public sealed class SectionAlignmentRule : IValidationRule
{
public string RuleName => nameof(SectionAlignmentRule);
public ValidationSeverity Severity => ValidationSeverity.Warning;
public Task<ValidationResult> ValidateAsync(PeImageInfo peInfo, CancellationToken cancellationToken)
{
var sectionAlignment = peInfo.NtHeaders.OptionalHeader.SectionAlignment;
var fileAlignment = peInfo.NtHeaders.OptionalHeader.FileAlignment;
var ok = sectionAlignment >= fileAlignment && fileAlignment != 0;
return Task.FromResult(new ValidationResult(RuleName, Severity, ok, ok ? "Alignment looks valid." : "Suspicious section/file alignment."));
}
}