Parse the COFF file header of a PE
npm install pe-coffParse the COFF file header of a PE. As specified by Microsoft PE and COFF Specification 9.3 [doc], section 3.3.
    
``js
const pecoff = require('pe-coff')
pecoff('file.exe', function (err, header, location) {
console.log(header)
console.log(location)
})
`
The header has these properties:
`json`
{
"machineType": "i386",
"machineDescription": "Intel 386 or later processors and compatible processors",
"numberOfSections": 3,
"timeDateStamp": 1480757919,
"pointerToSymbolTable": 0,
"numberOfSymbols": 0,
"sizeOfOptionalHeader": 224,
"characteristics": 258
}
And location contains the offset and length of the header in bytes:
`json`
{
"offset": 132,
"length": 20
}
Where mixed is either a filename or a file descriptor. Use limit (the number of bytes to read) if you only need the first (few) fields:
`js
pecoff('file.exe', pecoff.NUMBER_OF_SECTIONS, function (err, header) {
// Will have machineType, machineDescription, numberOfSections
console.log(header)
})
pecoff('file.exe', pecoff.MACHINE_TYPE, function (err, header) {
// Will have machineType, machineDescription
console.log(header)
})
`
- pe-signature
- pe-signature-offset
- pe-machine-type-descriptor
With npm do:
`
npm install pe-coff
MIT © Vincent Weevers