PE/PE32+ Parser - VB.NET

'------------------
'Creator: aeonhack
'Site: elitevs.net
'Created: 4/10/2011
'Changed: 11/9/2011
'Version: 1.0.1
'------------------
<Obfuscation(ApplyToMembers:=True, Exclude:=True)> _
Class PE

#Region " Properties "

    Private _MACHINE_I386 As Boolean
    ReadOnly Property MACHINE_I386() As Boolean
        Get
            Return _MACHINE_I386
        End Get
    End Property

    Private _DOS_HEADER As IMAGE_DOS_HEADER
    ReadOnly Property DOS_HEADER As IMAGE_DOS_HEADER
        Get
            Return _DOS_HEADER
        End Get
    End Property

    Private _NT_SIGNATURE As UInteger
    ReadOnly Property NT_SIGNATURE As UInteger
        Get
            Return _NT_SIGNATURE
        End Get
    End Property

    Private _FILE_HEADER As IMAGE_FILE_HEADER
    ReadOnly Property FILE_HEADER As IMAGE_FILE_HEADER
        Get
            Return _FILE_HEADER
        End Get
    End Property

    Private _OPTIONAL_HEADER32 As IMAGE_OPTIONAL_HEADER32
    ReadOnly Property OPTIONAL_HEADER32 As IMAGE_OPTIONAL_HEADER32
        Get
            Return _OPTIONAL_HEADER32
        End Get
    End Property
    Private _OPTIONAL_HEADER64 As IMAGE_OPTIONAL_HEADER64
    ReadOnly Property OPTIONAL_HEADER64 As IMAGE_OPTIONAL_HEADER64
        Get
            Return _OPTIONAL_HEADER64
        End Get
    End Property

    Private _DATA_DIRECTORY As IMAGE_DATA_DIRECTORY()
    ReadOnly Property DATA_DIRECTORY As IMAGE_DATA_DIRECTORY()
        Get
            Return _DATA_DIRECTORY
        End Get
    End Property

    Private _SECTION_HEADERS As IMAGE_SECTION_HEADER()
    ReadOnly Property SECTION_HEADERS() As IMAGE_SECTION_HEADER()
        Get
            Return _SECTION_HEADERS
        End Get
    End Property

#End Region

#Region " Offsets "

    Function OS(Of T)() As Integer
        Dim Base As Integer = CInt(_DOS_HEADER.e_lfanew)

        Select Case GetType(T).GUID
            Case GetType(IMAGE_DOS_HEADER).GUID
                Base = 0
            Case GetType(IMAGE_FILE_HEADER).GUID
                Base += 4
            Case GetType(IMAGE_OPTIONAL_HEADER32).GUID
                Base += 24
            Case GetType(IMAGE_OPTIONAL_HEADER64).GUID
                Base += 24
            Case GetType(IMAGE_DATA_DIRECTORY).GUID
                Base += 24 + _FILE_HEADER.SizeOfOptionalHeader - Length
            Case GetType(IMAGE_SECTION_HEADER).GUID
                Base += 24 + _FILE_HEADER.SizeOfOptionalHeader - Length + (_DATA_DIRECTORY.Length * 8)
        End Select

        Return Base
    End Function

    Function OS(Of T)(ByVal name As String) As Integer
        If name = "Signature" Then Return CInt(_DOS_HEADER.e_lfanew)
        Return OS(Of T)() + Marshal.OffsetOf(GetType(T), name).ToInt32()
    End Function

    Function OS(Of T)(ByVal index As Integer, ByVal name As String) As Integer
        Return OS(Of T)() + (index * (Marshal.SizeOf(GetType(T))) + Marshal.OffsetOf(GetType(T), name).ToInt32())
    End Function

#End Region

#Region " Structures "

