Skip to content

Instantly share code, notes, and snippets.

@MircoBabin

MircoBabin/ReadingPortableExecutable_PE_header.cs

Forked from augustoproiete/ReadingPortableExecutable_PE_header.cs
Last active June 3, 2021 13:02
Show Gist options
  • Save MircoBabin/c6be4c0295f038bfeb4abb19b0774bb1 to your computer and use it in GitHub Desktop.
Save MircoBabin/c6be4c0295f038bfeb4abb19b0774bb1 to your computer and use it in GitHub Desktop.
Download ZIP
Reading the Portable Executable (PE) header in C# - reading Import Directory Table to e.g. determine Microsoft VC Runtime version
Raw
ReadingPortableExecutable_PE_header.cs
using System;
using System.Collections.Generic;
using System.IO;
using System.Runtime.InteropServices;
using System.Text;
namespace peheader
{
//https://gist.github.com/caioproiete/b51f29f74f5f5b2c59c39e47a8afc3a3
/// <summary>
/// Reads in the header information of the Portable Executable format.
/// Provides information such as the date the assembly was compiled.
/// </summary>
public class PeHeaderReader
{
#region File Header Structures
public struct IMAGE_DOS_HEADER
{ // DOS .EXE header
public UInt16 e_magic; // Magic number
public UInt16 e_cblp; // Bytes on last page of file
public UInt16 e_cp; // Pages in file
public UInt16 e_crlc; // Relocations
public UInt16 e_cparhdr; // Size of header in paragraphs
public UInt16 e_minalloc; // Minimum extra paragraphs needed
public UInt16 e_maxalloc; // Maximum extra paragraphs needed
public UInt16 e_ss; // Initial (relative) SS value
public UInt16 e_sp; // Initial SP value
public UInt16 e_csum; // Checksum
public UInt16 e_ip; // Initial IP value
public UInt16 e_cs; // Initial (relative) CS value
public UInt16 e_lfarlc; // File address of relocation table
public UInt16 e_ovno; // Overlay number
public UInt16 e_res_0; // Reserved words
public UInt16 e_res_1; // Reserved words
public UInt16 e_res_2; // Reserved words
public UInt16 e_res_3; // Reserved words
public UInt16 e_oemid; // OEM identifier (for e_oeminfo)
public UInt16 e_oeminfo; // OEM information; e_oemid specific
public UInt16 e_res2_0; // Reserved words
public UInt16 e_res2_1; // Reserved words
public UInt16 e_res2_2; // Reserved words
public UInt16 e_res2_3; // Reserved words
public UInt16 e_res2_4; // Reserved words
public UInt16 e_res2_5; // Reserved words
public UInt16 e_res2_6; // Reserved words
public UInt16 e_res2_7; // Reserved words
public UInt16 e_res2_8; // Reserved words
public UInt16 e_res2_9; // Reserved words
public UInt32 e_lfanew; // File address of new exe header
}
[StructLayout(LayoutKind.Sequential)]
public struct IMAGE_DATA_DIRECTORY
{
public UInt32 VirtualAddress;
public UInt32 Size;
}
[StructLayout(LayoutKind.Sequential, Pack = 1)]
public struct IMAGE_OPTIONAL_HEADER32
{
public UInt16 Magic;
public Byte MajorLinkerVersion;
public Byte MinorLinkerVersion;
public UInt32 SizeOfCode;
public UInt32 SizeOfInitializedData;
public UInt32 SizeOfUninitializedData;
public UInt32 AddressOfEntryPoint;
public UInt32 BaseOfCode;
public UInt32 BaseOfData;
public UInt32 ImageBase;
public UInt32 SectionAlignment;
public UInt32 FileAlignment;
public UInt16 MajorOperatingSystemVersion;
