namespace X86Disassembler.PE { /// /// Represents a section header in a PE file /// public class SectionHeader { // Section characteristics flags private const uint IMAGE_SCN_CNT_CODE = 0x00000020; // Section contains code private const uint IMAGE_SCN_MEM_EXECUTE = 0x20000000; // Section is executable private const uint IMAGE_SCN_MEM_READ = 0x40000000; // Section is readable private const uint IMAGE_SCN_MEM_WRITE = 0x80000000; // Section is writable public string Name; // Section name public uint VirtualSize; // Virtual size public uint VirtualAddress; // Virtual address public uint SizeOfRawData; // Size of raw data public uint PointerToRawData; // Pointer to raw data public uint PointerToRelocations; // Pointer to relocations public uint PointerToLinenumbers; // Pointer to line numbers public ushort NumberOfRelocations; // Number of relocations public ushort NumberOfLinenumbers; // Number of line numbers public uint Characteristics; // Characteristics /// /// Checks if the section contains code /// /// True if the section contains code, false otherwise public bool ContainsCode() { return (Characteristics & IMAGE_SCN_CNT_CODE) != 0 || (Characteristics & IMAGE_SCN_MEM_EXECUTE) != 0; } /// /// Checks if the section is readable /// /// True if the section is readable, false otherwise public bool IsReadable() { return (Characteristics & IMAGE_SCN_MEM_READ) != 0; } /// /// Checks if the section is writable /// /// True if the section is writable, false otherwise public bool IsWritable() { return (Characteristics & IMAGE_SCN_MEM_WRITE) != 0; } /// /// Checks if the section is executable /// /// True if the section is executable, false otherwise public bool IsExecutable() { return (Characteristics & IMAGE_SCN_MEM_EXECUTE) != 0; } } }