仿LordPE获取PE结构

乍一看LordPE一个小工具一般般，真的动手做起来才知道技术含量高的很。

当前只是获取到PE结构并打印，仅此而已。

PE.h

#pragma once
#include <stdio.h>
#include <stdarg.h>

#include <Windows.h>
#include <time.h>


HANDLE m_hFile = NULL;                    // 文件句柄
HANDLE m_hMap = NULL;                    // 文件映射句柄
LPVOID m_lpBase = NULL;                    // 映射基址
DWORD m_dwLen = 0;                        // 文件数据大小
IMAGE_DOS_HEADER *m_pDosHeader = NULL;    // Dos头
IMAGE_NT_HEADERS *m_pNtHeaders = NULL;    // NT头
IMAGE_SECTION_HEADER *m_pSecHeader = NULL;

/*
    读取PE磁盘文件
    fileUrl:文件路径
    lpSaveData:保存数据的指针
    成功返回数据大小,失败返回0.
*/
DWORD ReadPeFile(char *fileUrl, LPVOID lpSaveData);

VOID DestroryFunc(void);

PE.cpp

#include "PE.h"

DWORD ReadPeFile(char *fileUrl, LPVOID lpSaveData)
{
    m_hFile = CreateFile(fileUrl, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    if (m_hFile == INVALID_HANDLE_VALUE)
    {
        printf("[ReadPeFile]:Can't open file!
");
        return 0;
    }
    m_hMap = CreateFileMapping(m_hFile, NULL, PAGE_READWRITE | SEC_IMAGE, 0, 0, 0);
    if (!m_hMap)
    {
        printf("[ReadPeFile]:Can't create filemap!
");
        return 0;
    }
    m_lpBase = MapViewOfFile(m_hMap, FILE_MAP_READ | FILE_MAP_WRITE, 0, 0, 0);
    if (!m_lpBase)
    {
        printf("[ReadPeFile]:MapViewOfFile bad!
");
        return 0;
    }
    m_dwLen = GetFileSize(m_hFile, &m_dwLen);
    m_pDosHeader = (PIMAGE_DOS_HEADER)m_lpBase;
    if (m_pDosHeader->e_magic != IMAGE_DOS_SIGNATURE)
    {
        printf("[ReadPeFile]:Not is pe file!
");
        return 0;
    }
    m_pNtHeaders = (PIMAGE_NT_HEADERS)((DWORD)m_lpBase + m_pDosHeader->e_lfanew);
    if (m_pNtHeaders->Signature != IMAGE_NT_SIGNATURE)
    {
        printf("[ReadPeFile]:Not is execut programmer!
");
        return 0;
    }
    m_pSecHeader = (PIMAGE_SECTION_HEADER)((DWORD)&(m_pNtHeaders->OptionalHeader) + m_pNtHeaders->FileHeader.SizeOfOptionalHeader);
    return m_dwLen;
}

VOID DestroryFunc(void)
{
    CloseHandle(m_hMap);
    CloseHandle(m_hFile);
    UnmapViewOfFile(m_lpBase);
}

LPCSTR _getMachineName(WORD wMachine)
{
    char *name = (char *)malloc(125);

    switch (wMachine)
    {
    case 0:
        lstrcpy(name, "Unknown");
        break;
    case 0x14c:
        lstrcpy(name, "Intel 386");
        break;
    case 0x0162:
        lstrcpy(name, "MIPS little-endian, 0x160 big-endian");
        break;
    case 0x0166:
        lstrcpy(name, "MIPS little-endian");
        break;
    case 0x0168:
        lstrcpy(name, "MIPS little-endian");
        break;
    case 0x0169:
        lstrcpy(name, "MIPS little-endian WCE v2");
        break;
    case 0x0184:
        lstrcpy(name, "Alpha_AXP");
        break;
    case 0x01a2:
        lstrcpy(name, "SH3 little-endian");
        break;
    case 0x01a4:
        lstrcpy(name, "SH3E little-endian");
        break;
    case 0x01a6:
        lstrcpy(name, "SH4 little-endian");
        break;
    case 0x01a8:
        lstrcpy(name, "SH5");
        break;
    case 0x01c0:
        lstrcpy(name, "ARM Little-Endian");
        break;
    case 0x01c2:
        lstrcpy(name, "ARM Thumb/Thumb-2 Little-Endian");
        break;
    case 0x01c4:
        lstrcpy(name, "ARM Thumb-2 Little-Endian");
        break;
    case 0x01F0:
        lstrcpy(name, "IBM PowerPC Little-Endian");
        break;
    case 0x0200:
        lstrcpy(name, "Intel 64");
        break;
    case 0x0266:
        lstrcpy(name, "MIPS");
        break;
    case 0x0284:
        lstrcpy(name, "ALPHA64");
        break;
    case 0x0366:
        lstrcpy(name, "MIPS");
        break;
    case 0x0466:
        lstrcpy(name, "MIPS");
        break;
    case 0x0520:
        lstrcpy(name, "Infineon");
        break;
    case 0x0EBC:
        lstrcpy(name, "EFI Byte Code");
        break;
    case 0x8664:
        lstrcpy(name, "AMD64 (K8)");
        break;
    case 0x9041:
        lstrcpy(name, "M32R little-endian");
        break;
    default:
        free(name);
        return NULL;
        break;
    }
    return name;
}

