+
+-
+
(static) calculateEntropy()
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ - See:
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) calculateMD5()
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ - See:
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
+
+
+
+-
+
+
+
+ Calculate the size of the headers.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+UInt
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) compare()
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ - See:
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) compareEP(sSignature, nOffsetopt) → {Bool}
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+ Attributes |
+
+
+
+ Default |
+
+
+ Description |
+
+
+
+
+
+
+
+
+ sSignature |
+
+
+
+
+
+String
+
+
+
+ |
+
+
+
+
+
+
+
+
+ |
+
+
+
+
+
+ |
+
+
+ The signature. |
+
+
+
+
+
+
+ nOffset |
+
+
+
+
+
+Int
+
+
+
+ |
+
+
+
+
+ <optional>
+
+
+
+
+
+ |
+
+
+
+
+
+ 0
+
+ |
+
+
+ The offset from the entry point. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Bool
+
+
+
+
+
+
+
+
+ Example
+
+ if(PE.compareEP("2C81",8))
{
sVersion="1.98";
}
if(PE.compareEP("EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C24"))
{
bDetected=1;
}
+
+
+
+
+
+
+-
+
(static) compareEP_NET(sSignature, nOffsetopt) → {Bool}
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+ Attributes |
+
+
+
+ Default |
+
+
+ Description |
+
+
+
+
+
+
+
+
+ sSignature |
+
+
+
+
+
+String
+
+
+
+ |
+
+
+
+
+
+
+
+
+ |
+
+
+
+
+
+ |
+
+
+ The signature. |
+
+
+
+
+
+
+ nOffset |
+
+
+
+
+
+Int
+
+
+
+ |
+
+
+
+
+ <optional>
+
+
+
+
+
+ |
+
+
+
+
+
+ 0
+
+ |
+
+
+ The offset from the entry point of .NET. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Bool
+
+
+
+
+
+
+
+
+ Example
+
+ if(PE.compareEP_NET("4228070000066f09000006283800000a2a1b3004006f0000000d0000110272b9"))
{
bDetected=1;
sVersion="2.X";
}
+
+
+
+
+
+
+-
+
(static) compareOverlay(sSignature, nOffsetopt) → {Bool}
+
+
+
+-
+
+
+
+ Compare bytes at the overlay.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+ Attributes |
+
+
+
+ Default |
+
+
+ Description |
+
+
+
+
+
+
+
+
+ sSignature |
+
+
+
+
+
+String
+
+
+
+ |
+
+
+
+
+
+
+
+
+ |
+
+
+
+
+
+ |
+
+
+ The signature. |
+
+
+
+
+
+
+ nOffset |
+
+
+
+
+
+Int
+
+
+
+ |
+
+
+
+
+ <optional>
+
+
+
+
+
+ |
+
+
+
+
+
+ 0
+
+ |
+
+
+ The offset from the overlay. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Bool
+
+
+
+
+
+
+
+
+ Example
+
+ if(PE.compareOverlay("';!@Install@!UTF-8!'"))
{
bDetected=1;
}
+
+
+
+
+
+
+-
+
(static) findByte()
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ - See:
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) findDword()
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ - See:
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) findSignature()
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ - See:
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Example
+
+ nOffset=PE.findSignature(nOffset,1024,"'7z'BCAF271C");
if(nOffset!=-1)
{
bDetected=1;
}
+
+
+
+
+
+
+-
+
(static) findString()
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ - See:
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Example
+
+ nOffset=PE.findString(0,1024,"UPX!");
if(nOffset==-1)
{
return;
}
+
+
+
+
+
+
+-
+
(static) findWord()
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ - See:
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getAddressOfEntryPoint() → {UInt}
+
+
+
+-
+
+
+
+ Get the relative virtual address (RVA) of the entry point.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+UInt
+
+
+
+
+
+
+
+
+ Example
+
+ var nSection=PE.nLastSection;
if(nSection>=2)
{
if(PE.getAddressOfEntryPoint()==PE.section[nSection].VirtualAddress)
{
if(PE.section[nSection].Characteristics==0xe0000040)
{
if(PE.section[nSection-1].Characteristics==0xe0000040)
{
if(PE.getNumberOfImportThunks(0)==1)
{
bDetected=1;
}
}
}
}
}
+
+
+
+
+
+
+-
+
(static) getCompilerVersion() → {String}
+
+
+
+-
+
+
+
+ Get the compiler version.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+ The string "MajorLinkerVersion.MinorLinkerVersion".
