From a8db812aa3cc456078d9767fbc90f9e0ec99ebaf Mon Sep 17 00:00:00 2001 From: xeons Date: Mon, 29 Jun 2015 23:14:32 -0500 Subject: [PATCH] Initial commit --- App.ico | Bin 0 -> 1078 bytes AssemblyInfo.cs | 58 ++++++ PEExplorer.cs | 459 +++++++++++++++++++++++++++++++++++++++++ PEExplorer.csproj | 119 +++++++++++ PEExplorer.resx | 426 ++++++++++++++++++++++++++++++++++++++ PEExplorer.sln | 19 ++ PEReader.cs | 513 ++++++++++++++++++++++++++++++++++++++++++++++ 7 files changed, 1594 insertions(+) create mode 100644 App.ico create mode 100644 AssemblyInfo.cs create mode 100644 PEExplorer.cs create mode 100644 PEExplorer.csproj create mode 100644 PEExplorer.resx create mode 100644 PEExplorer.sln create mode 100644 PEReader.cs diff --git a/App.ico b/App.ico new file mode 100644 index 0000000000000000000000000000000000000000..3a5525fd794f7a7c5c8e6187f470ea3af38cd2b6 GIT binary patch literal 1078 zcmeHHJr05}7=1t!Hp3A*8IHkVf+j?-!eHY14Gtcw1Eb*_9>Bq^zETJ@GKj{_2j4$w zo9}xCh!8{T3=X##Skq>ikMjsvB|y%crWBM2iW(4pI}c%z6%lW!=~4v77#3{z!dmB1 z__&l)-{KUYR+|8|;wB^R|9ET$J@(@=#rd^=)qs85?vAy(PSF5CyNkus435LVkZ$rj zNw|JG-P7^hF<(;#o*Vk}5R#e|^13tBbQkeF?djULtvqyxd3<{9 literal 0 HcmV?d00001 diff --git a/AssemblyInfo.cs b/AssemblyInfo.cs new file mode 100644 index 0000000..9f89a32 --- /dev/null +++ b/AssemblyInfo.cs @@ -0,0 +1,58 @@ +using System.Reflection; +using System.Runtime.CompilerServices; + +// +// General Information about an assembly is controlled through the following +// set of attributes. Change these attribute values to modify the information +// associated with an assembly. +// +[assembly: AssemblyTitle("")] +[assembly: AssemblyDescription("")] +[assembly: AssemblyConfiguration("")] +[assembly: AssemblyCompany("")] +[assembly: AssemblyProduct("")] +[assembly: AssemblyCopyright("")] +[assembly: AssemblyTrademark("")] +[assembly: AssemblyCulture("")] + +// +// Version information for an assembly consists of the following four values: +// +// Major Version +// Minor Version +// Build Number +// Revision +// +// You can specify all the values or you can default the Revision and Build Numbers +// by using the '*' as shown below: + +[assembly: AssemblyVersion("1.0.*")] + +// +// In order to sign your assembly you must specify a key to use. Refer to the +// Microsoft .NET Framework documentation for more information on assembly signing. +// +// Use the attributes below to control which key is used for signing. +// +// Notes: +// (*) If no key is specified, the assembly is not signed. +// (*) KeyName refers to a key that has been installed in the Crypto Service +// Provider (CSP) on your machine. KeyFile refers to a file which contains +// a key. +// (*) If the KeyFile and the KeyName values are both specified, the +// following processing occurs: +// (1) If the KeyName can be found in the CSP, that key is used. +// (2) If the KeyName does not exist and the KeyFile does exist, the key +// in the KeyFile is installed into the CSP and used. +// (*) In order to create a KeyFile, you can use the sn.exe (Strong Name) utility. +// When specifying the KeyFile, the location of the KeyFile should be +// relative to the project output directory which is +// %Project Directory%\obj\. For example, if your KeyFile is +// located in the project directory, you would specify the AssemblyKeyFile +// attribute as [assembly: AssemblyKeyFile("..\\..\\mykey.snk")] +// (*) Delay Signing is an advanced option - see the Microsoft .NET Framework +// documentation for more information on this. +// +[assembly: AssemblyDelaySign(false)] +[assembly: AssemblyKeyFile("")] +[assembly: AssemblyKeyName("")] diff --git a/PEExplorer.cs b/PEExplorer.cs new file mode 100644 index 0000000..0707d6c --- /dev/null +++ b/PEExplorer.cs @@ -0,0 +1,459 @@ +using System; +using System.Drawing; +using System.Collections; +using System.ComponentModel; +using System.Windows.Forms; +using System.Data; +using System.IO; + +namespace PEReader +{ + /// + /// Summary description for Form1. + /// + public class PEExplorer : System.Windows.Forms.Form + { + private System.Windows.Forms.ListView listView1; + private System.Windows.Forms.ColumnHeader columnHeader1; + private System.Windows.Forms.ColumnHeader columnHeader2; + private System.Windows.Forms.TabPage headersTab; + private System.Windows.Forms.TabPage directoriesTab; + private System.Windows.Forms.ListView listView2; + private System.Windows.Forms.ColumnHeader columnHeader5; + private System.Windows.Forms.ColumnHeader columnHeader6; + private System.Windows.Forms.ColumnHeader columnHeader7; + private System.Windows.Forms.ColumnHeader columnHeader3; + private System.Windows.Forms.TabControl sectionTabs; + private System.Windows.Forms.TabPage sectionHeadersTab; + private System.Windows.Forms.ListView listView3; + private System.Windows.Forms.ColumnHeader columnHeader11; + private System.Windows.Forms.ColumnHeader columnHeader13; + private System.Windows.Forms.ColumnHeader columnHeader14; + private System.Windows.Forms.MainMenu mainMenu1; + private System.Windows.Forms.MenuItem menuItem1; + private System.Windows.Forms.MenuItem menuItem2; + private System.Windows.Forms.MenuItem menuItem3; + private System.Windows.Forms.MenuItem menuItem4; + private System.Windows.Forms.MenuItem menuItem5; + private System.Windows.Forms.ColumnHeader columnHeader4; + private System.Windows.Forms.ColumnHeader columnHeader8; + private System.Windows.Forms.OpenFileDialog openFileDialog1; + private System.Windows.Forms.SaveFileDialog saveFileDialog1; + /// + /// Required designer variable. + /// + private System.ComponentModel.Container components = null; + + // Create PE Reader Class + PEReader pr = new PEReader(); + + public PEExplorer() + { + // + // Required for Windows Form Designer support + // + InitializeComponent(); + + // + // TODO: Add any constructor code after InitializeComponent call + // + } + + /// + /// Clean up any resources being used. + /// + protected override void Dispose( bool disposing ) + { + if( disposing ) + { + if (components != null) + { + components.Dispose(); + } + } + base.Dispose( disposing ); + } + + #region