Portable Executable (PE/COFF & .NET CLI) reader

PE / PE+ / CLI executable low‑level reader. Targets .NET Framework 2.0 and .NET Standard 2.0 (usable from .NET 6+). No unsafe code; pure managed parsing.

Installation

NuGet package:

dotnet add package AlphaOmega.PEReader

Legacy projects (.NET Framework < 4.0) can reference the assembly directly after build.

Supported frameworks

.NET Framework 2.0+
.NET Standard 2.0 (covers .NET Core 2.0+, .NET 5/6/7/8, Mono, etc.)

Quick start

string filePath = @"C:\\Windows\\System32\\kernel32.dll";
using (PEFile file = new PEFile(filePath, StreamLoader.FromFile(filePath)))
{
    if (!file.Header.IsValid) return;

    // Exports
    if (!file.Export.IsEmpty)
    {
        foreach (var func in file.Export.Functions)
        {
            // func.Name / func.Ordinal / func.Address
        }
    }

    // Imports
    if (!file.Import.IsEmpty)
    {
        foreach (var lib in file.Import.Libraries)
        {
            // lib.Name; lib.Functions
        }
    }

    // Authenticode certificate
    if (!file.Certificate.IsEmpty)
    {
        var cert = file.Certificate.X509;
        // cert.Subject, cert.NotBefore, cert.NotAfter
    }

    // .NET metadata (managed assemblies only)
    if (file.ComDescriptor != null)
    {
        var meta = file.ComDescriptor.MetaData;
        // meta.Tables[TableType.TypeDef] etc.
    }
}

See the Wiki for more advanced samples (resources, relocation, debug info, IL parsing, signatures).

Core capabilities

Full DOS, PE and optional header parsing
Section headers & data directory enumeration
Import / Export / Delay‑Import tables
Resources (multiple Win32 resource types including VERSION, MANIFEST, BITMAP, DIALOG, MENU, STRING, MESSAGE TABLE, ACCELERATOR, HTML, TLS)
Relocations, TLS, Load Config, Bound Import, Debug (CodeView PDB 2.0 / 7.0, Misc)
Authenticode (WIN_CERTIFICATE + X509 extraction)
.NET CLR header & metadata streams (#~, #Strings, #US, #Guid, #Blob)
Rich access to MetaData tables (TypeDef, MethodDef, Signatures, CustomAttribute, Assembly*, ManifestResource, Generic*, etc.)
IL method body reader + signature decoding

High level object map

PEFile
 ├─ Header (DOS → NT → File/Optional → Sections)
 ├─ Directories
 │   ├─ Import / DelayImport / Export
 │   ├─ Resource
 │   ├─ Certificate
 │   ├─ Base Relocation / TLS / Load Config
 │   ├─ Debug
 │   └─ CLR (.NET) → MetaData → Tables & Streams
 └─ Helpers (IL reader, Signatures, Strong Name, Manifest resources)

Selected supported structures

(Non‑exhaustive; full list in Wiki) DOS/NT headers, IMAGE_* directories, WIN_CERTIFICATE, ImgDelayDescr, relocation & config directories, Debug (IMAGE_DEBUG_DIRECTORY, CodeView), TLS, CLR (IMAGE_COR20_HEADER, metadata streams & tables), unmanaged resource templates (dialogs, menus, version info, bitmaps, accelerators, message tables, fonts).

Performance & memory

Lazily loads sections and directories. Avoids reading large blobs until accessed. Suitable for scanning many binaries (e.g. signature, import/export enumeration) with minimal allocations.

<details> <summary>Full structure list</summary>

DOS header (IMAGE_DOS_HEADER)
- PE/PE+ header (IMAGE_NT_HEADERS)
- File header (IMAGE_FILE_HEADER)
- Optional header (IMAGE_OPTIONAL_HEADER)
- COFF header (IMAGE_COFF_SYMBOLS_HEADER)
- Sections header (IMAGE_SECTION_HEADER[])
- Directories:
  - Architecture
  - Bound import
  - Certificate
  - CLR runtime header
    - MetaData
      - #~
        
