

Indicates the image can handle a high entropy 64-bit virtual address space.

Indicates the DLL can be relocated at load time.

Indicates Code Integrity checks are enforced.

Indicates the image is NX compatible.

Indicates the image is isolation aware, but do not isolate the image.

Indicates the image does not use structured exception (SE) handling. No SE handler may be called in this image.

Indicates the image must not be bound.

Indicates the image must execute in an AppContainer.

Indicates the image is a WDM driver.

Indicates the image supports Control Flow Guard.

Indicates the image is Terminal Server aware.

Represents the DOS header (also known as the MZ header) in the portable executable (PE) file format.

Indicates the magic constant that every DOS header should start with.

Indicates the minimal length of a valid DOS header in a portable executable file.

Indicates the offset of the e_flanew field in the DOS header.

Indicates the default value of the e_flanew field in the DOS header.

Reads a DOS header structure at the current position of the provided input stream.

The input stream to read from. The read DOS header. Occurs when the input stream does not point to a valid DOS header.

Creates a new DOS header with the default contents.

Creates a new DOS header with the provided contents.

The raw contents of the header. Occurs when the input data does not contain a valid DOS header.

Gets or sets the offset to the next header (NT header).

Represents the COFF file header of a portable executable file.

Indicates the static size of the COFF file header.

Reads a COFF file header from an input stream.

The input stream. The read file header.

Gets or sets the machine the portable executable file is compiled for.

Gets or sets the number of sections defined in the portable executable file.

Gets or sets the time stamp of the portable executable file.

This timestamp is encoded as the number of seconds since 00:00 January 1, 1970.

Gets or sets the absolute file offset to the symbol table.

Gets or sets the number of symbols defined in the portable executable file.

Gets or sets the size of the optional header.

Gets or sets the characteristics of the portable executable file.

Provides members for each processor architecture that a portable executable (PE) file can encode for.

The content of this field is assumed to be applicable to any machine type.

Provides a bitmask that is used to indicate the PE file is targeting Apple devices only.

This value is a bitmask and is not a valid machine type on its own. Furthermore, is only supposed to be used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Provides a bitmask that is used to indicate the PE file is targeting FreeBSD operating system derivatives.

This value is a bitmask and is not a valid machine type on its own. Furthermore, is only supposed to be used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Provides a bitmask that is used to indicate the PE file is targeting Linux operating system derivatives.

This value is a bitmask and is not a valid machine type on its own. Furthermore, is only supposed to be used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Provides a bitmask that is used to indicate the PE file is targeting NetBSD operating system derivatives.

This value is a bitmask and is not a valid machine type on its own. Furthermore, is only supposed to be used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Provides a bitmask that is used to indicate the PE file is targeting Sun operating system derivatives.

This value is a bitmask and is not a valid machine type on its own. Furthermore, is only supposed to be used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Indicates the Matsushita AM33 architecture.

Indicates the x64 architecture.

Indicates the x64 architecture, but specifically targets Apple devices.

This value is only used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Indicates the x64 architecture, but specifically targets FreeBSD operating system derivatives.

This value is only used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Indicates the x64 architecture, but specifically targets Linux operating system derivatives.

This value is only used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Indicates the x64 architecture, but specifically targets NetBSD operating system derivatives.

This value is only used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Indicates the x64 architecture, but specifically targets SunOS operating system derivatives.

This value is only used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Indicates the ARM little endian architecture.

Indicates the ARM thumb-2 little endian architecture.

Indicates the ARM thumb-2 little endian architecture, but specifically targets Apple devices.

This value is only used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Indicates the ARM thumb-2 little endian architecture, but specifically targets FreeBSD operating system derivatives.

This value is only used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Indicates the ARM thumb-2 little endian architecture, but specifically targets Linux operating system derivatives.

This value is only used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Indicates the ARM thumb-2 little endian architecture, but specifically targets NetBSD operating system derivatives.

This value is only used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Indicates the ARM 64-bit little endian architecture.