VOID _printFormat(char *dataName, WORD *dataAddr, int nSize)
{
    printf("	%s:", dataName);
    for (int i = 0; i < (int)(13 - strlen(dataName)); i++)
    {
        printf(" ");
    }
    printf("0x");
    for (int i = 0; i < nSize; i++)
    {
        printf("%04X", dataAddr[i]);
    }
    printf("
");
}

VOID test_PrintPeInfo(void)
{
    char infoTmp[50] = { 0 };

    printf("->DOS Header
");
    _printFormat("e_magic", &m_pDosHeader->e_magic, 1);
    _printFormat("e_cblp", &m_pDosHeader->e_cblp, 1);
    _printFormat("e_cp", &m_pDosHeader->e_cp, 1);
    _printFormat("e_crlc", &m_pDosHeader->e_crlc, 1);
    _printFormat("e_cparhdr", &m_pDosHeader->e_cparhdr, 1);
    _printFormat("e_minalloc", &m_pDosHeader->e_minalloc, 1);
    _printFormat("e_maxalloc", &m_pDosHeader->e_maxalloc, 1);
    _printFormat("e_ss", &m_pDosHeader->e_ss, 1);
    _printFormat("e_sp", &m_pDosHeader->e_sp, 1);
    _printFormat("e_csum", &m_pDosHeader->e_csum, 1);
    _printFormat("e_ip", &m_pDosHeader->e_ip, 1);
    _printFormat("e_cs", &m_pDosHeader->e_cs, 1);
    _printFormat("e_lfarlc", &m_pDosHeader->e_lfarlc, 1);
    _printFormat("e_ovno", &m_pDosHeader->e_ovno, 1);
    _printFormat("e_res", m_pDosHeader->e_res, 4);
    _printFormat("e_oeminfo", &m_pDosHeader->e_oemid, 1);
    _printFormat("e_oeminfo", &m_pDosHeader->e_oeminfo, 1);
    _printFormat("e_res2", m_pDosHeader->e_res2, 10);
    printf("	e_lfanew:     0x%08X

", m_pDosHeader->e_lfanew);
    
    printf("->File Header
");
    printf("	Machine:              0x%04X  (%s)
", m_pNtHeaders->FileHeader.Machine,_getMachineName(m_pNtHeaders->FileHeader.Machine));
    printf("	NumberOfSections:     0x%04X
", m_pNtHeaders->FileHeader.NumberOfSections);
    struct tm Tm = { 0 };
    gmtime_s(&Tm, (time_t *)&(m_pNtHeaders->FileHeader.TimeDateStamp));
    printf("	TimeDateStamp:        0x%04X  (%d/%d/%d %d:%d:%d)
", m_pNtHeaders->FileHeader.TimeDateStamp, Tm.tm_year + 1900, Tm.tm_mon + 1, Tm.tm_mday, Tm.tm_hour, Tm.tm_min, Tm.tm_sec);
    printf("	PointerToSymbolTable: 0x%04X
", m_pNtHeaders->FileHeader.PointerToSymbolTable);
    printf("	NumberOfSymbols:      0x%04X
", m_pNtHeaders->FileHeader.NumberOfSymbols);
    printf("	SizeOfOptionalHeader: 0x%04X
", m_pNtHeaders->FileHeader.SizeOfOptionalHeader);
    printf("	Characteristics:      0x%04X

