├── .gitattributes ├── .gitignore ├── .idea └── .idea.PEExplorer │ ├── .idea │ ├── contentModel.xml │ ├── indexLayout.xml │ ├── modules.xml │ ├── vcs.xml │ └── workspace.xml │ └── riderModule.iml ├── MigrationBackup └── bf36c03e │ └── PEExplorer │ ├── NuGetUpgradeLog.html │ ├── PEExplorer.csproj │ └── packages.config ├── PEExplorer.Core ├── DirectoryTables.cs ├── Enums.cs ├── ExceptionTables.cs ├── ExportedSymbol.cs ├── ImportedLibrary.cs ├── ImportedSymbol.cs ├── Interop │ └── NativeTypes.cs ├── LoadConfiguration.cs ├── MachineType.cs ├── PEExplorer.Core.csproj ├── PEFileHelper.cs ├── PEFileParser.cs ├── PEParser.cs ├── Properties │ └── AssemblyInfo.cs ├── ResourceID.cs ├── ResourceManager.cs ├── SectionData.cs ├── SectionHeader.cs ├── StringResource.cs ├── Win32.cs ├── app.config └── packages.config ├── PEExplorer.sln ├── PEExplorer ├── App.config ├── App.xaml ├── App.xaml.cs ├── Assemblies │ ├── DebugHelp.dll │ ├── MahApps.Metro.dll │ ├── Microsoft.Diagnostics.Runtime.dll │ ├── Microsoft.Expression.Interactions.dll │ ├── Prism.dll │ ├── SharpDisasm.dll │ ├── System.Collections.Immutable.dll │ ├── System.Windows.Interactivity.dll │ └── Zodiacon.WPF.dll ├── Constants.cs ├── Converters │ ├── BytesToStringConverter.cs │ └── ResourceTemplateSelector.cs ├── Extensions.cs ├── Helpers │ ├── DateTimeHelper.cs │ └── Serializer.cs ├── Icons │ ├── apiset.ico │ ├── binary.ico │ ├── close.ico │ ├── close2.ico │ ├── config.ico │ ├── cpu.ico │ ├── data.ico │ ├── debug.ico │ ├── dependencies.ico │ ├── exceptions.ico │ ├── explorer.ico │ ├── export1.ico │ ├── folder.ico │ ├── general.ico │ ├── iat.ico │ ├── import2.ico │ ├── library.ico │ ├── open-new.ico │ ├── open.ico │ ├── registry.ico │ ├── res.ico │ ├── resources.ico │ ├── save.ico │ └── sections.ico ├── MainWindow.xaml ├── MainWindow.xaml.cs ├── PEExplorer.csproj ├── Properties │ ├── AssemblyInfo.cs │ ├── Resources.Designer.cs │ ├── Resources.resx │ ├── Settings.Designer.cs │ ├── Settings.settings │ └── app.manifest ├── Resources │ └── Templates.xaml ├── Settings.cs ├── ViewModels │ ├── DisassemblyViewModel.cs │ ├── GenericProperty.cs │ ├── InstructionViewModel.cs │ ├── MainViewModel.cs │ ├── PEHeaderProperty.cs │ ├── Resources │ │ ├── ImageResourceViewModel.cs │ │ ├── ResourceTypeViewModel.cs │ │ ├── ResourceViewModel.cs │ │ ├── StringResourceViewModel.cs │ │ └── TextResourceViewModel.cs │ ├── TabViewModelBase.cs │ ├── Tabs │ │ ├── CLRTabViewModel.cs │ │ ├── DebugTabViewModel.cs │ │ ├── DependenciesTabViewModel.cs │ │ ├── ExceptionsTabViewModel.cs │ │ ├── ExportsTabViewModel.cs │ │ ├── GeneralTabViewModel.cs │ │ ├── ImportAddressTableTabViewModel.cs │ │ ├── ImportsTabViewModel.cs │ │ ├── LoadConfigTabViewModel.cs │ │ ├── ResourcesTabViewModel.cs │ │ └── SectionsTabViewModel.cs │ └── TreeViewItemViewModel.cs └── Views │ ├── DisassemblyView.xaml │ ├── DisassemblyView.xaml.cs │ ├── GenericResourceView.xaml │ ├── GenericResourceView.xaml.cs │ ├── MainView.xaml │ ├── MainView.xaml.cs │ └── Tabs │ ├── DebugTabView.xaml │ ├── DebugTabView.xaml.cs │ ├── DependenciesTabView.xaml │ ├── DependenciesTabView.xaml.cs │ ├── ExportsTabView.xaml │ ├── ExportsTabView.xaml.cs │ ├── GeneralTabView.xaml │ ├── GeneralTabView.xaml.cs │ ├── ImportAddressTableTabView.xaml │ ├── ImportAddressTableTabView.xaml.cs │ ├── ImportsTabView.xaml │ ├── ImportsTabView.xaml.cs │ ├── LoadConfigTabView.xaml │ ├── LoadConfigTabView.xaml.cs │ ├── ResourcesTabView.xaml │ ├── ResourcesTabView.xaml.cs │ ├── SectionsTabView.xaml │ └── SectionsTabView.xaml.cs ├── README.md └── peexplorer1.PNG /.gitattributes: -------------------------------------------------------------------------------- 1 | ############################################################################### 2 | # Set default behavior to automatically normalize line endings. 3 | ############################################################################### 4 | * text=auto 5 | 6 | ############################################################################### 7 | # Set default behavior for command prompt diff. 8 | # 9 | # This is need for earlier builds of msysgit that does not have it on by 10 | # default for csharp files. 11 | # Note: This is only used by command line 12 | ############################################################################### 13 | #*.cs diff=csharp 14 | 15 | ############################################################################### 16 | # Set the merge driver for project and solution files 17 | # 18 | # Merging from the command prompt will add diff markers to the files if there 19 | # are conflicts (Merging from VS is not affected by the settings below, in VS 20 | # the diff markers are never inserted). Diff markers may cause the following 21 | # file extensions to fail to load in VS. An alternative would be to treat 22 | # these files as binary and thus will always conflict and require user 23 | # intervention with every merge. To do so, just uncomment the entries below 24 | ############################################################################### 25 | #*.sln merge=binary 26 | #*.csproj merge=binary 27 | #*.vbproj merge=binary 28 | #*.vcxproj merge=binary 29 | #*.vcproj merge=binary 30 | #*.dbproj merge=binary 31 | #*.fsproj merge=binary 32 | #*.lsproj merge=binary 33 | #*.wixproj merge=binary 34 | #*.modelproj merge=binary 35 | #*.sqlproj merge=binary 36 | #*.wwaproj merge=binary 37 | 38 | ############################################################################### 39 | # behavior for image files 40 | # 41 | # image files are treated as binary by default. 42 | ############################################################################### 43 | #*.jpg binary 44 | #*.png binary 45 | #*.gif binary 46 | 47 | ############################################################################### 48 | # diff behavior for common document formats 49 | # 50 | # Convert binary document formats to text before diffing them. This feature 51 | # is only available from the command line. Turn it on by uncommenting the 52 | # entries below. 53 | ############################################################################### 54 | #*.doc diff=astextplain 55 | #*.DOC diff=astextplain 56 | #*.docx diff=astextplain 57 | #*.DOCX diff=astextplain 58 | #*.dot diff=astextplain 59 | #*.DOT diff=astextplain 60 | #*.pdf diff=astextplain 61 | #*.PDF diff=astextplain 62 | #*.rtf diff=astextplain 63 | #*.RTF diff=astextplain 64 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | ## Ignore Visual Studio temporary files, build results, and 2 | ## files generated by popular Visual Studio add-ons. 3 | 4 | # User-specific files 5 | *.suo 6 | *.user 7 | *.userosscache 8 | *.sln.docstates 9 | 10 | # User-specific files (MonoDevelop/Xamarin Studio) 11 | *.userprefs 12 | 13 | # Build results 14 | [Dd]ebug/ 15 | [Dd]ebugPublic/ 16 | [Rr]elease/ 17 | [Rr]eleases/ 18 | [Xx]64/ 19 | [Xx]86/ 20 | [Bb]uild/ 21 | bld/ 22 | [Bb]in/ 23 | [Oo]bj/ 24 | 25 | # Visual Studio 2015 cache/options directory 26 | .vs/ 27 | # Uncomment if you have tasks that create the project's static files in wwwroot 28 | #wwwroot/ 29 | 30 | # MSTest test Results 31 | [Tt]est[Rr]esult*/ 32 | [Bb]uild[Ll]og.* 33 | 34 | # NUNIT 35 | *.VisualState.xml 36 | TestResult.xml 37 | 38 | # Build Results of an ATL Project 39 | [Dd]ebugPS/ 40 | [Rr]eleasePS/ 41 | dlldata.c 42 | 43 | # DNX 44 | project.lock.json 45 | artifacts/ 46 | 47 | *_i.c 48 | *_p.c 49 | *_i.h 50 | *.ilk 51 | *.meta 52 | *.obj 53 | *.pch 54 | *.pdb 55 | *.pgc 56 | *.pgd 57 | *.rsp 58 | *.sbr 59 | *.tlb 60 | *.tli 61 | *.tlh 62 | *.tmp 63 | *.tmp_proj 64 | *.log 65 | *.vspscc 66 | *.vssscc 67 | .builds 68 | *.pidb 69 | *.svclog 70 | *.scc 71 | 72 | # Chutzpah Test files 73 | _Chutzpah* 74 | 75 | # Visual C++ cache files 76 | ipch/ 77 | *.aps 78 | *.ncb 79 | *.opendb 80 | *.opensdf 81 | *.sdf 82 | *.cachefile 83 | *.VC.db 84 | 85 | # Visual Studio profiler 86 | *.psess 87 | *.vsp 88 | *.vspx 89 | *.sap 90 | 91 | # TFS 2012 Local Workspace 92 | $tf/ 93 | 94 | # Guidance Automation Toolkit 95 | *.gpState 96 | 97 | # ReSharper is a .NET coding add-in 98 | _ReSharper*/ 99 | *.[Rr]e[Ss]harper 100 | *.DotSettings.user 101 | 102 | # JustCode is a .NET coding add-in 103 | .JustCode 104 | 105 | # TeamCity is a build add-in 106 | _TeamCity* 107 | 108 | # DotCover is a Code Coverage Tool 109 | *.dotCover 110 | 111 | # NCrunch 112 | _NCrunch_* 113 | .*crunch*.local.xml 114 | nCrunchTemp_* 115 | 116 | # MightyMoose 117 | *.mm.* 118 | AutoTest.Net/ 119 | 120 | # Web workbench (sass) 121 | .sass-cache/ 122 | 123 | # Installshield output folder 124 | [Ee]xpress/ 125 | 126 | # DocProject is a documentation generator add-in 127 | DocProject/buildhelp/ 128 | DocProject/Help/*.HxT 129 | DocProject/Help/*.HxC 130 | DocProject/Help/*.hhc 131 | DocProject/Help/*.hhk 132 | DocProject/Help/*.hhp 133 | DocProject/Help/Html2 134 | DocProject/Help/html 135 | 136 | # Click-Once directory 137 | publish/ 138 | 139 | # Publish Web Output 140 | *.[Pp]ublish.xml 141 | *.azurePubxml 142 | 143 | # TODO: Un-comment the next line if you do not want to checkin 144 | # your web deploy settings because they may include unencrypted 145 | # passwords 146 | #*.pubxml 147 | *.publishproj 148 | 149 | # NuGet Packages 150 | *.nupkg 151 | # The packages folder can be ignored because of Package Restore 152 | **/packages/* 153 | # except build/, which is used as an MSBuild target. 154 | !**/packages/build/ 155 | # Uncomment if necessary however generally it will be regenerated when needed 156 | #!**/packages/repositories.config 157 | # NuGet v3's project.json files produces more ignoreable files 158 | *.nuget.props 159 | *.nuget.targets 160 | 161 | # Microsoft Azure Build Output 162 | csx/ 163 | *.build.csdef 164 | 165 | # Microsoft Azure Emulator 166 | ecf/ 167 | rcf/ 168 | 169 | # Microsoft Azure ApplicationInsights config file 170 | ApplicationInsights.config 171 | 172 | # Windows Store app package directory 173 | AppPackages/ 174 | BundleArtifacts/ 175 | 176 | # Visual Studio cache files 177 | # files ending in .cache can be ignored 178 | *.[Cc]ache 179 | # but keep track of directories ending in .cache 180 | !*.[Cc]ache/ 181 | 182 | # Others 183 | ClientBin/ 184 | [Ss]tyle[Cc]op.* 185 | ~$* 186 | *~ 187 | *.dbmdl 188 | *.dbproj.schemaview 189 | *.pfx 190 | *.publishsettings 191 | node_modules/ 192 | orleans.codegen.cs 193 | 194 | # RIA/Silverlight projects 195 | Generated_Code/ 196 | 197 | # Backup & report files from converting an old project file 198 | # to a newer Visual Studio version. Backup files are not needed, 199 | # because we have git ;-) 200 | _UpgradeReport_Files/ 201 | Backup*/ 202 | UpgradeLog*.XML 203 | UpgradeLog*.htm 204 | 205 | # SQL Server files 206 | *.mdf 207 | *.ldf 208 | 209 | # Business Intelligence projects 210 | *.rdl.data 211 | *.bim.layout 212 | *.bim_*.settings 213 | 214 | # Microsoft Fakes 215 | FakesAssemblies/ 216 | 217 | # GhostDoc plugin setting file 218 | *.GhostDoc.xml 219 | 220 | # Node.js Tools for Visual Studio 221 | .ntvs_analysis.dat 222 | 223 | # Visual Studio 6 build log 224 | *.plg 225 | 226 | # Visual Studio 6 workspace options file 227 | *.opt 228 | 229 | # Visual Studio LightSwitch build output 230 | **/*.HTMLClient/GeneratedArtifacts 231 | **/*.DesktopClient/GeneratedArtifacts 232 | **/*.DesktopClient/ModelManifest.xml 233 | **/*.Server/GeneratedArtifacts 234 | **/*.Server/ModelManifest.xml 235 | _Pvt_Extensions 236 | 237 | # LightSwitch generated files 238 | GeneratedArtifacts/ 239 | ModelManifest.xml 240 | 241 | # Paket dependency manager 242 | .paket/paket.exe 243 | 244 | # FAKE - F# Make 245 | .fake/ -------------------------------------------------------------------------------- /.idea/.idea.PEExplorer/.idea/contentModel.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | 97 | 98 | 99 | 100 | 101 | 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | 110 | 111 | 112 | 113 | 114 | 115 | 116 | 117 | 118 | 119 | 120 | 121 | 122 | 123 | 124 | 125 | 126 | 127 | -------------------------------------------------------------------------------- /.idea/.idea.PEExplorer/.idea/indexLayout.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | -------------------------------------------------------------------------------- /.idea/.idea.PEExplorer/.idea/modules.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | -------------------------------------------------------------------------------- /.idea/.idea.PEExplorer/.idea/vcs.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /.idea/.idea.PEExplorer/riderModule.iml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | -------------------------------------------------------------------------------- /MigrationBackup/bf36c03e/PEExplorer/NuGetUpgradeLog.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | NuGetMigrationLog 6 |

153 | NuGet Migration Report - PEExplorer

Overview

Migration to PackageReference was completed successfully. Please build and run your solution to verify that all packages are available.
154 | If you run into any problems, have feedback, questions, or concerns, please 155 | file an issue on the NuGet GitHub repository.
