zoukankan      html  css  js  c++  java
  • PE文件格式分析

    void pe_print()
    {
        IMAGE_DOS_HEADER myDosHeader;
        IMAGE_FILE_HEADER myFileHeader;
        int nSectionCount;//PE文件ection数目
        LONG e_lfanew;//为DOS头部的偏移
        FILE *fp;
        if(fp=fopen("e:\1000.exe","rb"))  //打开一个文件
            {
            printf("[+]成功打开了文件 ");
            fread(&myDosHeader,sizeof(IMAGE_DOS_HEADER),1,fp);  //打开一个文件流,读取一个数据块
            e_lfanew = myDosHeader.e_lfanew;  //为DOS头部的偏移
            fseek(fp, (e_lfanew + sizeof(DWORD)), SEEK_SET);
            fread(&myFileHeader,sizeof(IMAGE_FILE_HEADER),1,fp);
            nSectionCount=myFileHeader.NumberOfSections;
            IMAGE_SECTION_HEADER *pmySectionHeader = (IMAGE_SECTION_HEADER *)calloc(nSectionCount, sizeof(IMAGE_SECTION_HEADER));
            fseek(fp, (e_lfanew + sizeof(IMAGE_NT_HEADERS)), SEEK_SET); //从文件起始位置偏移
            fread(pmySectionHeader, sizeof(IMAGE_SECTION_HEADER), nSectionCount, fp);
            int i = 0;
            //printf("%d",nSectionCount);
            for(i = 0; i <nSectionCount; i++,pmySectionHeader++)
                {
                printf("Name: %s ", pmySectionHeader->Name);
                printf("union_PhysicalAddress: %08x ", pmySectionHeader->Misc.PhysicalAddress);
                printf("union_VirtualSize: %04x ", pmySectionHeader->Misc.VirtualSize);
                printf("VirtualAddress: %08x ", pmySectionHeader->VirtualAddress);
                printf("SizeOfRawData: %08x ", pmySectionHeader->SizeOfRawData);
                printf("PointerToRawData: %04x ", pmySectionHeader->PointerToRawData);
                printf("PointerToRelocations: %04x ", pmySectionHeader->PointerToRelocations);
                printf("PointerToLinenumbers: %04x ", pmySectionHeader->PointerToLinenumbers);
                printf("NumberOfRelocations: %04x ", pmySectionHeader->NumberOfRelocations);
                printf("NumberOfLinenumbers: %04x ", pmySectionHeader->NumberOfLinenumbers);
                printf("Charateristics: %04x ", pmySectionHeader->Characteristics);
                }
            if(pmySectionHeader != NULL)          // 释放内存
                {
                free(pmySectionHeader);
                pmySectionHeader = NULL;
                }
            fclose(fp);
            }
        else printf("[-]打开文件失败 ");
    }

    C语言实现打印section信息

  • 相关阅读:
    PHP开发经常遇到的几个错误
    PHP的Trait
    PHP反射API
    php split 和 explode 的区别
    php判断检测一个数组里有没有重复的值
    PHP serialize 和 JSON 解析与区别
    php 单文件上传
    php 数组 类对象 值传递 引用传递 区别
    六. 网络编程(解决黏包TCP)
    五. 网络编程(UDP 不黏包)
  • 原文地址:https://www.cnblogs.com/wj2ge/p/6505042.html
Copyright © 2011-2022 走看看