Pro.PE — API for parsing Portable Executables¶
Enumerating Imports¶
The following code example demonstrates how to enumerate imported modules and their symbols:
from Pro.Core import *
from Pro.PE import *
def printImports(fname):
c = createContainerFromFile(fname)
if c.isNull():
return
obj = PEObject()
if not obj.Load(c):
return
impdescr = obj.ImportDescriptors()
if impdescr.IsNull():
return
ordflag = obj.ImportOrdinalFlag()
it = impdescr.iterator()
i = 0
while it.hasNext():
descr = it.next()
offs = obj.RvaToOffset(descr.Num("Name"))
name = obj.ReadUInt8String(offs, 1000)[0]
print("module:", name.decode("utf-8", errors="ignore"))
# imported APIs
thunks = obj.ImportThunks(i)
i += 1
thunks_it = thunks.iterator()
while thunks_it.hasNext():
thunk = thunks_it.next().Uns(0)
# check if it's imported by ordinal
if (thunk & ordflag) != 0:
print("\tordinal: %08X" % (t & ~ordflag,))
# imported by name
else:
offs = obj.RvaToOffset(thunk)
if offs != INVALID_STREAM_OFFSET:
name = obj.ReadUInt8String(offs+2, 1000)[0]
print("\tname:", name.decode("utf-8", errors="ignore"))
Enumerating Resources¶
The following code example demonstrates how to enumerate resources:
from Pro.Core import *
from Pro.PE import *
def enumerateResources(fname):
c = createContainerFromFile(fname)
if c.isNull():
return
obj = PEObject()
if not obj.Load(c):
return
current_root = None
it = obj.ResourceIterator()
while it.Next():
root = it.RootName()
if current_root != root:
current_root = root
if type(root) is int and (known_root := obj.GetKnownResourceIdName(root)):
print(known_root)
else:
print(root)
print(" ", it.Name())
Module API¶
Pro.PE module API.
Attributes:
Represents the AssemblyOS metadata table in .NET assemblies.
Represents the AssemblyProcessor metadata table in .NET assemblies.
Represents the AssemblyRefOS metadata table in .NET assemblies.
Represents the AssemblyRefProcessor metadata table in .NET assemblies.
Represents the AssemblyRef metadata table in .NET assemblies.
Represents the Assembly metadata table in .NET assemblies.
Indicates that the .NET assembly can only be loaded into a 32-bit process.
Indicates that the .NET assembly contains only Microsoft Intermediate Language (MSIL) code.
Specifies that the .NET assembly is an MSIL library.
Indicates that the .NET assembly has a native entry point.
Indicates that the .NET assembly is strong-name signed.
Indicates that the .NET assembly’s debug data should be tracked.
Specifies the length of deleted names in .NET metadata (8 characters).
Specifies the maximum data size (255 bytes) for small method sections in .NET IL code.
Specifies the major version number (2) for the CLR metadata format.
Specifies the major version number (2) for the CLR metadata format, version 2.
Specifies the minor version number (0) for the CLR metadata format.
Specifies the length of virtual table gap names in .NET metadata (8 characters).
Indicates that a virtual table slot uses a 32-bit pointer.
Indicates that a virtual table slot uses a 64-bit pointer.
Specifies that calls should be made to the most derived method.
Indicates that the method call originates from unmanaged code.
Represents the ClassLayout metadata table in .NET assemblies.
Represents the Constant metadata table in .NET assemblies.
Specifies the signature type for custom attributes in .NET assemblies.
Represents the CustomAttribute metadata table in .NET assemblies.
Indicates that the delay-load import address is an RVA (Relative Virtual Address).
Represents the DeclSecurity metadata table in .NET assemblies.
Represents the ENCLog (Edit and Continue Log) metadata table in .NET assemblies.
Represents the ENCMap (Edit and Continue Map) metadata table in .NET assemblies.
Represents the EventMap metadata table in .NET assemblies.
Represents the EventPtr metadata table in .NET assemblies.
Represents the Event metadata table in .NET assemblies.
Represents the ExportedType metadata table in .NET assemblies.
Represents the FieldLayout metadata table in .NET assemblies.
Represents the FieldMarshal metadata table in .NET assemblies.
Represents the FieldPtr metadata table in .NET assemblies.
Represents the FieldRVA metadata table in .NET assemblies.
Specifies the signature type for fields in .NET assemblies.
Represents the Field metadata table in .NET assemblies.
Represents the File metadata table in .NET assemblies.
Represents the GenericParamConstraint metadata table in .NET assemblies.
Represents the GenericParam metadata table in .NET assemblies.
Specifies the size (32 bytes) of an EATJ (Export Address Table Jump) thunk.
Indicates a basic block in a managed native header.
Indicates that the exception handler RVA is present in the managed native header.
Indicates that the method RVA is present in the managed native header.
Represents Borland debug information.
Reserved for future use.
Represents CodeView debug information.
Represents COFF debug information.
Represents exception debug information.
Deprecated and should not be used.
Represents frame pointer omission (FPO) debug information.
Represents incremental link time code generation debug information.
Represents miscellaneous debug information.
Reserved for MPX (Memory Protection Extensions) debug information.
Represents the mapping from source to image when using OMAP.
Represents the mapping from image to source when using OMAP.
Represents POGO (Profile Guided Optimization) debug information.
Indicates a reproducible build in the debug information.
Reserved and should not be used.
Represents unknown debug information.
Represents Visual C++ feature debug information.
Index of the architecture-specific data directory entry.
Index of the base relocation table in the data directory.
Index of the bound import table in the data directory.
Index of the .NET metadata directory in the data directory.
Index of the debug data directory entry.
Index of the delay import descriptor in the data directory.
Index of the .NET-specific data directory entry.
Index of the exception table in the data directory.
Index of the export table in the data directory.
Index of the global pointer register in the data directory.
Index of the Import Address Table (IAT) in the data directory.
Index of the import table in the data directory.
Index of the load configuration table in the data directory.
Index of the .NET metadata directory in the data directory.
Index of the resource table in the data directory.
Index of the security table in the data directory.
Index of the Thread Local Storage (TLS) table in the data directory.
Indicates that the DLL can run in an AppContainer.
Indicates that the DLL can be relocated at load time.
Code integrity checks are enforced.
Indicates that the image supports Control Flow Guard.
Indicates support for high entropy 64-bit virtual address space.
Indicates that the DLL cannot be bound.
Indicates that the image does not use isolation.
Indicates no structured exception handling (SEH) is used.
The image is compatible with Data Execution Prevention (DEP).
The image is Terminal Server aware.
The driver is compliant with the Windows Driver Model (WDM).
Indicates that the file supports a 32-bit machine.
Aggressively trims the working set.
Reverses the bytes of the word (deprecated).
Reverses the bytes of the half-word (deprecated).
Debugging information is removed from the file.
The image is a DLL.
The file is executable.
The application can handle addresses larger than 2 GB.
Line numbers are removed from the file.
Local symbols are removed from the file.
Specifies the Alpha AXP machine type.
Specifies the Alpha AXP 64-bit machine type.
Specifies the Matsushita AM33 machine type.
Specifies the x64 (AMD64) machine type.
Specifies the ARM little endian machine type.
Specifies the ARM64 little endian machine type.
Specifies the ARM Thumb-2 little endian machine type.
Specifies the Alpha AXP 64-bit machine type (same as Alpha64).
Specifies the Common Language Runtime (CLR) pure MSIL machine type.
Specifies the EFI byte code machine type.
Specifies the EFI byte code machine type.
Specifies the Intel 386 (x86) machine type.
Specifies the Intel Itanium processor family machine type.
Specifies the Mitsubishi M32R little endian machine type.
Specifies the MIPS16 machine type.
Specifies the MIPS with FPU machine type.
Specifies the MIPS16 with FPU machine type.
Specifies the PowerPC little endian machine type.
Specifies the PowerPC with floating point support.
Specifies the MIPS R10000 machine type.
Specifies the MIPS R3000 little endian machine type.
Specifies the MIPS R4000 little endian machine type.
Specifies the Hitachi SH3 little endian machine type.
Specifies the Hitachi SH3 DSP machine type.
Specifies the Hitachi SH3E little endian machine type.
Specifies the Hitachi SH4 little endian machine type.
Specifies the Hitachi SH5 machine type.
Specifies a target host machine type.
Specifies the ARM or Thumb (“interworking”) machine type.
Specifies the Infineon TriCore machine type.
Specifies an unknown machine type.
Specifies the MIPS WCE v2 little endian machine type.
The image is copied to swap before execution.
Relocation information is removed from the file.
The image is copied to swap before execution if on removable media.
The image is a system file.
The image is only runnable on a uniprocessor machine.
Indicates that Control Flow Guard (CFW) instrumentation is present.
Indicates that the Control Flow Guard function table is present.
Mask for the size of the Control Flow Guard function table.
Shift count for the size of the Control Flow Guard function table.
Indicates that Control Flow Guard (CF) instrumentation is present.
Indicates that the security cookie is not used.
Magic number identifying a 32-bit PE32 format image.
Magic number identifying a 64-bit PE32+ format image.
Defines the number of data directory entries in the optional header.
The base relocation is skipped.
The relocation is an ARM MOV32 instruction.
The relocation applies to a 64-bit address.
The relocation adds the high 16 bits of the delta to the 16-bit field at the offset.
The relocation adds the high 16 bits of the delta to the 16-bit field at the offset and adjusts for sign extension.
The relocation applies to a 32-bit field at the offset.
The relocation applies to a 64-bit IA64 instruction.
The relocation adds the low 16 bits of the delta to the 16-bit field at the offset.
The relocation applies to a MIPS jump address.
The relocation applies to a MIPS16 jump address.
The relocation applies to a Thumb-2 MOVW/MOVT pair.
Indicates that the resource data is a directory.
Indicates that the resource name is a string.
Magic number identifying a ROM image.
Align data on a 1024-byte boundary.
Align data on a 128-byte boundary.
Align data on a 16-byte boundary.
Align data on a 1-byte boundary.
Align data on a 2048-byte boundary.
Align data on a 256-byte boundary.
Align data on a 2-byte boundary.
Align data on a 32-byte boundary.
Align data on a 4096-byte boundary.
Align data on a 4-byte boundary.
Align data on a 512-byte boundary.
Align data on a 64-byte boundary.
Align data on an 8192-byte boundary.
Align data on an 8-byte boundary.
Mask for section alignment attributes.
The section contains executable code.
The section contains initialized data.
The section contains uninitialized data.
The section contains data referenced through the global pointer.
The section contains COMDAT data.
The section contains comments or other information.
Section contains extended relocations.
Reserved for future use.
The section should not be included in the image.
Reserved for 16-bit machine code.
The section can be discarded as needed.
The section is executable.
Reserved for far data.
Reserved for memory locking.
The section is not cachable.
The section is not pageable.
Reserved for preloading.
Reserved for memory purging.
The section is readable.
The section is shareable.
The section is writable.
Reset speculative exceptions handling bits in the TLB entries for this section.
The section does not require padding.
Specifies the size (8 bytes) of a base relocation.
Specifies the size (40 bytes) of a section header.
Specifies the length of a section name (8 characters).
Image is an EFI application.
Image is an EFI boot service driver.
Image is an EFI ROM image.
Image is an EFI runtime driver.
Image does not require a subsystem.
Image is a native Windows process.
Image runs in the OS/2 character subsystem.
Image runs in the POSIX character subsystem.
Unknown subsystem required.
Image is a Windows boot application.
Image runs in the Windows CE subsystem.
Image runs in the Windows character subsystem.
Image runs in the Windows graphical user interface (GUI) subsystem.
Image runs on the Xbox system.
Specifies an invalid section index.
Represents the ImplMap metadata table in .NET assemblies.
Represents the InterfaceImpl metadata table in .NET assemblies.
Specifies the signature type for local variables in .NET assemblies.
Specifies the maximum length of a class name (1024 characters).
Specifies the maximum length of a package name (1024 characters).
Indicates an array type in metadata constants.
Indicates a boolean type in metadata constants.
Indicates a by-reference type in metadata constants.
Indicates a character type in metadata constants.
Indicates a class type in metadata constants.
Indicates an optional custom modifier in metadata constants.
Indicates a required custom modifier in metadata constants.
Indicates the end of a list in metadata constants.
Indicates a function pointer type in metadata constants.
Indicates a generic instance type in metadata constants.
Indicates a native integer type in metadata constants.
Indicates an 8-bit signed integer type in metadata constants.
Indicates a 16-bit signed integer type in metadata constants.
Indicates a 32-bit signed integer type in metadata constants.
Indicates a 64-bit signed integer type in metadata constants.
Indicates an internal type in metadata constants.
Indicates a modifier type in metadata constants.
Indicates a method type variable in metadata constants.
Indicates an object type in metadata constants.
Indicates a pinned type in metadata constants.
Indicates a pointer type in metadata constants.
Indicates a 32-bit floating-point type in metadata constants.
Indicates a 64-bit floating-point type in metadata constants.
Indicates a sentinel type in metadata constants.
Indicates a string type in metadata constants.
Indicates a single-dimensional array with zero lower bound in metadata constants.
Indicates a typed reference type in metadata constants.
Indicates a native unsigned integer type in metadata constants.
Indicates an 8-bit unsigned integer type in metadata constants.
Indicates a 16-bit unsigned integer type in metadata constants.
Indicates a 32-bit unsigned integer type in metadata constants.
Indicates a 64-bit unsigned integer type in metadata constants.
Indicates a value type in metadata constants.
Indicates a type variable in metadata constants.
Indicates a void type in metadata constants.
An exception clause that handles a specific exception type.
An exception clause that handles a fault.
An exception clause that handles exceptions based on a filter.
An exception clause that represents a finally block.
Indicates a fat format method in MDIL.
Specifies that local variables are initialized to zero.
Indicates that the method has more sections.
Indicates an exception handling table section.
Indicates a fat format section.
Indicates that more sections follow.
Indicates an optimized IL table section.
Indicates a tiny format method in MDIL.
Specifies a bitmap resource.
Specifies an icon resource.
Specifies an unknown resource type.
Represents a class reference tag in MSIL.
Represents an instruction tag in MSIL.
Represents an invalid tag in MSIL.
Represents a label tag in MSIL.
Represents a label jump tag in MSIL.
Represents a method definition tag in MSIL.
Represents a method reference tag in MSIL.
Represents a string tag in MSIL.
Represents the ManifestResource metadata table in .NET assemblies.
Specifies the signature type for marshaling specifications.
Represents the MemberRef metadata table in .NET assemblies.
Specifies the signature type for method definitions.
Indicates that the method has an explicit ‘this’ parameter.
Indicates that the method is generic.
Indicates that the method has an implicit ‘this’ parameter.
Indicates that the method has a variable number of arguments.
Represents the MethodDef metadata table in .NET assemblies.
Represents the MethodImpl metadata table in .NET assemblies.
Represents the MethodPtr metadata table in .NET assemblies.
Specifies the signature type for method references.
Represents the MethodSemantics metadata table in .NET assemblies.
Specifies the signature type for method specifications.
Represents the MethodSpec metadata table in .NET assemblies.
Represents the Method metadata table in .NET assemblies.
Represents the ModuleRef metadata table in .NET assemblies.
Represents the Module metadata table in .NET assemblies.
Specifies the maximum size for native types.
Represents the NestedClass metadata table in .NET assemblies.
Represents the ParamPtr metadata table in .NET assemblies.
Specifies the signature type for parameters.
Represents the Param metadata table in .NET assemblies.
Represents the PropertyMap metadata table in .NET assemblies.
Represents the PropertyPtr metadata table in .NET assemblies.
Specifies the signature type for properties.
Represents the Property metadata table in .NET assemblies.
Specifies an accelerator table resource.
Specifies a bitmap resource.
Specifies a configuration file resource.
Specifies a cursor resource.
Specifies a cursor group resource.
Specifies a dialog resource.
Specifies a font resource.
Specifies a font directory resource.
Specifies an HTML page resource.
Specifies an icon resource.
Specifies an icon group resource.
Specifies a menu resource.
Specifies a message table resource.
Specifies application-defined resource data.
Specifies a string table resource.
Specifies a version information resource.
Specifies the signature type for return types.
Specifies the signature type for stand-alone methods.
Represents the StandAloneSig metadata table in .NET assemblies.
Represents the TypeDef metadata table in .NET assemblies.
Represents the TypeRef metadata table in .NET assemblies.
Specifies the signature type for type specifications.
Represents the TypeSpec metadata table in .NET assemblies.
Indicates that chained unwind information is present.
Indicates that an exception handler is present.
Indicates that a termination handler is present.
Specifies a PKCS#7 SignedData structure.
Specifies an X.509 certificate.
Indicates that the JIT compiler optimizer is disabled.
Indicates that JIT compiler tracking is enabled.
Specifies the AMD64 processor architecture.
Mask for the full processor architecture.
Specifies the IA64 processor architecture.
Specifies that the assembly contains MSIL code only.
Mask for the processor architecture.
Specifies no processor architecture.
Shift count for the processor architecture flags.
Indicates that a processor architecture is specified.
Specifies the x86 processor architecture.
Indicates that the assembly has a public key.
Indicates that the assembly can be retargeted.
Indicates a runtime special name event.
Mask reserved for event attributes.
Indicates a special name event.
Specifies that the field is accessible by any code in the same assembly.
Specifies that the field is accessible only by derived classes in the same assembly.
Specifies that the field is accessible by derived classes and by code in the same assembly.
Specifies that the field is accessible only by derived classes.
Mask used to retrieve field accessibility information.
Specifies that the field has a default value.
Specifies that the field has marshaling information.
Specifies that the field has an associated relative virtual address (RVA).
Specifies that the field is initialized only and cannot be changed after initialization (read-only).
Specifies that the field’s value is a compile-time constant.
Specifies that the field is not serialized when the type is remoted.
Specifies that the field is implemented using PInvoke (Platform Invocation Services).
Specifies that the field is accessible only within its declaring type.
Specifies that the field is not referenceable.
Specifies that the field is accessible by any code that has access to the declaring type.
Specifies that the field name is special and the runtime should check its encoding.
Mask reserved for runtime use.
Specifies that the field is special, and its name describes how.
Specifies that the field is static.
Indicates that the file contains metadata.
Indicates that the file does not contain metadata (e.g., a resource file).
Specifies that the generic parameter is contravariant.
Specifies that the generic parameter is covariant.
Specifies that the generic parameter must have a default constructor.
Specifies that there are no special constraints on the generic parameter.
Specifies that the generic parameter is non-variant.
Specifies that the generic parameter must be a non-nullable value type.
Specifies that the generic parameter must be a reference type.
Mask used to retrieve special constraints on the generic parameter.
Mask used to retrieve variance information on the generic parameter.
Specifies that the method is abstract.
Specifies that the method is accessible to any code in the same assembly.
Indicates that the runtime should check access restrictions when overriding the method.
Specifies that the method is accessible only by derived classes in the same assembly.
Specifies that the method is accessible by derived classes and by code in the same assembly.
Specifies that the method is accessible only by derived classes.
Specifies that the method cannot be overridden.
Specifies that the method has security attributes associated with it.
Indicates that the method hides by signature rather than by name.
Mask used to retrieve method accessibility information.
Specifies that the method always gets a new slot in the virtual method table.
Specifies that the method is implemented using PInvoke (Platform Invocation Services).
Specifies that the method is accessible only within its declaring type.
Specifies that the method cannot be referenced.
Specifies that the method is accessible by any code that has access to the declaring type.
Specifies that the method name is special and the runtime should check its encoding.
Specifies that the method calls another method containing security code.
Mask reserved for runtime use.
Specifies that the method reuses an existing slot in the virtual method table.
Specifies that the method is special, and its name describes how.
Specifies that the method is static.
Specifies that the method is exported to unmanaged code.
Specifies that the method is virtual.
Mask used to retrieve method virtual table layout information.
Mask used to retrieve method code type information.
Specifies that the method is not defined and should be looked up at runtime.
Specifies that the method implementation is in Microsoft Intermediate Language (MSIL).
Specifies that the method is an internal call.
Specifies that the method is implemented in managed code.
Mask used to retrieve method managed/unmanaged information.
Maximum valid value for method implementation attributes.
Specifies that the method implementation is native.
Specifies that the method should not be inlined.
Specifies that the method implementation is in optimized IL.
Specifies that the method signature is exported exactly as declared.
Specifies that the method implementation is provided by the runtime.
Specifies that the method is single-threaded through the body.
Specifies that the method is implemented in unmanaged code.
Specifies that the manifest resource is private to the assembly.
Specifies that the manifest resource is exported from the assembly.
Mask used to retrieve manifest resource visibility information.
Specifies that the method adds an event handler.
Specifies that the method raises an event.
Specifies that the method gets a property value.
Specifies that the method is associated in some other way with a property or event.
Specifies that the method removes an event handler.
Specifies that the method sets a property value.
Specifies that the parameter has a default value.
Specifies that the parameter has marshaling information.
Specifies that the parameter is an input parameter.
Specifies that the parameter is optional.
Specifies that the parameter is an output parameter.
Mask reserved for runtime use.
Unused parameter attributes.
Specifies that best-fit mapping behavior is disabled.
Specifies that best-fit mapping behavior is enabled.
Mask used to retrieve best-fit mapping information.
Specifies that best-fit mapping behavior is taken from the containing assembly.
Specifies the Cdecl calling convention.
Specifies the Fastcall calling convention.
Mask used to retrieve calling convention information.
Specifies the Stdcall calling convention.
Specifies the Thiscall calling convention.
Specifies the default platform calling convention.
Specifies that strings are marshaled as ANSI.
Automatically marshals strings appropriately for the target operating system.
Mask used to retrieve character set information.
Specifies that no character set is specified.
Specifies that strings are marshaled as Unicode.
Maximum valid value for PInvoke attributes.
Specifies that the method name is exported exactly as it appears.
Indicates that the callee will call SetLastError and the runtime should retrieve the error code after the call.
Specifies that an exception should not be thrown on an unmappable Unicode character.
Specifies that an exception should be thrown on an unmappable Unicode character.
Mask used to retrieve throw-on-unmappable-char information.
Specifies that throw-on-unmappable-char behavior is taken from the containing assembly.
Specifies that the property has a default value.
Specifies that the property name is special and the runtime should check its encoding.
Mask reserved for runtime use.
Specifies that the property is special, and its name describes how.
Unused property attributes.
Specifies that the type is abstract.
Specifies that the type string format is ANSI.
Specifies that the type string format is auto.
Specifies that the fields of the type are laid out automatically.
Specifies that type initialization is deferred until first use.
Specifies that the type is a class.
Mask used to retrieve class semantics information.
Specifies that the type string format is custom.
Mask used to retrieve custom string format information.
Specifies that the fields of the type are laid out explicitly.
Specifies that the type is a type forwarder.
Specifies that the type has security attributes associated with it.
Specifies that the type is imported.
Specifies that the type is an interface.
Mask used to retrieve type layout information.
Specifies that the type is nested and visible only within its assembly.
Specifies that the type is nested and visible only to types that are both in the same assembly and derived from the declaring type.
Specifies that the type is nested and visible to derived types and types in the same assembly.
Specifies that the type is nested and visible only to derived types.
Specifies that the type is nested and visible only within its declaring type.
Specifies that the type is nested and publicly visible.
Specifies that the type is not publicly visible.
Specifies that the type is publicly visible.
Specifies that the type name is special and the runtime should check its encoding.
Mask reserved for runtime use.
Specifies that the type is sealed and cannot be inherited.
Specifies that the fields of the type are laid out sequentially in the order in which they appear.
Specifies that the type is serializable.
Specifies that the type is special, and its name describes how.
Mask used to retrieve string format information.
Specifies that the type string format is Unicode.
Mask used to retrieve type visibility information.
Classes:
PEObject()Represents a Portable Executable (PE) file object.
Provides an iterator to traverse the resources in a PE file.
Functions:
PE_VerifyAuthenticode(obj[, options])Verifies the Authenticode digital signature of a PE file.
- AssemblyOS_t: Final[int]¶
Represents the AssemblyOS metadata table in .NET assemblies.
- AssemblyProcessor_t: Final[int]¶
Represents the AssemblyProcessor metadata table in .NET assemblies.
- AssemblyRefOS_t: Final[int]¶
Represents the AssemblyRefOS metadata table in .NET assemblies.
- AssemblyRefProcessor_t: Final[int]¶
Represents the AssemblyRefProcessor metadata table in .NET assemblies.
- AssemblyRef_t: Final[int]¶
Represents the AssemblyRef metadata table in .NET assemblies.
- Assembly_t: Final[int]¶
Represents the Assembly metadata table in .NET assemblies.
- COMIMAGE_FLAGS_32BITREQUIRED: Final[int]¶
Indicates that the .NET assembly can only be loaded into a 32-bit process.
- COMIMAGE_FLAGS_ILONLY: Final[int]¶
Indicates that the .NET assembly contains only Microsoft Intermediate Language (MSIL) code.
- COMIMAGE_FLAGS_IL_LIBRARY: Final[int]¶
Specifies that the .NET assembly is an MSIL library.
- COMIMAGE_FLAGS_NATIVE_ENTRYPOINT: Final[int]¶
Indicates that the .NET assembly has a native entry point.
- COMIMAGE_FLAGS_STRONGNAMESIGNED: Final[int]¶
Indicates that the .NET assembly is strong-name signed.
- COMIMAGE_FLAGS_TRACKDEBUGDATA: Final[int]¶
Indicates that the .NET assembly’s debug data should be tracked.
- COR_DELETED_NAME_LENGTH: Final[int]¶
Specifies the length of deleted names in .NET metadata (8 characters).
- COR_ILMETHOD_SECT_SMALL_MAX_DATASIZE: Final[int]¶
Specifies the maximum data size (255 bytes) for small method sections in .NET IL code.
- COR_VERSION_MAJOR: Final[int]¶
Specifies the major version number (2) for the CLR metadata format.
- COR_VERSION_MAJOR_V2: Final[int]¶
Specifies the major version number (2) for the CLR metadata format, version 2.
- COR_VERSION_MINOR: Final[int]¶
Specifies the minor version number (0) for the CLR metadata format.
- COR_VTABLEGAP_NAME_LENGTH: Final[int]¶
Specifies the length of virtual table gap names in .NET metadata (8 characters).
- COR_VTABLE_32BIT: Final[int]¶
Indicates that a virtual table slot uses a 32-bit pointer.
- COR_VTABLE_64BIT: Final[int]¶
Indicates that a virtual table slot uses a 64-bit pointer.
- COR_VTABLE_CALL_MOST_DERIVED: Final[int]¶
Specifies that calls should be made to the most derived method.
- COR_VTABLE_FROM_UNMANAGED: Final[int]¶
Indicates that the method call originates from unmanaged code.
- ClassLayout_t: Final[int]¶
Represents the ClassLayout metadata table in .NET assemblies.
- Constant_t: Final[int]¶
Represents the Constant metadata table in .NET assemblies.
- CustomAttribSig: Final[int]¶
Specifies the signature type for custom attributes in .NET assemblies.
- CustomAttribute_t: Final[int]¶
Represents the CustomAttribute metadata table in .NET assemblies.
- DELAYIMP_ATTR_ASRVA: Final[int]¶
Indicates that the delay-load import address is an RVA (Relative Virtual Address).
- DeclSecurity_t: Final[int]¶
Represents the DeclSecurity metadata table in .NET assemblies.
- ENCLog_t: Final[int]¶
Represents the ENCLog (Edit and Continue Log) metadata table in .NET assemblies.
- ENCMap_t: Final[int]¶
Represents the ENCMap (Edit and Continue Map) metadata table in .NET assemblies.
- EventMap_t: Final[int]¶
Represents the EventMap metadata table in .NET assemblies.
- EventPtr_t: Final[int]¶
Represents the EventPtr metadata table in .NET assemblies.
- Event_t: Final[int]¶
Represents the Event metadata table in .NET assemblies.
