根据
a search of the reference source
,的
PEFileKinds
枚举仅用于
AssemblyBuilder
ModuleBuilder
(以及它们的非公共助手类型)。此枚举和类位于
System.Reflection.Emit
namespace
然而,
the official
System.Reflection.Metadata
NuGet package
在程序集中显示程序集的PE头的相关值
System.Reflection.PortableExecutable
namespace
培林
价值观。下面是C#中的一个例子:
using (var stream = File.OpenRead(filenameAndExtension))
{
using (var peFile = new PEReader(stream))
{
var headers = peFile.PEHeaders;
Console.WriteLine($"Reading {filenameAndExtension} with System.Reflection.Metadata");
Console.WriteLine($" IsDll: {headers.IsDll}");
Console.WriteLine($" IsExe: {headers.IsExe}");
Console.WriteLine($" IsConsoleApplication: {headers.IsConsoleApplication}");
PEFileKinds reverseEngineeredKind;
// NOTE: the header values cause IsConsoleApplication to return
// true for DLLs, so we need to check IsDll first
if (headers.IsDll)
{
reverseEngineeredKind = PEFileKinds.Dll;
}
else if (headers.IsConsoleApplication)
{
reverseEngineeredKind = PEFileKinds.ConsoleApplication;
}
else
{
reverseEngineeredKind = PEFileKinds.WindowApplication;
}
Console.WriteLine($" Reverse-engineered kind: {reverseEngineeredKind}");
}
}
我在生成的程序集上运行了这段代码
系统反射发射
以确保其准确性。完整的程序正在运行
this gist
.
您也可以通过第三方库获取这些信息,如
Mono.Cecil
或者,正如莱克斯李提到的,
PeNet