Indicates the ARM 64-bit little endian architecture, but specifically targets Apple devices.

This value is only used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Indicates the ARM 64-bit little endian architecture, but specifically targets FreeBSD operating system derivatives.

This value is only used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Indicates the ARM 64-bit little endian architecture, but specifically targets Linux operating system derivatives.

This value is only used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Indicates the ARM 64-bit little endian architecture, but specifically targets NetBSD operating system derivatives.

This value is only used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Indicates EFI byte code.

Indicates the Intel 368 or compatible x86 (32-bit) architectures.

Indicates the Intel 368 or compatible x86 (32-bit) architectures, but specifically targets Apple devices.

This value is only used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Indicates the Intel 368 or compatible x86 (32-bit) architectures, but specifically targets FreeBSD operating system derivatives.

This value is only used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Indicates the Intel 368 or compatible x86 (32-bit) architectures, but specifically targets Linux operating system derivatives.

This value is only used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Indicates the Intel 368 or compatible x86 (32-bit) architectures, but specifically targets NetBSD operating system derivatives.

This value is only used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Indicates the Intel 368 or compatible x86 (32-bit) architectures, but specifically targets SunOS operating system derivatives.

This value is only used by .NET PE images. Reference: https://github.com/dotnet/runtime/issues/36364

Indicates the Intel Itanium processor family.

Indicates the Mitsubishi M32R little endian architecture.

Indicates the MIPS 16-bit architecture.

Indicates the MIPS architecture with FPU.

Indicates the MIPS 16-bit architecture with FPU.

Indicates the PowerPC little-endian architecture.

Indicates the PowerPC little-endian architecture with floating point support.

Indicates the MIPS little endian architecture.

Indicates the Hitachi SH3 architecture.

Indicates the Hitachi SH3 DSP architecture.

Indicates the Hitachi SH4 architecture.

Indicates the Hitachi SH5 architecture.

Indicates the Thumb architecture.

Indicates the MIPS little-endian WCE v2 architecture.

Indicates the RISCV 32-bit architecture.

Indicates the RISCV 64-bit architecture.

Indicates the RISCV 128-bit architecture.

Represents a 32-bit or 64-bit optional header in a portable executable (PE) file.

Indicates the offset of the SizeOfImage field in the optional header.

Indicates the static size of an optional header in a 32-bit portable executable file, excluding the data directory entries.

Indicates the static size of an optional header in a 64-bit portable executable file, excluding the data directory entries.

Indicates the default number of data directory entries in an optional header.

Reads an optional header from the provided input stream.

The input stream. Indicates whether the number of data directories should be ignored and should be used instead. The optional header. Occurs when the input stream is malformed.

Gets or sets the magic optional header signature, determining whether the image is a PE32 (32-bit) or a PE32+ (64-bit) image.

Gets or sets the major linker version used to link the portable executable (PE) file.

Gets or sets the minor linker version used to link the portable executable (PE) file.

Gets or sets the total amount of bytes the code sections consist of.

Gets or sets the total amount of bytes the initialized data sections consist of.

Gets or sets the total amount of bytes the uninitialized data sections consist of.

Gets or sets the relative virtual address to the entry point of the portable executable (PE) file.

Gets or sets the relative virtual address (RVA) to the beginning of the code section, when loaded into memory.

Gets or sets the relative virtual address to the begin of the data section, when loaded into memory.

Gets or sets the preferred address of the first byte of the image when loaded into memory. Must be a multiple of 64,000.

Gets or sets the alignment of the sections when loaded into memory. Must be greater or equal to . Default is the page size for the architecture.

Gets or sets the alignment of the raw data of sections in the image file. Must be a power of 2 between 512 and 64,000.

Gets or sets the minimum major version of the operating system required to run the portable executable (PE) file.

Gets or sets the minimum minor version of the operating system required to run the portable executable (PE) file.

Gets or sets the major image version.

Gets or sets the minor image version.

Gets or sets the major version of the subsystem.