Windows Form Designer generated code + /// + /// Required method for Designer support - do not modify + /// the contents of this method with the code editor. + /// + private void InitializeComponent() + { + System.Resources.ResourceManager resources = new System.Resources.ResourceManager(typeof(PEExplorer)); + this.listView1 = new System.Windows.Forms.ListView(); + this.columnHeader1 = new System.Windows.Forms.ColumnHeader(); + this.columnHeader2 = new System.Windows.Forms.ColumnHeader(); + this.sectionTabs = new System.Windows.Forms.TabControl(); + this.headersTab = new System.Windows.Forms.TabPage(); + this.directoriesTab = new System.Windows.Forms.TabPage(); + this.listView2 = new System.Windows.Forms.ListView(); + this.columnHeader5 = new System.Windows.Forms.ColumnHeader(); + this.columnHeader6 = new System.Windows.Forms.ColumnHeader(); + this.columnHeader7 = new System.Windows.Forms.ColumnHeader(); + this.columnHeader3 = new System.Windows.Forms.ColumnHeader(); + this.sectionHeadersTab = new System.Windows.Forms.TabPage(); + this.listView3 = new System.Windows.Forms.ListView(); + this.columnHeader11 = new System.Windows.Forms.ColumnHeader(); + this.columnHeader13 = new System.Windows.Forms.ColumnHeader(); + this.columnHeader14 = new System.Windows.Forms.ColumnHeader(); + this.columnHeader4 = new System.Windows.Forms.ColumnHeader(); + this.columnHeader8 = new System.Windows.Forms.ColumnHeader(); + this.mainMenu1 = new System.Windows.Forms.MainMenu(); + this.menuItem1 = new System.Windows.Forms.MenuItem(); + this.menuItem2 = new System.Windows.Forms.MenuItem(); + this.menuItem3 = new System.Windows.Forms.MenuItem(); + this.menuItem4 = new System.Windows.Forms.MenuItem(); + this.menuItem5 = new System.Windows.Forms.MenuItem(); + this.openFileDialog1 = new System.Windows.Forms.OpenFileDialog(); + this.saveFileDialog1 = new System.Windows.Forms.SaveFileDialog(); + this.sectionTabs.SuspendLayout(); + this.headersTab.SuspendLayout(); + this.directoriesTab.SuspendLayout(); + this.sectionHeadersTab.SuspendLayout(); + this.SuspendLayout(); + // + // listView1 + // + this.listView1.Anchor = ((System.Windows.Forms.AnchorStyles)((((System.Windows.Forms.AnchorStyles.Top | System.Windows.Forms.AnchorStyles.Bottom) + | System.Windows.Forms.AnchorStyles.Left) + | System.Windows.Forms.AnchorStyles.Right))); + this.listView1.Columns.AddRange(new System.Windows.Forms.ColumnHeader[] { + this.columnHeader1, + this.columnHeader2}); + this.listView1.FullRowSelect = true; + this.listView1.HeaderStyle = System.Windows.Forms.ColumnHeaderStyle.Nonclickable; + this.listView1.Location = new System.Drawing.Point(8, 8); + this.listView1.Name = "listView1"; + this.listView1.Size = new System.Drawing.Size(440, 328); + this.listView1.TabIndex = 2; + this.listView1.View = System.Windows.Forms.View.Details; + // + // columnHeader1 + // + this.columnHeader1.Text = "Property Name"; + this.columnHeader1.Width = 229; + // + // columnHeader2 + // + this.columnHeader2.Text = "Value"; + this.columnHeader2.Width = 180; + // + // sectionTabs + // + this.sectionTabs.Anchor = ((System.Windows.Forms.AnchorStyles)((((System.Windows.Forms.AnchorStyles.Top | System.Windows.Forms.AnchorStyles.Bottom) + | System.Windows.Forms.AnchorStyles.Left) + | System.Windows.Forms.AnchorStyles.Right))); + this.sectionTabs.Controls.Add(this.headersTab); + this.sectionTabs.Controls.Add(this.directoriesTab); + this.sectionTabs.Controls.Add(this.sectionHeadersTab); + this.sectionTabs.Location = new System.Drawing.Point(8, 8); + this.sectionTabs.Name = "sectionTabs"; + this.sectionTabs.SelectedIndex = 0; + this.sectionTabs.Size = new System.Drawing.Size(464, 368); + this.sectionTabs.TabIndex = 3; + // + // headersTab + // + this.headersTab.Controls.Add(this.listView1); + this.headersTab.Location = new System.Drawing.Point(4, 22); + this.headersTab.Name = "headersTab"; + this.headersTab.Size = new System.Drawing.Size(456, 342); + this.headersTab.TabIndex = 0; + this.headersTab.Text = "Headers"; + // + // directoriesTab + // + this.directoriesTab.Controls.Add(this.listView2); + this.directoriesTab.Location = new System.Drawing.Point(4, 22); + this.directoriesTab.Name = "directoriesTab"; + this.directoriesTab.Size = new System.Drawing.Size(456, 342); + this.directoriesTab.TabIndex = 1; + this.directoriesTab.Text = "Directories"; + // + // listView2 + // + this.listView2.Anchor = ((System.Windows.Forms.AnchorStyles)((((System.Windows.Forms.AnchorStyles.Top | System.Windows.Forms.AnchorStyles.Bottom) + | System.Windows.Forms.AnchorStyles.Left) + | System.Windows.Forms.AnchorStyles.Right))); + this.listView2.Columns.AddRange(new System.Windows.Forms.ColumnHeader[] { + this.columnHeader5, + this.columnHeader6, + this.columnHeader7, + this.columnHeader3}); + this.listView2.FullRowSelect = true; + this.listView2.HeaderStyle = System.Windows.Forms.ColumnHeaderStyle.Nonclickable; + this.listView2.Location = new System.Drawing.Point(8, 8); + this.listView2.MultiSelect = false; + this.listView2.Name = "listView2"; + this.listView2.Size = new System.Drawing.Size(440, 328); + this.listView2.TabIndex = 3; + this.listView2.View = System.Windows.Forms.View.Details; + // + // columnHeader5 + // + this.columnHeader5.Text = "Type"; + this.columnHeader5.Width = 173; + // + // columnHeader6 + // + this.columnHeader6.Text = "Virtual Address"; + this.columnHeader6.Width = 89; + // + // columnHeader7 + // + this.columnHeader7.Text = "Size"; + this.columnHeader7.Width = 84; + // + // columnHeader3 + // + this.columnHeader3.Text = "Present"; + // + // sectionHeadersTab + // + this.sectionHeadersTab.Controls.Add(this.listView3); + this.sectionHeadersTab.Location = new System.Drawing.Point(4, 22); + this.sectionHeadersTab.Name = "sectionHeadersTab"; + this.sectionHeadersTab.Size = new System.Drawing.Size(456, 342); + this.sectionHeadersTab.TabIndex = 2; + this.sectionHeadersTab.Text = "Section Headers"; + // + // listView3 + // + this.listView3.Anchor = ((System.Windows.Forms.AnchorStyles)((((System.Windows.Forms.AnchorStyles.Top | System.Windows.Forms.AnchorStyles.Bottom) + | System.Windows.Forms.AnchorStyles.Left) + | System.Windows.Forms.AnchorStyles.Right))); + this.listView3.Columns.AddRange(new System.Windows.Forms.ColumnHeader[] { + this.columnHeader11, + this.columnHeader13, + this.columnHeader14, + this.columnHeader4, + this.columnHeader8}); + this.listView3.FullRowSelect = true; + this.listView3.HeaderStyle = System.Windows.Forms.ColumnHeaderStyle.Nonclickable; + this.listView3.Location = new System.Drawing.Point(8, 7); + this.listView3.MultiSelect = false; + this.listView3.Name = "listView3"; + this.listView3.Size = new System.Drawing.Size(440, 328); + this.listView3.TabIndex = 4; + this.listView3.View = System.Windows.Forms.View.Details; + // + // columnHeader11 + // + this.columnHeader11.Text = "Name"; + this.columnHeader11.Width = 70; + // + // columnHeader13 + // + this.columnHeader13.Text = "Virtual Address"; + this.columnHeader13.Width = 88; + // + // columnHeader14 + // + this.columnHeader14.Text = "Virtual Size"; + this.columnHeader14.Width = 69; + // + // columnHeader4 + // + this.columnHeader4.Text = "Raw Data Pointer"; + this.columnHeader4.Width = 100; + // + // columnHeader8 + // + this.columnHeader8.Text = "Raw Data Size"; + this.columnHeader8.Width = 84; + // + // mainMenu1 + // + this.mainMenu1.MenuItems.AddRange(new System.Windows.Forms.MenuItem[] { + this.menuItem1}); + // + // menuItem1 + // + this.menuItem1.Index = 0; + this.menuItem1.MenuItems.AddRange(new System.Windows.Forms.MenuItem[] { + this.menuItem2, + this.menuItem3, + this.menuItem4, + this.menuItem5}); + this.menuItem1.Text = "File"; + // + // menuItem2 + // + this.menuItem2.Index = 0; + this.menuItem2.Text = "Open EXE..."; + this.menuItem2.Click += new System.EventHandler(this.menuItem2_Click); + // + // menuItem3 + // + this.menuItem3.Index = 1; + this.menuItem3.Text = "Close"; + this.menuItem3.Click += new System.EventHandler(this.menuItem3_Click); + // + // menuItem4 + // + this.menuItem4.Index = 2; + this.menuItem4.Text = "-"; + // + // menuItem5 + // + this.menuItem5.Index = 3; + this.menuItem5.Text = "Exit"; + this.menuItem5.Click += new System.EventHandler(this.menuItem5_Click); + // + // openFileDialog1 + // + this.openFileDialog1.Filter = "Executable Files|*.exe|All Files|*.*"; + this.openFileDialog1.Title = "Open Executable File"; + // + // PEExplorer + // + this.AutoScaleBaseSize = new System.Drawing.Size(5, 14); + this.ClientSize = new System.Drawing.Size(480, 385); + this.Controls.Add(this.sectionTabs); + this.Font = new System.Drawing.Font("Tahoma", 8.25F, System.Drawing.FontStyle.Regular, System.Drawing.GraphicsUnit.Point, ((System.Byte)(0))); + this.Icon = ((System.Drawing.Icon)(resources.GetObject("$this.Icon"))); + this.Menu = this.mainMenu1; + this.Name = "PEExplorer"; + this.Text = "PE Explorer Sample Application"; + this.Load += new System.EventHandler(this.Form1_Load); + this.sectionTabs.ResumeLayout(false); + this.headersTab.ResumeLayout(false); + this.directoriesTab.ResumeLayout(false); + this.sectionHeadersTab.ResumeLayout(false); + this.ResumeLayout(false); + + } + #endregion + + /// + /// The main entry point for the application. + /// + [STAThread] + static void Main() + { + Application.Run(new PEExplorer()); + } + + private void button1_Click(object sender, System.EventArgs e) + { + + } + + private void Form1_Load(object sender, System.EventArgs e) + { + + } + + private void AddHeaderInformation(string name, string value) + { + ListViewItem lvi = listView1.Items.Add(name); + lvi.SubItems.Add(value); + } + + private void AddDirectoryInfo(string type, uint virtualAddress, uint size) + { + ListViewItem lvi = listView2.Items.Add(type); + lvi.SubItems.Add(string.Format("{0:X8}", virtualAddress)); + lvi.SubItems.Add(string.Format("{0:X8}", size)); + lvi.SubItems.Add((virtualAddress > 0 ? "Yes" : "No")); + } + + private void AddSectionHeaderInfo(string name, uint physicalAddress, uint virtualAddress, uint virtualSize, uint rawDataPointer, uint rawDataSize) + { + ListViewItem lvi = listView3.Items.Add(name); + lvi.SubItems.Add(string.Format("{0:X8}", virtualAddress)); + lvi.SubItems.Add(string.Format("{0:X8}", virtualSize)); + lvi.SubItems.Add(string.Format("{0:X8}", rawDataPointer)); + lvi.SubItems.Add(string.Format("{0:X8}", rawDataSize)); + } + + private void menuItem2_Click(object sender, System.EventArgs e) + { + openFileDialog1.ShowDialog(); + if(openFileDialog1.FileName.Length > 0) + { + pr.LoadExecutable(openFileDialog1.FileName); + + listView1.Items.Clear(); + listView2.Items.Clear(); + listView3.Items.Clear(); + + AddHeaderInformation("DOS Header Information", String.Empty); + AddHeaderInformation("Magic", pr.DOSHeader.Magic.ToString()); + AddHeaderInformation("Size of Last Page", pr.DOSHeader.SizeOfLastPage.ToString()); + AddHeaderInformation("Number of Pages", pr.DOSHeader.NumberOfPages.ToString()); + AddHeaderInformation("Relocations", pr.DOSHeader.Relocations.ToString()); + AddHeaderInformation("Size of Header", pr.DOSHeader.SizeOfHeader.ToString()); + AddHeaderInformation("Minimum Extra Paragraphs", pr.DOSHeader.MinimumExtraParagraphs.ToString()); + AddHeaderInformation("Maximum Extra Paragraphs", pr.DOSHeader.MaximumExtraParagraphs.ToString()); + AddHeaderInformation("Initial SS Value", pr.DOSHeader.InitialSSValue.ToString()); + AddHeaderInformation("Initial SP Value", pr.DOSHeader.InitialSPValue.ToString()); + AddHeaderInformation("Checksum", pr.DOSHeader.Checksum.ToString()); + AddHeaderInformation("Initial IP Value", pr.DOSHeader.InitialIPValue.ToString()); + AddHeaderInformation("Initial CS Value", pr.DOSHeader.InitialCSValue.ToString()); + AddHeaderInformation("Relocation Table Address", pr.DOSHeader.RelocationTableAddress.ToString()); + AddHeaderInformation("Overlay Number", pr.DOSHeader.OverlayNumber.ToString()); + AddHeaderInformation("OEM Identifier", pr.DOSHeader.OemIdentifier.ToString()); + AddHeaderInformation("OEM Information", pr.DOSHeader.OemInformation.ToString()); + AddHeaderInformation("PE Header Offset", pr.DOSHeader.PEHeaderAddress.ToString()); + AddHeaderInformation(String.Empty, String.Empty); + + AddHeaderInformation("PE