public UInt16 MinorOperatingSystemVersion;
public UInt16 MajorImageVersion;
public UInt16 MinorImageVersion;
public UInt16 MajorSubsystemVersion;
public UInt16 MinorSubsystemVersion;
public UInt32 Win32VersionValue;
public UInt32 SizeOfImage;
public UInt32 SizeOfHeaders;
public UInt32 CheckSum;
public UInt16 Subsystem;
public UInt16 DllCharacteristics;
public UInt32 SizeOfStackReserve;
public UInt32 SizeOfStackCommit;
public UInt32 SizeOfHeapReserve;
public UInt32 SizeOfHeapCommit;
public UInt32 LoaderFlags;
public UInt32 NumberOfRvaAndSizes;
public IMAGE_DATA_DIRECTORY ExportTable;
public IMAGE_DATA_DIRECTORY ImportTable;
public IMAGE_DATA_DIRECTORY ResourceTable;
public IMAGE_DATA_DIRECTORY ExceptionTable;
public IMAGE_DATA_DIRECTORY CertificateTable;
public IMAGE_DATA_DIRECTORY BaseRelocationTable;
public IMAGE_DATA_DIRECTORY Debug;
public IMAGE_DATA_DIRECTORY Architecture;
public IMAGE_DATA_DIRECTORY GlobalPtr;
public IMAGE_DATA_DIRECTORY TLSTable;
public IMAGE_DATA_DIRECTORY LoadConfigTable;
public IMAGE_DATA_DIRECTORY BoundImport;
public IMAGE_DATA_DIRECTORY IAT;
public IMAGE_DATA_DIRECTORY DelayImportDescriptor;
public IMAGE_DATA_DIRECTORY CLRRuntimeHeader;
public IMAGE_DATA_DIRECTORY Reserved;
}
[StructLayout(LayoutKind.Sequential, Pack = 1)]
public struct IMAGE_OPTIONAL_HEADER64
{
public UInt16 Magic;
public Byte MajorLinkerVersion;
public Byte MinorLinkerVersion;
public UInt32 SizeOfCode;
public UInt32 SizeOfInitializedData;
public UInt32 SizeOfUninitializedData;
public UInt32 AddressOfEntryPoint;
public UInt32 BaseOfCode;
public UInt64 ImageBase;
public UInt32 SectionAlignment;
public UInt32 FileAlignment;
public UInt16 MajorOperatingSystemVersion;
public UInt16 MinorOperatingSystemVersion;
public UInt16 MajorImageVersion;
public UInt16 MinorImageVersion;
public UInt16 MajorSubsystemVersion;
public UInt16 MinorSubsystemVersion;
public UInt32 Win32VersionValue;
public UInt32 SizeOfImage;
public UInt32 SizeOfHeaders;
public UInt32 CheckSum;
public UInt16 Subsystem;
public UInt16 DllCharacteristics;
public UInt64 SizeOfStackReserve;
public UInt64 SizeOfStackCommit;
public UInt64 SizeOfHeapReserve;
public UInt64 SizeOfHeapCommit;
public UInt32 LoaderFlags;
public UInt32 NumberOfRvaAndSizes;
public IMAGE_DATA_DIRECTORY ExportTable;
public IMAGE_DATA_DIRECTORY ImportTable;
public IMAGE_DATA_DIRECTORY ResourceTable;
public IMAGE_DATA_DIRECTORY ExceptionTable;
public IMAGE_DATA_DIRECTORY CertificateTable;
public IMAGE_DATA_DIRECTORY BaseRelocationTable;
public IMAGE_DATA_DIRECTORY Debug;
public IMAGE_DATA_DIRECTORY Architecture;
public IMAGE_DATA_DIRECTORY GlobalPtr;
public IMAGE_DATA_DIRECTORY TLSTable;
public IMAGE_DATA_DIRECTORY LoadConfigTable;
public IMAGE_DATA_DIRECTORY BoundImport;
public IMAGE_DATA_DIRECTORY IAT;
public IMAGE_DATA_DIRECTORY DelayImportDescriptor;
public IMAGE_DATA_DIRECTORY CLRRuntimeHeader;
public IMAGE_DATA_DIRECTORY Reserved;
}
[StructLayout(LayoutKind.Sequential, Pack = 1)]
public struct IMAGE_FILE_HEADER
{
public UInt16 Machine;
public UInt16 NumberOfSections;
public UInt32 TimeDateStamp;
public UInt32 PointerToSymbolTable;
public UInt32 NumberOfSymbols;
public UInt16 SizeOfOptionalHeader;
