testpe.php

<?php
define('IMAGE_FILE_HEADER_OFFSET',16);
define('IMAGE_NT_OPTIONAL_HDR_OFFSET',66);
function testPE($file) {
	$fp = fopen($file,'rb');
	$bits = fread($fp,2);
	$peInfo['is_pe'] = false;
	if(($bits == "MZ") || ($bits == "ZM")) {
		#echo $bits . "\n";
		fseek($fp,60);
		$bits = ord(fread($fp,1));
		#echo "e_lfanew: " . $bits . "\n";
		$peInfo['e_lfanew'] = $bits;
		fseek($fp,$bits);
		$bits = fread($fp,2);
		#echo $bits . "\n";
		if($bits == "PE") {
			$peInfo['is_pe'] = TRUE;
			fseek($fp,2,SEEK_CUR);
			$bits = read_leshort($fp);
			$IMAGE_FILE_HEADER_MACHINE = "0x" . $bits[1];
			$peInfo['IMAGE_FILE_HEADER_MACHINE'] = $IMAGE_FILE_HEADER_MACHINE;
			switch($bits[0]) {
				case 0x014c:
					$is_32bit = true;
					$is_64bit = false;
					break;
				case 0x0200:
				case 0x8664:
					$is_32bit = false;
					$is_64bit = true;
					break;				
			} 
			$peInfo['is_32bit'] = $is_32bit;
			$peInfo['is_64bit'] = $is_64bit;
	
			#echo "IMAGE_FILE_HEADER_MACHINE: " . $IMAGE_FILE_HEADER_MACHINE . "\n";
			
			//Seek to IMAGE_FILE_HEADER_CHARACTERISTICS
			fseek($fp,IMAGE_FILE_HEADER_OFFSET,SEEK_CUR);
			$bits = read_leshort($fp);
			$IMAGE_FILE_HEADER_CHARACTERISTICS = "0x" . $bits[1];
			#echo "IMAGE_FILE_HEADER_CHARACTERISTICS: " . $IMAGE_FILE_HEADER_CHARACTERISTICS . "\n";
			if($bits[0] >= 0x2000) {
				#print "This is a DLL\n";
				$is_dll = true;
			}
			$peInfo['is_dll'] = $is_dll;
	
			//Read IMAGE_NT_OPTIONAL_HDR_MAGIC
			$bits = read_leshort($fp);
			$IMAGE_NT_OPTIONAL_HDR_MAGIC = "0x" . $bits[1];
			#echo "IMAGE_NT_OPTIONAL_HDR_MAGIC:" . $IMAGE_NT_OPTIONAL_HDR_MAGIC . "\n";
			$peInfo['IMAGE_NT_OPTIONAL_HDR_MAGIC'] = $IMAGE_NT_OPTIONAL_HDR_MAGIC;
	
			//Seek to Subsystem
			fseek($fp,IMAGE_NT_OPTIONAL_HDR_OFFSET,SEEK_CUR);
			$bits = read_leshort($fp);
			$IMAGE_NT_OPTIONAL_HDR_Subsystem = "0x" . $bits[1];
			#echo "Subsystem: " . $IMAGE_NT_OPTIONAL_HDR_Subsystem . "\n";
			$peInfo['IMAGE_NT_OPTIONAL_HDR_Subsystem'] = $IMAGE_NT_OPTIONAL_HDR_Subsystem;
			switch($bits[0]) {
				case 0x01:
					$is_native = true;
					$is_gui = false;
					$is_console = false;
					break;
				case 0x02:
					$is_native =false;
					$is_gui = true;
					$is_console = false;
					break;
				case 0x03:
					$is_native = false;
					$is_gui = true;
					$is_console = false;
					break;
			} 
			$peInfo['is_native'] = $is_native;
			$peInfo['is_gui'] = $is_gui;
			$peInfo['is_console'] = $is_console;
			
			//Read DllCharacteristics
			$bits = read_leshort($fp);
			$IMAGE_NT_OPTIONAL_HDR_DllCharacteristics = "0x" . $bits[1];
				#echo "DllCharacteristics: " . $IMAGE_NT_OPTIONAL_HDR_DllCharacteristics . "\n";
				$peInfo['IMAGE_NT_OPTIONAL_HDR_DllCharacteristics'] = $IMAGE_NT_OPTIONAL_HDR_DllCharacteristics;
			}
	} 
	fclose($fp);
	return $peInfo;
}
function read_leshort($fp) {
	$bits = fread($fp,2);
	$bit = unpack('v',$bits);
	return array($bit[1],sprintf('%02X',$bit[1]));
}


?>