pe-parser.cpp File Reference

Portable Executable parser. More...

#include "pch.h"

Typedefs
typedef enum _PE_ASCII_STRING_STATUS	PE_ASCII_STRING_STATUS

Enumerations
enum	_PE_ASCII_STRING_STATUS { PeAsciiStringInvalid , PeAsciiStringOk , PeAsciiStringTruncated }

Functions
BOOLEAN	PeShowSectionInformationAndDump (const WCHAR *AddressOfFile, const CHAR *SectionToShow, BOOLEAN Is32Bit)
	Show information about different sections of PE and the dump of sections.
BOOLEAN	PeIsPE32BitOr64Bit (const WCHAR *AddressOfFile, PBOOLEAN Is32Bit)
	Detect whether PE is a 32-bit PE or 64-bit PE.
UINT32	PeGetSyscallNumber (LPCSTR NtFunctionName)
	Get the syscall number of a given Nt function.

Detailed Description

Portable Executable parser.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2021-12-26

Copyright

This project is released under the GNU Public License v3.

Typedef Documentation

PE_ASCII_STRING_STATUS

typedef enum _PE_ASCII_STRING_STATUS PE_ASCII_STRING_STATUS

Enumeration Type Documentation

_PE_ASCII_STRING_STATUS

enum _PE_ASCII_STRING_STATUS

Enumerator
PeAsciiStringInvalid
PeAsciiStringOk
PeAsciiStringTruncated

{
    PeAsciiStringInvalid,
    PeAsciiStringOk,
    PeAsciiStringTruncated,
} PE_ASCII_STRING_STATUS;

Function Documentation

PeGetSyscallNumber()

UINT32 PeGetSyscallNumber

(

LPCSTR

NtFunctionName

)

Get the syscall number of a given Nt function.

Parameters

NtFunctionName

Returns

UINT32

{
    HMODULE DllHandle = NULL;
 
    //
    // Load ntdll.dll to get the address of the Nt function
    //
    DllHandle = LoadLibraryA("ntdll.dll");
 
    if (!DllHandle)
    {
        ShowMessages("err, failed to load ntdll.dll\n");
        return NULL;
    }
 
    //
    // Choose any Nt function
    //
    VOID * TargetFunc = GetProcAddress(DllHandle, NtFunctionName);
 
    if (!TargetFunc)
    {
        //
        // If we failed to get the address of the Nt function,
        // maybe it's from win32u.dll
        //
        DllHandle = LoadLibraryA("win32u.dll");
 
        if (!DllHandle)
        {
            ShowMessages("err, failed to load win32u.dll\n");
            return NULL;
        }
 
        TargetFunc = GetProcAddress(DllHandle, NtFunctionName);
 
        if (!TargetFunc)
        {
            ShowMessages("err, failed to get address of %s\n", NtFunctionName);
            return NULL;
        }
    }
 
    //
    // By default, we send 30 bytes to the disassembler,
    // since usually the syscall handler is less than 30 bytes,
    // and we want to avoid disassembling another function
    //
    return HyperDbgGetImmediateValueOnEaxForSyscallNumber((UCHAR *)TargetFunc, 30, TRUE);
}

PeIsPE32BitOr64Bit()

BOOLEAN PeIsPE32BitOr64Bit	(	const WCHAR *	AddressOfFile,
		PBOOLEAN	Is32Bit )

Detect whether PE is a 32-bit PE or 64-bit PE.

Parameters

AddressOfFile
Is32Bit

Returns

BOOLEAN

{
    BOOLEAN             Result     = FALSE;
    HANDLE              FileHandle = INVALID_HANDLE_VALUE; // Open file handle
    SIZE_T              MappedSize = 0;                    // Size of the mapped file in bytes
    LPVOID              BaseAddr;                          // Pointer to the base memory of mapped file
    PIMAGE_DOS_HEADER   DosHeader;                   // Pointer to DOS Header
    PIMAGE_NT_HEADERS32 NtHeader32 = NULL;           // Pointer to NT Header 32 bit
    PE_IMAGE_READER     Reader;
    LARGE_INTEGER       FileSize;
 
    //
    // Open and map the EXE file read-only
    //
    BaseAddr = PlatformMapFileReadOnly(AddressOfFile, &MappedSize, &FileHandle);
 
    if (BaseAddr == NULL)
    {
        ShowMessages("err, unable to read or map the file (%x)\n", PlatformGetLastError());
        return FALSE;
    }
 
    FileSize.QuadPart = (LONGLONG)MappedSize;
 
    if (FileSize.QuadPart < (LONGLONG)sizeof(IMAGE_DOS_HEADER))
    {
        PlatformUnmapFile(BaseAddr, MappedSize, FileHandle);
        return FALSE;
    }
 
    //
    // Get the DOS Header Base
    //
    DosHeader = (PIMAGE_DOS_HEADER)BaseAddr; // 0x04000000
 
    //
    // Check for Valid DOS file
    //
    if (DosHeader->e_magic != IMAGE_DOS_SIGNATURE)
    {
        Result = FALSE;
 
        ShowMessages("err, the selected file is not in a valid PE format\n");
        goto Finished;
    }
 
    if (DosHeader->e_lfanew < sizeof(IMAGE_DOS_HEADER) ||
        (LONGLONG)DosHeader->e_lfanew + (LONGLONG)sizeof(IMAGE_NT_HEADERS32) > FileSize.QuadPart)
    {
        Result = FALSE;
 
