1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113
| #include<windows.h> #include<stdio.h> #include"main.h" int main() { FILE* fd = fopen("C:\\Users\\xia0ji233\\Desktop\\Home\\C++\\test.exe", "rb"); char* buffer = (char*)malloc(0x100000); if (buffer == NULL) { perror("malloc fail"); exit(0); } if (fd == NULL) { perror("NO such File"); exit(0); } fread(buffer, 1, 0x100000, fd); PIMAGE_DOS_HEADER pheader = (PIMAGE_DOS_HEADER)buffer; printf("MS-DOS INFO:\n"); printf("MAGIC HEADER: "); fwrite((char*)&pheader->e_magic, 2, 1, stdout); putchar(10); printf("PE OFFSET:%x\n", pheader->e_lfanew); printf("PE INFO:\n"); PIMAGE_NT_HEADERS ReadNTHeaders = (PIMAGE_NT_HEADERS)(&(buffer[pheader->e_lfanew]));
printf("PE Magic Header:"); fwrite(&ReadNTHeaders->Signature, 2, 1, stdout); putchar(10);
printf("Standard Header info:"); printf("Platform:"); switch (ReadNTHeaders->FileHeader.Machine) { case IMAGE_FILE_MACHINE_I386: printf("I386"); break; case IMAGE_FILE_MACHINE_IA64: printf("Intel 64"); break; case IMAGE_FILE_MACHINE_AMD64: printf("AMD 64"); break; default: printf("UNKnown Platform"); break; } putchar(10);
printf("Optional PE Header:"); printf("ImageBase:%08x\n", ReadNTHeaders->OptionalHeader.ImageBase);
PIMAGE_SECTION_HEADER ReadSectionHeader = IMAGE_FIRST_SECTION(ReadNTHeaders); PIMAGE_FILE_HEADER pFileHeader = &ReadNTHeaders->FileHeader; for (int i = 0; i < pFileHeader->NumberOfSections; i++) { printf("Name(区段名称):%s\n", ReadSectionHeader[i].Name); printf("Voffset(起始的相对虚拟地址):%08X\n", ReadSectionHeader[i].VirtualAddress); printf("VSize(区段大小):%08X\n", ReadSectionHeader[i].SizeOfRawData); printf("ROffset(文件偏移):%08X\n", ReadSectionHeader[i].PointerToRawData); printf("RSize(文件中区段大小):%08X\n", ReadSectionHeader[i].Misc.VirtualSize); printf("标记(区段的属性):%08X\n\n", ReadSectionHeader[i].Characteristics); } ImportTable(buffer); system("pause"); }
DWORD RvaToFrva(DWORD Rva, char* buffer) { PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)buffer; PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(buffer + pDos->e_lfanew); PIMAGE_SECTION_HEADER pSection = IMAGE_FIRST_SECTION(pNt); if (Rva < pSection[0].VirtualAddress) { return Rva; } for (int i = 0; i < pNt->FileHeader.NumberOfSections; i++) { if (Rva >= pSection[i].VirtualAddress && Rva <= pSection[i].Misc.VirtualSize + pSection[i].VirtualAddress) { return Rva - pSection[i].VirtualAddress + pSection[i].PointerToRawData; } } return Rva; }
void ImportTable(char *buffer) { PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)buffer; PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(buffer + pDos->e_lfanew); PIMAGE_DATA_DIRECTORY pImportDir = (PIMAGE_DATA_DIRECTORY)(pNt->OptionalHeader.DataDirectory+IMAGE_DIRECTORY_ENTRY_IMPORT);
PIMAGE_IMPORT_DESCRIPTOR pImport = (PIMAGE_IMPORT_DESCRIPTOR)(buffer + RvaToFrva(pImportDir->VirtualAddress, buffer));
while (pImport->Name) { char* DllName = (char*)(RvaToFrva(pImport->Name, buffer) + buffer); printf("DllName: %s\n", DllName); printf("日期时间标志:%08X\n", pImport->TimeDateStamp); printf("ForwarderChain:%08X\n", pImport->ForwarderChain); printf("名称OFFSET:%08X\n", pImport->Name); printf("FirstThunk:%08X\n", pImport->FirstThunk); printf("OriginalFirstThunk:%08X\n\n", pImport->OriginalFirstThunk);
PIMAGE_THUNK_DATA pIat = (PIMAGE_THUNK_DATA)(RvaToFrva(pImport->OriginalFirstThunk, buffer) + buffer); DWORD index = 0; DWORD ImportOffset = 0; while (pIat->u1.Ordinal != 0) { PIMAGE_IMPORT_BY_NAME pName = (PIMAGE_IMPORT_BY_NAME)(RvaToFrva(pIat->u1.AddressOfData, buffer) + buffer); printf("API 名称:%s\n", pName->Name); printf("Hint:%04X\n", pName->Hint); printf("ThunkValue:%08X\n\n" ,pIat->u1.Function); pIat++; }
pImport++; }
}
|