", m_pNtHeaders->FileHeader.Characteristics);

    printf("->Optional Header
");
    printf("	Magic:                       0x%04X",m_pNtHeaders->OptionalHeader.Magic);
    switch (m_pNtHeaders->OptionalHeader.Magic)
    {
    case IMAGE_NT_OPTIONAL_HDR32_MAGIC:
        printf("  (HDR32_MAGIC)
");
        break;
    case IMAGE_NT_OPTIONAL_HDR64_MAGIC:
        printf("  (HDR64_MAGIC)
");
        break;
    case IMAGE_ROM_OPTIONAL_HDR_MAGIC:
        printf("  (ROM_MAGIC)
");
        break;
    default:
        printf("  (Unknown)
");
        break;
    }
    printf("	MajorLinkerVersion:          0x%02X
", m_pNtHeaders->OptionalHeader.MajorLinkerVersion);
    printf("	MinorLinkerVersion:          0x%02X  -> %d.%02d
", m_pNtHeaders->OptionalHeader.MinorLinkerVersion,m_pNtHeaders->OptionalHeader.MajorLinkerVersion,m_pNtHeaders->OptionalHeader.MinorLinkerVersion);
    printf("	SizeOfCode:                  0x%08X
", m_pNtHeaders->OptionalHeader.SizeOfCode);
    printf("	SizeOfInitializedData:       0x%08X
", m_pNtHeaders->OptionalHeader.SizeOfInitializedData);
    printf("	SizeOfUninitializedData:     0x%08X
", m_pNtHeaders->OptionalHeader.SizeOfUninitializedData);
    printf("	AddressOfEntryPoint:         0x%08X
", m_pNtHeaders->OptionalHeader.AddressOfEntryPoint);
    printf("	BaseOfCode:                  0x%08X
", m_pNtHeaders->OptionalHeader.BaseOfCode);
    printf("	BaseOfData:                  0x%08X
", m_pNtHeaders->OptionalHeader.BaseOfData);
    printf("	ImageBase:                   0x%08X
", m_pNtHeaders->OptionalHeader.ImageBase);
    printf("	SectionAlignment:            0x%08X
", m_pNtHeaders->OptionalHeader.SectionAlignment);
    printf("	FileAlignment:               0x%08X
", m_pNtHeaders->OptionalHeader.FileAlignment);
    printf("	MajorOperatingSystemVersion: 0x%08X
", m_pNtHeaders->OptionalHeader.MajorOperatingSystemVersion);
    printf("	MinorOperatingSystemVersion: 0x%08X  -> %d.%02d
", m_pNtHeaders->OptionalHeader.MinorOperatingSystemVersion, m_pNtHeaders->OptionalHeader.MajorOperatingSystemVersion, m_pNtHeaders->OptionalHeader.MinorOperatingSystemVersion);
    printf("	MajorImageVersion:           0x%08X
", m_pNtHeaders->OptionalHeader.MajorImageVersion);
    printf("	MinorImageVersion:           0x%08X  -> %d.%02d
", m_pNtHeaders->OptionalHeader.MinorImageVersion, m_pNtHeaders->OptionalHeader.MajorImageVersion, m_pNtHeaders->OptionalHeader.MinorImageVersion);
    printf("	MajorSubsystemVersion:       0x%08X
", m_pNtHeaders->OptionalHeader.MajorSubsystemVersion);
    printf("	MinorSubsystemVersion:       0x%08X  -> %d.%02d
", m_pNtHeaders->OptionalHeader.MinorSubsystemVersion, m_pNtHeaders->OptionalHeader.MajorSubsystemVersion, m_pNtHeaders->OptionalHeader.MinorSubsystemVersion);
    printf("	Win32VersionValue:           0x%08X
", m_pNtHeaders->OptionalHeader.Win32VersionValue);
    printf("	SizeOfImage:                 0x%08X
", m_pNtHeaders->OptionalHeader.SizeOfImage);
    printf("	SizeOfHeaders:               0x%08X
", m_pNtHeaders->OptionalHeader.SizeOfHeaders);
    printf("	CheckSum:                    0x%08X
", m_pNtHeaders->OptionalHeader.CheckSum);
    printf("	Subsystem:                   0x%04X", m_pNtHeaders->OptionalHeader.Subsystem);
    switch (m_pNtHeaders->OptionalHeader.Subsystem)
    {
    case IMAGE_SUBSYSTEM_UNKNOWN:
        printf("  (Unknown)
");
            break;
    case IMAGE_SUBSYSTEM_NATIVE:
        printf("  (Driver And SysPro)
");
        break;
    case IMAGE_SUBSYSTEM_WINDOWS_GUI:
        printf("  (Windows_GUI)
");
        break;
    case IMAGE_SUBSYSTEM_WINDOWS_CUI:
        printf("  (Windows_CUI)
");
        break;
    case IMAGE_SUBSYSTEM_OS2_CUI:
        printf("  (OS/2_CUI)
");
        break;
    case IMAGE_SUBSYSTEM_POSIX_CUI:
        printf("  (POSIX_CUI)
");
        break;
    case IMAGE_SUBSYSTEM_WINDOWS_CE_GUI:
        printf("  (WinCE_GUI)
");
        break;
    case IMAGE_SUBSYSTEM_EFI_APPLICATION:
        printf("  (EFI)
");
        break;
    case IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER:
        printf("  (EFI_Driver)
");
        break;
    case IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER:
        printf("  (EFI_Dirver Run-Time)
");
        break;
    case IMAGE_SUBSYSTEM_EFI_ROM:
        printf("  (EFI_ROM)
");
        break;
    case IMAGE_SUBSYSTEM_XBOX:
        printf("  (XBox)
");
        break;
    case IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION:
        printf("  (Boot Application)
");
        break;
    default:
        printf("  (Unknown!)");
        break;
    }
    printf("	DllCharacteristics:          0x%04X
", m_pNtHeaders->OptionalHeader.DllCharacteristics);
    printf("	SizeOfStackReserve:          0x%08X
", m_pNtHeaders->OptionalHeader.SizeOfStackReserve);
    printf("	SizeOfStackCommit:           0x%08X
", m_pNtHeaders->OptionalHeader.SizeOfStackCommit);
    printf("	SizeOfHeapReserve:           0x%08X
", m_pNtHeaders->OptionalHeader.SizeOfHeapReserve);
    printf("	LoaderFlags:                 0x%08X
", m_pNtHeaders->OptionalHeader.LoaderFlags);
    printf("	NumberOfRvaAndSizes:         0x%08X