        ShowMessages("err, invalid image NT header offset\n");
        goto Finished;
    }
 
    //
    // Offset of NT Header is found at 0x3c location in DOS header specified by
    // e_lfanew
    // Get the Base of NT Header(PE Header)     = DosHeader + RVA address of PE
    // header
    //
 
    NtHeader32 = (PIMAGE_NT_HEADERS32)((UINT64)(DosHeader) + (DosHeader->e_lfanew));
 
    //
    // Identify for valid PE file
    //
    if (NtHeader32->Signature != IMAGE_NT_SIGNATURE)
    {
        Result = FALSE;
 
        ShowMessages("err, invalid image NT signature\n");
        goto Finished;
    }
 
    if (!PeImageReaderInitialize((const BYTE *)BaseAddr, (SIZE_T)FileSize.QuadPart, &Reader))
    {
        Result = FALSE;
 
        ShowMessages("err, the selected file is not in a valid PE format\n");
        goto Finished;
    }
 
    //
    // Only few are determined (for remaining refer
    // to the above specification)
    //
    switch (Reader.FileHeader->Machine)
    {
    case IMAGE_FILE_MACHINE_I386:
        *Is32Bit = TRUE;
        Result   = TRUE;
        goto Finished;
        break;
    case IMAGE_FILE_MACHINE_AMD64:
        *Is32Bit = FALSE;
        Result   = TRUE;
        goto Finished;
        break;
    default:
        ShowMessages("err, PE file is not i386 or AMD64; thus, it's not supported "
                     "in HyperDbg\n");
        Result = FALSE;
        goto Finished;
        break;
    }
 
Finished:
    //
    // Unmap and close the handles
    //
    PlatformUnmapFile(BaseAddr, MappedSize, FileHandle);
 
    return Result;
}

PeShowSectionInformationAndDump()

BOOLEAN PeShowSectionInformationAndDump	(	const WCHAR *	AddressOfFile,
		const CHAR *	SectionToShow,
		BOOLEAN	Is32Bit )

Show information about different sections of PE and the dump of sections.

Parameters

AddressOfFile
SectionToShow
Is32Bit

Returns

BOOLEAN

{
    RICH_HEADER_INFO             PeFileRichHeaderInfo {0};
    RICH_HEADER                  PeFileRichHeader {0};
    BOOLEAN                      Result = FALSE, RichFound = FALSE, SectionFound = FALSE;
    const DWORD                  MaxRichReadSize          = 1024 * 1024;
    const INT                    MaxRichHeaderSize        = 256 * 1024;
    const INT                    MaxRichHeaderEntries     = 0x4000;
    const DWORD                  MaxSectionScanBytes      = 16 * 1024 * 1024;
    const ULONGLONG              MaxTotalSectionScanBytes = 64 * 1024 * 1024;
    const SIZE_T                 MaxSectionDumpBytes      = 1024 * 1024;
    const ULONGLONG              MaxTotalSectionDumpBytes = 4 * 1024 * 1024;
    HANDLE                       FileHandle = INVALID_HANDLE_VALUE;                         // Open file handle (kept for the raw Rich-header read)
    SIZE_T                       MappedSize = 0;                                            // Size of the mapped file in bytes
    UINT32                       NumberOfSections;                                          // Number of sections
    LPVOID                       BaseAddr = NULL;                                           // Pointer to the base memory of mapped file
    PIMAGE_DOS_HEADER            DosHeader;                                                 // Pointer to DOS Header
    PIMAGE_NT_HEADERS32          NtHeader32 = NULL;                                         // Pointer to NT Header 32 bit
    PIMAGE_NT_HEADERS64          NtHeader64 = NULL;                                         // Pointer to NT Header 64 bit
    IMAGE_FILE_HEADER            Header;                                                    // Pointer to image file header of NT Header
    IMAGE_OPTIONAL_HEADER32      OpHeader32;                                                // Optional Header of PE files present in NT Header structure
    IMAGE_OPTIONAL_HEADER64      OpHeader64;                                                // Optional Header of PE files present in NT Header structure
    const IMAGE_SECTION_HEADER * SecHeader;                                                 // Section Header or Section Table Header
    PE_IMAGE_READER              Reader;
    IMAGE_DATA_DIRECTORY         EmptyDirectory = {0};
    LARGE_INTEGER                FileSize;
    CHAR                         Key[4];
    INT                          RichHeaderOffset          = -1;
    const CHAR *                 RichHeaderStatus          = "not found";
    BOOLEAN                      RichSearchCapped          = FALSE;
    ULONGLONG                    RemainingSectionScanBytes = MaxTotalSectionScanBytes;
    ULONGLONG                    RemainingSectionDumpBytes = MaxTotalSectionDumpBytes;
    time_t                       TimeDateStamp;
 
    //
    // Open and map the EXE file read-only. The wrapper also hands back the open
    // file handle so the raw Rich-header read below can still seek/read it.
    //
    BaseAddr = PlatformMapFileReadOnly(AddressOfFile, &MappedSize, &FileHandle);
 
    if (BaseAddr == NULL)
    {
        ShowMessages("err, could not open the file specified\n");
        return FALSE;
    }
 
