Class: PE

PE

This is a description of the PE class.

new PE()

Members

(static) nEP

The file offset of the entry point.

(static) nLastSection

The number of the last section.

(static) resource

An array of resources, indexed by number and name (if not numeric). Members are the same as the functions.
Example
var nOffset=PE.resource["PACKAGEINFO"].Offset;

(static) section

An array of sections, indexed by number and name (if not numeric). Members are the same as the functions.
Example
var nOffset=PE.section[".rsrc"].FileOffset;

Methods

(static) calculateEntropy()

See:

(static) calculateMD5()

See:

(static) calculateSizeOfHeaders() → {UInt}

Calculate the size of the headers.
Returns:
Type
UInt

(static) compare()

See:

(static) compareEP(sSignature, nOffsetopt) → {Bool}

Compare (see Binary.compare) bytes at the Entry Point.
Parameters:
Name Type Attributes Default Description
sSignature String The signature.
nOffset Int <optional>
0 The offset from the entry point.
Returns:
Type
Bool
Example
if(PE.compareEP("2C81",8))
{
    sVersion="1.98";
}

if(PE.compareEP("EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C24"))
{
    bDetected=1;
}

(static) compareEP_NET(sSignature, nOffsetopt) → {Bool}

Compare (see Binary.compare) bytes at the Entry Point of .NET.
Parameters:
Name Type Attributes Default Description
sSignature String The signature.
nOffset Int <optional>
0 The offset from the entry point of .NET.
Returns:
Type
Bool
Example
if(PE.compareEP_NET("4228070000066f09000006283800000a2a1b3004006f0000000d0000110272b9"))
{
    bDetected=1;
    sVersion="2.X";
}

(static) compareOverlay(sSignature, nOffsetopt) → {Bool}

Compare bytes at the overlay.
Parameters:
Name Type Attributes Default Description
sSignature String The signature.
nOffset Int <optional>
0 The offset from the overlay.
Returns:
Type
Bool
Example
if(PE.compareOverlay("';!@Install@!UTF-8!'"))
{
    bDetected=1;
}

(static) findByte()

See:

(static) findDword()

See:

(static) findSignature()

See:
Example
nOffset=PE.findSignature(nOffset,1024,"'7z'BCAF271C");
if(nOffset!=-1)
{
    bDetected=1;
}

(static) findString()

See:
Example
nOffset=PE.findString(0,1024,"UPX!");
if(nOffset==-1)
{
    return;
}

(static) findWord()

See:

(static) getAddressOfEntryPoint() → {UInt}

Get the relative virtual address (RVA) of the entry point.
Returns:
Type
UInt
Example
var nSection=PE.nLastSection;
if(nSection>=2)
{
    if(PE.getAddressOfEntryPoint()==PE.section[nSection].VirtualAddress)
    {
        if(PE.section[nSection].Characteristics==0xe0000040)
        {
            if(PE.section[nSection-1].Characteristics==0xe0000040)
            {
                if(PE.getNumberOfImportThunks(0)==1)
                {
                    bDetected=1;
                }
            }
        }
    }
}

(static) getCompilerVersion() → {String}

Get the compiler version.
Returns:
The string "MajorLinkerVersion.MinorLinkerVersion".
Type
String
Example
if(bDetected)
{
    switch(PE.getCompilerVersion())
    {
    case "6.0":  sVersion="6.0";  break;
    case "7.0":  sVersion="2002"; break;
    case "7.10": sVersion="2003"; break;
    case "8.0":  sVersion="2005"; break;
    case "9.0":  sVersion="2008"; break;
    case "10.0": sVersion="2010"; break;
    case "11.0": sVersion="2012"; break;
    case "12.0": sVersion="2013"; break;
    }
}

(static) getDosStubOffset() → {UInt}

Get the file offset of the MSDOS stub.
Returns:
Type
UInt

(static) getDosStubSize() → {UInt}

Get the size of the MSDOS stub.
Returns:
Type
UInt

(static) getEntryPointOffset() → {Int64}

Get the offset of the entry point.
Returns:
If an error occurs, -1 will be returned.
Type
Int64

(static) getEntryPointSection() → {Int}

Get the number of the section containing the entry point.
Returns:
If no entry point returns -1.
Type
Int
Example
if(PE.getEntryPointSection()==PE.nLastSection)
{
    bDetected=1;
}

(static) getEPSignature()

Get the signature at an offset of the entry point.
See:

