PE分析

#include<windows.h>
#include<RichEdit.h>
#include "resource.h"



BOOL CALLBACK DlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam);

//Pe文件处理函数声明

BOOL IsPeFile(LPVOID ImageBase);
PIMAGE_NT_HEADERS    GetNtHeader(LPVOID    ImageBase);
PIMAGE_FILE_HEADER    WINAPI    GetFileHeader(LPVOID    Imagebase);
PIMAGE_OPTIONAL_HEADER    GetOptionalHeader(LPVOID    ImageBase);

int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowcmd)
{
    DialogBox(hInstance, MAKEINTRESOURCE(IDD_DIALOG), NULL, DlgProc);

    return 0;
}


BOOL CALLBACK DlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam)
{


    OPENFILENAME    FileName  = { 0,0,0 }, *lpFileName  = &FileName;
    HANDLE            hFile, hFileMap;
    TCHAR            szPe[] = ""PE File(*.exe)" *.exe;*.dll;*.scr;*.fon;*.drv;"*.All File(*.*) *.*";
    TCHAR            szFileName[256] = { "" };

    LPVOID            lpMemory;

    TCHAR            Buff[16];
    PIMAGE_FILE_HEADER    pFileHeader  = NULL;
    PIMAGE_OPTIONAL_HEADER    pOptionHeader  = NULL;

    switch (message)
    {
    case    WM_INITDIALOG:
        break;
    case    WM_CLOSE:

        EndDialog(hDlg, NULL);
        break;

    case    WM_COMMAND:
        switch (LOWORD(wParam))
        {
        case    IDM_OPEN:
            FileName.hInstance  = (HINSTANCE)hDlg;
            FileName.hwndOwner  = hDlg;
            FileName.lStructSize  = sizeof(OPENFILENAME);
            FileName.lpstrFilter  = szPe;
            FileName.lpstrFile  = szFileName;
            FileName.Flags  = OFN_FILEMUSTEXIST || OFN_PATHMUSTEXIST;
            FileName.nMaxFile  = sizeof(szFileName);


            if (!GetOpenFileName(lpFileName))
            {
                MessageBox(hDlg, "GetOpenFileName 调用失败", "ERROR", NULL);
                break;
            }

            SetDlgItemText(hDlg, IDC_FILENAME, szFileName);

            hFile  = CreateFile(FileName.lpstrFile, // open pe file 

                GENERIC_READ, // open for reading 

                FILE_SHARE_READ || FILE_SHARE_WRITE, // share for reading 

                NULL, // no security 

                OPEN_EXISTING, // existing file only 

                FILE_ATTRIBUTE_NORMAL, // normal file 

                NULL); // no attr. template 


            if (hFile  == INVALID_HANDLE_VALUE)
            {
                MessageBox(hDlg, "Could not open file.", "ERROR", MB_ICONERROR);
                break;// process error 

            }

            if (GetFileSize(hFile, NULL) != 0)
            {
                hFileMap  = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
                if (hFileMap != 0)
                {
                    lpMemory  = MapViewOfFile(hFileMap, FILE_MAP_READ, NULL, NULL, NULL);
                }
            }

            if (IsPeFile(lpMemory))
            {

                pFileHeader  = GetFileHeader(lpMemory);
                pOptionHeader  = GetOptionalHeader(lpMemory);
                if (!(pFileHeader&&pOptionHeader))
                {
                    MessageBox(hDlg, "获取文件头指针失败", "PEINFO", MB_ICONERROR);
                    break;
                }
                else
                {
                    wsprintf(Buff, "%04lX", pFileHeader->Machine);
                    SetDlgItemText(hDlg, IDC_MACHINE, Buff);

                    wsprintf(Buff, "%04lX", pFileHeader->NumberOfSections);
                    SetDlgItemText(hDlg, IDC_NUMSECTION, Buff);

                    wsprintf(Buff, "%04lX", pOptionHeader->Magic);
                    SetDlgItemText(hDlg, IDC_MAGIC, Buff);