+
+
+
+
+
+ -
+ Type
+
+ -
+
+String
+
+
+
+
+
+
+
+
+ Example
+
+ if(bDetected)
{
switch(PE.getCompilerVersion())
{
case "6.0": sVersion="6.0"; break;
case "7.0": sVersion="2002"; break;
case "7.10": sVersion="2003"; break;
case "8.0": sVersion="2005"; break;
case "9.0": sVersion="2008"; break;
case "10.0": sVersion="2010"; break;
case "11.0": sVersion="2012"; break;
case "12.0": sVersion="2013"; break;
}
}
+
+
+
+
+
+
+-
+
(static) getDosStubOffset() → {UInt}
+
+
+
+-
+
+
+
+ Get the file offset of the MSDOS stub.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+UInt
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getDosStubSize() → {UInt}
+
+
+
+-
+
+
+
+ Get the size of the MSDOS stub.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+UInt
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getEntryPointOffset() → {Int64}
+
+
+
+-
+
+
+
+ Get the offset of the entry point.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+ If an error occurs, -1 will be returned.
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Int64
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getEntryPointSection() → {Int}
+
+
+
+-
+
+
+
+ Get the number of the section containing the entry point.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+ If no entry point returns -1.
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Int
+
+
+
+
+
+
+
+
+ Example
+
+ if(PE.getEntryPointSection()==PE.nLastSection)
{
bDetected=1;
}
+
+
+
+
+
+
+-
+
(static) getEPSignature()
+
+
+
+-
+
+
+
+ Get the signature at an offset of the entry point.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ - See:
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getExportSection() → {Int}
+
+
+
+-
+
+
+
+ Get the number of the section containing the export table.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+ If no export returns -1.
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Int
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getFileBaseName()
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ - See:
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getFileCompleteSuffix()
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ - See:
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getFileDirectory()
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ - See:
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getFileSuffix()
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ - See:
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getFileVersion() → {String}
+
+
+
+-
+
+
+
+ Get the version of the file, if the version resource exists.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+String
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getGeneralOptions() → {String}
+
+
+
+-
+
+
+
+ Get a string in the form of "PEtypePEmode". For example "EXE32" or "Driver32".
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+String
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getGeneralOptionsEx() → {String}
+
+
+
+-
+
+
+
+ Add console and/or admininistrator requirement to the general options.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+String
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getImageBase() → {UInt}
+
+
+
+-
+
+
+
+ Get the base address of the image.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+UInt
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getImportFunctionName(nImport, nFunctionNumber) → {String}
+
+
+
+-
+
+
+
+ Get the name of an imported function.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ nImport |
+
+
+
+
+
+UInt
+
+
+
+ |
+
+
+
+
+
+ Number of the imported library. |
+
+
+
+
+
+
+ nFunctionNumber |
+
+
+
+
+
+UInt
+
+
+
+ |
+
+
+
+
+
+ Number of the function in the library. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+String
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getImportLibraryName(nImport) → {String}
+
+
+
+-
+
+
+
+ Get the name of an imported library.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ nImport |
+
+
+
+
+
+UInt
+
+
+
+ |
+
+
+
+
+
+ Number of the imported library. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+String
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getImportSection() → {Int}
+
+
+
+-
+
+
+
+ Get the number of the section containing the import table.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+ If no import returns -1.
