C# Class PeNet.PeFile

This class represents a Portable Executable (PE) file and makes the different header and properties accessible.

Show file Open project: secana/PeNet Class Usage Examples

Public Properties

Property	Type	Description
Buff	byte[]

Public Methods

Method	Description
GetCrlUrlList ( ) : CrlUrlList	Get an object which holds information about the Certificate Revocation Lists of the signing certificate if any is present.
GetFileType ( ) : string	Returns if the PE file is a EXE, DLL and which architecture is used (32/64). Architectures: "I386", "AMD64", "UNKNOWN" DllOrExe: "DLL", "EXE", "UNKNOWN"
Is32BitPeFile ( string file ) : bool	Returns if the file is a PE file and 32 Bit.
Is64BitPeFile ( string file ) : bool	Returns if the file is a PE file and 64 Bit.
IsPEFile ( string file ) : bool	Tests is a file is a PE file based on the MZ header. It is not checked if the PE file is correct in all other parts.
IsValidCertChain ( bool online ) : bool	Checks if cert is from a trusted CA with a valid certificate chain.
IsValidPEFile ( string file ) : bool	Tries to parse the PE file and checks all directories.
PeFile ( byte buff ) : System	Create a new PeFile object.
PeFile ( string peFile ) : System	Create a new PeFile object.
ToString ( ) : string	Creates a string representation of the objects properties.

Method Details

GetCrlUrlList() public method

Get an object which holds information about the Certificate Revocation Lists of the signing certificate if any is present.

public GetCrlUrlList ( ) : CrlUrlList
return	CrlUrlList

GetFileType() public method

Returns if the PE file is a EXE, DLL and which architecture is used (32/64). Architectures: "I386", "AMD64", "UNKNOWN" DllOrExe: "DLL", "EXE", "UNKNOWN"

public GetFileType ( ) : string
return	string

Is32BitPeFile() public static method

Returns if the file is a PE file and 32 Bit.

public static Is32BitPeFile ( string file ) : bool
file	string	Path to a possible PE file.
return	bool

Is64BitPeFile() public static method

Returns if the file is a PE file and 64 Bit.

public static Is64BitPeFile ( string file ) : bool
file	string	Path to a possible PE file.
return	bool

IsPEFile() public static method

Tests is a file is a PE file based on the MZ header. It is not checked if the PE file is correct in all other parts.

public static IsPEFile ( string file ) : bool
file	string	Path to a possible PE file.
return	bool

IsValidCertChain() public method

Checks if cert is from a trusted CA with a valid certificate chain.

public IsValidCertChain ( bool online ) : bool
online	bool	Check certificate chain online or off-line.
return	bool

IsValidPEFile() public static method

Tries to parse the PE file and checks all directories.

public static IsValidPEFile ( string file ) : bool
file	string	Path to a possible PE file.
return	bool

PeFile() public method

Create a new PeFile object.

public PeFile ( byte buff ) : System
buff	byte	A PE file a byte array.
return	System

PeFile() public method

Create a new PeFile object.

public PeFile ( string peFile ) : System
peFile	string	Path to a PE file.
return	System

ToString() public method

Creates a string representation of the objects properties.

public ToString ( ) : string
return	string

Property Details

Buff public property

The PE binary as a byte array.

public byte[] Buff
return	byte[]