(static) getExportSection() → {Int}

Get the number of the section containing the export table.
Returns:
If no export returns -1.
Type
Int

(static) getFileBaseName()

See:

(static) getFileCompleteSuffix()

See:

(static) getFileDirectory()

See:

(static) getFileSuffix()

See:

(static) getFileVersion() → {String}

Get the version of the file, if the version resource exists.
Returns:
Type
String

(static) getGeneralOptions() → {String}

Get a string in the form of "PEtypePEmode". For example "EXE32" or "Driver32".
Returns:
Type
String

(static) getGeneralOptionsEx() → {String}

Add console and/or admininistrator requirement to the general options.
Returns:
Type
String

(static) getImageBase() → {UInt}

Get the base address of the image.
Returns:
Type
UInt

(static) getImportFunctionName(nImport, nFunctionNumber) → {String}

Get the name of an imported function.
Parameters:
Name Type Description
nImport UInt Number of the imported library.
nFunctionNumber UInt Number of the function in the library.
Returns:
Type
String

(static) getImportLibraryName(nImport) → {String}

Get the name of an imported library.
Parameters:
Name Type Description
nImport UInt Number of the imported library.
Returns:
Type
String

(static) getImportSection() → {Int}

Get the number of the section containing the import table.
Returns:
If no import returns -1.
Type
Int

(static) getMachineType() → {UShort}

Get the machine type.
Returns:
Type
UShort

(static) getMajorLinkerVersion() → {UInt}

Get the major linker version.
Returns:
Type
UInt
Example
var nMajor=PE.getMajorLinkerVersion();
if(nMajor>3)
{
    sName="Microsoft Linker";
    bDetected=1;
}

(static) getManifest() → {String}

Get the XML manifest from the resources.
Returns:
Type
String
Example
if(/requireAdministrator/.test(PE.getManifest()))
{
    sOptions=sOptions.append("admin");
}

(static) getMinorLinkerVersion() → {UInt}

Get the minor linker version.
Returns:
Type
UInt
Example
var nMinor=PE.getMinorLinkerVersion();
if(nMinor==55)
{
    sName="LCC Linker";
    sVersion+="*";
    bDetected=1;
}

(static) getNETVersion() → {String}

Get the .NET version.
Returns:
Type
String
Example
if(PE.isNET())
{
    sVersion=PE.getNETVersion();
    bDetected=1;
}

(static) getNumberOfImports() → {Int}

Get the number of imports.
Returns:
Type
Int
Example
if(PE.getNumberOfImports()==1)
{
    if(PE.getNumberOfImportThunks(0)==2)
    {
        if(PE.section[0].Name=="ANDpakk2")
        {
            sVersion="2.X";
            bDetected=1;
        }
    }
}

(static) getNumberOfImportThunks(nImport) → {UInt}

Get the number of functions in the imported library.
Parameters:
Name Type Description
nImport UInt Number of the library.
Returns:
Type
UInt
Example
if(PE.getNumberOfImportThunks(0)==1)
{
    bDetected=1;
}

(static) getNumberOfResources() → {UInt}

Get the number of resources.
Returns:
Type
UInt

(static) getNumberOfRichIDs() → {UInt}

Get the number of the Rich IDs.
Returns:
Type
UInt

(static) getNumberOfSections() → {Int}

Get the number of sections.
Returns:
Type
Int

(static) getOverlayOffset() → {UInt}

Get the file offset of the overlay.
Returns:
Type
UInt

(static) getOverlaySize() → {UInt}

Get the size of the overlay .
Returns:
Type
UInt

(static) getPEFileVersion(sFileName) → {String}

Get the version of a particular file, if the version resource exists.
Parameters:
Name Type Description
sFileName String The file name.
Returns:
Type
String

(static) getRelocsSection() → {Int}

Get the number of the section containing the relocations.
Returns:
If no relocations returns -1.
Type
Int

(static) getResourceIdByNumber(nNumber) → {UInt}

Get the Id of a resource.
Parameters:
Name Type Description
nNumber UInt Number of resource.
Returns:
Type
UInt

(static) getResourceNameByNumber(nNumber) → {String}

Get the name of a resource.
Parameters:
Name Type Description
nNumber UInt Number of resource.
Returns:
Type
String

(static) getResourceNameOffset(sFileName) → {Int}

Get the file offset to a named resource.
Parameters:
Name Type Description
sFileName String The name of the resource.
Returns:
If an error occurs, -1 will be returned.
Type
Int