- ExportedType_t: Final[int]¶
Represents the ExportedType metadata table in .NET assemblies.
- FieldLayout_t: Final[int]¶
Represents the FieldLayout metadata table in .NET assemblies.
- FieldMarshal_t: Final[int]¶
Represents the FieldMarshal metadata table in .NET assemblies.
- FieldPtr_t: Final[int]¶
Represents the FieldPtr metadata table in .NET assemblies.
- FieldRVA_t: Final[int]¶
Represents the FieldRVA metadata table in .NET assemblies.
- FieldSig: Final[int]¶
Specifies the signature type for fields in .NET assemblies.
- Field_t: Final[int]¶
Represents the Field metadata table in .NET assemblies.
- File_t: Final[int]¶
Represents the File metadata table in .NET assemblies.
- GenericParamConstraint_t: Final[int]¶
Represents the GenericParamConstraint metadata table in .NET assemblies.
- GenericParam_t: Final[int]¶
Represents the GenericParam metadata table in .NET assemblies.
- IMAGE_COR_EATJ_THUNK_SIZE: Final[int]¶
Specifies the size (32 bytes) of an EATJ (Export Address Table Jump) thunk.
- IMAGE_COR_MIH_BASICBLOCK: Final[int]¶
Indicates a basic block in a managed native header.
- IMAGE_COR_MIH_EHRVA: Final[int]¶
Indicates that the exception handler RVA is present in the managed native header.
- IMAGE_COR_MIH_METHODRVA: Final[int]¶
Indicates that the method RVA is present in the managed native header.
- IMAGE_DEBUG_TYPE_BORLAND: Final[int]¶
Represents Borland debug information.
- IMAGE_DEBUG_TYPE_CLSID: Final[int]¶
Reserved for future use.
- IMAGE_DEBUG_TYPE_CODEVIEW: Final[int]¶
Represents CodeView debug information.
- IMAGE_DEBUG_TYPE_COFF: Final[int]¶
Represents COFF debug information.
- IMAGE_DEBUG_TYPE_EXCEPTION: Final[int]¶
Represents exception debug information.
- IMAGE_DEBUG_TYPE_FIXUP: Final[int]¶
Deprecated and should not be used.
- IMAGE_DEBUG_TYPE_FPO: Final[int]¶
Represents frame pointer omission (FPO) debug information.
- IMAGE_DEBUG_TYPE_ILTCG: Final[int]¶
Represents incremental link time code generation debug information.
- IMAGE_DEBUG_TYPE_MISC: Final[int]¶
Represents miscellaneous debug information.
- IMAGE_DEBUG_TYPE_MPX: Final[int]¶
Reserved for MPX (Memory Protection Extensions) debug information.
- IMAGE_DEBUG_TYPE_OMAP_FROM_SRC: Final[int]¶
Represents the mapping from source to image when using OMAP.
- IMAGE_DEBUG_TYPE_OMAP_TO_SRC: Final[int]¶
Represents the mapping from image to source when using OMAP.
- IMAGE_DEBUG_TYPE_POGO: Final[int]¶
Represents POGO (Profile Guided Optimization) debug information.
- IMAGE_DEBUG_TYPE_REPRO: Final[int]¶
Indicates a reproducible build in the debug information.
- IMAGE_DEBUG_TYPE_RESERVED10: Final[int]¶
Reserved and should not be used.
- IMAGE_DEBUG_TYPE_UNKNOWN: Final[int]¶
Represents unknown debug information.
- IMAGE_DEBUG_TYPE_VC_FEATURE: Final[int]¶
Represents Visual C++ feature debug information.
- IMAGE_DIRECTORY_ENTRY_ARCHITECTURE: Final[int]¶
Index of the architecture-specific data directory entry.
- IMAGE_DIRECTORY_ENTRY_BASERELOC: Final[int]¶
Index of the base relocation table in the data directory.
- IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT: Final[int]¶
Index of the bound import table in the data directory.
- IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR: Final[int]¶
Index of the .NET metadata directory in the data directory.
- IMAGE_DIRECTORY_ENTRY_DEBUG: Final[int]¶
Index of the debug data directory entry.
- IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT: Final[int]¶
Index of the delay import descriptor in the data directory.
- IMAGE_DIRECTORY_ENTRY_DOTNET: Final[int]¶
Index of the .NET-specific data directory entry.
- IMAGE_DIRECTORY_ENTRY_EXCEPTION: Final[int]¶
Index of the exception table in the data directory.
- IMAGE_DIRECTORY_ENTRY_EXPORT: Final[int]¶
Index of the export table in the data directory.
- IMAGE_DIRECTORY_ENTRY_GLOBALPTR: Final[int]¶
Index of the global pointer register in the data directory.
- IMAGE_DIRECTORY_ENTRY_IAT: Final[int]¶
Index of the Import Address Table (IAT) in the data directory.
- IMAGE_DIRECTORY_ENTRY_IMPORT: Final[int]¶
Index of the import table in the data directory.
- IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG: Final[int]¶
Index of the load configuration table in the data directory.
- IMAGE_DIRECTORY_ENTRY_NET_METADATA: Final[int]¶
Index of the .NET metadata directory in the data directory.
- IMAGE_DIRECTORY_ENTRY_RESOURCE: Final[int]¶
Index of the resource table in the data directory.
- IMAGE_DIRECTORY_ENTRY_SECURITY: Final[int]¶
Index of the security table in the data directory.
- IMAGE_DIRECTORY_ENTRY_TLS: Final[int]¶
Index of the Thread Local Storage (TLS) table in the data directory.
- IMAGE_DLLCHARACTERISTICS_APPCONTAINER: Final[int]¶
Indicates that the DLL can run in an AppContainer.
- IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE: Final[int]¶
Indicates that the DLL can be relocated at load time.
- IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY: Final[int]¶
Code integrity checks are enforced.
- IMAGE_DLLCHARACTERISTICS_GUARD_CF: Final[int]¶
Indicates that the image supports Control Flow Guard.
- IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA: Final[int]¶
Indicates support for high entropy 64-bit virtual address space.
- IMAGE_DLLCHARACTERISTICS_NO_BIND: Final[int]¶
Indicates that the DLL cannot be bound.
- IMAGE_DLLCHARACTERISTICS_NO_ISOLATION: Final[int]¶
Indicates that the image does not use isolation.
- IMAGE_DLLCHARACTERISTICS_NO_SEH: Final[int]¶
Indicates no structured exception handling (SEH) is used.
- IMAGE_DLLCHARACTERISTICS_NX_COMPAT: Final[int]¶
The image is compatible with Data Execution Prevention (DEP).
- IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE: Final[int]¶
The image is Terminal Server aware.
- IMAGE_DLLCHARACTERISTICS_WDM_DRIVER: Final[int]¶
The driver is compliant with the Windows Driver Model (WDM).
- IMAGE_FILE_32BIT_MACHINE: Final[int]¶
Indicates that the file supports a 32-bit machine.
- IMAGE_FILE_AGGRESIVE_WS_TRIM: Final[int]¶
Aggressively trims the working set.
- IMAGE_FILE_BYTES_REVERSED_HI: Final[int]¶
Reverses the bytes of the word (deprecated).
- IMAGE_FILE_BYTES_REVERSED_LO: Final[int]¶
Reverses the bytes of the half-word (deprecated).
- IMAGE_FILE_DEBUG_STRIPPED: Final[int]¶
Debugging information is removed from the file.
- IMAGE_FILE_DLL: Final[int]¶
The image is a DLL.
- IMAGE_FILE_EXECUTABLE_IMAGE: Final[int]¶
The file is executable.
- IMAGE_FILE_LARGE_ADDRESS_AWARE: Final[int]¶
The application can handle addresses larger than 2 GB.
- IMAGE_FILE_LINE_NUMS_STRIPPED: Final[int]¶
Line numbers are removed from the file.
- IMAGE_FILE_LOCAL_SYMS_STRIPPED: Final[int]¶
Local symbols are removed from the file.
- IMAGE_FILE_MACHINE_ALPHA: Final[int]¶
Specifies the Alpha AXP machine type.
- IMAGE_FILE_MACHINE_ALPHA64: Final[int]¶
Specifies the Alpha AXP 64-bit machine type.
- IMAGE_FILE_MACHINE_AM33: Final[int]¶
Specifies the Matsushita AM33 machine type.
- IMAGE_FILE_MACHINE_AMD64: Final[int]¶
Specifies the x64 (AMD64) machine type.
- IMAGE_FILE_MACHINE_ARM: Final[int]¶
Specifies the ARM little endian machine type.
- IMAGE_FILE_MACHINE_ARM64: Final[int]¶
Specifies the ARM64 little endian machine type.
- IMAGE_FILE_MACHINE_ARMNT: Final[int]¶
Specifies the ARM Thumb-2 little endian machine type.
- IMAGE_FILE_MACHINE_AXP64: Final[int]¶
Specifies the Alpha AXP 64-bit machine type (same as Alpha64).
- IMAGE_FILE_MACHINE_CEE: Final[int]¶
Specifies the Common Language Runtime (CLR) pure MSIL machine type.
- IMAGE_FILE_MACHINE_CEF: Final[int]¶
Specifies the EFI byte code machine type.
- IMAGE_FILE_MACHINE_EBC: Final[int]¶
Specifies the EFI byte code machine type.
- IMAGE_FILE_MACHINE_I386: Final[int]¶
Specifies the Intel 386 (x86) machine type.
- IMAGE_FILE_MACHINE_IA64: Final[int]¶
Specifies the Intel Itanium processor family machine type.
- IMAGE_FILE_MACHINE_M32R: Final[int]¶
Specifies the Mitsubishi M32R little endian machine type.
- IMAGE_FILE_MACHINE_MIPS16: Final[int]¶
Specifies the MIPS16 machine type.
- IMAGE_FILE_MACHINE_MIPSFPU: Final[int]¶
Specifies the MIPS with FPU machine type.
- IMAGE_FILE_MACHINE_MIPSFPU16: Final[int]¶
Specifies the MIPS16 with FPU machine type.
- IMAGE_FILE_MACHINE_POWERPC: Final[int]¶
Specifies the PowerPC little endian machine type.
- IMAGE_FILE_MACHINE_POWERPCFP: Final[int]¶
Specifies the PowerPC with floating point support.
- IMAGE_FILE_MACHINE_R10000: Final[int]¶
Specifies the MIPS R10000 machine type.
- IMAGE_FILE_MACHINE_R3000: Final[int]¶
Specifies the MIPS R3000 little endian machine type.
- IMAGE_FILE_MACHINE_R4000: Final[int]¶
Specifies the MIPS R4000 little endian machine type.
- IMAGE_FILE_MACHINE_SH3: Final[int]¶
Specifies the Hitachi SH3 little endian machine type.
- IMAGE_FILE_MACHINE_SH3DSP: Final[int]¶
Specifies the Hitachi SH3 DSP machine type.
- IMAGE_FILE_MACHINE_SH3E: Final[int]¶
Specifies the Hitachi SH3E little endian machine type.
- IMAGE_FILE_MACHINE_SH4: Final[int]¶
Specifies the Hitachi SH4 little endian machine type.
- IMAGE_FILE_MACHINE_SH5: Final[int]¶
Specifies the Hitachi SH5 machine type.
- IMAGE_FILE_MACHINE_TARGET_HOST: Final[int]¶
Specifies a target host machine type.
- IMAGE_FILE_MACHINE_THUMB: Final[int]¶
Specifies the ARM or Thumb (“interworking”) machine type.
- IMAGE_FILE_MACHINE_TRICORE: Final[int]¶
Specifies the Infineon TriCore machine type.
- IMAGE_FILE_MACHINE_UNKNOWN: Final[int]¶
Specifies an unknown machine type.
- IMAGE_FILE_MACHINE_WCEMIPSV2: Final[int]¶
Specifies the MIPS WCE v2 little endian machine type.
- IMAGE_FILE_NET_RUN_FROM_SWAP: Final[int]¶
The image is copied to swap before execution.
- IMAGE_FILE_RELOCS_STRIPPED: Final[int]¶
Relocation information is removed from the file.
- IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP: Final[int]¶
The image is copied to swap before execution if on removable media.
- IMAGE_FILE_SYSTEM: Final[int]¶
The image is a system file.
- IMAGE_FILE_UP_SYSTEM_ONLY: Final[int]¶
The image is only runnable on a uniprocessor machine.
- IMAGE_GUARD_CFW_INSTRUMENTED: Final[int]¶
Indicates that Control Flow Guard (CFW) instrumentation is present.
- IMAGE_GUARD_CF_FUNCTION_TABLE_PRESENT: Final[int]¶
Indicates that the Control Flow Guard function table is present.
- IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_MASK: Final[int]¶
Mask for the size of the Control Flow Guard function table.
- IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_SHIFT: Final[int]¶
Shift count for the size of the Control Flow Guard function table.
- IMAGE_GUARD_CF_INSTRUMENTED: Final[int]¶
Indicates that Control Flow Guard (CF) instrumentation is present.
- IMAGE_GUARD_SECURITY_COOKIE_UNUSED: Final[int]¶
Indicates that the security cookie is not used.
- IMAGE_NT_OPTIONAL_HDR32_MAGIC: Final[int]¶
Magic number identifying a 32-bit PE32 format image.
- IMAGE_NT_OPTIONAL_HDR64_MAGIC: Final[int]¶
Magic number identifying a 64-bit PE32+ format image.
- IMAGE_NUMBEROF_DIRECTORY_ENTRIES: Final[int]¶
Defines the number of data directory entries in the optional header.
- IMAGE_REL_BASED_ABSOLUTE: Final[int]¶
The base relocation is skipped.
- IMAGE_REL_BASED_ARM_MOV32: Final[int]¶
The relocation is an ARM MOV32 instruction.
- IMAGE_REL_BASED_DIR64: Final[int]¶
The relocation applies to a 64-bit address.
- IMAGE_REL_BASED_HIGH: Final[int]¶
The relocation adds the high 16 bits of the delta to the 16-bit field at the offset.
