Edit

Share via


PEHeader Class

Definition

Represents the Portable Executable (PE) file header.

public ref class PEHeader sealed
public sealed class PEHeader
type PEHeader = class
Public NotInheritable Class PEHeader
Inheritance
PEHeader

Examples

This example shows how to read information from the PE header:

// Open the Portable Executable (PE) file
using var fs = new FileStream(@"Example.dll", FileMode.Open, FileAccess.Read, FileShare.ReadWrite);
using var peReader = new PEReader(fs);

// Display PE header information
if (peReader.PEHeaders.PEHeader is PEHeader header)
{
    Console.WriteLine($"Image size, bytes:   {header.SizeOfImage}");
    Console.WriteLine($"Image base:          0x{header.ImageBase:X}");
    Console.WriteLine($"File alignment:      0x{header.FileAlignment:X}");
    Console.WriteLine($"Section alignment:   0x{header.SectionAlignment:X}");
    Console.WriteLine($"Subsystem:           {header.Subsystem}");
    Console.WriteLine($"Dll characteristics: {header.DllCharacteristics}");
    Console.WriteLine($"Linker version:      {header.MajorLinkerVersion}.{header.MinorLinkerVersion}");
    Console.WriteLine($"OS version:          {header.MajorOperatingSystemVersion}.{header.MinorOperatingSystemVersion}");
}

Remarks

The PE file header format is defined by the PE specification. This class is used by the PEHeader property.

Properties

AddressOfEntryPoint

Gets the address of the entry point relative to the image base when the PE file is loaded into memory.

BaseOfCode

Gets the address of the beginning-of-code section relative to the image base when the image is loaded into memory.

BaseOfData

Gets the address of the beginning-of-data section relative to the image base when the image is loaded into memory.

BaseRelocationTableDirectory

Gets the Base Relocations Table entry.

BoundImportTableDirectory

Gets the Bound Import Table entry.

CertificateTableDirectory

Gets the Certificate Table entry, which points to a table of attribute certificates.

CheckSum

Gets the image file checksum.

CopyrightTableDirectory

Gets the Copyright Table entry.

CorHeaderTableDirectory

Gets the CLI Header Table entry.

DebugTableDirectory

Gets the Debug Table entry.

DelayImportTableDirectory

Gets the Delay-Load Import Table entry.

DllCharacteristics

Gets the characteristics of a dynamic link library.

ExceptionTableDirectory

Gets the Exception Table entry.

ExportTableDirectory

Gets the Export Table entry.

FileAlignment

Gets the alignment factor (in bytes) that is used to align the raw data of sections in the image file.

GlobalPointerTableDirectory

Gets the Global Pointer Table entry.

ImageBase

Gets the preferred address of the first byte of the image when it is loaded into memory.

ImportAddressTableDirectory

Gets the Import Address Table entry.

ImportTableDirectory

Gets the Import Table entry.

LoadConfigTableDirectory

Gets the Load Configuration Table entry.

Magic

Gets a value that identifies the format of the image file.

MajorImageVersion

Gets the major version number of the image.

MajorLinkerVersion

Gets the linker major version number.

MajorOperatingSystemVersion

Gets the major version number of the required operating system.

MajorSubsystemVersion

Gets the major version number of the subsystem.

MinorImageVersion

Gets the minor version number of the image.

MinorLinkerVersion

Gets the linker minor version number.

MinorOperatingSystemVersion

Gets the minor version number of the required operating system.

MinorSubsystemVersion

Gets the minor version number of the subsystem.

NumberOfRvaAndSizes

Gets the number of data-directory entries in the remainder of the PEHeader. Each describes a location and size.

ResourceTableDirectory

Gets the Resource Table entry.

SectionAlignment

Gets the alignment (in bytes) of sections when they are loaded into memory.

SizeOfCode

Gets the size of the code (text) section, or the sum of all code sections if there are multiple sections.

SizeOfHeaders

Gets the combined size of an MS DOS stub, PE header, and section headers rounded up to a multiple of FileAlignment.

SizeOfHeapCommit

Gets the size of the local heap space to commit.

SizeOfHeapReserve

Gets the size of the local heap space to reserve. Only SizeOfHeapCommit is committed; the rest is made available one page at a time until the reserve size is reached.

SizeOfImage

Gets the size (in bytes) of the image, including all headers, as the image is loaded in memory.

SizeOfInitializedData

Gets the size of the initialized data section, or the sum of all such sections if there are multiple data sections.

SizeOfStackCommit

Gets the size of the stack to commit.

SizeOfStackReserve

Gets the size of the stack to reserve. Only SizeOfStackCommit is committed; the rest is made available one page at a time until the reserve size is reached.

SizeOfUninitializedData

Gets the size of the uninitialized data section (BSS), or the sum of all such sections if there are multiple BSS sections.

Subsystem

Gets the name of the subsystem that is required to run this image.

ThreadLocalStorageTableDirectory

Gets the Thread-Local Storage Table entry.

Methods

Equals(Object)

Determines whether the specified object is equal to the current object.

(Inherited from Object)
GetHashCode()

Serves as the default hash function.

(Inherited from Object)
GetType()

Gets the Type of the current instance.

(Inherited from Object)
MemberwiseClone()

Creates a shallow copy of the current Object.

(Inherited from Object)
ToString()

Returns a string that represents the current object.

(Inherited from Object)

Applies to