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Int
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getMachineType() → {UShort}
+
+
+
+-
+
+
+
+ Get the machine type.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+UShort
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getMajorLinkerVersion() → {UInt}
+
+
+
+-
+
+
+
+ Get the major linker version.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+UInt
+
+
+
+
+
+
+
+
+ Example
+
+ var nMajor=PE.getMajorLinkerVersion();
if(nMajor>3)
{
sName="Microsoft Linker";
bDetected=1;
}
+
+
+
+
+
+
+-
+
(static) getManifest() → {String}
+
+
+
+-
+
+
+
+ Get the XML manifest from the resources.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+String
+
+
+
+
+
+
+
+
+ Example
+
+ if(/requireAdministrator/.test(PE.getManifest()))
{
sOptions=sOptions.append("admin");
}
+
+
+
+
+
+
+-
+
(static) getMinorLinkerVersion() → {UInt}
+
+
+
+-
+
+
+
+ Get the minor linker version.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+UInt
+
+
+
+
+
+
+
+
+ Example
+
+ var nMinor=PE.getMinorLinkerVersion();
if(nMinor==55)
{
sName="LCC Linker";
sVersion+="*";
bDetected=1;
}
+
+
+
+
+
+
+-
+
(static) getNETVersion() → {String}
+
+
+
+-
+
+
+
+ Get the .NET version.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+String
+
+
+
+
+
+
+
+
+ Example
+
+ if(PE.isNET())
{
sVersion=PE.getNETVersion();
bDetected=1;
}
+
+
+
+
+
+
+-
+
(static) getNumberOfImports() → {Int}
+
+
+
+-
+
+
+
+ Get the number of imports.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Int
+
+
+
+
+
+
+
+
+ Example
+
+ if(PE.getNumberOfImports()==1)
{
if(PE.getNumberOfImportThunks(0)==2)
{
if(PE.section[0].Name=="ANDpakk2")
{
sVersion="2.X";
bDetected=1;
}
}
}
+
+
+
+
+
+
+-
+
(static) getNumberOfImportThunks(nImport) → {UInt}
+
+
+
+-
+
+
+
+ Get the number of functions in the imported library.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ nImport |
+
+
+
+
+
+UInt
+
+
+
+ |
+
+
+
+
+
+ Number of the library. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+UInt
+
+
+
+
+
+
+
+
+ Example
+
+ if(PE.getNumberOfImportThunks(0)==1)
{
bDetected=1;
}
+
+
+
+
+
+
+-
+
(static) getNumberOfResources() → {UInt}
+
+
+
+-
+
+
+
+ Get the number of resources.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+UInt
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getNumberOfRichIDs() → {UInt}
+
+
+
+-
+
+
+
+ Get the number of the Rich IDs.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+UInt
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getNumberOfSections() → {Int}
+
+
+
+-
+
+
+
+ Get the number of sections.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Int
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getOverlayOffset() → {UInt}
+
+
+
+-
+
+
+
+ Get the file offset of the overlay.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+UInt
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getOverlaySize() → {UInt}
+
+
+
+-
+
+
+
+ Get the size of the overlay .
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+UInt
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getPEFileVersion(sFileName) → {String}
+
+
+
+-
+
+
+
+ Get the version of a particular file, if the version resource exists.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ sFileName |
+
+
+
+
+
+String
+
+
+
+ |
+
+
+
+
+
+ The file name. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+String
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getRelocsSection() → {Int}
+
+
+
+-
+
+
+
+ Get the number of the section containing the relocations.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+ If no relocations returns -1.
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Int
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getResourceIdByNumber(nNumber) → {UInt}
+
+
+
+-
+
+
+
+ Get the Id of a resource.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ nNumber |
+
+
+
+
+
+UInt
+
+
+
+ |
+
+
+
+
+
+ Number of resource. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+UInt
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getResourceNameByNumber(nNumber) → {String}
+
+
+
+-
+
+
+
+ Get the name of a resource.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ nNumber |
+
+
+
+
+
+UInt
+
+
+
+ |
+
+
+
+
+
+ Number of resource. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+String
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getResourceNameOffset(sFileName) → {Int}
+
+
+
+-
+
+
+
+ Get the file offset to a named resource.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ sFileName |
+
+
+
+
+
+String
+
+
+
+ |
+
+
+
+
+
+ The name of the resource. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+ If an error occurs, -1 will be returned.
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Int
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getResourceNameSize(sFileName) → {Int}
+
+
+
+-
+
+
+
+ Get the size of a named resource.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ sFileName |
+
+
+
+
+
+String
+
+
+
+ |
+
+
+
+
+
+ The name of the resource. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Int
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getResourceOffsetByNumber(nNumber) → {Int}
+
+
+
+-
+
+
+
+ Get the offset of a resource.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ nNumber |
+
+
+
+
+
+UInt
+
+
+
+ |
+
+
+
+
+
+ Number of resource. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+ If an error occurs, -1 will be returned.