- IMAGE_REL_BASED_HIGHADJ: Final[int]¶
The relocation adds the high 16 bits of the delta to the 16-bit field at the offset and adjusts for sign extension.
- IMAGE_REL_BASED_HIGHLOW: Final[int]¶
The relocation applies to a 32-bit field at the offset.
- IMAGE_REL_BASED_IA64_IMM64: Final[int]¶
The relocation applies to a 64-bit IA64 instruction.
- IMAGE_REL_BASED_LOW: Final[int]¶
The relocation adds the low 16 bits of the delta to the 16-bit field at the offset.
- IMAGE_REL_BASED_MIPS_JMPADDR: Final[int]¶
The relocation applies to a MIPS jump address.
- IMAGE_REL_BASED_MIPS_JMPADDR16: Final[int]¶
The relocation applies to a MIPS16 jump address.
- IMAGE_REL_BASED_THUMB_MOV32: Final[int]¶
The relocation applies to a Thumb-2 MOVW/MOVT pair.
- IMAGE_RESOURCE_DATA_IS_DIRECTORY: Final[int]¶
Indicates that the resource data is a directory.
- IMAGE_RESOURCE_NAME_IS_STRING: Final[int]¶
Indicates that the resource name is a string.
- IMAGE_ROM_OPTIONAL_HDR_MAGIC: Final[int]¶
Magic number identifying a ROM image.
- IMAGE_SCN_ALIGN_1024BYTES: Final[int]¶
Align data on a 1024-byte boundary.
- IMAGE_SCN_ALIGN_128BYTES: Final[int]¶
Align data on a 128-byte boundary.
- IMAGE_SCN_ALIGN_16BYTES: Final[int]¶
Align data on a 16-byte boundary.
- IMAGE_SCN_ALIGN_1BYTES: Final[int]¶
Align data on a 1-byte boundary.
- IMAGE_SCN_ALIGN_2048BYTES: Final[int]¶
Align data on a 2048-byte boundary.
- IMAGE_SCN_ALIGN_256BYTES: Final[int]¶
Align data on a 256-byte boundary.
- IMAGE_SCN_ALIGN_2BYTES: Final[int]¶
Align data on a 2-byte boundary.
- IMAGE_SCN_ALIGN_32BYTES: Final[int]¶
Align data on a 32-byte boundary.
- IMAGE_SCN_ALIGN_4096BYTES: Final[int]¶
Align data on a 4096-byte boundary.
- IMAGE_SCN_ALIGN_4BYTES: Final[int]¶
Align data on a 4-byte boundary.
- IMAGE_SCN_ALIGN_512BYTES: Final[int]¶
Align data on a 512-byte boundary.
- IMAGE_SCN_ALIGN_64BYTES: Final[int]¶
Align data on a 64-byte boundary.
- IMAGE_SCN_ALIGN_8192BYTES: Final[int]¶
Align data on an 8192-byte boundary.
- IMAGE_SCN_ALIGN_8BYTES: Final[int]¶
Align data on an 8-byte boundary.
- IMAGE_SCN_ALIGN_MASK: Final[int]¶
Mask for section alignment attributes.
- IMAGE_SCN_CNT_CODE: Final[int]¶
The section contains executable code.
- IMAGE_SCN_CNT_INITIALIZED_DATA: Final[int]¶
The section contains initialized data.
- IMAGE_SCN_CNT_UNINITIALIZED_DATA: Final[int]¶
The section contains uninitialized data.
- IMAGE_SCN_GPREL: Final[int]¶
The section contains data referenced through the global pointer.
- IMAGE_SCN_LNK_COMDAT: Final[int]¶
The section contains COMDAT data.
- IMAGE_SCN_LNK_INFO: Final[int]¶
The section contains comments or other information.
- IMAGE_SCN_LNK_NRELOC_OVFL: Final[int]¶
Section contains extended relocations.
- IMAGE_SCN_LNK_OTHER: Final[int]¶
Reserved for future use.
- IMAGE_SCN_LNK_REMOVE: Final[int]¶
The section should not be included in the image.
- IMAGE_SCN_MEM_16BIT: Final[int]¶
Reserved for 16-bit machine code.
- IMAGE_SCN_MEM_DISCARDABLE: Final[int]¶
The section can be discarded as needed.
- IMAGE_SCN_MEM_EXECUTE: Final[int]¶
The section is executable.
- IMAGE_SCN_MEM_FARDATA: Final[int]¶
Reserved for far data.
- IMAGE_SCN_MEM_LOCKED: Final[int]¶
Reserved for memory locking.
- IMAGE_SCN_MEM_NOT_CACHED: Final[int]¶
The section is not cachable.
- IMAGE_SCN_MEM_NOT_PAGED: Final[int]¶
The section is not pageable.
- IMAGE_SCN_MEM_PRELOAD: Final[int]¶
Reserved for preloading.
- IMAGE_SCN_MEM_PURGEABLE: Final[int]¶
Reserved for memory purging.
- IMAGE_SCN_MEM_READ: Final[int]¶
The section is readable.
- IMAGE_SCN_MEM_SHARED: Final[int]¶
The section is shareable.
- IMAGE_SCN_MEM_WRITE: Final[int]¶
The section is writable.
- IMAGE_SCN_NO_DEFER_SPEC_EXC: Final[int]¶
Reset speculative exceptions handling bits in the TLB entries for this section.
- IMAGE_SCN_TYPE_NO_PAD: Final[int]¶
The section does not require padding.
- IMAGE_SIZEOF_BASE_RELOCATION: Final[int]¶
Specifies the size (8 bytes) of a base relocation.
- IMAGE_SIZEOF_SECTION_HEADER: Final[int]¶
Specifies the size (40 bytes) of a section header.
- IMAGE_SIZEOF_SHORT_NAME: Final[int]¶
Specifies the length of a section name (8 characters).
- IMAGE_SUBSYSTEM_EFI_APPLICATION: Final[int]¶
Image is an EFI application.
- IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER: Final[int]¶
Image is an EFI boot service driver.
- IMAGE_SUBSYSTEM_EFI_ROM: Final[int]¶
Image is an EFI ROM image.
- IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER: Final[int]¶
Image is an EFI runtime driver.
- IMAGE_SUBSYSTEM_NATIVE: Final[int]¶
Image does not require a subsystem.
- IMAGE_SUBSYSTEM_NATIVE_WINDOWS: Final[int]¶
Image is a native Windows process.
- IMAGE_SUBSYSTEM_OS2_CUI: Final[int]¶
Image runs in the OS/2 character subsystem.
- IMAGE_SUBSYSTEM_POSIX_CUI: Final[int]¶
Image runs in the POSIX character subsystem.
- IMAGE_SUBSYSTEM_UNKNOWN: Final[int]¶
Unknown subsystem required.
- IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION: Final[int]¶
Image is a Windows boot application.
- IMAGE_SUBSYSTEM_WINDOWS_CE_GUI: Final[int]¶
Image runs in the Windows CE subsystem.
- IMAGE_SUBSYSTEM_WINDOWS_CUI: Final[int]¶
Image runs in the Windows character subsystem.
- IMAGE_SUBSYSTEM_WINDOWS_GUI: Final[int]¶
Image runs in the Windows graphical user interface (GUI) subsystem.
- IMAGE_SUBSYSTEM_XBOX: Final[int]¶
Image runs on the Xbox system.
- INVALID_SECTION: Final[int]¶
Specifies an invalid section index.
- ImplMap_t: Final[int]¶
Represents the ImplMap metadata table in .NET assemblies.
- InterfaceImpl_t: Final[int]¶
Represents the InterfaceImpl metadata table in .NET assemblies.
- LocalVarSig: Final[int]¶
Specifies the signature type for local variables in .NET assemblies.
- MAX_CLASS_NAME: Final[int]¶
Specifies the maximum length of a class name (1024 characters).
- MAX_PACKAGE_NAME: Final[int]¶
Specifies the maximum length of a package name (1024 characters).
- MDCONST_TYPE_ARRAY: Final[int]¶
Indicates an array type in metadata constants.
- MDCONST_TYPE_BOOLEAN: Final[int]¶
Indicates a boolean type in metadata constants.
- MDCONST_TYPE_BYREF: Final[int]¶
Indicates a by-reference type in metadata constants.
- MDCONST_TYPE_CHAR: Final[int]¶
Indicates a character type in metadata constants.
- MDCONST_TYPE_CLASS: Final[int]¶
Indicates a class type in metadata constants.
- MDCONST_TYPE_CMOD_OPT: Final[int]¶
Indicates an optional custom modifier in metadata constants.
- MDCONST_TYPE_CMOD_REQD: Final[int]¶
Indicates a required custom modifier in metadata constants.
- MDCONST_TYPE_END: Final[int]¶
Indicates the end of a list in metadata constants.
- MDCONST_TYPE_FNPTR: Final[int]¶
Indicates a function pointer type in metadata constants.
- MDCONST_TYPE_GENERICINST: Final[int]¶
Indicates a generic instance type in metadata constants.
- MDCONST_TYPE_I: Final[int]¶
Indicates a native integer type in metadata constants.
- MDCONST_TYPE_I1: Final[int]¶
Indicates an 8-bit signed integer type in metadata constants.
- MDCONST_TYPE_I2: Final[int]¶
Indicates a 16-bit signed integer type in metadata constants.
- MDCONST_TYPE_I4: Final[int]¶
Indicates a 32-bit signed integer type in metadata constants.
- MDCONST_TYPE_I8: Final[int]¶
Indicates a 64-bit signed integer type in metadata constants.
- MDCONST_TYPE_INTERNAL: Final[int]¶
Indicates an internal type in metadata constants.
- MDCONST_TYPE_MODIFIER: Final[int]¶
Indicates a modifier type in metadata constants.
- MDCONST_TYPE_MVAR: Final[int]¶
Indicates a method type variable in metadata constants.
- MDCONST_TYPE_OBJECT: Final[int]¶
Indicates an object type in metadata constants.
- MDCONST_TYPE_PINNED: Final[int]¶
Indicates a pinned type in metadata constants.
- MDCONST_TYPE_PTR: Final[int]¶
Indicates a pointer type in metadata constants.
- MDCONST_TYPE_R4: Final[int]¶
Indicates a 32-bit floating-point type in metadata constants.
- MDCONST_TYPE_R8: Final[int]¶
Indicates a 64-bit floating-point type in metadata constants.
- MDCONST_TYPE_SENTINEL: Final[int]¶
Indicates a sentinel type in metadata constants.
- MDCONST_TYPE_STRING: Final[int]¶
Indicates a string type in metadata constants.
- MDCONST_TYPE_SZARRAY: Final[int]¶
Indicates a single-dimensional array with zero lower bound in metadata constants.
- MDCONST_TYPE_TYPEDBYREF: Final[int]¶
Indicates a typed reference type in metadata constants.
- MDCONST_TYPE_U: Final[int]¶
Indicates a native unsigned integer type in metadata constants.
- MDCONST_TYPE_U1: Final[int]¶
Indicates an 8-bit unsigned integer type in metadata constants.
- MDCONST_TYPE_U2: Final[int]¶
Indicates a 16-bit unsigned integer type in metadata constants.
- MDCONST_TYPE_U4: Final[int]¶
Indicates a 32-bit unsigned integer type in metadata constants.
- MDCONST_TYPE_U8: Final[int]¶
Indicates a 64-bit unsigned integer type in metadata constants.
- MDCONST_TYPE_VALUETYPE: Final[int]¶
Indicates a value type in metadata constants.
- MDCONST_TYPE_VAR: Final[int]¶
Indicates a type variable in metadata constants.
- MDCONST_TYPE_VOID: Final[int]¶
Indicates a void type in metadata constants.
- MDEXCEPTION_CLAUSE_EXCEPTION: Final[int]¶
An exception clause that handles a specific exception type.
- MDEXCEPTION_CLAUSE_FAULT: Final[int]¶
An exception clause that handles a fault.
- MDEXCEPTION_CLAUSE_FILTER: Final[int]¶
An exception clause that handles exceptions based on a filter.
- MDEXCEPTION_CLAUSE_FINALLY: Final[int]¶
An exception clause that represents a finally block.
- MDILMethod_FatFormat: Final[int]¶
Indicates a fat format method in MDIL.
- MDILMethod_InitLocals: Final[int]¶
Specifies that local variables are initialized to zero.
- MDILMethod_MoreSects: Final[int]¶
Indicates that the method has more sections.
- MDILMethod_Sect_EHTable: Final[int]¶
Indicates an exception handling table section.
- MDILMethod_Sect_FatFormat: Final[int]¶
Indicates a fat format section.
- MDILMethod_Sect_MoreSects: Final[int]¶
Indicates that more sections follow.
- MDILMethod_Sect_OptILTable: Final[int]¶
Indicates an optimized IL table section.
- MDILMethod_TinyFormat: Final[int]¶
Indicates a tiny format method in MDIL.
- MRESOURCE_TYPE_BITMAP: Final[int]¶
Specifies a bitmap resource.
- MRESOURCE_TYPE_ICON: Final[int]¶
Specifies an icon resource.
- MRESOURCE_TYPE_UNKNOWN: Final[int]¶
Specifies an unknown resource type.
- MSILTag_ClassRef: Final[int]¶
Represents a class reference tag in MSIL.
- MSILTag_Instruction: Final[int]¶
Represents an instruction tag in MSIL.
- MSILTag_Invalid: Final[int]¶
Represents an invalid tag in MSIL.
- MSILTag_Label: Final[int]¶
Represents a label tag in MSIL.
- MSILTag_LabelJump: Final[int]¶
Represents a label jump tag in MSIL.
- MSILTag_MethodDef: Final[int]¶
Represents a method definition tag in MSIL.
- MSILTag_MethodRef: Final[int]¶
Represents a method reference tag in MSIL.
- MSILTag_String: Final[int]¶
Represents a string tag in MSIL.
- ManifestResource_t: Final[int]¶
Represents the ManifestResource metadata table in .NET assemblies.
- MarshalSpecSig: Final[int]¶
Specifies the signature type for marshaling specifications.
