Class PESubsystemInfo

This class exposes methods for obtaining the subsystem ID encoded into the NT header of a Windows Portable Executable (PE) file. Such files include, but are not limited to, character mode and graphical mode programs implemented in both native or managed programming languages, dynamic link libraries, and device drivers.

Inheritance
System.Object
GenericSingletonBase<PESubsystemInfo>
PESubsystemInfo
Inherited Members
System.Object.Equals(System.Object)
System.Object.Equals(System.Object, System.Object)
System.Object.ReferenceEquals(System.Object, System.Object)
System.Object.GetHashCode()
System.Object.GetType()
System.Object.MemberwiseClone()
Namespace: WizardWrx.AssemblyUtils
Assembly: WizardWrx.AssemblyUtils.dll
Syntax
public class PESubsystemInfo : GenericSingletonBase<PESubsystemInfo>

Fields

| Improve this Doc View Source

IMAGE_SUBSYSTEM_UNKNOWN

The ProcessSubsystmID property returns this value until the private constructor initializes it.

Declaration
public const short IMAGE_SUBSYSTEM_UNKNOWN = 0
Field Value
Type Description
System.Int16
| Improve this Doc View Source

IMAGE_SUBSYSTEM_WINDOWS_CUI

The ProcessSubsystmID property returns this value when queried on an PESubsystemInfo singleton instance that was initialized by a console (character mode) entry assembly.

Static method GetPESubsystemID returns this value when queried about the subsystem ID of a console (character mode) assembly or compiled native program.

Declaration
public const short IMAGE_SUBSYSTEM_WINDOWS_CUI = 3
Field Value
Type Description
System.Int16
| Improve this Doc View Source

IMAGE_SUBSYSTEM_WINDOWS_GUI

The ProcessSubsystmID property returns this value when queried on an PESubsystemInfo singleton instance that was initialized by a Windows (graphical mode) entry assembly.

Static method GetPESubsystemID returns this value when queried about the subsystem ID of a Windows (graphical mode) assembly or compiled native program.

Declaration
public const short IMAGE_SUBSYSTEM_WINDOWS_GUI = 2
Field Value
Type Description
System.Int16

Properties

| Improve this Doc View Source

DefaultAppDomainSubsystem

Get the subsystem in which the default application domain executes.

Declaration
public PESubsystemInfo.PESubsystemID DefaultAppDomainSubsystem { get; }
Property Value
Type Description
PESubsystemInfo.PESubsystemID
See Also
| Improve this Doc View Source

DefaultAppDomainSubsystemID

Get the subsystem ID of the default application domain.

Declaration
public short DefaultAppDomainSubsystemID { get; }
Property Value
Type Description
System.Int16
See Also
| Improve this Doc View Source

DefaultDomainEntryAssemblyName

Get the fully qualified AssemblyName of the first assembly that was loaded into the default application domain.

Declaration
public AssemblyName DefaultDomainEntryAssemblyName { get; }
Property Value
Type Description
System.Reflection.AssemblyName
Remarks

AssemblyName has properties that expose the parts of an assembly name, its simple name, version, culture, and public key token.

| Improve this Doc View Source

DomainEntryAssemblyLocation

Get the fully qualified name of the file from which the first assembly that was loaded into the default application domain was read.

Declaration
public string DomainEntryAssemblyLocation { get; }
Property Value
Type Description
System.String

Methods

| Improve this Doc View Source

GetPESubsystem(String)

Use this wrapper to get the PESubsystemID enumeration member equivalent to the integer returned by GetPESubsystemID.

Declaration
public static PESubsystemInfo.PESubsystemID GetPESubsystem(string pstrFileName)
Parameters
Type Name Description
System.String pstrFileName

This string must be the name of a file that can be found in the current security context. Names may be either relative or fully qualified. Relative file names are resolved relative to the current working directory.
Returns
Type Description
PESubsystemInfo.PESubsystemID

If the function succeeds, its return value is a PESubsystemID member that corresponds to the 16-bit integer returned by GetPESubsystemID, which it calls internally.
See Also
| Improve this Doc View Source

GetPESubsystemDescription(Int16, PESubsystemInfo.SubsystemDescription)

Get the short (one or two word) or long (complete, grammatically correct sentence) description that corresponds to a Portable Executable (PE) subsystem ID, such as the value returned by passing a file name to GetPESubsystemID.

