# Class: PE

## PE

This is a description of the PE class.

#### new PE()

### Members

#### (static) nEP

  The file offset of the entry point.

#### (static) nLastSection

  The number of the last section.

#### (static) resource

  An array of resources, indexed by number and name (if not numeric). Members are the same as the functions.

  ##### Example

      var nOffset=PE.resource["PACKAGEINFO"].Offset;

#### (static) section

  An array of sections, indexed by number and name (if not numeric). Members are the same as the functions.

  ##### Example

      var nOffset=PE.section[".rsrc"].FileOffset;

### Methods

#### (static) calculateEntropy()

  See:
    - Binary.calculateEntropy

#### (static) calculateMD5()

  See:
    - Binary.calculateMD5

#### (static) calculateSizeOfHeaders() → {UInt}

  Calculate the size of the headers.

  ##### Returns:

  Type
    UInt

#### (static) compare()

  See:
    - Binary.compare

#### (static) compareEP(sSignature, nOffsetopt) → {Bool}

  Compare (see Binary.compare) bytes at the Entry Point.

  ##### Parameters:

  Name | Type | Attributes | Default | Description
  --- | --- | --- | --- | ---
  `sSignature` | String |  |  | The signature.
  `nOffset` | Int | <optional> | 0 | The offset from the entry point.

  ##### Returns:

  Type
    Bool

  ##### Example

      if(PE.compareEP("2C81",8))
      {
          sVersion="1.98";
      }

      if(PE.compareEP("EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C24"))
      {
          bDetected=1;
      }

#### (static) compareEP_NET(sSignature, nOffsetopt) → {Bool}

  Compare (see Binary.compare) bytes at the Entry Point of .NET.

  ##### Parameters:

  Name | Type | Attributes | Default | Description
  --- | --- | --- | --- | ---
  `sSignature` | String |  |  | The signature.
  `nOffset` | Int | <optional> | 0 | The offset from the entry point of .NET.

  ##### Returns:

  Type
    Bool

  ##### Example

      if(PE.compareEP_NET("4228070000066f09000006283800000a2a1b3004006f0000000d0000110272b9"))
      {
          bDetected=1;
          sVersion="2.X";
      }

#### (static) compareOverlay(sSignature, nOffsetopt) → {Bool}

  Compare bytes at the overlay.

  ##### Parameters:

  Name | Type | Attributes | Default | Description
  --- | --- | --- | --- | ---
  `sSignature` | String |  |  | The signature.
  `nOffset` | Int | <optional> | 0 | The offset from the overlay.

  ##### Returns:

  Type
    Bool

  ##### Example

      if(PE.compareOverlay("';!@Install@!UTF-8!'"))
      {
          bDetected=1;
      }

#### (static) findByte()

  See:
    - Binary.findByte

#### (static) findDword()

  See:
    - Binary.findDword

#### (static) findSignature()

  See:
    - Binary.findSignature

  ##### Example

      nOffset=PE.findSignature(nOffset,1024,"'7z'BCAF271C");
      if(nOffset!=-1)
      {
          bDetected=1;
      }

#### (static) findString()

  See:
    - Binary.findString

  ##### Example

      nOffset=PE.findString(0,1024,"UPX!");
      if(nOffset==-1)
      {
          return;
      }

#### (static) findWord()

  See:
    - Binary.findWord

#### (static) getAddressOfEntryPoint() → {UInt}

  Get the relative virtual address (RVA) of the entry point.

  ##### Returns:

  Type
    UInt

  ##### Example

      var nSection=PE.nLastSection;
      if(nSection>=2)
      {
          if(PE.getAddressOfEntryPoint()==PE.section[nSection].VirtualAddress)
          {
              if(PE.section[nSection].Characteristics==0xe0000040)
              {
                  if(PE.section[nSection-1].Characteristics==0xe0000040)
                  {
                      if(PE.getNumberOfImportThunks(0)==1)
                      {
                          bDetected=1;
                      }
                  }
              }
          }
      }

#### (static) getCompilerVersion() → {String}

  Get the compiler version.

