-
(static) calculateEntropy()
-
- See:
-
-
(static) calculateMD5()
-
- See:
-
-
-
Calculate the size of the headers.
Returns:
-
Type
-
UInt
-
(static) compare()
-
- See:
-
-
(static) compareEP(sSignature, nOffsetopt) → {Bool}
-
Parameters:
Name |
Type |
Attributes |
Default |
Description |
sSignature |
String
|
|
|
The signature. |
nOffset |
Int
|
<optional>
|
0
|
The offset from the entry point. |
Returns:
-
Type
-
Bool
Example
if(PE.compareEP("2C81",8))
{
sVersion="1.98";
}
if(PE.compareEP("EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C24"))
{
bDetected=1;
}
-
(static) compareEP_NET(sSignature, nOffsetopt) → {Bool}
-
Parameters:
Name |
Type |
Attributes |
Default |
Description |
sSignature |
String
|
|
|
The signature. |
nOffset |
Int
|
<optional>
|
0
|
The offset from the entry point of .NET. |
Returns:
-
Type
-
Bool
Example
if(PE.compareEP_NET("4228070000066f09000006283800000a2a1b3004006f0000000d0000110272b9"))
{
bDetected=1;
sVersion="2.X";
}
-
(static) compareOverlay(sSignature, nOffsetopt) → {Bool}
-
Compare bytes at the overlay.
Parameters:
Name |
Type |
Attributes |
Default |
Description |
sSignature |
String
|
|
|
The signature. |
nOffset |
Int
|
<optional>
|
0
|
The offset from the overlay. |
Returns:
-
Type
-
Bool
Example
if(PE.compareOverlay("';!@Install@!UTF-8!'"))
{
bDetected=1;
}
-
(static) findByte()
-
- See:
-
-
(static) findDword()
-
- See:
-
-
(static) findSignature()
-
- See:
-
Example
nOffset=PE.findSignature(nOffset,1024,"'7z'BCAF271C");
if(nOffset!=-1)
{
bDetected=1;
}
-
(static) findString()
-
- See:
-
Example
nOffset=PE.findString(0,1024,"UPX!");
if(nOffset==-1)
{
return;
}
-
(static) findWord()
-
- See:
-
-
(static) getAddressOfEntryPoint() → {UInt}
-
Get the relative virtual address (RVA) of the entry point.
Returns:
-
Type
-
UInt
Example
var nSection=PE.nLastSection;
if(nSection>=2)
{
if(PE.getAddressOfEntryPoint()==PE.section[nSection].VirtualAddress)
{
if(PE.section[nSection].Characteristics==0xe0000040)
{
if(PE.section[nSection-1].Characteristics==0xe0000040)
{
if(PE.getNumberOfImportThunks(0)==1)
{
bDetected=1;
}
}
}
}
}
-
(static) getCompilerVersion() → {String}
-
Get the compiler version.
Returns:
The string "MajorLinkerVersion.MinorLinkerVersion"
.
-
Type
-
String
Example
if(bDetected)
{
switch(PE.getCompilerVersion())
{
case "6.0": sVersion="6.0"; break;
case "7.0": sVersion="2002"; break;
case "7.10": sVersion="2003"; break;
case "8.0": sVersion="2005"; break;
case "9.0": sVersion="2008"; break;
case "10.0": sVersion="2010"; break;
case "11.0": sVersion="2012"; break;
case "12.0": sVersion="2013"; break;
}
}
-
(static) getDosStubOffset() → {UInt}
-
Get the file offset of the MSDOS stub.
Returns:
-
Type
-
UInt
-
(static) getDosStubSize() → {UInt}
-
Get the size of the MSDOS stub.
Returns:
-
Type
-
UInt
-
(static) getEntryPointOffset() → {Int64}
-
Get the offset of the entry point.
Returns:
If an error occurs, -1 will be returned.
-
Type
-
Int64
-
(static) getEntryPointSection() → {Int}
-
Get the number of the section containing the entry point.
