21Debug.Assert(peReader.PEHeaders.PEHeader is object); 25DirectoryEntry exportTable = peReader.PEHeaders.PEHeader.ExportTableDirectory;

88peReader.PEHeaders.PEHeader is null ||

1002builder.WriteInt32(peReader.PEHeaders.PEHeader.SizeOfImage);

7344Assert.Equal(5, peHeaders.PEHeader.MajorSubsystemVersion); 7345Assert.Equal(1, peHeaders.PEHeader.MinorSubsystemVersion); 12307var debugDirectory = peReader.PEHeaders.PEHeader.DebugTableDirectory;

3535Assert.Equal(0x30, peHeaders.PEHeader.MajorLinkerVersion); 3536Assert.Equal(0, peHeaders.PEHeader.MinorLinkerVersion); 3537Assert.Equal(0x10000000u, peHeaders.PEHeader.ImageBase); 3538Assert.Equal(0x200, peHeaders.PEHeader.FileAlignment); 3539Assert.Equal(0x8540u, (ushort)peHeaders.PEHeader.DllCharacteristics); //DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE 3541Assert.Equal(0x00100000u, peHeaders.PEHeader.SizeOfStackReserve); 3542Assert.Equal(0x1000u, peHeaders.PEHeader.SizeOfStackCommit); 3543Assert.Equal(0x00100000u, peHeaders.PEHeader.SizeOfHeapReserve); 3544Assert.Equal(0x1000u, peHeaders.PEHeader.SizeOfHeapCommit); 3569Assert.Equal(0x30, peHeaders.PEHeader.MajorLinkerVersion); 3570Assert.Equal(0, peHeaders.PEHeader.MinorLinkerVersion); 3572Assert.Equal(0x0000000180000000u, peHeaders.PEHeader.ImageBase); 3573Assert.Equal(0x00000200, peHeaders.PEHeader.FileAlignment); //doesn't change based on architecture. 3574Assert.Equal(0x8540u, (ushort)peHeaders.PEHeader.DllCharacteristics); //DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE 3576Assert.Equal(0x00400000u, peHeaders.PEHeader.SizeOfStackReserve); 3577Assert.Equal(0x4000u, peHeaders.PEHeader.SizeOfStackCommit); 3578Assert.Equal(0x00100000u, peHeaders.PEHeader.SizeOfHeapReserve); 3579Assert.Equal(0x2000u, peHeaders.PEHeader.SizeOfHeapCommit); 3585Assert.Equal(4, peHeaders.PEHeader.MajorSubsystemVersion); 3586Assert.Equal(0, peHeaders.PEHeader.MinorSubsystemVersion); 3589Assert.Equal(0, peHeaders.PEHeader.ImportAddressTableDirectory.RelativeVirtualAddress); 3590Assert.Equal(0, peHeaders.PEHeader.ImportAddressTableDirectory.Size); 3591Assert.Equal(0, peHeaders.PEHeader.ImportTableDirectory.RelativeVirtualAddress); 3592Assert.Equal(0, peHeaders.PEHeader.ImportTableDirectory.Size); 3593Assert.Equal(0, peHeaders.PEHeader.BaseRelocationTableDirectory.RelativeVirtualAddress); 3594Assert.Equal(0, peHeaders.PEHeader.BaseRelocationTableDirectory.Size); 3619Assert.Equal(0x30, peHeaders.PEHeader.MajorLinkerVersion); 3620Assert.Equal(0, peHeaders.PEHeader.MinorLinkerVersion); 3622Assert.Equal(0x10000000u, peHeaders.PEHeader.ImageBase); 3623Assert.Equal(0x200, peHeaders.PEHeader.FileAlignment); 3624Assert.Equal(0x8540u, (ushort)peHeaders.PEHeader.DllCharacteristics); //DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE 3626Assert.Equal(6, peHeaders.PEHeader.MajorSubsystemVersion); //Arm targets only run on 6.2 and above 3627Assert.Equal(2, peHeaders.PEHeader.MinorSubsystemVersion); 3629Assert.Equal(0, peHeaders.PEHeader.ImportAddressTableDirectory.RelativeVirtualAddress); 3630Assert.Equal(0, peHeaders.PEHeader.ImportAddressTableDirectory.Size); 3631Assert.Equal(0, peHeaders.PEHeader.ImportTableDirectory.RelativeVirtualAddress); 3632Assert.Equal(0, peHeaders.PEHeader.ImportTableDirectory.Size); 3633Assert.Equal(0, peHeaders.PEHeader.BaseRelocationTableDirectory.RelativeVirtualAddress); 3634Assert.Equal(0, peHeaders.PEHeader.BaseRelocationTableDirectory.Size); 3659Assert.Equal(0x30, peHeaders.PEHeader.MajorLinkerVersion); 3660Assert.Equal(0, peHeaders.PEHeader.MinorLinkerVersion); 3661Assert.Equal(0x00400000ul, peHeaders.PEHeader.ImageBase); 3662Assert.Equal(0x00000200, peHeaders.PEHeader.FileAlignment); 3664Assert.Equal(0x8540u, (ushort)peHeaders.PEHeader.DllCharacteristics); //DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE 3665Assert.Equal(0x00100000u, peHeaders.PEHeader.SizeOfStackReserve); 3666Assert.Equal(0x1000u, peHeaders.PEHeader.SizeOfStackCommit); 3667Assert.Equal(0x00100000u, peHeaders.PEHeader.SizeOfHeapReserve); 3668Assert.Equal(0x1000u, peHeaders.PEHeader.SizeOfHeapCommit); 3671Assert.NotEqual(0, peHeaders.PEHeader.ImportAddressTableDirectory.RelativeVirtualAddress); 3672Assert.NotEqual(0, peHeaders.PEHeader.ImportAddressTableDirectory.Size); 3673Assert.NotEqual(0, peHeaders.PEHeader.ImportTableDirectory.RelativeVirtualAddress); 3674Assert.NotEqual(0, peHeaders.PEHeader.ImportTableDirectory.Size); 3675Assert.NotEqual(0, peHeaders.PEHeader.BaseRelocationTableDirectory.RelativeVirtualAddress); 3676Assert.NotEqual(0, peHeaders.PEHeader.BaseRelocationTableDirectory.Size); 3699Assert.Equal(0x30, peHeaders.PEHeader.MajorLinkerVersion); 3700Assert.Equal(0, peHeaders.PEHeader.MinorLinkerVersion); 3701Assert.Equal(0x0000000140000000ul, peHeaders.PEHeader.ImageBase); 3702Assert.Equal(0x200, peHeaders.PEHeader.FileAlignment); //doesn't change based on architecture 3704Assert.Equal(0x8540u, (ushort)peHeaders.PEHeader.DllCharacteristics); //DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE 3705Assert.Equal(0x00400000u, peHeaders.PEHeader.SizeOfStackReserve); 3706Assert.Equal(0x4000u, peHeaders.PEHeader.SizeOfStackCommit); 3707Assert.Equal(0x00100000u, peHeaders.PEHeader.SizeOfHeapReserve); //no sure why we don't bump this up relative to 32bit as well. 3708Assert.Equal(0x2000u, peHeaders.PEHeader.SizeOfHeapCommit); 3725Assert.Equal(0x8560u, (ushort)peHeaders.PEHeader.DllCharacteristics); //DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE | HIGH_ENTROPY_VA (0x20) 3743Assert.Equal(0x9540u, (ushort)peHeaders.PEHeader.DllCharacteristics); //DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE | IMAGE_DLLCHARACTERISTICS_APPCONTAINER (0x1000) 3759Assert.Equal(0x10110000ul, peHeaders.PEHeader.ImageBase); 3764Assert.Equal(0x10000ul, peHeaders.PEHeader.ImageBase); 3769Assert.Equal(0x00400000u, peHeaders.PEHeader.ImageBase); 3774Assert.Equal(0x00400000u, peHeaders.PEHeader.ImageBase); 3779Assert.Equal(0xffff0000ul, peHeaders.PEHeader.ImageBase); 3784Assert.Equal(0x00400000u, peHeaders.PEHeader.ImageBase); 3788Assert.Equal(0x0000000140000000u, peHeaders.PEHeader.ImageBase); 3793Assert.Equal(0xffffffffffff0000ul, peHeaders.PEHeader.ImageBase); 3798Assert.Equal(0x0000000140000000u, peHeaders.PEHeader.ImageBase); 3813Assert.Equal(1024, peHeaders.PEHeader.FileAlignment);

