21Debug.Assert(peReader.PEHeaders.PEHeader is object); 25DirectoryEntry exportTable = peReader.PEHeaders.PEHeader.ExportTableDirectory;

88peReader.PEHeaders.PEHeader is null ||

1002builder.WriteInt32(peReader.PEHeaders.PEHeader.SizeOfImage);

7333Assert.Equal(5, peHeaders.PEHeader.MajorSubsystemVersion); 7334Assert.Equal(1, peHeaders.PEHeader.MinorSubsystemVersion); 12296var debugDirectory = peReader.PEHeaders.PEHeader.DebugTableDirectory;

3535Assert.Equal(0x30, peHeaders.PEHeader.MajorLinkerVersion); 3536Assert.Equal(0, peHeaders.PEHeader.MinorLinkerVersion); 3537Assert.Equal(0x10000000u, peHeaders.PEHeader.ImageBase); 3538Assert.Equal(0x200, peHeaders.PEHeader.FileAlignment); 3539Assert.Equal(0x8540u, (ushort)peHeaders.PEHeader.DllCharacteristics); //DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE 3541Assert.Equal(0x00100000u, peHeaders.PEHeader.SizeOfStackReserve); 3542Assert.Equal(0x1000u, peHeaders.PEHeader.SizeOfStackCommit); 3543Assert.Equal(0x00100000u, peHeaders.PEHeader.SizeOfHeapReserve); 3544Assert.Equal(0x1000u, peHeaders.PEHeader.SizeOfHeapCommit); 3569Assert.Equal(0x30, peHeaders.PEHeader.MajorLinkerVersion); 3570Assert.Equal(0, peHeaders.PEHeader.MinorLinkerVersion); 3572Assert.Equal(0x0000000180000000u, peHeaders.PEHeader.ImageBase); 3573Assert.Equal(0x00000200, peHeaders.PEHeader.FileAlignment); //doesn't change based on architecture. 3574Assert.Equal(0x8540u, (ushort)peHeaders.PEHeader.DllCharacteristics); //DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE 3576Assert.Equal(0x00400000u, peHeaders.PEHeader.SizeOfStackReserve); 3577Assert.Equal(0x4000u, peHeaders.PEHeader.SizeOfStackCommit); 3578Assert.Equal(0x00100000u, peHeaders.PEHeader.SizeOfHeapReserve); 3579Assert.Equal(0x2000u, peHeaders.PEHeader.SizeOfHeapCommit); 3585Assert.Equal(4, peHeaders.PEHeader.MajorSubsystemVersion); 3586Assert.Equal(0, peHeaders.PEHeader.MinorSubsystemVersion); 3589Assert.Equal(0, peHeaders.PEHeader.ImportAddressTableDirectory.RelativeVirtualAddress); 3590Assert.Equal(0, peHeaders.PEHeader.ImportAddressTableDirectory.Size); 3591Assert.Equal(0, peHeaders.PEHeader.ImportTableDirectory.RelativeVirtualAddress); 3592Assert.Equal(0, peHeaders.PEHeader.ImportTableDirectory.Size); 3593Assert.Equal(0, peHeaders.PEHeader.BaseRelocationTableDirectory.RelativeVirtualAddress); 3594Assert.Equal(0, peHeaders.PEHeader.BaseRelocationTableDirectory.Size); 3619Assert.Equal(0x30, peHeaders.PEHeader.MajorLinkerVersion); 3620Assert.Equal(0, peHeaders.PEHeader.MinorLinkerVersion); 3622Assert.Equal(0x10000000u, peHeaders.PEHeader.ImageBase); 3623Assert.Equal(0x200, peHeaders.PEHeader.FileAlignment); 3624Assert.Equal(0x8540u, (ushort)peHeaders.PEHeader.DllCharacteristics); //DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE 3626Assert.Equal(6, peHeaders.PEHeader.MajorSubsystemVersion); //Arm targets only run on 6.2 and above 3627Assert.Equal(2, peHeaders.PEHeader.MinorSubsystemVersion); 3629Assert.Equal(0, peHeaders.PEHeader.ImportAddressTableDirectory.RelativeVirtualAddress); 3630Assert.Equal(0, peHeaders.PEHeader.ImportAddressTableDirectory.Size); 3631Assert.Equal(0, peHeaders.PEHeader.ImportTableDirectory.RelativeVirtualAddress); 