Gets or sets the minor version of the subsystem.

Reserved, should be zero.

Gets or sets the size in bytes of the portable executable (PE) file, including all headers. Must be a multiple of .

Gets or sets the size of the headers of the portable executable (PE) file, including the DOS-, PE- and section headers, rounded to .

Gets or sets the checksum of the portable executable (PE) file.

Gets or sets the subsystem to use when running the portable executable (PE) file.

Gets or sets the dynamic linked library characteristics of the portable executable (PE) file.

Gets or sets the size of the stack to reserve.

Gets or sets the size of the stack to commit.

Gets or sets the size of the heap to reserve.

Gets or sets the size of the heap to commit.

Obsolete.

Gets or sets the number of data directory headers defined in the optional header.

Gets the data directory headers defined in the optional header.

Gets a data directory by its index.

The index. The data directory entry.

Sets a data directory by its index.

The index. The new data directory entry.

Provides valid values for the optional header magic.

Indicates the binary contains a 32-bit portable executable file.

Indicates the binary contains a 64-bit portable executable file.

Indicates the binary contains a 64-bit portable executable file.

Provides members describing all possible flags that can be assigned to a section.

Reserved for future use.

Reserved for future use.

Reserved for future use.

The section should not be padded to the next boundary. This flag is obsolete and is replaced by Align1Bytes. This is valid only for object files.

Reserved for future use.

The section contains executable code.

The section contains initialized data.

The section contains uninitialized data.

Reserved for future use.

The section contains comments or other information. The .drectve section has this type. This is valid for object files only.

Reserved for future use.

The section will not become part of the image. This is valid only for object files.

The section contains COMDAT data. For more information, see section 5.5.6, COMDAT Sections (Object Only). This is valid only for object files.

Reset speculative exceptions handling bits in the TLB entries for this section.

The section contains data referenced through the global pointer (GP).

Reserved for future use.

Reserved for future use.

Reserved for future use.

Reserved for future use.

Align data on a 1-byte boundary. Valid only for object files.

Align data on a 2-byte boundary. Valid only for object files.

Align data on a 4-byte boundary. Valid only for object files.

Align data on an 8-byte boundary. Valid only for object files.

Align data on a 16-byte boundary. Valid only for object files.

Align data on a 32-byte boundary. Valid only for object files.

Align data on a 64-byte boundary. Valid only for object files.

Align data on a 128-byte boundary. Valid only for object files.

Align data on a 256-byte boundary. Valid only for object files.

Align data on a 512-byte boundary. Valid only for object files.

Align data on a 1024-byte boundary. Valid only for object files.

Align data on a 2048-byte boundary. Valid only for object files.

Align data on a 4096-byte boundary. Valid only for object files.

Align data on an 8192-byte boundary. Valid only for object files.

The section contains extended relocations.

The section can be discarded as needed.

The section cannot be cached.

The section is not pageable.

The section can be shared in memory.

The section can be executed as code.

The section can be read.

The section can be written.

Represents a single section header in the portable executable (PE) file format.

Indicates the static size of a single section header.

Creates a new section header with the provided name.

The name of the new section. The section flags to assign.

Creates a copy of the provided section header.

The section header to base information on.

Gets or sets the name of the section.

The name of the section is a UTF-8 string that can be no longer than 8 characters long.

Gets or sets the total number of bytes the section consists of when it is loaded into memory.

If the value is greater than , it is zero-padded when loaded into memory.

Gets or sets the virtual address (relative to the image base) of the section.

Gets or sets the number of bytes the section consists of on disk.

Gets or sets the file offset to the beginning of the section on disk.

Gets or sets the file offset to the beginning of the relocations table for the section.

This field is set to zero in a normal PE image.

Gets or sets the file offset to the beginning of the line numbers table for the section.

This field is set to zero in a normal PE image.

Gets or sets the number of relocations in the relocation table of the section.

This field is set to zero for executable files.

Gets or sets the total amount of line numbers table referenced by for the section.