156 | Changed files and this report have been backed up here: 157 | C:\Dev\PEExplorer\MigrationBackup\bf36c03e\PEExplorer
Help me rollback to packages.config

Packages processed

Top-level dependencies:

Package IdVersion
MahApps.Metro 158 | v2.0.0-alpha0095
Prism.Core 159 | v7.1.0.431
SharpDisasm 160 | v1.1.11
Zodiacon.PEParsing 161 | v0.1.6
Zodiacon.WPF 162 | v1.2.17

Transitive dependencies:

Package IdVersion
ControlzEx 163 | v4.0.0-alpha0189

Package compatibility issues

Description
164 | No issues were found. 165 |
-------------------------------------------------------------------------------- /MigrationBackup/bf36c03e/PEExplorer/packages.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | -------------------------------------------------------------------------------- /PEExplorer.Core/DirectoryTables.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Runtime.InteropServices; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | 8 | namespace PEExplorer.Core { 9 | [StructLayout(LayoutKind.Sequential)] 10 | public struct IMAGE_EXPORT_DIRECTORY { 11 | public uint Characteristics; 12 | public uint TimeDateStamp; 13 | public ushort MajorVersion; 14 | public ushort MinorVersion; 15 | public int Name; 16 | public int Base; 17 | public int NumberOfFunctions; 18 | public int NumberOfNames; 19 | public int AddressOfFunctions; // RVA from base of image 20 | public int AddressOfNames; // RVA from base of image 21 | public int AddressOfOrdinals; // RVA from base of image 22 | } 23 | 24 | [StructLayout(LayoutKind.Sequential)] 25 | public struct IMAGE_RESOURCE_DIRECTORY { 26 | public int Characteristics; 27 | public int TimeDateStamp; 28 | public short MajorVersion; 29 | public short MinorVersion; 30 | public ushort NumberOfNamedEntries; 31 | public ushort NumberOfIdEntries; 32 | // IMAGE_RESOURCE_DIRECTORY_ENTRY DirectoryEntries[]; 33 | }; 34 | 35 | [StructLayout(LayoutKind.Sequential)] 36 | public struct IMAGE_IMPORT_DIRECTORY { 37 | public int ImportLookupTable; 38 | public int TimeDateStamp; 39 | public int ForwarderChain; 40 | public int NameRva; 41 | public int ImportAddressTable; 42 | } 43 | 44 | 45 | [StructLayout(LayoutKind.Sequential)] 46 | public struct _IMAGE_DEBUG_DIRECTORY { 47 | public uint Characteristics; 48 | public uint TimeDateStamp; 49 | public ushort MajorVersion; 50 | public ushort MinorVersion; 51 | public ImageDebugType Type; 52 | public uint SizeOfData; 53 | public uint AddressOfRawData; 54 | public uint PointerToRawData; 55 | } 56 | 57 | 58 | [StructLayout(LayoutKind.Sequential)] 59 | public struct IMAGE_LOAD_CONFIG_DIRECTORY64 { 60 | public uint Size; 61 | public uint TimeDateStamp; 62 | public ushort MajorVersion; 63 | public ushort MinorVersion; 64 | public uint GlobalFlagsClear; 65 | public uint GlobalFlagsSet; 66 | public uint CriticalSectionDefaultTimeout; 67 | public ulong DeCommitFreeBlockThreshold; 68 | public ulong DeCommitTotalFreeThreshold; 69 | public ulong LockPrefixTable; 70 | public ulong MaximumAllocationSize; 71 | public ulong VirtualMemoryThreshold; 72 | public ulong ProcessAffinityMask; 73 | public uint ProcessHeapFlags; 74 | public ushort CSDVersion; 75 | public ushort Reserved1; 76 | public ulong EditList; 77 | public ulong SecurityCookie; 78 | public ulong SEHandlerTable; 79 | public ulong SEHandlerCount; 80 | public ulong GuardCFCheckFunctionPointer; // VA 81 | public ulong GuardCFDispatchFunctionPointer; // VA 82 | public ulong GuardCFFunctionTable; // VA 83 | public ulong GuardCFFunctionCount; 84 | public ControlFlowGuardFlags GuardFlags; 85 | 86 | public IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; 87 | uint GuardAddressTakenIatEntryTable; // VA 88 | uint GuardAddressTakenIatEntryCount; 89 | uint GuardLongJumpTargetTable; // VA 90 | uint GuardLongJumpTargetCount; 91 | uint DynamicValueRelocTable; // VA 92 | uint HybridMetadataPointer; // VA 93 | } 94 | 95 | [StructLayout(LayoutKind.Sequential)] 96 | public struct IMAGE_LOAD_CONFIG_DIRECTORY32 { 97 | public uint Size; 98 | public uint TimeDateStamp; 99 | public ushort MajorVersion; 100 | public ushort MinorVersion; 101 | public uint GlobalFlagsClear; 102 | public uint GlobalFlagsSet; 103 | public uint CriticalSectionDefaultTimeout; 104 | public uint DeCommitFreeBlockThreshold; 105 | public uint DeCommitTotalFreeThreshold; 106 | public uint LockPrefixTable; 107 | public uint MaximumAllocationSize; 108 | public uint VirtualMemoryThreshold; 109 | public uint ProcessAffinityMask; 110 | public uint ProcessHeapFlags; 111 | public ushort CSDVersion; 112 | public ushort Reserved1; 113 | public uint EditList; 114 | public uint SecurityCookie; 115 | public uint SEHandlerTable; 116 | public uint SEHandlerCount; 117 | public uint GuardCFCheckFunctionPointer; // VA 118 | public uint GuardCFDispatchFunctionPointer; // VA 119 | public uint GuardCFFunctionTable; // VA 120 | public uint GuardCFFunctionCount; 121 | public ControlFlowGuardFlags GuardFlags; 122 | 123 | public IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; 124 | ulong GuardAddressTakenIatEntryTable; // VA 125 | ulong GuardAddressTakenIatEntryCount; 126 | ulong GuardLongJumpTargetTable; // VA 127 | ulong GuardLongJumpTargetCount; 128 | ulong DynamicValueRelocTable; // VA 129 | ulong HybridMetadataPointer; // VA 130 | } 131 | 132 | [StructLayout(LayoutKind.Sequential)] 133 | public struct IMAGE_LOAD_CONFIG_CODE_INTEGRITY { 134 | public ushort Flags; 135 | public ushort Catalog; 136 | public uint CatalogOffset; 137 | public uint Reserved; 138 | } 139 | } -------------------------------------------------------------------------------- /PEExplorer.Core/Enums.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace PEExplorer.Core { 8 | public enum SubsystemType : ushort { 9 | Unknown, 10 | Native, 11 | WindowsGUI, 12 | WindowsCUI, 13 | PosixCUI = 7, 14 | WindowsCEGUI = 9, 15 | EfiApplication = 10, 16 | EfiBootServiceDriver = 11, 17 | EfiRuntimeDriver = 12, 18 | EfiROM = 13, 19 | XBOX = 14 20 | } 21 | 22 | [Flags] 23 | public enum DllCharacteristics : ushort { 24 | None = 0, 25 | HighEntropyVA = 0x20, 26 | DynamicBase = 0x40, 27 | ForceIntegrity = 0x80, 28 | NxCompat = 0x100, 29 | NoIsolation = 0x200, 30 | NoSEH = 0x400, 31 | NoBind = 0x800, 32 | AppContainer = 0x1000, 33 | WDMDriver = 0x2000, 34 | ControlFlowGuard = 0x4000, 35 | TerminalServerAware = 0x8000 36 | } 37 | 38 | [Flags] 39 | public enum ImageCharacteristics : ushort { 40 | RelocsStripped = 1, 41 | ExecutableImage = 2, 42 | LineNumsStripped = 4, 43 | LocalSymbolsStripped = 8, 44 | AggressiveTrimWorkingSet = 0x10, 45 | LargeAddressAware = 0x20, 46 | LittleEndian = 0x80, 47 | Machine32Bit = 0x100, 48 | DebugInfoStripped = 0x200, 49 | RemovableRunFromSwap = 0x400, 50 | NetRunFromSwap = 0x800, 51 | SystemFile = 0x1000, 52 | DllFile = 0x2000, 53 | SingleCpuOnly = 0x4000, 54 | BigEndian = 0x8000 55 | } 56 | 57 | public enum ImageDebugType { 58 | Unknown, 59 | Coff, 60 | CodeView, 61 | Fpo, 62 | Misc, 63 | Exception, 64 | Fixup, 65 | Borland = 9 66 | } 67 | 68 | [Flags] 69 | public enum ControlFlowGuardFlags { 70 | Instrumented = 0x100, 71 | WriteInstrumented = 0x200, 72 | FunctionTablePresent = 0x400, 73 | SecurityCookieUnused = 0x800, 74 | ProtectDelayLoadIAT = 0x1000, 75 | DelayLoadIATOwnSection = 0x2000, 76 | ExportSuppressInfo = 0x4000, 77 | EnableExportSuppression = 0x8000, 78 | LongJumpTablePresent = 0x10000 79 | } 80 | } 81 | -------------------------------------------------------------------------------- /PEExplorer.Core/ExceptionTables.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Runtime.InteropServices; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | 8 | namespace PEExplorer.Core { 9 | [StructLayout(LayoutKind.Sequential)] 10 | public struct ExceptionTableEntry32 { 11 | public int BeginAddress; 12 | public int EndAddress; 13 | public int ExceptionHandler; 14 | public int HandlerData; 15 | public int PrologEndAddress; 16 | } 17 | 18 | [StructLayout(LayoutKind.Sequential)] 19 | public struct ExceptionTableEntry64 { 20 | public int BeginAddress; 21 | public int EndAddress; 22 | public int UnwindInformation; 23 | } 24 | } 25 | -------------------------------------------------------------------------------- /PEExplorer.Core/ExportedSymbol.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace PEExplorer.Core { 8 | public class ExportedSymbol { 9 | public string Name { get; set; } 10 | public int Ordinal { get; set; } 11 | public uint Address { get; set; } 12 | public string ForwardName { get; set; } 13 | public string UndecoratedName { get; set; } 14 | } 15 | } 16 | -------------------------------------------------------------------------------- /PEExplorer.Core/ImportedLibrary.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace PEExplorer.Core { 8 | public class ImportedLibrary { 9 | public string LibraryName { get; internal set; } 10 | 11 | public ICollection Symbols { get; } = new List(16); 12 | } 13 | } 14 | -------------------------------------------------------------------------------- /PEExplorer.Core/ImportedSymbol.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace PEExplorer.Core { 8 | public class ImportedSymbol { 9 | public string Name { get; set; } 10 | public int Hint { get; set; } 11 | public string UndecoratedName { get; set; } 12 | } 13 | } 14 | -------------------------------------------------------------------------------- /PEExplorer.Core/Interop/NativeTypes.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Runtime.InteropServices; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | 8 | namespace PEExplorer.Core.Interop { 9 | [StructLayout(LayoutKind.Explicit, Size = 64)] 10 | internal struct IMAGE_DOS_HEADER { 11 | public const short IMAGE_DOS_SIGNATURE = 0x5A4D; // MZ 12 | [FieldOffset(0)] 13 | public short e_magic; 14 | [FieldOffset(60)] 15 | public int e_lfanew; // Offset to the IMAGE_FILE_HEADER 16 | } 17 | 18 | [StructLayout(LayoutKind.Sequential, Pack = 1)] 19 | internal struct IMAGE_NT_HEADERS { 20 | public uint Signature; 21 | public IMAGE_FILE_HEADER FileHeader; 22 | } 23 | 24 | [StructLayout(LayoutKind.Sequential, Pack = 1)] 25 | internal struct IMAGE_FILE_HEADER { 26 | public ushort Machine; 27 | public ushort NumberOfSections; 28 | public uint TimeDateStamp; 29 | public uint PointerToSymbolTable; 30 | public uint NumberOfSymbols; 31 | public ushort SizeOfOptionalHeader; 32 | public ushort Characteristics; 33 | } 34 | 35 | [StructLayout(LayoutKind.Sequential, Pack = 1)] 36 | internal struct IMAGE_OPTIONAL_HEADER32 { 37 | public ushort Magic; 38 | public byte MajorLinkerVersion; 39 | public byte MinorLinkerVersion; 40 | public uint SizeOfCode; 41 | public uint SizeOfInitializedData; 42 | public uint SizeOfUninitializedData; 43 | public uint AddressOfEntryPoint; 44 | public uint BaseOfCode; 45 | public uint BaseOfData; 46 | public uint ImageBase; 47 | public uint SectionAlignment; 48 | public uint FileAlignment; 49 | public ushort MajorOperatingSystemVersion; 50 | public ushort MinorOperatingSystemVersion; 51 | public ushort MajorImageVersion; 52 | public ushort MinorImageVersion; 53 | public ushort MajorSubsystemVersion; 54 | public ushort MinorSubsystemVersion; 55 | public uint Win32VersionValue; 56 | public uint SizeOfImage; 57 | public uint SizeOfHeaders; 58 | public uint CheckSum; 59 | public ushort Subsystem; 60 | public ushort DllCharacteristics; 61 | public uint SizeOfStackReserve; 62 | public uint SizeOfStackCommit; 63 | public uint SizeOfHeapReserve; 64 | public uint SizeOfHeapCommit; 65 | public uint LoaderFlags; 66 | public uint NumberOfRvaAndSizes; 67 | } 68 | 69 | [StructLayout(LayoutKind.Sequential, Pack = 1)] 70 | internal struct IMAGE_OPTIONAL_HEADER64 { 71 | public ushort Magic; 72 | public byte MajorLinkerVersion; 73 | public byte MinorLinkerVersion; 74 | public uint SizeOfCode; 75 | public uint SizeOfInitializedData; 76 | public uint SizeOfUninitializedData; 77 | public uint AddressOfEntryPoint; 78 | public uint BaseOfCode; 79 | public ulong ImageBase; 80 | public uint SectionAlignment; 81 | public uint FileAlignment; 82 | public ushort MajorOperatingSystemVersion; 83 | public ushort MinorOperatingSystemVersion; 84 | public ushort MajorImageVersion; 85 | public ushort MinorImageVersion; 86 | public ushort MajorSubsystemVersion; 87 | public ushort MinorSubsystemVersion; 88 | public uint Win32VersionValue; 89 | public uint SizeOfImage; 90 | public uint SizeOfHeaders; 91 | public uint CheckSum; 92 | public ushort Subsystem; 93 | public ushort DllCharacteristics; 94 | public ulong SizeOfStackReserve; 95 | public ulong SizeOfStackCommit; 96 | public ulong SizeOfHeapReserve; 97 | public ulong SizeOfHeapCommit; 98 | public uint LoaderFlags; 99 | public uint NumberOfRvaAndSizes; 100 | } 101 | 102 | [StructLayout(LayoutKind.Sequential)] 103 | unsafe internal struct IMAGE_SECTION_HEADER { 104 | public string Name { 105 | get { 106 | fixed (byte* ptr = NameBytes) { 107 | if (ptr[7] == 0) 108 | return System.Runtime.InteropServices.Marshal.PtrToStringAnsi((IntPtr)ptr); 109 | else 110 | return System.Runtime.InteropServices.Marshal.PtrToStringAnsi((IntPtr)ptr, 8); 111 | } 112 | } 113 | } 114 | public fixed byte NameBytes[8]; 115 | public uint VirtualSize; 116 | public uint VirtualAddress; 117 | public uint SizeOfRawData; 118 | public uint PointerToRawData; 119 | public uint PointerToRelocations; 120 | public uint PointerToLinenumbers; 121 | public ushort NumberOfRelocations; 122 | public ushort NumberOfLinenumbers; 123 | public uint Characteristics; 124 | }; 125 | 126 | internal struct IMAGE_DEBUG_DIRECTORY { 127 | public int Characteristics; 128 | public int TimeDateStamp; 129 | public short MajorVersion; 130 | public short MinorVersion; 131 | public IMAGE_DEBUG_TYPE Type; 132 | public int SizeOfData; 133 | public int AddressOfRawData; 134 | public int PointerToRawData; 135 | }; 136 | 137 | internal enum IMAGE_DEBUG_TYPE { 138 | UNKNOWN = 0, 139 | COFF = 1, 140 | CODEVIEW = 2, 141 | FPO = 3, 142 | MISC = 4, 143 | BBT = 10, 144 | }; 145 | } 146 | -------------------------------------------------------------------------------- /PEExplorer.Core/LoadConfiguration.cs: -------------------------------------------------------------------------------- 1 | using DebugHelp; 2 | using Microsoft.Diagnostics.Runtime.Utilities; 3 | using System; 4 | using System.Collections.Generic; 5 | using System.Threading.Tasks; 6 | 7 | namespace PEExplorer.Core { 8 | public sealed class LoadConfiguration { 9 | IMAGE_LOAD_CONFIG_DIRECTORY32 _config32; 10 | IMAGE_LOAD_CONFIG_DIRECTORY64 _config64; 11 | PEParser _pefile; 12 | bool _is32bit; 13 | 14 | internal LoadConfiguration(PEParser pefile, ref IMAGE_LOAD_CONFIG_DIRECTORY32 config32) { 15 | _config32 = config32; 16 | _is32bit = true; 17 | _pefile = pefile; 18 | } 19 | 20 | internal LoadConfiguration(PEParser pefile, ref IMAGE_LOAD_CONFIG_DIRECTORY64 config64) { 21 | _config64 = config64; 22 | _pefile = pefile; 23 | } 24 | 25 | public uint TimeDateStamp => _is32bit ? _config32.TimeDateStamp : _config64.TimeDateStamp; 26 | public ushort MajorVersion => _is32bit ? _config32.MajorVersion : _config64.MajorVersion; 27 | public ushort MinorVersion => _is32bit ? _config32.MinorVersion : _config64.MinorVersion; 28 | 29 | public ulong CFGCheckFunctionPointer => _is32bit ? _config32.GuardCFCheckFunctionPointer : _config64.GuardCFCheckFunctionPointer; 30 | public ulong CFGDispatchFunctionPointer => _is32bit ? _config32.GuardCFDispatchFunctionPointer : _config64.GuardCFDispatchFunctionPointer; 31 | 32 | public ControlFlowGuardFlags GuardFlags => _is32bit ? _config32.GuardFlags : _config64.GuardFlags; 33 | 34 | public uint GlobalFlagsClear => _is32bit ? _config32.GlobalFlagsClear : _config64.GlobalFlagsClear; 35 | public uint GlobalFlagsSet => _is32bit ? _config32.GlobalFlagsSet : _config64.GlobalFlagsSet; 36 | 37 | public ulong CFGFunctionTable => _is32bit ? _config32.GuardCFFunctionTable : _config64.GuardCFFunctionTable; 38 | public ulong CFGFunctionCount => _is32bit ? _config32.GuardCFFunctionCount : _config64.GuardCFFunctionCount; 39 | 40 | public async Task> GetCFGFunctions() { 41 | var va = CFGFunctionTable - _pefile.Header.ImageBase; 42 | int count = (int)CFGFunctionCount; 43 | var symbols = new ExportedSymbol[count]; 44 | var offset = _pefile.Header.RvaToFileOffset((int)va); 45 | int lastIndex = -1; 46 | 47 | using(var handler = SymbolHandler.Create(SymbolOptions.UndecorateNames)) { 48 | var dllBase = await handler.TryLoadSymbolsForModuleAsync(_pefile.FileName); 49 | 50 | ulong disp; 51 | var symbol = new SymbolInfo(); 52 | for(int i = 0; i < count; i++) { 53 | var address = _pefile.Accessor.ReadUInt32(offset); 54 | string name = null; 55 | if(dllBase != 0) { 56 | if(handler.TryGetSymbolFromAddress(address + dllBase, ref symbol, out disp) && (lastIndex < 0 || symbol.Name != symbols[lastIndex].Name)) { 57 | name = symbol.Name; 58 | lastIndex = i; 59 | } 60 | } 61 | symbols[i] = new ExportedSymbol { Address = address, Name = name }; 62 | offset += 5; 63 | } 64 | } 65 | 66 | return symbols; 67 | } 68 | } 69 | } 70 | 71 | -------------------------------------------------------------------------------- /PEExplorer.Core/MachineType.