PeNet Documentation

PeNet provides several ways to open and parse a PE file. The best method depends on your requirements for memory usage, performance, and whether you intend to modify the file.

1. Byte Array (Small Files / Modification)

Best for very small files or when you want to write/change the PE file without affecting the original on disk. A full copy of the file is held in memory; changes are made to the copy, which you can then save to a new file.

• Warning: Memory usage scales with file size. Performance decreases for files larger than 10 MB.

2. Stream (Low Memory / Constant Usage)

Best for keeping memory usage low and constant regardless of file size.

• Warning: Performance is lower than other methods. If you modify the stream, changes are written directly to the original file, which may cause unwanted side-effects.

3. Memory Mapped File (Large Files / High Performance)

The fastest method for large files with the lowest memory consumption.

• Warning: Like streams, all writes are applied directly to the original input file.

// Byte Array
var bin = File.ReadAllBytes(@"C:\Windows\System32\kernel32.dll");
var peHeader = new PeNet.PeFile(bin);

// Stream
using var fileStream = File.OpenRead(@"C:\Windows\System32\kernel32.dll");
var peHeader = new PeNet.PeFile(fileStream);

// Memory Mapped File
using var mmf = new PeNet.FileParser.MMFile(@"C:\Windows\System32\kernel32.dll");
var peHeader = new PeNet.PeFile(mmf);

PeNet can extract Code View PDB v7 information from the debug directory of a PE file. This information includes the PdbFileName (useful for malware family identification) and the Signature GUID (useful for downloading matching symbols from the Microsoft public symbol server for memory forensics or debugging).

To access this, iterate through the ImageDebugDirectory of a PeFile instance and locate the entry where CvInfoPdb70 is not null.

using System;
using System.Linq;
using PeNet;

namespace Pdb
{
    class Program
    {
        static void Main(string[] args)
        {
            var peFile = new PeFile("peWithDbgInfo.exe");

            // Select the first debug directory with
            // PDB information available.
            var pdbInfo = peFile
                .ImageDebugDirectory
                .First(idb => idb.CvInfoPdb70 != null)
                .CvInfoPdb70;

            // Print content of the Code View PDB v7 structure
            Console.WriteLine(pdbInfo);
        }
    }
}

Use the RemoveSection method to delete a section from a PE file. You can control whether the actual data of the section is removed from the file or just the entry in the section table.

Usage Modes:

• Full Removal (Default): Removes the section from the section table AND deletes the section's content from the file.
• Table-only Removal: By passing false as the second argument, you remove the section from the section table but keep the actual content within the file.

Method Signature: peFile.RemoveSection(string sectionName, bool removeContent = true)

var peFile = new PeFile("myapp.exe");

// Remove the resource section from the section table and the content
// of the section from the file.
peFile.RemoveSection(".rsrc");

// Alternatively you can only remove the section from the section table
// and keep the content of the section in the file.
peFile.RemoveSection(".rsrc", false);