2242var peHeader = peHeaders.PEHeader; 2430var peHeader = peHeaders.PEHeader;

105var peHeader = OptionsReader.PeReader.PEHeaders.PEHeader!;

85uint expectedChecksum = peHeaders.PEHeader.CheckSum; 136bool is32bit = peHeaders.PEHeader.Magic == PEMagic.PE32; 145var authenticodeDir = peHeaders.PEHeader.CertificateTableDirectory;

83return headers.PEHeader != null && headers.PEHeader.Magic == PEMagic.PE32Plus

44_peReader.PEHeaders.PEHeader.SizeOfImage,

51var entry = headers.PEHeader.CertificateTableDirectory; 59int certificateTableDirectoryOffset = (headers.PEHeader.Magic == PEMagic.PE32Plus) ? 144 : 128;

52if (peReader.PEHeaders.PEHeader.CertificateTableDirectory.Size != 0) 55int certificateTableDirectoryOffset = (peReader.PEHeaders.PEHeader.Magic == PEMagic.PE32Plus) ? 144 : 128;

97var securityDirectory = peReader.PEHeaders.PEHeader.CertificateTableDirectory;

201var entry = headers.PEHeader.CertificateTableDirectory;

3254WriteBytesToLocation(inputStream, outputStream, checksumStart, peHeaders.PEHeader.CheckSum); 3268WriteBytesToLocation(inputStream, outputStream, checksumStart, peHeaders.PEHeader.CheckSum ^ 0x1);

83bool is32bit = peHeaders.PEHeader.Magic == PEMagic.PE32; 90var authenticodeDir = peHeaders.PEHeader.CertificateTableDirectory; 139+ (peHeaders.PEHeader.Magic == PEMagic.PE32 ? Constants.PEHeaderSize32Bit : Constants.PEHeaderSize64Bit)

71if (peHeaders.PEHeader.CheckSum == 0) 83if (peHeaders.PEHeader.CheckSum != Utils.CalculateChecksum(peBuffer, peHeaders))

382Debug.Assert(headers.PEHeader != null); 409if (headers.PEHeader.CertificateTableDirectory.Size > 0) 411var certificateTableDirectoryOffset = (headers.PEHeader.Magic == PEMagic.PE32Plus) ? 144 : 128;

537Debug.Assert(PEHeaders.PEHeader != null); 539var debugDirectory = PEHeaders.PEHeader.DebugTableDirectory;

90PEMagic peMagic = peHeaders.PEHeader!.Magic;