pe-coff

Parse the COFF file header of a PE. As specified by Microsoft PE and COFF Specification 9.3 [doc], section 3.3.

example

const pecoff = require('pe-coff')

pecoff('file.exe', function (err, header, location) {
  console.log(header)
  console.log(location)
})

The header has these properties:

{
  "machineType": "i386",
  "machineDescription": "Intel 386 or later processors and compatible processors",
  "numberOfSections": 3,
  "timeDateStamp": 1480757919,
  "pointerToSymbolTable": 0,
  "numberOfSymbols": 0,
  "sizeOfOptionalHeader": 224,
  "characteristics": 258
}

And location contains the offset and length of the header in bytes:

{
  "offset": 132,
  "length": 20
}

pecoff(mixed, [limit], callback)

Where mixed is either a filename or a file descriptor. Use limit (the number of bytes to read) if you only need the first (few) fields:

pecoff('file.exe', pecoff.NUMBER_OF_SECTIONS, function (err, header) {
  // Will have machineType, machineDescription, numberOfSections
  console.log(header)
})

pecoff('file.exe', pecoff.MACHINE_TYPE, function (err, header) {
  // Will have machineType, machineDescription
  console.log(header)
})

related

• pe-signature
• pe-signature-offset
• pe-machine-type-descriptor

install

With npm do:

npm install pe-coff

license

MIT © Vincent Weevers