This field is not used in a normal PE image.

Gets or sets the characteristics of the section.

Reads a single section header at the current position of the provided input stream.

The input stream to read from. The section header that was read.

Determines whether the provided file offset falls within the section that the header describes.

The offset to check. true if the file offset falls within the section, false otherwise.

Determines whether the provided virtual address falls within the section that the header describes.

The virtual address to check. true if the virtual address falls within the section, false otherwise.

Provides members describing all supported subsystems that a portable executable can run in.

Indicates an unknown subsystem.

Indicates device drivers and native Windows processes.

Indicates the Windows graphical user interface subsystem.

Indicates the Windows character subsystem.

Indicates the POSIX character subsystem.

Indicates a native Win9x driver.

Indicates a Windows CE graphical user interface application.

Indicates an extensible firmware interface application.

Indicates an extensible firmware interface driver with boot services.

Indicates an extensible firmware interface driver with run-time services.

Indicates an extensible firmware interface ROM image.

Indicates an XBOX application.

Indicates a Windows boot application.

Provides a writable implementation of the interface.

When this PE file was read from the disk, gets the file path to the PE file.

Gets or sets the DOS header of the PE file.

Gets or sets the COFF file header of the portable executable (PE) file.

Gets or sets the optional header of the portable executable (PE) file.

Gets a collection of sections present in the portable executable (PE) file.

Gets a value indicating the mapping mode of the PE file. If the PE file is in its mapped form, then every offset of all segments in the PE file will be equal to the physical memory address. If the file is in its unmapped form, the offsets will be equal to the file offset.

Gets or sets the padding data in between the last section header and the first section.

Gets or sets the data appended to the end of the file (EoF), if available.

Finds the section containing the provided virtual address.

The virtual address. The section containing the virtual address. Occurs when the virtual address does not fall within any of the sections.

Attempts to find the section containing the provided virtual address.

The virtual address. The section that was found. true if the section was found, false otherwise.

Obtains a reader that spans the provided data directory.

The data directory to read. The reader.

Attempts to create a reader that spans the provided data directory.

The data directory to read. The reader that was created. true if the reader was created successfully, false otherwise.

Creates a new reader at the provided virtual address.

The virtual address to start reading at. The reader.

Attempts to create a new reader at the provided virtual address.

The virtual address to start reading at. The reader that was created. true if the reader was created successfully, false otherwise.

Creates a new reader of a chunk of data at the provided virtual address.

The virtual address to start reading at. The number of bytes in the chunk. The reader.

Attempts to create a new reader of a chunk of data at the provided virtual address.

The virtual address to start reading at. The number of bytes in the chunk. The reader that was created. true if the reader was created successfully, false otherwise.

Creates a new reader at the provided file offset.

The file offset to start reading at. The reader.

Attempts to create a new reader at the provided file offset.

The file offset to start reading at. The reader that was created. true if the reader was created successfully, false otherwise.

Creates a new reader of a chunk of data at the provided file offset.

The file offset to start reading at. The number of bytes in the chunk. The reader.

Attempts to create a new reader of a chunk of data at the provided file offset.

The file offset to start reading at. The number of bytes in the chunk. The reader that was created. true if the reader was created successfully, false otherwise.

Models a file using the portable executable (PE) file format. It provides access to various PE headers, as well as the raw contents of each section present in the file.

Indicates a valid NT header signature.

Creates a new empty portable executable file.

Creates a new portable executable file.

The DOS header to add. The COFF header to add. The optional header to add.

Reads an unmapped PE file from the disk.

The file path to the PE file. The PE file that was read. Occurs when the file does not follow the PE file format.

Reads an unmapped PE file.

The file representing the PE. The PE file that was read. Occurs when the file does not follow the PE file format.

Reads an unmapped PE file from memory.

The raw bytes representing the contents of the PE file to read. The PE file that was read. Occurs when the file does not follow the PE file format.

Reads a mapped PE file starting at the provided module base address (HINSTANCE).