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Int
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getResourceSection() → {Int}
+
+
+
+-
+
+
+
+ Get the number of the section containing the resources.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+ If no resources returns -1.
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Int
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getResourceSizeByNumber(nNumber) → {Int}
+
+
+
+-
+
+
+
+ Get the size of a resource.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ nNumber |
+
+
+
+
+
+UInt
+
+
+
+ |
+
+
+
+
+
+ Number of resource. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Int
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getResourceTypeByNumber(nNumber) → {String}
+
+
+
+-
+
+
+
+ Get the type of a resource.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ nNumber |
+
+
+
+
+
+UInt
+
+
+
+ |
+
+
+
+
+
+ Number of resource. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+String
+
+
+
+
+
+
+
+
+ Example
+
+ if(PE.getResourceTypeByNumber(0)=="RT_MANIFEST")
{
bDetected=1;
}
+
+
+
+
+
+
+-
+
(static) getSectionCharacteristics(nSectionNumber) → {UInt}
+
+
+
+-
+
+
+
+ Get the characteristics of a section.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ nSectionNumber |
+
+
+
+
+
+Int
+
+
+
+ |
+
+
+
+
+
+ Section number (from 0). |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+UInt
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getSectionFileOffset(nSectionNumber) → {UInt}
+
+
+
+-
+
+
+
+ Get the file offset of a setion.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ nSectionNumber |
+
+
+
+
+
+Int
+
+
+
+ |
+
+
+
+
+
+ Section number (from 0). |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+UInt
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getSectionFileSize(nSectionNumber) → {UInt}
+
+
+
+-
+
+
+
+ Get the file size of a section.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ nSectionNumber |
+
+
+
+
+
+Int
+
+
+
+ |
+
+
+
+
+
+ Section number (from 0). |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+UInt
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getSectionName(nSectionNumber) → {String}
+
+
+
+-
+
+
+
+ Get the name of a section.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ nSectionNumber |
+
+
+
+
+
+Int
+
+
+
+ |
+
+
+
+
+
+ Section number (from 0). |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+String
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getSectionNameCollision(sString1, sString2) → {String}
+
+
+
+-
+
+
+
+ Get the common prefix of two section name suffixes.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ sString1 |
+
+
+
+
+
+String
+
+
+
+ |
+
+
+
+
+
+ First section name suffix. |
+
+
+
+
+
+
+ sString2 |
+
+
+
+
+
+String
+
+
+
+ |
+
+
+
+
+
+ Second section name suffix. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+ Section name prefix.
+
+
+
+
+
+ -
+ Type
+
+ -
+
+String
+
+
+
+
+
+
+
+
+ Example
+
+ if("UPX"==PE.getSectionNameCollision("0","1"))
{
// Both "UPX0" and "UPX1" exist.
bDetected=1;
}
+
+
+
+
+
+
+-
+
(static) getSectionNumber(sSectionName) → {Int}
+
+
+
+-
+
+
+
+ Get the number of a section with a specific name.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ sSectionName |
+
+
+
+
+
+String
+
+
+
+ |
+
+
+
+
+
+ Section name. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+ 0-based section number, or -1 if there is no section with that name.
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Int
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getSectionNumberExp(sSectionName) → {Int}
+
+
+
+-
+
+
+
+ Get the number of a section whose name matches a regular expression.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ sSectionName |
+
+
+
+
+
+String
+
+
+
+ |
+
+
+
+
+
+ Section pattern. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+ 0-based section number, or -1 if there is no section with that pattern.
