PE相关代码

发布时间:2014-10-25 2:19:39
来源:分享查询网

查看PE文件重定位表 #include "stdafx.h"#include <Windows.h> DWORD RVA2Offset(PIMAGE_NT_HEADERS pNTHeader, DWORD dwRVA){    PIMAGE_SECTION_HEADER pSection = (PIMAGE_SECTION_HEADER)((DWORD)pNTHeader + sizeof(IMAGE_NT_HEADERS));     for(int i = 0; i < pNTHeader->FileHeader.NumberOfSections; i++)    {        if(dwRVA >= pSection[i].VirtualAddress && dwRVA < (pSection[i].VirtualAddress + pSection[i].SizeOfRawData))        {            return pSection[i].PointerToRawData + (dwRVA - pSection[i].VirtualAddress);        }    }     return 0;} int _tmain(int argc, _TCHAR* argv[]){    HANDLE hFile = CreateFile(argv[1], GENERIC_ALL, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL);    HANDLE hMapping = CreateFileMapping(hFile, NULL, PAGE_READWRITE, 0, 0, NULL);    PVOID pbFile = MapViewOfFile(hMapping, FILE_MAP_ALL_ACCESS, 0, 0, 0);     if(INVALID_HANDLE_VALUE == hFile || NULL == hMapping || NULL == pbFile)    {        printf("/n/t---------- The File Inexistence! ----------/n");        goto EXIT;    }     PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)pbFile;    PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pbFile + pDosHeader->e_lfanew);     if(0x00004550 != pNTHeader->Signature)    {        printf("/n/t---------- Lawless PE File! ----------/n");        goto EXIT;    }     DWORD dwRelocOffset = RVA2Offset(pNTHeader, pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress);    PIMAGE_BASE_RELOCATION pReloc = (PIMAGE_BASE_RELOCATION)((DWORD)pbFile + dwRelocOffset);     if(0 == pReloc->VirtualAddress)    {        printf("/n/t---------- No Relocation Table! ----------/n");        goto EXIT;    }     while(pReloc->VirtualAddress)    {        printf("[0x%08X]/n/n", pReloc->VirtualAddress);         for(int i = 0; i < (pReloc->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / 2; i++)        {            printf("   <%04d> - 0x%08X/n", i, pReloc->VirtualAddress + ((*(WORD*)((DWORD)pReloc + sizeof(IMAGE_BASE_RELOCATION) + i * 2)) & 0x0FFF));        }         printf("/n");         pReloc = (PIMAGE_BASE_RELOCATION)((DWORD)pReloc + pReloc->SizeOfBlock);    } EXIT:    if(NULL != pbFile)    {        UnmapViewOfFile(pbFile);    }     if(NULL != hMapping)    {        CloseHandle(hMapping);    }     if (INVALID_HANDLE_VALUE != hFile)    {        CloseHandle(hFile);    }     return 0;}   查看PE文件导出表 #include "stdafx.h"#include <Windows.h> DWORD RVA2Offset(PIMAGE_NT_HEADERS pNTHeader, DWORD dwRVA){    PIMAGE_SECTION_HEADER pSection = (PIMAGE_SECTION_HEADER)((DWORD)pNTHeader + sizeof(IMAGE_NT_HEADERS));     for(int i = 0; i < pNTHeader->FileHeader.NumberOfSections; i++)    {        if(dwRVA >= pSection[i].VirtualAddress && dwRVA < (pSection[i].VirtualAddress + pSection[i].SizeOfRawData))        {            return pSection[i].PointerToRawData + (dwRVA - pSection[i].VirtualAddress);        }    }     return 0;} int _tmain(int argc, _TCHAR* argv[]){    HANDLE hFile = CreateFile(argv[1], GENERIC_ALL, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL);    HANDLE hMapping = CreateFileMapping(hFile, NULL, PAGE_READWRITE, 0, 0, NULL);    PVOID pbFile = MapViewOfFile(hMapping, FILE_MAP_ALL_ACCESS, 0, 0, 0);     if(INVALID_HANDLE_VALUE == hFile || NULL == hMapping || NULL == pbFile)    {        printf("/n/t---------- The File Inexistence! ----------/n");        goto EXIT;    }     PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)pbFile;    PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pbFile + pDosHeader->e_lfanew);     if(0x00004550 != pNTHeader->Signature)    {        printf("/n/t---------- Lawless PE File! ----------/n");        goto EXIT;    }     DWORD dwExportOffset = RVA2Offset(pNTHeader, pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);    PIMAGE_EXPORT_DIRECTORY pExport = (PIMAGE_EXPORT_DIRECTORY)((DWORD)pbFile + dwExportOffset);    DWORD dwFunctionNameOffset = (DWORD)pbFile + RVA2Offset(pNTHeader, pExport->Name);    DWORD* pdwNamesAddress = (DWORD*)((DWORD)pbFile + RVA2Offset(pNTHeader, pExport->AddressOfNames));    DWORD* pdwFunctionAddress = (DWORD*)((DWORD)pbFile + RVA2Offset(pNTHeader, pExport->AddressOfFunctions));    