1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
| #include<windows.h>
#include<stdio.h>
#include"main.h"
int main() {
FILE* fd = fopen("C:\\Users\\xia0ji233\\Desktop\\Home\\C++\\test.exe", "rb");
char* buffer = (char*)malloc(0x100000);
if (buffer == NULL) {
perror("malloc fail");
exit(0);
}
if (fd == NULL) {
perror("NO such File");
exit(0);
}
fread(buffer, 1, 0x100000, fd);
PIMAGE_DOS_HEADER pheader = (PIMAGE_DOS_HEADER)buffer;
printf("MS-DOS INFO:\n");
printf("MAGIC HEADER: ");
fwrite((char*)&pheader->e_magic, 2, 1, stdout);
putchar(10);
printf("PE OFFSET:%x\n", pheader->e_lfanew);
printf("PE INFO:\n");
PIMAGE_NT_HEADERS ReadNTHeaders = (PIMAGE_NT_HEADERS)(&(buffer[pheader->e_lfanew]));
printf("PE Magic Header:");
fwrite(&ReadNTHeaders->Signature, 2, 1, stdout);
putchar(10);
printf("Standard Header info:");
printf("Platform:");
switch (ReadNTHeaders->FileHeader.Machine)
{
case IMAGE_FILE_MACHINE_I386:
printf("I386");
break;
case IMAGE_FILE_MACHINE_IA64:
printf("Intel 64");
break;
case IMAGE_FILE_MACHINE_AMD64:
printf("AMD 64");
break;
default:
printf("UNKnown Platform");
break;
}
putchar(10);
printf("Optional PE Header:");
printf("ImageBase:%08x\n", ReadNTHeaders->OptionalHeader.ImageBase);
PIMAGE_SECTION_HEADER ReadSectionHeader = IMAGE_FIRST_SECTION(ReadNTHeaders);
PIMAGE_FILE_HEADER pFileHeader = &ReadNTHeaders->FileHeader;
for (int i = 0; i < pFileHeader->NumberOfSections; i++) {
printf("Name(区段名称)：%s\n", ReadSectionHeader[i].Name);
printf("Voffset(起始的相对虚拟地址)：%08X\n", ReadSectionHeader[i].VirtualAddress);
printf("VSize(区段大小)：%08X\n", ReadSectionHeader[i].SizeOfRawData);
printf("ROffset(文件偏移)：%08X\n", ReadSectionHeader[i].PointerToRawData);
printf("RSize(文件中区段大小)：%08X\n", ReadSectionHeader[i].Misc.VirtualSize);
printf("标记(区段的属性)：%08X\n\n", ReadSectionHeader[i].Characteristics);
}
ImportTable(buffer);
system("pause");
}
DWORD RvaToFrva(DWORD Rva, char* buffer) {
PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)buffer;
PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(buffer + pDos->e_lfanew);
PIMAGE_SECTION_HEADER pSection = IMAGE_FIRST_SECTION(pNt);
if (Rva < pSection[0].VirtualAddress) {
return Rva;
}
for (int i = 0; i < pNt->FileHeader.NumberOfSections; i++) {
if (Rva >= pSection[i].VirtualAddress && Rva <= pSection[i].Misc.VirtualSize + pSection[i].VirtualAddress) {
return Rva - pSection[i].VirtualAddress + pSection[i].PointerToRawData;
}
}
return Rva;
}
void ImportTable(char *buffer) {
PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)buffer;
PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(buffer + pDos->e_lfanew);
PIMAGE_DATA_DIRECTORY pImportDir = (PIMAGE_DATA_DIRECTORY)(pNt->OptionalHeader.DataDirectory+IMAGE_DIRECTORY_ENTRY_IMPORT);
PIMAGE_IMPORT_DESCRIPTOR pImport = (PIMAGE_IMPORT_DESCRIPTOR)(buffer + RvaToFrva(pImportDir->VirtualAddress, buffer));
while (pImport->Name) {
char* DllName = (char*)(RvaToFrva(pImport->Name, buffer) + buffer);
printf("DllName: %s\n", DllName);
printf("日期时间标志：%08X\n", pImport->TimeDateStamp);
printf("ForwarderChain:%08X\n", pImport->ForwarderChain);
printf("名称OFFSET:%08X\n", pImport->Name);
printf("FirstThunk:%08X\n", pImport->FirstThunk);
printf("OriginalFirstThunk:%08X\n\n", pImport->OriginalFirstThunk);
PIMAGE_THUNK_DATA pIat = (PIMAGE_THUNK_DATA)(RvaToFrva(pImport->OriginalFirstThunk, buffer) + buffer);
DWORD index = 0;
DWORD ImportOffset = 0;
while (pIat->u1.Ordinal != 0) {
PIMAGE_IMPORT_BY_NAME pName = (PIMAGE_IMPORT_BY_NAME)(RvaToFrva(pIat->u1.AddressOfData, buffer) + buffer);
printf("API 名称:%s\n", pName->Name);
printf("Hint:%04X\n", pName->Hint);
printf("ThunkValue:%08X\n\n" ,pIat->u1.Function);
pIat++;
}
pImport++;
}
}
|
