pe-signature-offset

Get position of PE signature. As specified by Microsoft PE and COFF Specification 9.3 ^[doc], section 3.2:

After the MS-DOS stub, at the file offset specified at offset 0x3c, is a 4-byte signature that identifies the file as a PE format image file. This signature is PE\0\0 (the letters "P" and "E" followed by two null bytes).

example

const getOffset = require('pe-signature-offset')

getOffset('file.exe', function (err, offset) {
  console.log(offset)
})

getOffset(mixed, callback)

Where mixed is either a filename or a file descriptor.

related

• pe-signature

install

With npm do:

npm install pe-signature-offset

license

MIT © Vincent Weevers