zoukankan      html  css  js  c++  java
  • PE文件格式分析

    void pe_print()
    {
        IMAGE_DOS_HEADER myDosHeader;
        IMAGE_FILE_HEADER myFileHeader;
        int nSectionCount;//PE文件ection数目
        LONG e_lfanew;//为DOS头部的偏移
        FILE *fp;
        if(fp=fopen("e:\1000.exe","rb"))  //打开一个文件
            {
            printf("[+]成功打开了文件 ");
            fread(&myDosHeader,sizeof(IMAGE_DOS_HEADER),1,fp);  //打开一个文件流,读取一个数据块
            e_lfanew = myDosHeader.e_lfanew;  //为DOS头部的偏移
            fseek(fp, (e_lfanew + sizeof(DWORD)), SEEK_SET);
            fread(&myFileHeader,sizeof(IMAGE_FILE_HEADER),1,fp);
            nSectionCount=myFileHeader.NumberOfSections;
            IMAGE_SECTION_HEADER *pmySectionHeader = (IMAGE_SECTION_HEADER *)calloc(nSectionCount, sizeof(IMAGE_SECTION_HEADER));
            fseek(fp, (e_lfanew + sizeof(IMAGE_NT_HEADERS)), SEEK_SET); //从文件起始位置偏移
            fread(pmySectionHeader, sizeof(IMAGE_SECTION_HEADER), nSectionCount, fp);
            int i = 0;
            //printf("%d",nSectionCount);
            for(i = 0; i <nSectionCount; i++,pmySectionHeader++)
                {
                printf("Name: %s ", pmySectionHeader->Name);
                printf("union_PhysicalAddress: %08x ", pmySectionHeader->Misc.PhysicalAddress);
                printf("union_VirtualSize: %04x ", pmySectionHeader->Misc.VirtualSize);
                printf("VirtualAddress: %08x ", pmySectionHeader->VirtualAddress);
                printf("SizeOfRawData: %08x ", pmySectionHeader->SizeOfRawData);
                printf("PointerToRawData: %04x ", pmySectionHeader->PointerToRawData);
                printf("PointerToRelocations: %04x ", pmySectionHeader->PointerToRelocations);
                printf("PointerToLinenumbers: %04x ", pmySectionHeader->PointerToLinenumbers);
                printf("NumberOfRelocations: %04x ", pmySectionHeader->NumberOfRelocations);
                printf("NumberOfLinenumbers: %04x ", pmySectionHeader->NumberOfLinenumbers);
                printf("Charateristics: %04x ", pmySectionHeader->Characteristics);
                }
            if(pmySectionHeader != NULL)          // 释放内存
                {
                free(pmySectionHeader);
                pmySectionHeader = NULL;
                }
            fclose(fp);
            }
        else printf("[-]打开文件失败 ");
    }

    C语言实现打印section信息

  • 相关阅读:
    MVC调用SVC无法找到资源解决问题
    动态更改iframe src
    http改成https wcf 配置更改
    Nuget 管理报repositories.config 访问路径被拒绝 解决办法
    如何在水晶报表中动态添加字段
    VS2.0控件之日历《Calendar》C#
    C#操作Excel全源码
    如何向水晶报表数据源中的存储过程传参数……
    公式的典型用途
    水晶报表公式使用必读
  • 原文地址:https://www.cnblogs.com/wj2ge/p/6505042.html
Copyright © 2011-2022 走看看