public UInt16 Characteristics;
}
// Grabbed the following 2 definitions from http://www.pinvoke.net/default.aspx/Structures/IMAGE_SECTION_HEADER.html
[StructLayout(LayoutKind.Explicit)]
public struct IMAGE_SECTION_HEADER
{
[FieldOffset(0)]
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)]
public char[] Name;
[FieldOffset(8)]
public UInt32 VirtualSize;
[FieldOffset(12)]
public UInt32 VirtualAddress;
[FieldOffset(16)]
public UInt32 SizeOfRawData;
[FieldOffset(20)]
public UInt32 PointerToRawData;
[FieldOffset(24)]
public UInt32 PointerToRelocations;
[FieldOffset(28)]
public UInt32 PointerToLinenumbers;
[FieldOffset(32)]
public UInt16 NumberOfRelocations;
[FieldOffset(34)]
public UInt16 NumberOfLinenumbers;
[FieldOffset(36)]
public DataSectionFlags Characteristics;
public string Section
{
get { return new string(Name); }
}
}
[Flags]
public enum DataSectionFlags : uint
{
/// <summary>
/// Reserved for future use.
/// </summary>
TypeReg = 0x00000000,
/// <summary>
/// Reserved for future use.
/// </summary>
TypeDsect = 0x00000001,
/// <summary>
/// Reserved for future use.
/// </summary>
TypeNoLoad = 0x00000002,
/// <summary>
/// Reserved for future use.
/// </summary>
TypeGroup = 0x00000004,
/// <summary>
/// The section should not be padded to the next boundary. This flag is obsolete and is replaced by IMAGE_SCN_ALIGN_1BYTES. This is valid only for object files.
/// </summary>
TypeNoPadded = 0x00000008,
/// <summary>
/// Reserved for future use.
/// </summary>
TypeCopy = 0x00000010,
/// <summary>
/// The section contains executable code.
/// </summary>
ContentCode = 0x00000020,
/// <summary>
/// The section contains initialized data.
/// </summary>
ContentInitializedData = 0x00000040,
/// <summary>
/// The section contains uninitialized data.
/// </summary>
ContentUninitializedData = 0x00000080,
/// <summary>
/// Reserved for future use.
/// </summary>
LinkOther = 0x00000100,
/// <summary>
/// The section contains comments or other information. The .drectve section has this type. This is valid for object files only.
/// </summary>
LinkInfo = 0x00000200,
/// <summary>
/// Reserved for future use.
/// </summary>
TypeOver = 0x00000400,
/// <summary>
/// The section will not become part of the image. This is valid only for object files.
/// </summary>
LinkRemove = 0x00000800,
/// <summary>
/// The section contains COMDAT data. For more information, see section 5.5.6, COMDAT Sections (Object Only). This is valid only for object files.
/// </summary>
LinkComDat = 0x00001000,
/// <summary>
/// Reset speculative exceptions handling bits in the TLB entries for this section.
/// </summary>
NoDeferSpecExceptions = 0x00004000,
/// <summary>
/// The section contains data referenced through the global pointer (GP).
/// </summary>
RelativeGP = 0x00008000,
/// <summary>
/// Reserved for future use.
/// </summary>
MemPurgeable = 0x00020000,
/// <summary>
/// Reserved for future use.
/// </summary>
Memory16Bit = 0x00020000,
/// <summary>
/// Reserved for future use.
/// </summary>
MemoryLocked = 0x00040000,
/// <summary>
/// Reserved for future use.
/// </summary>
MemoryPreload = 0x00080000,
/// <summary>
/// Align data on a 1-byte boundary. Valid only for object files.