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace PEExplorer.Core { 8 | public enum MachineType : ushort { 9 | Unknown = 0, 10 | X86 = 332, 11 | Arm = 0x1c0, 12 | Arm_NT = 0x1c4, 13 | IA64 = 512, 14 | Amd64 = 34404, 15 | Arm64 = 43620, 16 | 17 | } 18 | } 19 | -------------------------------------------------------------------------------- /PEExplorer.Core/PEExplorer.Core.csproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | AnyCPU 7 | {F5A21CBF-3DA6-4F54-A2BF-085325D2996F} 8 | Library 9 | Properties 10 | PEExplorer.Core 11 | PEExplorer.Core 12 | v4.6.1 13 | 512 14 | 15 | 16 | 17 | true 18 | full 19 | false 20 | bin\Debug\ 21 | DEBUG;TRACE 22 | prompt 23 | 4 24 | true 25 | 26 | 27 | pdbonly 28 | true 29 | bin\Release\ 30 | TRACE 31 | prompt 32 | 4 33 | true 34 | false 35 | 36 | 37 | 38 | ..\packages\DebugHelp.0.4.3\lib\net40\DebugHelp.dll 39 | 40 | 41 | ..\packages\Microsoft.Diagnostics.Runtime.0.9.170809.03\lib\net40\Microsoft.Diagnostics.Runtime.dll 42 | 43 | 44 | 45 | ..\packages\Prism.Core.6.3.0\lib\net45\Prism.dll 46 | 47 | 48 | 49 | ..\packages\System.Collections.Immutable.1.4.0\lib\portable-net45+win8+wp8+wpa81\System.Collections.Immutable.dll 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 92 | -------------------------------------------------------------------------------- /PEExplorer.Core/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System.Reflection; 2 | using System.Runtime.CompilerServices; 3 | using System.Runtime.InteropServices; 4 | 5 | // General Information about an assembly is controlled through the following 6 | // set of attributes. Change these attribute values to modify the information 7 | // associated with an assembly. 8 | [assembly: AssemblyTitle("PEExplorer.Core")] 9 | [assembly: AssemblyDescription("")] 10 | [assembly: AssemblyConfiguration("")] 11 | [assembly: AssemblyCompany("")] 12 | [assembly: AssemblyProduct("PEExplorer.Core")] 13 | [assembly: AssemblyCopyright("Copyright © 2016")] 14 | [assembly: AssemblyTrademark("")] 15 | [assembly: AssemblyCulture("")] 16 | 17 | // Setting ComVisible to false makes the types in this assembly not visible 18 | // to COM components. If you need to access a type in this assembly from 19 | // COM, set the ComVisible attribute to true on that type. 20 | [assembly: ComVisible(false)] 21 | 22 | // The following GUID is for the ID of the typelib if this project is exposed to COM 23 | [assembly: Guid("f5a21cbf-3da6-4f54-a2bf-085325d2996f")] 24 | 25 | // Version information for an assembly consists of the following four values: 26 | // 27 | // Major Version 28 | // Minor Version 29 | // Build Number 30 | // Revision 31 | // 32 | // You can specify all the values or you can default the Build and Revision Numbers 33 | // by using the '*' as shown below: 34 | // [assembly: AssemblyVersion("1.0.*")] 35 | [assembly: AssemblyVersion("1.0.0.0")] 36 | [assembly: AssemblyFileVersion("1.0.0.0")] 37 | -------------------------------------------------------------------------------- /PEExplorer.Core/ResourceID.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Reflection; 5 | using System.Runtime.InteropServices; 6 | using System.Text; 7 | using System.Threading.Tasks; 8 | 9 | namespace PEExplorer.Core { 10 | public sealed class ResourceID : IEquatable { 11 | static readonly ResourceID[] _standardResources; 12 | 13 | static ResourceID() { 14 | _standardResources = typeof(ResourceID).GetFields(BindingFlags.Public | BindingFlags.Static).Select(f => f.GetValue(null)).Cast().ToArray(); 15 | } 16 | 17 | public int Id { get; } 18 | public string Name { get; } 19 | public ResourceID(int id, string typename = null) { 20 | Id = id; 21 | if(typename == null) { 22 | var res = _standardResources.FirstOrDefault(r => r.IsId && r.Id == id); 23 | if(res != null) { 24 | typename = res.TypeName; 25 | IsStandard = true; 26 | } 27 | } 28 | else { 29 | IsStandard = true; 30 | } 31 | TypeName = typename; 32 | } 33 | 34 | public ResourceID(string name) { 35 | Name = TypeName = name; 36 | } 37 | 38 | public bool IsId => Name == null; 39 | 40 | public bool IsStandard { get; } 41 | 42 | public override string ToString() => IsId ? $"#{Id}" : Name; 43 | 44 | public bool Equals(ResourceID other) { 45 | return other.Id == Id && other.Name == Name; 46 | } 47 | 48 | public override int GetHashCode() { 49 | return IsId ? Id.GetHashCode() : Name.GetHashCode(); 50 | } 51 | 52 | public override bool Equals(object obj) { 53 | if(obj is ResourceID) 54 | return Equals((ResourceID)obj); 55 | return false; 56 | } 57 | 58 | unsafe struct FixedDisposable : IDisposable { 59 | internal GCHandle _handle; 60 | public FixedDisposable(string value = null) { 61 | _handle = GCHandle.Alloc(value, GCHandleType.Pinned); 62 | } 63 | public void Dispose() { 64 | _handle.Free(); 65 | } 66 | } 67 | 68 | public IDisposable GetAsIntPtr(out IntPtr ptr) { 69 | if(IsId) { 70 | ptr = new IntPtr(Id); 71 | return null; 72 | } 73 | var fix = new FixedDisposable(Name); 74 | ptr = fix._handle.AddrOfPinnedObject(); 75 | return fix; 76 | } 77 | 78 | public string TypeName { get; } 79 | 80 | public static readonly ResourceID Icon = new ResourceID(3, "Icon"); 81 | public static readonly ResourceID StringTable = new ResourceID(6, "String Table"); 82 | public static readonly ResourceID Accelerator = new ResourceID(9, "Accelerator"); 83 | public static readonly ResourceID AnimatedCursor = new ResourceID(21, "Animated Cursor"); 84 | public static readonly ResourceID Bitmap = new ResourceID(2, "Bitmap"); 85 | public static readonly ResourceID Dialog = new ResourceID(5, "Dialog"); 86 | public static readonly ResourceID Cursor = new ResourceID(1, "Cursor"); 87 | public static readonly ResourceID Font = new ResourceID(2, "Font"); 88 | public static readonly ResourceID Manifest = new ResourceID(24, "Manifest"); 89 | public static readonly ResourceID AnimatedIcon = new ResourceID(22, "Animated Icon"); 90 | public static readonly ResourceID FontDir = new ResourceID(7, "Font Directory"); 91 | public static readonly ResourceID GroupIcon = new ResourceID(14, "Icon Group"); 92 | public static readonly ResourceID GroupCursor = new ResourceID(12, "Cursor Group"); 93 | public static readonly ResourceID Menu = new ResourceID(4, "Menu"); 94 | public static readonly ResourceID Html = new ResourceID(23, "Html"); 95 | public static readonly ResourceID MessageTable = new ResourceID(11, "Message Table"); 96 | public static readonly ResourceID PlugPlay = new ResourceID(19, "Plug & PLay"); 97 | public static readonly ResourceID Version = new ResourceID(16, "Version"); 98 | public static readonly ResourceID RCData = new ResourceID(10, "RC Data"); 99 | public static readonly ResourceID DialogInclude = new ResourceID(17, "Dialog Include"); 100 | } 101 | } 102 | -------------------------------------------------------------------------------- /PEExplorer.Core/ResourceManager.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.ComponentModel; 4 | using System.Diagnostics; 5 | using System.Linq; 6 | using System.Runtime.InteropServices; 7 | using System.Text; 8 | using System.Threading.Tasks; 9 | using System.Windows; 10 | using System.Windows.Interop; 11 | using System.Windows.Media; 12 | using System.Windows.Media.Imaging; 13 | 14 | namespace PEExplorer.Core { 15 | 16 | public sealed class ResourceManager : IDisposable { 17 | readonly IntPtr _hModule; 18 | 19 | public ResourceManager(string path) { 20 | _hModule = Win32.LoadLibraryEx(path, IntPtr.Zero, Win32.LoadLibraryFlags.LoadAsDataFile | Win32.LoadLibraryFlags.LoadAsImageResource); 21 | if(_hModule == IntPtr.Zero) 22 | throw new Win32Exception(Marshal.GetLastWin32Error()); 23 | } 24 | 25 | void Dispose(bool disposing) { 26 | Win32.FreeLibrary(_hModule); 27 | if(disposing) 28 | GC.SuppressFinalize(this); 29 | } 30 | 31 | public void Dispose() { 32 | Dispose(true); 33 | } 34 | 35 | ~ResourceManager() { 36 | Dispose(false); 37 | } 38 | 39 | readonly StringBuilder _text = new StringBuilder(2048); 40 | 41 | public string GetResourceString(ResourceID id) { 42 | Win32.LoadString(_hModule, id.Id, _text, _text.Capacity); 43 | return _text.ToString(); 44 | } 45 | 46 | public ICollection GetStringTableContent(ResourceID name) { 47 | var content = GetResourceContent(name, ResourceID.StringTable); 48 | var index = 0; 49 | var strings = new List(8); 50 | for(int i = 0; i < 16; i++) { // 16 is max strings in string table 51 | var length = BitConverter.ToInt16(content, index); 52 | index += 2; 53 | if(length == 0) 54 | continue; 55 | 56 | 57 | strings.Add(new StringResource { 58 | Id = i, 59 | Value = Encoding.Unicode.GetString(content, index, length * 2) 60 | }); 61 | index += length * 2; 62 | } 63 | 64 | return strings; 65 | } 66 | 67 | public unsafe ICollection GetResourceTypes() { 68 | var types = new List(); 69 | Win32.EnumResourceTypes(_hModule, (handle, ptr, param) => { 70 | if((long)ptr < 0x10000) 71 | types.Add(new ResourceID((int)ptr)); 72 | else 73 | types.Add(new ResourceID(new string((char*)ptr))); 74 | return true; 75 | }, IntPtr.Zero); 76 | return types; 77 | } 78 | 79 | public unsafe ICollection GetResourceNames(ResourceID type) { 80 | var names = new List(); 81 | Win32.EnumResNameProc proc = (module, typeName, name, param) => { 82 | if((long)name < 0x10000) 83 | names.Add(new ResourceID((int)name)); 84 | else 85 | names.Add(new ResourceID(new string((char*)name))); 86 | return true; 87 | }; 88 | 89 | if(type.IsId) 90 | Win32.EnumResourceNames(_hModule, new IntPtr(type.Id), proc, IntPtr.Zero); 91 | else 92 | Win32.EnumResourceNames(_hModule, type.Name, proc, IntPtr.Zero); 93 | return names; 94 | } 95 | 96 | public byte[] GetResourceContent(ResourceID name, ResourceID type) { 97 | IntPtr iname, itype; 98 | using(var d1 = name.GetAsIntPtr(out iname)) { 99 | using(var d2 = type.GetAsIntPtr(out itype)) { 100 | var hResource = Win32.FindResource(_hModule, iname, itype); 101 | if(hResource == IntPtr.Zero) return null; 102 | 103 | var hGlobal = Win32.LoadResource(_hModule, hResource); 104 | if(hGlobal == IntPtr.Zero) return null; 105 | 106 | var size = Win32.SizeofResource(_hModule, hResource); 107 | var ptr = Win32.LockResource(hGlobal); 108 | 109 | var buffer = new byte[size]; 110 | Marshal.Copy(ptr, buffer, 0, buffer.Length); 111 | return buffer; 112 | } 113 | } 114 | } 115 | 116 | public ImageSource GetIconImage(ResourceID id, bool icon) { 117 | IntPtr iconName; 118 | using(var d = id.GetAsIntPtr(out iconName)) { 119 | var hIcon = Win32.LoadImage(_hModule, iconName, icon ? Win32.ImageType.Icon : Win32.ImageType.Cursor, 0, 0, Win32.LoadImageFlags.None); 120 | if(hIcon == IntPtr.Zero) { 121 | var bytes = GetResourceContent(id, icon ? ResourceID.Icon : ResourceID.Cursor); 122 | hIcon = Win32.CreateIconFromResource(bytes, bytes.Length, icon, 0x30000); 123 | if(hIcon == IntPtr.Zero) 124 | return null; 125 | } 126 | 127 | var source = Imaging.CreateBitmapSourceFromHIcon(hIcon, Int32Rect.Empty, BitmapSizeOptions.FromEmptyOptions()); 128 | if(icon) 129 | Win32.DestroyIcon(hIcon); 130 | else 131 | Win32.DestroyCursor(hIcon); 132 | 133 | return source; 134 | } 135 | } 136 | 137 | public ImageSource GetBitmapImage(ResourceID id) { 138 | IntPtr bitmapName; 139 | using(var d = id.GetAsIntPtr(out bitmapName)) { 140 | var hBitmap = Win32.LoadImage(_hModule, bitmapName, Win32.ImageType.Bitmap, 0, 0, Win32.LoadImageFlags.CreateDibSection); 141 | if(hBitmap == IntPtr.Zero) return null; 142 | 143 | var source = Imaging.CreateBitmapSourceFromHBitmap(hBitmap, IntPtr.Zero, Int32Rect.Empty, BitmapSizeOptions.FromEmptyOptions()); 144 | Win32.DeleteObject(hBitmap); 145 | return source; 146 | } 147 | } 148 | } 149 | } 150 | -------------------------------------------------------------------------------- /PEExplorer.Core/SectionData.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace PEExplorer.Core { 8 | public class SectionData { 9 | SectionHeader _header; 10 | internal SectionData(SectionHeader header) { 11 | _header = header; 12 | } 13 | 14 | public string Name => _header.Name; 15 | public uint VirtualSize => _header.VirtualSize; 16 | public uint VirtualAddress => _header.VirtualAddress; 17 | public uint SizeOfRawData => _header.SizeOfRawData; 18 | public uint PointerToRawData => _header.PointerToRawData; 19 | public uint PointerToRelocations => _header.PointerToRelocations; 20 | public uint PointerToLineNumbers => _header.PointerToLinenumbers; 21 | 22 | public ushort NumberOfRelocations => _header.NumberOfRelocations; 23 | public ushort NumberOfLineNumbers => _header.NumberOfLinenumbers; 24 | public SectionFlags Characteristics => _header.Characteristics; 25 | 26 | } 27 | } 28 | -------------------------------------------------------------------------------- /PEExplorer.Core/SectionHeader.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Runtime.InteropServices; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | 8 | namespace PEExplorer.Core { 9 | [Flags] 10 | public enum SectionFlags : uint { 11 | NoPad = 8, 12 | Code = 0x20, 13 | InitializedData = 0x40, 14 | UninitializedData = 0x80, 15 | Other = 0x100, 16 | Info = 0x200, 17 | Remove = 0x800, 18 | Comdat = 0x1000, 19 | GPRel = 0x80000, 20 | Align1Byte = 0x100000, 21 | Align2Bytes = 0x200000, 22 | ExtendedReloc = 0x1000000, 23 | Discardable = 0x2000000, 24 | NotCached = 0x4000000, 25 | NotPaged = 0x8000000, 26 | Shared = 0x10000000, 27 | Execute = 0x20000000, 28 | Read = 0x40000000, 29 | Write = 0x80000000, 30 | } 31 | 32 | [StructLayout(LayoutKind.Sequential)] 33 | public unsafe struct SectionHeader { 34 | public string Name { 35 | get { 36 | fixed (byte* ptr = NameBytes) { 37 | if(ptr[7] == 0) 38 | return Marshal.PtrToStringAnsi((IntPtr)ptr); 39 | else 40 | return Marshal.PtrToStringAnsi((IntPtr)ptr, 8); 41 | } 42 | } 43 | } 44 | public fixed byte NameBytes[8]; 45 | public uint VirtualSize; 46 | public uint VirtualAddress; 47 | public uint SizeOfRawData; 48 | public uint PointerToRawData; 49 | public uint PointerToRelocations; 50 | public uint PointerToLinenumbers; 51 | public ushort NumberOfRelocations; 52 | public ushort NumberOfLinenumbers; 53 | public SectionFlags Characteristics; 54 | }; 55 | } 56 | -------------------------------------------------------------------------------- /PEExplorer.Core/StringResource.