Access to IMAGE_NT_HEADER

How to Access the IMAGE_NT_HEADER structure

after initialize the PE class you can get access the IMAGE_NT_HEADER structure by calling GetImageNtHeader() method. by calling this function, you get the object of ImageNtHeader class, so you can retrieve IMAGE_NT_HEADER fields, changed or modify them.

Note: Every field in ImageNtHeader class has two overload method. first overload is getter function to just retrieve the specific field and second overload is a Setter for change and modify the specific field.

#include <iostream>
#include <POEX.h> // include POEX header

int main()
{
    auto pe = POEX::PE(L"1.exe");

    // Access to Image Nt Header
    auto nt = pe.GetImageNtHeader();
    
    // Access to 'Signature' and print it in console as hex string;
    std::cout << "Signature: 0x" << std::hex << nt.Signature();

    /// Change the value of `signature' field 
    nt.Signature(17745);

    // print again the `signature' field for seeing change
    std::cout << "Signature: 0x" << std::hex << nt.Signature();

    return 0;
}

List of all available method in ImageNtHeader class

auto Signature() const ->unsigned int;
auto Signature(const unsigned int& signature)->void;

auto FileHeader() const->ImageFileHeader;

auto OptionalHeader() const->ImageOptionalHeader;