    FileSize.QuadPart = (LONGLONG)MappedSize;
 
    if (FileSize.QuadPart < (LONGLONG)sizeof(IMAGE_DOS_HEADER))
    {
        PlatformUnmapFile(BaseAddr, MappedSize, FileHandle);
        return FALSE;
    }
 
    //
    // Get the DOS Header Base
    //
    DosHeader = (PIMAGE_DOS_HEADER)BaseAddr; // 0x04000000
 
    if (DosHeader->e_magic != IMAGE_DOS_SIGNATURE ||
        DosHeader->e_lfanew < sizeof(IMAGE_DOS_HEADER) ||
        (LONGLONG)DosHeader->e_lfanew > FileSize.QuadPart ||
        (LONGLONG)DosHeader->e_lfanew + (LONGLONG)(Is32Bit ? sizeof(IMAGE_NT_HEADERS32) : sizeof(IMAGE_NT_HEADERS64)) > FileSize.QuadPart)
    {
        ShowMessages("\nGiven File is not a valid PE file\n");
        Result = FALSE;
        goto Finished;
    }
 
    if (!PeImageReaderInitialize((const BYTE *)BaseAddr, (SIZE_T)FileSize.QuadPart, &Reader))
    {
        ShowMessages("\nGiven File is not a valid PE file\n");
        Result = FALSE;
        goto Finished;
    }
 
    if (DosHeader->e_lfanew > 0 && (ULONGLONG)DosHeader->e_lfanew <= (ULONGLONG)MAXDWORD)
    {
        CHAR *        DataPtr      = NULL;
        DWORD         BytesRead    = 0;
        DWORD         RichReadSize = (DWORD)DosHeader->e_lfanew;
        DWORD         SearchOffset = 0;
        BOOLEAN       HadCandidate = FALSE;
        LARGE_INTEGER FileStart    = {0};
 
        if (RichReadSize > MaxRichReadSize)
        {
            RichReadSize     = MaxRichReadSize;
            RichHeaderStatus = "not found in first 1 MiB";
            RichSearchCapped = TRUE;
        }
 
        if (RichReadSize >= 8)
        {
            DataPtr = new (std::nothrow) CHAR[RichReadSize];
            if (DataPtr == NULL)
            {
                RichHeaderStatus = "allocation failed";
                goto SkipRichHeader;
            }
 
            if (!PlatformReadFileAtOffset(FileHandle, 0, DataPtr, RichReadSize, &BytesRead) || BytesRead != RichReadSize)
            {
                RichHeaderStatus = "read failed";
                delete[] DataPtr;
                goto SkipRichHeader;
            }
 
            for (;;)
            {
                CHAR * RichHeaderPtr = NULL;
 
                RichHeaderOffset = FindRichHeader(DosHeader, RichReadSize, SearchOffset, Key);
                if (RichHeaderOffset < 0)
                {
                    break;
                }
 
                HadCandidate     = TRUE;
                RichHeaderStatus = RichSearchCapped ? "malformed candidate in first 1 MiB" : "malformed";
 
                INT RichHeaderSize = DecryptRichHeader(Key, RichHeaderOffset, DataPtr, (INT)RichReadSize);
                INT IndexPointer   = RichHeaderOffset - RichHeaderSize;
 
                if (RichHeaderSize < 16 || RichHeaderSize > MaxRichHeaderSize || ((RichHeaderSize - 16) % 8) != 0 ||
                    (RichHeaderSize - 16) / 8 == 0 || (RichHeaderSize - 16) / 8 > MaxRichHeaderEntries ||
                    IndexPointer < 0 || RichHeaderSize > (INT)RichReadSize || IndexPointer > (INT)RichReadSize - RichHeaderSize)
                {
                    SearchOffset = (DWORD)RichHeaderOffset + 1;
                    continue;
                }
 
                RichHeaderPtr = new (std::nothrow) CHAR[RichHeaderSize];
                if (RichHeaderPtr == NULL)
                {
                    RichHeaderStatus = "allocation failed";
                    break;
                }
 
                memcpy(RichHeaderPtr, DataPtr + IndexPointer, RichHeaderSize);
 
                if (!FindRichEntries(RichHeaderPtr, RichHeaderSize, Key, &PeFileRichHeaderInfo))
                {
                    delete[] RichHeaderPtr;
                    SearchOffset = (DWORD)RichHeaderOffset + 1;
                    continue;
                }
 
                RichHeaderPtr = NULL;
 
                if (PeFileRichHeaderInfo.Entries > MaxRichHeaderEntries || PeFileRichHeaderInfo.Entries >= INT_MAX / (INT)sizeof(RICH_HEADER_ENTRY) - 1)
                {
                    delete[] PeFileRichHeaderInfo.PtrToBuffer;
                    PeFileRichHeaderInfo = {0};
                    SearchOffset         = (DWORD)RichHeaderOffset + 1;
                    continue;
                }
 
                PeFileRichHeader.Entries = new (std::nothrow) RICH_HEADER_ENTRY[PeFileRichHeaderInfo.Entries + 1];
                if (PeFileRichHeader.Entries == NULL)
                {
                    RichHeaderStatus = "allocation failed";
                    delete[] PeFileRichHeaderInfo.PtrToBuffer;
                    PeFileRichHeaderInfo = {0};
                    break;
                }
 
                if (!SetRichEntries(RichHeaderSize, PeFileRichHeaderInfo.PtrToBuffer, &PeFileRichHeader))
                {
                    delete[] PeFileRichHeaderInfo.PtrToBuffer;
                    PeFileRichHeaderInfo = {0};
                    delete[] PeFileRichHeader.Entries;
                    PeFileRichHeader.Entries = NULL;
                    SearchOffset             = (DWORD)RichHeaderOffset + 1;
                    continue;
                }
 