- MemberRef_t: Final[int]¶
Represents the MemberRef metadata table in .NET assemblies.
- MethodDefSig: Final[int]¶
Specifies the signature type for method definitions.
- MethodDefSig_EXPLICITTHIS: Final[int]¶
Indicates that the method has an explicit ‘this’ parameter.
- MethodDefSig_GENERIC: Final[int]¶
Indicates that the method is generic.
- MethodDefSig_HASTHIS: Final[int]¶
Indicates that the method has an implicit ‘this’ parameter.
- MethodDefSig_VARARG: Final[int]¶
Indicates that the method has a variable number of arguments.
- MethodDef_t: Final[int]¶
Represents the MethodDef metadata table in .NET assemblies.
- MethodImpl_t: Final[int]¶
Represents the MethodImpl metadata table in .NET assemblies.
- MethodPtr_t: Final[int]¶
Represents the MethodPtr metadata table in .NET assemblies.
- MethodRefSig: Final[int]¶
Specifies the signature type for method references.
- MethodSemantics_t: Final[int]¶
Represents the MethodSemantics metadata table in .NET assemblies.
- MethodSpecSig: Final[int]¶
Specifies the signature type for method specifications.
- MethodSpec_t: Final[int]¶
Represents the MethodSpec metadata table in .NET assemblies.
- Method_t: Final[int]¶
Represents the Method metadata table in .NET assemblies.
- ModuleRef_t: Final[int]¶
Represents the ModuleRef metadata table in .NET assemblies.
- Module_t: Final[int]¶
Represents the Module metadata table in .NET assemblies.
- NATIVE_TYPE_MAX_CB: Final[int]¶
Specifies the maximum size for native types.
- NestedClass_t: Final[int]¶
Represents the NestedClass metadata table in .NET assemblies.
- class PEObject¶
Bases:
Pro.Core.CFFObjectRepresents a Portable Executable (PE) file object.
Methods:
AfterDumpRebuild(imgbase[, nochecksums])Rebuilds the PE image after dumping from memory.
Returns the Attribute Certificate Table, which contains the digital signature information of the PE file.
Returns the array of Bound Import Descriptors.
Returns the Bound Import Directory structure.
Computes the checksum of the PE file.
Computes the SizeOfImage value, which is the size of the image in memory, including all headers and sections.
CountThunks(offset[, max_count])Counts the number of thunks starting at the given file offset.
Returns the Data Directories as an array.
Returns the Data Directories as a single structure.
Returns the Debug Directory entries.
DebugDirectoryData(dbg)Retrieves the data associated with a specific Debug Directory entry.
Retrieves the header of the debug data associated with a specific Debug Directory entry.
DelayImportBoundIATThunks(nDescr)Retrieves the Bound Import Address Table (IAT) thunks for a specified Delay Import Descriptor.
Returns the array of Delay Import Descriptors.
Returns the Delay Import Directory.
DelayImportIATThunks(nDescr)Retrieves the Import Address Table (IAT) thunks for a specified Delay Import Descriptor.
DelayImportNameThunks(nDescr)Retrieves the Name Table thunks for a specified Delay Import Descriptor.
DelayImportUnloadIATThunks(nDescr)Retrieves the Unload Import Address Table (IAT) thunks for a specified Delay Import Descriptor.
DisassembleMSIL(out, token[, tables, …])Disassembles Microsoft Intermediate Language (MSIL) code associated with a given metadata token.
Returns the DOS Header.
Returns the .NET Directory structure, which contains the CLR metadata information.
DumpRichSignature(out)Dumps the Rich Signature information to the provided output stream.
DumpSectionContent(i, out)Dumps the known content of a specified section to the provided output stream.
DumpVersionInfo(out, offset, size)Dumps the Version Information resource from the specified offset and size.
Returns the entry point address.
Returns the Exception Directory entries.
Returns Export Directory.
Returns the array of exported function addresses.
Retrieves the array of exported function name ordinals.
Retrieves the array of exported function names.
Returns the File Header.
FindMDStream(names, mdoffs)Finds a .NET metadata stream by name.
GetDataDirectory(nEntry[, to_offset])Retrieves the RVA and size of a specified Data Directory entry.
Retrieves the raw data associated with a Debug Directory entry.
GetDescriptors(descr, i[, i2])Counts the number of the descriptors based on specified fields.
GetKnownResourceIdName(id[, plural])Retrieves the known name of a resource ID.
GetPDBAssociationInfo([dbgdatahdr])Retrieves the PDB (Program Database) association information.
Calculates the real size of the PE file.
GetRelocTypeName(type, machine)Retrieves the name of a relocation type based on the machine type.
GetResourceEntryName(resbase, entry_or_nameval)Retrieves the name of a resource entry.
Retrieves the Thread Local Storage (TLS) data.
GetThunks(s, i[, rvas])Retrieves the array of thunks for an import descriptor.
Returns the Import Descriptors.
Returns the Import Directory.
ImportFThunkCount(i[, max_count])Counts the number of First Thunks for a specified import descriptor.
ImportFThunks(nDescr)Retrieves the First Thunks for a specified import descriptor.
ImportOFThunkCount(i[, max_count])Counts the number of Original First Thunks for a specified import descriptor.
ImportOFThunks(nDescr)Retrieves the Original First Thunks for a specified import descriptor.
Retrieves the import ordinal flag based on the PE architecture.
ImportThunks(nDescr)Retrieves the Original First Thunks or First Thunks (whichever available) for a specified import descriptor.
IsMIPSMachine(machine)Checks if the machine type corresponds to a MIPS architecture.
IsPE64()Determines if the PE file is a 64-bit executable (PE32+).
IsRvaValid(Rva)Checks if the given Relative Virtual Address (RVA) is valid.
Determines if the file is a valid PE file.
Returns the Load Configuration Directory.
Retrieves the Control Flow Guard (CFG) function table from the Load Configuration Directory.
LoadConfigSEHandlers([lc])Retrieves the SEH (Structured Exception Handling) handlers from the Load Configuration Directory.
MDHeader([mdoffs])Retrieves the .NET Metadata Header.
MDStreams([mdoffs])Retrieves the array of .NET Metadata Streams.
MDTables(stream_name[, mdoffs])Retrieves the .NET Metadata Tables from the specified stream.
MDTablesHeader(stream_name[, mdoffs])Retrieves the header of the .NET Metadata Tables from the specified stream.
Returns the Managed Native Header, if present.
Returns the NT Headers.
OffsetToRva(offset)Converts a file offset to a Relative Virtual Address (RVA).
OffsetToVa(offset)Converts a file offset to a Virtual Address (VA).
Returns the Optional Header.
OutputMDClassAccessibility(out, flags)Outputs the accessibility modifiers of a .NET class based on the provided flags.
Returns the ReadyToRun Header, which is used for precompiled .NET assemblies.
Returns the ReadyToRun Section Headers.
RemoveDataDirectory(nEntry[, zero_data])Removes a specified Data Directory entry from the PE file.
ReqExecLevelFromConfigFile(offset, size)Parses the application manifest to determine the required execution level.
ResourceDataEntry(offset)Retrieves a Resource Data Entry at the specified offset.
ResourceDirectory(offset)Retrieves a Resource Directory at the specified offset.
ResourceDirectoryEntry(offset)Retrieves a Resource Directory Entry at the specified offset.
Creates an iterator to traverse the resources in the PE file.
Retrieves the Rich Signature offset and size.
Retrieves the raw data of the Rich Signature.
RvaToOffset(RVA)Converts a Relative Virtual Address (RVA) to a file offset.
RvaToVa(RVA)Converts a Relative Virtual Address (RVA) to a Virtual Address (VA).
ScopeTables(unw)Retrieves the scope tables associated with a given Unwind Info structure.
SectionData(i)Retrieves the data of a specified section.
SectionFromRva(RVA)Determines the section index containing the specified RVA.
Returns the array of Section Headers.
SectionInfo(i)Retrieves information about a specified section.
Returns the Thread Local Storage (TLS) callback functions.
TLSData()Retrieves the offset and size of the TLS data.
Returns the Thread Local Storage (TLS) Directory.
UnwindInfo(runfunc)Retrieves the Unwind Info for a given runtime function entry.
VaToOffset(VA)Converts a Virtual Address (VA) to a file offset.
VaToRva(VA)Converts a Virtual Address (VA) to a Relative Virtual Address (RVA).
VersionInfo(offset)Retrieves the Version Information resource at the specified offset.
Attributes:
Specifies that the required execution level is ‘As Administrator’.
Specifies that the required execution level is ‘As Invoker’.
Indicates an error or undefined execution level.
Specifies that the required execution level is ‘Highest Available’.
Indicates an unknown execution level.
- AfterDumpRebuild(imgbase: int, nochecksums: bool = True) → bool¶
Rebuilds the PE image after dumping from memory.
- Parameters
imgbase (int) – The new image base address.
nochecksums (bool) – If
True, it does not update the checksum.- Returns
Returns
Trueif successful; otherwise returnsFalse.- Return type
bool
See also
ComputeCheckSum(),GetRealPESize()andIsValidPE().
- AttributeCertificateTable() → Pro.Core.CFFStruct¶
- Returns
Returns the Attribute Certificate Table, which contains the digital signature information of the PE file.
- Return type
See also
PE_VerifyAuthenticode().
- BoundImportDescriptors() → Pro.Core.CFFStruct¶
- Returns
Returns the array of Bound Import Descriptors.
- Return type
See also
ImportDescriptors()andDelayImportDescriptors().
- BoundImportDirectory() → Pro.Core.CFFStruct¶
- Returns
Returns the Bound Import Directory structure.
- Return type
See also
BoundImportDescriptors().
- ComputeCheckSum() → int¶
Computes the checksum of the PE file.
- Returns
Returns the computed checksum value.
- Return type
int
See also
AfterDumpRebuild().
- ComputeSizeOfImage() → int¶
Computes the SizeOfImage value, which is the size of the image in memory, including all headers and sections.
- Returns
Returns the computed SizeOfImage value.
- Return type
int
See also
GetRealPESize()andOptionalHeader().
- CountThunks(offset: int, max_count: int = - 1) → int¶
Counts the number of thunks starting at the given file offset.
- Parameters
offset (int) – The file offset to start counting thunks.
max_count (int) – The maximum number of thunks to count (default is
-1for no limit).- Returns
Returns the number of thunks counted.
- Return type
int
See also
GetThunks()andImportThunks().
- DataDirectories() → Pro.Core.CFFStruct¶
- Returns
Returns the Data Directories as an array.
- Return type
See also
DataDirectories2(),GetDataDirectory()andRemoveDataDirectory().
- DataDirectories2() → Pro.Core.CFFStruct¶
- Returns
Returns the Data Directories as a single structure.
- Return type
See also
DataDirectories().
- DebugDirectory() → Pro.Core.CFFStruct¶
- Returns
Returns the Debug Directory entries.
- Return type
See also
GetDebugDirectoryData()andDebugDirectoryDataHeader().
- DebugDirectoryData(dbg: Pro.Core.CFFStruct) → tuple¶
Retrieves the data associated with a specific Debug Directory entry.
- Parameters
dbg (CFFStruct) – The Debug Directory entry.
- Returns
A tuple containing the file offset and size of the debug data.
- Return type
tuple[int, int]
See also
DebugDirectory()andGetDebugDirectoryData().
- DebugDirectoryDataHeader(dbg: Pro.Core.CFFStruct) → Pro.Core.CFFStruct¶
Retrieves the header of the debug data associated with a specific Debug Directory entry.
- Parameters
dbg (CFFStruct) – The Debug Directory entry.
- Returns
Returns the debug data header.
- Return type
See also
DebugDirectoryData()andDebugDirectory().
- DelayImportBoundIATThunks(nDescr: int) → Pro.Core.CFFStruct¶
Retrieves the Bound Import Address Table (IAT) thunks for a specified Delay Import Descriptor.
- Parameters
nDescr (int) – The index of the Delay Import Descriptor.
- Returns
Returns the Bound IAT thunks.
- Return type
See also
DelayImportDescriptors()andGetThunks().
- DelayImportDescriptors() → Pro.Core.CFFStruct¶
- Returns
Returns the array of Delay Import Descriptors.
- Return type
See also
ImportDescriptors()andBoundImportDescriptors().
- DelayImportDirectory() → Pro.Core.CFFStruct¶
- Returns
Returns the Delay Import Directory.
- Return type
See also
DelayImportDescriptors().
- DelayImportIATThunks(nDescr: int) → Pro.Core.CFFStruct¶
Retrieves the Import Address Table (IAT) thunks for a specified Delay Import Descriptor.
- Parameters
nDescr (int) – The index of the Delay Import Descriptor.
- Returns
Returns the IAT thunks.
- Return type
See also
DelayImportDescriptors()andGetThunks().
- DelayImportNameThunks(nDescr: int) → Pro.Core.CFFStruct¶
Retrieves the Name Table thunks for a specified Delay Import Descriptor.
- Parameters
nDescr (int) – The index of the Delay Import Descriptor.
- Returns
Returns the Name Table thunks.
- Return type
See also
DelayImportIATThunks().
- DelayImportUnloadIATThunks(nDescr: int) → Pro.Core.CFFStruct¶
Retrieves the Unload Import Address Table (IAT) thunks for a specified Delay Import Descriptor.
- Parameters
nDescr (int) – The index of the Delay Import Descriptor.
- Returns
Returns the Unload IAT thunks.
- Return type
See also
DelayImportIATThunks().
- DisassembleMSIL(out: Pro.Core.NTTextStream, token: int, tables: Pro.Core.CFFStructList = CFFStructList(), stream_name: str = str(), mdoffs: int = INVALID_STREAM_OFFSET) → None¶
Disassembles Microsoft Intermediate Language (MSIL) code associated with a given metadata token.
- Parameters
out (NTTextStream) – The output stream to write the disassembled code.
token (int) – The metadata token identifying the method.
tables (CFFStructList) – The list of .NET metadata tables.
stream_name (str) – The name of the .NET stream.
mdoffs (int) – The offset to the metadata.
See also
MDTables()andMDHeader().