3632Assert.Equal(0, peHeaders.PEHeader.ImportTableDirectory.Size); 3633Assert.Equal(0, peHeaders.PEHeader.BaseRelocationTableDirectory.RelativeVirtualAddress); 3634Assert.Equal(0, peHeaders.PEHeader.BaseRelocationTableDirectory.Size); 3659Assert.Equal(0x30, peHeaders.PEHeader.MajorLinkerVersion); 3660Assert.Equal(0, peHeaders.PEHeader.MinorLinkerVersion); 3661Assert.Equal(0x00400000ul, peHeaders.PEHeader.ImageBase); 3662Assert.Equal(0x00000200, peHeaders.PEHeader.FileAlignment); 3664Assert.Equal(0x8540u, (ushort)peHeaders.PEHeader.DllCharacteristics); //DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE 3665Assert.Equal(0x00100000u, peHeaders.PEHeader.SizeOfStackReserve); 3666Assert.Equal(0x1000u, peHeaders.PEHeader.SizeOfStackCommit); 3667Assert.Equal(0x00100000u, peHeaders.PEHeader.SizeOfHeapReserve); 3668Assert.Equal(0x1000u, peHeaders.PEHeader.SizeOfHeapCommit); 3671Assert.NotEqual(0, peHeaders.PEHeader.ImportAddressTableDirectory.RelativeVirtualAddress); 3672Assert.NotEqual(0, peHeaders.PEHeader.ImportAddressTableDirectory.Size); 3673Assert.NotEqual(0, peHeaders.PEHeader.ImportTableDirectory.RelativeVirtualAddress); 3674Assert.NotEqual(0, peHeaders.PEHeader.ImportTableDirectory.Size); 3675Assert.NotEqual(0, peHeaders.PEHeader.BaseRelocationTableDirectory.RelativeVirtualAddress); 3676Assert.NotEqual(0, peHeaders.PEHeader.BaseRelocationTableDirectory.Size); 3699Assert.Equal(0x30, peHeaders.PEHeader.MajorLinkerVersion); 3700Assert.Equal(0, peHeaders.PEHeader.MinorLinkerVersion); 3701Assert.Equal(0x0000000140000000ul, peHeaders.PEHeader.ImageBase); 3702Assert.Equal(0x200, peHeaders.PEHeader.FileAlignment); //doesn't change based on architecture 3704Assert.Equal(0x8540u, (ushort)peHeaders.PEHeader.DllCharacteristics); //DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE 3705Assert.Equal(0x00400000u, peHeaders.PEHeader.SizeOfStackReserve); 3706Assert.Equal(0x4000u, peHeaders.PEHeader.SizeOfStackCommit); 3707Assert.Equal(0x00100000u, peHeaders.PEHeader.SizeOfHeapReserve); //no sure why we don't bump this up relative to 32bit as well. 3708Assert.Equal(0x2000u, peHeaders.PEHeader.SizeOfHeapCommit); 3725Assert.Equal(0x8560u, (ushort)peHeaders.PEHeader.DllCharacteristics); //DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE | HIGH_ENTROPY_VA (0x20) 3743Assert.Equal(0x9540u, (ushort)peHeaders.PEHeader.DllCharacteristics); //DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE | IMAGE_DLLCHARACTERISTICS_APPCONTAINER (0x1000) 3759Assert.Equal(0x10110000ul, peHeaders.PEHeader.ImageBase); 3764Assert.Equal(0x10000ul, peHeaders.PEHeader.ImageBase); 3769Assert.Equal(0x00400000u, peHeaders.PEHeader.ImageBase); 3774Assert.Equal(0x00400000u, peHeaders.PEHeader.ImageBase); 3779Assert.Equal(0xffff0000ul, peHeaders.PEHeader.ImageBase); 3784Assert.Equal(0x00400000u, peHeaders.PEHeader.ImageBase); 3788Assert.Equal(0x0000000140000000u, peHeaders.PEHeader.ImageBase); 3793Assert.Equal(0xffffffffffff0000ul, peHeaders.PEHeader.ImageBase); 3798Assert.Equal(0x0000000140000000u, peHeaders.PEHeader.ImageBase); 3813Assert.Equal(1024, peHeaders.PEHeader.FileAlignment);

2242var peHeader = peHeaders.PEHeader; 2430var peHeader = peHeaders.PEHeader;