                RichFound = TRUE;
                break;
            }
 
            if (!RichFound && !HadCandidate && (DWORD)DosHeader->e_lfanew <= MaxRichReadSize)
            {
                RichHeaderStatus = "not found";
            }
 
            delete[] DataPtr;
        }
    }
 
SkipRichHeader:
 
    //
    // Check for Valid DOS file
    //
    if (DosHeader->e_magic == IMAGE_DOS_SIGNATURE)
    {
        //
        // Dump the Dos Header info
        //
        ShowMessages("\nValid Dos Exe File\n------------------\n");
        ShowMessages("\nDumping DOS Header Info....\n---------------------------");
        ShowMessages("\n%-36s%s ",
                     "Magic number : ",
                     DosHeader->e_magic == 0x5a4d ? "MZ" : "-");
        ShowMessages("\n%-36s%#x", "Bytes on last page of file :", DosHeader->e_cblp);
        ShowMessages("\n%-36s%#x", "Pages in file : ", DosHeader->e_cp);
        ShowMessages("\n%-36s%#x", "Relocation : ", DosHeader->e_crlc);
        ShowMessages("\n%-36s%#x",
                     "Size of header in paragraphs : ",
                     DosHeader->e_cparhdr);
        ShowMessages("\n%-36s%#x",
                     "Minimum extra paragraphs needed : ",
                     DosHeader->e_minalloc);
        ShowMessages("\n%-36s%#x",
                     "Maximum extra paragraphs needed : ",
                     DosHeader->e_maxalloc);
        ShowMessages("\n%-36s%#x", "Initial (relative) SS value : ", DosHeader->e_ss);
        ShowMessages("\n%-36s%#x", "Initial SP value : ", DosHeader->e_sp);
        ShowMessages("\n%-36s%#x", "Checksum : ", DosHeader->e_csum);
        ShowMessages("\n%-36s%#x", "Initial IP value : ", DosHeader->e_ip);
        ShowMessages("\n%-36s%#x", "Initial (relative) CS value : ", DosHeader->e_cs);
        ShowMessages("\n%-36s%#x",
                     "File address of relocation table : ",
                     DosHeader->e_lfarlc);
        ShowMessages("\n%-36s%#x", "Overlay number : ", DosHeader->e_ovno);
        ShowMessages("\n%-36s%#x", "OEM identifier : ", DosHeader->e_oemid);
        ShowMessages("\n%-36s%#x",
                     "OEM information(e_oemid specific) :",
                     DosHeader->e_oeminfo);
        ShowMessages("\n%-36s%#x", "RVA address of PE header : ", DosHeader->e_lfanew);
        ShowMessages("\n==============================================================="
                     "================\n");
    }
    else
    {
        ShowMessages("\nGiven File is not a valid DOS file\n");
        Result = FALSE;
        goto Finished;
    }
 
    if (RichFound)
    {
        ShowMessages("\n===============================================================================\n");
        ShowMessages("                              RICH HEADER                                     \n");
        ShowMessages("===============================================================================\n");
        ShowMessages("Entries: %d\n\n", PeFileRichHeaderInfo.Entries);
        ShowMessages("%-10s %-10s %-10s\n", "Build ID", "Prod ID", "Use Count");
        ShowMessages("---------------------------------------\n");
 
        for (int i = 0; i < PeFileRichHeaderInfo.Entries; i++)
        {
            ShowMessages("0x%08X 0x%08X %10u\n",
                         PeFileRichHeader.Entries[i].BuildID,
                         PeFileRichHeader.Entries[i].ProdID,
                         PeFileRichHeader.Entries[i].UseCount);
        }
 
        ShowMessages("==============Rich Header End ==================\n");
    }
    else
    {
        ShowMessages("=========== Rich Header Not Shown (%s) ===========\n", RichHeaderStatus);
    }
 
    //
    // Offset of NT Header is found at 0x3c location in DOS header specified by
    // e_lfanew
    // Get the Base of NT Header(PE Header)     = DosHeader + RVA address of PE
    // header
    //
    if (Is32Bit)
    {
        NtHeader32 = (PIMAGE_NT_HEADERS32)((UINT64)(DosHeader) + (DosHeader->e_lfanew));
    }
    else
    {
        NtHeader64 = (PIMAGE_NT_HEADERS64)((UINT64)(DosHeader) + (DosHeader->e_lfanew));
    }
 
    //
    // Identify for valid PE file
    //
    if (Is32Bit && NtHeader32->Signature == IMAGE_NT_SIGNATURE)
    {
        ShowMessages("\nValid PE32 file \n-------------\n");
    }
    else if (!Is32Bit && NtHeader64->Signature == IMAGE_NT_SIGNATURE)
    {
        ShowMessages("\nValid PE64 file \n-------------\n");
    }
    else
    {
        ShowMessages("err, the specified file is not a valid PE file");
        Result = FALSE;
        goto Finished;
    }
 
