Class IMAGE_OPTIONAL_HEADER

Represents the optional header in the NT header.

Inheritance

System.Object

AbstractStructure

IMAGE_OPTIONAL_HEADER

Inherited Members

AbstractStructure.ToString()

System.Object.Equals(System.Object)

System.Object.Equals(System.Object, System.Object)

System.Object.GetHashCode()

System.Object.GetType()

System.Object.MemberwiseClone()

System.Object.ReferenceEquals(System.Object, System.Object)

Namespace: PeNet.Structures

Assembly: PeNet.dll

Syntax

public class IMAGE_OPTIONAL_HEADER : AbstractStructure

Constructors

| Improve this Doc View Source

IMAGE_OPTIONAL_HEADER(Byte[], UInt32, Boolean)

Create a new IMAGE_OPTIONAL_HEADER object.

Declaration

public IMAGE_OPTIONAL_HEADER(byte[] buff, uint offset, bool is64Bit)

Parameters

Type	Name	Description
System.Byte[]	buff	A PE file as a byte array.
System.UInt32	offset	Raw offset to the optional header.
System.Boolean	is64Bit	Set to true, if header is for a x64 application.

Fields

| Improve this Doc View Source

DataDirectory

The Data Directories.

Declaration

public readonly IMAGE_DATA_DIRECTORY[] DataDirectory

Field Value

Type	Description
IMAGE_DATA_DIRECTORY[]

Properties

| Improve this Doc View Source

AddressOfEntryPoint

RVA of the entry point function.

Declaration

public uint AddressOfEntryPoint { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

BaseOfCode

RVA to the beginning of the code section.

Declaration

public uint BaseOfCode { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

BaseOfData

RVA to the beginning of the data section.

Declaration

public uint BaseOfData { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

CheckSum

Image checksum validated at runtime for drivers, DLLs loaded at boot time and DLLs loaded into a critical system.

Declaration

public uint CheckSum { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

DllCharacteristics

DLL characteristics of the image.

Declaration

public ushort DllCharacteristics { get; set; }

Property Value

Type	Description
System.UInt16

| Improve this Doc View Source

FileAlignment

File alignment of the raw data of the sections in bytes.

Declaration

public uint FileAlignment { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

ImageBase

Preferred address of the image when it's loaded to memory.

Declaration

public ulong ImageBase { get; set; }

Property Value

Type	Description
System.UInt64

| Improve this Doc View Source

LoaderFlags

Obsolete

Declaration

public uint LoaderFlags { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

Magic

Flag if the file is x32, x64 or a ROM image.

Declaration

public ushort Magic { get; set; }

Property Value

Type	Description
System.UInt16

| Improve this Doc View Source

MajorImageVersion

Major image version.

Declaration

public ushort MajorImageVersion { get; set; }

Property Value

Type	Description
System.UInt16

| Improve this Doc View Source

MajorLinkerVersion

Major linker version.

Declaration

public byte MajorLinkerVersion { get; set; }

Property Value

Type	Description
System.Byte

| Improve this Doc View Source

MajorOperatingSystemVersion

Major operation system version to run the file.

Declaration

public ushort MajorOperatingSystemVersion { get; set; }

Property Value

Type	Description
System.UInt16

| Improve this Doc View Source

MajorSubsystemVersion

Major version of the subsystem.

Declaration

public ushort MajorSubsystemVersion { get; set; }

Property Value

Type	Description
System.UInt16

| Improve this Doc View Source

MinorImageVersion

Minor image version.

Declaration

public ushort MinorImageVersion { get; set; }

Property Value

Type	Description
System.UInt16

| Improve this Doc View Source

MinorLinkerVersion

Minor linker version.

Declaration

public byte MinorLinkerVersion { get; set; }

Property Value

Type	Description
System.Byte

| Improve this Doc View Source

MinorOperatingSystemVersion

Minor operation system version to run the file.

Declaration

public ushort MinorOperatingSystemVersion { get; set; }

Property Value

Type	Description
System.UInt16

| Improve this Doc View Source

MinorSubsystemVersion

Minor version of the subsystem.

Declaration

public ushort MinorSubsystemVersion { get; set; }

Property Value

Type	Description
System.UInt16

| Improve this Doc View Source

NumberOfRvaAndSizes

Number of directory entries in the remainder of the optional header.

Declaration

public uint NumberOfRvaAndSizes { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

SectionAlignment

Section alignment in memory in bytes. Must be greater or equal to the file alignment.

Declaration

public uint SectionAlignment { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

SizeOfCode

Size of all code sections together.

Declaration

public uint SizeOfCode { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

SizeOfHeaders

Sum of the e_lfanwe from the DOS header, the 4 byte signature, size of the file header, size of the optional header and size of all section. Rounded to the next file alignment.

Declaration

public uint SizeOfHeaders { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

SizeOfHeapCommit

Size of the heap commit in bytes.

Declaration

public ulong SizeOfHeapCommit { get; set; }

Property Value

Type	Description
System.UInt64

| Improve this Doc View Source

SizeOfHeapReserve

Size of the heap to reserve in bytes.

Declaration

public ulong SizeOfHeapReserve { get; set; }

Property Value

Type	Description
System.UInt64

| Improve this Doc View Source

SizeOfImage

Size of the image including all headers in bytes. Must be a multiple of the section alignment.

Declaration

public uint SizeOfImage { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

SizeOfInitializedData

Size of all initialized data sections together.

Declaration

public uint SizeOfInitializedData { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

SizeOfStackCommit

Size of bytes committed for the stack in bytes.

Declaration

public ulong SizeOfStackCommit { get; set; }

Property Value

Type	Description
System.UInt64

| Improve this Doc View Source

SizeOfStackReserve

Size of stack reserve in bytes.

Declaration

public ulong SizeOfStackReserve { get; set; }

Property Value

Type	Description
System.UInt64

| Improve this Doc View Source

SizeOfUninitializedData

Size of all uninitialized data sections together.

Declaration

public uint SizeOfUninitializedData { get; set; }

Property Value

Type	Description
System.UInt32

| Improve this Doc View Source

Subsystem

The subsystem required to run the image e.g., Windows GUI, XBOX etc. Can be resolved to a string with Utility.ResolveSubsystem(subsystem=

Declaration

public ushort Subsystem { get; set; }

Property Value

Type	Description
System.UInt16

| Improve this Doc View Source

Win32VersionValue

Reserved and must be 0.

Declaration

public uint Win32VersionValue { get; set; }

Property Value

Type	Description
System.UInt32