105var peHeader = OptionsReader.PeReader.PEHeaders.PEHeader!;

85uint expectedChecksum = peHeaders.PEHeader.CheckSum; 136bool is32bit = peHeaders.PEHeader.Magic == PEMagic.PE32; 145var authenticodeDir = peHeaders.PEHeader.CertificateTableDirectory;

83return headers.PEHeader != null && headers.PEHeader.Magic == PEMagic.PE32Plus

44_peReader.PEHeaders.PEHeader.SizeOfImage,

6484Assert.Equal(5, peHeaders.PEHeader.MajorSubsystemVersion) 6485Assert.Equal(1, peHeaders.PEHeader.MinorSubsystemVersion) 9703Dim debugDirectory = peReader.PEHeaders.PEHeader.DebugTableDirectory

2126Assert.Equal(&H50, peHeaders.PEHeader.MajorLinkerVersion) 2127Assert.Equal(0, peHeaders.PEHeader.MinorLinkerVersion) 2128Assert.Equal(&H10000000UL, peHeaders.PEHeader.ImageBase) 2131Assert.Equal(&H200, peHeaders.PEHeader.FileAlignment) 2132Assert.Equal(CType(&H8540, UShort), peHeaders.PEHeader.DllCharacteristics) 'DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE 2134Assert.Equal(&H100000UL, peHeaders.PEHeader.SizeOfStackReserve) 2135Assert.Equal(&H1000UL, peHeaders.PEHeader.SizeOfStackCommit) 2136Assert.Equal(&H100000UL, peHeaders.PEHeader.SizeOfHeapReserve) 2137Assert.Equal(&H1000UL, peHeaders.PEHeader.SizeOfHeapCommit) 2150Assert.Equal(&H50, peHeaders.PEHeader.MajorLinkerVersion) 2151Assert.Equal(0, peHeaders.PEHeader.MinorLinkerVersion) 2152Assert.Equal(CType(&H400000, ULong), peHeaders.PEHeader.ImageBase) 2154Assert.Equal(&H200, peHeaders.PEHeader.FileAlignment) 2156Assert.Equal(CType(&H8540, UShort), peHeaders.PEHeader.DllCharacteristics) 'DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE 2158Assert.Equal(&H100000UL, peHeaders.PEHeader.SizeOfStackReserve) 2159Assert.Equal(&H1000UL, peHeaders.PEHeader.SizeOfStackCommit) 2160Assert.Equal(&H100000UL, peHeaders.PEHeader.SizeOfHeapReserve) 2161Assert.Equal(&H1000UL, peHeaders.PEHeader.SizeOfHeapCommit) 2187Assert.Equal(&H50, peHeaders.PEHeader.MajorLinkerVersion) 2188Assert.Equal(0, peHeaders.PEHeader.MinorLinkerVersion) 2189Assert.Equal(&H10000000UL, peHeaders.PEHeader.ImageBase) 2192Assert.Equal(&H200, peHeaders.PEHeader.FileAlignment) 2193Assert.Equal(CType(&H8540, UShort), peHeaders.PEHeader.DllCharacteristics) 'DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE 2195Assert.Equal(&H100000UL, peHeaders.PEHeader.SizeOfStackReserve) 2196Assert.Equal(&H1000UL, peHeaders.PEHeader.SizeOfStackCommit) 2197Assert.Equal(&H100000UL, peHeaders.PEHeader.SizeOfHeapReserve) 2198Assert.Equal(&H1000UL, peHeaders.PEHeader.SizeOfHeapCommit) 2211Assert.Equal(&H50, peHeaders.PEHeader.MajorLinkerVersion) 2212Assert.Equal(0, peHeaders.PEHeader.MinorLinkerVersion) 2213Assert.Equal(CType(&H400000, ULong), peHeaders.PEHeader.ImageBase) 2215Assert.Equal(&H200, peHeaders.PEHeader.FileAlignment) 2217Assert.Equal(CType(&H8540, UShort), peHeaders.PEHeader.DllCharacteristics) 'DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE 2219Assert.Equal(&H100000UL, peHeaders.PEHeader.SizeOfStackReserve) 2220Assert.Equal(&H1000UL, peHeaders.PEHeader.SizeOfStackCommit) 2221Assert.Equal(&H100000UL, peHeaders.PEHeader.SizeOfHeapReserve) 2222Assert.Equal(&H1000UL, peHeaders.PEHeader.SizeOfHeapCommit) 2248Assert.Equal(&H50, peHeaders.PEHeader.MajorLinkerVersion) 2249Assert.Equal(0, peHeaders.PEHeader.MinorLinkerVersion) 2250Assert.Equal(&H180000000UL, peHeaders.PEHeader.ImageBase) 2253Assert.Equal(&H200, peHeaders.PEHeader.FileAlignment) 'doesn't change based on architecture 2254Assert.Equal(CType(&H8540, UShort), peHeaders.PEHeader.DllCharacteristics) 'DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE 2267Assert.Equal(&H50, peHeaders.PEHeader.MajorLinkerVersion) 2268Assert.Equal(0, peHeaders.PEHeader.MinorLinkerVersion) 2269Assert.Equal(&H140000000UL, peHeaders.PEHeader.ImageBase) 2271Assert.Equal(&H200, peHeaders.PEHeader.FileAlignment) 2273Assert.Equal(CType(&H8540, UShort), peHeaders.PEHeader.DllCharacteristics) 'DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE 2276Assert.Equal(&H400000UL, peHeaders.PEHeader.SizeOfStackReserve) 2277Assert.Equal(&H4000UL, peHeaders.PEHeader.SizeOfStackCommit) 2278Assert.Equal(&H100000UL, peHeaders.PEHeader.SizeOfHeapReserve) ' is the 32bit value! 2279Assert.Equal(&H2000UL, peHeaders.PEHeader.SizeOfHeapCommit) 2296Assert.Equal(CType(&H8560, UShort), peHeaders.PEHeader.DllCharacteristics) 'DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE | HIGH_ENTROPY_VA (0x20) 2314Assert.Equal(CType(&H9540, UShort), peHeaders.PEHeader.DllCharacteristics) 'DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE | HIGH_ENTROPY_VA (0x20) 2332Assert.Equal(CType(&H10110000, ULong), peHeaders.PEHeader.ImageBase) 2337Assert.Equal(CType(&H10000, ULong), peHeaders.PEHeader.ImageBase) 2342Assert.Equal(&H400000UL, peHeaders.PEHeader.ImageBase) 2347Assert.Equal(&H400000UL, peHeaders.PEHeader.ImageBase) 2351Assert.Equal(&H140000000UL, peHeaders.PEHeader.ImageBase) 2355Assert.Equal(&H180000000UL, peHeaders.PEHeader.ImageBase) 2373Assert.Equal(1024, peHeaders.PEHeader.FileAlignment) 2377Assert.Equal(4096, peHeaders.PEHeader.FileAlignment)