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace PEExplorer.Core { 8 | public class StringResource { 9 | public int Id { get; set; } 10 | public string Value { get; set; } 11 | } 12 | } 13 | -------------------------------------------------------------------------------- /PEExplorer.Core/Win32.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Runtime.InteropServices; 5 | using System.Security; 6 | using System.Text; 7 | using System.Threading.Tasks; 8 | 9 | namespace PEExplorer.Core { 10 | [SuppressUnmanagedCodeSecurity] 11 | static class Win32 { 12 | [Flags] 13 | public enum LoadLibraryFlags : uint { 14 | LoadAsImageResource = 0x20, 15 | LoadAsDataFile = 0x2, 16 | LoadAsDataFileExclusive = 0x40 17 | } 18 | 19 | public enum ImageType { 20 | Bitmap, 21 | Icon, 22 | Cursor 23 | } 24 | 25 | [Flags] 26 | public enum LoadImageFlags { 27 | None = 0, 28 | DefaultSize = 0x40, 29 | CreateDibSection = 0x2000 30 | } 31 | 32 | [return:MarshalAs(UnmanagedType.Bool)] 33 | public delegate bool EnumResTypeProc(IntPtr hModule, IntPtr typeName, IntPtr param); 34 | public delegate bool EnumResNameProc(IntPtr hModule, IntPtr typeName, IntPtr name, IntPtr param); 35 | 36 | [DllImport("kernel32", SetLastError = true, CharSet = CharSet.Unicode)] 37 | public static extern bool EnumResourceTypes(IntPtr hModule, EnumResTypeProc enumProc, IntPtr param); 38 | 39 | [DllImport("kernel32", SetLastError = true, CharSet = CharSet.Unicode)] 40 | public static extern bool EnumResourceNames(IntPtr hModule, IntPtr typeName, EnumResNameProc enumProc, IntPtr param); 41 | 42 | [DllImport("kernel32", SetLastError = true, CharSet = CharSet.Unicode)] 43 | public static extern bool EnumResourceNames(IntPtr hModule, string typeName, EnumResNameProc enumProc, IntPtr param); 44 | 45 | [DllImport("kernel32", SetLastError = true, CharSet = CharSet.Unicode)] 46 | public static extern IntPtr FindResource(IntPtr hModule, string name, string typeName); 47 | 48 | [DllImport("kernel32", SetLastError = true, CharSet = CharSet.Unicode)] 49 | public static extern IntPtr LoadResource(IntPtr hModule, IntPtr hResInfo); 50 | 51 | [DllImport("kernel32", SetLastError = true, CharSet = CharSet.Unicode)] 52 | public static extern uint SizeofResource(IntPtr hModule, IntPtr hResInfo); 53 | 54 | [DllImport("kernel32", SetLastError = true, CharSet = CharSet.Unicode)] 55 | public static extern IntPtr LockResource(IntPtr hResData); 56 | 57 | 58 | [DllImport("kernel32", SetLastError = true, CharSet = CharSet.Unicode)] 59 | public static extern IntPtr LoadLibraryEx(string path, IntPtr handle, LoadLibraryFlags flags); 60 | 61 | [DllImport("kernel32")] 62 | public static extern bool FreeLibrary(IntPtr hModule); 63 | 64 | [DllImport("kernel32", CharSet = CharSet.Unicode)] 65 | public static extern IntPtr FindResource(IntPtr hModule, IntPtr name, IntPtr type); 66 | 67 | [DllImport("user32", CharSet = CharSet.Unicode)] 68 | public static extern IntPtr LoadIcon(IntPtr hModule, IntPtr name); 69 | 70 | [DllImport("user32")] 71 | public static extern bool DestroyIcon(IntPtr hIcon); 72 | 73 | [DllImport("user32")] 74 | public static extern bool DestroyCursor(IntPtr hCursor); 75 | 76 | [DllImport("user32", CharSet = CharSet.Unicode, SetLastError = true)] 77 | public static extern IntPtr LoadImage(IntPtr hModule, IntPtr name, ImageType type, int width, int height, LoadImageFlags flags); 78 | 79 | [DllImport("user32", CharSet = CharSet.Unicode, SetLastError = true)] 80 | public static extern IntPtr LoadImage(IntPtr hModule, string name, ImageType type, int width, int height, LoadImageFlags flags); 81 | 82 | [DllImport("gdi32")] 83 | public static extern bool DeleteObject(IntPtr hObject); 84 | 85 | [DllImport("user32")] 86 | public static extern IntPtr CreateIconFromResource([MarshalAs(UnmanagedType.LPArray)] byte[] bits, int size, bool isIcon, uint version); 87 | 88 | [DllImport("user32", CharSet = CharSet.Unicode)] 89 | public static extern int LoadString(IntPtr hModule, int id, StringBuilder buffer, int maxSize); 90 | } 91 | } 92 | -------------------------------------------------------------------------------- /PEExplorer.Core/app.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | -------------------------------------------------------------------------------- /PEExplorer.Core/packages.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | 7 | -------------------------------------------------------------------------------- /PEExplorer.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 15 4 | VisualStudioVersion = 15.0.27130.2010 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PEExplorer", "PEExplorer\PEExplorer.csproj", "{04B7AC75-B8A9-4530-B2CB-913DF1EF13DB}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|Any CPU = Debug|Any CPU 11 | Release|Any CPU = Release|Any CPU 12 | EndGlobalSection 13 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 14 | {04B7AC75-B8A9-4530-B2CB-913DF1EF13DB}.Debug|Any CPU.ActiveCfg = Debug|Any CPU 15 | {04B7AC75-B8A9-4530-B2CB-913DF1EF13DB}.Debug|Any CPU.Build.0 = Debug|Any CPU 16 | {04B7AC75-B8A9-4530-B2CB-913DF1EF13DB}.Release|Any CPU.ActiveCfg = Release|Any CPU 17 | {04B7AC75-B8A9-4530-B2CB-913DF1EF13DB}.Release|Any CPU.Build.0 = Release|Any CPU 18 | EndGlobalSection 19 | GlobalSection(SolutionProperties) = preSolution 20 | HideSolutionNode = FALSE 21 | EndGlobalSection 22 | GlobalSection(ExtensibilityGlobals) = postSolution 23 | SolutionGuid = {4490559E-476C-484E-8421-787A9257E06C} 24 | EndGlobalSection 25 | EndGlobal 26 | -------------------------------------------------------------------------------- /PEExplorer/App.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | -------------------------------------------------------------------------------- /PEExplorer/App.xaml: -------------------------------------------------------------------------------- 1 |  6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | -------------------------------------------------------------------------------- /PEExplorer/App.xaml.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.ComponentModel.Composition; 4 | using System.ComponentModel.Composition.Hosting; 5 | using System.Configuration; 6 | using System.Data; 7 | using System.Linq; 8 | using System.Reflection; 9 | using System.Threading.Tasks; 10 | using System.Windows; 11 | using PEExplorer.ViewModels; 12 | using Zodiacon.WPF; 13 | using System.Runtime.CompilerServices; 14 | 15 | namespace PEExplorer { 16 | /// 17 | /// Interaction logic for App.xaml 18 | /// 19 | public partial class App : Application { 20 | MainViewModel _mainViewModel; 21 | 22 | public App() { 23 | 24 | } 25 | 26 | protected override void OnStartup(StartupEventArgs e) { 27 | base.OnStartup(e); 28 | 29 | var container = new CompositionContainer( 30 | new AggregateCatalog( 31 | new AssemblyCatalog(Assembly.GetExecutingAssembly()), 32 | new AssemblyCatalog(typeof(IDialogService).Assembly))); 33 | 34 | var defaults = new UIServicesDefaults(); 35 | 36 | container.ComposeExportedValue(container); 37 | container.ComposeExportedValue(defaults.DialogService); 38 | container.ComposeExportedValue(defaults.FileDialogService); 39 | container.ComposeExportedValue(defaults.MessageBoxService); 40 | 41 | var vm = _mainViewModel = container.GetExportedValue(); 42 | var win = new MainWindow { DataContext = vm }; 43 | win.Show(); 44 | if (e.Args.Length > 0) 45 | vm.OpenInternal(e.Args[0], false); 46 | } 47 | 48 | protected override void OnExit(ExitEventArgs e) { 49 | _mainViewModel.Close(); 50 | base.OnExit(e); 51 | } 52 | } 53 | } 54 | -------------------------------------------------------------------------------- /PEExplorer/Assemblies/DebugHelp.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Assemblies/DebugHelp.dll -------------------------------------------------------------------------------- /PEExplorer/Assemblies/MahApps.Metro.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Assemblies/MahApps.Metro.dll -------------------------------------------------------------------------------- /PEExplorer/Assemblies/Microsoft.Diagnostics.Runtime.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Assemblies/Microsoft.Diagnostics.Runtime.dll -------------------------------------------------------------------------------- /PEExplorer/Assemblies/Microsoft.Expression.Interactions.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Assemblies/Microsoft.Expression.Interactions.dll -------------------------------------------------------------------------------- /PEExplorer/Assemblies/Prism.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Assemblies/Prism.dll -------------------------------------------------------------------------------- /PEExplorer/Assemblies/SharpDisasm.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Assemblies/SharpDisasm.dll -------------------------------------------------------------------------------- /PEExplorer/Assemblies/System.Collections.Immutable.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Assemblies/System.Collections.Immutable.dll -------------------------------------------------------------------------------- /PEExplorer/Assemblies/System.Windows.Interactivity.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Assemblies/System.Windows.Interactivity.dll -------------------------------------------------------------------------------- /PEExplorer/Assemblies/Zodiacon.WPF.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Assemblies/Zodiacon.WPF.dll -------------------------------------------------------------------------------- /PEExplorer/Constants.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace PEExplorer { 8 | static class Constants { 9 | public const string AppName = "PE Explorer v0.64"; 10 | public const string Copyright = "by Pavel Yosifovich (C)2016-2019"; 11 | public static string EmptyTitle = $"{AppName} {Copyright}"; 12 | } 13 | } 14 | -------------------------------------------------------------------------------- /PEExplorer/Converters/BytesToStringConverter.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Globalization; 4 | using System.Linq; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | using System.Windows.Data; 8 | 9 | namespace PEExplorer.Converters { 10 | class BytesToStringConverter : IValueConverter { 11 | public object Convert(object value, Type targetType, object parameter, CultureInfo culture) { 12 | return string.Join(" ", ((byte[])value).Select(v => v.ToString("X2"))); 13 | } 14 | 15 | public object ConvertBack(object value, Type targetType, object parameter, CultureInfo culture) { 16 | throw new NotImplementedException(); 17 | } 18 | } 19 | } 20 | -------------------------------------------------------------------------------- /PEExplorer/Converters/ResourceTemplateSelector.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using System.Windows; 7 | using System.Windows.Controls; 8 | using PEExplorer.ViewModels; 9 | using PEExplorer.ViewModels.Resources; 10 | 11 | namespace PEExplorer.Converters { 12 | class ResourceTemplateSelector : DataTemplateSelector { 13 | public DataTemplate DefaultTemplate { get; set; } 14 | static readonly DataTemplate _empty = new DataTemplate(); 15 | 16 | public override DataTemplate SelectTemplate(object item, DependencyObject container) { 17 | if(item != null) { 18 | if(item is ResourceTypeViewModel) 19 | return _empty; 20 | 21 | var resourceId = item as ResourceViewModel; 22 | if(resourceId != null) { 23 | if(resourceId.Type.ResourceType.IsStandard) { 24 | DataTemplate template; 25 | template = ((FrameworkElement)container).TryFindResource($"ResourceType{resourceId.Type.ResourceType.Id}") as DataTemplate; 26 | if(template != null) 27 | return template; 28 | if(DefaultTemplate != null) 29 | return DefaultTemplate; 30 | } 31 | else 32 | return DefaultTemplate; 33 | } 34 | } 35 | return base.SelectTemplate(item, container); 36 | } 37 | } 38 | } 39 | -------------------------------------------------------------------------------- /PEExplorer/Extensions.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace PEExplorer { 8 | static class Extensions { 9 | public static IEnumerable TakeWhileIncluding(this IEnumerable collection, Func predicate) { 10 | var enumerator = collection.GetEnumerator(); 11 | while(enumerator.MoveNext()) { 12 | yield return enumerator.Current; 13 | if(!predicate(enumerator.Current)) 14 | break; 15 | } 16 | } 17 | 18 | public static IEnumerable TakeWhileIncluding(this IEnumerable collection, Func predicate) { 19 | var enumerator = collection.GetEnumerator(); 20 | int i = 0; 21 | while (enumerator.MoveNext()) { 22 | yield return enumerator.Current; 23 | if (!predicate(enumerator.Current, i)) 24 | break; 25 | ++i; 26 | } 27 | } 28 | } 29 | } 30 | -------------------------------------------------------------------------------- /PEExplorer/Helpers/DateTimeHelper.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace PEExplorer.Helpers { 8 | public static class DateTimeHelper { 9 | public static DateTime FromSeconds(uint seconds) => new DateTime(1970, 1, 1) + TimeSpan.FromSeconds((double)seconds); 10 | 11 | public static DateTime ToDateTime(uint timeDateStamp) => new DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc) + TimeSpan.FromSeconds(timeDateStamp); 12 | 13 | } 14 | } 15 | -------------------------------------------------------------------------------- /PEExplorer/Helpers/Serializer.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.IO; 4 | using System.Linq; 5 | using System.Runtime.Serialization; 6 | using System.Text; 7 | using System.Threading.Tasks; 8 | 9 | namespace PEExplorer.Helpers { 10 | static class Serializer { 11 | public static void Save(T obj, Stream stm) where T : class { 12 | var writer = new DataContractSerializer(typeof(T)); 13 | writer.WriteObject(stm, obj); 14 | } 15 | 16 | public static void Save(T obj, string filename) where T : class { 17 | var path = GetPath(filename); 18 | 19 | try { 20 | using(var stm = File.Open(path, FileMode.Create)) 21 | Save(obj, stm); 22 | } 23 | catch { 24 | } 25 | } 26 | 27 | public static T Load(Stream stm) where T : class { 28 | var reader = new DataContractSerializer(typeof(T)); 29 | return reader.ReadObject(stm) as T; 30 | } 31 | 32 | public static T Load(string filename) where T : class { 33 | var path = GetPath(filename); 34 | try { 35 | using(var stm = File.Open(path, FileMode.Open)) 36 | return Load(stm); 37 | } 38 | catch { 39 | return null; 40 | } 41 | } 42 | 43 | private static string GetPath(string filename) { 44 | var path = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData, Environment.SpecialFolderOption.Create) + @"\PEExplorer"; 45 | if(!Directory.Exists(path)) 46 | Directory.CreateDirectory(path); 47 | path += "\\" + filename; 48 | return path; 49 | } 50 | } 51 | } 52 | 53 | -------------------------------------------------------------------------------- /PEExplorer/Icons/apiset.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/apiset.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/binary.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/binary.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/close.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/close.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/close2.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/close2.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/config.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/config.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/cpu.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/cpu.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/data.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/data.