Header Information", String.Empty); + AddHeaderInformation("Magic", String.Format("{0:X4}", pr.PEHeader.Magic)); + AddHeaderInformation("Major Linker Version", pr.PEHeader.MajorLinkerVersion.ToString()); + AddHeaderInformation("Minor Linker Version", pr.PEHeader.MinorLinkerVersion.ToString()); + AddHeaderInformation("Size of Code", pr.PEHeader.SizeOfCode.ToString()); + AddHeaderInformation("Size Of Initialized Data", pr.PEHeader.SizeOfInitializedData.ToString()); + AddHeaderInformation("Size Of Uninitialized Data", pr.PEHeader.SizeOfUninitializedData.ToString()); + AddHeaderInformation("Address Of Entry Point", pr.PEHeader.AddressOfEntryPoint.ToString()); + AddHeaderInformation("Base Of Code", pr.PEHeader.BaseOfCode.ToString()); + AddHeaderInformation("Base Of Data", pr.PEHeader.BaseOfData.ToString()); + AddHeaderInformation("Image Base", pr.PEHeader.ImageBase.ToString()); + AddHeaderInformation("Section Alignment", pr.PEHeader.SectionAlignment.ToString()); + AddHeaderInformation("File Alignment", pr.PEHeader.FileAlignment.ToString()); + AddHeaderInformation("Major Operating System Version", pr.PEHeader.MajorOperatingSystemVersion.ToString()); + AddHeaderInformation("Minor Operating System Version", pr.PEHeader.MinorOperatingSystemVersion.ToString()); + AddHeaderInformation("Major Image Version", pr.PEHeader.MajorImageVersion.ToString()); + AddHeaderInformation("Minor Image Version", pr.PEHeader.MinorImageVersion.ToString()); + AddHeaderInformation("Major Subsystem Version", pr.PEHeader.MajorSubsystemVersion.ToString()); + AddHeaderInformation("Minor Subsystem Version", pr.PEHeader.MinorSubsystemVersion.ToString()); + AddHeaderInformation("Win32 Version Value", pr.PEHeader.Win32VersionValue.ToString()); + AddHeaderInformation("Size Of Image", pr.PEHeader.SizeOfImage.ToString()); + AddHeaderInformation("Size Of Headers", pr.PEHeader.SizeOfHeaders.ToString()); + AddHeaderInformation("CheckSum", pr.PEHeader.CheckSum.ToString()); + AddHeaderInformation("Subsystem", pr.PEHeader.Subsystem.ToString()); + AddHeaderInformation("DLL Characteristics", pr.PEHeader.DllCharacteristics.ToString()); + AddHeaderInformation("Size Of Stack Reserve", pr.PEHeader.SizeOfStackReserve.ToString()); + AddHeaderInformation("Size Of Stack Commit", pr.PEHeader.SizeOfStackCommit.ToString()); + AddHeaderInformation("Size Of Heap Reserve", pr.PEHeader.SizeOfHeapReserve.ToString()); + AddHeaderInformation("Size Of Heap Commit", pr.PEHeader.SizeOfHeapCommit.ToString()); + AddHeaderInformation("Loader Flags", pr.PEHeader.LoaderFlags.ToString()); + AddHeaderInformation("Number Of Data Directories", pr.PEHeader.NumberOfRvaAndSizes.ToString()); + + // Fill the directories list + for(int i = 0; i < 16; i++) + AddDirectoryInfo(pr.DataDirectories[i].Type, pr.DataDirectories[i].VirtualAddress, pr.DataDirectories[i].Size); + + // Fill the directories list + for(int i = 0; i < pr.SectionHeaders.Length; i++) + AddSectionHeaderInfo( pr.SectionHeaders[i].Name, pr.SectionHeaders[i].PhysicalAddress, pr.SectionHeaders[i].VirtualAddress, pr.SectionHeaders[i].VirtualSize, pr.SectionHeaders[i].PointerToRawData, pr.SectionHeaders[i].SizeOfRawData); + + //FileStream fs = new FileStream(Application.ExecutablePath.Replace("PEReader.exe", "rsrc.bin"),FileMode.Create, FileAccess.ReadWrite, FileShare.ReadWrite); + //byte[] resourceData = pr.GetSectionDataByName(".rsrc"); + //fs.Write(resourceData, 0, resourceData.Length); + } + } + + private void menuItem3_Click(object sender, System.EventArgs e) + { + pr.CloseExecutable(); + } + + private void menuItem5_Click(object sender, System.EventArgs e) + { + Application.Exit(); + } + } +} diff --git a/PEExplorer.csproj b/PEExplorer.csproj new file mode 100644 index 0000000..3b7aeee --- /dev/null +++ b/PEExplorer.csproj @@ -0,0 +1,119 @@ + + + + Local + 8.0.21022 + 2.0 + {A053AAA8-6752-4753-AC81-C8DBFE1EFA73} + Debug + AnyCPU + App.ico + + + PEReader + + + JScript + Grid + IE50 + false + WinExe + PEReader + OnBuildSuccess + + + + + + + 3.5 + v2.0 + + + bin\Debug\ + false + 285212672 + false + + + DEBUG;TRACE + + + true + 4096 + false + + + false + false + false + false + 4 + full + prompt + AllRules.ruleset + + + bin\Release\ + false + 285212672 + false + + + TRACE + + + false + 4096 + false + + + true + false + false + false + 4 + none + prompt + AllRules.ruleset + + + + System + + + System.Data + + + System.Drawing + + + System.Windows.Forms + + + System.XML + + + + + + Code + + + Form + + + Code + + + PEExplorer.cs + + + + + + + + + + \ No newline at end of file diff --git a/PEExplorer.resx b/PEExplorer.resx new file mode 100644 index 0000000..2567935 --- /dev/null +++ b/PEExplorer.resx @@ -0,0 +1,426 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + text/microsoft-resx + + + 1.3 + + + System.Resources.ResXResourceReader, System.Windows.Forms, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + + + System.Resources.ResXResourceWriter, System.Windows.Forms, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + + + False + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + True + + + False + + + True + + + Private + + + Private + + + 8, 8 + + + False + + + True + + + True + + + Private + + + Private + + + 8, 8 + + + False + + + True + + + True + + + Private + + + Private + + + 8, 8 + + + False + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + False + + + True + + + True + + + Private + + + Private + + + 8, 8 + + + False + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + 17, 17 + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + Private + + + 126, 17 + + + Private + + + Private + + + 256, 17 + + + False + + + (Default) + + + False + + + False + + + 8, 8 + + + PEExplorer + + + True + + + 80 + + + True + + + Private + + + + AAABAAIAEBAAAAAAAABoAwAAJgAAACAgAAAAAAAAqAwAAI4DAAAoAAAAEAAAACAAAAABABgAAAAAAEAD + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAASkpKSkpKAAAA5ubmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAASkpK + SkpKSkpKAAAA5ubmqqqqenp6AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAASkpKSkpKSkpKAAAAqqqq + MjIyMjIyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5ubmAAAASkpKSkpKSkpKSkpK + SkpKSkpKwsLCAAAAAAAAAAAAAAAAAAAAAAAAAAAA5ubmqqqqPj4+3JIAwsLCSkpKANzcSkpKSkpKAAAA + AAAAAAAAAAAAAAAAAAAA5ubm5ubm5ubmAAAA/7hI/6oAPj4+AP7+AP7+SkpKwsLCAAAAAAAAAAAAAAAA + AAAA5ubm5ubm5ubmqqqqJiYmMjIyMjIyMjIyMjIyPj4+Pj4+AAAAAAAAAAAAAAAA5ubm5ubm5ubm5ubm + 5ubmAAAAa2v/wsLCMjIyANySkpKSMjIywsLCAAAAAAAAAAAA5ubm5ubm5ubm5ubm5ubmqqqqJiYma2v/ + a2v/JiYmANySAJZiJiYmAAAAAAAA5ubm5ubm5ubm5ubm5ubm5ubm5ubmAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAA5ubm5ubm5ubm5ubm5ubm5ubm5ubmqqqqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 5ubm5ubm5ubm5ubm5ubm5ubmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5ubm5ubm + 5ubm5ubmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5ubmAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAA+f///+D///+Af///gAf//+AD///gA///wAH//8AB//+AAP//gAD//wAB//8AP///gH///8B/ + ///w/////f///ygAAAAgAAAAQAAAAAEAGAAAAAAAgAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABKSkpKSkoAAADm + 5ubm5uYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAABKSkpKSkpKSkpKSkoAAADm5ubm5ubm5uYAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABKSkpKSkpKSkpK + SkpKSkoAAADm5ubm5ubm5ubm5uaqqqoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAABKSkpKSkpKSkpKSkpKSkpKSkpKSkoAAADm5ubm5ubm5uaqqqqSkpJ6 + enoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABKSkpKSkpK + SkpKSkpKSkpKSkpKSkoAAADm5ubm5ubm5uaqqqqSkpJ6enp6enp6enoAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABKSkpKSkpKSkpKSkpKSkpKSkoAAADm5ubm5uaq + qqoyMjIyMjIyMjIyMjIyMjIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAABKSkpKSkpKSkoAAADm5ubm5ubm5uYAAACqqqqqqqqqqqqqqqqqqqqqqqqqqqqq + qqqqqqqqqqqqqqqqqqqqqqqqqqoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABKSkoA + AADm5ubm5ubm5uYAAABKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkrCwsIAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADm5ubm5ubm5ubm5uYAAAA+Pj5KSkr/qgDc + kgDCwsLCwsJKSkpKSkoA/v4A3NySkpJKSkpKSkpubm7CwsIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAADm5ubm5ubm5ubm5uaqqqoAAAA+Pj7/uEjckgDCwsLCwsI+Pj5KSkoA/v4A3NySkpJK + SkpKSkpKSkrCwsIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADm5ubm5ubm5ubm5ubm5ubm + 5uYAAAAyMjK5egD/qgDckgDckgC5egA+Pj4AlpYA/v4A3NwA3NwAublKSkpubm7CwsIAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAADm5ubm5ubm5ubm5ubm5ubm5uaqqqoAAAAyMjL/uEj/uEj/qgD/qgA+ + Pj4+Pj4A/v4A/v4A/v4AublKSkpKSkrCwsIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADm5ubm5ubm + 5ubm5ubm5ubm5ubm5ubm5uYAAAAyMjIyMjIyMjIyMjIyMjIyMjIyMjI+Pj4+Pj4+Pj4+Pj5KSkpKSkpu + bm7CwsIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5uaqqqoAAAAm + JiYyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjI+Pj4+Pj4+Pj4+Pj7CwsIAAAAAAAAAAAAAAAAAAAAAAAAA + AADm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5uYAAAAmJiYmJiZra/8AAP7CwsLCwsIyMjIyMjIA + 3JIAuXqSkpJKSkoyMjJubm7CwsIAAAAAAAAAAAAAAAAAAAAAAADm5ubm5ubm5ubm5ubm5ubm5ubm5ubm + 5ubm5ubm5uaqqqoAAAAmJiZra/8AAP7CwsLCwsIyMjIyMjIA3JIAuXqSkpJKSkoyMjIyMjLCwsIAAAAA + AAAAAAAAAAAAAADm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5uYAAAAmJiYAAJZra/8A + AP4AAP4AALkmJiYAc0oA3JIAuXoAuXoAlmIyMjJubm7CwsIAAAAAAAAAAAAAAADm5ubm5ubm5ubm5ubm + 5ubm5ubm5ubm5ubm5ubm5ubm5ubm5uaqqqoAAAAmJiZra/9ra/9ra/9ra/8mJiYmJiYA3JIA3JIA3JIA + lmImJiYmJibCwsIAAAAAAAAAAADm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm + 5uYAAAAmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiZubm4AAAAAAAAAAADm5ubm + 5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5uaqqqoAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm + 5ubm5ubm5ubm5ubm5ubm5uaqqqoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAADm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5uaqqqoAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADm5ubm5ubm5ubm5ubm + 5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5uYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm + 5ubm5uYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAADm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5uYAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADm5ubm5ubm + 5ubm5ubm5ubm5ubm5uYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADm5ubm5ubm5ubm5uYAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAADm5ubm5uYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + AAD/5////wP///wB///wAP//wAB//4AAP//AAAA/8AAAH/wAAB/8AAAP/AAAD/gAAAf4AAAH8AAAA/AA + AAPgAAAB4AAAAcAAAADAAAAAgAAAAIAAAAEAAB//AAAf/4AAP//gAD//+AB///4Af///gP///+D////5 + /////////////w== + + + \ No newline at end of file diff --git a/PEExplorer.sln b/PEExplorer.sln new file mode 100644 index 0000000..21c83a6 --- /dev/null +++ b/PEExplorer.sln @@ -0,0 +1,19 @@ +Microsoft Visual Studio Solution File, Format Version 11.00 +# Visual Studio 2010 +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PEExplorer", "PEExplorer.csproj", "{A053AAA8-6752-4753-AC81-C8DBFE1EFA73}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Any CPU = Debug|Any CPU + Release|Any CPU = Release|Any CPU + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {A053AAA8-6752-4753-AC81-C8DBFE1EFA73}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {A053AAA8-6752-4753-AC81-C8DBFE1EFA73}.Debug|Any CPU.Build.0 = Debug|Any CPU + {A053AAA8-6752-4753-AC81-C8DBFE1EFA73}.Release|Any CPU.ActiveCfg = Release|Any CPU + {A053AAA8-6752-4753-AC81-C8DBFE1EFA73}.Release|Any CPU.Build.0 = Release|Any CPU + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/PEReader.cs b/PEReader.cs new file mode 100644 index 0000000..afc1cea --- /dev/null +++ b/PEReader.cs @@ -0,0 +1,513 @@ +// Coded by Brandon Scott +// Version 0.01a +// +// Probely some room for improvement, this is just the first release though. +// +// A very valuable resource for the PE file structure is located +// below. +// http://www.csn.ul.ie/~caolan/publink/winresdump/winresdump/doc/pefile.html +// +// If you do use this for something, please give me some credit. +// +// Eventually I want to have this thing read Resource Data, and maby +// detect some of the common packers such as UPX. + +using System; +using System.Runtime.InteropServices; +using System.IO; +using System.Text; + +namespace PEReader +{ + /// + /// Written to make reading the information from a PE (Portable Executable) + /// easier and simple. + /// + public class PEReader + { + #region Subsystem Values + public const uint IMAGE_SUBSYSTEM_UNKNOWN = 0; // Unknown subsystem. + public const uint IMAGE_SUBSYSTEM_NATIVE = 1; // Image doesn't require a subsystem. + public const uint IMAGE_SUBSYSTEM_WINDOWS_GUI = 2; // Image runs in the Windows GUI subsystem. + public const uint IMAGE_SUBSYSTEM_WINDOWS_CUI = 3; // Image runs in the Windows character subsystem. + public const uint IMAGE_SUBSYSTEM_OS2_CUI = 5; // image runs in the OS/2 character subsystem. + public const uint IMAGE_SUBSYSTEM_POSIX_CUI = 7; // image runs in the Posix character subsystem. + public const uint IMAGE_SUBSYSTEM_NATIVE_WINDOWS = 8; // image is a native Win9x driver. + public const uint IMAGE_SUBSYSTEM_WINDOWS_CE_GUI = 9; // Image runs in the Windows CE subsystem. + public const uint IMAGE_SUBSYSTEM_EFI_APPLICATION = 10; // + public const uint IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER = 11; // + public const uint IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER = 12; // + public const uint IMAGE_SUBSYSTEM_EFI_ROM = 13; + public const uint IMAGE_SUBSYSTEM_XBOX = 14; + #endregion + + #region DllCharacteristics Entries + public const uint IMAGE_DLLCHARACTERISTICS_NO_SEH = 0x0400; // Image does not use SEH. No SE handler may reside in this image + public const uint IMAGE_DLLCHARACTERISTICS_NO_BIND = 0x0800; // Do not bind this image. + public const uint IMAGE_DLLCHARACTERISTICS_WDM_DRIVER = 0x2000; // Driver uses WDM model + public const uint IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = 0x8000; + #endregion + + #region DOS header format + public struct IMAGE_DOS_HEADER + { + public ushort Magic; + public ushort SizeOfLastPage; + public ushort NumberOfPages; + public ushort Relocations; + public ushort SizeOfHeader; + public ushort MinimumExtraParagraphs; + public ushort MaximumExtraParagraphs; + public ushort InitialSSValue; + public ushort InitialSPValue; + public ushort Checksum; + public ushort InitialIPValue; + public ushort InitialCSValue; + public ushort RelocationTableAddress; + public ushort OverlayNumber; + //[MarshalAs(UnmanagedType.U2, SizeConst=8)] + //public ushort[] ReservedWords; + public ushort OemIdentifier; + public ushort OemInformation; + //[MarshalAs(UnmanagedType.U2, SizeConst=20)] + //public ushort[] ReservedWords2; + public uint PEHeaderAddress; + } + #endregion + #region File header format + public const int IMAGE_SIZEOF_FILE_HEADER = 20; + public struct IMAGE_FILE_HEADER + { + public ushort Machine; + public ushort NumberOfSections; + public uint TimeDateStamp; + public uint PointerToSymbolTable; + public uint NumberOfSymbols; + public ushort SizeOfOptionalHeader; + public ushort Characteristics; + } + public const ushort IMAGE_FILE_RELOCS_STRIPPED = 0x0001; // Relocation info stripped from file. + public const ushort IMAGE_FILE_EXECUTABLE_IMAGE = 0x0002; // File is executable (i.e. no unresolved externel references). + public const ushort IMAGE_FILE_LINE_NUMS_STRIPPED = 0x0004; // Line nunbers stripped from file. + public const ushort IMAGE_FILE_LOCAL_SYMS_STRIPPED = 0x0008; // Local symbols stripped from file. + public const ushort IMAGE_FILE_AGGRESIVE_WS_TRIM = 0x0010; // Agressively trim working set + public const ushort IMAGE_FILE_LARGE_ADDRESS_AWARE = 0x0020; // App can handle >2gb addresses + public const ushort IMAGE_FILE_BYTES_REVERSED_LO = 0x0080; // Bytes of machine word are reversed. + public const ushort IMAGE_FILE_32BIT_MACHINE = 0x0100; // 32 bit word machine. + public const ushort IMAGE_FILE_DEBUG_STRIPPED = 0x0200; // Debugging info stripped from file in .DBG file + public const ushort IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP = 0x0400; // If Image is on removable media, copy and run from the swap file. + public const ushort IMAGE_FILE_NET_RUN_FROM_SWAP = 0x0800; // If Image is on Net, copy and run from the swap file. + public const ushort IMAGE_FILE_SYSTEM = 0x1000; // System File. + public const ushort IMAGE_FILE_DLL = 0x2000; // File is a DLL. + public const ushort IMAGE_FILE_UP_SYSTEM_ONLY = 0x4000; // File should only be run on a UP machine + public const ushort IMAGE_FILE_BYTES_REVERSED_HI = 0x8000; // Bytes of machine word are reversed. + + public const ushort IMAGE_FILE_MACHINE_UNKNOWN = 0; + public const ushort IMAGE_FILE_MACHINE_I386 = 0x014c; // Intel 386. + public const ushort IMAGE_FILE_MACHINE_R3000 = 0x0162; // MIPS little-endian, 0x160 big-endian + public const ushort IMAGE_FILE_MACHINE_R4000 = 0x0166; // MIPS little-endian + public const ushort IMAGE_FILE_MACHINE_R10000 = 0x0168; // MIPS little-endian + public const ushort IMAGE_FILE_MACHINE_WCEMIPSV2 = 0x0169; // MIPS little-endian WCE v2 + public const ushort IMAGE_FILE_MACHINE_ALPHA = 0x0184; // Alpha_AXP + public const ushort IMAGE_FILE_MACHINE_SH3 = 0x01a2; // SH3 little-endian + public const ushort IMAGE_FILE_MACHINE_SH3DSP = 0x01a3; + public const ushort IMAGE_FILE_MACHINE_SH3E = 0x01a4; // SH3E little-endian + public const ushort IMAGE_FILE_MACHINE_SH4 = 0x01a6; // SH4 little-endian + public const ushort IMAGE_FILE_MACHINE_SH5 = 0x01a8; // SH5 + public const ushort IMAGE_FILE_MACHINE_ARM = 0x01c0; // ARM Little-Endian + public const ushort IMAGE_FILE_MACHINE_THUMB = 0x01c2; + public const ushort IMAGE_FILE_MACHINE_AM33 = 0x01d3; + public const ushort IMAGE_FILE_MACHINE_POWERPC = 0x01F0; // IBM PowerPC Little-Endian + public const ushort IMAGE_FILE_MACHINE_POWERPCFP = 0x01f1; + public const ushort IMAGE_FILE_MACHINE_IA64 = 0x0200; // Intel 64 + public const ushort IMAGE_FILE_MACHINE_MIPS16 = 0x0266; // MIPS + public const ushort IMAGE_FILE_MACHINE_ALPHA64 = 0x0284; // ALPHA64 + public const ushort IMAGE_FILE_MACHINE_MIPSFPU = 0x0366; // MIPS + public const ushort IMAGE_FILE_MACHINE_MIPSFPU16 = 0x0466; // MIPS + public const ushort IMAGE_FILE_MACHINE_AXP64 = 0x0284; + public const ushort IMAGE_FILE_MACHINE_TRICORE = 0x0520; // Infineon + public const ushort IMAGE_FILE_MACHINE_CEF = 0x0CEF; + public const