(static) getResourceNameSize(sFileName) → {Int}

Get the size of a named resource.
Parameters:
Name Type Description
sFileName String The name of the resource.
Returns:
Type
Int

(static) getResourceOffsetByNumber(nNumber) → {Int}

Get the offset of a resource.
Parameters:
Name Type Description
nNumber UInt Number of resource.
Returns:
If an error occurs, -1 will be returned.
Type
Int

(static) getResourceSection() → {Int}

Get the number of the section containing the resources.
Returns:
If no resources returns -1.
Type
Int

(static) getResourceSizeByNumber(nNumber) → {Int}

Get the size of a resource.
Parameters:
Name Type Description
nNumber UInt Number of resource.
Returns:
Type
Int

(static) getResourceTypeByNumber(nNumber) → {String}

Get the type of a resource.
Parameters:
Name Type Description
nNumber UInt Number of resource.
Returns:
Type
String
Example
if(PE.getResourceTypeByNumber(0)=="RT_MANIFEST")
{
    bDetected=1;
}

(static) getSectionCharacteristics(nSectionNumber) → {UInt}

Get the characteristics of a section.
Parameters:
Name Type Description
nSectionNumber Int Section number (from 0).
Returns:
Type
UInt

(static) getSectionFileOffset(nSectionNumber) → {UInt}

Get the file offset of a setion.
Parameters:
Name Type Description
nSectionNumber Int Section number (from 0).
Returns:
Type
UInt

(static) getSectionFileSize(nSectionNumber) → {UInt}

Get the file size of a section.
Parameters:
Name Type Description
nSectionNumber Int Section number (from 0).
Returns:
Type
UInt

(static) getSectionName(nSectionNumber) → {String}

Get the name of a section.
Parameters:
Name Type Description
nSectionNumber Int Section number (from 0).
Returns:
Type
String

(static) getSectionNameCollision(sString1, sString2) → {String}

Get the common prefix of two section name suffixes.
Parameters:
Name Type Description
sString1 String First section name suffix.
sString2 String Second section name suffix.
Returns:
Section name prefix.
Type
String
Example
if("UPX"==PE.getSectionNameCollision("0","1"))
{
    // Both "UPX0" and "UPX1" exist.
    bDetected=1;
}

(static) getSectionNumber(sSectionName) → {Int}

Get the number of a section with a specific name.
Parameters:
Name Type Description
sSectionName String Section name.
Returns:
0-based section number, or -1 if there is no section with that name.
Type
Int

(static) getSectionNumberExp(sSectionName) → {Int}

Get the number of a section whose name matches a regular expression.
Parameters:
Name Type Description
sSectionName String Section pattern.
Returns:
0-based section number, or -1 if there is no section with that pattern.
Type
Int

(static) getSectionVirtualAddress(nSectionNumber) → {UInt}

Get the relative virtual address of a section.
Parameters:
Name Type Description
nSectionNumber Int Section number (from 0).
Returns:
Type
UInt

(static) getSectionVirtualSize(nSectionNumber) → {UInt}

Get the virtual size of a section.
Parameters:
Name Type Description
nSectionNumber Int Section number (from 0).
Returns:
Type
UInt

(static) getSignature()

See:

(static) getSize()

See:

(static) getSizeOfCode() → {Int}

Get the size of code.
Returns:
Type
Int

(static) getSizeOfUninitializedData() → {Int}

Get the size of unitialized data.
Returns:
Type
Int

(static) getString()

See:

(static) getTLSSection() → {Int}

Get the number of the section containing the TLS.
Returns:
If no TLS returns -1.
Type
Int

(static) getVersionStringInfo(sKey) → {String}

Get the value associated with a version resource string key.
Parameters:
Name Type Description
sKey String
Returns:
Type
String

(static) isConsole() → {Bool}

Check if the file is a console application.
Returns:
Type
Bool

(static) isDll() → {Bool}

Check if the file is a DLL.
Returns:
Type
Bool

(static) isDosStubPresent() → {Bool}

Check if there is an MSDOS stub.
Returns:
Type
Bool

(static) isDriver() → {Bool}

Check if the file is a driver.
Returns:
Type
Bool

(static) isLibraryFunctionPresent(sLibraryName, sFunctionName) → {Bool}

Check if a function exists in a library.
Parameters:
Name Type Description
sLibraryName String The name of the library.
sFunctionName String The name of the function.
Returns:
Type
Bool

