OptionHeaderTypes PE+_IMAGE_OPTIONAL_HEADER32 PE+_IMAGE_OPTIONAL_HEADER64 PEView PEHeader Module DOSHeader FileHeader OptionalHeader SectionHeaders Imports Exports OptionalHeaderView OptionHeaderTypes Magic MajorLinkerVersion MinorLinkerVersion SizeOfCode "0x$($_.SizeOfCode.ToString('X8'))" SizeOfInitializedData "0x$($_.SizeOfInitializedData.ToString('X8'))" SizeOfUninitializedData "0x$($_.SizeOfUninitializedData.ToString('X8'))" AddressOfEntryPoint "0x$($_.AddressOfEntryPoint.ToString('X8'))" BaseOfCode "0x$($_.BaseOfCode.ToString('X8'))" BaseOfData "0x$($_.BaseOfData.ToString('X8'))" ImageBase if ($_.Magic.ToString() -eq 'PE32') { "0x$($_.ImageBase.ToString('X8'))" } else { "0x$($_.ImageBase.ToString('X16'))" } SectionAlignment "0x$($_.SectionAlignment.ToString('X8'))" FileAlignment "0x$($_.FileAlignment.ToString('X8'))" MajorOperatingSystemVersion MinorOperatingSystemVersion MajorSubsystemVersion MinorSubsystemVersion Win32VersionValue SizeOfImage "0x$($_.SizeOfImage.ToString('X8'))" SizeOfHeaders "0x$($_.SizeOfHeaders.ToString('X8'))" CheckSum "0x$($_.CheckSum.ToString('X8'))" Subsystem DllCharacteristics SizeOfStackReserve if ($_.Magic.ToString() -eq 'PE32') { "0x$($_.SizeOfStackReserve.ToString('X8'))" } else { "0x$($_.SizeOfStackReserve.ToString('X16'))" } SizeOfStackCommit if ($_.Magic.ToString() -eq 'PE32') { "0x$($_.SizeOfStackCommit.ToString('X8'))" } else { "0x$($_.SizeOfStackCommit.ToString('X16'))" } SizeOfHeapReserve if ($_.Magic.ToString() -eq 'PE32') { "0x$($_.SizeOfHeapReserve.ToString('X8'))" } else { "0x$($_.SizeOfHeapReserve.ToString('X16'))" } SizeOfHeapCommit if ($_.Magic.ToString() -eq 'PE32') { "0x$($_.SizeOfHeapCommit.ToString('X8'))" } else { "0x$($_.SizeOfHeapCommit.ToString('X16'))" } LoaderFlags NumberOfRvaAndSizes DataDirectory SectionHeaderView PE+_IMAGE_SECTION_HEADER Name Right VirtualSize VirtualAddress SizeOfRawData PointerToRawData Characteristics Left Right Name "0x$($_.VirtualSize.ToString('X8'))" "0x$($_.VirtualAddress.ToString('X8'))" "0x$($_.SizeOfRawData.ToString('X8'))" "0x$($_.PointerToRawData.ToString('X8'))" Characteristics FileHeaderView PE+_IMAGE_FILE_HEADER Machine NumberOfSections TimeDateStamp (New-Object DateTime(1970, 1, 1, 0, 0, 0)).AddSeconds($_.TimeDateStamp) PointerToSymbolTable NumberOfSymbols SizeOfOptionalHeader Characteristics DataDirectoryView PE+_IMAGE_DATA_DIRECTORY VirtualAddress Size "0x$($_.VirtualAddress.ToString('X8'))" "0x$($_.Size.ToString('X8'))" ImportView Import ModuleName Right VA/FT Ordinal FunctionName Right ModuleName RVA Ordinal FunctionName ExportView Export RVA Ordinal FunctionName ForwardedName RVA Ordinal FunctionName ForwardedName