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/debug.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/debug.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/dependencies.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/dependencies.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/exceptions.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/exceptions.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/explorer.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/explorer.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/export1.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/export1.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/folder.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/folder.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/general.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/general.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/iat.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/iat.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/import2.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/import2.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/library.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/library.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/open-new.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/open-new.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/open.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/open.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/registry.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/registry.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/res.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/res.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/resources.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/resources.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/save.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/save.ico -------------------------------------------------------------------------------- /PEExplorer/Icons/sections.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/PEExplorer/Icons/sections.ico -------------------------------------------------------------------------------- /PEExplorer/MainWindow.xaml: -------------------------------------------------------------------------------- 1 |  15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | -------------------------------------------------------------------------------- /PEExplorer/MainWindow.xaml.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using System.Windows; 7 | using System.Windows.Controls; 8 | using System.Windows.Data; 9 | using System.Windows.Documents; 10 | using System.Windows.Input; 11 | using System.Windows.Media; 12 | using System.Windows.Media.Imaging; 13 | using System.Windows.Navigation; 14 | using System.Windows.Shapes; 15 | 16 | namespace PEExplorer { 17 | /// 18 | /// Interaction logic for MainWindow.xaml 19 | /// 20 | public partial class MainWindow { 21 | public MainWindow() { 22 | InitializeComponent(); 23 | } 24 | } 25 | } 26 | -------------------------------------------------------------------------------- /PEExplorer/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System.Reflection; 2 | using System.Resources; 3 | using System.Runtime.CompilerServices; 4 | using System.Runtime.InteropServices; 5 | using System.Windows; 6 | 7 | // General Information about an assembly is controlled through the following 8 | // set of attributes. Change these attribute values to modify the information 9 | // associated with an assembly. 10 | [assembly: AssemblyTitle("PEExplorer")] 11 | [assembly: AssemblyDescription("")] 12 | [assembly: AssemblyConfiguration("")] 13 | [assembly: AssemblyCompany("")] 14 | [assembly: AssemblyProduct("PEExplorer")] 15 | [assembly: AssemblyCopyright("Copyright © 2016")] 16 | [assembly: AssemblyTrademark("")] 17 | [assembly: AssemblyCulture("")] 18 | 19 | // Setting ComVisible to false makes the types in this assembly not visible 20 | // to COM components. If you need to access a type in this assembly from 21 | // COM, set the ComVisible attribute to true on that type. 22 | [assembly: ComVisible(false)] 23 | 24 | //In order to begin building localizable applications, set 25 | //CultureYouAreCodingWith in your .csproj file 26 | //inside a . For example, if you are using US english 27 | //in your source files, set the to en-US. Then uncomment 28 | //the NeutralResourceLanguage attribute below. Update the "en-US" in 29 | //the line below to match the UICulture setting in the project file. 30 | 31 | //[assembly: NeutralResourcesLanguage("en-US", UltimateResourceFallbackLocation.Satellite)] 32 | 33 | 34 | [assembly: ThemeInfo( 35 | ResourceDictionaryLocation.None, //where theme specific resource dictionaries are located 36 | //(used if a resource is not found in the page, 37 | // or application resource dictionaries) 38 | ResourceDictionaryLocation.SourceAssembly //where the generic resource dictionary is located 39 | //(used if a resource is not found in the page, 40 | // app, or any theme specific resource dictionaries) 41 | )] 42 | 43 | 44 | // Version information for an assembly consists of the following four values: 45 | // 46 | // Major Version 47 | // Minor Version 48 | // Build Number 49 | // Revision 50 | // 51 | // You can specify all the values or you can default the Build and Revision Numbers 52 | // by using the '*' as shown below: 53 | // [assembly: AssemblyVersion("1.0.*")] 54 | [assembly: AssemblyVersion("0.6.*")] 55 | [assembly: AssemblyFileVersion("1.0.0.0")] 56 | -------------------------------------------------------------------------------- /PEExplorer/Properties/Resources.Designer.cs: -------------------------------------------------------------------------------- 1 | //------------------------------------------------------------------------------ 2 | // 3 | // This code was generated by a tool. 4 | // Runtime Version:4.0.30319.42000 5 | // 6 | // Changes to this file may cause incorrect behavior and will be lost if 7 | // the code is regenerated. 8 | // 9 | //------------------------------------------------------------------------------ 10 | 11 | namespace PEExplorer.Properties { 12 | using System; 13 | 14 | 15 | /// 16 | /// A strongly-typed resource class, for looking up localized strings, etc. 17 | /// 18 | // This class was auto-generated by the StronglyTypedResourceBuilder 19 | // class via a tool like ResGen or Visual Studio. 20 | // To add or remove a member, edit your .ResX file then rerun ResGen 21 | // with the /str option, or rebuild your VS project. 22 | [global::System.CodeDom.Compiler.GeneratedCodeAttribute("System.Resources.Tools.StronglyTypedResourceBuilder", "15.0.0.0")] 23 | [global::System.Diagnostics.DebuggerNonUserCodeAttribute()] 24 | [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()] 25 | internal class Resources { 26 | 27 | private static global::System.Resources.ResourceManager resourceMan; 28 | 29 | private static global::System.Globalization.CultureInfo resourceCulture; 30 | 31 | [global::System.Diagnostics.CodeAnalysis.SuppressMessageAttribute("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode")] 32 | internal Resources() { 33 | } 34 | 35 | /// 36 | /// Returns the cached ResourceManager instance used by this class. 37 | /// 38 | [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)] 39 | internal static global::System.Resources.ResourceManager ResourceManager { 40 | get { 41 | if (object.ReferenceEquals(resourceMan, null)) { 42 | global::System.Resources.ResourceManager temp = new global::System.Resources.ResourceManager("PEExplorer.Properties.Resources", typeof(Resources).Assembly); 43 | resourceMan = temp; 44 | } 45 | return resourceMan; 46 | } 47 | } 48 | 49 | /// 50 | /// Overrides the current thread's CurrentUICulture property for all 51 | /// resource lookups using this strongly typed resource class. 52 | /// 53 | [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)] 54 | internal static global::System.Globalization.CultureInfo Culture { 55 | get { 56 | return resourceCulture; 57 | } 58 | set { 59 | resourceCulture = value; 60 | } 61 | } 62 | } 63 | } 64 | -------------------------------------------------------------------------------- /PEExplorer/Properties/Resources.resx: -------------------------------------------------------------------------------- 1 |  2 | 3 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | 97 | 98 | 99 | 100 | 101 | 102 | 103 | 104 | 105 | 106 | text/microsoft-resx 107 | 108 | 109 | 2.0 110 | 111 | 112 | System.Resources.ResXResourceReader, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 113 | 114 | 115 | System.Resources.ResXResourceWriter, System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 116 | 117 | -------------------------------------------------------------------------------- /PEExplorer/Properties/Settings.Designer.cs: -------------------------------------------------------------------------------- 1 | //------------------------------------------------------------------------------ 2 | // 3 | // This code was generated by a tool. 4 | // Runtime Version:4.0.30319.42000 5 | // 6 | // Changes to this file may cause incorrect behavior and will be lost if 7 | // the code is regenerated. 8 | // 9 | //------------------------------------------------------------------------------ 10 | 11 | namespace PEExplorer.Properties { 12 | 13 | 14 | [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()] 15 | [global::System.CodeDom.Compiler.GeneratedCodeAttribute("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "15.8.0.0")] 16 | internal sealed partial class Settings : global::System.Configuration.ApplicationSettingsBase { 17 | 18 | private static Settings defaultInstance = ((Settings)(global::System.Configuration.ApplicationSettingsBase.Synchronized(new Settings()))); 19 | 20 | public static Settings Default { 21 | get { 22 | return defaultInstance; 23 | } 24 | } 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /PEExplorer/Properties/Settings.settings: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | 7 | -------------------------------------------------------------------------------- /PEExplorer/Properties/app.manifest: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | 7 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 48 | 55 | 56 | 70 | -------------------------------------------------------------------------------- /PEExplorer/Resources/Templates.xaml: -------------------------------------------------------------------------------- 1 |  8 | 9 | 10 | 13 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 94 | 95 | 96 | 97 | 98 | 99 | 100 | 101 | 102 | 103 | 104 | 105 | 109 | 110 | 111 | 112 | 113 | 114 | 117 | 118 | 119 | 120 | 121 | 122 | 123 | 124 | 125 | 126 | 127 | 128 | 129 | 130 | 131 | 132 | 133 | 134 | 135 | 136 | 141 | 142 | 143 | 144 | 145 | 146 | 147 | 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 161 | 162 | 163 | 164 | 165 | 166 | 167 | 168 | 169 | 170 | 171 | -------------------------------------------------------------------------------- /PEExplorer/Settings.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace PEExplorer { 8 | class Settings { 9 | public bool IsTopmost { get; set; } 10 | public string AccentColor { get; set; } 11 | } 12 | } 13 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/DisassemblyViewModel.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using System.Windows; 7 | using SharpDisasm; 8 | using Zodiacon.WPF; 9 | using SharpDisasm.Udis86; 10 | 11 | namespace PEExplorer.ViewModels { 12 | class DisassemblyViewModel : DialogViewModelBase { 13 | public string SymbolName { get; } 14 | 15 | public DisassemblyViewModel(Window dialog, string symbolName) : base(dialog) { 16 | SymbolName = symbolName; 17 | } 18 | 19 | public void Disassemble(byte[] code, int address, bool x64) { 20 | Disassembler.Translator.IncludeAddress = true; 21 | Disassembler.Translator.IncludeBinary = true; 22 | using(var disassem = new Disassembler(code, x64 ? ArchitectureMode.x86_64 : ArchitectureMode.x86_32, (ulong)address, true)) { 23 | Instructions = disassem.Disassemble().TakeWhileIncluding((i, c) => c < 1000 && 24 | i.Mnemonic != ud_mnemonic_code.UD_Iret && i.Mnemonic != ud_mnemonic_code.UD_Iint3). 25 | Select(i => new InstructionViewModel(i)); 26 | } 27 | } 28 | 29 | private IEnumerable _instructions; 30 | 31 | public IEnumerable Instructions { 32 | get { return _instructions; } 33 | set { SetProperty(ref _instructions, value); } 34 | } 35 | 36 | public string Title => $"Disassembly: {SymbolName}"; 37 | } 38 | } 39 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/GenericProperty.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace PEExplorer.ViewModels { 8 | class GenericProperty { 9 | public string Name { get; set; } 10 | public string Value { get; set; } 11 | public string Info { get; set; } 12 | } 13 | } 14 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/InstructionViewModel.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using SharpDisasm; 7 | 8 | namespace PEExplorer.ViewModels { 9 | class InstructionViewModel { 10 | public Instruction Instruction { get; } 11 | 12 | public InstructionViewModel(Instruction instruction) { 13 | Instruction = instruction; 14 | } 15 | 16 | public string Bytes => string.Join(" ", Instruction.Bytes); 17 | 18 | public string Address => Instruction.Offset.ToString("X8"); 19 | 20 | public string Text => Instruction.ToString().Substring(8); 21 | 22 | } 23 | } 24 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/PEHeaderProperty.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace PEExplorer.ViewModels { 8 | class PEHeaderProperty { 9 | public string Name { get; set; } 10 | public string Value { get; set; } 11 | public string Info { get; set; } 12 | } 13 | } 14 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/Resources/ImageResourceViewModel.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using System.Windows.Media; 7 | using Zodiacon.PEParsing; 8 | 9 | namespace PEExplorer.ViewModels.Resources { 10 | class ImageResourceViewModel : ResourceViewModel { 11 | public ImageResourceViewModel(ResourceID id, ResourceTypeViewModel type) : base(id, type) { 12 | } 13 | 14 | ImageSource _image; 15 | public ImageSource Icon => _image ?? (_image = Type.ResourceManager.GetIconImage(ResourceId, true)); 16 | public ImageSource Cursor => _image ?? (_image = Type.ResourceManager.GetIconImage(ResourceId, false)); 17 | 18 | public ImageSource Bitmap => _image ?? (_image = Type.ResourceManager.GetBitmapImage(ResourceId)); 19 | public override bool CustomViewPossible => true; 20 | 21 | } 22 | } 23 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/Resources/ResourceTypeViewModel.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.ComponentModel.Composition; 4 | using System.Linq; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | using Zodiacon.PEParsing; 8 | 9 | namespace PEExplorer.ViewModels.Resources { 10 | class ResourceTypeViewModel { 11 | public ResourceID ResourceType { get; internal set; } 12 | public ICollection Resources { get; } = new List(); 13 | 14 | public ResourceManager ResourceManager { get; } 15 | 16 | [Import] 17 | public MainViewModel MainViewModel; 18 | 19 | public ResourceTypeViewModel(ResourceManager mgr) { 20 | ResourceManager = mgr; 21 | } 22 | 23 | static readonly Dictionary _viewModels = new Dictionary { 24 | { ResourceID.Icon, typeof(ImageResourceViewModel) }, 25 | { ResourceID.Cursor, typeof(ImageResourceViewModel) }, 26 | { ResourceID.Bitmap, typeof(ImageResourceViewModel) }, 27 | { ResourceID.GroupCursor, typeof(ImageResourceViewModel) }, 28 | { ResourceID.GroupIcon, typeof(ImageResourceViewModel) }, 29 | { ResourceID.StringTable, typeof(StringResourceViewModel) }, 30 | { ResourceID.Manifest, typeof(TextResourceViewModel) }, 31 | }; 32 | 33 | internal ResourceViewModel CreateResourceViewModel(ResourceID resource) { 34 | if(!ResourceType.IsStandard) 35 | return new ResourceViewModel(resource, this); 36 | 37 | Type viewModelType; 38 | if(!