", m_pNtHeaders->OptionalHeader.NumberOfRvaAndSizes);

    printf("	DataDirectory(16)            RVA        Size
");
    printf("	-----------------            ---------- ----------
");
    for (DWORD dwI = 0; dwI < m_pNtHeaders->OptionalHeader.NumberOfRvaAndSizes; dwI++)
    {
        switch (dwI)
        {
        case 0:
            printf("	%-29s", "ExportTable");
            break;
        case 1:
            printf("	%-29s", "ImportTable");
            break;
        case 2:
            printf("	%-29s", "Resource");
            break;
        case 3:
            printf("	%-29s", "Exception");
            break;
        case 4:
            printf("	%-29s", "Security");
            break;
        case 5:
            printf("	%-29s", "Relocation");
            break;
        case 6:
            printf("	%-29s", "Debug");
            break;
        case 7:
            printf("	%-29s", "Copyright");
            break;
        case 8:
            printf("	%-29s", "GlobalPtr");
            break;
        case 9:
            printf("	%-29s", "TLSTable");
            break;
        case 10:
            printf("	%-29s", "LoadConfig");
            break;
        case 11:
            printf("	%-29s", "BoundImport");
            break;
        case 12:
            printf("	%-29s", "IAT");
            break;
        case 13:
            printf("	%-29s", "DelayImport");
            break;
        case 14:
            printf("	%-29s", "COM");
            break;
        case 15:
            printf("	%-29s", "Reserved");
            break;
        default:
            printf("	%-29s", "Unknown");
            break;
        }
        printf("0x%08X 0x%08X", m_pNtHeaders->OptionalHeader.DataDirectory[dwI].VirtualAddress, m_pNtHeaders->OptionalHeader.DataDirectory[dwI].Size);
        for (WORD wI = 0; wI < m_pNtHeaders->FileHeader.NumberOfSections; wI++)
        {
            // 如果该数据目录的起始地址>某节起始地址 && 该数据目录的结束地址<某节结束地址,那么就说明该数据目录存在此节中.
            if ((m_pSecHeader[wI].VirtualAddress <= m_pNtHeaders->OptionalHeader.DataDirectory[dwI].VirtualAddress) && ((m_pSecHeader[wI].VirtualAddress + m_pSecHeader[wI].Misc.VirtualSize) >= (m_pNtHeaders->OptionalHeader.DataDirectory[dwI].VirtualAddress + m_pNtHeaders->OptionalHeader.DataDirectory[dwI].Size)))
            {
                printf("  ("%s")", m_pSecHeader[wI].Name);
                break;
            }
        }
        printf("
");
    }
    return;
}

int main(void)
{

    LPVOID lpData = NULL;
    printf("Hello Pe!
");
    ReadPeFile("C:\Users\Hades\Desktop\测试程序.exe", lpData);
    test_PrintPeInfo();
    DestroryFunc();
    system("pause");
    return 0;
}

效果图：

以后有机会我要一步步的仿造出LordPE的所有功能。