- DosHeader() → Pro.Core.CFFStruct¶
- Returns
Returns the DOS Header.
- Return type
See also
NtHeaders()andOptionalHeader().
- DotNETDirectory() → Pro.Core.CFFStruct¶
- Returns
Returns the .NET Directory structure, which contains the CLR metadata information.
- Return type
See also
MDHeader()andMDStreams().
- DumpRichSignature(out: Pro.Core.NTTextStream) → None¶
Dumps the Rich Signature information to the provided output stream.
- Parameters
out (NTTextStream) – The output stream to write the Rich Signature information.
See also
RichSignature()andRichSignatureData().
- DumpSectionContent(i: int, out: Pro.Core.NTTextStream) → None¶
Dumps the known content of a specified section to the provided output stream.
- Parameters
i (int) – The index of the section.
out (NTTextStream) – The output stream to write the section known content.
See also
SectionData()andSectionHeaders().
- DumpVersionInfo(out: Pro.Core.NTTextStream, offset: int, size: int) → None¶
Dumps the Version Information resource from the specified offset and size.
- Parameters
out (NTTextStream) – The output stream to write the version information.
offset (int) – The file offset of the version information resource.
size (int) – The size of the version information resource.
See also
VersionInfo()andResourceDataEntry().
- EntryPoint() → int¶
- Returns
Returns the entry point address.
- Return type
int
See also
OptionalHeader().
- ExceptionDirectory() → Pro.Core.CFFStruct¶
- Returns
Returns the Exception Directory entries.
- Return type
See also
UnwindInfo().
- ExportDirectory() → Pro.Core.CFFStruct¶
- Returns
Returns Export Directory.
- Return type
See also
ExportDirectoryFunctions(),ExportDirectoryNames()andExportDirectoryNameOrdinals().
- ExportDirectoryFunctions() → Pro.Core.CFFStruct¶
- Returns
Returns the array of exported function addresses.
- Return type
See also
ExportDirectoryNames(),ExportDirectoryNameOrdinals()andExportDirectory().
- ExportDirectoryNameOrdinals() → Pro.Core.CFFStruct¶
Retrieves the array of exported function name ordinals.
- Returns
A CFFStruct representing the exported name ordinals.
- Return type
See also
ExportDirectoryFunctions(),ExportDirectoryNames()andExportDirectory().
- ExportDirectoryNames() → Pro.Core.CFFStruct¶
Retrieves the array of exported function names.
- Returns
A CFFStruct representing the exported names.
- Return type
See also
ExportDirectoryFunctions(),ExportDirectoryNameOrdinals()andExportDirectory().
- FileHeader() → Pro.Core.CFFStruct¶
- Returns
Returns the File Header.
- Return type
See also
OptionalHeader()andNtHeaders().
- FindMDStream(names: str, mdoffs: int) → tuple¶
Finds a .NET metadata stream by name.
- Parameters
names (str) – The name of the metadata stream.
mdoffs (int) – The offset to the metadata directory.
- Returns
A tuple containing the stream header, offset, and size.
- Return type
tuple[CFFStruct, int, int]
See also
MDStreams()andMDHeader().
- GetDataDirectory(nEntry: int, to_offset: bool = True) → tuple¶
Retrieves the RVA and size of a specified Data Directory entry.
- Parameters
nEntry (int) – The index of the Data Directory entry.
to_offset (bool) – If
True, converts the RVA to a file offset.- Returns
A tuple containing the RVA or file offset and the size.
- Return type
tuple[int, int]
See also
DataDirectories().
- GetDebugDirectoryData(dbg: Pro.Core.CFFStruct) → tuple¶
Retrieves the raw data associated with a Debug Directory entry.
- Parameters
dbg (CFFStruct) – The Debug Directory entry.
- Returns
A tuple containing the data container, offset, and size.
- Return type
tuple[NTContainer, int, int]
See also
DebugDirectoryData()andDebugDirectoryDataHeader().
- GetDescriptors(descr: Pro.Core.CFFStruct, i: int, i2: int = - 1) → Pro.Core.CFFStruct¶
Counts the number of the descriptors based on specified fields.
Note
This method is used internally. Methods like
ImportDescriptors()should be called instead.
- Parameters
descr (CFFStruct) – The descriptors container.
i (int) – The index of a field that can be used as terminator.
i2 (int) – The optional index of another field that can be used as terminator.
- Returns
Returns the array of descriptors with the correct number of entries.
- Return type
See also
ImportDescriptors(),DelayImportDescriptors(), andBoundImportDescriptors().
- static GetKnownResourceIdName(id: int, plural: bool = True) → str¶
Retrieves the known name of a resource ID.
- Parameters
id (int) – The resource ID.
plural (bool) – If
True, returns the plural form of the name.- Returns
Returns the name of the resource ID if successful; otherwise returns an empty string.
- Return type
str
See also
GetResourceEntryName().
- GetPDBAssociationInfo(dbgdatahdr: Optional[Pro.Core.CFFStruct] = None) → Pro.Core.PDBAssociationInfo¶
Retrieves the PDB (Program Database) association information.
- Parameters
dbgdatahdr (Optional[CFFStruct]) – An optional debug data header.
- Returns
Returns the PDB association information.
- Return type
See also
DebugDirectory()andGetDebugDirectoryData().
- GetRealPESize() → int¶
Calculates the real size of the PE file.
- Returns
Returns the calculated size.
- Return type
int
See also
ComputeSizeOfImage().
- static GetRelocTypeName(type: int, machine: int) → str¶
Retrieves the name of a relocation type based on the machine type.
- Parameters
type (int) – The relocation type.
machine (int) – The machine type (e.g.,
IMAGE_FILE_MACHINE_I386).- Returns
The name of the relocation type.
- Return type
str
See also
FileHeader().
- GetResourceEntryName(resbase: int, entry_or_nameval: Union[Pro.Core.CFFStruct, int]) → tuple¶
Retrieves the name of a resource entry.
- Parameters
resbase (int) – The base offset of the resource directory.
entry_or_nameval (Union[CFFStruct, int]) – The resource entry or name value.
- Returns
Returns tuple containing an integer (
1for string name,0for integer name) and the name string.- Return type
tuple[int, str]
See also
ResourceDirectoryEntry().
- GetTLSData() → tuple¶
Retrieves the Thread Local Storage (TLS) data.
- Returns
A tuple containing the data container, offset, and size.
- Return type
tuple[NTContainer, int, int]
See also
TLSDirectory()andTLSCallbacks().
- GetThunks(s: Pro.Core.CFFStruct, i: int, rvas: bool = True) → Pro.Core.CFFStruct¶
Retrieves the array of thunks for an import descriptor.
- Parameters
s (CFFStruct) – The import descriptor.
i (int) – The index of the thunks address field.
rvas (bool) – If
True, the field is treated as an RVA; otherwise it is treated as a VA.- Returns
A CFFStruct representing the thunks.
- Return type
See also
ImportThunks()andDelayImportIATThunks().
- ImportDescriptors() → Pro.Core.CFFStruct¶
- Returns
Returns the Import Descriptors.
- Return type
See also
ImportDirectory(),ImportThunks()andGetDescriptors().
- ImportDirectory() → Pro.Core.CFFStruct¶
- Returns
Returns the Import Directory.
- Return type
See also
ImportDescriptors()andDataDirectories().
- ImportFThunkCount(i: int, max_count: int = - 1) → int¶
Counts the number of First Thunks for a specified import descriptor.
- Parameters
i (int) – The index of the import descriptor.
max_count (int) – The maximum number of thunks to count (default is
-1for no limit).- Returns
Returns the number of first thunks.
- Return type
int
See also
ImportFThunks()andCountThunks().
- ImportFThunks(nDescr: int) → Pro.Core.CFFStruct¶
Retrieves the First Thunks for a specified import descriptor.
- Parameters
nDescr (int) – The index of the import descriptor.
- Returns
Returns the First Thunks entries.
- Return type
See also
ImportFThunkCount()andGetThunks().
- ImportOFThunkCount(i: int, max_count: int = - 1) → int¶
Counts the number of Original First Thunks for a specified import descriptor.
- Parameters
i (int) – The index of the import descriptor.
max_count (int) – The maximum number of thunks to count (default is
-1for no limit).- Returns
Returns the number of Original First Thunks.
- Return type
int
See also
ImportOFThunks()andCountThunks().
- ImportOFThunks(nDescr: int) → Pro.Core.CFFStruct¶
Retrieves the Original First Thunks for a specified import descriptor.
- Parameters
nDescr (int) – The index of the import descriptor.
- Returns
Returns the Original First Thunks entries.
- Return type
See also
ImportOFThunkCount()andGetThunks().
- ImportOrdinalFlag() → int¶
Retrieves the import ordinal flag based on the PE architecture.
- Returns
The import ordinal flag value.
- Return type
int
See also
IsPE64()andGetThunks().
- ImportThunks(nDescr: int) → Pro.Core.CFFStruct¶
Retrieves the Original First Thunks or First Thunks (whichever available) for a specified import descriptor.
- Parameters
nDescr (int) – The index of the import descriptor.
- Returns
Returns the IAT Thunks entries.
- Return type
See also
ImportDescriptors()andGetThunks().
- static IsMIPSMachine(machine: int) → bool¶
Checks if the machine type corresponds to a MIPS architecture.
- Parameters
machine (int) – The machine type.
- Returns
Returns
Trueif the machine is MIPS; otherwise returnsFalse.- Return type
bool
See also
FileHeader()andIsPE64().
- IsPE64() → bool¶
Determines if the PE file is a 64-bit executable (PE32+).
- Returns
Returns
Trueif the PE is 64-bit; otherwise returnsFalse.- Return type
bool
See also
OptionalHeader().
- IsRvaValid(Rva: int) → bool¶
Checks if the given Relative Virtual Address (RVA) is valid.
- Parameters
Rva (int) – The RVA to check.
- Returns
Returns
Trueif the RVA is valid; otherwise returnsFalse.- Return type
bool
See also
RvaToOffset()andSectionFromRva().
- IsValidPE() → bool¶
Determines if the file is a valid PE file.
- Returns
Returns
Trueif valid; otherwise returnsFalse.- Return type
bool
See also
DosHeader(),NtHeaders(), andOptionalHeader().
- LoadConfigDirectory() → Pro.Core.CFFStruct¶
- Returns
Returns the Load Configuration Directory.
- Return type
See also
LoadConfigGuardCFFunctions()andLoadConfigSEHandlers().
- LoadConfigGuardCFFunctions(lc: Optional[Pro.Core.CFFStruct] = None) → Pro.Core.CFFStruct¶
Retrieves the Control Flow Guard (CFG) function table from the Load Configuration Directory.
- Parameters
lc (Optional[CFFStruct]) – An optional Load Configuration Directory structure.
- Returns
Returns the CFG function table.
- Return type
See also
LoadConfigDirectory().
- LoadConfigSEHandlers(lc: Optional[Pro.Core.CFFStruct] = None) → Pro.Core.CFFStruct¶
Retrieves the SEH (Structured Exception Handling) handlers from the Load Configuration Directory.
- Parameters
lc (Optional[CFFStruct]) – An optional Load Configuration Directory structure.
- Returns
Returns the SEH handlers.
- Return type
See also
LoadConfigDirectory().
- MDHeader(mdoffs: int = INVALID_STREAM_OFFSET) → Pro.Core.CFFStruct¶
Retrieves the .NET Metadata Header.
- Parameters
mdoffs (int) – The optional offset to the metadata directory.
- Returns
Returns the Metadata Header.
- Return type
See also
MDStreams(),MDTables(), andDotNETDirectory().
- MDStreams(mdoffs: int = INVALID_STREAM_OFFSET) → Pro.Core.CFFStruct¶
Retrieves the array of .NET Metadata Streams.
- Parameters
mdoffs (int) – The optional offset to the metadata directory .
- Returns
Returns the Metadata Streams.
- Return type
See also
MDHeader()andFindMDStream().
- MDTables(stream_name: str, mdoffs: int = INVALID_STREAM_OFFSET) → Pro.Core.CFFStructList¶
Retrieves the .NET Metadata Tables from the specified stream.
- Parameters
stream_name (str) – The name of the metadata stream (e.g., ‘#~’ or ‘#-‘).
mdoffs (int) – The optional offset to the metadata directory.
- Returns
Returns the Metadata Tables.
- Return type
See also
MDTablesHeader(),MDHeader()andDisassembleMSIL().
- MDTablesHeader(stream_name: str, mdoffs: int = INVALID_STREAM_OFFSET) → Pro.Core.CFFStruct¶
Retrieves the header of the .NET Metadata Tables from the specified stream.
- Parameters
stream_name (str) – The name of the metadata stream (e.g., ‘#~’ or ‘#-‘).
mdoffs (int) – The optional offset to the metadata directory.
- Returns
Returns the Metadata Tables Header.
- Return type
See also
MDTables()andMDHeader().
- ManagedNativeHeader() → Pro.Core.CFFStruct¶
- Returns
Returns the Managed Native Header, if present.
- Return type
See also
DotNETDirectory().
- NtHeaders() → Pro.Core.CFFStruct¶
- Returns
Returns the NT Headers.
- Return type
See also
DosHeader(),OptionalHeader(), andFileHeader().
- OffsetToRva(offset: int) → int¶
Converts a file offset to a Relative Virtual Address (RVA).
- Parameters
offset (int) – The file offset to convert.
- Returns
Returns the RVA if successful; otherwise returns
Pro.Core.INVALID_STREAM_OFFSET.- Return type
int
See also
RvaToOffset(),OffsetToVa(), andIsRvaValid().
- OffsetToVa(offset: int) → int¶
Converts a file offset to a Virtual Address (VA).
- Parameters
offset (int) – The file offset to convert.
- Returns
Returns the VA if successful; otherwise returns
Pro.Core.INVALID_STREAM_OFFSET.- Return type
int
See also
VaToOffset(),OffsetToRva().
- OptionalHeader() → Pro.Core.CFFStruct¶
- Returns
Returns the Optional Header.
- Return type
See also
NtHeaders()andFileHeader().