Returns:
If no entry point returns -1
.
-
Type
-
Int
Example
if(PE.getEntryPointSection()==PE.nLastSection)
{
bDetected=1;
}
-
(static) getEPSignature()
-
Get the signature at an offset of the entry point.
- See:
-
-
(static) getExportSection() → {Int}
-
Get the number of the section containing the export table.
Returns:
If no export returns -1
.
-
Type
-
Int
-
(static) getFileBaseName()
-
- See:
-
-
(static) getFileCompleteSuffix()
-
- See:
-
-
(static) getFileDirectory()
-
- See:
-
-
(static) getFileSuffix()
-
- See:
-
-
(static) getFileVersion() → {String}
-
Get the version of the file, if the version resource exists.
Returns:
-
Type
-
String
-
(static) getGeneralOptions() → {String}
-
Get a string in the form of "PEtypePEmode"
. For example "EXE32" or "Driver32".
Returns:
-
Type
-
String
-
(static) getGeneralOptionsEx() → {String}
-
Add console and/or admininistrator requirement to the general options.
Returns:
-
Type
-
String
-
(static) getImageBase() → {UInt}
-
Get the base address of the image.
Returns:
-
Type
-
UInt
-
(static) getImportFunctionName(nImport, nFunctionNumber) → {String}
-
Get the name of an imported function.
Parameters:
Name |
Type |
Description |
nImport |
UInt
|
Number of the imported library. |
nFunctionNumber |
UInt
|
Number of the function in the library. |
Returns:
-
Type
-
String
-
(static) getImportLibraryName(nImport) → {String}
-
Get the name of an imported library.
Parameters:
Name |
Type |
Description |
nImport |
UInt
|
Number of the imported library. |
Returns:
-
Type
-
String
-
(static) getImportSection() → {Int}
-
Get the number of the section containing the import table.
Returns:
If no import returns -1
.
-
Type
-
Int
-
(static) getMachineType() → {UShort}
-
Get the machine type.
Returns:
-
Type
-
UShort
-
(static) getMajorLinkerVersion() → {UInt}
-
Get the major linker version.
Returns:
-
Type
-
UInt
Example
var nMajor=PE.getMajorLinkerVersion();
if(nMajor>3)
{
sName="Microsoft Linker";
bDetected=1;
}
-
(static) getManifest() → {String}
-
Get the XML manifest from the resources.
Returns:
-
Type
-
String
Example
if(/requireAdministrator/.test(PE.getManifest()))
{
sOptions=sOptions.append("admin");
}
-
(static) getMinorLinkerVersion() → {UInt}
-
Get the minor linker version.
Returns:
-
Type
-
UInt
Example
var nMinor=PE.getMinorLinkerVersion();
if(nMinor==55)
{
sName="LCC Linker";
sVersion+="*";
bDetected=1;
}
-
(static) getNETVersion() → {String}
-
Get the .NET version.
Returns:
-
Type
-
String
Example
if(PE.isNET())
{
sVersion=PE.getNETVersion();
bDetected=1;
}
-
(static) getNumberOfImports() → {Int}
-
Get the number of imports.
Returns:
-
Type
-
Int
Example
if(PE.getNumberOfImports()==1)
{
if(PE.getNumberOfImportThunks(0)==2)
{
if(PE.section[0].Name=="ANDpakk2")
{
sVersion="2.X";
bDetected=1;
}
}
}
-
(static) getNumberOfImportThunks(nImport) → {UInt}
-
Get the number of functions in the imported library.
Parameters:
Name |
Type |
Description |
nImport |
UInt
|
Number of the library. |
Returns:
-
Type
-
UInt
Example
if(PE.getNumberOfImportThunks(0)==1)
{
bDetected=1;
}
-
(static) getNumberOfResources() → {UInt}
-
Get the number of resources.
Returns:
-
Type
-
UInt
-
(static) getNumberOfRichIDs() → {UInt}
-
Get the number of the Rich IDs.
