public sealed class EntryPointValidityRule : IValidationRule
{
public string RuleName => nameof(EntryPointValidityRule);
public ValidationSeverity Severity => ValidationSeverity.Error;
public Task<ValidationResult> ValidateAsync(PeImageInfo peInfo, CancellationToken cancellationToken)
{
var ep = peInfo.NtHeaders.OptionalHeader.AddressOfEntryPoint;
var found = peInfo.Sections.Any(s =>
ep >= s.VirtualAddress &&
ep < s.VirtualAddress + Math.Max(s.VirtualSize, s.SizeOfRawData) &&
(s.Characteristics & 0x20000000) != 0);
return Task.FromResult(new ValidationResult(RuleName, Severity, found, found ? "Entry point is valid." : "Entry point not located in executable section."));
}
}