How thefocusman/nt_file_reader works
This repository is a Windows PE-image toolkit: its console reader inspects executable headers and import/export metadata, while a separate loader implements image-loading support and companion programs replace Authenticode signature data or execute files. The reader maps a file, interprets its PE structures, and reports details; the loader handles relocation, import resolution, and module caching. Pointer abstractions and native-process structures support low-level memory access. The README is empty, so capabilities and relationships here are limited to the tree and shown source/index references; unsampled subsystem links are omitted where evidence is insufficient.
Main entry points: NT File Reader/Program.cs PE reader · Extentions.cs Image operations · LibraryLoader.cs Library loader · ImageSignature Replacer/Program.cs Signature replacer
Components 22
User tools
- PE reader
NT File Reader/Program.cs - Signature replacer
ImageSignature Replacer/Program.cs - File executer
NT File Executer/Program.cs
PE inspection
- PE structures
NT File Reader/System/Reflection/PortableExecutable - DOS header
NT File Reader/System/Reflection/PortableExecutable/DOSHeader.cs - File header
NT File Reader/System/Reflection/PortableExecutable/FileHeader.cs - PE32 optional header
NT File Reader/System/Reflection/PortableExecutable/OptionalHeaders32.cs - PE32+ optional header
NT File Reader/System/Reflection/PortableExecutable/OptionalHeaders64.cs - Export directory
NT File Reader/System/Reflection/PortableExecutable/ExportDirectory.cs - Section headers
NT File Reader/System/Reflection/PortableExecutable/SectionHeader.cs - Import descriptors
NT File Reader/ImportDescriptor.cs
Image loading
- Image operations
NT File Reader/Extentions.cs - Library loader
NT File Reader/LibraryLoader.cs - API call shims
NT File Reader/CustomApiCalls.cs
Native memory
- Mapped file
NT File Reader/CMemoryMappedFile.cs - Safe pointers
NT File Reader/SafePointer.cs - Read-only pointers
NT File Reader/ReadOnlySafePointer.cs - Pointer extensions
NT File Reader/SafePointerExtentions.cs - Allocated pointers
NT File Reader/AllocatedPointer.cs - Process structures
NT File Reader/WindowsNative/PEB.cs
Other components
- CLI user
- Windows APIs
Connections 26
- CLI user → PE reader: requests inspection
NT File Reader/Program.cs - PE reader → Mapped file: maps file
NT File Reader/Program.cs - PE reader → DOS header: reads header
NT File Reader/Program.cs - PE reader → PE structures: parses PE data
NT File Reader/Program.cs - PE reader → Export directory: lists exports
NT File Reader/Program.cs - PE reader → Import descriptors: reads imports
NT File Reader/Program.cs - PE reader → Read-only pointers: reads strings
NT File Reader/Program.cs - CLI user → Signature replacer: requests replacement
ImageSignature Replacer/Program.cs - Signature replacer → DOS header: validates image
ImageSignature Replacer/Program.cs - Signature replacer → PE32 optional header: reads PE fields
ImageSignature Replacer/Program.cs - Signature replacer → PE32+ optional header: reads PE fields
ImageSignature Replacer/Program.cs - CLI user → File executer: requests execution
NT File Executer/Program.cs - File executer → Image operations: uses extensions
NT File Executer/Program.cs - Image operations → Library loader: loads libraries
NT File Reader/Extentions.cs - Image operations → Allocated pointers: allocates memory
NT File Reader/Extentions.cs - Image operations → Safe pointers: accesses image
NT File Reader/Extentions.cs - Image operations → DOS header: validates image
NT File Reader/Extentions.cs - Library loader → API call shims: uses API shims
NT File Reader/LibraryLoader.cs - Library loader → Process structures: reads process state
NT File Reader/LibraryLoader.cs - Library loader → Windows APIs: queries modules
NT File Reader/LibraryLoader.cs - API call shims → Image operations: dispatches calls
NT File Reader/CustomApiCalls.cs - API call shims → Library loader: loads libraries
NT File Reader/CustomApiCalls.cs - Safe pointers → Pointer extensions: uses extensions
NT File Reader/SafePointer.cs - Read-only pointers → Pointer extensions: uses extensions
NT File Reader/ReadOnlySafePointer.cs - Mapped file → Safe pointers: uses pointers
NT File Reader/CMemoryMappedFile.cs - Process structures → Safe pointers: uses pointers
NT File Reader/WindowsNative/PEB.cs