Class ImageOptionalHeader

Represents the optional header in the NT header.

Inheritance

System.Object

ImageOptionalHeader

Namespace: PeNet.Header.Pe

Assembly: PeNet.dll

Syntax

public class ImageOptionalHeader : AbstractStructure

Constructors

| Improve this Doc View Source

ImageOptionalHeader(IRawFile, Int64, Boolean)

Create a new ImageOptionalHeader object.

Declaration

public ImageOptionalHeader(IRawFile peFile, long offset, bool is64Bit)

Parameters

Type	Name	Description
IRawFile	peFile	A PE file.
System.Int64	offset	Raw offset to the optional header.
System.Boolean	is64Bit	Set to true, if header is for a x64 application.

Fields

| Improve this Doc View Source

DataDirectory

The Data Directories.

Declaration

public readonly ImageDataDirectory[] DataDirectory

Field Value

Type	Description
ImageDataDirectory[]

Properties

| Improve this Doc View Source

AddressOfEntryPoint

RVA of the entry point function.

Declaration

public uint AddressOfEntryPoint { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

BaseOfCode

RVA to the beginning of the code section.

Declaration

public uint BaseOfCode { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

BaseOfData

RVA to the beginning of the data section.

Declaration

public uint BaseOfData { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

CheckSum

Image checksum validated at runtime for drivers, DLLs loaded at boot time and DLLs loaded into a critical system.

Declaration

public uint CheckSum { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

DllCharacteristics

DLL characteristics of the image.

Declaration

public DllCharacteristicsType DllCharacteristics { get; set; }

Property Value

Type	Description
DllCharacteristicsType

| Improve this Doc View Source

FileAlignment

File alignment of the raw data of the sections in bytes.

Declaration

public uint FileAlignment { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

ImageBase

Preferred address of the image when it's loaded to memory.

Declaration

public ulong ImageBase { get; set; }

Property Value

Type	Description
System.UInt64

| Improve this Doc View Source

LoaderFlags

Obsolete

Declaration

public uint LoaderFlags { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

Magic

Flag if the file is x32, x64 or a ROM image.

Declaration

public MagicType Magic { get; set; }

Property Value

Type	Description
MagicType

| Improve this Doc View Source

MajorImageVersion

Major image version.

Declaration

public ushort MajorImageVersion { get; set; }

Property Value

Type	Description
System.UInt16

| Improve this Doc View Source

MajorLinkerVersion

Major linker version.

Declaration

public byte MajorLinkerVersion { get; set; }

Property Value

Type	Description
System.Byte

| Improve this Doc View Source

MajorOperatingSystemVersion

Major operation system version to run the file.

Declaration

public ushort MajorOperatingSystemVersion { get; set; }

Property Value

Type	Description
System.UInt16

| Improve this Doc View Source

MajorSubsystemVersion

Major version of the subsystem.

Declaration

public ushort MajorSubsystemVersion { get; set; }

Property Value

Type	Description
System.UInt16

| Improve this Doc View Source

MinorImageVersion

Minor image version.

Declaration

public ushort MinorImageVersion { get; set; }

Property Value

Type	Description
System.UInt16

| Improve this Doc View Source

MinorLinkerVersion

Minor linker version.

Declaration

public byte MinorLinkerVersion { get; set; }

Property Value

Type	Description
System.Byte

| Improve this Doc View Source

MinorOperatingSystemVersion

Minor operation system version to run the file.

Declaration

public ushort MinorOperatingSystemVersion { get; set; }

Property Value

Type	Description
System.UInt16

| Improve this Doc View Source

MinorSubsystemVersion

Minor version of the subsystem.

Declaration

public ushort MinorSubsystemVersion { get; set; }

Property Value

Type	Description
System.UInt16

| Improve this Doc View Source

NumberOfRvaAndSizes

Number of directory entries in the remainder of the optional header.

Declaration

public uint NumberOfRvaAndSizes { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

SectionAlignment

Section alignment in memory in bytes. Must be greater or equal to the file alignment.

Declaration

public uint SectionAlignment { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

SizeOfCode

Size of all code sections together.

Declaration

public uint SizeOfCode { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

SizeOfHeaders

Sum of the e_lfanwe from the DOS header, the 4 byte signature, size of the file header, size of the optional header and size of all section. Rounded to the next file alignment.

Declaration

public uint SizeOfHeaders { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

SizeOfHeapCommit

Size of the heap commit in bytes.

Declaration

public ulong SizeOfHeapCommit { get; set; }

Property Value

Type	Description
System.UInt64

| Improve this Doc View Source

SizeOfHeapReserve

Size of the heap to reserve in bytes.

Declaration

public ulong SizeOfHeapReserve { get; set; }

Property Value

Type	Description
System.UInt64

| Improve this Doc View Source

SizeOfImage

Size of the image including all headers in bytes. Must be a multiple of the section alignment.

Declaration

public uint SizeOfImage { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

SizeOfInitializedData

Size of all initialized data sections together.

Declaration

public uint SizeOfInitializedData { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

SizeOfStackCommit

Size of bytes committed for the stack in bytes.

Declaration

public ulong SizeOfStackCommit { get; set; }

Property Value

Type	Description
System.UInt64

| Improve this Doc View Source

SizeOfStackReserve

Size of stack reserve in bytes.

Declaration

public ulong SizeOfStackReserve { get; set; }

Property Value

Type	Description
System.UInt64

| Improve this Doc View Source

SizeOfUninitializedData

Size of all uninitialized data sections together.

Declaration

public uint SizeOfUninitializedData { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

Subsystem

The subsystem required to run the image e.g., Windows GUI, XBOX etc.

Declaration

public SubsystemType Subsystem { get; set; }

Property Value

Type	Description
SubsystemType

| Improve this Doc View Source

SubsystemResolved

Subsystem resolved to a readable string.

Declaration

public string SubsystemResolved { get; }

Property Value

Type	Description
System.String

| Improve this Doc View Source

Win32VersionValue

Reserved and must be 0.

Declaration

public uint Win32VersionValue { get; set; }

Property Value

Type	Description
System.UInt32

Methods

| Improve this Doc View Source

ResolveSubsystem(SubsystemType)

Resolve the subsystem attribute to a human readable string.

Declaration

public static string ResolveSubsystem(SubsystemType subsystem)

Parameters

Type	Name	Description
SubsystemType	subsystem	Subsystem attribute.

Returns

Type	Description
System.String	Subsystem as readable string.