        Module
        
        TypeRef
        
        TypeDef
        
        FieldPtr
        
        Field
        
        MethodPtr
        
        MethodDef
        
        Signature
        
        IL Instructions
        
        ParamPtr
        
        Param
        
        InterfaceImpl
        
        MemberRef
        
        Signature
        
        Constant
        
        CustomAttribute
        
        Signature
        
        FieldMarshal
        
        DeclSecurity
        
        ClassLayout
        
        FieldLayout
        
        StandAloneSig
        
        EventMap
        
        EventPtr
        
        Event
        
        PropertyMap
        
        PropertyPtr
        
        Property
        
        Signature
        
        MethodSemantics
        
        MethodImpl
        
        ModuleRef
        
        TypeSpec
        
        ImplMap
        
        FieldRVA
        
        ENCLog
        
        ENCMap
        
        Assembly
        
        AssemblyProcessor
        
        AssemblyOS
        
        AssemblyRef
        
        AssemblyRefProcessor
        
        AssemblyRefOS
        
        File
        
        ExportedType
        
        ManifestResource
        
        NestedClass
        
        GenericParam
        
        MethodSpec
        
        GenericParamConstraint
      - #Strings
      - #US
      - #Guid
      - #Blob
    - Resource Table (Linked to ManifestResource MetaData table)
    - VTable fixup
    - Code Manager Table
    - Export Address Table
    - Managed Native Header
    - Strong Name Signature
  - Debug
    - CodeView PDB2
    - CodeView PDB7
    - Misc (IMAGE_DEBUG_MISC)
  - Delay Import Descriptor
    - List of delay load imported libraries
    - List of delay load imported functions
  - Exception Table
  - Export Table
    - List of exported functions
  - Global Ptr
  - IAT
  - Import Table
    - List of imported libraries
    - List of imported functions
  - Load Config Table
  - Base Relocation Table
    - Relocation Blocks
    - Relocation Sections
  - Resource Table. Supported resource types:
    - RT_STRING
    - RT_HTML
    - RT_MANIFEST
    - RT_ACCELERATOR
    - RT_MESSAGETABLE
    - RT_DIALOG (Without DLU conversion)
    - RT_BITMAP
    - RT_MENU
    - RT_VERSION
  - TLS Table

Few supported structures:

DOS Header
- IMAGE_DOS_HEADER
PE/PE+ Headers
- IMAGE_FILE_HEADER
- IMAGE_OPTIONAL_HEADER32
- IMAGE_OPTIONAL_HEADER64
- IMAGE_NT_HEADERS32
- IMAGE_NT_HEADERS64
- IMAGE_SECTION_HEADER
- Unmanaged resources
  - IMAGE_RESOURCE_DIRECTORY
  - IMAGE_RESOURCE_DIRECTORY_ENTRY
  - IMAGE_RESOURCE_DATA_ENTRY
  - IMAGE_RESOURCE_DIRECTORY_STRING
  - ACCELTABLEENTRY
  - DLGTEMPLATE
  - DLGITEMTEMPLATE
  - DLGTEMPLATEEX
  - DLGITEMTEMPLATEEX
  - MENUHEADER
  - MENUITEM
  - MENUITEMPOPUP
  - MENUITEMEX
  - BITMAPINFOHEADER
  - VS_VERSIONINFO
  - VS_FIXEDFILEINFO
  - VarFileInfo
  - StringTable
  - V_STRING
  - FONTDIRENTRY
  - MESSAGE_RESOURCE_BLOCK
  - MESSAGE_RESOURCE_ENTRY
- IMAGE_IMPORT_DESCRIPTOR
- IMAGE_THUNK_DATA32
- IMAGE_THUNK_DATA64
- IMAGE_IMPORT_BY_NAME
- IMAGE_RUNTIME_FUNCTION_ENTRY
- IMAGE_DATA_DIRECTORY
- IMAGE_EXPORT_DIRECTORY
- IMAGE_BOUND_IMPORT_DESCRIPTOR
- IMAGE_BOUND_FORWARDER_REF
- WIN_CERTIFICATE
- ImgDelayDescr
- IMAGE_BASE_RELOCATION
- IMAGE_LOAD_CONFIG_DIRECTORY32
- IMAGE_LOAD_CONFIG_DIRECTORY64
- IMAGE_TLS_DIRECTORY32
- IMAGE_TLS_DIRECTORY64
- Debug directory
  - IMAGE_DEBUG_DIRECTORY
  - CV_INFO_PDB70
  - CV_HEADER
  - CV_INFO_PDB20
  - IMAGE_DEBUG_MISC
- .NET CLI
  - IMAGE_COR20_HEADER
  - IMAGE_COR20_METADATA
  - IMAGE_COR20_VTABLE
  - ResourceManagerHeader
  - ResourceSetHeader
  - STREAM_HEADER
  - STREAM_TABLE_HEADER

</details>

PEReader

Install / Use

README