21Debug.Assert(peReader.PEHeaders.PEHeader is object); 25DirectoryEntry exportTable = peReader.PEHeaders.PEHeader.ExportTableDirectory;

88peReader.PEHeaders.PEHeader is null ||

1002builder.WriteInt32(peReader.PEHeaders.PEHeader.SizeOfImage);

7348Assert.Equal(5, peHeaders.PEHeader.MajorSubsystemVersion); 7349Assert.Equal(1, peHeaders.PEHeader.MinorSubsystemVersion); 12374var debugDirectory = peReader.PEHeaders.PEHeader.DebugTableDirectory;

3616Assert.Equal(0x30, peHeaders.PEHeader.MajorLinkerVersion); 3617Assert.Equal(0, peHeaders.PEHeader.MinorLinkerVersion); 3618Assert.Equal(0x10000000u, peHeaders.PEHeader.ImageBase); 3619Assert.Equal(0x200, peHeaders.PEHeader.FileAlignment); 3620Assert.Equal(0x8540u, (ushort)peHeaders.PEHeader.DllCharacteristics); //DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE 3622Assert.Equal(0x00100000u, peHeaders.PEHeader.SizeOfStackReserve); 3623Assert.Equal(0x1000u, peHeaders.PEHeader.SizeOfStackCommit); 3624Assert.Equal(0x00100000u, peHeaders.PEHeader.SizeOfHeapReserve); 3625Assert.Equal(0x1000u, peHeaders.PEHeader.SizeOfHeapCommit); 3650Assert.Equal(0x30, peHeaders.PEHeader.MajorLinkerVersion); 3651Assert.Equal(0, peHeaders.PEHeader.MinorLinkerVersion); 3653Assert.Equal(0x0000000180000000u, peHeaders.PEHeader.ImageBase); 3654Assert.Equal(0x00000200, peHeaders.PEHeader.FileAlignment); //doesn't change based on architecture. 3655Assert.Equal(0x8540u, (ushort)peHeaders.PEHeader.DllCharacteristics); //DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE 3657Assert.Equal(0x00400000u, peHeaders.PEHeader.SizeOfStackReserve); 3658Assert.Equal(0x4000u, peHeaders.PEHeader.SizeOfStackCommit); 3659Assert.Equal(0x00100000u, peHeaders.PEHeader.SizeOfHeapReserve); 3660Assert.Equal(0x2000u, peHeaders.PEHeader.SizeOfHeapCommit); 3666Assert.Equal(4, peHeaders.PEHeader.MajorSubsystemVersion); 3667Assert.Equal(0, peHeaders.PEHeader.MinorSubsystemVersion); 3670Assert.Equal(0, peHeaders.PEHeader.ImportAddressTableDirectory.RelativeVirtualAddress); 3671Assert.Equal(0, peHeaders.PEHeader.ImportAddressTableDirectory.Size); 3672Assert.Equal(0, peHeaders.PEHeader.ImportTableDirectory.RelativeVirtualAddress); 3673Assert.Equal(0, peHeaders.PEHeader.ImportTableDirectory.Size); 3674Assert.Equal(0, peHeaders.PEHeader.BaseRelocationTableDirectory.RelativeVirtualAddress); 3675Assert.Equal(0, peHeaders.PEHeader.BaseRelocationTableDirectory.Size); 3700Assert.Equal(0x30, peHeaders.PEHeader.MajorLinkerVersion); 3701Assert.Equal(0, peHeaders.PEHeader.MinorLinkerVersion); 3703Assert.Equal(0x10000000u, peHeaders.PEHeader.ImageBase); 3704Assert.Equal(0x200, peHeaders.PEHeader.FileAlignment); 3705Assert.Equal(0x8540u, (ushort)peHeaders.PEHeader.DllCharacteristics); //DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE 3707Assert.Equal(6, peHeaders.PEHeader.MajorSubsystemVersion); //Arm targets only run on 6.2 and above 3708Assert.Equal(2, peHeaders.PEHeader.MinorSubsystemVersion); 3710Assert.Equal(0, peHeaders.PEHeader.ImportAddressTableDirectory.RelativeVirtualAddress); 3711Assert.Equal(0, peHeaders.PEHeader.ImportAddressTableDirectory.Size); 3712Assert.Equal(0, peHeaders.PEHeader.ImportTableDirectory.RelativeVirtualAddress); 3713Assert.Equal(0, peHeaders.PEHeader.ImportTableDirectory.Size); 3714Assert.Equal(0, peHeaders.PEHeader.BaseRelocationTableDirectory.RelativeVirtualAddress); 3715Assert.Equal(0, peHeaders.PEHeader.BaseRelocationTableDirectory.Size); 3740Assert.Equal(0x30, peHeaders.PEHeader.MajorLinkerVersion); 3741Assert.Equal(0, peHeaders.PEHeader.MinorLinkerVersion); 3742Assert.Equal(0x00400000ul, peHeaders.PEHeader.ImageBase); 3743Assert.Equal(0x00000200, peHeaders.PEHeader.FileAlignment); 3745Assert.Equal(0x8540u, (ushort)peHeaders.PEHeader.DllCharacteristics); //DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE 3746Assert.Equal(0x00100000u, peHeaders.PEHeader.SizeOfStackReserve); 3747Assert.Equal(0x1000u, peHeaders.PEHeader.SizeOfStackCommit); 3748Assert.Equal(0x00100000u, peHeaders.PEHeader.SizeOfHeapReserve); 3749Assert.Equal(0x1000u, peHeaders.PEHeader.SizeOfHeapCommit); 3752Assert.NotEqual(0, peHeaders.PEHeader.ImportAddressTableDirectory.RelativeVirtualAddress); 3753Assert.NotEqual(0, peHeaders.PEHeader.ImportAddressTableDirectory.Size); 3754Assert.NotEqual(0, peHeaders.PEHeader.ImportTableDirectory.RelativeVirtualAddress); 3755Assert.NotEqual(0, peHeaders.PEHeader.ImportTableDirectory.Size); 3756Assert.NotEqual(0, peHeaders.PEHeader.BaseRelocationTableDirectory.RelativeVirtualAddress); 3757Assert.NotEqual(0, peHeaders.PEHeader.BaseRelocationTableDirectory.Size); 3780Assert.Equal(0x30, peHeaders.PEHeader.MajorLinkerVersion); 3781Assert.Equal(0, peHeaders.PEHeader.MinorLinkerVersion); 3782Assert.Equal(0x0000000140000000ul, peHeaders.PEHeader.ImageBase); 3783Assert.Equal(0x200, peHeaders.PEHeader.FileAlignment); //doesn't change based on architecture 3785Assert.Equal(0x8540u, (ushort)peHeaders.PEHeader.DllCharacteristics); //DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE 3786Assert.Equal(0x00400000u, peHeaders.PEHeader.SizeOfStackReserve); 3787Assert.Equal(0x4000u, peHeaders.PEHeader.SizeOfStackCommit); 3788Assert.Equal(0x00100000u, peHeaders.PEHeader.SizeOfHeapReserve); //no sure why we don't bump this up relative to 32bit as well. 3789Assert.Equal(0x2000u, peHeaders.PEHeader.SizeOfHeapCommit); 3806Assert.Equal(0x8560u, (ushort)peHeaders.PEHeader.DllCharacteristics); //DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE | HIGH_ENTROPY_VA (0x20) 3824Assert.Equal(0x9540u, (ushort)peHeaders.PEHeader.DllCharacteristics); //DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE | IMAGE_DLLCHARACTERISTICS_APPCONTAINER (0x1000) 3840Assert.Equal(0x10110000ul, peHeaders.PEHeader.ImageBase); 3845Assert.Equal(0x10000ul, peHeaders.PEHeader.ImageBase); 3850Assert.Equal(0x00400000u, peHeaders.PEHeader.ImageBase); 3855Assert.Equal(0x00400000u, peHeaders.PEHeader.ImageBase); 3860Assert.Equal(0xffff0000ul, peHeaders.PEHeader.ImageBase); 3865Assert.Equal(0x00400000u, peHeaders.PEHeader.ImageBase); 3869Assert.Equal(0x0000000140000000u, peHeaders.PEHeader.ImageBase); 3874Assert.Equal(0xffffffffffff0000ul, peHeaders.PEHeader.ImageBase); 3879Assert.Equal(0x0000000140000000u, peHeaders.PEHeader.ImageBase); 3894Assert.Equal(1024, peHeaders.PEHeader.FileAlignment);

