zoukankan      html  css  js  c++  java
  • 仿LordPE获取PE结构

    乍一看LordPE一个小工具一般般,真的动手做起来才知道技术含量高的很。

    当前只是获取到PE结构并打印,仅此而已。

    PE.h

     1 #pragma once
     2 #include <stdio.h>
     3 #include <stdarg.h>
     4 
     5 #include <Windows.h>
     6 #include <time.h>
     7 
     8 
     9 HANDLE m_hFile = NULL;                    // 文件句柄
    10 HANDLE m_hMap = NULL;                    // 文件映射句柄
    11 LPVOID m_lpBase = NULL;                    // 映射基址
    12 DWORD m_dwLen = 0;                        // 文件数据大小
    13 IMAGE_DOS_HEADER *m_pDosHeader = NULL;    // Dos头
    14 IMAGE_NT_HEADERS *m_pNtHeaders = NULL;    // NT头
    15 IMAGE_SECTION_HEADER *m_pSecHeader = NULL;
    16 
    17 /*
    18     读取PE磁盘文件
    19     fileUrl:文件路径
    20     lpSaveData:保存数据的指针
    21     成功返回数据大小,失败返回0.
    22 */
    23 DWORD ReadPeFile(char *fileUrl, LPVOID lpSaveData);
    24 
    25 VOID DestroryFunc(void);

