zoukankan      html  css  js  c++  java
  • PE view---重要参数--C语言实现

    #include<stdio.h>
    #include<windows.h>
    char strPath[100];
    
    	
    	void P_NT_HEADER(FILE *fp,LONG e_lfanew){
    		IMAGE_NT_HEADERS MyNTHeader;
    		fseek(fp,e_lfanew,SEEK_SET);//指针定位到e_lfanew
    		fread(&MyNTHeader,sizeof(DWORD),1,fp);
    		printf("/***************NT_HEADER*************//
    ");
    		printf("Signature:%08x
    ",MyNTHeader.Signature);	
    	}
    	
    	
    	
    	void P_FILE_HEADER(FILE *fp,LONG e_lfanew){
    		IMAGE_FILE_HEADER MyFileHeader;
    		fseek(fp,e_lfanew+sizeof(DWORD),SEEK_SET);
    		fread(&MyFileHeader,sizeof(IMAGE_FILE_HEADER),1,fp);
    		printf("/*********************FILE_HEADER**************/
    ");
    		printf("Machine:%08x
    ",MyFileHeader.Machine);
    		printf("SizeOfOptionalHeade:%08x
    ",MyFileHeader.SizeOfOptionalHeader);
    		printf("Characteristics:%08x
    ",MyFileHeader.Characteristics);
    	}
    	
    	void P_OPTIONAL_HEADER(FILE *fp,LONG e_lfanew){
    		IMAGE_OPTIONAL_HEADER MyOptionalHeader;
    		fseek(fp,e_lfanew+sizeof(DWORD)+sizeof(IMAGE_FILE_HEADER),SEEK_SET);
    		fread(&MyOptionalHeader,sizeof(IMAGE_OPTIONAL_HEADER),1,fp);
    		printf("/****************OPTIONAL_HEADER**************/
    ");
    		printf("Magic:%08x
    ",MyOptionalHeader.Magic);
    		printf("AddressOfEntryPoint:%08x
    ",MyOptionalHeader.AddressOfEntryPoint);
    		printf("ImageBase:%08x
    ",MyOptionalHeader.ImageBase);
    		printf("SectionAlignment:%08x
    ",MyOptionalHeader.SectionAlignment);
    		printf("FileAlignment:%08x
    ",MyOptionalHeader.FileAlignment);
    		printf("SizeOfImage:%08x
    ",MyOptionalHeader.SizeOfImage);
    		printf("SizeOfHeaders:%08x
    ",MyOptionalHeader.SizeOfHeaders);
    		printf("Subsystem:%08x
    ",MyOptionalHeader.Subsystem);
    		printf("NumberOfRvaAndSizes:%08x
    ",MyOptionalHeader.NumberOfRvaAndSizes);
    		
    	}
    	
    	
    	void P_DATA_DIRECTORY(FILE *fp,LONG e_lfanew)
    	{
    		IMAGE_DATA_DIRECTORY MyDataDirectory[16];
    		fseek(fp,e_lfanew+sizeof(IMAGE_NT_HEADERS)-sizeof(IMAGE_DATA_DIRECTORY),SEEK_SET);	
    		for(int i=0;i<16;i++){
    		fread(&MyDataDirectory[i],sizeof(IMAGE_DATA_DIRECTORY),1,fp);
    		}
    		printf("/********************DATA_DIRECTORY***************/
    ");
    		printf("      EXPORT Directory
    ");
    		printf("VirtualAddress:%08x
    ",MyDataDirectory[0].VirtualAddress);
    		printf("Size:%08x
    ",MyDataDirectory[0].Size);
    		/////////////////////////////////////////////////////
    		printf("      IMPORT Directory
    ");
    		printf("VirtualAddress:%08x
    ",MyDataDirectory[1].VirtualAddress);
    		printf("Size:%08x
    ",MyDataDirectory[1].Size);
    		/////////////////////////////////////////////////////////////
    		printf("      RESOURCE Directory
    ");
    		printf("VirtualAddress:%08x
    ",MyDataDirectory[2].VirtualAddress);
    		printf("Size:%08x
    ",MyDataDirectory[2].Size);
    		/////////////////////////////////////////////////////////
    		printf("      BASERELOC Directory
    ");
    		printf("VirtualAddress:%08x
    ",MyDataDirectory[5].VirtualAddress);
    		printf("Size:%08x
    ",MyDataDirectory[5].Size);
    	}
    	void P_DOS_HEADER(FILE *fp){
    		IMAGE_DOS_HEADER MyDosHeader; 
    		LONG e_lfanew;
    		fread(&MyDosHeader,sizeof(IMAGE_DOS_HEADER),1,fp);
    		printf("/*******DOS_HEADER*****/
    ");
    		printf("e_magic:%08x
    ",MyDosHeader.e_magic); 
    		printf("e_lafnew:%08x
    ",MyDosHeader.e_lfanew);
    		e_lfanew=MyDosHeader.e_lfanew;
    		P_NT_HEADER(fp,e_lfanew);
    		P_FILE_HEADER(fp,e_lfanew);
    		P_OPTIONAL_HEADER(fp,e_lfanew);
    		P_DATA_DIRECTORY(fp,e_lfanew);
    		fclose(fp);
    	}
    	