ushort IMAGE_FILE_MACHINE_EBC = 0x0EBC; // EFI Byte Code + public const ushort IMAGE_FILE_MACHINE_AMD64 = 0x8664; // AMD64 (K8) + public const ushort IMAGE_FILE_MACHINE_M32R = 0x9041; // M32R little-endian + public const ushort IMAGE_FILE_MACHINE_CEE = 0xC0EE; + #endregion + + #region Directory format + public const uint IMAGE_DIRECTORY_ENTRY_EXPORT = 0; // Export Directory + public const uint IMAGE_DIRECTORY_ENTRY_IMPORT = 1; // Import Directory + public const uint IMAGE_DIRECTORY_ENTRY_RESOURCE = 2; // Resource Directory + public const uint IMAGE_DIRECTORY_ENTRY_EXCEPTION = 3; // Exception Directory + public const uint IMAGE_DIRECTORY_ENTRY_SECURITY = 4; // Security Directory + public const uint IMAGE_DIRECTORY_ENTRY_BASERELOC = 5; // Base Relocation Table + public const uint IMAGE_DIRECTORY_ENTRY_DEBUG = 6; // Debug Directory + public const uint IMAGE_DIRECTORY_ENTRY_COPYRIGHT = 7; // Copyright + public const uint IMAGE_DIRECTORY_ENTRY_GLOBALPTR = 8; // RVA of GP + public const uint IMAGE_DIRECTORY_ENTRY_TLS = 9; // TLS Directory + public const uint IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG = 10; // Load Configuration Directory + public const uint IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT = 11; // Bound Import Directory in headers + public const uint IMAGE_DIRECTORY_ENTRY_IAT = 12; // Import Address Table + public const uint IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT = 13; // Delay Load Import Descriptors + public const uint IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR = 14; // COM Runtime descriptor + public const int IMAGE_NUMBEROF_DIRECTORY_ENTRIES = 16; + public struct IMAGE_DATA_DIRECTORY + { + public string Type; + public uint VirtualAddress; + public uint Size; + } + #endregion + + #region Optional header 64-bit + public struct IMAGE_OPTIONAL_HEADER64 + { + public ushort Magic; + public byte MajorLinkerVersion; + public byte MinorLinkerVersion; + public uint SizeOfCode; + public uint SizeOfInitializedData; + public uint SizeOfUninitializedData; + public uint AddressOfEntryPoint; + public uint BaseOfCode; + public UInt64 ImageBase; + public uint SectionAlignment; + public uint FileAlignment; + public ushort MajorOperatingSystemVersion; + public ushort MinorOperatingSystemVersion; + public ushort MajorImageVersion; + public ushort MinorImageVersion; + public ushort MajorSubsystemVersion; + public ushort MinorSubsystemVersion; + public uint Win32VersionValue; + public uint SizeOfImage; + public uint SizeOfHeaders; + public uint CheckSum; + public ushort Subsystem; + public ushort DllCharacteristics; + public UInt64 SizeOfStackReserve; + public UInt64 SizeOfStackCommit; + public UInt64 SizeOfHeapReserve; + public UInt64 SizeOfHeapCommit; + public uint LoaderFlags; + public uint NumberOfRvaAndSizes; + public IMAGE_DATA_DIRECTORY[] DataDirectory; + } + #endregion + + #region Optional header 32-bit + public struct IMAGE_OPTIONAL_HEADER32 + { + public ushort Magic; + public byte MajorLinkerVersion; + public byte MinorLinkerVersion; + public uint SizeOfCode; + public uint SizeOfInitializedData; + public uint SizeOfUninitializedData; + public uint AddressOfEntryPoint; + public uint BaseOfCode; + public uint BaseOfData; + public uint ImageBase; + public uint SectionAlignment; + public uint FileAlignment; + public ushort MajorOperatingSystemVersion; + public ushort MinorOperatingSystemVersion; + public ushort MajorImageVersion; + public ushort MinorImageVersion; + public ushort MajorSubsystemVersion; + public ushort MinorSubsystemVersion; + public uint Win32VersionValue; + public uint SizeOfImage; + public uint SizeOfHeaders; + public uint CheckSum; + public ushort Subsystem; + public ushort DllCharacteristics; + public uint SizeOfStackReserve; + public uint SizeOfStackCommit; + public uint SizeOfHeapReserve; + public uint SizeOfHeapCommit; + public uint LoaderFlags; + public uint NumberOfRvaAndSizes; + public IMAGE_DATA_DIRECTORY[] DataDirectory; + } + #endregion + + #region Section header format + public struct IMAGE_SECTION_HEADER + { + public string Name; + public uint PhysicalAddress; + public uint VirtualSize; + public uint VirtualAddress; + public uint SizeOfRawData; + public uint PointerToRawData; + public uint PointerToRelocations; + public uint PointerToLinenumbers; + public ushort NumberOfRelocations; + public ushort NumberOfLinenumbers; + public uint Characteristics; + } + #endregion + + private FileStream inputExe; + private BinaryReader inputReader; + private IMAGE_DOS_HEADER dosHeader; + private IMAGE_FILE_HEADER fileHeader; + private IMAGE_DATA_DIRECTORY[] dataDirectory = new IMAGE_DATA_DIRECTORY[16]; + private IMAGE_OPTIONAL_HEADER32 optionalHeader32; + private IMAGE_SECTION_HEADER[] sectionHeaders; + private bool isExeLoaded = false; + //private IMAGE_OPTIONAL_HEADER64 optionalHeader64; + + private string[] directoryTypeStrings = new string[16] {"Export Table", + "Import Table", + "Resource Table", + "Exception Table", + "Certificate Table", + "Base Relocation Table", + "Debug Directory", + "Architecture Specific Data", + "Global Pointer Register", + "Thread Local Storage Table", + "Load Configuration Table", + "Bound Import Table", + "Import Address Table", + "Delay Load Import Descriptors", + "COM Runtime Descriptor", + "Reserved"}; + + public IMAGE_DOS_HEADER DOSHeader + { + get { return dosHeader; } + } + + public IMAGE_FILE_HEADER FileHeader + { + get { return fileHeader; } + } + + public IMAGE_OPTIONAL_HEADER32 PEHeader + { + get { return optionalHeader32; } + } + + public IMAGE_DATA_DIRECTORY[] DataDirectories + { + get { return dataDirectory; } + } + + public IMAGE_SECTION_HEADER[] SectionHeaders + { + get { return sectionHeaders; } + } + + public bool DoesSectionExist(string sectionName) + { + for(int i = 0; i < fileHeader.NumberOfSections; i++) + if(sectionHeaders[i].Name == sectionName) + return true; + return false; + } + + public byte[] GetSectionDataByName(string sectionName) + { + byte[] result; + for(int i = 0; i < fileHeader.NumberOfSections; i++) + { + if(sectionHeaders[i].Name == sectionName) + { + inputExe.Position = sectionHeaders[i].PointerToRawData; + result = inputReader.ReadBytes((int)sectionHeaders[i].SizeOfRawData); + return result; + } + } + return null; + } + + public bool LoadExecutable(string fileName) + { + try + { + inputExe = new FileStream(fileName, + FileMode.Open, + FileAccess.Read, + FileShare.Read); + inputReader = new BinaryReader(inputExe); + ReadMZHeader(); + if (dosHeader.PEHeaderAddress > 0) + { + inputExe.Position = dosHeader.PEHeaderAddress + 4; + ReadFileHeader(); + ReadSectionHeaders(); + } + isExeLoaded = true; + return true; + } + catch(Exception ex) + { + return false; + } + } + + public void CloseExecutable() + { + if(isExeLoaded) + inputExe.Close(); + isExeLoaded = false; + } + + private bool ReadMZHeader() + { + try + { + dosHeader.Magic = inputReader.ReadUInt16(); + dosHeader.SizeOfLastPage = inputReader.ReadUInt16(); + dosHeader.NumberOfPages = inputReader.ReadUInt16(); + dosHeader.Relocations = inputReader.ReadUInt16(); + dosHeader.SizeOfHeader = inputReader.ReadUInt16(); + dosHeader.MinimumExtraParagraphs = inputReader.ReadUInt16(); + dosHeader.MaximumExtraParagraphs = inputReader.ReadUInt16(); + dosHeader.InitialSSValue = inputReader.ReadUInt16(); + dosHeader.InitialSPValue = inputReader.ReadUInt16(); + dosHeader.Checksum = inputReader.ReadUInt16(); + dosHeader.InitialIPValue = inputReader.ReadUInt16(); + dosHeader.InitialCSValue = inputReader.ReadUInt16(); + dosHeader.RelocationTableAddress = inputReader.ReadUInt16(); + dosHeader.OverlayNumber = inputReader.ReadUInt16(); + for(int i = 0; i < 4; i++) + inputReader.ReadUInt16(); + dosHeader.OemIdentifier = inputReader.ReadUInt16(); + dosHeader.OemInformation = inputReader.ReadUInt16(); + for(int i = 0; i < 10; i++) + inputReader.ReadUInt16(); + dosHeader.PEHeaderAddress = inputReader.ReadUInt32(); + return true; + + } + catch(Exception ex) + { + return false; + } + } + + private bool ReadFileHeader() + { + try + { + fileHeader.Machine = inputReader.ReadUInt16(); + fileHeader.NumberOfSections = inputReader.ReadUInt16(); + fileHeader.TimeDateStamp = inputReader.ReadUInt32(); + fileHeader.PointerToSymbolTable = inputReader.ReadUInt32(); + fileHeader.NumberOfSymbols = inputReader.ReadUInt32(); + fileHeader.SizeOfOptionalHeader = inputReader.ReadUInt16(); + fileHeader.Characteristics = inputReader.ReadUInt16(); + if(fileHeader.SizeOfOptionalHeader > 0) + { + if(ReadPEHeader()) + return true; + else + return false; + } + return true; + } + catch(Exception ex) + { + return false; + } + } + + private bool ReadPEHeader() + { + try + { + optionalHeader32.Magic = inputReader.ReadUInt16(); + optionalHeader32.MajorLinkerVersion = inputReader.ReadByte(); + optionalHeader32.MinorLinkerVersion = inputReader.ReadByte(); + optionalHeader32.SizeOfCode = inputReader.ReadUInt32(); + optionalHeader32.SizeOfInitializedData = inputReader.ReadUInt32(); + optionalHeader32.SizeOfUninitializedData = inputReader.ReadUInt32(); + optionalHeader32.AddressOfEntryPoint = inputReader.ReadUInt32(); + optionalHeader32.BaseOfCode = inputReader.ReadUInt32(); + optionalHeader32.BaseOfData = inputReader.ReadUInt32(); + optionalHeader32.ImageBase = inputReader.ReadUInt32(); + optionalHeader32.SectionAlignment = inputReader.ReadUInt32(); + optionalHeader32.FileAlignment = inputReader.ReadUInt32(); + optionalHeader32.MajorOperatingSystemVersion = inputReader.ReadUInt16(); + optionalHeader32.MinorOperatingSystemVersion = inputReader.ReadUInt16(); + optionalHeader32.MajorImageVersion = inputReader.ReadUInt16(); + optionalHeader32.MinorImageVersion = inputReader.ReadUInt16(); + optionalHeader32.MajorSubsystemVersion = inputReader.ReadUInt16(); + optionalHeader32.MinorSubsystemVersion = inputReader.ReadUInt16(); + optionalHeader32.Win32VersionValue = inputReader.ReadUInt32(); + optionalHeader32.SizeOfImage = inputReader.ReadUInt32(); + optionalHeader32.SizeOfHeaders = inputReader.ReadUInt32(); + optionalHeader32.CheckSum = inputReader.ReadUInt32(); + optionalHeader32.Subsystem = inputReader.ReadUInt16(); + optionalHeader32.DllCharacteristics = inputReader.ReadUInt16(); + optionalHeader32.SizeOfStackReserve = inputReader.ReadUInt32(); + optionalHeader32.SizeOfStackCommit = inputReader.ReadUInt32(); + optionalHeader32.SizeOfHeapReserve = inputReader.ReadUInt32(); + optionalHeader32.SizeOfHeapCommit = inputReader.ReadUInt32(); + optionalHeader32.LoaderFlags = inputReader.ReadUInt32(); + optionalHeader32.NumberOfRvaAndSizes = inputReader.ReadUInt32(); + for(int i = 0; i < dataDirectory.Length; i++) + { + dataDirectory[i].Type = directoryTypeStrings[i]; + dataDirectory[i].VirtualAddress = inputReader.ReadUInt32(); + dataDirectory[i].Size = inputReader.ReadUInt32(); + } + return true; + + } + catch(Exception ex) + { + return false; + } + } + + private bool ReadSectionHeaders() + { + try + { + byte[] sectionNameBuffer; + string sectionName; + string sectionNameClean; + sectionHeaders = new IMAGE_SECTION_HEADER[fileHeader.NumberOfSections]; + for(int i = 0; i < fileHeader.NumberOfSections; i++) + { + sectionNameBuffer = inputReader.ReadBytes(8); + sectionName = Encoding.ASCII.GetString(sectionNameBuffer); + sectionNameClean = sectionName.Substring(0, sectionName.IndexOf("\0")); + sectionHeaders[i].Name = sectionNameClean; + //sectionHeaders[i].PhysicalAddress = inputReader.ReadUInt32(); + sectionHeaders[i].VirtualSize = inputReader.ReadUInt32(); + sectionHeaders[i].VirtualAddress = inputReader.ReadUInt32(); + sectionHeaders[i].SizeOfRawData = inputReader.ReadUInt32(); + sectionHeaders[i].PointerToRawData = inputReader.ReadUInt32(); + sectionHeaders[i].PointerToRelocations = inputReader.ReadUInt32(); + sectionHeaders[i].PointerToLinenumbers = inputReader.ReadUInt32(); + sectionHeaders[i].NumberOfRelocations = inputReader.ReadUInt16(); + sectionHeaders[i].NumberOfLinenumbers = inputReader.ReadUInt16(); + sectionHeaders[i].Characteristics = inputReader.ReadUInt32(); + } + return true; + + } + catch(Exception ex) + { + return false; + } + } + + + + ~PEReader() + { + if(isExeLoaded) + { + inputReader.Close(); + inputExe = null; + inputReader = null; + } + } + } +}