  ##### Returns:

  The string `"MajorLinkerVersion.MinorLinkerVersion"`.
  Type
    String

  ##### Example

      if(bDetected)
      {
          switch(PE.getCompilerVersion())
          {
          case "6.0":  sVersion="6.0";  break;
          case "7.0":  sVersion="2002"; break;
          case "7.10": sVersion="2003"; break;
          case "8.0":  sVersion="2005"; break;
          case "9.0":  sVersion="2008"; break;
          case "10.0": sVersion="2010"; break;
          case "11.0": sVersion="2012"; break;
          case "12.0": sVersion="2013"; break;
          }
      }

#### (static) getDosStubOffset() → {UInt}

  Get the file offset of the MSDOS stub.

  ##### Returns:

  Type
    UInt

#### (static) getDosStubSize() → {UInt}

  Get the size of the MSDOS stub.

  ##### Returns:

  Type
    UInt

#### (static) getEntryPointOffset() → {Int64}

  Get the offset of the entry point.

  ##### Returns:

  If an error occurs, -1 will be returned.
  Type
    Int64

#### (static) getEntryPointSection() → {Int}

  Get the number of the section containing the entry point.

  ##### Returns:

  If no entry point returns `-1`.
  Type
    Int

  ##### Example

      if(PE.getEntryPointSection()==PE.nLastSection)
      {
          bDetected=1;
      }

#### (static) getEPSignature()

  Get the signature at an offset of the entry point.
  See:
    - Binary.getSignature

#### (static) getExportSection() → {Int}

  Get the number of the section containing the export table.

  ##### Returns:

  If no export returns `-1`.
  Type
    Int

#### (static) getFileBaseName()

  See:
    - Binary.getFileBaseName

#### (static) getFileCompleteSuffix()

  See:
    - Binary.getFileCompleteSuffix

#### (static) getFileDirectory()

  See:
    - Binary.getFileDirectory

#### (static) getFileSuffix()

  See:
    - Binary.getFileSuffix

#### (static) getFileVersion() → {String}

  Get the version of the file, if the version resource exists.

  ##### Returns:

  Type
    String

#### (static) getGeneralOptions() → {String}

  Get a string in the form of `"PEtypePEmode"`. For example `"EXE32"` or `"Driver32"`.

  ##### Returns:

  Type
    String

#### (static) getGeneralOptionsEx() → {String}

  Add console and/or admininistrator requirement to the general options.

  ##### Returns:

  Type
    String

#### (static) getImageBase() → {UInt}

  Get the base address of the image.

  ##### Returns:

  Type
    UInt

#### (static) getImportFunctionName(nImport, nFunctionNumber) → {String}

  Get the name of an imported function.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `nImport` | UInt | Number of the imported library.
  `nFunctionNumber` | UInt | Number of the function in the library.

  ##### Returns:

  Type
    String

#### (static) getImportLibraryName(nImport) → {String}

  Get the name of an imported library.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `nImport` | UInt | Number of the imported library.

  ##### Returns:

  Type
    String

#### (static) getImportSection() → {Int}

  Get the number of the section containing the import table.

  ##### Returns:

  If no import returns `-1`.
  Type
    Int

#### (static) getMachineType() → {UShort}

  Get the machine type.

  ##### Returns:

  Type
    UShort

#### (static) getMajorLinkerVersion() → {UInt}

  Get the major linker version.

  ##### Returns:

  Type
    UInt

  ##### Example

      var nMajor=PE.getMajorLinkerVersion();
      if(nMajor>3)
      {
          sName="Microsoft Linker";
          bDetected=1;
      }

#### (static) getManifest() → {String}

  Get the XML manifest from the resources.

  ##### Returns:

  Type
    String

  ##### Example

      if(/requireAdministrator/.test(PE.getManifest()))
      {
          sOptions=sOptions.append("admin");
      }

#### (static) getMinorLinkerVersion() → {UInt}

  Get the minor linker version.

  ##### Returns:

  Type
    UInt

  ##### Example

      var nMinor=PE.getMinorLinkerVersion();
      if(nMinor==55)
      {
          sName="LCC Linker";
          sVersion+="*";
          bDetected=1;
      }

#### (static) getNETVersion() → {String}

  Get the .NET version.