2242var peHeader = peHeaders.PEHeader; 2430var peHeader = peHeaders.PEHeader;

105var peHeader = OptionsReader.PeReader.PEHeaders.PEHeader!;

85uint expectedChecksum = peHeaders.PEHeader.CheckSum; 136bool is32bit = peHeaders.PEHeader.Magic == PEMagic.PE32; 145var authenticodeDir = peHeaders.PEHeader.CertificateTableDirectory;

84return headers.PEHeader != null && headers.PEHeader.Magic == PEMagic.PE32Plus

44_peReader.PEHeaders.PEHeader.SizeOfImage,

38var entry = headers.PEHeader.CertificateTableDirectory; 46int certificateTableDirectoryOffset = (headers.PEHeader.Magic == PEMagic.PE32Plus) ? 144 : 128;

52if (peReader.PEHeaders.PEHeader.CertificateTableDirectory.Size != 0) 55int certificateTableDirectoryOffset = (peReader.PEHeaders.PEHeader.Magic == PEMagic.PE32Plus) ? 144 : 128;

182var securityDirectory = peReader.PEHeaders.PEHeader.CertificateTableDirectory;

161var entry = headers.PEHeader.CertificateTableDirectory;

3531WriteBytesToLocation(inputStream, outputStream, checksumStart, peHeaders.PEHeader.CheckSum); 3545WriteBytesToLocation(inputStream, outputStream, checksumStart, peHeaders.PEHeader.CheckSum ^ 0x1);

83bool is32bit = peHeaders.PEHeader.Magic == PEMagic.PE32; 90var authenticodeDir = peHeaders.PEHeader.CertificateTableDirectory; 139+ (peHeaders.PEHeader.Magic == PEMagic.PE32 ? Constants.PEHeaderSize32Bit : Constants.PEHeaderSize64Bit)

71if (peHeaders.PEHeader.CheckSum == 0) 83if (peHeaders.PEHeader.CheckSum != Utils.CalculateChecksum(peBuffer, peHeaders))

400Debug.Assert(headers.PEHeader != null); 427if (headers.PEHeader.CertificateTableDirectory.Size > 0) 429var certificateTableDirectoryOffset = (headers.PEHeader.Magic == PEMagic.PE32Plus) ? 144 : 128;

537Debug.Assert(PEHeaders.PEHeader != null); 539var debugDirectory = PEHeaders.PEHeader.DebugTableDirectory;

90PEMagic peMagic = peHeaders.PEHeader!.Magic;