C语言编写控制台下PE分析工具（二）

五、输出数据目录表信息

由于数据目录数组中包含16个元素，所以循环16次，依次输出每个数据目录表的信息：

void ShowDataDirInfo(PMAP_FILE_STRUCT stMapFile)
{
char strTmp[9] = { 0 };
char data[16][50] = {
"Export Table:",
"Import Table:",
"Resource:    ",
"Exception:   ",
"Security:    ",
"Relocation:  ",
"Debug:       ",
"Copyright:   ",
"Globalptr:   ",
"Tls Table:   ",
"LoadConfig:  ",
"IAT:         ",
"Bound Import:",
"COM:         ",
"Delay Import:",
"No Use:      "
};


PIMAGE_OPTIONAL_HEADER pOH = nullptr;
pOH = GetOptionalHeader(stMapFile->ImageBase);
if (!pOH)
{
return;
}
printf("\n\n[Data Directory]\n");
printf("\t\t\t  RVA\t\t\t  Size\n");
for (int i = 0; i < 16; i++)
{
printf("%s\t\t%08lX\t\t%08lX\n", data[i], pOH->DataDirectory[i].VirtualAddress, pOH->DataDirectory[i].Size);
}
}

结果如下图所示：

六、输出区块表信息

首先获取指向第一个区块表的指针

PIMAGE_SECTION_HEADER  GetFirstSectionHeader(LPVOID ImageBase)
{
if (!ImageBase)
{
return nullptr;
}


PIMAGE_NT_HEADERS pNH = nullptr;
PIMAGE_SECTION_HEADER pSH = nullptr;
pNH = GetNtHeaders(ImageBase);
if (!pNH)
{
return nullptr;
}


pSH = IMAGE_FIRST_SECTION(pNH);
return pSH;
}

然后根据IMAGE_FILE_HEADER中的SizeOfOptionalHeader判断区块表的数目，循环输出每一个区块表：

void ShowSectionHeaderInfo(PMAP_FILE_STRUCT stMapFile)
{
PIMAGE_FILE_HEADER pFH = nullptr;
PIMAGE_SECTION_HEADER pSH = nullptr;


pFH = GetFileHeader(stMapFile->ImageBase);
if (!pFH)
{
return;
}


WORD OptionalLength = pFH->SizeOfOptionalHeader;
PIMAGE_OPTIONAL_HEADER pOH = GetOptionalHeader(stMapFile->ImageBase);
pSH = (PIMAGE_SECTION_HEADER)((DWORD)pOH + OptionalLength);


printf("\n\n[Section Table]\n");
printf(" Name    VAddress   VSize    RAddress   RSize     Flags\n");
for (int i = 0; i < pFH->NumberOfSections; i++)
{
printf("%s\t%08lX  %08lX  %08lX  %08lX  %08lX\n", pSH->Name, pSH->VirtualAddress, pSH->Misc, 
pSH->PointerToRawData, pSH->SizeOfRawData, pSH->Characteristics);
pSH++;
}
}

结果如图所示：

主函数：

MAP_FILE_STRUCT stMapFile = { nullptr, nullptr, nullptr };

int main()
{
LPTSTR filePath = TEXT("D:\\PEInfo_example.exe");
UnLoadFile(&stMapFile);
if (!LoadFile(filePath, &stMapFile))
{
return -1;
}


if (!IsPEFile(stMapFile.ImageBase))
{
UnLoadFile(&stMapFile);
return -1;
}

ShowFileHeaderInfo(&stMapFile);

ShowDataDirInfo(&stMapFile);
ShowSectionHeaderInfo(&stMapFile);

UnLoadFile(&stMapFile);
return 0;
}