The HINSTANCE or base address of the module. The PE file that was read. Occurs when the file does not follow the PE file format.

Reads a PE file starting at the provided module base address (HINSTANCE).

The HINSTANCE or base address of the module. Indicates how the input PE file is mapped. The PE file that was read. Occurs when the file does not follow the PE file format.

Reads a PE file from the provided data source.

The data source to read from. Indicates how the input PE file is mapped. The PE file that was read. Occurs when the file does not follow the PE file format.

Reads a PE file from the provided input stream.

The input stream to read from. Indicates how the input PE file is mapped. The PE file that was read. Occurs when the file does not follow the PE file format.

Finds the section containing the provided file offset.

The file offset. The section containing the file offset. Occurs when the file offset does not fall within any of the sections.

Attempts to find the section containing the provided file offset.

The file offset. The section that was found. true if the section was found, false otherwise.

Recomputes file offsets and sizes in the file, optional and section headers.

Affected fields in the file header include: SizeOfOptionalHeader Affected fields in the optional header include: SizeOfHeaders SizeOfImage Data directories Affected fields in the section header include: VirtualAddress VirtualSize PointerToRawData SizeOfRawData

Aligns all sections according to the file and section alignment properties in the optional header.

Aligns all data directories' virtual address according to the section header's ones.

Writes the PE file to a file on the disk.

The path of the file.

Writes the PE file to the provided output stream.

The output stream to write to.

Writes the PE file to the provided output stream.

The output stream to write to.

Obtains the sections in the portable executable file.

The section. This method is called upon the initialization of the property.

Obtains the padding data in between the last section header and the first section.

The extra padding data. This method is called upon the initialization of the property.

Obtains any data appended to the end of the file (EoF).

The extra data. This method is called upon the initialization of the property.

Provides members for describing whether a portable executable file is in its mapped or unmapped form.

Indicates the portable executable is in its unmapped form. Every offset in the portable executable refers to a physical file offset as it would appear on disk.

Indicates the portable executable is in its mapped form. Every offset in the portable executable refers to an absolute memory address.

Represents a single section in a portable executable (PE) file.

Creates a new empty section.

The name of the section. The section flags.

Creates a new empty section.

The name of the section. The section flags. The contents of the section.

Copy a new section.

The section to be copied.

Creates a new section with the provided contents.

The header to associate to the section. The contents of the section.

Gets the portable executable file this section is part of.

Gets or sets the name of the section.

The name of the section is a UTF-8 string that can be no longer than 8 characters long.

Gets or sets the characteristics of the section.

Gets or sets a value indicating the section contains executable code.

Gets or sets a value indicating the section contains initialized data.

Gets or sets a value indicating the section contains uninitialized data.

Gets or sets a value indicating the section can be discarded as needed.

Gets or sets a value indicating the section cannot be cached.

Gets or sets a value indicating the section is not pageable.

Gets or sets a value indicating the section can be shared in memory.

Gets or sets a value indicating the section can be executed as code.

Gets or sets a value indicating the section can be read.

Gets or sets a value indicating the section can be written.

Gets or sets the contents of the section.

Gets a value indicating whether the section is readable using a binary stream reader.

Creates a new header for this section.

Determines whether the provided file offset falls within the section that the header describes.

The offset to check. true if the file offset falls within the section, false otherwise.

Determines whether the provided virtual address falls within the section that the header describes.

The virtual address to check. true if the virtual address falls within the section, false otherwise.

Represents a collection of sections stored in a portable executable file.

Creates a new instance of the class.

The owner of the sections.

Gets the PE file containing the sections.

Represents a reference to a segment of a PE file.

Creates a new PE reference.

The underlying PE file. The virtual address of the segment.

Gets a value indicating whether the reference points to a valid section within the PE file.

Provides an implementation of a PE image that gets its data from an input stream.

Reads a PE file from an input stream.

The input stream. Indicates how the input PE file is mapped. Occurs when the input stream is malformed.