Returns:
-
Type
-
UInt
-
(static) getNumberOfSections() → {Int}
-
Get the number of sections.
Returns:
-
Type
-
Int
-
(static) getOverlayOffset() → {UInt}
-
Get the file offset of the overlay.
Returns:
-
Type
-
UInt
-
(static) getOverlaySize() → {UInt}
-
Get the size of the overlay .
Returns:
-
Type
-
UInt
-
(static) getPEFileVersion(sFileName) → {String}
-
Get the version of a particular file, if the version resource exists.
Parameters:
Name |
Type |
Description |
sFileName |
String
|
The file name. |
Returns:
-
Type
-
String
-
(static) getRelocsSection() → {Int}
-
Get the number of the section containing the relocations.
Returns:
If no relocations returns -1
.
-
Type
-
Int
-
(static) getResourceIdByNumber(nNumber) → {UInt}
-
Get the Id of a resource.
Parameters:
Name |
Type |
Description |
nNumber |
UInt
|
Number of resource. |
Returns:
-
Type
-
UInt
-
(static) getResourceNameByNumber(nNumber) → {String}
-
Get the name of a resource.
Parameters:
Name |
Type |
Description |
nNumber |
UInt
|
Number of resource. |
Returns:
-
Type
-
String
-
(static) getResourceNameOffset(sFileName) → {Int}
-
Get the file offset to a named resource.
Parameters:
Name |
Type |
Description |
sFileName |
String
|
The name of the resource. |
Returns:
If an error occurs, -1
will be returned.
-
Type
-
Int
-
(static) getResourceNameSize(sFileName) → {Int}
-
Get the size of a named resource.
Parameters:
Name |
Type |
Description |
sFileName |
String
|
The name of the resource. |
Returns:
-
Type
-
Int
-
(static) getResourceOffsetByNumber(nNumber) → {Int}
-
Get the offset of a resource.
Parameters:
Name |
Type |
Description |
nNumber |
UInt
|
Number of resource. |
Returns:
If an error occurs, -1 will be returned.
-
Type
-
Int
-
(static) getResourceSection() → {Int}
-
Get the number of the section containing the resources.
Returns:
If no resources returns -1
.
-
Type
-
Int
-
(static) getResourceSizeByNumber(nNumber) → {Int}
-
Get the size of a resource.
Parameters:
Name |
Type |
Description |
nNumber |
UInt
|
Number of resource. |
Returns:
-
Type
-
Int
-
(static) getResourceTypeByNumber(nNumber) → {String}
-
Get the type of a resource.
Parameters:
Name |
Type |
Description |
nNumber |
UInt
|
Number of resource. |
Returns:
-
Type
-
String
Example
if(PE.getResourceTypeByNumber(0)=="RT_MANIFEST")
{
bDetected=1;
}
-
(static) getSectionCharacteristics(nSectionNumber) → {UInt}
-
Get the characteristics of a section.
Parameters:
Name |
Type |
Description |
nSectionNumber |
Int
|
Section number (from 0). |
Returns:
-
Type
-
UInt
-
(static) getSectionFileOffset(nSectionNumber) → {UInt}
-
Get the file offset of a setion.
Parameters:
Name |
Type |
Description |
nSectionNumber |
Int
|
Section number (from 0). |
Returns:
-
Type
-
UInt
-
(static) getSectionFileSize(nSectionNumber) → {UInt}
-
Get the file size of a section.
Parameters:
Name |
Type |
Description |
nSectionNumber |
Int
|
Section number (from 0). |
Returns:
-
Type
-
UInt
-
(static) getSectionName(nSectionNumber) → {String}
-
Get the name of a section.
Parameters:
Name |
Type |
Description |
nSectionNumber |
Int
|
Section number (from 0). |
Returns:
-
Type
-
String
-
(static) getSectionNameCollision(sString1, sString2) → {String}
-
Get the common prefix of two section name suffixes.
Parameters:
Name |
Type |
Description |
sString1 |
String
|
First section name suffix. |
sString2 |
String
|
Second section name suffix. |
Returns:
Section name prefix.