- OutputMDClassAccessibility(out: Pro.Core.NTTextStream, flags: int) → None¶
Outputs the accessibility modifiers of a .NET class based on the provided flags.
- Parameters
out (NTTextStream) – The output stream to write the accessibility information.
flags (int) – The flags representing the class attributes.
See also
MDTables()andDisassembleMSIL().
- ReadyToRunHeader() → Pro.Core.CFFStruct¶
- Returns
Returns the ReadyToRun Header, which is used for precompiled .NET assemblies.
- Return type
See also
ReadyToRunSectionHeaders().
- ReadyToRunSectionHeaders() → Pro.Core.CFFStruct¶
- Returns
Returns the ReadyToRun Section Headers.
- Return type
See also
ReadyToRunHeader().
- RemoveDataDirectory(nEntry: int, zero_data: bool = True) → bool¶
Removes a specified Data Directory entry from the PE file.
- Parameters
nEntry (int) – The index of the Data Directory entry to remove.
zero_data (bool) – If
True, zeroes out the data directory.- Returns
Returns
Trueif successful; otherwise returnsFalse.- Return type
bool
See also
GetDataDirectory()andDataDirectories().
- ReqExecLevelFromConfigFile(offset: int, size: int) → int¶
Parses the application manifest to determine the required execution level.
- Parameters
offset (int) – The file offset of the manifest.
size (int) – The size of the manifest.
- Returns
Returns one of the ReqExecLevel constants indicating the required execution level.
- Return type
int
See also
ReqExecLevel_AsInvoker,ReqExecLevel_AsAdministratorandReqExecLevel_HighestAvailable.
- ReqExecLevel_AsAdministrator: Final[int]¶
Specifies that the required execution level is ‘As Administrator’.
See also
ReqExecLevelFromConfigFile().
- ReqExecLevel_AsInvoker: Final[int]¶
Specifies that the required execution level is ‘As Invoker’.
See also
ReqExecLevelFromConfigFile().
- ReqExecLevel_Error: Final[int]¶
Indicates an error or undefined execution level.
See also
ReqExecLevelFromConfigFile().
- ReqExecLevel_HighestAvailable: Final[int]¶
Specifies that the required execution level is ‘Highest Available’.
See also
ReqExecLevelFromConfigFile().
- ReqExecLevel_Unknown: Final[int]¶
Indicates an unknown execution level.
See also
ReqExecLevelFromConfigFile().
- ResourceDataEntry(offset: int) → Pro.Core.CFFStruct¶
Retrieves a Resource Data Entry at the specified offset.
- Parameters
offset (int) – The file offset of the Resource Data Entry.
- Returns
Returns the Resource Data Entry.
- Return type
See also
ResourceDirectoryEntry()andResourceIterator().
- ResourceDirectory(offset: int) → Pro.Core.CFFStruct¶
Retrieves a Resource Directory at the specified offset.
- Parameters
offset (int) – The file offset of the Resource Directory.
- Returns
Returns the Resource Directory.
- Return type
See also
ResourceDirectoryEntry()andResourceIterator().
- ResourceDirectoryEntry(offset: int) → Pro.Core.CFFStruct¶
Retrieves a Resource Directory Entry at the specified offset.
- Parameters
offset (int) – The file offset of the Resource Directory Entry.
- Returns
Returns the Resource Directory Entry.
- Return type
See also
ResourceDirectory()andResourceIterator().
- ResourceIterator() → Pro.PE.PEResourceIterator¶
Creates an iterator to traverse the resources in the PE file.
- Returns
Returns an iterator.
- Return type
See also
PEResourceIterator.
- RichSignature() → tuple¶
Retrieves the Rich Signature offset and size.
- Returns
Returns a tuple containing the offset and size of the Rich Signature.
- Return type
tuple[int, int]
See also
DumpRichSignature()andRichSignatureData().
- RichSignatureData() → bytes¶
Retrieves the raw data of the Rich Signature.
- Returns
Returns the Rich Signature data.
- Return type
bytes
See also
RichSignature()andDumpRichSignature().
- RvaToOffset(RVA: int) → int¶
Converts a Relative Virtual Address (RVA) to a file offset.
- Parameters
RVA (int) – The RVA to convert.
- Returns
Returns the offset if successful; otherwise returns
Pro.Core.INVALID_STREAM_OFFSET.- Return type
int
See also
OffsetToRva(),VaToOffset()andIsRvaValid().
- RvaToVa(RVA: int) → int¶
Converts a Relative Virtual Address (RVA) to a Virtual Address (VA).
- Parameters
RVA (int) – The RVA to convert.
- Returns
Returns the VA if successful; otherwise returns
Pro.Core.INVALID_STREAM_OFFSET.- Return type
int
See also
VaToRva()andOffsetToVa().
- ScopeTables(unw: Pro.Core.CFFStruct) → Pro.Core.CFFStruct¶
Retrieves the scope tables associated with a given Unwind Info structure.
- Parameters
unw (CFFStruct) – The Unwind Info structure.
- Returns
Returns the scope tables.
- Return type
See also
UnwindInfo()andExceptionDirectory().
- SectionData(i: int) → tuple¶
Retrieves the data of a specified section.
- Parameters
i (int) – The index of the section.
- Returns
Returns a tuple containing the data container, offset and size.
- Return type
tuple[NTContainer, int, int]
See also
SectionHeaders().
- SectionFromRva(RVA: int) → int¶
Determines the section index containing the specified RVA.
- Parameters
RVA (int) – The Relative Virtual Address.
- Returns
Returns the index of the section containing the RVA, or
INVALID_SECTIONif not found.- Return type
int
See also
IsRvaValid()andSectionHeaders().
- SectionHeaders() → Pro.Core.CFFStruct¶
- Returns
Returns the array of Section Headers.
- Return type
See also
SectionData()andSectionInfo().
- SectionInfo(i: int) → tuple¶
Retrieves information about a specified section.
- Parameters
i (int) – The index of the section.
- Returns
Returns a tuple containing a success flag, the file offset, and the size of the section.
- Return type
tuple[bool, int, int]
See also
SectionHeaders()andSectionData().
- TLSCallbacks() → Pro.Core.CFFStruct¶
- Returns
Returns the Thread Local Storage (TLS) callback functions.
- Return type
See also
TLSDirectory()andGetTLSData().
- TLSData() → tuple¶
Retrieves the offset and size of the TLS data.
- Returns
Returns a tuple containing the file offset and size of the TLS data.
- Return type
tuple[int, int]
See also
TLSDirectory()andGetTLSData().
- TLSDirectory() → Pro.Core.CFFStruct¶
- Returns
Returns the Thread Local Storage (TLS) Directory.
- Return type
See also
TLSCallbacks()andGetTLSData().
- UnwindInfo(runfunc: Pro.Core.CFFStruct) → Pro.Core.CFFStruct¶
Retrieves the Unwind Info for a given runtime function entry.
- Parameters
runfunc (CFFStruct) – The runtime function entry.
- Returns
Returns the Unwind Info.
- Return type
See also
ExceptionDirectory()andScopeTables().
- VaToOffset(VA: int) → int¶
Converts a Virtual Address (VA) to a file offset.
- Parameters
VA (int) – The VA to convert.
- Returns
Returns the offset if successful; otherwise returns
Pro.Core.INVALID_STREAM_OFFSET.- Return type
int
See also
OffsetToVa(),RvaToOffset()andVaToRva().
- VaToRva(VA: int) → int¶
Converts a Virtual Address (VA) to a Relative Virtual Address (RVA).
- Parameters
VA (int) – The VA to convert.
- Returns
Returns the RVA if successful; otherwise returns
Pro.Core.INVALID_STREAM_OFFSET.- Return type
int
See also
RvaToVa()andOffsetToRva().
- VersionInfo(offset: int) → Pro.Core.CFFStruct¶
Retrieves the Version Information resource at the specified offset.
- Parameters
offset (int) – The offset of the Version Information resource.
- Returns
Returns the Version Information.
- Return type
See also
DumpVersionInfo()andResourceDataEntry().
- class PEResourceIterator¶
Provides an iterator to traverse the resources in a PE file.
Methods:
Data()Returns the current Resource Data Entry.
IsNull()Returns
Trueif the iterator is invalid; otherwise returnsFalse.
IsValid()Returns
Trueif the iterator is valid; otherwise returnsFalse.
MoveToResource(name)Moves the iterator to a resource with the specified name or ID.
MoveToRoot(name)Moves the iterator to the root of the resource tree with the specified name or ID.
Name()Returns th name or ID of the resource.
Next()Advances the iterator to the next resource.
Reset()Resets the iterator to the initial position.
RootName()Returns th name or ID of the root resource.
- Data() → Pro.Core.CFFStruct¶
- Returns
Returns the current Resource Data Entry.
- Return type
See also
Name().
- IsNull() → bool¶
- Returns
Returns
Trueif the iterator is invalid; otherwise returnsFalse.- Return type
bool
See also
IsValid().
- IsValid() → bool¶
- Returns
Returns
Trueif the iterator is valid; otherwise returnsFalse.- Return type
bool
See also
IsNull().
- MoveToResource(name: Union[int, str]) → bool¶
Moves the iterator to a resource with the specified name or ID.
- Parameters
name (Union[int, str]) – The name or ID of the resource.
- Returns
Returns
Trueif the resource was found; otherwise returnsFalse.- Return type
bool
See also
MoveToRoot()andReset().
- MoveToRoot(name: Union[int, str]) → bool¶
Moves the iterator to the root of the resource tree with the specified name or ID.
- Parameters
name (Union[int, str]) – The name or ID of the root resource.
- Returns
Returns
Trueif the root resource was found; otherwise returnsFalse.- Return type
bool
See also
MoveToResource()andReset().
- Name() → Optional[Union[int, float, bool, bytes, str]]¶
- Returns
Returns th name or ID of the resource.
- Return type
BasicType
See also
RootName()andMoveToResource().
- Next() → bool¶
Advances the iterator to the next resource.
- Returns
Returns
Trueif successful; otherwise returnsFalse.- Return type
bool
See also
Reset().
- Reset() → None¶
Resets the iterator to the initial position.
See also
MoveToResource()andMoveToRoot().
- RootName() → Optional[Union[int, float, bool, bytes, str]]¶
- Returns
Returns th name or ID of the root resource.
- Return type
BasicType
See also
Name()andMoveToRoot().
- PE_VerifyAuthenticode(obj: Pro.PE.PEObject, options: int = 0) → bool¶
Verifies the Authenticode digital signature of a PE file.
- Parameters
obj (PEObject) – The PE file object.
options (int) – Verification options (reserved for future use).
- Returns
Returns
Trueif the signature is valid; otherwise returnsFalse.- Return type
bool
- ParamPtr_t: Final[int]¶
Represents the ParamPtr metadata table in .NET assemblies.
- ParamSig: Final[int]¶
Specifies the signature type for parameters.
- Param_t: Final[int]¶
Represents the Param metadata table in .NET assemblies.
- PropertyMap_t: Final[int]¶
Represents the PropertyMap metadata table in .NET assemblies.
- PropertyPtr_t: Final[int]¶
Represents the PropertyPtr metadata table in .NET assemblies.
- PropertySig: Final[int]¶
Specifies the signature type for properties.
- Property_t: Final[int]¶
Represents the Property metadata table in .NET assemblies.
- RES_TYPE_ACCELERATORS: Final[int]¶
Specifies an accelerator table resource.
- RES_TYPE_BITMAPS: Final[int]¶
Specifies a bitmap resource.
- RES_TYPE_CONFIGURATION_FILES: Final[int]¶
Specifies a configuration file resource.
- RES_TYPE_CURSORS: Final[int]¶
Specifies a cursor resource.
- RES_TYPE_CURSOR_GROUPS: Final[int]¶
Specifies a cursor group resource.
- RES_TYPE_DIALOGS: Final[int]¶
Specifies a dialog resource.
- RES_TYPE_FONTS: Final[int]¶
Specifies a font resource.
- RES_TYPE_FONT_DIRECTORY: Final[int]¶
Specifies a font directory resource.
- RES_TYPE_HTML_PAGES: Final[int]¶
Specifies an HTML page resource.
- RES_TYPE_ICONS: Final[int]¶
Specifies an icon resource.
- RES_TYPE_ICON_GROUPS: Final[int]¶
Specifies an icon group resource.
- RES_TYPE_MENUS: Final[int]¶
Specifies a menu resource.
- RES_TYPE_MESSAGE_TABLES: Final[int]¶
Specifies a message table resource.
- RES_TYPE_RCDATA: Final[int]¶
Specifies application-defined resource data.
- RES_TYPE_STRING_TABLES: Final[int]¶
Specifies a string table resource.
- RES_TYPE_VERSION_INFO: Final[int]¶
Specifies a version information resource.
- RetTypeSig: Final[int]¶
Specifies the signature type for return types.
- StandAloneMethodSig: Final[int]¶
Specifies the signature type for stand-alone methods.
- StandAloneSig_t: Final[int]¶
Represents the StandAloneSig metadata table in .NET assemblies.
- TypeDef_t: Final[int]¶
Represents the TypeDef metadata table in .NET assemblies.
- TypeRef_t: Final[int]¶
Represents the TypeRef metadata table in .NET assemblies.
- TypeSpecSig: Final[int]¶
Specifies the signature type for type specifications.
- TypeSpec_t: Final[int]¶
Represents the TypeSpec metadata table in .NET assemblies.
- UNW_FLAG_CHAININFO: Final[int]¶
Indicates that chained unwind information is present.
- UNW_FLAG_EHANDLER: Final[int]¶
Indicates that an exception handler is present.
- UNW_FLAG_UHANDLER: Final[int]¶
Indicates that a termination handler is present.
- WIN_CERT_TYPE_PKCS_SIGNED_DATA: Final[int]¶
Specifies a PKCS#7 SignedData structure.
- WIN_CERT_TYPE_X509: Final[int]¶
Specifies an X.509 certificate.
- afDisableJITcompileOptimizer: Final[int]¶
Indicates that the JIT compiler optimizer is disabled.