Declaration
public static string GetPESubsystemDescription(short pintSubsystemID, PESubsystemInfo.SubsystemDescription penmSubsystemDescription)
Parameters
Type Name Description
System.Int16 pintSubsystemID

Specify the subsystem ID for which the corresponding short or long description is wanted. Suitable inputs include the signed integer returned by GetPESubsystemID, which may be called as a nested method if you have no further use for the subsystem ID.
PESubsystemInfo.SubsystemDescription penmSubsystemDescription

A member of the SubsystemDescription specifies whether to return the short (one or two word) description or the long (complete sentence) description that corresponds to the specified subsystem ID.
Returns
Type Description
System.String

If the function succeeds, the return value is a string containing a short or long description that corresponds to a specified subsystem ID.
Exceptions
Type Condition
System.ArgumentOutOfRangeException

If the subsystem ID specified by argument pintSubsystemID is either negative or greater than the largest valid subsystem ID (9, at present, though future editions of the Microsoft Platform SDK might define additional IDs), an ArgumentOutOfRangeException exception is thrown, which reports the
System.ComponentModel.InvalidEnumArgumentException

An System.ComponentModel.InvalidEnumArgumentException exception is thrown when the second argument, penmSubsystemDescription, is either SubsystemDescription.Unspecified or is not a valid member of the SubsystemDescription enumeration. Unspecified is defined, but marked as invalid to ensure that if penmSubsystemDescription is a variable, it is initialized.
See Also
| Improve this Doc View Source

GetPESubsystemDescription(PESubsystemInfo.PESubsystemID, PESubsystemInfo.SubsystemDescription)

Get the short (one or two word) or long (complete, grammatically correct sentence) description that corresponds to a Portable Executable (PE) subsystem ID, such as the value returned by passing a file name to GetPESubsystemID.

Declaration
public static string GetPESubsystemDescription(PESubsystemInfo.PESubsystemID penmSubsystemID, PESubsystemInfo.SubsystemDescription penmSubsystemDescription)
Parameters
Type Name Description
PESubsystemInfo.PESubsystemID penmSubsystemID

Specify the PESubsystemID enumeration value for which the corresponding string is needed. Suitable inputs include the value returned by GetPESubsystem or the DefaultDomainSubsystem property returned by the singleton instance.
PESubsystemInfo.SubsystemDescription penmSubsystemDescription

A member of the SubsystemDescription specifies whether to return the short (one or two word) description or the long (complete sentence) description that corresponds to the specified subsystem ID.
Returns
Type Description
System.String

If the function succeeds, the return value is a string containing a short or long description that corresponds to a specified subsystem ID.
Remarks

This method casts penmSubsystemID to Int16, and feeds it to GetPESubsystemDescription, since the cast wound be necessary, sooner or later, to use the lookup tables that contain the descriptions.

See Also
| Improve this Doc View Source

GetPESubsystemID(String)

Call this method with the name of a file to get its subsystem ID.

Declaration
public static short GetPESubsystemID(string pstrFileName)
Parameters
Type Name Description
System.String pstrFileName

This string must be the name of a file that can be found in the current security context. Names may be either relative or fully qualified. Relative file names are resolved relative to the current working directory.
Returns
Type Description
System.Int16

If the specified file exists and is a valid Windows Portable Executable (PE) file, its subsystem ID is returned. Since the ID is represented internally as a 16 bit signed integer, the return type of Int16 is guaranteed to be correct, regardless of the machine architecture. Debuggers and stack traces may represent this type as a short, a common alias for Int16.
Exceptions
Type Condition
System.ArgumentException

The following conditions elicit an ArgumentException exception.

  1. String argument pstrFileName is a null reference or points to the empty string.

  2. String argument pstrFileName specifies a file that cannot be found in the current security context.

  3. String argument pstrFileName specifies a file that is too small to contain a valid PE header, let alone its associated code and' data.
System.Exception

The following conditions elicit an Exception (the garden variety exception class) exception.

  1. The file read returned, indicating that fewer than the expected number of bytes was read. This is probably the result of an internal programming error, and is unlikely to arise in practice, since this type of error should elicit an I/O exception.

  2. The Int16 (16 bit signed integer) that marks the start of a valid DOS file header is missing.

  3. The DWORD (32 bit unsigned integer) in the DOS header that should point to the start of the NT header is either null, or it points to a location beyond the first 1024 bytes of the file.

  4. The magic Int32 (32 bit signed integer) that marks the start of the NT header is not where the pointer in the DOS header says it should be.

  5. The I/O subsystem threw an exception. A new garden variety exception object is created, the I/O exception is attached as its InnerException property, and the new exception is thrown up the call stack.

Wrapping the I/O exception in a garden variety exception lets the final exception report include the name of the file that was being processed when the exception arose, which may provide useful clues about its root cause.

  1. A completely unexpected event gave rise to an exception. A new garden variety exception object is created, the original exception is attached as its InnerException property, and the new exception is thrown up the call stack.

Wrapping the original I/O exception in a new exception lets the final exception report include the name of the file that was being processed when the exception arose, which may provide useful clues about its root cause.
See Also
| Improve this Doc View Source

ToString()

Override the default ToString method to display the subsystem type.

Declaration
public override string ToString()
Returns
Type Description
System.String

The returned string resembles the following example.

{{Subsystem ID = Console (3)}} WizardWrx.AssemblyUtils.PESubsystemInfo
Overrides
System.Object.ToString()