How to get software (exe, dll) Version info from a buffer?

[includeh10]

an exe or dll is in memory buffer downloaded from website. How to get the exe or dll version info from memory buffer directly? I don't want to save it then retrieve version info from the saved file. Is it possible? How?

[Orjan Westin]

Yes, it is possible, but quite fiddly. If it's at all possible to save the files and using the Windows API function GetFileVersionInfo I recommend doing that. If not, you can dig into the details of "PE", or the Win32 Portable Executable File Format which describes where to find the version information, among many other things. It's quite a hassle though.

[j_schultz]

There is probably some C/C++ code that does this, but so far I have only seen an implementation in PHP. Maybe you could just translate this to C/C++.

[David Crow]

j_schultz wrote:

...so far I have only seen an implementation in PHP.

Which requires the info to be on disk, yes?

"One man's wage rise is another man's price increase." - Harold Wilson

"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons

"Some people are making such thorough preparation for rainy days that they aren't enjoying today's sunshine." - William Feather

[j_schultz]

It should be simple to rewrite the implementation to work with normal memory chunks instead of real files - as the downloaded file should be in some kind of byte array, you can emulate the fseek / etc. calls by simply advancing a pointer in this array.