_viewModels.TryGetValue(ResourceType, out viewModelType)) 39 | return new ResourceViewModel(resource, this); 40 | 41 | return (ResourceViewModel)Activator.CreateInstance(viewModelType, resource, this); 42 | } 43 | 44 | public bool CustomViewPossible => false; 45 | 46 | } 47 | } 48 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/Resources/ResourceViewModel.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.ComponentModel.Composition; 4 | using System.Globalization; 5 | using System.IO; 6 | using System.Linq; 7 | using System.Text; 8 | using System.Threading.Tasks; 9 | using System.Windows; 10 | using System.Windows.Input; 11 | using System.Windows.Interop; 12 | using System.Windows.Media; 13 | using System.Windows.Media.Imaging; 14 | using Prism.Commands; 15 | using Prism.Mvvm; 16 | using Zodiacon.PEParsing; 17 | using Zodiacon.WPF; 18 | 19 | namespace PEExplorer.ViewModels.Resources { 20 | class ResourceViewModel : BindableBase { 21 | public ResourceID ResourceId { get; } 22 | public ResourceTypeViewModel Type { get; } 23 | 24 | public ResourceViewModel(ResourceID id, ResourceTypeViewModel type) { 25 | ResourceId = id; 26 | Type = type; 27 | } 28 | 29 | byte[] _bytes; 30 | 31 | private int _chunk = 1; 32 | 33 | public int Chunk { 34 | get { return _chunk; } 35 | set { 36 | if(SetProperty(ref _chunk, value)) { 37 | RaisePropertyChanged(nameof(HexText)); 38 | } 39 | } 40 | } 41 | 42 | private int _lineWidth = 16; 43 | 44 | public int LineWidth { 45 | get { return _lineWidth; } 46 | set { 47 | if(SetProperty(ref _lineWidth, value)) { 48 | RaisePropertyChanged(nameof(HexText)); 49 | } 50 | } 51 | } 52 | 53 | static Dictionary> _converters = new Dictionary> { 54 | { 1, (arr, index) => arr[index].ToString("X2") }, 55 | { 2, (arr, index) => BitConverter.ToUInt16(arr, index).ToString("X4") }, 56 | { 4, (arr, index) => BitConverter.ToUInt32(arr, index).ToString("X8") }, 57 | { 8, (arr, index) => BitConverter.ToUInt64(arr, index).ToString("X16") }, 58 | }; 59 | 60 | public int ResourceSize => (_bytes ?? (_bytes = GetContents())).Length; 61 | 62 | public byte[] GetContents() => _bytes ?? (_bytes = Type.ResourceManager.GetResourceContent(ResourceId, Type.ResourceType)); 63 | 64 | public string HexText { 65 | get { 66 | var bytes = GetContents(); 67 | if(bytes == null) 68 | return string.Empty; 69 | var encoding = IsASCII ? Encoding.ASCII : Encoding.Unicode; 70 | var count = ResourceSize; 71 | var sb = new StringBuilder(1024); 72 | for(int i = 0; i < count; i += Chunk) { 73 | if(i % LineWidth == 0) 74 | sb.Append($"{i:X4}: "); 75 | if(i + Chunk > count) 76 | continue; 77 | sb.Append(_converters[Chunk](bytes, i)).Append(" "); 78 | var lastLine = i == count - Chunk; 79 | if(i % LineWidth == LineWidth - Chunk || lastLine) { 80 | // add ASCII/Unicode characters 81 | var str = new string(encoding.GetString(_bytes, lastLine ? i - (count % LineWidth) + 1 : i - LineWidth + Chunk, lastLine ? count % LineWidth : LineWidth). 82 | Select(ch => char.GetUnicodeCategory(ch) == UnicodeCategory.Control || char.GetUnicodeCategory(ch) == UnicodeCategory.Format ? '.' : ch) 83 | .ToArray()); 84 | if(lastLine) 85 | sb.Append(new string(' ', (LineWidth - str.Length * (IsASCII ? 1 : 2)) / Chunk * (Chunk * 2 + 1))); 86 | sb.Append(" ").Append(str).AppendLine(); 87 | } 88 | } 89 | return sb.ToString(); 90 | } 91 | } 92 | 93 | private bool _rawView; 94 | 95 | public bool RawView { 96 | get { return _rawView; } 97 | set { SetProperty(ref _rawView, value); } 98 | } 99 | 100 | private bool _is8Bytes; 101 | 102 | public bool Is8Bytes { 103 | get { return _is8Bytes; } 104 | set { 105 | if(SetProperty(ref _is8Bytes, value) && value) { 106 | Is16Bytes = Is32Bytes = false; 107 | LineWidth = 8; 108 | } 109 | } 110 | } 111 | 112 | public virtual bool CustomViewPossible => false; 113 | 114 | private bool _is16Bytes = true; 115 | 116 | public bool Is16Bytes { 117 | get { return _is16Bytes; } 118 | set { 119 | if(SetProperty(ref _is16Bytes, value) && value) { 120 | Is8Bytes = Is32Bytes = false; 121 | LineWidth = 16; 122 | } 123 | } 124 | } 125 | 126 | private bool _is32Bytes; 127 | 128 | public bool Is32Bytes { 129 | get { return _is32Bytes; } 130 | set { 131 | if(SetProperty(ref _is32Bytes, value) && value) { 132 | Is8Bytes = Is16Bytes = false; 133 | LineWidth = 32; 134 | } 135 | } 136 | } 137 | 138 | private bool _isASCII = true; 139 | 140 | public bool IsASCII { 141 | get { return _isASCII; } 142 | set { 143 | if(SetProperty(ref _isASCII, value) && value) { 144 | IsUTF16 = false; 145 | RaisePropertyChanged(nameof(HexText)); 146 | } 147 | } 148 | } 149 | 150 | private bool _isUTF16; 151 | 152 | public bool IsUTF16 { 153 | get { return _isUTF16; } 154 | set { 155 | if(SetProperty(ref _isUTF16, value) && value) { 156 | IsASCII = false; 157 | RaisePropertyChanged(nameof(HexText)); 158 | }; 159 | } 160 | } 161 | 162 | private bool _is1Chunk = true; 163 | 164 | public bool Is1Chunk { 165 | get { return _is1Chunk; } 166 | set { 167 | if(SetProperty(ref _is1Chunk, value) && value) { 168 | Is2Chunk = Is4Chunk = Is8Chunk = false; 169 | Chunk = 1; 170 | } 171 | } 172 | } 173 | 174 | private bool _is2Chunk; 175 | 176 | public bool Is2Chunk { 177 | get { return _is2Chunk; } 178 | set { 179 | if(SetProperty(ref _is2Chunk, value) && value) { 180 | Is1Chunk = Is4Chunk = Is8Chunk = false; 181 | Chunk = 2; 182 | } 183 | } 184 | } 185 | 186 | private bool _is4Chunk; 187 | 188 | public bool Is4Chunk { 189 | get { return _is4Chunk; } 190 | set { 191 | if(SetProperty(ref _is4Chunk, value) && value) { 192 | Is2Chunk = Is1Chunk = Is8Chunk = false; 193 | Chunk = 4; 194 | } 195 | } 196 | } 197 | 198 | private bool _is8Chunk; 199 | 200 | public bool Is8Chunk { 201 | get { return _is8Chunk; } 202 | set { 203 | if(SetProperty(ref _is8Chunk, value) && value) { 204 | Is2Chunk = Is4Chunk = Is1Chunk = false; 205 | Chunk = 8; 206 | } 207 | } 208 | } 209 | 210 | 211 | } 212 | } 213 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/Resources/StringResourceViewModel.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using Zodiacon.PEParsing; 7 | 8 | namespace PEExplorer.ViewModels.Resources { 9 | class StringResourceViewModel : ResourceViewModel { 10 | public StringResourceViewModel(ResourceID id, ResourceTypeViewModel type) : base(id, type) { 11 | } 12 | 13 | ICollection _strings; 14 | 15 | public ICollection Strings => _strings ?? (_strings = Type.ResourceManager.GetStringTableContent(ResourceId)); 16 | 17 | public override bool CustomViewPossible => true; 18 | 19 | } 20 | } 21 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/Resources/TextResourceViewModel.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using Zodiacon.PEParsing; 7 | 8 | namespace PEExplorer.ViewModels.Resources { 9 | class TextResourceViewModel : ResourceViewModel { 10 | public TextResourceViewModel(ResourceID id, ResourceTypeViewModel type) : base(id, type) { 11 | } 12 | 13 | public string ManifestText => Type.ResourceManager.GetManifest(ResourceId); 14 | 15 | public override bool CustomViewPossible => true; 16 | } 17 | } 18 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/TabViewModelBase.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.ComponentModel.Composition; 4 | using System.Linq; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | using System.Windows.Input; 8 | using Prism.Commands; 9 | using Prism.Mvvm; 10 | 11 | namespace PEExplorer.ViewModels { 12 | abstract class TabViewModelBase : BindableBase { 13 | public abstract string Icon { get; } 14 | public abstract string Text { get; } 15 | 16 | public virtual bool CanClose => true; 17 | 18 | protected MainViewModel MainViewModel { get; } 19 | 20 | protected TabViewModelBase(MainViewModel vm) { 21 | MainViewModel = vm; 22 | } 23 | 24 | public string ToDecHex(ulong n) => $"{n} (0x{n:X})"; 25 | 26 | } 27 | 28 | } 29 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/Tabs/CLRTabViewModel.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.ComponentModel.Composition; 4 | using System.IO; 5 | using System.Linq; 6 | using System.Reflection; 7 | using System.Text; 8 | using System.Threading.Tasks; 9 | 10 | namespace PEExplorer.ViewModels.Tabs { 11 | [Export, PartCreationPolicy(CreationPolicy.NonShared)] 12 | class CLRTabViewModel : TabViewModelBase { 13 | [ImportingConstructor] 14 | public CLRTabViewModel(MainViewModel vm) : base(vm) { 15 | } 16 | 17 | public override string Icon => "/icons/cpu.ico"; 18 | 19 | public override string Text => "CLR"; 20 | } 21 | 22 | } 23 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/Tabs/DebugTabViewModel.cs: -------------------------------------------------------------------------------- 1 | using PEExplorer.Helpers; 2 | using System; 3 | using System.Collections.Generic; 4 | using System.ComponentModel.Composition; 5 | using System.Linq; 6 | using System.Text; 7 | using System.Threading.Tasks; 8 | 9 | namespace PEExplorer.ViewModels.Tabs { 10 | [Export, PartCreationPolicy(CreationPolicy.NonShared)] 11 | class DebugTabViewModel : TabViewModelBase { 12 | [ImportingConstructor] 13 | public DebugTabViewModel(MainViewModel vm) : base(vm) { 14 | } 15 | 16 | public override string Icon => "/icons/debug.ico"; 17 | 18 | public override string Text => "Debug"; 19 | 20 | public IEnumerable Properties { 21 | get { 22 | var debug = MainViewModel.Parser.GetDebugInformation(); 23 | yield return new GenericProperty { 24 | Name = "Time Stamp", 25 | Value = ToDecHex(debug.TimeDateStamp), 26 | Info = DateTimeHelper.ToDateTime(debug.TimeDateStamp).ToString("F") 27 | }; 28 | yield return new GenericProperty { 29 | Name = "Debug Type", 30 | Value = debug.DebugType.ToString() 31 | }; 32 | yield return new GenericProperty { 33 | Name = "Major version", 34 | Value = debug.MajorVersion.ToString() 35 | }; 36 | yield return new GenericProperty { 37 | Name = "Minor Version", 38 | Value = debug.MinorVersion.ToString() 39 | }; 40 | yield return new GenericProperty { 41 | Name = "Size of Data", 42 | Value = ToDecHex(debug.SizeOfData) 43 | }; 44 | yield return new GenericProperty { 45 | Name = "Address of Raw Data", 46 | Value = ToDecHex(debug.AddressOfRawData) 47 | }; 48 | yield return new GenericProperty { 49 | Name = "Pointer to Raw Data", 50 | Value = ToDecHex(debug.PointerToRawData) 51 | }; 52 | 53 | } 54 | } 55 | } 56 | } 57 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/Tabs/DependenciesTabViewModel.cs: -------------------------------------------------------------------------------- 1 | using Prism.Mvvm; 2 | using System; 3 | using System.Collections.Generic; 4 | using System.Collections.ObjectModel; 5 | using System.ComponentModel.Composition; 6 | using System.Diagnostics; 7 | using System.IO; 8 | using System.IO.MemoryMappedFiles; 9 | using System.Linq; 10 | using System.Text; 11 | using System.Threading.Tasks; 12 | using Zodiacon.PEParsing; 13 | 14 | namespace PEExplorer.ViewModels.Tabs { 15 | sealed class DependencyTreeItem : BindableBase { 16 | DependenciesTabViewModel _tab; 17 | 18 | public DependencyTreeItem(DependenciesTabViewModel tab, string filename, bool apiSet, IEnumerable exports = null) { 19 | FilePath = filename; 20 | IsApiSet = apiSet; 21 | _tab = tab; 22 | _exports = exports; 23 | } 24 | 25 | public string Text { get; set; } 26 | public string Icon { get; set; } 27 | public string FilePath { get; set; } 28 | public bool IsApiSet { get; } 29 | 30 | private bool _isExpanded; 31 | 32 | public bool IsExpanded { 33 | get { return _isExpanded; } 34 | set { SetProperty(ref _isExpanded, value); } 35 | } 36 | 37 | private bool _isSelected; 38 | 39 | public bool IsSelected { 40 | get { return _isSelected; } 41 | set { SetProperty(ref _isSelected, value); } 42 | } 43 | 44 | IEnumerable _exports; 45 | public IEnumerable Exports { 46 | get { 47 | if (_exports == null) { 48 | if (IsApiSet) { 49 | if (_tab.Imports.TryGetValue(FilePath, out var library)) 50 | _exports = library.Symbols; 51 | } 52 | else { 53 | try { 54 | using (var parser = new PEParser(FilePath)) { 55 | _exports = parser.GetExports(); 56 | } 57 | } 58 | catch { } 59 | } 60 | } 61 | return _exports; 62 | } 63 | } 64 | 65 | List _items; 66 | public IEnumerable Items { 67 | get { 68 | if (IsApiSet) 69 | return null; 70 | 71 | if (_items == null) { 72 | _items = new List(8); 73 | using (var parser = new PEParser(FilePath)) { 74 | var imports = parser.GetImports(); 75 | if (imports == null) 76 | return _items; 77 | foreach (var library in imports) { 78 | var path = Environment.SystemDirectory + "\\" + library.LibraryName; 79 | 80 | bool apiSet = library.LibraryName.StartsWith("api-ms-"); 81 | _items.Add(new DependencyTreeItem(_tab, apiSet ? library.LibraryName : path, apiSet) { 82 | Text = library.LibraryName, 83 | Icon = apiSet ? "/icons/apiset.ico" : "/icons/library.ico", 84 | }); 85 | } 86 | } 87 | } 88 | return _items; 89 | } 90 | } 91 | } 92 | 93 | [Export, PartCreationPolicy(CreationPolicy.NonShared)] 94 | sealed class DependenciesTabViewModel : TabViewModelBase, IPartImportsSatisfiedNotification { 95 | DependencyTreeItem[] _items; 96 | public DependencyTreeItem[] Dependencies => _items ?? (_items = _root.Items.ToArray()); 97 | 98 | [ImportingConstructor] 99 | public DependenciesTabViewModel(MainViewModel vm) : base(vm) { 100 | } 101 | 102 | public override string Icon => "/icons/dependencies.ico"; 103 | 104 | public override string Text => "Dependencies"; 105 | 106 | DependencyTreeItem _root; 107 | 108 | public DependencyTreeItem PEImage => _root ?? (_root = new DependencyTreeItem(this, MainViewModel.PathName, false, 109 | MainViewModel.Parser.GetExports()) { 110 | Text = MainViewModel.FileName, 111 | Icon = "/icons/data.ico", 112 | }); 113 | 114 | private DependencyTreeItem _selectedItem; 115 | 116 | public DependencyTreeItem SelectedItem { 117 | get { return _selectedItem; } 118 | set { SetProperty(ref _selectedItem, value); } 119 | } 120 | 121 | public Dictionary Imports { get; private set; } 122 | 123 | public void OnImportsSatisfied() { 124 | var imports = MainViewModel.Parser.GetImports(); 125 | if (imports != null) { 126 | Imports = imports.ToDictionary(library => library.LibraryName); 127 | } 128 | } 129 | } 130 | } 131 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/Tabs/ExceptionsTabViewModel.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.ComponentModel.Composition; 4 | using System.Linq; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | 8 | namespace PEExplorer.ViewModels.Tabs { 9 | [Export, PartCreationPolicy(CreationPolicy.NonShared)] 10 | class ExceptionsTabViewModel : TabViewModelBase { 11 | [ImportingConstructor] 12 | public ExceptionsTabViewModel(MainViewModel vm) : base(vm) { 13 | } 14 | 15 | public override string Icon => "/icons/exceptions.ico"; 16 | 17 | public override string Text => "Exceptions"; 18 | } 19 | } 20 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/Tabs/ExportsTabViewModel.