  ##### Returns:

  Type
    String

  ##### Example

      if(PE.isNET())
      {
          sVersion=PE.getNETVersion();
          bDetected=1;
      }

#### (static) getNumberOfImports() → {Int}

  Get the number of imports.

  ##### Returns:

  Type
    Int

  ##### Example

      if(PE.getNumberOfImports()==1)
      {
          if(PE.getNumberOfImportThunks(0)==2)
          {
              if(PE.section[0].Name=="ANDpakk2")
              {
                  sVersion="2.X";
                  bDetected=1;
              }
          }
      }

#### (static) getNumberOfImportThunks(nImport) → {UInt}

  Get the number of functions in the imported library.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `nImport` | UInt | Number of the library.

  ##### Returns:

  Type
    UInt

  ##### Example

      if(PE.getNumberOfImportThunks(0)==1)
      {
          bDetected=1;
      }

#### (static) getNumberOfResources() → {UInt}

  Get the number of resources.

  ##### Returns:

  Type
    UInt

#### (static) getNumberOfRichIDs() → {UInt}

  Get the number of the Rich IDs.

  ##### Returns:

  Type
    UInt

#### (static) getNumberOfSections() → {Int}

  Get the number of sections.

  ##### Returns:

  Type
    Int

#### (static) getOverlayOffset() → {UInt}

  Get the file offset of the overlay.

  ##### Returns:

  Type
    UInt

#### (static) getOverlaySize() → {UInt}

  Get the size of the overlay .

  ##### Returns:

  Type
    UInt

#### (static) getPEFileVersion(sFileName) → {String}

  Get the version of a particular file, if the version resource exists.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `sFileName` | String | The file name.

  ##### Returns:

  Type
    String

#### (static) getRelocsSection() → {Int}

  Get the number of the section containing the relocations.

  ##### Returns:

  If no relocations returns `-1`.
  Type
    Int

#### (static) getResourceIdByNumber(nNumber) → {UInt}

  Get the Id of a resource.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `nNumber` | UInt | Number of resource.

  ##### Returns:

  Type
    UInt

#### (static) getResourceNameByNumber(nNumber) → {String}

  Get the name of a resource.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `nNumber` | UInt | Number of resource.

  ##### Returns:

  Type
    String

#### (static) getResourceNameOffset(sFileName) → {Int}

  Get the file offset to a named resource.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `sFileName` | String | The name of the resource.

  ##### Returns:

  If an error occurs, `-1` will be returned.
  Type
    Int

#### (static) getResourceNameSize(sFileName) → {Int}

  Get the size of a named resource.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `sFileName` | String | The name of the resource.

  ##### Returns:

  Type
    Int

#### (static) getResourceOffsetByNumber(nNumber) → {Int}

  Get the offset of a resource.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `nNumber` | UInt | Number of resource.

  ##### Returns:

  If an error occurs, -1 will be returned.
  Type
    Int

#### (static) getResourceSection() → {Int}

  Get the number of the section containing the resources.

  ##### Returns:

  If no resources returns `-1`.
  Type
    Int

#### (static) getResourceSizeByNumber(nNumber) → {Int}

  Get the size of a resource.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `nNumber` | UInt | Number of resource.

  ##### Returns:

  Type
    Int

#### (static) getResourceTypeByNumber(nNumber) → {String}

  Get the type of a resource.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `nNumber` | UInt | Number of resource.

  ##### Returns:

  Type
    String

  ##### Example

      if(PE.getResourceTypeByNumber(0)=="RT_MANIFEST")
      {
          bDetected=1;
      }

#### (static) getSectionCharacteristics(nSectionNumber) → {UInt}

  Get the characteristics of a section.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `nSectionNumber` | Int | Section number (from 0).

  ##### Returns:

  Type
    UInt

#### (static) getSectionFileOffset(nSectionNumber) → {UInt}

  Get the file offset of a setion.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `nSectionNumber` | Int | Section number (from 0).

  ##### Returns:

  Type
    UInt

#### (static) getSectionFileSize(nSectionNumber) → {UInt}

  Get the file size of a section.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `nSectionNumber` | Int | Section number (from 0).

