zoukankan      html  css  js  c++  java
  • PE文件格式分析

    void pe_print()
    {
        IMAGE_DOS_HEADER myDosHeader;
        IMAGE_FILE_HEADER myFileHeader;
        int nSectionCount;//PE文件ection数目
        LONG e_lfanew;//为DOS头部的偏移
        FILE *fp;
        if(fp=fopen("e:\1000.exe","rb"))  //打开一个文件
            {
            printf("[+]成功打开了文件 ");
            fread(&myDosHeader,sizeof(IMAGE_DOS_HEADER),1,fp);  //打开一个文件流,读取一个数据块
            e_lfanew = myDosHeader.e_lfanew;  //为DOS头部的偏移
            fseek(fp, (e_lfanew + sizeof(DWORD)), SEEK_SET);
            fread(&myFileHeader,sizeof(IMAGE_FILE_HEADER),1,fp);
            nSectionCount=myFileHeader.NumberOfSections;
            IMAGE_SECTION_HEADER *pmySectionHeader = (IMAGE_SECTION_HEADER *)calloc(nSectionCount, sizeof(IMAGE_SECTION_HEADER));
            fseek(fp, (e_lfanew + sizeof(IMAGE_NT_HEADERS)), SEEK_SET); //从文件起始位置偏移
            fread(pmySectionHeader, sizeof(IMAGE_SECTION_HEADER), nSectionCount, fp);
            int i = 0;
            //printf("%d",nSectionCount);
            for(i = 0; i <nSectionCount; i++,pmySectionHeader++)
                {
                printf("Name: %s ", pmySectionHeader->Name);
                printf("union_PhysicalAddress: %08x ", pmySectionHeader->Misc.PhysicalAddress);
                printf("union_VirtualSize: %04x ", pmySectionHeader->Misc.VirtualSize);
                printf("VirtualAddress: %08x ", pmySectionHeader->VirtualAddress);
                printf("SizeOfRawData: %08x ", pmySectionHeader->SizeOfRawData);
                printf("PointerToRawData: %04x ", pmySectionHeader->PointerToRawData);
                printf("PointerToRelocations: %04x ", pmySectionHeader->PointerToRelocations);
                printf("PointerToLinenumbers: %04x ", pmySectionHeader->PointerToLinenumbers);
                printf("NumberOfRelocations: %04x ", pmySectionHeader->NumberOfRelocations);
                printf("NumberOfLinenumbers: %04x ", pmySectionHeader->NumberOfLinenumbers);
                printf("Charateristics: %04x ", pmySectionHeader->Characteristics);
                }
            if(pmySectionHeader != NULL)          // 释放内存
                {
                free(pmySectionHeader);
                pmySectionHeader = NULL;
                }
            fclose(fp);
            }
        else printf("[-]打开文件失败 ");
    }

    C语言实现打印section信息

  • 相关阅读:
    每日总结
    每日总结
    团队冲刺阶段二(10)
    团队冲刺阶段二(9)
    团队冲刺阶段二(8)
    团队冲刺阶段二(7)
    团队冲刺阶段二(6)
    团队冲刺阶段二(5)
    团队冲刺阶段二(4)
    根据Panda Global了解,中央政治局第十八次集体学习中指出“区块链技术的集成应用在新的技术革新和产业变革中起着重要作用”
  • 原文地址:https://www.cnblogs.com/wj2ge/p/6505042.html
Copyright © 2011-2022 走看看