51var entry = headers.PEHeader.CertificateTableDirectory; 59int certificateTableDirectoryOffset = (headers.PEHeader.Magic == PEMagic.PE32Plus) ? 144 : 128;

52if (peReader.PEHeaders.PEHeader.CertificateTableDirectory.Size != 0) 55int certificateTableDirectoryOffset = (peReader.PEHeaders.PEHeader.Magic == PEMagic.PE32Plus) ? 144 : 128;

201var entry = headers.PEHeader.CertificateTableDirectory;

3115WriteBytesToLocation(inputStream, outputStream, checksumStart, peHeaders.PEHeader.CheckSum); 3129WriteBytesToLocation(inputStream, outputStream, checksumStart, peHeaders.PEHeader.CheckSum ^ 0x1);

83bool is32bit = peHeaders.PEHeader.Magic == PEMagic.PE32; 90var authenticodeDir = peHeaders.PEHeader.CertificateTableDirectory; 139+ (peHeaders.PEHeader.Magic == PEMagic.PE32 ? Constants.PEHeaderSize32Bit : Constants.PEHeaderSize64Bit)

71if (peHeaders.PEHeader.CheckSum == 0) 83if (peHeaders.PEHeader.CheckSum != Utils.CalculateChecksum(peBuffer, peHeaders))

382Debug.Assert(headers.PEHeader != null); 409if (headers.PEHeader.CertificateTableDirectory.Size > 0) 411var certificateTableDirectoryOffset = (headers.PEHeader.Magic == PEMagic.PE32Plus) ? 144 : 128;

537Debug.Assert(PEHeaders.PEHeader != null); 539var debugDirectory = PEHeaders.PEHeader.DebugTableDirectory;

90PEMagic peMagic = peHeaders.PEHeader!.Magic;