    PE.cpp

      1 #include "PE.h"
      2 
      3 DWORD ReadPeFile(char *fileUrl, LPVOID lpSaveData)
      4 {
      5     m_hFile = CreateFile(fileUrl, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
      6     if (m_hFile == INVALID_HANDLE_VALUE)
      7     {
      8         printf("[ReadPeFile]:Can't open file!
    ");
      9         return 0;
     10     }
     11     m_hMap = CreateFileMapping(m_hFile, NULL, PAGE_READWRITE | SEC_IMAGE, 0, 0, 0);
     12     if (!m_hMap)
     13     {
     14         printf("[ReadPeFile]:Can't create filemap!
    ");
     15         return 0;
     16     }
     17     m_lpBase = MapViewOfFile(m_hMap, FILE_MAP_READ | FILE_MAP_WRITE, 0, 0, 0);
     18     if (!m_lpBase)
     19     {
     20         printf("[ReadPeFile]:MapViewOfFile bad!
    ");
     21         return 0;
     22     }
     23     m_dwLen = GetFileSize(m_hFile, &m_dwLen);
     24     m_pDosHeader = (PIMAGE_DOS_HEADER)m_lpBase;
     25     if (m_pDosHeader->e_magic != IMAGE_DOS_SIGNATURE)
     26     {
     27         printf("[ReadPeFile]:Not is pe file!
    ");
     28         return 0;
     29     }
     30     m_pNtHeaders = (PIMAGE_NT_HEADERS)((DWORD)m_lpBase + m_pDosHeader->e_lfanew);
     31     if (m_pNtHeaders->Signature != IMAGE_NT_SIGNATURE)
     32     {
     33         printf("[ReadPeFile]:Not is execut programmer!
    ");
     34         return 0;
     35     }
     36     m_pSecHeader = (PIMAGE_SECTION_HEADER)((DWORD)&(m_pNtHeaders->OptionalHeader) + m_pNtHeaders->FileHeader.SizeOfOptionalHeader);
     37     return m_dwLen;
     38 }
     39 
     40 VOID DestroryFunc(void)
     41 {
     42     CloseHandle(m_hMap);
     43     CloseHandle(m_hFile);
     44     UnmapViewOfFile(m_lpBase);
     45 }
     46 
     47 LPCSTR _getMachineName(WORD wMachine)
     48 {
     49     char *name = (char *)malloc(125);
     50 
     51     switch (wMachine)
     52     {
     53     case 0:
     54         lstrcpy(name, "Unknown");
     55         break;
     56     case 0x14c:
     57         lstrcpy(name, "Intel 386");
     58         break;
     59     case 0x0162:
     60         lstrcpy(name, "MIPS little-endian, 0x160 big-endian");
     61         break;
     62     case 0x0166:
     63         lstrcpy(name, "MIPS little-endian");
     64         break;
     65     case 0x0168:
     66         lstrcpy(name, "MIPS little-endian");
     67         break;
     68     case 0x0169:
     69         lstrcpy(name, "MIPS little-endian WCE v2");
     70         break;
     71     case 0x0184:
     72         lstrcpy(name, "Alpha_AXP");
     73         break;
     74     case 0x01a2:
     75         lstrcpy(name, "SH3 little-endian");
     76         break;
     77     case 0x01a4:
     78         lstrcpy(name, "SH3E little-endian");
     79         break;
     80     case 0x01a6:
     81         lstrcpy(name, "SH4 little-endian");
     82         break;
     83     case 0x01a8:
     84         lstrcpy(name, "SH5");
     85         break;
     86     case 0x01c0:
     87         lstrcpy(name, "ARM Little-Endian");
     88         break;
     89     case 0x01c2:
     90         lstrcpy(name, "ARM Thumb/Thumb-2 Little-Endian");
     91         break;
     92     case 0x01c4:
     93         lstrcpy(name, "ARM Thumb-2 Little-Endian");
     94         break;
     95     case 0x01F0:
     96         lstrcpy(name, "IBM PowerPC Little-Endian");
     97         break;
     98     case 0x0200:
     99         lstrcpy(name, "Intel 64");
    100         break;
    101     case 0x0266:
    102         lstrcpy(name, "MIPS");
    103         break;
    104     case 0x0284:
    105         lstrcpy(name, "ALPHA64");
    106         break;
    107     case 0x0366:
    108         lstrcpy(name, "MIPS");
    109         break;
    110     case 0x0466:
    111         lstrcpy(name, "MIPS");
    112         break;
    113     case 0x0520:
    114         lstrcpy(name, "Infineon");
    115         break;
    116     case 0x0EBC:
    117         lstrcpy(name, "EFI Byte Code");
    118         break;
    119     case 0x8664:
    120         lstrcpy(name, "AMD64 (K8)");
    121         break;
    122     case 0x9041:
    123         lstrcpy(name, "M32R little-endian");
    124         break;
    125     default:
    126         free(name);
    127         return NULL;
    128         break;
    129     }
    130     return name;
    131 }
    132 
    133 VOID _printFormat(char *dataName, WORD *dataAddr, int nSize)
    134 {
    135     printf("	%s:", dataName);
    136     for (int i = 0; i < (int)(13 - strlen(dataName)); i++)
    137     {
    138         printf(" ");
    139     }
    140     printf("0x");
    141     for (int i = 0; i < nSize; i++)
    142     {
    143         printf("%04X", dataAddr[i]);
    144     }
    145     printf("
    ");
    146 }
    147 
    148 VOID test_PrintPeInfo(void)
    149 {
    150     char infoTmp[50] = { 0 };
    151 
    152     printf("->DOS Header
    ");
    153     _printFormat("e_magic", &m_pDosHeader->e_magic, 1);
    154     _printFormat("e_cblp", &m_pDosHeader->e_cblp, 1);
    155     _printFormat("e_cp", &m_pDosHeader->e_cp, 1);
    156     _printFormat("e_crlc", &m_pDosHeader->e_crlc, 1);
    157     _printFormat("e_cparhdr", &m_pDosHeader->e_cparhdr, 1);
    158     _printFormat("e_minalloc", &m_pDosHeader->e_minalloc, 1);
    159     _printFormat("e_maxalloc", &m_pDosHeader->e_maxalloc, 1);
    160     _printFormat("e_ss", &m_pDosHeader->e_ss, 1);
    161     _printFormat("e_sp", &m_pDosHeader->e_sp, 1);
    162     _printFormat("e_csum", &m_pDosHeader->e_csum, 1);
    163     _printFormat("e_ip", &m_pDosHeader->e_ip, 1);
    164     _printFormat("e_cs", &m_pDosHeader->e_cs, 1);
    165     _printFormat("e_lfarlc", &m_pDosHeader->e_lfarlc, 1);
    166     _printFormat("e_ovno", &m_pDosHeader->e_ovno, 1);
    167     _printFormat("e_res", m_pDosHeader->e_res, 4);
    168     _printFormat("e_oeminfo", &m_pDosHeader->e_oemid, 1);
    169     _printFormat("e_oeminfo", &m_pDosHeader->e_oeminfo, 1);
    170     _printFormat("e_res2", m_pDosHeader->e_res2, 10);
    171     printf("	e_lfanew:     0x%08X
    