    //
    // Dump NT Header Info....
    //
    ShowMessages("\nDumping COFF/PE Header "
                 "Info....\n--------------------------------");
    ShowMessages("\n%-36s%s", "Signature :", "PE");
 
    //
    // Get the IMAGE FILE HEADER Structure
    //
    if (Is32Bit)
    {
        Header = NtHeader32->FileHeader;
    }
    else
    {
        Header = NtHeader64->FileHeader;
    }
 
    //
    // Determine Machine Architecture
    //
    ShowMessages("\n%-36s", "Machine Architecture :");
 
    //
    // Only few are determined (for remaining refer
    // to the above specification)
    //
    switch (Header.Machine)
    {
    case 0x0:
        ShowMessages("All ");
        break;
    case 0x14d:
        ShowMessages("Intel i860");
        break;
    case 0x14c:
        ShowMessages("Intel i386, i486, i586");
        break;
    case 0x200:
        ShowMessages("Intel Itanium processor");
        break;
    case 0x8664:
        ShowMessages("AMD x64");
        break;
    case 0x162:
        ShowMessages("MIPS R3000");
        break;
    case 0x166:
        ShowMessages("MIPS R4000");
        break;
    case 0x183:
        ShowMessages("DEC Alpha AXP");
        break;
    default:
        ShowMessages("Not Found");
        break;
    }
 
    //
    // Determine the characteristics of the given file
    //
    ShowMessages("\n%-36s", "Characteristics : ");
    if ((Header.Characteristics & 0x0002) == 0x0002)
        ShowMessages("Executable Image, ");
    if ((Header.Characteristics & 0x0020) == 0x0020)
        ShowMessages("Application can address > 2GB, ");
    if ((Header.Characteristics & 0x1000) == 0x1000)
        ShowMessages("System file (Kernel Mode Driver(I think)), ");
    if ((Header.Characteristics & 0x2000) == 0x2000)
        ShowMessages("Dll file, ");
    if ((Header.Characteristics & 0x4000) == 0x4000)
        ShowMessages("Application runs only in Uniprocessor, ");
 
    //
    // Determine Time Stamp
    //
    TimeDateStamp = Header.TimeDateStamp;
    ShowMessages("\n%-36s%s",
                 "Time Stamp :",
                 ctime(&TimeDateStamp));
 
    //
    // Determine number of sections
    //
    ShowMessages("%-36s%d", "No.sections(size) :", Header.NumberOfSections);
    ShowMessages("\n%-36s%d", "No.entries in symbol table :", Header.NumberOfSymbols);
    ShowMessages("\n%-36s%d",
                 "Size of optional header :",
                 Header.SizeOfOptionalHeader);
    ShowMessages("\n%-36s%#x", "Raw machine value :", Header.Machine);
    ShowMessages("\n%-36s%#x", "Pointer to symbol table :", Header.PointerToSymbolTable);
    ShowMessages("\n%-36s%#x", "Raw characteristics value :", Header.Characteristics);
 
    ShowMessages("\n\nDumping PE Optional Header "
                 "Info....\n-----------------------------------");
 
    if (Is32Bit)
    {
        //
        // Info about Optional Header
        //
        OpHeader32 = NtHeader32->OptionalHeader;
        ShowMessages("\n\nInfo of optional Header\n-----------------------");
        ShowMessages("\n%-36s%#x",
                     "Address of Entry Point : ",
                     OpHeader32.AddressOfEntryPoint);
        ShowMessages("\n%-36s%#x", "Raw optional header magic :", OpHeader32.Magic);
        PeShowEntrypointFileOffset(&Reader, OpHeader32.AddressOfEntryPoint);
        ShowMessages("\n%-36s%#llx", "Base Address of the Image : ", OpHeader32.ImageBase);
        ShowMessages("\n%-36s%s", "SubSystem type : ", PeGetSubsystemName(OpHeader32.Subsystem));
        ShowMessages("\n%-36s%s", "Given file is a : ", OpHeader32.Magic == 0x20b ? "PE32+(64)" : "PE32");
        ShowMessages("\n%-36s%#x", "File Alignment :", OpHeader32.FileAlignment);
        ShowMessages("\n%-36s%#x", "Size of Image :", OpHeader32.SizeOfImage);
        ShowMessages("\n%-36s%#x", "Size of Headers :", OpHeader32.SizeOfHeaders);
        PeShowChecksum(&Reader,
                       OpHeader32.CheckSum,
                       (SIZE_T)(Reader.NtHeaders - Reader.ImageBase) + sizeof(DWORD) + sizeof(IMAGE_FILE_HEADER) + FIELD_OFFSET(IMAGE_OPTIONAL_HEADER32, CheckSum));
        ShowMessages("\n%-36s%#x", "Raw DLL characteristics value :", OpHeader32.DllCharacteristics);
        ShowMessages("\n%-36s", "DLL characteristics flags :");
        PeShowDllCharacteristics(OpHeader32.DllCharacteristics);
        ShowMessages("\n%-36s%d", "Size of code segment(.text) : ", OpHeader32.SizeOfCode);
        ShowMessages("\n%-36s%#x",
                     "Base address of code segment(RVA) :",
                     OpHeader32.BaseOfCode);
        ShowMessages("\n%-36s%d",
                     "Size of Initialized data : ",
                     OpHeader32.SizeOfInitializedData);
 
