PEHeader Class

Definition

Namespace:

System.Reflection.PortableExecutable

Assembly:

System.Reflection.Metadata.dll

Source:

PEHeader.cs

Represents the Portable Executable (PE) file header.

public ref class PEHeader sealed

public sealed class PEHeader

type PEHeader = class

Public NotInheritable Class PEHeader

Inheritance

Object

PEHeader

Examples

This example shows how to read information from the PE header:

// Open the Portable Executable (PE) file
using var fs = new FileStream(@"Example.dll", FileMode.Open, FileAccess.Read, FileShare.ReadWrite);
using var peReader = new PEReader(fs);

// Display PE header information
if (peReader.PEHeaders.PEHeader is PEHeader header)
{
    Console.WriteLine($"Image size, bytes:   {header.SizeOfImage}");
    Console.WriteLine($"Image base:          0x{header.ImageBase:X}");
    Console.WriteLine($"File alignment:      0x{header.FileAlignment:X}");
    Console.WriteLine($"Section alignment:   0x{header.SectionAlignment:X}");
    Console.WriteLine($"Subsystem:           {header.Subsystem}");
    Console.WriteLine($"Dll characteristics: {header.DllCharacteristics}");
    Console.WriteLine($"Linker version:      {header.MajorLinkerVersion}.{header.MinorLinkerVersion}");
    Console.WriteLine($"OS version:          {header.MajorOperatingSystemVersion}.{header.MinorOperatingSystemVersion}");
}

Remarks

The PE file header format is defined by the PE specification. This class is used by the PEHeader property.

Properties

AddressOfEntryPoint	Gets the address of the entry point relative to the image base when the PE file is loaded into memory.
BaseOfCode	Gets the address of the beginning-of-code section relative to the image base when the image is loaded into memory.
BaseOfData	Gets the address of the beginning-of-data section relative to the image base when the image is loaded into memory.
BaseRelocationTableDirectory	Gets the Base Relocations Table entry.
BoundImportTableDirectory	Gets the Bound Import Table entry.
CertificateTableDirectory	Gets the Certificate Table entry, which points to a table of attribute certificates.
CheckSum	Gets the image file checksum.
CopyrightTableDirectory	Gets the Copyright Table entry.
CorHeaderTableDirectory	Gets the CLI Header Table entry.
DebugTableDirectory	Gets the Debug Table entry.
DelayImportTableDirectory	Gets the Delay-Load Import Table entry.
DllCharacteristics	Gets the characteristics of a dynamic link library.
ExceptionTableDirectory	Gets the Exception Table entry.
ExportTableDirectory	Gets the Export Table entry.
FileAlignment	Gets the alignment factor (in bytes) that is used to align the raw data of sections in the image file.
GlobalPointerTableDirectory	Gets the Global Pointer Table entry.
ImageBase	Gets the preferred address of the first byte of the image when it is loaded into memory.
ImportAddressTableDirectory	Gets the Import Address Table entry.
ImportTableDirectory	Gets the Import Table entry.
LoadConfigTableDirectory	Gets the Load Configuration Table entry.
Magic	Gets a value that identifies the format of the image file.
MajorImageVersion	Gets the major version number of the image.
MajorLinkerVersion	Gets the linker major version number.
MajorOperatingSystemVersion	Gets the major version number of the required operating system.
MajorSubsystemVersion	Gets the major version number of the subsystem.
MinorImageVersion	Gets the minor version number of the image.
MinorLinkerVersion	Gets the linker minor version number.
MinorOperatingSystemVersion	Gets the minor version number of the required operating system.
MinorSubsystemVersion	Gets the minor version number of the subsystem.
NumberOfRvaAndSizes	Gets the number of data-directory entries in the remainder of the PEHeader. Each describes a location and size.
ResourceTableDirectory	Gets the Resource Table entry.
SectionAlignment	Gets the alignment (in bytes) of sections when they are loaded into memory.
SizeOfCode	Gets the size of the code (text) section, or the sum of all code sections if there are multiple sections.
SizeOfHeaders	Gets the combined size of an MS DOS stub, PE header, and section headers rounded up to a multiple of FileAlignment.
SizeOfHeapCommit	Gets the size of the local heap space to commit.
SizeOfHeapReserve	Gets the size of the local heap space to reserve. Only SizeOfHeapCommit is committed; the rest is made available one page at a time until the reserve size is reached.
SizeOfImage	Gets the size (in bytes) of the image, including all headers, as the image is loaded in memory.
SizeOfInitializedData	Gets the size of the initialized data section, or the sum of all such sections if there are multiple data sections.
SizeOfStackCommit	Gets the size of the stack to commit.
SizeOfStackReserve	Gets the size of the stack to reserve. Only SizeOfStackCommit is committed; the rest is made available one page at a time until the reserve size is reached.
SizeOfUninitializedData	Gets the size of the uninitialized data section (BSS), or the sum of all such sections if there are multiple BSS sections.
Subsystem	Gets the name of the subsystem that is required to run this image.
ThreadLocalStorageTableDirectory	Gets the Thread-Local Storage Table entry.

Methods

Equals(Object)	Determines whether the specified object is equal to the current object. (Inherited from Object)
GetHashCode()	Serves as the default hash function. (Inherited from Object)
GetType()	Gets the Type of the current instance. (Inherited from Object)
MemberwiseClone()	Creates a shallow copy of the current Object. (Inherited from Object)
ToString()	Returns a string that represents the current object. (Inherited from Object)