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Int
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getSectionVirtualAddress(nSectionNumber) → {UInt}
+
+
+
+-
+
+
+
+ Get the relative virtual address of a section.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ nSectionNumber |
+
+
+
+
+
+Int
+
+
+
+ |
+
+
+
+
+
+ Section number (from 0). |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+UInt
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getSectionVirtualSize(nSectionNumber) → {UInt}
+
+
+
+-
+
+
+
+ Get the virtual size of a section.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ nSectionNumber |
+
+
+
+
+
+Int
+
+
+
+ |
+
+
+
+
+
+ Section number (from 0). |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+UInt
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getSignature()
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ - See:
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getSize()
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ - See:
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getSizeOfCode() → {Int}
+
+
+
+-
+
+
+
+ Get the size of code.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Int
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getSizeOfUninitializedData() → {Int}
+
+
+
+-
+
+
+
+ Get the size of unitialized data.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Int
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getString()
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ - See:
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getTLSSection() → {Int}
+
+
+
+-
+
+
+
+ Get the number of the section containing the TLS.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+ If no TLS returns -1.
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Int
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) getVersionStringInfo(sKey) → {String}
+
+
+
+-
+
+
+
+ Get the value associated with a version resource string key.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ sKey |
+
+
+
+
+
+String
+
+
+
+ |
+
+
+
+
+
+ |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+String
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) isConsole() → {Bool}
+
+
+
+-
+
+
+
+ Check if the file is a console application.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Bool
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) isDll() → {Bool}
+
+
+
+-
+
+
+
+ Check if the file is a DLL.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Bool
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) isDosStubPresent() → {Bool}
+
+
+
+-
+
+
+
+ Check if there is an MSDOS stub.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Bool
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) isDriver() → {Bool}
+
+
+
+-
+
+
+
+ Check if the file is a driver.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Bool
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) isLibraryFunctionPresent(sLibraryName, sFunctionName) → {Bool}
+
+
+
+-
+
+
+
+ Check if a function exists in a library.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ sLibraryName |
+
+
+
+
+
+String
+
+
+
+ |
+
+
+
+
+
+ The name of the library. |
+
+
+
+
+
+
+ sFunctionName |
+
+
+
+
+
+String
+
+
+
+ |
+
+
+
+
+
+ The name of the function. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Bool
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) isLibraryPresent(sLibraryName) → {Bool}
+
+
+
+-
+
+
+
+ Check if a library is imported.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ sLibraryName |
+
+
+
+
+
+String
+
+
+
+ |
+
+
+
+
+
+ The name of the library. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Bool
+
+
+
+
+
+
+
+
+ Example
+
+ if(PE.isLibraryPresent("MSVBVM50.DLL"))
{
sVersion="5.0";
bDetected=1;
}
+
+
+
+
+
+
+-
+
(static) isLibraryPresentExp() → (nullable) {Array}
+
+
+
+-
+
+
+
+ Locate the first library matching a pattern.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+ null if not found, otherwise:
[-1] is the number of the library;
[0] is the name of the library (lower cased);
[1] onwards are the captured subpatterns.
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Array
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) isNET() → {Bool}
+
+
+
+-
+
+
+
+ Check if the file is a .NET application.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Bool
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) isNETStringPresent(sString) → {Bool}
+
+
+
+-
+
+
+
+ Check if there is a specific .NET string.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ sString |
+
+
+
+
+
+String
+
+
+
+ |
+
+
+
+
+
+ |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Bool
+
+
+
+
+
+
+
+
+ Example
+
+ if(PE.isNETStringPresent(0,"DotfuscatorAttribute"))
{
bDetected=1;
}
+
+
+
+
+
+
+-
+
(static) isNETUnicodeStringPresent(sString) → {Bool}
+
+
+
+-
+
+
+
+ Check if there is a specific .NET Unicode string.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ sString |
+
+
+
+
+
+String
+
+
+
+ |
+
+
+
+
+
+ |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Bool
+
+
+
+
+
+
+
+
+ Example
+
+ if(PE.isNETUnicodeStringPresent("E_TamperDetected"))
{
sVersion="3.X-4.X";
bDetected=1;
}
+
+
+
+
+
+
+-
+
(static) isOverlayPresent() → {Bool}
+
+
+
+-
+
+
+
+ Check if there is an overlay in the file.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Bool
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) isPEPlus() → {Bool}
+
+
+
+-
+
+
+
+ Check if the file is 64 bit (PE+).
