From 65ebaea880b1470718f609e1946f950e7fff0d81 Mon Sep 17 00:00:00 2001 From: bitform Date: Sun, 22 Jul 2012 15:16:22 -0400 Subject: Added Get-PEHeader. PETools is now a module. Get-PEHeader is a 32 and 64-bit in-memory and on-disk PE parsing utility. PETools is now a PowerShell module that can be loaded with `Import-Module PETools` --- PETools/PETools.format.ps1xml | 374 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 374 insertions(+) create mode 100644 PETools/PETools.format.ps1xml (limited to 'PETools/PETools.format.ps1xml') diff --git a/PETools/PETools.format.ps1xml b/PETools/PETools.format.ps1xml new file mode 100644 index 0000000..2a1cbdb --- /dev/null +++ b/PETools/PETools.format.ps1xml @@ -0,0 +1,374 @@ + + + + + OptionHeaderTypes + + PE+_IMAGE_OPTIONAL_HEADER32 + PE+_IMAGE_OPTIONAL_HEADER64 + + + + + + PEView + + PEHeader + + + + + + + Module + + + DOSHeader + + + FileHeader + + + OptionalHeader + + + SectionHeaders + + + Imports + + + Exports + + + + + + + + OptionalHeaderView + + OptionHeaderTypes + + + + + + + Magic + + + MajorLinkerVersion + + + MinorLinkerVersion + + + + "0x$($_.SizeOfCode.ToString('X8'))" + + + + "0x$($_.SizeOfInitializedData.ToString('X8'))" + + + + "0x$($_.SizeOfUninitializedData.ToString('X8'))" + + + + "0x$($_.AddressOfEntryPoint.ToString('X8'))" + + + + "0x$($_.BaseOfCode.ToString('X8'))" + + + + "0x$($_.BaseOfData.ToString('X8'))" + + + + if ($_.Magic.ToString() -eq 'PE32') { "0x$($_.ImageBase.ToString('X8'))" } else { "0x$($_.ImageBase.ToString('X16'))" } + + + + "0x$($_.SectionAlignment.ToString('X8'))" + + + + "0x$($_.FileAlignment.ToString('X8'))" + + + MajorOperatingSystemVersion + + + MinorOperatingSystemVersion + + + MajorSubsystemVersion + + + MinorSubsystemVersion + + + Win32VersionValue + + + + "0x$($_.SizeOfImage.ToString('X8'))" + + + + "0x$($_.SizeOfHeaders.ToString('X8'))" + + + + "0x$($_.CheckSum.ToString('X8'))" + + + Subsystem + + + DllCharacteristics + + + + if ($_.Magic.ToString() -eq 'PE32') { "0x$($_.ImageBase.ToString('X8'))" } else { "0x$($_.ImageBase.ToString('X16'))" } + + + + if ($_.Magic.ToString() -eq 'PE32') { "0x$($_.ImageBase.ToString('X8'))" } else { "0x$($_.ImageBase.ToString('X16'))" } + + + + if ($_.Magic.ToString() -eq 'PE32') { "0x$($_.ImageBase.ToString('X8'))" } else { "0x$($_.ImageBase.ToString('X16'))" } + + + + if ($_.Magic.ToString() -eq 'PE32') { "0x$($_.ImageBase.ToString('X8'))" } else { "0x$($_.ImageBase.ToString('X16'))" } + + + LoaderFlags + + + NumberOfRvaAndSizes + + + DataDirectory + + + + + + + + SectionHeaderView + + PE+_IMAGE_SECTION_HEADER + + + + + + + Right + + + + + + + + + + + + + + + + Left + + + + + + + Right + Name + + + "0x$($_.VirtualSize.ToString('X8'))" + + + "0x$($_.VirtualAddress.ToString('X8'))" + + + "0x$($_.SizeOfRawData.ToString('X8'))" + + + "0x$($_.PointerToRawData.ToString('X8'))" + + + Characteristics + + + + + + + + FileHeaderView + + PE+_IMAGE_FILE_HEADER + + + + + + + Machine + + + NumberOfSections + + + + + (New-Object DateTime(1970, 1, 1, 0, 0, 0)).AddSeconds($_.TimeDateStamp) + + + + + PointerToSymbolTable + + + NumberOfSymbols + + + SizeOfOptionalHeader + + + Characteristics + + + + + + + + DataDirectoryView + + PE+_IMAGE_DATA_DIRECTORY + + + + + + + + + + + + + + + + "0x$($_.VirtualAddress.ToString('X8'))" + + + "0x$($_.Size.ToString('X8'))" + + + + + + + + ImportView + + Import + + + + + + + Right + + + + + + + + + + + + + + + + Right + ModuleName + + + VA + + + Ordinal + + + FunctionName + + + + + + + + ExportView + + Export + + + + + + + + + + + + + + + + + + + + + + VA + + + Ordinal + + + FunctionName + + + ForwardedName + + + + + + + + \ No newline at end of file -- cgit v1.2.3