/// </summary>
Align1Bytes = 0x00100000,
/// <summary>
/// Align data on a 2-byte boundary. Valid only for object files.
/// </summary>
Align2Bytes = 0x00200000,
/// <summary>
/// Align data on a 4-byte boundary. Valid only for object files.
/// </summary>
Align4Bytes = 0x00300000,
/// <summary>
/// Align data on an 8-byte boundary. Valid only for object files.
/// </summary>
Align8Bytes = 0x00400000,
/// <summary>
/// Align data on a 16-byte boundary. Valid only for object files.
/// </summary>
Align16Bytes = 0x00500000,
/// <summary>
/// Align data on a 32-byte boundary. Valid only for object files.
/// </summary>
Align32Bytes = 0x00600000,
/// <summary>
/// Align data on a 64-byte boundary. Valid only for object files.
/// </summary>
Align64Bytes = 0x00700000,
/// <summary>
/// Align data on a 128-byte boundary. Valid only for object files.
/// </summary>
Align128Bytes = 0x00800000,
/// <summary>
/// Align data on a 256-byte boundary. Valid only for object files.
/// </summary>
Align256Bytes = 0x00900000,
/// <summary>
/// Align data on a 512-byte boundary. Valid only for object files.
/// </summary>
Align512Bytes = 0x00A00000,
/// <summary>
/// Align data on a 1024-byte boundary. Valid only for object files.
/// </summary>
Align1024Bytes = 0x00B00000,
/// <summary>
/// Align data on a 2048-byte boundary. Valid only for object files.
/// </summary>
Align2048Bytes = 0x00C00000,
/// <summary>
/// Align data on a 4096-byte boundary. Valid only for object files.
/// </summary>
Align4096Bytes = 0x00D00000,
/// <summary>
/// Align data on an 8192-byte boundary. Valid only for object files.
/// </summary>
Align8192Bytes = 0x00E00000,
/// <summary>
/// The section contains extended relocations.
/// </summary>
LinkExtendedRelocationOverflow = 0x01000000,
/// <summary>
/// The section can be discarded as needed.
/// </summary>
MemoryDiscardable = 0x02000000,
/// <summary>
/// The section cannot be cached.
/// </summary>
MemoryNotCached = 0x04000000,
/// <summary>
/// The section is not pageable.
/// </summary>
MemoryNotPaged = 0x08000000,
/// <summary>
/// The section can be shared in memory.
/// </summary>
MemoryShared = 0x10000000,
/// <summary>
/// The section can be executed as code.
/// </summary>
MemoryExecute = 0x20000000,
/// <summary>
/// The section can be read.
/// </summary>
MemoryRead = 0x40000000,
/// <summary>
/// The section can be written to.
/// </summary>
MemoryWrite = 0x80000000
}
#endregion File Header Structures
#region Private Fields
/// <summary>
/// The DOS header
/// </summary>
private IMAGE_DOS_HEADER dosHeader;
/// <summary>
/// The file header
/// </summary>
private IMAGE_FILE_HEADER fileHeader;
/// <summary>
/// Optional 32 bit file header
/// </summary>
private IMAGE_OPTIONAL_HEADER32 optionalHeader32;
/// <summary>
/// Optional 64 bit file header
/// </summary>
private IMAGE_OPTIONAL_HEADER64 optionalHeader64;
/// <summary>
/// Image Section headers. Number of sections is in the file header.
/// </summary>
private IMAGE_SECTION_HEADER[] imageSectionHeaders;
#endregion Private Fields
#region Public Methods
public PeHeaderReader(string filePath)
{