    <StructLayout(LayoutKind.Sequential, Pack:=1)> _
    Structure IMAGE_DOS_HEADER
        ReadOnly e_magic As UInt16
        ReadOnly e_cblp As UInt16
        ReadOnly e_cp As UInt16
        ReadOnly e_crlc As UInt16
        ReadOnly e_cparhdr As UInt16
        ReadOnly e_minalloc As UInt16
        ReadOnly e_maxalloc As UInt16
        ReadOnly e_ss As UInt16
        ReadOnly e_sp As UInt16
        ReadOnly e_csum As UInt16
        ReadOnly e_ip As UInt16
        ReadOnly e_cs As UInt16
        ReadOnly e_lfarlc As UInt16
        ReadOnly e_ovno As UInt16
        <MarshalAs(UnmanagedType.ByValArray, SizeConst:=4)> _
        ReadOnly e_res As UInt16()
        ReadOnly e_oemid As UInt16
        ReadOnly e_oeminfo As UInt16
        <MarshalAs(UnmanagedType.ByValArray, SizeConst:=10)> _
        ReadOnly e_res2 As UInt16()
        ReadOnly e_lfanew As UInt32
    End Structure

    <StructLayout(LayoutKind.Sequential, Pack:=1)> _
    Structure IMAGE_FILE_HEADER
        ReadOnly Machine As UInt16
        ReadOnly NumberOfSections As UInt16
        ReadOnly TimeDateStamp As UInt32
        ReadOnly PointerToSymbolTable As UInt32
        ReadOnly NumberOfSymbols As UInt32
        ReadOnly SizeOfOptionalHeader As UInt16
        ReadOnly Characteristics As UInt16
    End Structure

    <StructLayout(LayoutKind.Sequential, Pack:=1)> _
    Structure IMAGE_OPTIONAL_HEADER32
        ReadOnly Magic As UInt16
        ReadOnly MajorLinkerVersion As Byte
        ReadOnly MinorLinkerVersion As Byte
        ReadOnly SizeOfCode As UInt32
        ReadOnly SizeOfInitializedData As UInt32
        ReadOnly SizeOfUninitializedData As UInt32
        ReadOnly AddressOfEntryPoint As UInt32
        ReadOnly BaseOfCode As UInt32
        ReadOnly BaseOfData As UInt32
        ReadOnly ImageBase As UInt32
        ReadOnly SectionAlignment As UInt32
        ReadOnly FileAlignment As UInt32
        ReadOnly MajorOperatingSystemVersion As UInt16
        ReadOnly MinorOperatingSystemVersion As UInt16
        ReadOnly MajorImageVersion As UInt16
        ReadOnly MinorImageVersion As UInt16
        ReadOnly MajorSubsystemVersion As UInt16
        ReadOnly MinorSubsystemVersion As UInt16
        ReadOnly Win32VersionValue As UInt32
        ReadOnly SizeOfImage As UInt32
        ReadOnly SizeOfHeaders As UInt32
        ReadOnly CheckSum As UInt32
        ReadOnly Subsystem As UInt16
        ReadOnly DllCharacteristics As UInt16
        ReadOnly SizeOfStackReserve As UInt32
        ReadOnly SizeOfStackCommit As UInt32
        ReadOnly SizeOfHeapReserve As UInt32
        ReadOnly SizeOfHeapCommit As UInt32
        ReadOnly LoaderFlags As UInt32
        ReadOnly NumberOfRvaAndSizes As UInt32
    End Structure
    <StructLayout(LayoutKind.Sequential, Pack:=1)> _
    Structure IMAGE_OPTIONAL_HEADER64
        ReadOnly Magic As UInt16
        ReadOnly MajorLinkerVersion As Byte
        ReadOnly MinorLinkerVersion As Byte
        ReadOnly SizeOfCode As UInt32
        ReadOnly SizeOfInitializedData As UInt32
        ReadOnly SizeOfUninitializedData As UInt32
        ReadOnly AddressOfEntryPoint As UInt32
        ReadOnly BaseOfCode As UInt32
        ReadOnly ImageBase As UInt64
        ReadOnly SectionAlignment As UInt32
        ReadOnly FileAlignment As UInt32
        ReadOnly MajorOperatingSystemVersion As UInt16
        ReadOnly MinorOperatingSystemVersion As UInt16
        ReadOnly MajorImageVersion As UInt16
        ReadOnly MinorImageVersion As UInt16
        ReadOnly MajorSubsystemVersion As UInt16
        ReadOnly MinorSubsystemVersion As UInt16
        ReadOnly Win32VersionValue As UInt32
        ReadOnly SizeOfImage As UInt32
        ReadOnly SizeOfHeaders As UInt32
        ReadOnly CheckSum As UInt32
        ReadOnly Subsystem As UInt16
        ReadOnly DllCharacteristics As UInt16
        ReadOnly SizeOfStackReserve As UInt64
        ReadOnly SizeOfStackCommit As UInt64
        ReadOnly SizeOfHeapReserve As UInt64
        ReadOnly SizeOfHeapCommit As UInt64
        ReadOnly LoaderFlags As UInt32
        ReadOnly NumberOfRvaAndSizes As UInt32
    End Structure