        ShowMessages("\n%-36s%#x",
                     "Base address of data segment(RVA) :",
                     OpHeader32.BaseOfData);
 
        ShowMessages("\n%-36s%#x", "Section Alignment :", OpHeader32.SectionAlignment);
        ShowMessages("\n%-36s%d", "Major Linker Version : ", OpHeader32.MajorLinkerVersion);
        ShowMessages("\n%-36s%d", "Minor Linker Version : ", OpHeader32.MinorLinkerVersion);
        PeShowDataDirectories(&Reader, OpHeader32.DataDirectory, OpHeader32.NumberOfRvaAndSizes);
        PeShowCertificateTable(&Reader,
                               OpHeader32.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_SECURITY ? &OpHeader32.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY] : &EmptyDirectory);
        PeShowBaseRelocations(&Reader,
                              OpHeader32.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_BASERELOC ? &OpHeader32.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC] : &EmptyDirectory);
        PeShowBoundImports(&Reader,
                           OpHeader32.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT ? &OpHeader32.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT] : &EmptyDirectory);
        PeShowResources(&Reader,
                        OpHeader32.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_RESOURCE ? &OpHeader32.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE] : &EmptyDirectory);
        PeShowExceptions(&Reader,
                         OpHeader32.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_EXCEPTION ? &OpHeader32.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION] : &EmptyDirectory,
                         Header.Machine,
                         TRUE);
        PeShowDelayImports(&Reader,
                           OpHeader32.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT ? &OpHeader32.DataDirectory[IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT] : &EmptyDirectory,
                           TRUE,
                           OpHeader32.ImageBase);
        PeShowClrRuntime(&Reader,
                         OpHeader32.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR ? &OpHeader32.DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR] : &EmptyDirectory);
        PeShowTls(&Reader,
                  OpHeader32.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_TLS ? &OpHeader32.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS] : &EmptyDirectory,
                  TRUE,
                  OpHeader32.ImageBase);
        PeShowDebug(&Reader,
                    OpHeader32.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_DEBUG ? &OpHeader32.DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG] : &EmptyDirectory);
        PeShowLoadConfig(&Reader,
                         OpHeader32.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG ? &OpHeader32.DataDirectory[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG] : &EmptyDirectory,
                         TRUE);
        PeShowImports(&Reader,
                      OpHeader32.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_IMPORT ? &OpHeader32.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT] : &EmptyDirectory,
                      TRUE);
        PeShowExports(&Reader,
                      OpHeader32.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_EXPORT ? &OpHeader32.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT] : &EmptyDirectory);
    }
    else
    {
        //
        // Info about Optional Header
        //
        OpHeader64 = NtHeader64->OptionalHeader;
        ShowMessages("\n\nInfo of optional Header\n-----------------------");
        ShowMessages("\n%-36s%#x",
                     "Address of Entry Point : ",
                     OpHeader64.AddressOfEntryPoint);
        ShowMessages("\n%-36s%#x", "Raw optional header magic :", OpHeader64.Magic);
        PeShowEntrypointFileOffset(&Reader, OpHeader64.AddressOfEntryPoint);
        ShowMessages("\n%-36s%#llx", "Base Address of the Image : ", OpHeader64.ImageBase);
        ShowMessages("\n%-36s%s", "SubSystem type : ", PeGetSubsystemName(OpHeader64.Subsystem));
        ShowMessages("\n%-36s%s", "Given file is a : ", OpHeader64.Magic == 0x20b ? "PE32+(64)" : "PE32");
        ShowMessages("\n%-36s%#x", "File Alignment :", OpHeader64.FileAlignment);
        ShowMessages("\n%-36s%#x", "Size of Image :", OpHeader64.SizeOfImage);
        ShowMessages("\n%-36s%#x", "Size of Headers :", OpHeader64.SizeOfHeaders);
        PeShowChecksum(&Reader,
                       OpHeader64.CheckSum,
                       (SIZE_T)(Reader.NtHeaders - Reader.ImageBase) + sizeof(DWORD) + sizeof(IMAGE_FILE_HEADER) + FIELD_OFFSET(IMAGE_OPTIONAL_HEADER64, CheckSum));
        ShowMessages("\n%-36s%#x", "Raw DLL characteristics value :", OpHeader64.DllCharacteristics);
        ShowMessages("\n%-36s", "DLL characteristics flags :");
        PeShowDllCharacteristics(OpHeader64.DllCharacteristics);
        ShowMessages("\n%-36s%d", "Size of code segment(.text) : ", OpHeader64.SizeOfCode);
        ShowMessages("\n%-36s%#x",
                     "Base address of code segment(RVA) :",
                     OpHeader64.BaseOfCode);
        ShowMessages("\n%-36s%d",
                     "Size of Initialized data : ",
                     OpHeader64.SizeOfInitializedData);
 