  ##### Returns:

  Type
    UInt

#### (static) getSectionName(nSectionNumber) → {String}

  Get the name of a section.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `nSectionNumber` | Int | Section number (from 0).

  ##### Returns:

  Type
    String

#### (static) getSectionNameCollision(sString1, sString2) → {String}

  Get the common prefix of two section name suffixes.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `sString1` | String | First section name suffix.
  `sString2` | String | Second section name suffix.

  ##### Returns:

  Section name prefix.
  Type
    String

  ##### Example

      if("UPX"==PE.getSectionNameCollision("0","1"))
      {
          // Both "UPX0" and "UPX1" exist.
          bDetected=1;
      }

#### (static) getSectionNumber(sSectionName) → {Int}

  Get the number of a section with a specific name.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `sSectionName` | String | Section name.

  ##### Returns:

  0-based section number, or `-1` if there is no section with that name.
  Type
    Int

#### (static) getSectionNumberExp(sSectionName) → {Int}

  Get the number of a section whose name matches a regular expression.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `sSectionName` | String | Section pattern.

  ##### Returns:

  0-based section number, or `-1` if there is no section with that pattern.
  Type
    Int

#### (static) getSectionVirtualAddress(nSectionNumber) → {UInt}

  Get the relative virtual address of a section.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `nSectionNumber` | Int | Section number (from 0).

  ##### Returns:

  Type
    UInt

#### (static) getSectionVirtualSize(nSectionNumber) → {UInt}

  Get the virtual size of a section.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `nSectionNumber` | Int | Section number (from 0).

  ##### Returns:

  Type
    UInt

#### (static) getSignature()

  See:
    - Binary.getSignature

#### (static) getSize()

  See:
    - Binary.getSize

#### (static) getSizeOfCode() → {Int}

  Get the size of code.

  ##### Returns:

  Type
    Int

#### (static) getSizeOfUninitializedData() → {Int}

  Get the size of unitialized data.

  ##### Returns:

  Type
    Int

#### (static) getString()

  See:
    - Binary.getString

#### (static) getTLSSection() → {Int}

  Get the number of the section containing the TLS.

  ##### Returns:

  If no TLS returns `-1`.
  Type
    Int

#### (static) getVersionStringInfo(sKey) → {String}

  Get the value associated with a version resource string key.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `sKey` | String |

  ##### Returns:

  Type
    String

#### (static) isConsole() → {Bool}

  Check if the file is a console application.

  ##### Returns:

  Type
    Bool

#### (static) isDll() → {Bool}

  Check if the file is a DLL.

  ##### Returns:

  Type
    Bool

#### (static) isDosStubPresent() → {Bool}

  Check if there is an MSDOS stub.

  ##### Returns:

  Type
    Bool

#### (static) isDriver() → {Bool}

  Check if the file is a driver.

  ##### Returns:

  Type
    Bool

#### (static) isLibraryFunctionPresent(sLibraryName, sFunctionName) → {Bool}

  Check if a function exists in a library.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `sLibraryName` | String | The name of the library.
  `sFunctionName` | String | The name of the function.

  ##### Returns:

  Type
    Bool

#### (static) isLibraryPresent(sLibraryName) → {Bool}

  Check if a library is imported.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `sLibraryName` | String | The name of the library.

  ##### Returns:

  Type
    Bool

  ##### Example

      if(PE.isLibraryPresent("MSVBVM50.DLL"))
      {
          sVersion="5.0";
          bDetected=1;
      }

#### (static) isLibraryPresentExp() → (nullable) {Array}

  Locate the first library matching a pattern.

  ##### Returns:

  `null` if not found, otherwise:
  `[-1]` is the number of the library;
  `[0]` is the name of the library (lower cased);
  `[1]` onwards are the captured subpatterns.
  Type
    Array

#### (static) isNET() → {Bool}

  Check if the file is a .NET application.