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.ComponentModel.Composition; 4 | using System.IO; 5 | using System.IO.MemoryMappedFiles; 6 | using System.Linq; 7 | using System.Runtime.InteropServices; 8 | using System.Text; 9 | using System.Threading.Tasks; 10 | using System.Windows.Data; 11 | using System.Windows.Input; 12 | using PEExplorer.Views; 13 | using Prism.Commands; 14 | using Zodiacon.PEParsing; 15 | using Zodiacon.WPF; 16 | 17 | namespace PEExplorer.ViewModels.Tabs { 18 | [Export, PartCreationPolicy(CreationPolicy.NonShared)] 19 | class ExportsTabViewModel : TabViewModelBase { 20 | [ImportingConstructor] 21 | public ExportsTabViewModel(MainViewModel mainViewModel) : base(mainViewModel) { 22 | DisassembleCommand = new DelegateCommand(() => { 23 | var symbol = SelectedItem; 24 | var vm = DialogService.CreateDialog(symbol.Name); 25 | var address = (int)symbol.Address; 26 | var parser = mainViewModel.Parser; 27 | 28 | parser.ReadArray(parser.RvaToFileOffset(address), _bytes); 29 | vm.Disassemble(_bytes, address, MainViewModel.Parser.IsPE64); 30 | vm.Show(); 31 | }, () => SelectedItem != null && string.IsNullOrEmpty(SelectedItem.ForwardName)).ObservesProperty(() => SelectedItem); 32 | } 33 | 34 | public override string Icon => "/icons/export1.ico"; 35 | 36 | public override string Text => "Exports"; 37 | 38 | ICollection _exports; 39 | 40 | public unsafe ICollection Exports { 41 | get { 42 | if(_exports == null) { 43 | _exports = MainViewModel.Parser.GetExports(); 44 | } 45 | return _exports; 46 | } 47 | } 48 | 49 | private string _searchText; 50 | 51 | public string SearchText { 52 | get { return _searchText; } 53 | set { 54 | if(SetProperty(ref _searchText, value)) { 55 | var view = CollectionViewSource.GetDefaultView(Exports); 56 | if(string.IsNullOrWhiteSpace(value)) 57 | view.Filter = null; 58 | else { 59 | var lower = value.ToLower(); 60 | view.Filter = o => { 61 | var symbol = (ExportedSymbol)o; 62 | return symbol.Name.ToLower().Contains(lower) || (symbol.ForwardName != null && symbol.ForwardName.ToLower().Contains(lower)); 63 | }; 64 | } 65 | } 66 | } 67 | } 68 | 69 | [Import] 70 | IDialogService DialogService; 71 | 72 | static byte[] _bytes = new byte[1 << 12]; 73 | 74 | public ICommand DisassembleCommand { get; } 75 | 76 | private ExportedSymbol _selectedItem; 77 | 78 | public ExportedSymbol SelectedItem { 79 | get { return _selectedItem; } 80 | set { SetProperty(ref _selectedItem, value); } 81 | } 82 | 83 | public string StatusMessage => $"{Exports.Count} Functions"; 84 | 85 | } 86 | } 87 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/Tabs/GeneralTabViewModel.cs: -------------------------------------------------------------------------------- 1 | using PEExplorer.Helpers; 2 | using System; 3 | using System.Collections.Generic; 4 | using System.ComponentModel.Composition; 5 | using System.Linq; 6 | using System.Text; 7 | using System.Threading.Tasks; 8 | using System.Windows.Data; 9 | using Zodiacon.PEParsing; 10 | 11 | namespace PEExplorer.ViewModels.Tabs { 12 | [Export, PartCreationPolicy(CreationPolicy.NonShared)] 13 | class GeneralTabViewModel : TabViewModelBase { 14 | [ImportingConstructor] 15 | public GeneralTabViewModel(MainViewModel vm) : base(vm) { 16 | } 17 | 18 | public override bool CanClose => false; 19 | 20 | public override string Icon => "/icons/General.ico"; 21 | 22 | public override string Text => "General"; 23 | 24 | public string FullPathName => MainViewModel.PathName; 25 | 26 | IEnumerable _headerProperties; 27 | 28 | public IEnumerable HeaderProperties { 29 | get { 30 | if(_headerProperties == null) { 31 | var header = MainViewModel.PEHeader; 32 | var fileHeader = MainViewModel.Parser.FileHeader; 33 | 34 | _headerProperties = new List { 35 | new GenericProperty { Name = "Base of Code", Value = ToDecHex(header.BaseOfCode) }, 36 | new GenericProperty { Name = "Address of Entry Point", Value = ToDecHex(header.AddressOfEntryPoint) }, 37 | new GenericProperty { Name = "Image Base", Value = ToDecHex(header.ImageBase) }, 38 | new GenericProperty { Name = "Is Managed?", Value = header.IsManaged.ToString() }, 39 | new GenericProperty { Name = "Machine", Value = ((ushort)fileHeader.Machine).ToString(), Info = fileHeader.Machine.ToString() }, 40 | new GenericProperty { Name = "Magic", Value = ToDecHex((ushort)header.Magic), Info = MagicToPEFormat((ushort)header.Magic) }, 41 | new GenericProperty { Name = "Major Image Version", Value = header.MajorImageVersion.ToString() }, 42 | new GenericProperty { Name = "Minor Image Version", Value = header.MinorImageVersion.ToString() }, 43 | new GenericProperty { Name = "Major Linker Version", Value = header.MajorLinkerVersion.ToString() }, 44 | new GenericProperty { Name = "Minor Linker Version", Value = header.MinorLinkerVersion.ToString() }, 45 | new GenericProperty { Name = "Loader Flags", Value = ToDecHex(header.LoaderFlags) }, 46 | new GenericProperty { Name = "Subsystem", Value = header.Subsystem.ToString(), Info = ((SubsystemType)header.Subsystem).ToString() }, 47 | new GenericProperty { Name = "Characteristics", Value = ToDecHex((ulong)fileHeader.Characteristics), Info = fileHeader.Characteristics.ToString() }, 48 | new GenericProperty { Name = "Dll Characteristics", Value = ToDecHex((ulong)header.DllCharacteristics), Info = header.DllCharacteristics.ToString() }, 49 | new GenericProperty { Name = "File Alignment", Value = ToDecHex(header.FileAlignment) }, 50 | new GenericProperty { Name = "Size of Code", Value = ToDecHex(header.SizeOfCode) }, 51 | new GenericProperty { Name = "Size of Image", Value = ToDecHex(header.SizeOfImage) }, 52 | new GenericProperty { Name = "Major OS Version", Value = header.MajorOperatingSystemVersion.ToString() }, 53 | new GenericProperty { Name = "Minor OS Version", Value = header.MinorOperatingSystemVersion.ToString() }, 54 | new GenericProperty { Name = "Major Subsystem Version", Value = header.MajorSubsystemVersion.ToString() }, 55 | new GenericProperty { Name = "Minor Subsystem Version", Value = header.MinorSubsystemVersion.ToString() }, 56 | new GenericProperty { Name = "Size of Headers", Value = ToDecHex(header.SizeOfHeaders) }, 57 | new GenericProperty { Name = "Size of Stack Commit", Value = ToDecHex(header.SizeOfStackCommit) }, 58 | new GenericProperty { Name = "Size of Stack Reserve", Value = ToDecHex(header.SizeOfStackReserve) }, 59 | new GenericProperty { Name = "Size of Heap Commit", Value = ToDecHex(header.SizeOfHeapCommit) }, 60 | new GenericProperty { Name = "Size of Heap Reserve", Value = ToDecHex(header.SizeOfHeapReserve) }, 61 | new GenericProperty { Name = "Size of Uninitialized Data", Value = ToDecHex(header.SizeOfUninitializedData) }, 62 | new GenericProperty { Name = "Size of Initialized Data", Value = ToDecHex(header.SizeOfInitializedData) }, 63 | new GenericProperty { Name = "Size of Optional Header", Value = ToDecHex(fileHeader.SizeOfOptionalHeader) }, 64 | new GenericProperty { Name = "Date Time Stamp", Value = ToDecHex(fileHeader.TimeDateStamp), Info = DateTimeHelper.ToDateTime(fileHeader.TimeDateStamp).ToString("F") }, 65 | new GenericProperty { Name = "Section Alignment", Value = ToDecHex(header.SectionAlignment) }, 66 | new GenericProperty { Name = "Pointer to Symbol Table", Value = ToDecHex(fileHeader.PointerToSymbolTable) }, 67 | new GenericProperty { Name = "Number of Sections", Value = fileHeader.NumberOfSections.ToString() }, 68 | new GenericProperty { Name = "Number of Symbols", Value = fileHeader.NumberOfSymbols.ToString() }, 69 | new GenericProperty { Name = "Number of RVA and Sizes", Value = header.NumberOfRvaAndSizes.ToString() }, 70 | new GenericProperty { Name = "Signature", Value = ToDecHex(MainViewModel.Parser.Signature) }, 71 | new GenericProperty { Name = "Checksum", Value = ToDecHex(header.CheckSum) }, 72 | header.ImportAddressTableDirectory.Size == 0 ? null : new GenericProperty { Name = "Import Address Table Directory", Value = FromDirectory(header.ImportAddressTableDirectory) }, 73 | header.ImportDirectory.Size == 0 ? null : new GenericProperty { Name = "Import Directory", Value = FromDirectory(header.ImportDirectory) }, 74 | header.ResourceDirectory.Size == 0 ? null : new GenericProperty { Name = "Resource Directory", Value = FromDirectory(header.ResourceDirectory) }, 75 | header.BaseRelocationDirectory.Size == 0 ? null : new GenericProperty { Name = "Base Relocation Directory", Value = FromDirectory(header.BaseRelocationDirectory) }, 76 | header.BoundImportDirectory.Size == 0 ? null : new GenericProperty { Name = "Bound Import Directory", Value = FromDirectory(header.BoundImportDirectory) }, 77 | header.ExceptionDirectory.Size == 0 ? null : new GenericProperty { Name = "Exception Directory", Value = FromDirectory(header.ExceptionDirectory) }, 78 | header.ExportDirectory.Size == 0 ? null : new GenericProperty { Name = "Export Directory", Value = FromDirectory(header.ExportDirectory) }, 79 | header.LoadConfigurationDirectory.Size == 0 ? null : new GenericProperty { Name = "Load Configuration Directory", Value = FromDirectory(header.LoadConfigurationDirectory) }, 80 | new GenericProperty { Name = "Global Pointer", Value = ToDecHex((uint)header.GlobalPointerDirectory.VirtualAddress) }, 81 | header.ComDescriptorDirectory.Size == 0 ? null : new GenericProperty { Name = "CLR Descriptor Directory", Value = FromDirectory(header.ComDescriptorDirectory) }, 82 | header.DebugDirectory.Size == 0 ? null : new GenericProperty { Name = "Debug Directory", Value = FromDirectory(header.DebugDirectory) }, 83 | header.DelayImportDirectory.Size == 0 ? null : new GenericProperty { Name = "Delay Import Directory", Value = FromDirectory(header.DelayImportDirectory) }, 84 | header.ArchitectureDirectory.Size == 0 ? null : new GenericProperty { Name = "Architecture Directory", Value = FromDirectory(header.ArchitectureDirectory) }, 85 | header.ThreadLocalStorageDirectory.Size == 0 ? null : new GenericProperty { Name = "Thread Storage Directory", Value = FromDirectory(header.ThreadLocalStorageDirectory) }, 86 | header.CertificatesDirectory.Size == 0 ? null : new GenericProperty { Name = "Certificate Directory", Value = FromDirectory(header.CertificatesDirectory) }, 87 | }.Where(p => p != null).OrderBy(p => p.Name); 88 | } 89 | return _headerProperties; 90 | } 91 | } 92 | 93 | private string FromDirectory(DataDirectory dir) { 94 | return $"Offset: {ToDecHex((uint)dir.VirtualAddress)}, Size:{ToDecHex((uint)dir.Size)}"; 95 | } 96 | 97 | private string MagicToPEFormat(ushort magic) { 98 | switch(magic) { 99 | case 0x10b: return "PE32"; 100 | case 0x20b: return "PE32+"; 101 | case 0x107: return "ROM"; 102 | } 103 | return "Unknown"; 104 | } 105 | 106 | private string _searchText; 107 | 108 | public string SearchText { 109 | get { return _searchText; } 110 | set { if(SetProperty(ref _searchText, value)) { 111 | var view = CollectionViewSource.GetDefaultView(HeaderProperties); 112 | if(string.IsNullOrWhiteSpace(value)) 113 | view.Filter = null; 114 | else { 115 | var name = value.ToLower(); 116 | view.Filter = o => ((GenericProperty)o).Name.ToLower().Contains(name); 117 | } 118 | } 119 | } 120 | } 121 | 122 | public string StatusMessage => $"{MainViewModel.Parser.GetSectionHeaders().Count} Sections"; 123 | } 124 | } 125 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/Tabs/ImportAddressTableTabViewModel.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.ComponentModel.Composition; 4 | using System.Linq; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | using Zodiacon.PEParsing; 8 | 9 | namespace PEExplorer.ViewModels.Tabs { 10 | [Export, PartCreationPolicy(CreationPolicy.NonShared)] 11 | class ImportAddressTableTabViewModel : TabViewModelBase { 12 | [ImportingConstructor] 13 | public ImportAddressTableTabViewModel(MainViewModel vm) : base(vm) { 14 | } 15 | 16 | public override string Icon => "/icons/iat.ico"; 17 | 18 | public override string Text => "IAT"; 19 | 20 | ICollection _imports; 21 | 22 | public ICollection Imports => _imports ?? (_imports = MainViewModel.Parser.GetImportAddressTable()); 23 | } 24 | } 25 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/Tabs/ImportsTabViewModel.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.ComponentModel.Composition; 4 | using System.Linq; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | using System.Windows.Data; 8 | using Zodiacon.PEParsing; 9 | 10 | namespace PEExplorer.ViewModels.Tabs { 11 | [Export, PartCreationPolicy(CreationPolicy.NonShared)] 12 | class ImportsTabViewModel : TabViewModelBase { 13 | [ImportingConstructor] 14 | public ImportsTabViewModel(MainViewModel vm) : base(vm) { 15 | } 16 | 17 | public override string Icon => "/icons/import2.ico"; 18 | 19 | public override string Text => "Imports"; 20 | 21 | ICollection _imports; 22 | public ICollection Imports => _imports ?? (_imports = MainViewModel.Parser.GetImports()); 23 | 24 | private string _searchLibrariesText; 25 | 26 | public string SearchLibrariesText { 27 | get { return _searchLibrariesText; } 28 | set { 29 | if(SetProperty(ref _searchLibrariesText, value)) { 30 | var view = CollectionViewSource.GetDefaultView(Imports); 31 | if(string.IsNullOrWhiteSpace(value)) 32 | view.Filter = null; 33 | else { 34 | var text = value.ToLower(); 35 | view.Filter = o => ((ImportedLibrary)o).LibraryName.ToLower().Contains(text); 36 | } 37 | } 38 | } 39 | } 40 | 41 | private ImportedLibrary _selectedLibrary; 42 | 43 | public ImportedLibrary SelectedLibrary { 44 | get { return _selectedLibrary; } 45 | set { 46 | if(SetProperty(ref _selectedLibrary, value)) { 47 | SearchImportsText = string.Empty; 48 | RaisePropertyChanged(nameof(StatusMessage)); 49 | } 50 | } 51 | } 52 | 53 | private string _searchImportsText; 54 | 55 | public string SearchImportsText { 56 | get { return _searchImportsText; } 57 | set { 58 | if(SetProperty(ref _searchImportsText, value)) { 59 | if(SelectedLibrary != null) { 60 | var view = CollectionViewSource.GetDefaultView(SelectedLibrary.Symbols); 61 | if(string.IsNullOrWhiteSpace(value)) 62 | view.Filter = null; 63 | else { 64 | var text = value.ToLower(); 65 | view.Filter = o => ((ImportedSymbol)o).Name.ToLower().Contains(text); 66 | } 67 | } 68 | } 69 | } 70 | } 71 | 72 | public string StatusMessage => $"{Imports.Count} Libraries " + 73 | (SelectedLibrary == null ? "" : $"{SelectedLibrary?.LibraryName} has {SelectedLibrary?.Symbols.Count} Imports"); 74 | } 75 | } 76 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/Tabs/LoadConfigTabViewModel.cs: -------------------------------------------------------------------------------- 1 | using PEExplorer.Helpers; 2 | using System; 3 | using System.Collections.Generic; 4 | using System.ComponentModel.Composition; 5 | using System.Linq; 6 | using System.Text; 7 | using System.Threading.Tasks; 8 | using Zodiacon.PEParsing; 9 | 10 | namespace PEExplorer.ViewModels.Tabs { 11 | [Export, PartCreationPolicy(CreationPolicy.NonShared)] 12 | class LoadConfigTabViewModel : TabViewModelBase { 13 | LoadConfiguration _loadConfig; 14 | 15 | [ImportingConstructor] 16 | public LoadConfigTabViewModel(MainViewModel vm) : base(vm) { 17 | } 18 | 19 | public override string Icon => "/icons/config.ico"; 20 | 21 | public override string Text => "Load Config"; 22 | 23 | GenericProperty[] _properties; 24 | 25 | ExportedSymbol[] _cfgFunctions; 26 | public ExportedSymbol[] CFGFunctions { 27 | get { 28 | if (_cfgFunctions == null) { 29 | _loadConfig.GetCFGFunctions().ContinueWith(t => { 30 | _cfgFunctions = t.Result.ToArray(); 31 | RaisePropertyChanged(nameof(CFGFunctions)); 32 | }).ConfigureAwait(true); 33 | } 34 | return _cfgFunctions; 35 | } 36 | } 37 | 38 | public GenericProperty[] Properties { 39 | get { 40 | if (_properties == null) { 41 | _loadConfig = MainViewModel.Parser.GetLoadConfiguration(); 42 | 43 | _properties = new GenericProperty[] { 44 | new GenericProperty { Name = "Time Stamp", Value = _loadConfig.TimeDateStamp.ToString(), Info = DateTimeHelper.FromSeconds(_loadConfig.TimeDateStamp).ToString() }, 45 | new GenericProperty { Name = "Major Version", Value = _loadConfig.MajorVersion.ToString() }, 46 | new GenericProperty { Name = "Minor Version", Value = _loadConfig.MinorVersion.ToString() }, 47 | 48 | new GenericProperty { Name = "CFG Check Function Pointer", Value = ToDecHex(_loadConfig.CFGCheckFunctionPointer) }, 49 | new GenericProperty { Name = "CFG Dispatch Function Pointer", Value = ToDecHex(_loadConfig.CFGDispatchFunctionPointer) }, 50 | new GenericProperty { Name = "CFG Flags", Value = ToDecHex((ulong)_loadConfig.GuardFlags), Info = _loadConfig.GuardFlags.ToString() }, 51 | new GenericProperty { Name = "CFG Function Table", Value = ToDecHex(_loadConfig.CFGFunctionTable) }, 52 | new GenericProperty { Name = "CFG Function Count", Value = _loadConfig.CFGFunctionCount.ToString() }, 53 | }; 54 | 55 | } 56 | return _properties; 57 | 58 | } 59 | } 60 | } 61 | } 62 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/Tabs/ResourcesTabViewModel.