-
Type
-
String
Example
if("UPX"==PE.getSectionNameCollision("0","1"))
{
// Both "UPX0" and "UPX1" exist.
bDetected=1;
}
-
(static) getSectionNumber(sSectionName) → {Int}
-
Get the number of a section with a specific name.
Parameters:
Name |
Type |
Description |
sSectionName |
String
|
Section name. |
Returns:
0-based section number, or -1
if there is no section with that name.
-
Type
-
Int
-
(static) getSectionNumberExp(sSectionName) → {Int}
-
Get the number of a section whose name matches a regular expression.
Parameters:
Name |
Type |
Description |
sSectionName |
String
|
Section pattern. |
Returns:
0-based section number, or -1
if there is no section with that pattern.
-
Type
-
Int
-
(static) getSectionVirtualAddress(nSectionNumber) → {UInt}
-
Get the relative virtual address of a section.
Parameters:
Name |
Type |
Description |
nSectionNumber |
Int
|
Section number (from 0). |
Returns:
-
Type
-
UInt
-
(static) getSectionVirtualSize(nSectionNumber) → {UInt}
-
Get the virtual size of a section.
Parameters:
Name |
Type |
Description |
nSectionNumber |
Int
|
Section number (from 0). |
Returns:
-
Type
-
UInt
-
(static) getSignature()
-
- See:
-
-
(static) getSize()
-
- See:
-
-
(static) getSizeOfCode() → {Int}
-
Get the size of code.
Returns:
-
Type
-
Int
-
(static) getSizeOfUninitializedData() → {Int}
-
Get the size of unitialized data.
Returns:
-
Type
-
Int
-
(static) getString()
-
- See:
-
-
(static) getTLSSection() → {Int}
-
Get the number of the section containing the TLS.
Returns:
If no TLS returns -1
.
-
Type
-
Int
-
(static) getVersionStringInfo(sKey) → {String}
-
Get the value associated with a version resource string key.
Parameters:
Name |
Type |
Description |
sKey |
String
|
|
Returns:
-
Type
-
String
-
(static) isConsole() → {Bool}
-
Check if the file is a console application.
Returns:
-
Type
-
Bool
-
(static) isDll() → {Bool}
-
Check if the file is a DLL.
Returns:
-
Type
-
Bool
-
(static) isDosStubPresent() → {Bool}
-
Check if there is an MSDOS stub.
Returns:
-
Type
-
Bool
-
(static) isDriver() → {Bool}
-
Check if the file is a driver.
Returns:
-
Type
-
Bool
-
(static) isLibraryFunctionPresent(sLibraryName, sFunctionName) → {Bool}
-
Check if a function exists in a library.
Parameters:
Name |
Type |
Description |
sLibraryName |
String
|
The name of the library. |
sFunctionName |
String
|
The name of the function. |
Returns:
-
Type
-
Bool
-
(static) isLibraryPresent(sLibraryName) → {Bool}
-
Check if a library is imported.
Parameters:
Name |
Type |
Description |
sLibraryName |
String
|
The name of the library. |
Returns:
-
Type
-
Bool
Example
if(PE.isLibraryPresent("MSVBVM50.DLL"))
{
sVersion="5.0";
bDetected=1;
}
-
(static) isLibraryPresentExp() → (nullable) {Array}
-
Locate the first library matching a pattern.
Returns:
null
if not found, otherwise:
[-1]
is the number of the library;
[0]
is the name of the library (lower cased);
[1]
onwards are the captured subpatterns.
-
Type
-
Array
-
(static) isNET() → {Bool}
-
Check if the file is a .NET application.
Returns:
-
Type
-
Bool
-
(static) isNETStringPresent(sString) → {Bool}
-
Check if there is a specific .NET string.