        ShowMessages("\n%-36s%#x", "Section Alignment :", OpHeader64.SectionAlignment);
        ShowMessages("\n%-36s%d", "Major Linker Version : ", OpHeader64.MajorLinkerVersion);
        ShowMessages("\n%-36s%d", "Minor Linker Version : ", OpHeader64.MinorLinkerVersion);
        PeShowDataDirectories(&Reader, OpHeader64.DataDirectory, OpHeader64.NumberOfRvaAndSizes);
        PeShowCertificateTable(&Reader,
                               OpHeader64.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_SECURITY ? &OpHeader64.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY] : &EmptyDirectory);
        PeShowBaseRelocations(&Reader,
                              OpHeader64.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_BASERELOC ? &OpHeader64.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC] : &EmptyDirectory);
        PeShowBoundImports(&Reader,
                           OpHeader64.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT ? &OpHeader64.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT] : &EmptyDirectory);
        PeShowResources(&Reader,
                        OpHeader64.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_RESOURCE ? &OpHeader64.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE] : &EmptyDirectory);
        PeShowExceptions(&Reader,
                         OpHeader64.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_EXCEPTION ? &OpHeader64.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION] : &EmptyDirectory,
                         Header.Machine,
                         FALSE);
        PeShowDelayImports(&Reader,
                           OpHeader64.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT ? &OpHeader64.DataDirectory[IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT] : &EmptyDirectory,
                           FALSE,
                           OpHeader64.ImageBase);
        PeShowClrRuntime(&Reader,
                         OpHeader64.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR ? &OpHeader64.DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR] : &EmptyDirectory);
        PeShowTls(&Reader,
                  OpHeader64.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_TLS ? &OpHeader64.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS] : &EmptyDirectory,
                  FALSE,
                  OpHeader64.ImageBase);
        PeShowDebug(&Reader,
                    OpHeader64.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_DEBUG ? &OpHeader64.DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG] : &EmptyDirectory);
        PeShowLoadConfig(&Reader,
                         OpHeader64.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG ? &OpHeader64.DataDirectory[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG] : &EmptyDirectory,
                         FALSE);
        PeShowImports(&Reader,
                      OpHeader64.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_IMPORT ? &OpHeader64.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT] : &EmptyDirectory,
                      FALSE);
        PeShowExports(&Reader,
                      OpHeader64.NumberOfRvaAndSizes > IMAGE_DIRECTORY_ENTRY_EXPORT ? &OpHeader64.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT] : &EmptyDirectory);
    }
 
    ShowMessages("\n\nDumping Sections Header "
                 "Info....\n--------------------------------");
 
    //
    // Retrieve a pointer to First Section Header(or Section Table Entry)
    //
    SecHeader        = Reader.SectionHeaders;
    NumberOfSections = Reader.FileHeader->NumberOfSections;
 
    for (UINT32 i = 0; i < NumberOfSections; i++, SecHeader++)
    {
        CHAR         SectionName[IMAGE_SIZEOF_SHORT_NAME + 1];
        const BYTE * Pointer       = NULL;
        const CHAR * RawDataBounds = "empty";
 
        PeImageReaderGetSectionName(SecHeader, SectionName, sizeof(SectionName));
 
        if (SecHeader->SizeOfRawData != 0)
        {
            RawDataBounds = PeImageReaderGetPointerAtOffset(&Reader,
                                                            SecHeader->PointerToRawData,
                                                            SecHeader->SizeOfRawData,
                                                            &Pointer)
                                ? "valid"
                                : "invalid";
        }
 
        ShowMessages("\n\nSection Info (%d of %d)", i + 1, NumberOfSections);
 
        ShowMessages("\n---------------------");
        ShowMessages("\n%-36s%s", "Section Header name : ", SectionName);
        ShowMessages("\n%-36s%#x",
                     "ActualSize of code or data : ",
                     SecHeader->Misc.VirtualSize);
        ShowMessages("\n%-36s%#x", "Virtual Address(RVA) :", SecHeader->VirtualAddress);
        ShowMessages("\n%-36s%#x",
                     "Size of raw data (rounded to FA) : ",
                     SecHeader->SizeOfRawData);
        ShowMessages("\n%-36s%#x",
                     "Pointer to Raw Data : ",
                     SecHeader->PointerToRawData);
        ShowMessages("\n%-36s%s", "Raw data bounds :", RawDataBounds);
        if (Pointer != NULL && SecHeader->SizeOfRawData != 0)
        {
            if (SecHeader->SizeOfRawData > MaxSectionScanBytes)
            {
                ShowMessages("\n%-36s%s", "Raw data entropy :", "skipped, section is larger than local cap");
                ShowMessages("\n%-36s%s", "Raw data FNV-1a64 :", "skipped, section is larger than local cap");
            }
            else if ((ULONGLONG)SecHeader->SizeOfRawData > RemainingSectionScanBytes)
            {
                RemainingSectionScanBytes = 0;
                ShowMessages("\n%-36s%s", "Raw data entropy :", "skipped, global scan budget exhausted");
                ShowMessages("\n%-36s%s", "Raw data FNV-1a64 :", "skipped, global scan budget exhausted");
            }
            else
            {
                ShowMessages("\n%-36s%.4f", "Raw data entropy :", PeCalculateEntropy(Pointer, SecHeader->SizeOfRawData));
                ShowMessages("\n%-36s%#llx", "Raw data FNV-1a64 :", PeFnv1a64(Pointer, SecHeader->SizeOfRawData));
                RemainingSectionScanBytes -= SecHeader->SizeOfRawData;
            }
        }
        if (SecHeader->SizeOfRawData != 0 && SecHeader->Misc.VirtualSize > SecHeader->SizeOfRawData)
        {
            ShowMessages("\n%-36s%s", "Warning :", "virtual size is larger than raw data");
        }
        ShowMessages("\n%-36s%#x",
                     "Pointer to Relocations : ",
                     SecHeader->PointerToRelocations);
        ShowMessages("\n%-36s%#x",
                     "Pointer to Line numbers : ",
                     SecHeader->PointerToLinenumbers);
        ShowMessages("\n%-36s%#x",
                     "Number of relocations : ",
                     SecHeader->NumberOfRelocations);
        ShowMessages("\n%-36s%#x",
                     "Number of line numbers : ",
                     SecHeader->NumberOfLinenumbers);
        ShowMessages("\n%-36s%s", "Characteristics : ", "Contains ");
        if ((SecHeader->Characteristics & 0x20) == 0x20)
            ShowMessages("executable code, ");
        if ((SecHeader->Characteristics & 0x40) == 0x40)
            ShowMessages("initialized data, ");
        if ((SecHeader->Characteristics & 0x80) == 0x80)
            ShowMessages("uninitialized data, ");
        if ((SecHeader->Characteristics & 0x200) == 0x200)
            ShowMessages("comments and linker commands, ");
        if ((SecHeader->Characteristics & 0x10000000) == 0x10000000)
            ShowMessages("shareable data(via DLLs), ");
        if ((SecHeader->Characteristics & 0x40000000) == 0x40000000)
            ShowMessages("Readable, ");
        if ((SecHeader->Characteristics & 0x80000000) == 0x80000000)
            ShowMessages("Writable, ");
 