// Read in the DLL or EXE and get the timestamp
using (FileStream stream = new FileStream(filePath, System.IO.FileMode.Open, System.IO.FileAccess.Read))
{
BinaryReader reader = new BinaryReader(stream);
dosHeader = FromBinaryReader<IMAGE_DOS_HEADER>(reader);
// Add 4 bytes to the offset
stream.Seek(dosHeader.e_lfanew, SeekOrigin.Begin);
UInt32 ntHeadersSignature = reader.ReadUInt32();
fileHeader = FromBinaryReader<IMAGE_FILE_HEADER>(reader);
if (this.Is32BitHeader)
{
optionalHeader32 = FromBinaryReader<IMAGE_OPTIONAL_HEADER32>(reader);
}
else
{
optionalHeader64 = FromBinaryReader<IMAGE_OPTIONAL_HEADER64>(reader);
}
imageSectionHeaders = new IMAGE_SECTION_HEADER[fileHeader.NumberOfSections];
for (int headerNo = 0; headerNo < imageSectionHeaders.Length; ++headerNo)
{
imageSectionHeaders[headerNo] = FromBinaryReader<IMAGE_SECTION_HEADER>(reader);
}
//ImportTable
ImportTableNames.Clear();
IMAGE_DATA_DIRECTORY ImportTable = (Is32BitHeader ? optionalHeader32.ImportTable : optionalHeader64.ImportTable);
if (ImportTable.VirtualAddress != 0)
{
try
{
IMAGE_SECTION_HEADER ImportTableSection = DataToSection(ImportTable);
stream.Seek(RVAtoFileOffset(ImportTableSection, ImportTable.VirtualAddress), SeekOrigin.Begin);
List<IMAGE_IMPORT_DIRECTORY_TABLE> items = new List<IMAGE_IMPORT_DIRECTORY_TABLE>();
while (true)
{
IMAGE_IMPORT_DIRECTORY_TABLE item = FromBinaryReader<IMAGE_IMPORT_DIRECTORY_TABLE>(reader);
if (item.ImportLookupTableRVA == 0) break;
items.Add(item);
}
foreach (var item in items)
{
stream.Seek(RVAtoFileOffset(ImportTableSection, item.NameRVA), SeekOrigin.Begin);
byte[] name = new byte[0];
while (true)
{
byte b = FromBinaryReader<byte>(reader);
if (b == 0) break;
byte[] newname = new byte[name.Length + 1];
name.CopyTo(newname, 0);
newname[name.Length] = b;
name = newname;
}
ImportTableNames.Add(Encoding.ASCII.GetString(name));
}
}
catch { }
}
}
}
/// <summary>
/// Gets the header of the .NET assembly that called this function
/// </summary>
/// <returns></returns>
public static PeHeaderReader GetCallingAssemblyHeader()
{
// Get the path to the calling assembly, which is the path to the
// DLL or EXE that we want the time of
string filePath = System.Reflection.Assembly.GetCallingAssembly().Location;
// Get and return the timestamp
return new PeHeaderReader(filePath);
}
/// <summary>
/// Gets the header of the .NET assembly that called this function
/// </summary>
/// <returns></returns>
public static PeHeaderReader GetAssemblyHeader()
{
// Get the path to the calling assembly, which is the path to the
// DLL or EXE that we want the time of
string filePath = System.Reflection.Assembly.GetAssembly(typeof(PeHeaderReader)).Location;
// Get and return the timestamp
return new PeHeaderReader(filePath);
}
public IMAGE_SECTION_HEADER DataToSection(IMAGE_DATA_DIRECTORY data)
{
foreach (var section in imageSectionHeaders)
{
if (data.VirtualAddress >= section.VirtualAddress && data.VirtualAddress < section.VirtualAddress + section.VirtualSize) return section;
}
throw new Exception("Section not found");
}
public static UInt32 RVAtoFileOffset(IMAGE_SECTION_HEADER section, UInt32 RVA)
{
//offset = imageBase + text.RawOffset + (importDirectory.RVA−text.VA)