WORD* pwOrdinals = (WORD*)((DWORD)pbFile + RVA2Offset(pNTHeader, pExport->AddressOfNameOrdinals));     if(0 == pExport->NumberOfFunctions)    {        printf("/n/t---------- No Export Tabel! ----------/n");        goto EXIT;    }        printf("FileName: %s/n", dwFunctionNameOffset);    printf("NumberOfFunctions: %d/n", pExport->NumberOfFunctions);    printf("NumberOfNames: %d/n/n", pExport->NumberOfNames);    printf("NameExport:/n/n");     for(int i = 0; i < pExport->NumberOfNames; i++)    {        DWORD dwFunctionAddress = pdwFunctionAddress[pwOrdinals[i]];        DWORD pdwFunNameOffset = (DWORD)pbFile + RVA2Offset(pNTHeader, pdwNamesAddress[i]);         printf("[ExportNum]: %-4d  [Name]: %-30s  [RVA]: 0x%08X/n", pExport->Base + i, pdwFunNameOffset, dwFunctionAddress);    }     printf("/nNumberExport:/n/n");     for(int i = 0; i < pExport->NumberOfFunctions - pExport->NumberOfNames; i++)    {        printf("[ExportNum]: %-4d  [RVA]: 0x%08X/n", pExport->Base + i, pdwFunctionAddress[i]);    }     printf("/n"); EXIT:    if(NULL != pbFile)    {        UnmapViewOfFile(pbFile);    }     if(NULL != hMapping)    {        CloseHandle(hMapping);    }     if (INVALID_HANDLE_VALUE != hFile)    {        CloseHandle(hFile);    }     return 0;}   查看PE文件导入表 这个博客空间主席帮申请下来快一年了,都快忘了。最近一直在学习PE文件,贴段代码,功能如题,自己学习写的练习程序,VC2005编译,控制台程序,有很多不严谨和不完善的地方! #include "stdafx.h"#include <Windows.h> DWORD RVA2Offset(PIMAGE_NT_HEADERS pNTHeader, DWORD dwRVA){    PIMAGE_SECTION_HEADER pSection = (PIMAGE_SECTION_HEADER)((DWORD)pNTHeader + sizeof(IMAGE_NT_HEADERS));     for(int i = 0; i < pNTHeader->FileHeader.NumberOfSections; i++)    {        if(dwRVA >= pSection[i].VirtualAddress && dwRVA < (pSection[i].VirtualAddress + pSection[i].SizeOfRawData))        {            return pSection[i].PointerToRawData + (dwRVA - pSection[i].VirtualAddress);        }    }     return 0;} int _tmain(int argc, _TCHAR* argv[]){    HANDLE hFile = CreateFile(argv[1], GENERIC_ALL, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL);    HANDLE hMapping = CreateFileMapping(hFile, NULL, PAGE_READWRITE, 0, 0, NULL);    PVOID pbFile = MapViewOfFile(hMapping, FILE_MAP_ALL_ACCESS, 0, 0, 0);     if(INVALID_HANDLE_VALUE == hFile || NULL == hMapping || NULL == pbFile)    {        printf("/n/t---------- The File Inexistence! ----------/n");        goto EXIT;    }     PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)pbFile;    PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pbFile + pDosHeader->e_lfanew);     if(0x00004550 != pNTHeader->Signature)    {        printf("/n/t---------- Lawless PE File! ----------/n");        goto EXIT;    }     DWORD dwImportOffset = RVA2Offset(pNTHeader, pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);    PIMAGE_IMPORT_DESCRIPTOR pImport = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD)pbFile + dwImportOffset);     DWORD dwOriginalThunkOffset = 0;    DWORD dwThunkData = 0;    PIMAGE_IMPORT_BY_NAME pImageFunName = NULL;    PIMAGE_THUNK_DATA pThunkData = NULL;     for(int i = 0; i < pNTHeader->OptionalHeader.DataDirectory[1].Size / sizeof(IMAGE_IMPORT_DESCRIPTOR) - 1; i++)    {        printf("[DLL Name]: %s/n/n", ((DWORD)pbFile + RVA2Offset(pNTHeader, pImport[i].Name)));         pThunkData = (PIMAGE_THUNK_DATA)((DWORD)pbFile + RVA2Offset(pNTHeader, pImport[i].FirstThunk));         for(int j = 0; pThunkData[j].u1.Ordinal != 0; j++)        {            if(pThunkData[j].u1.Ordinal & IMAGE_ORDINAL_FLAG32)            {                printf("    [%03d]  ---  Number: %04d    Name: <NULL>/n", j + 1, pThunkData[j].u1.Ordinal & 0xFFFF);            }            else            {                pImageFunName = (PIMAGE_IMPORT_BY_NAME)((DWORD)pbFile + RVA2Offset(pNTHeader, pThunkData[j].u1.AddressOfData));                printf("    [%03d]  ---  Number: %04d    Name: %s/n", j + 1, pImageFunName->Hint, pImageFunName->Name);            }        }         printf("/n");    } EXIT:    if(NULL != pbFile)    {        UnmapViewOfFile(pbFile);    }     if(NULL != hMapping)    {        CloseHandle(hMapping);    }     if (INVALID_HANDLE_VALUE != hFile)    {        CloseHandle(hFile);    }     return 0;} 

返回顶部
查看电脑版