(static) isLibraryPresent(sLibraryName) → {Bool}

Check if a library is imported.
Parameters:
Name Type Description
sLibraryName String The name of the library.
Returns:
Type
Bool
Example
if(PE.isLibraryPresent("MSVBVM50.DLL"))
{
    sVersion="5.0";
    bDetected=1;
}

(static) isLibraryPresentExp() → (nullable) {Array}

Locate the first library matching a pattern.
Returns:
null if not found, otherwise:
[-1] is the number of the library;
[0] is the name of the library (lower cased);
[1] onwards are the captured subpatterns.
Type
Array

(static) isNET() → {Bool}

Check if the file is a .NET application.
Returns:
Type
Bool

(static) isNETStringPresent(sString) → {Bool}

Check if there is a specific .NET string.
Parameters:
Name Type Description
sString String
Returns:
Type
Bool
Example
if(PE.isNETStringPresent(0,"DotfuscatorAttribute"))
{
    bDetected=1;
}

(static) isNETUnicodeStringPresent(sString) → {Bool}

Check if there is a specific .NET Unicode string.
Parameters:
Name Type Description
sString String
Returns:
Type
Bool
Example
if(PE.isNETUnicodeStringPresent("E_TamperDetected"))
{
    sVersion="3.X-4.X";
    bDetected=1;
}

(static) isOverlayPresent() → {Bool}

Check if there is an overlay in the file.
Returns:
Type
Bool

(static) isPEPlus() → {Bool}

Check if the file is 64 bit (PE+).
Returns:
Type
Bool
Example
if(PE.isPEPlus())
{
    sOptions="PE+";
}

(static) isResourceNamePresent(sName) → {Bool}

Check if there is a resource with a specific name in the file.
Parameters:
Name Type Description
sName String The name of the resource.
Returns:
Type
Bool
Example
if(PE.isResourceNamePresent("PACKAGEINFO"))
{
    bDetected=1;
}

(static) isRichSignaturePresent() → {Bool}

Check if the “Rich” signature is in the file. For more information see http://www.ntcore.com/files/richsign.htm. It is typical for the files made by the MS Linker.
Returns:
Type
Bool
Example
if(PE.isRichSignaturePresent())
{
    sName="Microsoft Linker";
    bDetected=1;
}

(static) isRichVersionPresent(nVersion) → {Bool}

Check if there is a Rich version.
Parameters:
Name Type Description
nVersion UInt Rich version.
Returns:
Type
Bool

(static) isSectionNamePresent(sSectionName) → {Bool}

Checks if a section exists with a specific name.
Parameters:
Name Type Description
sSectionName String Section name.
Returns:
Type
Bool

(static) isSectionNamePresentExp(sSectionName) → {Bool}

Check if a section name matches a regular expression.
Parameters:
Name Type Description
sSectionName String Section pattern.
Returns:
Type
Bool

(static) isSignatureInSectionPresent(nSection, sSignature) → {Bool}

Check if a signature (see Binary.compare) exists in a section.
Parameters:
Name Type Description
nSection Int Section number (from 0).
sSignature String Signature.
Returns:
Type
Bool
Example
if(PE.isSignatureInSectionPresent(0,"'ENIGMA'"))
{
    bDetected=1;
}

(static) isSignaturePresent()

See:

(static) isSignedFile() → {Bool}

Check if there is a digital signature.
Returns:
Type
Bool

(static) OffsetToRVA(nOffset) → {Int64}

Convert a file offset to a relative virtual address (RVA).
Parameters:
Name Type Description
nOffset UInt64
Returns:
If an error occurs, -1 will be returned.
Type
Int64

(static) OffsetToVA(nOffset) → {Int64}

Convert a file offset to a virtual address (VA).
Parameters:
Name Type Description
nOffset UInt64
Returns:
If an error occurs, -1 will be returned.
Type
Int64

(static) readByte()

See:

(static) readDword()

See:

(static) readWord()

See:

(static) RVAToOffset(nRVA) → {Int64}

Convert a relative virtual address (RVA) to a file offset.
Parameters:
Name Type Description
nRVA UInt64
Returns:
If an error occurs, -1 will be returned.
Type
Int64

(static) swapBytes()

See:

(static) VAToOffset(nVA) → {Int64}

Convert a virtual address (VA) to a file offset.
Parameters:
Name Type Description
nVA UInt64
Returns:
If an error occurs, -1 will be returned.
Type
Int64