Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- using System;
- using System.IO;
- public enum MachineType {Unknown = 0,
- x86 = 0x014c, // IMAGE_FILE_MACHINE_I386 Intel 386
- i64 = 0x0200, // IMAGE_FILE_MACHINE_IA64 Intel Itanium processor family (64-bit)
- x64 = 0x8664 } // IMAGE_FILE_MACHINE_AMD64 NOT! AMD 64-bit processor ???
- //UPDATE : Seems IMAGE_FILE_MACHINE_EM64T = 0x8664, as well
- //http://msdn.microsoft.com/en-us/library/windows/desktop/ms680309(v=vs.85).aspx
- //Intel, reacting to the market success of AMD, admits it has been developing a clone of the AMD64 extensions named IA-32e (later renamed EM64T, then yet again renamed to Intel 64). Intel ships updated versions of its Xeon and Pentium 4 processor families supporting the new 64-bit instruction set.
- public string GetAppCompiledMachineType(string fileName)
- {
- const int PE_POINTER_OFFSET = 60;
- const int MACHINE_OFFSET = 4;
- byte[] data = new byte[4096];
- using (Stream s = new FileStream(fileName, FileMode.Open, FileAccess.Read)) {
- s.Read(data, 0, 4096);
- }
- // dos header is 64 bytes, last element, long (4 bytes) is the address of the PE header
- int PE_HEADER_ADDR = BitConverter.ToInt32(data, PE_POINTER_OFFSET);
- int machineUint = BitConverter.ToUInt16(data, PE_HEADER_ADDR + MACHINE_OFFSET);
- return ((MachineType)machineUint).ToString();
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement