PE_Explorer

A lightweight command-line PE (Portable Executable) file analyzer written in C#. No GUI, no external dependencies — it reads the whole file into memory and dumps every major structure in CFF Explorer style.

Features

• File info: name, path, size, MD5 / SHA1 / SHA256
• DOS + NT header validation
• File Header, Optional Header (PE32 and PE32+), Data Directories
• Section Table
• Import Table (names and ordinals, PE32 and PE32+ thunks)
• Export Table (ordinals, names, forwarded exports)
• Resource Table (3-level directory tree, UTF-16 resource names)
• Base Relocations
• TLS directory (incl. callback array, VA-to-RVA conversion)
• Debug Directory (CodeView signatures, PDB path)
• Certificate Table (overlay, file-offset based)
• Delay Import Table

Requirements

• .NET SDK 10

Build and Run

dotnet build
dotnet run -- <path-to-pe-file>

You can also drag a file onto the executable, or run it without arguments and type the path when prompted.

Example output

=== File Info ===
  File Name                       0Harmony.dll
  File Size                       0x00047600 (292352 bytes)
  MD5                             0A528B5FFE81163E08C4B4F6F4B6887F
  SHA256                          2EDDA13A18954B79795BAC0D7E0E8FDF0BFA05B96552D6056D90F446CD0A2AB2

=== File Header ===
  Machine                         0x014C
  Number of Sections              0x0003
  ...

=== Exports ===
  Dll Name                        KERNEL32.dll
  Ordinal Base                    0x00000001
         1  0x000A7125  -> NTDLL.RtlAcquireSRWLockExclusive
         3  0x00037D20  ActivateActCtx
  ...

Samples

samples/0Harmony.dll — 0Harmony, from the Harmony library (MIT License).

Microsoft DLLs (kernel32.dll, etc.) are not redistributed — test against files on your own machine.

Architecture

The code is organized by responsibility, keeping modules decoupled:

• PEValidator — checks whether the file is a valid PE (MZ + PE signatures)
• PEParser — all parsing logic; holds the file in a byte[] and packs results into data classes
• *Data classes — plain data containers (properties only, no logic)
• Program — entry point; orchestrates validation, parsing and output

License

MIT