    ", m_pDosHeader->e_lfanew);
    172     
    173     printf("->File Header
    ");
    174     printf("	Machine:              0x%04X  (%s)
    ", m_pNtHeaders->FileHeader.Machine,_getMachineName(m_pNtHeaders->FileHeader.Machine));
    175     printf("	NumberOfSections:     0x%04X
    ", m_pNtHeaders->FileHeader.NumberOfSections);
    176     struct tm Tm = { 0 };
    177     gmtime_s(&Tm, (time_t *)&(m_pNtHeaders->FileHeader.TimeDateStamp));
    178     printf("	TimeDateStamp:        0x%04X  (%d/%d/%d %d:%d:%d)
    ", m_pNtHeaders->FileHeader.TimeDateStamp, Tm.tm_year + 1900, Tm.tm_mon + 1, Tm.tm_mday, Tm.tm_hour, Tm.tm_min, Tm.tm_sec);
    179     printf("	PointerToSymbolTable: 0x%04X
    ", m_pNtHeaders->FileHeader.PointerToSymbolTable);
    180     printf("	NumberOfSymbols:      0x%04X
    ", m_pNtHeaders->FileHeader.NumberOfSymbols);
    181     printf("	SizeOfOptionalHeader: 0x%04X
    ", m_pNtHeaders->FileHeader.SizeOfOptionalHeader);
    182     printf("	Characteristics:      0x%04X
    