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Bool
+
+
+
+
+
+
+
+
+ Example
+
+ if(PE.isPEPlus())
{
sOptions="PE+";
}
+
+
+
+
+
+
+-
+
(static) isResourceNamePresent(sName) → {Bool}
+
+
+
+-
+
+
+
+ Check if there is a resource with a specific name in the file.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ sName |
+
+
+
+
+
+String
+
+
+
+ |
+
+
+
+
+
+ The name of the resource. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Bool
+
+
+
+
+
+
+
+
+ Example
+
+ if(PE.isResourceNamePresent("PACKAGEINFO"))
{
bDetected=1;
}
+
+
+
+
+
+
+-
+
(static) isRichSignaturePresent() → {Bool}
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Bool
+
+
+
+
+
+
+
+
+ Example
+
+ if(PE.isRichSignaturePresent())
{
sName="Microsoft Linker";
bDetected=1;
}
+
+
+
+
+
+
+-
+
(static) isRichVersionPresent(nVersion) → {Bool}
+
+
+
+-
+
+
+
+ Check if there is a Rich version.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ nVersion |
+
+
+
+
+
+UInt
+
+
+
+ |
+
+
+
+
+
+ Rich version. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Bool
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) isSectionNamePresent(sSectionName) → {Bool}
+
+
+
+-
+
+
+
+ Checks if a section exists with a specific name.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ sSectionName |
+
+
+
+
+
+String
+
+
+
+ |
+
+
+
+
+
+ Section name. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Bool
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) isSectionNamePresentExp(sSectionName) → {Bool}
+
+
+
+-
+
+
+
+ Check if a section name matches a regular expression.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ sSectionName |
+
+
+
+
+
+String
+
+
+
+ |
+
+
+
+
+
+ Section pattern. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Bool
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) isSignatureInSectionPresent(nSection, sSignature) → {Bool}
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ nSection |
+
+
+
+
+
+Int
+
+
+
+ |
+
+
+
+
+
+ Section number (from 0). |
+
+
+
+
+
+
+ sSignature |
+
+
+
+
+
+String
+
+
+
+ |
+
+
+
+
+
+ Signature. |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Bool
+
+
+
+
+
+
+
+
+ Example
+
+ if(PE.isSignatureInSectionPresent(0,"'ENIGMA'"))
{
bDetected=1;
}
+
+
+
+
+
+
+-
+
(static) isSignaturePresent()
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ - See:
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) isSignedFile() → {Bool}
+
+
+
+-
+
+
+
+ Check if there is a digital signature.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Bool
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) OffsetToRVA(nOffset) → {Int64}
+
+
+
+-
+
+
+
+ Convert a file offset to a relative virtual address (RVA).
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ nOffset |
+
+
+
+
+
+UInt64
+
+
+
+ |
+
+
+
+
+
+ |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+ If an error occurs, -1 will be returned.
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Int64
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) OffsetToVA(nOffset) → {Int64}
+
+
+
+-
+
+
+
+ Convert a file offset to a virtual address (VA).
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ nOffset |
+
+
+
+
+
+UInt64
+
+
+
+ |
+
+
+
+
+
+ |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+ If an error occurs, -1 will be returned.
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Int64
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) readByte()
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ - See:
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) readDword()
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ - See:
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) readWord()
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ - See:
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) RVAToOffset(nRVA) → {Int64}
+
+
+
+-
+
+
+
+ Convert a relative virtual address (RVA) to a file offset.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ nRVA |
+
+
+
+
+
+UInt64
+
+
+
+ |
+
+
+
+
+
+ |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+ If an error occurs, -1 will be returned.
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Int64
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) swapBytes()
+
+
+
+-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ - See:
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+-
+
(static) VAToOffset(nVA) → {Int64}
+
+
+
+-
+
+
+
+ Convert a virtual address (VA) to a file offset.
+
+
+
+
+
+
+
+
+ Parameters:
+
+
+
+
+
+
+ | Name |
+
+
+ Type |
+
+
+
+
+
+ Description |
+
+
+
+
+
+
+
+
+ nVA |
+
+
+
+
+
+UInt64
+
+
+
+ |
+
+
+
+
+
+ |
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Returns:
+
+
+
+ If an error occurs, -1 will be returned.
+
+
+
+
+
+ -
+ Type
+
+ -
+
+Int64
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+