PEReader in .Net Framework?

Question

PEReader in .Net Framework?

Peter Volz 1,295

Hello experts,

Going to determine if a file is an executable of any kind, exe dll ocx etc...

Checking the initial 2 bytes to be MZ or ZM is not accurate at all, so here's a good way, the second sample, PEReader:

https://learn.microsoft.com/en-us/dotnet/standard/assembly/identify

Seems only available to .NET and not .NET Framework!

Any trick to find out if a file is any executable?

Thanks for help :)

Can I use this is .net framework to get the executable kind? https://learn.microsoft.com/en-us/dotnet/api/system.reflection.module.getpekind?view=netframework-4.0 https://learn.microsoft.com/en-us/dotnet/api/system.reflection.portableexecutablekinds?view=netframework-4.0

Accepted answer

0 additional answers

Your answer

Answer 1

Jiachen Li-MSFT 34,221 Microsoft External Staff

Hi @Peter Volz ,

PEReader class can be used in .NET Framework, you need to install the System.Reflection.Metadata NuGet package.

I tested it with sample code in .NET Framework 4.7.2

User's image

Best Regards.

Jiachen Li

If the answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Jiachen Li-MSFT 34,221 Microsoft External Staff

Hi @Peter Volz ,

For Win16 executable files, known as New Executable, they also use MZ as the file header, so MyBinaryReader.ReadUInt16() = 23117 should also works for NE file.

New (NE), linear (LX), and portable (PE) executables retain the DOS MZ format file header for backward compatibility with DOS.

Try
    Dim MyBinaryReader As New BinaryReader(InputStream)
    Dim mzSignature As UInt16 = MyBinaryReader.ReadUInt16()
    If mzSignature = &H5A4D Then ' Check for MZ signature
        MyArchitecture = 16 ' This is an MZ (DOS) file
    ElseIf mzSignature = 23117 Then ' Check for NE signature
        MyArchitecture = 16 ' This is an NE (16-bit New Executable) file
    Else
        InputStream.Seek(0, SeekOrigin.Begin) ' Reset stream position
        Dim peSignature As UInt32 = MyBinaryReader.ReadUInt32()
        If peSignature = 17744 Then ' Check for PE signature
            MyArchitecture = 32 ' This is a PE (Portable Executable) file
        End If
    End If
Catch Exception As Exception

End Try

Share via

PEReader in .Net Framework?

0 additional answers

Your answer