return 0 + section.PointerToRawData + (RVA - section.VirtualAddress);
}
/// <summary>
/// Reads in a block from a file and converts it to the struct
/// type specified by the template parameter
/// </summary>
/// <typeparam name="T"></typeparam>
/// <param name="reader"></param>
/// <returns></returns>
public static T FromBinaryReader<T>(BinaryReader reader)
{
T theStructure;
// Read in a byte array
byte[] bytes = reader.ReadBytes(Marshal.SizeOf(typeof(T)));
// Pin the managed memory while, copy it out the data, then unpin it
GCHandle handle = GCHandle.Alloc(bytes, GCHandleType.Pinned);
try
{
theStructure = (T)Marshal.PtrToStructure(handle.AddrOfPinnedObject(), typeof(T));
}
finally
{
handle.Free();
}
return theStructure;
}
#endregion Public Methods
#region Properties
/// <summary>
/// Gets if the file header is 32 bit or not
/// </summary>
public bool Is32BitHeader
{
get
{
UInt16 IMAGE_FILE_32BIT_MACHINE = 0x0100;
return (IMAGE_FILE_32BIT_MACHINE & FileHeader.Characteristics) == IMAGE_FILE_32BIT_MACHINE;
}
}
/// <summary>
/// Gets the file header
/// </summary>
public IMAGE_FILE_HEADER FileHeader
{
get
{
return fileHeader;
}
}
/// <summary>
/// Gets the optional header
/// </summary>
public IMAGE_OPTIONAL_HEADER32 OptionalHeader32
{
get
{
return optionalHeader32;
}
}
/// <summary>
/// Gets the optional header
/// </summary>
public IMAGE_OPTIONAL_HEADER64 OptionalHeader64
{
get
{
return optionalHeader64;
}
}
public IMAGE_SECTION_HEADER[] ImageSectionHeaders
{
get
{
return imageSectionHeaders;
}
}
[StructLayout(LayoutKind.Sequential, Pack = 1)]
public class IMAGE_IMPORT_DIRECTORY_TABLE
{
//The import directory table consists of an array of import directory entries, one entry for each DLL to which the image refers.The last directory entry is empty(filled with null values), which indicates the end of the directory table.
//The RVA of the import lookup table. This table contains a name or ordinal for each import. (The name "Characteristics" is used in Winnt.h, but no longer describes this field.)
public UInt32 ImportLookupTableRVA;
//The stamp that is set to zero until the image is bound. After the image is bound, this field is set to the time/data stamp of the DLL.
public UInt32 TimeStamp;
//The index of the first forwarder reference.
public UInt32 ForwarderChain;
//The address of an ASCII string that contains the name of the DLL. This address is relative to the image base.
public UInt32 NameRVA;
//The RVA of the import address table. The contents of this table are identical to the contents of the import lookup table until the image is bound.
public UInt32 ImportAddressTableRVA;
}
public List<string> ImportTableNames = new List<string>();
/// <summary>
/// Gets the timestamp from the file header
/// </summary>
public DateTime TimeStamp
{
get
{
// Timestamp is a date offset from 1970
DateTime returnValue = new DateTime(1970, 1, 1, 0, 0, 0);
// Add in the number of seconds since 1970/1/1
returnValue = returnValue.AddSeconds(fileHeader.TimeDateStamp);
// Adjust to local timezone
returnValue += TimeZone.CurrentTimeZone.GetUtcOffset(returnValue);
return returnValue;
}
}
#endregion Properties
}
}
@MircoBabin
Copy link
Author

