PE Information

Imports System.Runtime.InteropServices

Public Class Form1

    <StructLayout(LayoutKind.Sequential, Pack:=1)> _
    Public Structure IMAGE_DOS_HEADER
        Public e_magic As UInt16
        Public e_cblp As UInt16
        Public e_cp As UInt16
        Public e_crlc As UInt16
        Public e_cparhdr As UInt16
        Public e_minalloc As UInt16
        Public e_maxalloc As UInt16
        Public e_ss As UInt16
        Public e_sp As UInt16
        Public e_csum As UInt16
        Public e_ip As UInt16
        Public e_cs As UInt16
        Public e_lfarlc As UInt16
        Public e_ovno As UInt16
        Public e_res_0 As UInt16
        Public e_res_1 As UInt16
        Public e_res_2 As UInt16
        Public e_res_3 As UInt16
        Public e_oemid As UInt16
        Public e_oeminfo As UInt16
        Public e_res2_0 As UInt16
        Public e_res2_1 As UInt16
        Public e_res2_2 As UInt16
        Public e_res2_3 As UInt16
        Public e_res2_4 As UInt16
        Public e_res2_5 As UInt16
        Public e_res2_6 As UInt16
        Public e_res2_7 As UInt16
        Public e_res2_8 As UInt16
        Public e_res2_9 As UInt16
        Public e_lfanew As UInt32
    End Structure
    <StructLayout(LayoutKind.Sequential, Pack:=1)> _
        Public Structure IMAGE_FILE_HEADER
        Public Machine As UInt16
        Public NumberOfSections As UInt16
        Public TimeDateStamp As UInt32
        Public PointerToSymbolTable As UInt32
        Public NumberOfSymbols As UInt32
        Public SizeOfOptionalHeader As UInt16
        Public Characteristics As UInt16

    End Structure
    <StructLayout(LayoutKind.Sequential, Pack:=1)> _
        Public Structure IMAGE_OPTIONAL_HEADER
        Public Magic As UInt16
        Public MajorLinkerVersion As Byte
        Public MinorLinkerVersion As Byte
        Public SizeOfCode As UInt32
        Public SizeOfInitializedData As UInt32
        Public SizeOfUninitializedData As UInt32
        Public AddressOfEntryPoint As UInt32
        Public BaseOfCode As UInt32
        Public BaseOfData As UInt32
        Public ImageBase As UInt32
        Public SectionAlignment As UInt32
        Public FileAlignment As UInt32
        Public MajorOperatingSystemVersion As UInt16
        Public MinorOperatingSystemVersion As UInt16
        Public MajorImageVersion As UInt16
        Public MinorImageVersion As UInt16
        Public MajorSubsystemVersion As UInt16
        Public MinorSubsystemVersion As UInt16
        Public Win32VersionValue As UInt32
        Public SizeOfImage As UInt32
        Public SizeOfHeaders As UInt32
        Public CheckSum As UInt32
        Public Subsystem As UInt16
        Public DllCharacteristics As UInt16
        Public SizeOfStackReserve As UInt32
        Public SizeOfStackCommit As UInt32
        Public SizeOfHeapReserve As UInt32
        Public SizeOfHeapCommit As UInt32
        Public LoaderFlags As UInt32
        Public NumberOfRvaAndSizes As UInt32
    End Structure
    <StructLayout(LayoutKind.Sequential)> _
        Public Structure IMAGE_NT_HEADERS
        Public Signature As UInt32
        Public FileHeader As IMAGE_FILE_HEADER
        Public OptionalHeader As IMAGE_OPTIONAL_HEADER
    End Structure

    Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click
        Dim x As New OpenFileDialog
        x.Filter = "Executable File |*.exe"
        If x.ShowDialog = Windows.Forms.DialogResult.OK Then
            FlatTextBox1.Text = x.FileName
        End If
        '---------------
        Dim data As Byte() = IO.File.ReadAllBytes(FlatTextBox1.Text)
        Dim g As GCHandle = GCHandle.Alloc(data, GCHandleType.Pinned)
        Dim Pointer As IntPtr = g.AddrOfPinnedObject
        Dim DosHeader As New IMAGE_DOS_HEADER
        DosHeader = Marshal.PtrToStructure(Pointer, GetType(IMAGE_DOS_HEADER))
        Pointer = Pointer.ToInt32 + DosHeader.e_lfanew
        Dim PE As New IMAGE_NT_HEADERS
        PE = Marshal.PtrToStructure(Pointer, GetType(IMAGE_NT_HEADERS))
        '-----------------
        TextBox1.Text = PE.FileHeader.NumberOfSections
        TextBox2.Text = PE.FileHeader.TimeDateStamp.ToString("X")
        TextBox3.Text = PE.FileHeader.Characteristics.ToString("X")
        TextBox4.Text = PE.OptionalHeader.AddressOfEntryPoint.ToString("X")
        TextBox5.Text = PE.OptionalHeader.SizeOfCode
        TextBox6.Text = PE.OptionalHeader.ImageBase.ToString("X")
        TextBox7.Text = PE.OptionalHeader.BaseOfCode.ToString("X")
        TextBox8.Text = PE.OptionalHeader.BaseOfData.ToString("X")


    End Sub
End Class