                    wsprintf(Buff, "%08lX", pOptionHeader->AddressOfEntryPoint);
                    SetDlgItemText(hDlg, IDC_ENTERPOINT, Buff);

                    wsprintf(Buff, "%08lX", pOptionHeader->DataDirectory[0].VirtualAddress);
                    SetDlgItemText(hDlg, IDC_EDIT_RVA_EXPORT, Buff);

                    wsprintf(Buff, "%08lX", pOptionHeader->DataDirectory[0].Size);
                    SetDlgItemText(hDlg, IDC_EDIT_SIZE_EXPORT, Buff);

                    wsprintf(Buff, "%08lX", pOptionHeader->DataDirectory[1].VirtualAddress);
                    SetDlgItemText(hDlg, IDC_EDIT_RVA_IMPORT, Buff);

                    wsprintf(Buff, "%08lX", pOptionHeader->DataDirectory[1].Size);
                    SetDlgItemText(hDlg, IDC_EDIT_SIZE_IMPORT, Buff);

                    wsprintf(Buff, "%08lX", pOptionHeader->DataDirectory[2].VirtualAddress);
                    SetDlgItemText(hDlg, IDC_EDIT_RVA_RES, Buff);

                    wsprintf(Buff, "%08lX", pOptionHeader->DataDirectory[2].Size);
                    SetDlgItemText(hDlg, IDC_EDIT_SIZE_RES, Buff);



                }


            }
            else
            {
                MessageBox(hDlg, "你选择的不是PE文件", "error", MB_ICONERROR);
                UnmapViewOfFile(lpMemory);
                CloseHandle(hFileMap);
                CloseHandle(hFile);
            }
            UnmapViewOfFile(lpMemory);
            CloseHandle(hFileMap);
            CloseHandle(hFile);

            break;


        }


    }
    return FALSE;
}

BOOL    IsPeFile(LPVOID    ImageBase) //判断是否是PE文件结构

{
    PIMAGE_DOS_HEADER    pDosHeader  = NULL;
    PIMAGE_NT_HEADERS    pNtHeader  = NULL;

    if (!ImageBase)
        return FALSE;
    pDosHeader  = (PIMAGE_DOS_HEADER)ImageBase;
    if (pDosHeader->e_magic  != IMAGE_DOS_SIGNATURE)
        return FALSE;
    pNtHeader  = (PIMAGE_NT_HEADERS32)((DWORD)pDosHeader + pDosHeader->e_lfanew);
    if (pNtHeader->Signature  != IMAGE_NT_SIGNATURE )
        return    FALSE;
    return        TRUE;
}

//FileHeader 内容的读取


PIMAGE_NT_HEADERS    GetNtHeader(LPVOID    ImageBase) //获取NT结构指针

{
    PIMAGE_DOS_HEADER    pDosHeader  = NULL;
    PIMAGE_NT_HEADERS    pNtHeader  = NULL;

    if (!IsPeFile(ImageBase))
        return    NULL;
    pDosHeader  = (PIMAGE_DOS_HEADER)ImageBase;
    pNtHeader  = (PIMAGE_NT_HEADERS32)((DWORD)pDosHeader + pDosHeader->e_lfanew);
    return        pNtHeader;
}

PIMAGE_FILE_HEADER    WINAPI    GetFileHeader(LPVOID    Imagebase)
{
    PIMAGE_FILE_HEADER    pFileHeader;
    PIMAGE_NT_HEADERS    pNtHeader  = NULL;
    pNtHeader  = GetNtHeader(Imagebase);
    if (!pNtHeader)
        return    NULL;
    pFileHeader  = &pNtHeader->FileHeader;
    return    pFileHeader;
}

PIMAGE_OPTIONAL_HEADER    GetOptionalHeader(LPVOID    ImageBase)
{
    PIMAGE_OPTIONAL_HEADER    pOptionHeader  = NULL;
    PIMAGE_NT_HEADERS    pNtHeader  = NULL;
    pNtHeader  = GetNtHeader(ImageBase);
    if (!pNtHeader)
        return    NULL;
    pOptionHeader  = &pNtHeader->OptionalHeader;
    return    pOptionHeader;
}