Parameters:
Name |
Type |
Description |
sString |
String
|
|
Returns:
-
Type
-
Bool
Example
if(PE.isNETStringPresent(0,"DotfuscatorAttribute"))
{
bDetected=1;
}
-
(static) isNETUnicodeStringPresent(sString) → {Bool}
-
Check if there is a specific .NET Unicode string.
Parameters:
Name |
Type |
Description |
sString |
String
|
|
Returns:
-
Type
-
Bool
Example
if(PE.isNETUnicodeStringPresent("E_TamperDetected"))
{
sVersion="3.X-4.X";
bDetected=1;
}
-
(static) isOverlayPresent() → {Bool}
-
Check if there is an overlay in the file.
Returns:
-
Type
-
Bool
-
(static) isPEPlus() → {Bool}
-
Check if the file is 64 bit (PE+).
Returns:
-
Type
-
Bool
Example
if(PE.isPEPlus())
{
sOptions="PE+";
}
-
(static) isResourceNamePresent(sName) → {Bool}
-
Check if there is a resource with a specific name in the file.
Parameters:
Name |
Type |
Description |
sName |
String
|
The name of the resource. |
Returns:
-
Type
-
Bool
Example
if(PE.isResourceNamePresent("PACKAGEINFO"))
{
bDetected=1;
}
-
(static) isRichSignaturePresent() → {Bool}
-
Returns:
-
Type
-
Bool
Example
if(PE.isRichSignaturePresent())
{
sName="Microsoft Linker";
bDetected=1;
}
-
(static) isRichVersionPresent(nVersion) → {Bool}
-
Check if there is a Rich version.
Parameters:
Name |
Type |
Description |
nVersion |
UInt
|
Rich version. |
Returns:
-
Type
-
Bool
-
(static) isSectionNamePresent(sSectionName) → {Bool}
-
Checks if a section exists with a specific name.
Parameters:
Name |
Type |
Description |
sSectionName |
String
|
Section name. |
Returns:
-
Type
-
Bool
-
(static) isSectionNamePresentExp(sSectionName) → {Bool}
-
Check if a section name matches a regular expression.
Parameters:
Name |
Type |
Description |
sSectionName |
String
|
Section pattern. |
Returns:
-
Type
-
Bool
-
(static) isSignatureInSectionPresent(nSection, sSignature) → {Bool}
-
Parameters:
Name |
Type |
Description |
nSection |
Int
|
Section number (from 0). |
sSignature |
String
|
Signature. |
Returns:
-
Type
-
Bool
Example
if(PE.isSignatureInSectionPresent(0,"'ENIGMA'"))
{
bDetected=1;
}
-
(static) isSignaturePresent()
-
- See:
-
-
(static) isSignedFile() → {Bool}
-
Check if there is a digital signature.
Returns:
-
Type
-
Bool
-
(static) OffsetToRVA(nOffset) → {Int64}
-
Convert a file offset to a relative virtual address (RVA).
Parameters:
Name |
Type |
Description |
nOffset |
UInt64
|
|
Returns:
If an error occurs, -1 will be returned.
-
Type
-
Int64
-
(static) OffsetToVA(nOffset) → {Int64}
-
Convert a file offset to a virtual address (VA).
Parameters:
Name |
Type |
Description |
nOffset |
UInt64
|
|
Returns:
If an error occurs, -1 will be returned.
-
Type
-
Int64
-
(static) readByte()
-
- See:
-
-
(static) readDword()
-
- See:
-
-
(static) readWord()
-
- See:
-
-
(static) RVAToOffset(nRVA) → {Int64}
-
Convert a relative virtual address (RVA) to a file offset.
Parameters:
Name |
Type |
Description |
nRVA |
UInt64
|
|
Returns:
If an error occurs, -1 will be returned.
-
Type
-
Int64
-
(static) swapBytes()
-
- See:
-
-
(static) VAToOffset(nVA) → {Int64}
-
Convert a virtual address (VA) to a file offset.
Parameters:
Name |
Type |
Description |
nVA |
UInt64
|
|
Returns:
If an error occurs, -1 will be returned.
-
Type
-
Int64