Question

I can easily read an entire executable file, or however many bytes I’d like to read via defining the size but what about if I want to read it from the beginning up until the next “MZ” ? if 2 files are binded together and I want to grab the first half only, not knowing the size of it.

mz binary stuff 1 – the one i want
mz binary stuff 2

0x77, 0x90 == MZ

Answer 1

You need to take SizeOfRawData for each IMAGE_SECTION_HEADER (pinvoke) structure and append SizeOfHeaders from IMAGE_NT_HEADERS32/64 structure.

First you will need to take IMAGE_DOS_HEADER structure from PE/PE+ file

After that, e_lfanew field will points you to IMAGE_NT_HEADERS32/64 structure. (If Magic == 0x10b -> PE. If Magic = 0x20b -> PE+ file)

Count of sectionHeadersCount you can get from IMAGE_FILE_HEADER structure.

UInt32 startAddress = IMAGE_DOS_HEADER.e_lfanew + 4 + Marshal.SizeOf(typeof(IMAGE_FILE_HEADER)) + [IMAGE_FILE_HEADER][6].SizeOfOptionalHeader 

for(UInt32 loop = 0;loop < sectionHeadersCount;loop++)
{
    IMAGE_SECTION_HEADER section = /*Map offset to IMAGE_SECTION_HEADER structure Method*/(startAddress);
    startAddress += Marshal.SizeOf(typeof(IMAGE_SECTION_HEADER));//Offset to next section
}

// Example of Mapping function:
public T PtrToStructure<T>(UInt32 offset) where T : struct
{
    Byte[] bytes = this.ReadBytes(offset, (UInt32)Marshal.SizeOf(typeof(T)));

    GCHandle handle = GCHandle.Alloc(bytes, GCHandleType.Pinned);
    try
    {
         T result = (T)Marshal.PtrToStructure(handle.AddrOfPinnedObject(), typeof(T));
         return result;
    } finally
    {
         handle.Free();
    }
}

Detailed PE/PE+ description