    <StructLayout(LayoutKind.Sequential, Pack:=1)> _
    Structure IMAGE_DATA_DIRECTORY
        ReadOnly VirtualAddress As UInt32
        ReadOnly Size As UInt32
    End Structure

    <StructLayout(LayoutKind.Sequential, Pack:=1)> _
    Structure IMAGE_SECTION_HEADER
        <MarshalAs(UnmanagedType.ByValTStr, SizeConst:=8)> _
        ReadOnly Name As String
        ReadOnly Misc As UInt32
        ReadOnly VirtualAddress As UInt32
        ReadOnly SizeOfRawData As UInt32
        ReadOnly PointerToRawData As UInt32
        ReadOnly PointerToRelocations As UInt32
        ReadOnly PointerToLinenumbers As UInt32
        ReadOnly NumberOfRelocations As UInt16
        ReadOnly NumberOfLinenumbers As UInt16
        ReadOnly Characteristics As UInt32
    End Structure

#End Region

    Private Stream As FileStream, Length As Integer
    Sub Process(ByVal path As String)
        Stream = New FileStream(path, FileMode.Open, FileAccess.Read)

        Try
            _DOS_HEADER = Scan(Of IMAGE_DOS_HEADER)()
            Stream.Seek(_DOS_HEADER.e_lfanew, SeekOrigin.Begin)

            _NT_SIGNATURE = Scan(Of UInt32)()
            _FILE_HEADER = Scan(Of IMAGE_FILE_HEADER)()
            _MACHINE_I386 = _FILE_HEADER.Machine = 332

            Length = _FILE_HEADER.SizeOfOptionalHeader

            If _MACHINE_I386 Then
                _OPTIONAL_HEADER32 = Scan(Of IMAGE_OPTIONAL_HEADER32)()
                Length -= 96
            Else
                _OPTIONAL_HEADER64 = Scan(Of IMAGE_OPTIONAL_HEADER64)()
                Length -= 112
            End If

            Dim U1 As New List(Of IMAGE_DATA_DIRECTORY)
            For I As Integer = 1 To Length \ 8
                U1.Add(Scan(Of IMAGE_DATA_DIRECTORY))
            Next
            _DATA_DIRECTORY = U1.ToArray


            Stream.Seek(OS(Of IMAGE_SECTION_HEADER), SeekOrigin.Begin)

            Dim U2 As New List(Of IMAGE_SECTION_HEADER)
            For I As UShort = 1 To _FILE_HEADER.NumberOfSections
                U2.Add(Scan(Of IMAGE_SECTION_HEADER))
            Next
            _SECTION_HEADERS = U2.ToArray

        Finally
            Stream.Close()
        End Try
    End Sub

    Private Function Scan(Of T As Structure)() As T
        Dim Data(Marshal.SizeOf(GetType(T)) - 1) As Byte
        Stream.Read(Data, 0, Data.Length)
        Return Push(Of T)(Data)
    End Function
    Private Function Push(Of T As Structure)(ByVal data As Byte()) As T
        Dim Item As New T
        Dim U As IntPtr = Marshal.AllocCoTaskMem(Marshal.SizeOf(GetType(T)))

        If Not U = IntPtr.Zero Then
            Marshal.Copy(data, 0, U, data.Length)
            Item = CType(Marshal.PtrToStructure(U, GetType(T)), T)
            Marshal.FreeCoTaskMem(U)
        End If

        Return Item
    End Function

End Class