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Collections.ObjectModel; 4 | using System.ComponentModel.Composition; 5 | using System.ComponentModel.Composition.Hosting; 6 | using System.Diagnostics; 7 | using System.IO; 8 | using System.Linq; 9 | using System.Text; 10 | using System.Threading.Tasks; 11 | using System.Windows.Input; 12 | using PEExplorer.ViewModels.Resources; 13 | using Prism.Commands; 14 | using Zodiacon.PEParsing; 15 | using Zodiacon.WPF; 16 | 17 | namespace PEExplorer.ViewModels.Tabs { 18 | [Export, PartCreationPolicy(CreationPolicy.NonShared)] 19 | class ResourcesTabViewModel : TabViewModelBase, IDisposable { 20 | ResourceManager _resourceManager; 21 | 22 | [ImportingConstructor] 23 | public ResourcesTabViewModel(MainViewModel vm) : base(vm) { 24 | } 25 | 26 | public override string Icon => "/icons/resources.ico"; 27 | 28 | public override string Text => "Resources"; 29 | 30 | ICollection _resources; 31 | 32 | public ICollection Resources => _resources ?? (_resources = GetResources()); 33 | 34 | private ICollection GetResources() { 35 | _resourceManager = new ResourceManager(MainViewModel.PathName); 36 | var resources = new List(); 37 | foreach(var type in _resourceManager.GetResourceTypes()) { 38 | var resourceType = new ResourceTypeViewModel(_resourceManager) { ResourceType = type }; 39 | MainViewModel.Container.SatisfyImportsOnce(resourceType); 40 | foreach(var resource in _resourceManager.GetResourceNames(type)) { 41 | var vm = resourceType.CreateResourceViewModel(resource); 42 | resourceType.Resources.Add(vm); 43 | } 44 | resources.Add(resourceType); 45 | } 46 | return resources; 47 | } 48 | 49 | public void Dispose() { 50 | _resourceManager.Dispose(); 51 | } 52 | 53 | [Import] 54 | IFileDialogService FileDialogService; 55 | 56 | ICommand _exportCommand; 57 | public ICommand ExportCommand => _exportCommand ?? (_exportCommand = new DelegateCommand(res => { 58 | var file = FileDialogService.GetFileForSave(); 59 | if(file == null) return; 60 | 61 | File.WriteAllBytes(file, ((ResourceViewModel)res).GetContents()); 62 | }, res => res is ResourceViewModel).ObservesProperty(() => SelectedTreeItem)); 63 | 64 | private object _selectedTreeItem; 65 | 66 | public object SelectedTreeItem { 67 | get { return _selectedTreeItem; } 68 | set { SetProperty(ref _selectedTreeItem, value); } 69 | } 70 | } 71 | } 72 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/Tabs/SectionsTabViewModel.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.ComponentModel.Composition; 4 | using System.Linq; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | using Zodiacon.PEParsing; 8 | 9 | namespace PEExplorer.ViewModels.Tabs { 10 | [Export, PartCreationPolicy(CreationPolicy.NonShared)] 11 | class SectionsTabViewModel : TabViewModelBase { 12 | [ImportingConstructor] 13 | public SectionsTabViewModel(MainViewModel vm) : base(vm) { 14 | } 15 | 16 | public override string Icon => "/icons/sections.ico"; 17 | public override string Text => "Sections"; 18 | 19 | ICollection _sections; 20 | public ICollection Sections => _sections ?? (_sections = MainViewModel.Parser.GetSectionHeaders()); 21 | 22 | } 23 | } 24 | -------------------------------------------------------------------------------- /PEExplorer/ViewModels/TreeViewItemViewModel.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Collections.ObjectModel; 4 | using System.Linq; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | using System.Windows.Input; 8 | using Prism.Commands; 9 | using Prism.Mvvm; 10 | 11 | namespace PEExplorer.ViewModels { 12 | class TreeViewItemViewModel : BindableBase { 13 | protected MainViewModel MainViewModel { get; } 14 | public TreeViewItemViewModel(MainViewModel vm) { 15 | MainViewModel = vm; 16 | } 17 | private string _text; 18 | 19 | public string Text { 20 | get { return _text ?? Tab.Text; } 21 | set { SetProperty(ref _text, value); } 22 | } 23 | 24 | private string _icon; 25 | 26 | public string Icon { 27 | get { return _icon ?? Tab.Icon; } 28 | set { SetProperty(ref _icon, value); } 29 | } 30 | 31 | public TabViewModelBase Tab { get; set; } 32 | 33 | ObservableCollection _items; 34 | 35 | public IList Items => _items ?? (_items = new ObservableCollection()); 36 | 37 | private bool _isExpanded; 38 | 39 | public bool IsExpanded { 40 | get { return _isExpanded; } 41 | set { SetProperty(ref _isExpanded, value); } 42 | } 43 | 44 | } 45 | } 46 | -------------------------------------------------------------------------------- /PEExplorer/Views/DisassemblyView.xaml: -------------------------------------------------------------------------------- 1 |  12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | -------------------------------------------------------------------------------- /PEExplorer/Views/DisassemblyView.xaml.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using System.Windows; 7 | using System.Windows.Controls; 8 | using System.Windows.Data; 9 | using System.Windows.Documents; 10 | using System.Windows.Input; 11 | using System.Windows.Media; 12 | using System.Windows.Media.Imaging; 13 | using System.Windows.Shapes; 14 | 15 | namespace PEExplorer.Views { 16 | /// 17 | /// Interaction logic for DisassemblyView.xaml 18 | /// 19 | public partial class DisassemblyView { 20 | public DisassemblyView() { 21 | InitializeComponent(); 22 | } 23 | } 24 | } 25 | -------------------------------------------------------------------------------- /PEExplorer/Views/GenericResourceView.xaml: -------------------------------------------------------------------------------- 1 |  9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | Resource Size: 17 | 18 | (0x 19 | ) bytes 20 | 21 | 22 | 23 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 50 | 51 | 52 | -------------------------------------------------------------------------------- /PEExplorer/Views/GenericResourceView.xaml.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using System.Windows; 7 | using System.Windows.Controls; 8 | using System.Windows.Data; 9 | using System.Windows.Documents; 10 | using System.Windows.Input; 11 | using System.Windows.Media; 12 | using System.Windows.Media.Imaging; 13 | using System.Windows.Navigation; 14 | using System.Windows.Shapes; 15 | 16 | namespace PEExplorer.Views { 17 | /// 18 | /// Interaction logic for GenericResourceView.xaml 19 | /// 20 | public partial class GenericResourceView : UserControl { 21 | public GenericResourceView() { 22 | InitializeComponent(); 23 | } 24 | } 25 | } 26 | -------------------------------------------------------------------------------- /PEExplorer/Views/MainView.xaml: -------------------------------------------------------------------------------- 1 |  12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 32 | 33 | 34 | 35 | 36 | 37 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 67 | 68 | 74 | 75 | 29 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 40 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | -------------------------------------------------------------------------------- /PEExplorer/Views/Tabs/ExportsTabView.xaml.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using System.Windows; 7 | using System.Windows.Controls; 8 | using System.Windows.Data; 9 | using System.Windows.Documents; 10 | using System.Windows.Input; 11 | using System.Windows.Media; 12 | using System.Windows.Media.Imaging; 13 | using System.Windows.Navigation; 14 | using System.Windows.Shapes; 15 | 16 | namespace PEExplorer.Views.Tabs { 17 | /// 18 | /// Interaction logic for ExportsTabView.xaml 19 | /// 20 | public partial class ExportsTabView : UserControl { 21 | public ExportsTabView() { 22 | InitializeComponent(); 23 | } 24 | } 25 | } 26 | -------------------------------------------------------------------------------- /PEExplorer/Views/Tabs/GeneralTabView.xaml: -------------------------------------------------------------------------------- 1 |  13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | Full Path: 22 | 23 | 24 | 25 | 26 | 27 | 28 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 47 | 48 | 51 | 52 | 53 | 56 | 59 | 60 | 61 | 62 | 63 | 64 | -------------------------------------------------------------------------------- /PEExplorer/Views/Tabs/GeneralTabView.xaml.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using System.Windows; 7 | using System.Windows.Controls; 8 | using System.Windows.Data; 9 | using System.Windows.Documents; 10 | using System.Windows.Input; 11 | using System.Windows.Media; 12 | using System.Windows.Media.Imaging; 13 | using System.Windows.Navigation; 14 | using System.Windows.Shapes; 15 | 16 | namespace PEExplorer.Views.Tabs { 17 | /// 18 | /// Interaction logic for GeneralTabView.xaml 19 | /// 20 | public partial class GeneralTabView : UserControl { 21 | public GeneralTabView() { 22 | InitializeComponent(); 23 | } 24 | } 25 | } 26 | -------------------------------------------------------------------------------- /PEExplorer/Views/Tabs/ImportAddressTableTabView.xaml: -------------------------------------------------------------------------------- 1 |  12 | 13 | 18 | 19 | 23 | 24 | 27 | 28 | 29 | 30 | 31 | -------------------------------------------------------------------------------- /PEExplorer/Views/Tabs/ImportAddressTableTabView.xaml.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using System.Windows; 7 | using System.Windows.Controls; 8 | using System.Windows.Data; 9 | using System.Windows.Documents; 10 | using System.Windows.Input; 11 | using System.Windows.Media; 12 | using System.Windows.Media.Imaging; 13 | using System.Windows.Navigation; 14 | using System.Windows.Shapes; 15 | 16 | namespace PEExplorer.Views.Tabs { 17 | /// 18 | /// Interaction logic for ImportAddressTableTabView.xaml 19 | /// 20 | public partial class ImportAddressTableTabView : UserControl { 21 | public ImportAddressTableTabView() { 22 | InitializeComponent(); 23 | } 24 | } 25 | } 26 | -------------------------------------------------------------------------------- /PEExplorer/Views/Tabs/ImportsTabView.xaml: -------------------------------------------------------------------------------- 1 |  10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 22 | 24 | 26 | 27 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 37 | 38 | 39 | -------------------------------------------------------------------------------- /PEExplorer/Views/Tabs/ImportsTabView.xaml.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using System.Windows; 7 | using System.Windows.Controls; 8 | using System.Windows.Data; 9 | using System.Windows.Documents; 10 | using System.Windows.Input; 11 | using System.Windows.Media; 12 | using System.Windows.Media.Imaging; 13 | using System.Windows.Navigation; 14 | using System.Windows.Shapes; 15 | 16 | namespace PEExplorer.Views.Tabs { 17 | /// 18 | /// Interaction logic for ImportsTabView.xaml 19 | /// 20 | public partial class ImportsTabView : UserControl { 21 | public ImportsTabView() { 22 | InitializeComponent(); 23 | } 24 | } 25 | } 26 | -------------------------------------------------------------------------------- /PEExplorer/Views/Tabs/LoadConfigTabView.xaml: -------------------------------------------------------------------------------- 1 |  10 | 11 | 12 | 13 | 14 | 15 | 16 | 21 | 22 | 25 | 26 | 27 | 30 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | -------------------------------------------------------------------------------- /PEExplorer/Views/Tabs/LoadConfigTabView.xaml.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using System.Windows; 7 | using System.Windows.Controls; 8 | using System.Windows.Data; 9 | using System.Windows.Documents; 10 | using System.Windows.Input; 11 | using System.Windows.Media; 12 | using System.Windows.Media.Imaging; 13 | using System.Windows.Navigation; 14 | using System.Windows.Shapes; 15 | 16 | namespace PEExplorer.Views.Tabs { 17 | /// 18 | /// Interaction logic for LoadConfigTabView.xaml 19 | /// 20 | public partial class LoadConfigTabView : UserControl { 21 | public LoadConfigTabView() { 22 | InitializeComponent(); 23 | } 24 | } 25 | } 26 | -------------------------------------------------------------------------------- /PEExplorer/Views/Tabs/ResourcesTabView.xaml: -------------------------------------------------------------------------------- 1 |  14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 39 | 42 | 43 | 44 | 45 | 46 | 49 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 72 | 76 | 77 | 78 | 81 | 82 | 83 | 84 | 89 | 90 | 91 | 92 | 93 | 94 | -------------------------------------------------------------------------------- /PEExplorer/Views/Tabs/ResourcesTabView.xaml.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using System.Windows; 7 | using System.Windows.Controls; 8 | using System.Windows.Data; 9 | using System.Windows.Documents; 10 | using System.Windows.Input; 11 | using System.Windows.Media; 12 | using System.Windows.Media.Imaging; 13 | using System.Windows.Navigation; 14 | using System.Windows.Shapes; 15 | 16 | namespace PEExplorer.Views.Tabs { 17 | /// 18 | /// Interaction logic for ResourcesTabView.xaml 19 | /// 20 | public partial class ResourcesTabView : UserControl { 21 | public ResourcesTabView() { 22 | InitializeComponent(); 23 | } 24 | } 25 | } 26 | -------------------------------------------------------------------------------- /PEExplorer/Views/Tabs/SectionsTabView.xaml: -------------------------------------------------------------------------------- 1 |  10 | 11 | 13 | 14 | 17 | 20 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 34 | 35 | 36 | 37 | 38 | 39 | -------------------------------------------------------------------------------- /PEExplorer/Views/Tabs/SectionsTabView.xaml.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using System.Windows; 7 | using System.Windows.Controls; 8 | using System.Windows.Data; 9 | using System.Windows.Documents; 10 | using System.Windows.Input; 11 | using System.Windows.Media; 12 | using System.Windows.Media.Imaging; 13 | using System.Windows.Navigation; 14 | using System.Windows.Shapes; 15 | 16 | namespace PEExplorer.Views.Tabs { 17 | /// 18 | /// Interaction logic for SectionsTabView.xaml 19 | /// 20 | public partial class SectionsTabView : UserControl { 21 | public SectionsTabView() { 22 | InitializeComponent(); 23 | } 24 | } 25 | } 26 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # PEExplorer 2 | Portable Executable Explorer 3 | 4 | ![PEExplorer](https://github.com/zodiacon/PEExplorer/blob/NewParser/peexplorer1.PNG) 5 | -------------------------------------------------------------------------------- /peexplorer1.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/zodiacon/PEExplorer/3841e69fdb509db5cb414cdea7d0c2c729e9f624/peexplorer1.PNG --------------------------------------------------------------------------------