        //
        // show the hex dump if the user needs it
        //
        if (SectionToShow != NULL)
        {
            if (!_strcmpi(SectionToShow, SectionName))
            {
                SectionFound = TRUE;
 
                if (SecHeader->SizeOfRawData != 0)
                {
                    SIZE_T  DumpSize              = SecHeader->SizeOfRawData;
                    BOOLEAN TruncatedBySectionCap = FALSE;
                    BOOLEAN TruncatedByGlobalCap  = FALSE;
 
                    if (Pointer == NULL)
                    {
                        ShowMessages("\nerr, invalid section raw data\n");
                        continue;
                    }
 
                    if (RemainingSectionDumpBytes == 0)
                    {
                        ShowMessages("\n%-36s%s", "Warning, section dump skipped :", "global dump budget exhausted");
                        continue;
                    }
 
                    if (DumpSize > MaxSectionDumpBytes)
                    {
                        DumpSize              = MaxSectionDumpBytes;
                        TruncatedBySectionCap = TRUE;
                    }
 
                    if ((ULONGLONG)DumpSize > RemainingSectionDumpBytes)
                    {
                        DumpSize             = (SIZE_T)RemainingSectionDumpBytes;
                        TruncatedByGlobalCap = TRUE;
                    }
 
                    if (TruncatedBySectionCap)
                    {
                        ShowMessages("\n%-36s%#llx of %#x bytes",
                                     "Warning, section dump truncated by section cap :",
                                     (UINT64)DumpSize,
                                     SecHeader->SizeOfRawData);
                    }
                    if (TruncatedByGlobalCap)
                    {
                        ShowMessages("\n%-36s%#llx of %#x bytes",
                                     "Warning, section dump truncated by global cap :",
                                     (UINT64)DumpSize,
                                     SecHeader->SizeOfRawData);
                    }
 
                    if (Is32Bit)
                    {
                        PeHexDump((CHAR *)Pointer,
                                  DumpSize,
                                  (ULONGLONG)OpHeader32.ImageBase + SecHeader->VirtualAddress);
                    }
                    else
                    {
                        PeHexDump((CHAR *)Pointer,
                                  DumpSize,
                                  OpHeader64.ImageBase + SecHeader->VirtualAddress);
                    }
 
                    RemainingSectionDumpBytes -= DumpSize;
                }
            }
        }
    }
 
    PeShowOverlayAndWarnings(&Reader,
                             Header.Machine,
                             Is32Bit ? OpHeader32.Magic : OpHeader64.Magic,
                             Is32Bit ? OpHeader32.AddressOfEntryPoint : OpHeader64.AddressOfEntryPoint,
                             Is32Bit ? OpHeader32.SizeOfImage : OpHeader64.SizeOfImage,
                             Is32Bit ? OpHeader32.SizeOfHeaders : OpHeader64.SizeOfHeaders,
                             Is32Bit ? OpHeader32.DataDirectory : OpHeader64.DataDirectory,
                             Is32Bit ? OpHeader32.NumberOfRvaAndSizes : OpHeader64.NumberOfRvaAndSizes);
 
    if (SectionToShow != NULL && !SectionFound)
    {
        ShowMessages("\nerr, section '%s' was not found\n", SectionToShow);
    }
 
    ShowMessages("\n==============================================================="
                 "================\n");
 
    //
    // Set result to true
    //
    Result = TRUE;
 
Finished:
    //
    // Unmap and close the handles
    //
    if (PeFileRichHeaderInfo.PtrToBuffer != NULL)
    {
        delete[] PeFileRichHeaderInfo.PtrToBuffer;
    }
 
    if (PeFileRichHeader.Entries != NULL)
    {
        delete[] PeFileRichHeader.Entries;
    }
 
    PlatformUnmapFile(BaseAddr, MappedSize, FileHandle);
 
    return Result;
}