  ##### Returns:

  Type
    Bool

#### (static) isNETStringPresent(sString) → {Bool}

  Check if there is a specific .NET string.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `sString` | String |

  ##### Returns:

  Type
    Bool

  ##### Example

      if(PE.isNETStringPresent(0,"DotfuscatorAttribute"))
      {
          bDetected=1;
      }

#### (static) isNETUnicodeStringPresent(sString) → {Bool}

  Check if there is a specific .NET Unicode string.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `sString` | String |

  ##### Returns:

  Type
    Bool

  ##### Example

      if(PE.isNETUnicodeStringPresent("E_TamperDetected"))
      {
          sVersion="3.X-4.X";
          bDetected=1;
      }

#### (static) isOverlayPresent() → {Bool}

  Check if there is an overlay in the file.

  ##### Returns:

  Type
    Bool

#### (static) isPEPlus() → {Bool}

  Check if the file is 64 bit (PE+).

  ##### Returns:

  Type
    Bool

  ##### Example

      if(PE.isPEPlus())
      {
          sOptions="PE+";
      }

#### (static) isResourceNamePresent(sName) → {Bool}

  Check if there is a resource with a specific name in the file.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `sName` | String | The name of the resource.

  ##### Returns:

  Type
    Bool

  ##### Example

      if(PE.isResourceNamePresent("PACKAGEINFO"))
      {
          bDetected=1;
      }

#### (static) isRichSignaturePresent() → {Bool}

  Check if the “Rich” signature is in the file. For more information see http://www.ntcore.com/files/richsign.htm. It is typical for the files made by the MS Linker.

  ##### Returns:

  Type
    Bool

  ##### Example

      if(PE.isRichSignaturePresent())
      {
          sName="Microsoft Linker";
          bDetected=1;
      }

#### (static) isRichVersionPresent(nVersion) → {Bool}

  Check if there is a Rich version.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `nVersion` | UInt | Rich version.

  ##### Returns:

  Type
    Bool

#### (static) isSectionNamePresent(sSectionName) → {Bool}

  Checks if a section exists with a specific name.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `sSectionName` | String | Section name.

  ##### Returns:

  Type
    Bool

#### (static) isSectionNamePresentExp(sSectionName) → {Bool}

  Check if a section name matches a regular expression.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `sSectionName` | String | Section pattern.

  ##### Returns:

  Type
    Bool

#### (static) isSignatureInSectionPresent(nSection, sSignature) → {Bool}

  Check if a signature (see Binary.compare) exists in a section.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `nSection` | Int | Section number (from 0).
  `sSignature` | String | Signature.

  ##### Returns:

  Type
    Bool

  ##### Example

      if(PE.isSignatureInSectionPresent(0,"'ENIGMA'"))
      {
          bDetected=1;
      }

#### (static) isSignaturePresent()

  See:
    - Binary.isSignaturePresent

#### (static) isSignedFile() → {Bool}

  Check if there is a digital signature.

  ##### Returns:

  Type
    Bool

#### (static) OffsetToRVA(nOffset) → {Int64}

  Convert a file offset to a relative virtual address (RVA).

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `nOffset` | UInt64 |

  ##### Returns:

  If an error occurs, -1 will be returned.
  Type
    Int64

#### (static) OffsetToVA(nOffset) → {Int64}

  Convert a file offset to a virtual address (VA).

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `nOffset` | UInt64 |

  ##### Returns:

  If an error occurs, -1 will be returned.
  Type
    Int64

#### (static) readByte()

  See:
    - Binary.readByte

#### (static) readDword()

  See:
    - Binary.readDword

#### (static) readWord()

  See:
    - Binary.readWord

#### (static) RVAToOffset(nRVA) → {Int64}

  Convert a relative virtual address (RVA) to a file offset.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `nRVA` | UInt64 |

  ##### Returns:

  If an error occurs, -1 will be returned.
  Type
    Int64

#### (static) swapBytes()

  See:
    - Binary.swapBytes

#### (static) VAToOffset(nVA) → {Int64}

  Convert a virtual address (VA) to a file offset.

  ##### Parameters:

  Name | Type | Description
  --- | --- | ---
  `nVA` | UInt64 |

  ##### Returns:

  If an error occurs, -1 will be returned.
  Type
    Int64