    	
    
    int main(){
    	FILE *fp;
    	printf("输入需要打开文件的地址
    ");
    	scanf("%s",&strPath);
    	fp=fopen(strPath,"rb+");
    	/**传至P_DOS_HEADER**/
    	P_DOS_HEADER(fp);
    	return 0;
    } 
    <img alt="" data-cke-saved-src="https://img-blog.csdn.net/20180105180816070?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvemhpaGVfcmlnaHQ=/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/SouthEast" src="https://img-blog.csdn.net/20180105180816070?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvemhpaGVfcmlnaHQ=/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/SouthEast" />
    更改之后:
    #include<stdio.h>
    #include<windows.h>
    char strPath[100];
    
    	void P_NT_HEADER(FILE *fp,LONG e_lfanew){
    		IMAGE_NT_HEADERS64 MyNTHeader;
    		fseek(fp,e_lfanew,SEEK_SET);//指针定位到e_lfanew
    		fread(&MyNTHeader,sizeof(IMAGE_NT_HEADERS64),1,fp);
    		
    		printf("/***************NT_HEADER*************//
    ");
    		printf("Signature:%08x
    ",MyNTHeader.Signature);	
    		
    		printf("/*********************FILE_HEADER**************/
    ");
    		printf("Machine:%08x
    ",MyNTHeader.FileHeader.Machine);
    		printf("SizeOfOptionalHeade:%08x
    ",MyNTHeader.FileHeader.SizeOfOptionalHeader);
    		printf("Characteristics:%08x
    ",MyNTHeader.FileHeader.Characteristics);
    		
    		printf("/****************OPTIONAL_HEADER**************/
    ");
    		printf("Magic:%08x
    ",MyNTHeader.OptionalHeader.Magic);
    		printf("AddressOfEntryPoint:%08x
    ",MyNTHeader.OptionalHeader.AddressOfEntryPoint);
    		printf("ImageBase:%08x
    ",MyNTHeader.OptionalHeader.ImageBase);
    		printf("SectionAlignment:%08x
    ",MyNTHeader.OptionalHeader.SectionAlignment);
    		printf("FileAlignment:%08x
    ",MyNTHeader.OptionalHeader.FileAlignment);
    		printf("SizeOfImage:%08x
    ",MyNTHeader.OptionalHeader.SizeOfImage);
    		printf("SizeOfHeaders:%08x
    ",MyNTHeader.OptionalHeader.SizeOfHeaders);
    		printf("Subsystem:%08x
    ",MyNTHeader.OptionalHeader.Subsystem);
    		printf("NumberOfRvaAndSizes:%08x
    ",MyNTHeader.OptionalHeader.NumberOfRvaAndSizes);
    		
    		printf("/********************DATA_DIRECTORY***************/
    ");
    		printf("      EXPORT Directory
    ");
    		printf("VirtualAddress:%08x
    ",MyNTHeader.OptionalHeader.DataDirectory[0].VirtualAddress);
    		printf("Size:%08x
    ",MyNTHeader.OptionalHeader.DataDirectory[0].Size);
    		/////////////////////////////////////////////////////
    		printf("      IMPORT Directory
    ");
    		printf("VirtualAddress:%08x
    ",MyNTHeader.OptionalHeader.DataDirectory[1].VirtualAddress);
    		printf("Size:%08x
    ",MyNTHeader.OptionalHeader.DataDirectory[1].Size);
    		/////////////////////////////////////////////////////////////
    		printf("      RESOURCE Directory
    ");
    		printf("VirtualAddress:%08x
    ",MyNTHeader.OptionalHeader.DataDirectory[2].VirtualAddress);
    		printf("Size:%08x
    ",MyNTHeader.OptionalHeader.DataDirectory[2].Size);
    		/////////////////////////////////////////////////////////
    		printf("      BASERELOC Directory
    ");
    		printf("VirtualAddress:%08x
    ",MyNTHeader.OptionalHeader.DataDirectory[5].VirtualAddress);
    		printf("Size:%08x
    ",MyNTHeader.OptionalHeader.DataDirectory[5].Size);
    	}
    	
    	
  • 相关阅读:
    SpringCloud笔记(一)服务注册与发现
    个人备忘录
    ActiveMQ 消息持久化到Mysql数据库
    染色 [组合数 容斥]
    各种图床
    NOIP2012 疫情控制
    网格计数
    找钱 [多重背包 计数]
    序列[势能线段树]
    牛客挑战赛33 B-鸽天的放鸽序列
  • 原文地址:https://www.cnblogs.com/deciduousmap/p/12193726.html
Copyright © 2011-2022 走看看