- afEnableJITcompileTracking: Final[int]¶
Indicates that JIT compiler tracking is enabled.
- afPA_AMD64: Final[int]¶
Specifies the AMD64 processor architecture.
- afPA_FullMask: Final[int]¶
Mask for the full processor architecture.
- afPA_IA64: Final[int]¶
Specifies the IA64 processor architecture.
- afPA_MSIL: Final[int]¶
Specifies that the assembly contains MSIL code only.
- afPA_Mask: Final[int]¶
Mask for the processor architecture.
- afPA_None: Final[int]¶
Specifies no processor architecture.
- afPA_Shift: Final[int]¶
Shift count for the processor architecture flags.
- afPA_Specified: Final[int]¶
Indicates that a processor architecture is specified.
- afPA_x86: Final[int]¶
Specifies the x86 processor architecture.
- afPublicKey: Final[int]¶
Indicates that the assembly has a public key.
- afRetargetable: Final[int]¶
Indicates that the assembly can be retargeted.
- evRTSpecialName: Final[int]¶
Indicates a runtime special name event.
- evReservedMask: Final[int]¶
Mask reserved for event attributes.
- evSpecialName: Final[int]¶
Indicates a special name event.
- fdAssembly: Final[int]¶
Specifies that the field is accessible by any code in the same assembly.
- fdFamANDAssem: Final[int]¶
Specifies that the field is accessible only by derived classes in the same assembly.
- fdFamORAssem: Final[int]¶
Specifies that the field is accessible by derived classes and by code in the same assembly.
- fdFamily: Final[int]¶
Specifies that the field is accessible only by derived classes.
- fdFieldAccessMask: Final[int]¶
Mask used to retrieve field accessibility information.
- fdHasDefault: Final[int]¶
Specifies that the field has a default value.
- fdHasFieldMarshal: Final[int]¶
Specifies that the field has marshaling information.
- fdHasFieldRVA: Final[int]¶
Specifies that the field has an associated relative virtual address (RVA).
- fdInitOnly: Final[int]¶
Specifies that the field is initialized only and cannot be changed after initialization (read-only).
- fdLiteral: Final[int]¶
Specifies that the field’s value is a compile-time constant.
- fdNotSerialized: Final[int]¶
Specifies that the field is not serialized when the type is remoted.
- fdPinvokeImpl: Final[int]¶
Specifies that the field is implemented using PInvoke (Platform Invocation Services).
- fdPrivate: Final[int]¶
Specifies that the field is accessible only within its declaring type.
- fdPrivateScope: Final[int]¶
Specifies that the field is not referenceable.
- fdPublic: Final[int]¶
Specifies that the field is accessible by any code that has access to the declaring type.
- fdRTSpecialName: Final[int]¶
Specifies that the field name is special and the runtime should check its encoding.
- fdReservedMask: Final[int]¶
Mask reserved for runtime use.
- fdSpecialName: Final[int]¶
Specifies that the field is special, and its name describes how.
- fdStatic: Final[int]¶
Specifies that the field is static.
- ffContainsMetaData: Final[int]¶
Indicates that the file contains metadata.
- ffContainsNoMetaData: Final[int]¶
Indicates that the file does not contain metadata (e.g., a resource file).
- gpContravariant: Final[int]¶
Specifies that the generic parameter is contravariant.
- gpCovariant: Final[int]¶
Specifies that the generic parameter is covariant.
- gpDefaultConstructorConstraint: Final[int]¶
Specifies that the generic parameter must have a default constructor.
- gpNoSpecialConstraint: Final[int]¶
Specifies that there are no special constraints on the generic parameter.
- gpNonVariant: Final[int]¶
Specifies that the generic parameter is non-variant.
- gpNotNullableValueTypeConstraint: Final[int]¶
Specifies that the generic parameter must be a non-nullable value type.
- gpReferenceTypeConstraint: Final[int]¶
Specifies that the generic parameter must be a reference type.
- gpSpecialConstraintMask: Final[int]¶
Mask used to retrieve special constraints on the generic parameter.
- gpVarianceMask: Final[int]¶
Mask used to retrieve variance information on the generic parameter.
- mdAbstract: Final[int]¶
Specifies that the method is abstract.
- mdAssem: Final[int]¶
Specifies that the method is accessible to any code in the same assembly.
- mdCheckAccessOnOverride: Final[int]¶
Indicates that the runtime should check access restrictions when overriding the method.
- mdFamANDAssem: Final[int]¶
Specifies that the method is accessible only by derived classes in the same assembly.
- mdFamORAssem: Final[int]¶
Specifies that the method is accessible by derived classes and by code in the same assembly.
- mdFamily: Final[int]¶
Specifies that the method is accessible only by derived classes.
- mdFinal: Final[int]¶
Specifies that the method cannot be overridden.
- mdHasSecurity: Final[int]¶
Specifies that the method has security attributes associated with it.
- mdHideBySig: Final[int]¶
Indicates that the method hides by signature rather than by name.
- mdMemberAccessMask: Final[int]¶
Mask used to retrieve method accessibility information.
- mdNewSlot: Final[int]¶
Specifies that the method always gets a new slot in the virtual method table.
- mdPinvokeImpl: Final[int]¶
Specifies that the method is implemented using PInvoke (Platform Invocation Services).
- mdPrivate: Final[int]¶
Specifies that the method is accessible only within its declaring type.
- mdPrivateScope: Final[int]¶
Specifies that the method cannot be referenced.
- mdPublic: Final[int]¶
Specifies that the method is accessible by any code that has access to the declaring type.
- mdRTSpecialName: Final[int]¶
Specifies that the method name is special and the runtime should check its encoding.
- mdRequireSecObject: Final[int]¶
Specifies that the method calls another method containing security code.
- mdReservedMask: Final[int]¶
Mask reserved for runtime use.
- mdReuseSlot: Final[int]¶
Specifies that the method reuses an existing slot in the virtual method table.
- mdSpecialName: Final[int]¶
Specifies that the method is special, and its name describes how.
- mdStatic: Final[int]¶
Specifies that the method is static.
- mdUnmanagedExport: Final[int]¶
Specifies that the method is exported to unmanaged code.
- mdVirtual: Final[int]¶
Specifies that the method is virtual.
- mdVtableLayoutMask: Final[int]¶
Mask used to retrieve method virtual table layout information.
- miCodeTypeMask: Final[int]¶
Mask used to retrieve method code type information.
- miForwardRef: Final[int]¶
Specifies that the method is not defined and should be looked up at runtime.
- miIL: Final[int]¶
Specifies that the method implementation is in Microsoft Intermediate Language (MSIL).
- miInternalCall: Final[int]¶
Specifies that the method is an internal call.
- miManaged: Final[int]¶
Specifies that the method is implemented in managed code.
- miManagedMask: Final[int]¶
Mask used to retrieve method managed/unmanaged information.
- miMaxMethodImplVal: Final[int]¶
Maximum valid value for method implementation attributes.
- miNative: Final[int]¶
Specifies that the method implementation is native.
- miNoInlining: Final[int]¶
Specifies that the method should not be inlined.
- miOPTIL: Final[int]¶
Specifies that the method implementation is in optimized IL.
- miPreserveSig: Final[int]¶
Specifies that the method signature is exported exactly as declared.
- miRuntime: Final[int]¶
Specifies that the method implementation is provided by the runtime.
- miSynchronized: Final[int]¶
Specifies that the method is single-threaded through the body.
- miUnmanaged: Final[int]¶
Specifies that the method is implemented in unmanaged code.
- mrPrivate: Final[int]¶
Specifies that the manifest resource is private to the assembly.
- mrPublic: Final[int]¶
Specifies that the manifest resource is exported from the assembly.
- mrVisibilityMask: Final[int]¶
Mask used to retrieve manifest resource visibility information.
- msAddOn: Final[int]¶
Specifies that the method adds an event handler.
- msFire: Final[int]¶
Specifies that the method raises an event.
- msGetter: Final[int]¶
Specifies that the method gets a property value.
- msOther: Final[int]¶
Specifies that the method is associated in some other way with a property or event.
- msRemoveOn: Final[int]¶
Specifies that the method removes an event handler.
- msSetter: Final[int]¶
Specifies that the method sets a property value.
- pdHasDefault: Final[int]¶
Specifies that the parameter has a default value.
- pdHasFieldMarshal: Final[int]¶
Specifies that the parameter has marshaling information.
- pdIn: Final[int]¶
Specifies that the parameter is an input parameter.
- pdOptional: Final[int]¶
Specifies that the parameter is optional.
- pdOut: Final[int]¶
Specifies that the parameter is an output parameter.
- pdReservedMask: Final[int]¶
Mask reserved for runtime use.
- pdUnused: Final[int]¶
Unused parameter attributes.
- pmBestFitDisabled: Final[int]¶
Specifies that best-fit mapping behavior is disabled.
- pmBestFitEnabled: Final[int]¶
Specifies that best-fit mapping behavior is enabled.
- pmBestFitMask: Final[int]¶
Mask used to retrieve best-fit mapping information.
- pmBestFitUseAssem: Final[int]¶
Specifies that best-fit mapping behavior is taken from the containing assembly.
- pmCallConvCdecl: Final[int]¶
Specifies the Cdecl calling convention.
- pmCallConvFastcall: Final[int]¶
Specifies the Fastcall calling convention.
- pmCallConvMask: Final[int]¶
Mask used to retrieve calling convention information.
- pmCallConvStdcall: Final[int]¶
Specifies the Stdcall calling convention.
- pmCallConvThiscall: Final[int]¶
Specifies the Thiscall calling convention.
- pmCallConvWinapi: Final[int]¶
Specifies the default platform calling convention.
- pmCharSetAnsi: Final[int]¶
Specifies that strings are marshaled as ANSI.
- pmCharSetAuto: Final[int]¶
Automatically marshals strings appropriately for the target operating system.
- pmCharSetMask: Final[int]¶
Mask used to retrieve character set information.
- pmCharSetNotSpec: Final[int]¶
Specifies that no character set is specified.
- pmCharSetUnicode: Final[int]¶
Specifies that strings are marshaled as Unicode.
- pmMaxValue: Final[int]¶
Maximum valid value for PInvoke attributes.
- pmNoMangle: Final[int]¶
Specifies that the method name is exported exactly as it appears.
- pmSupportsLastError: Final[int]¶
Indicates that the callee will call SetLastError and the runtime should retrieve the error code after the call.
- pmThrowOnUnmappableCharDisabled: Final[int]¶
Specifies that an exception should not be thrown on an unmappable Unicode character.
- pmThrowOnUnmappableCharEnabled: Final[int]¶
Specifies that an exception should be thrown on an unmappable Unicode character.
- pmThrowOnUnmappableCharMask: Final[int]¶
Mask used to retrieve throw-on-unmappable-char information.
- pmThrowOnUnmappableCharUseAssem: Final[int]¶
Specifies that throw-on-unmappable-char behavior is taken from the containing assembly.
- prHasDefault: Final[int]¶
Specifies that the property has a default value.
- prRTSpecialName: Final[int]¶
Specifies that the property name is special and the runtime should check its encoding.
- prReservedMask: Final[int]¶
Mask reserved for runtime use.
- prSpecialName: Final[int]¶
Specifies that the property is special, and its name describes how.
- prUnused: Final[int]¶
Unused property attributes.
- tdAbstract: Final[int]¶
Specifies that the type is abstract.
- tdAnsiClass: Final[int]¶
Specifies that the type string format is ANSI.
- tdAutoClass: Final[int]¶
Specifies that the type string format is auto.
- tdAutoLayout: Final[int]¶
Specifies that the fields of the type are laid out automatically.
- tdBeforeFieldInit: Final[int]¶
Specifies that type initialization is deferred until first use.
- tdClass: Final[int]¶
Specifies that the type is a class.
- tdClassSemanticsMask: Final[int]¶
Mask used to retrieve class semantics information.
- tdCustomFormatClass: Final[int]¶
Specifies that the type string format is custom.
- tdCustomFormatMask: Final[int]¶
Mask used to retrieve custom string format information.
- tdExplicitLayout: Final[int]¶
Specifies that the fields of the type are laid out explicitly.
- tdForwarder: Final[int]¶
Specifies that the type is a type forwarder.
- tdHasSecurity: Final[int]¶
Specifies that the type has security attributes associated with it.
- tdImport: Final[int]¶
Specifies that the type is imported.
- tdInterface: Final[int]¶
Specifies that the type is an interface.
- tdLayoutMask: Final[int]¶
Mask used to retrieve type layout information.
- tdNestedAssembly: Final[int]¶
Specifies that the type is nested and visible only within its assembly.
- tdNestedFamANDAssem: Final[int]¶
Specifies that the type is nested and visible only to types that are both in the same assembly and derived from the declaring type.
- tdNestedFamORAssem: Final[int]¶
Specifies that the type is nested and visible to derived types and types in the same assembly.
- tdNestedFamily: Final[int]¶
Specifies that the type is nested and visible only to derived types.
- tdNestedPrivate: Final[int]¶
Specifies that the type is nested and visible only within its declaring type.
- tdNestedPublic: Final[int]¶
Specifies that the type is nested and publicly visible.
- tdNotPublic: Final[int]¶
Specifies that the type is not publicly visible.
- tdPublic: Final[int]¶
Specifies that the type is publicly visible.
- tdRTSpecialName: Final[int]¶
Specifies that the type name is special and the runtime should check its encoding.
- tdReservedMask: Final[int]¶
Mask reserved for runtime use.
- tdSealed: Final[int]¶
Specifies that the type is sealed and cannot be inherited.
- tdSequentialLayout: Final[int]¶
Specifies that the fields of the type are laid out sequentially in the order in which they appear.
- tdSerializable: Final[int]¶
Specifies that the type is serializable.
- tdSpecialName: Final[int]¶
Specifies that the type is special, and its name describes how.
- tdStringFormatMask: Final[int]¶
Mask used to retrieve string format information.
- tdUnicodeClass: Final[int]¶
Specifies that the type string format is Unicode.
- tdVisibilityMask: Final[int]¶
Mask used to retrieve type visibility information.