    ", m_pNtHeaders->FileHeader.Characteristics);
    183 
    184     printf("->Optional Header
    ");
    185     printf("	Magic:                       0x%04X",m_pNtHeaders->OptionalHeader.Magic);
    186     switch (m_pNtHeaders->OptionalHeader.Magic)
    187     {
    188     case IMAGE_NT_OPTIONAL_HDR32_MAGIC:
    189         printf("  (HDR32_MAGIC)
    ");
    190         break;
    191     case IMAGE_NT_OPTIONAL_HDR64_MAGIC:
    192         printf("  (HDR64_MAGIC)
    ");
    193         break;
    194     case IMAGE_ROM_OPTIONAL_HDR_MAGIC:
    195         printf("  (ROM_MAGIC)
    ");
    196         break;
    197     default:
    198         printf("  (Unknown)
    ");
    199         break;
    200     }
    201     printf("	MajorLinkerVersion:          0x%02X
    ", m_pNtHeaders->OptionalHeader.MajorLinkerVersion);
    202     printf("	MinorLinkerVersion:          0x%02X  -> %d.%02d
    ", m_pNtHeaders->OptionalHeader.MinorLinkerVersion,m_pNtHeaders->OptionalHeader.MajorLinkerVersion,m_pNtHeaders->OptionalHeader.MinorLinkerVersion);
    203     printf("	SizeOfCode:                  0x%08X
    ", m_pNtHeaders->OptionalHeader.SizeOfCode);
    204     printf("	SizeOfInitializedData:       0x%08X
    ", m_pNtHeaders->OptionalHeader.SizeOfInitializedData);
    205     printf("	SizeOfUninitializedData:     0x%08X
    ", m_pNtHeaders->OptionalHeader.SizeOfUninitializedData);
    206     printf("	AddressOfEntryPoint:         0x%08X
    ", m_pNtHeaders->OptionalHeader.AddressOfEntryPoint);
    207     printf("	BaseOfCode:                  0x%08X
    ", m_pNtHeaders->OptionalHeader.BaseOfCode);
    208     printf("	BaseOfData:                  0x%08X
    ", m_pNtHeaders->OptionalHeader.BaseOfData);
    209     printf("	ImageBase:                   0x%08X
    ", m_pNtHeaders->OptionalHeader.ImageBase);
    210     printf("	SectionAlignment:            0x%08X
    ", m_pNtHeaders->OptionalHeader.SectionAlignment);
    211     printf("	FileAlignment:               0x%08X
    ", m_pNtHeaders->OptionalHeader.FileAlignment);
    212     printf("	MajorOperatingSystemVersion: 0x%08X
    ", m_pNtHeaders->OptionalHeader.MajorOperatingSystemVersion);
    213     printf("	MinorOperatingSystemVersion: 0x%08X  -> %d.%02d
    ", m_pNtHeaders->OptionalHeader.MinorOperatingSystemVersion, m_pNtHeaders->OptionalHeader.MajorOperatingSystemVersion, m_pNtHeaders->OptionalHeader.MinorOperatingSystemVersion);
    214     printf("	MajorImageVersion:           0x%08X
    ", m_pNtHeaders->OptionalHeader.MajorImageVersion);
    215     printf("	MinorImageVersion:           0x%08X  -> %d.%02d
    ", m_pNtHeaders->OptionalHeader.MinorImageVersion, m_pNtHeaders->OptionalHeader.MajorImageVersion, m_pNtHeaders->OptionalHeader.MinorImageVersion);
    216     printf("	MajorSubsystemVersion:       0x%08X
    ", m_pNtHeaders->OptionalHeader.MajorSubsystemVersion);
    217     printf("	MinorSubsystemVersion:       0x%08X  -> %d.%02d
    ", m_pNtHeaders->OptionalHeader.MinorSubsystemVersion, m_pNtHeaders->OptionalHeader.MajorSubsystemVersion, m_pNtHeaders->OptionalHeader.MinorSubsystemVersion);
    218     printf("	Win32VersionValue:           0x%08X
    ", m_pNtHeaders->OptionalHeader.Win32VersionValue);
    219     printf("	SizeOfImage:                 0x%08X
    ", m_pNtHeaders->OptionalHeader.SizeOfImage);
    220     printf("	SizeOfHeaders:               0x%08X
    ", m_pNtHeaders->OptionalHeader.SizeOfHeaders);
    221     printf("	CheckSum:                    0x%08X
    ", m_pNtHeaders->OptionalHeader.CheckSum);
    222     printf("	Subsystem:                   0x%04X", m_pNtHeaders->OptionalHeader.Subsystem);
    223     switch (m_pNtHeaders->OptionalHeader.Subsystem)
    224     {
    225     case IMAGE_SUBSYSTEM_UNKNOWN:
    226         printf("  (Unknown)
    ");
    227             break;
    228     case IMAGE_SUBSYSTEM_NATIVE:
    229         printf("  (Driver And SysPro)
    ");
    230         break;
    231     case IMAGE_SUBSYSTEM_WINDOWS_GUI:
    232         printf("  (Windows_GUI)
    ");
    233         break;
    234     case IMAGE_SUBSYSTEM_WINDOWS_CUI:
    235         printf("  (Windows_CUI)
    ");
    236         break;
    237     case IMAGE_SUBSYSTEM_OS2_CUI:
    238         printf("  (OS/2_CUI)
    ");
    239         break;
    240     case IMAGE_SUBSYSTEM_POSIX_CUI:
    241         printf("  (POSIX_CUI)
    ");
    242         break;
    243     case IMAGE_SUBSYSTEM_WINDOWS_CE_GUI:
    244         printf("  (WinCE_GUI)
    ");
    245         break;
    246     case IMAGE_SUBSYSTEM_EFI_APPLICATION:
    247         printf("  (EFI)
    ");
    248         break;
    249     case IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER:
    250         printf("  (EFI_Driver)
    ");
    251         break;
    252     case IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER:
    253         printf("  (EFI_Dirver Run-Time)
    ");
    254         break;
    255     case IMAGE_SUBSYSTEM_EFI_ROM:
    256         printf("  (EFI_ROM)
    ");
    257         break;
    258     case IMAGE_SUBSYSTEM_XBOX:
    259         printf("  (XBox)
    ");
    260         break;
    261     case IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION:
    262         printf("  (Boot Application)
    ");
    263         break;
    264     default:
    265         printf("  (Unknown!)");
    266         break;
    267     }
    268     printf("	DllCharacteristics:          0x%04X
    ", m_pNtHeaders->OptionalHeader.DllCharacteristics);
    269     printf("	SizeOfStackReserve:          0x%08X
    ", m_pNtHeaders->OptionalHeader.SizeOfStackReserve);
    270     printf("	SizeOfStackCommit:           0x%08X
    ", m_pNtHeaders->OptionalHeader.SizeOfStackCommit);
    271     printf("	SizeOfHeapReserve:           0x%08X
    ", m_pNtHeaders->OptionalHeader.SizeOfHeapReserve);
    272     printf("	LoaderFlags:                 0x%08X
    ", m_pNtHeaders->OptionalHeader.LoaderFlags);
    273     printf("	NumberOfRvaAndSizes:         0x%08X
    
    ", m_pNtHeaders->OptionalHeader.NumberOfRvaAndSizes);
    274 
    275     printf("	DataDirectory(16)            RVA        Size
    ");
    276     printf("	-----------------            ---------- ----------
    ");
    277     for (DWORD dwI = 0; dwI < m_pNtHeaders->OptionalHeader.NumberOfRvaAndSizes; dwI++)
    278     {
    279         switch (dwI)
    280         {
    281         case 0:
    282             printf("	%-29s", "ExportTable");
    283             break;
    284         case 1:
    285             printf("	%-29s", "ImportTable");
    286             break;
    287         case 2:
    288             printf("	%-29s", "Resource");
    289             break;
    290         case 3:
    291             printf("	%-29s", "Exception");
    292             break;
    293         case 4:
    294             printf("	%-29s", "Security");
    295             break;
    296         case 5:
    297             printf("	%-29s", "Relocation");
    298             break;
    299         case 6:
    300             printf("	%-29s", "Debug");
    301             break;
    302         case 7:
    303             printf("	%-29s", "Copyright");
    304             break;
    305         case 8:
    306             printf("	%-29s", "GlobalPtr");
    307             break;
    308         case 9:
    309             printf("	%-29s", "TLSTable");
    310             break;
    311         case 10:
    312             printf("	%-29s", "LoadConfig");
    313             break;
    314         case 11:
    315             printf("	%-29s", "BoundImport");
    316             break;
    317         case 12:
    318             printf("	%-29s", "IAT");
    319             break;
    320         case 13:
    321             printf("	%-29s", "DelayImport");
    322             break;
    323         case 14:
    324             printf("	%-29s", "COM");
    325             break;
    326         case 15:
    327             printf("	%-29s", "Reserved");
    328             break;
    329         default:
    330             printf("	%-29s", "Unknown");
    331             break;
    332         }
    333         printf("0x%08X 0x%08X", m_pNtHeaders->OptionalHeader.DataDirectory[dwI].VirtualAddress, m_pNtHeaders->OptionalHeader.DataDirectory[dwI].Size);
    334         for (WORD wI = 0; wI < m_pNtHeaders->FileHeader.NumberOfSections; wI++)
    335         {
    336             // 如果该数据目录的起始地址>某节起始地址 && 该数据目录的结束地址<某节结束地址,那么就说明该数据目录存在此节中.
    337             if ((m_pSecHeader[wI].VirtualAddress <= m_pNtHeaders->OptionalHeader.DataDirectory[dwI].VirtualAddress) && ((m_pSecHeader[wI].VirtualAddress + m_pSecHeader[wI].Misc.VirtualSize) >= (m_pNtHeaders->OptionalHeader.DataDirectory[dwI].VirtualAddress + m_pNtHeaders->OptionalHeader.DataDirectory[dwI].Size)))
    338             {
    339                 printf("  ("%s")", m_pSecHeader[wI].Name);
    340                 break;
    341             }
    342         }
    343         printf("
    ");
    344     }
    345     return;
    346 }
    347 
    348 int main(void)
    349 {
    350 
    351     LPVOID lpData = NULL;
    352     printf("Hello Pe!
    ");
    353     ReadPeFile("C:\Users\Hades\Desktop\测试程序.exe", lpData);
    354     test_PrintPeInfo();
    355     DestroryFunc();
    356     system("pause");
    357     return 0;
    358 }

    效果图:

    以后有机会我要一步步的仿造出LordPE的所有功能。

  • 相关阅读:
    ExtJs多级联动菜单的一种实现
    初学jquery之自学笔记(2)
    微软MVP评Silverlight的功能特性和价值
    利用XMLFormView在Web部件页中或者自定义页面中嵌入Infopath表单
    初学jquery之自学笔记(3)
    我想大声告诉你
    HTC G7 金卡 制作
    黑苹果配置
    我的Android 从 2.3开始! 开发环境搭建
    新台式机配置表
  • 原文地址:https://www.cnblogs.com/biaoge140/p/9367388.html
Copyright © 2011-2022 走看看