MircoBabin commented Mar 18, 2020 •
edited
Loading

I have added PE Header Import Directory Table read to the original gist caioproiete/ReadingPortableExecutable_PE_header.cs.

To list what dll's an exe will load on startup.
Often the Microsoft Visual C++ Runtime (2008, 2010, 2012, 2013, 2015, 2017, 2019) is not installed.

Use it like this:

using System;
using System.Collections.Generic;

namespace peheader
{
    class Program
    {
        enum VcRuntime { none, msvcrt, msvc_2008, msvc_2010, msvc_2012, msvc_2013, msvc_2015, msvc_2017, universal };

        static string VcRuntimeDescription(VcRuntime runtime)
        {
            switch(runtime)
            {
                case VcRuntime.none:
                    return "";

                case VcRuntime.msvcrt:
                    return "Microsoft VC Runtime 5.0 / 6.0";

                case VcRuntime.msvc_2008:
                    return "Microsoft VC Runtime 2008";

                case VcRuntime.msvc_2010:
                    return "Microsoft VC Runtime 2010";

                case VcRuntime.msvc_2012:
                    return "Microsoft VC Runtime 2012";

                case VcRuntime.msvc_2013:
                    return "Microsoft VC Runtime 2013";

                case VcRuntime.msvc_2015:
                    return "Microsoft VC Runtime 2015";

                case VcRuntime.msvc_2017:
                    return "Microsoft VC Runtime 2017";

                case VcRuntime.universal:
                    return "Microsoft VC Universal Runtime, as of VS 2015";

                default:
                    return runtime.ToString();
            }
        }

        static void Main(string[] args)
        {
            string filename;
            filename = @"c:\windows\system32\notepad.exe";

            Console.WriteLine("Inspecting PE header for:");
            Console.WriteLine(filename);

            PeHeaderReader reader = new PeHeaderReader(filename);

            Console.WriteLine();
            Console.WriteLine("[Import Table Names]");

            Dictionary<VcRuntime, bool> found = new Dictionary<VcRuntime, bool>();
            foreach (var name in reader.ImportTableNames)
            {
                var lower = name.ToLowerInvariant();
                VcRuntime runtime = VcRuntime.none;

                Console.Write(name);

                if (lower == "msvcrt.dll") runtime = VcRuntime.msvcrt;
                if (lower == "msvcr90.dll" || lower == "msvcp90.dll") runtime = VcRuntime.msvc_2008;
                else if (lower == "msvcr100.dll" || lower == "msvcp100.dll" || lower == "vcruntime100.dll") runtime = VcRuntime.msvc_2010;
                else if (lower == "msvcr110.dll" || lower == "msvcp110.dll" || lower == "vcruntime110.dll") runtime = VcRuntime.msvc_2012;
                else if (lower == "msvcr120.dll" || lower == "msvcp120.dll" || lower == "vcruntime120.dll") runtime = VcRuntime.msvc_2013;
                else if (lower == "msvcr140.dll" || lower == "msvcp140.dll" || lower == "vcruntime140.dll") runtime = VcRuntime.msvc_2015;
                else if (lower == "msvcr150.dll" || lower == "msvcp150.dll" || lower == "vcruntime150.dll") runtime = VcRuntime.msvc_2017;
                else if (lower.StartsWith("api-ms-win-core-winrt-l")) runtime = VcRuntime.universal;

                if (runtime != VcRuntime.none && !found.ContainsKey(runtime))
                {
                    found.Add(runtime, true);
                    Console.WriteLine("    [" + VcRuntimeDescription(runtime) + "]");
                }
                else
                {
                    Console.WriteLine();
                }
            }

            Console.WriteLine();
            Console.WriteLine("[Detected Microsoft Visual C++ Runtime]");
            if (found.Count == 0)
            {
                Console.WriteLine("No runtime detected");
            }
            else
            {
                foreach(var item in found)
                {
                    Console.WriteLine(VcRuntimeDescription(item.Key));
                }
            }

            Console.WriteLine();
            if (reader.Is32BitHeader)
            {
                Console.WriteLine("32bits executable");
            }
            else
            {
                Console.WriteLine("64bits executable");
            }

            Console.ReadKey();
        }
    }
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment