Test if buffer is a PE signature
npm install pe-signatureTest if buffer is a PE signature. As specified by Microsoft PE and COFF Specification 9.3 [doc], section 3.2:
> After the MS-DOS stub, at the file offset specified at offset 0x3c, is a 4-byte signature that identifies the file as a PE format image file. This signature is PE\0\0 (the letters "P" and "E" followed by two null bytes).
    
``js
const psig = require('pe-signature')
const a = Buffer('PE\0\0')
const b = Buffer('PE\0\0xxx')
const c = Buffer('xxxPE\0\0')
console.log(psig.is(a)) // true
console.log(psig.is(b)) // false
console.log(psig.has(b)) // true
console.log(psig.is(c, 3)) // true
`
Use pe-signature-offset to get the position of the signature in a PE file:
`js
const open = require('fs-maybe-open')
, getOffset = require('pe-signature-offset')
, fs = require('fs')
, len = psig.length
function isPEFile (fdOrFile, done) {
open(fdOrFile, 'r', function (err, fd, close) {
if (err) return done(err)
getOffset(fd, function (err, offset) {
if (err) return close(done, err)
fs.read(fd, Buffer(len), 0, len, offset, function (err, bytesRead, buf) {
if (err) return close(done, err)
close(done, null, psig.is(buf))
})
})
})
}
isPEFile('chrome.exe', function (err, is) {
if (err) throw err
console.log(is) // true
})
`
With npm do:
`
npm install pe-signature
MIT © Vincent Weevers