PE文件结构分析_pefile.sectionstructure-CSDN博客

本文链接：https://blog.csdn.net/cnyu/article/details/4342565

PE文件格式(Portable Executable File Format )是windows下的可执行文件的格式，从某种意义上讲，它反映了windows操作系统的工作方式，对于它的了解，可以帮助我们更加了解windows操作系统，对于windows下的编程，好处也是大大的。

在本文中，我并不打算大讲特讲PE文件的构成是什么，每个字段是什么意思，这些资料可以说在网上是浩瀚如海，到处都是的，用google一搜，打开一看，基本讲解的都是大同小异。由于pe文件的结构比较庞大，结构中套结构，有的结构多达30多个字段，光看这些字段都让人够晕的，在加上有的字段是一个32位的DWORD值，而每一位都有其特殊的含义，这样，光把每个字段的含义看一遍过来，估计也得2个小时。而实际上，这里面很多字段，我们都不需要去了解，也不需要去关注，掌握那些关键字段就行了。

我觉得讲清楚一种技术，最好的方法是例子，通过例子，先从感性上去感受一下，然后有了这种感性的认识，然后再深入理论，这才是比较好的办法。所以，我这里给大家提供一个例子，这个例子是用VC6写的，是一个C语言的控制台程序，它要求提供一个PE文件名或者路径的参数，然后分析这个文件的结构，并且把关键字段打印出来。你可以一边看网上的关于PE文件结构的讲解，一边对照本程序，我相信，通过理论和实践的结合，你能很快的掌握PE文件的主要构成。好了，废话少说，源码奉上：

// ShowPE.c // Show The Main Structures Of the PE file // Author: thinker // Date: 11/28/2008 // E-Mail: cnhnyu@gmail.com // QQ: 94483026 /********************************************************* PE File Format ------------------------------- <--+ | MZ MS-DOS Header | | ------------------------------- | Dos Headers | MS DOS Stub | | ------------------------------- <--+ | PE00 | | ------------------------------- | | | | | IMAGE_FILE_HEADER | | IMAGE_NT_HEADERS32 ------------------------------- | | | | | IMAGE_OPTIONAL_HEADER32 | | | | | ------------------------------- <--+ | Section Header 1 | | |-----------------------------| | | Section Header 2 | | ------------------------------- | Section Headers | .............. | | |-----------------------------| | | Section Header N | | ------------------------------- <--+ | Section Data 1 | | |-----------------------------| | | Section Data 2 | | ------------------------------- | Section Datas | ............... | | ------------------------------- | | Section Data N | | ------------------------------- <--+ **********************************************************/ # include < stdio. h> # include < windows. h> # include < time . h> // Data Directory Description char szDataDirectory[ 16] [ 64] = { "Export Directory" , "Import Directory" , "Resource Directory" , "Exception Directory" , "Security Directory" , "Base Relocation Table" , "Debug Directory" , "Architecture Specific Data" , "RVA of GP" , "TLS Directory" , "Load Configuration Directory" , "Bound Import Directory in headers" , "Import Address Table" , "Delay Load Import Descriptors" , "COM Runtime descriptor" } ; HANDLE hFile = NULL ; HANDLE hFileMapping = NULL ; void * pFileBase = NULL ; IMAGE_DOS_HEADER * pDosHeader = NULL ; IMAGE_NT_HEADERS * pNTHeader = NULL ; IMAGE_SECTION_HEADER * pSectionHeader = NULL ; DWORD RVA2FileOffset( DWORD dwRVA) ; int main( int argc, char * * argv) { struct tm * ptm; DWORD dwIndex; IMAGE_IMPORT_DESCRIPTOR * pImportDescriptor = NULL ; IMAGE_THUNK_DATA * pThunkData = NULL ; IMAGE_IMPORT_BY_NAME * pImportByName = NULL ; IMAGE_EXPORT_DIRECTORY * pExportDirectory = NULL ; DWORD * pdw; WORD * pw; if ( argc ! = 2 ) { printf ( "Usage:/n/t%s PEFile/n" , argv[ 0] ) ; return - 1; } /*********************** Map the file to memory *************************/ hFile = CreateFile( argv[ 1] , GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL , OPEN_EXISTING, FILE_ATTRIBUTE_ARCHIVE, NULL ) ; if ( hFile = = INVALID_HANDLE_VALUE ) { printf ( "Open File Error./n" ) ; return - 1; } hFileMapping = CreateFileMapping( hFile, NULL , PAGE_READONLY, 0, 0, NULL ) ; if ( ! hFileMapping ) { CloseHandle( hFile) ; printf ( "Create File Mapping Error./n" ) ; return - 1; } pFileBase = MapViewOfFile( hFileMapping, FILE_MAP_READ, 0, 0, 0) ; if ( ! pFileBase ) { CloseHandle( hFileMapping) ; CloseHandle( hFile) ; printf ( "Map View Of File Error./n" ) ; return - 1; } /*********************** Map end *****************************************/ // get the dos heaader pointer pDosHeader = ( IMAGE_DOS_HEADER* ) pFileBase; if ( pDosHeader- > e_magic ! = IMAGE_DOS_SIGNATURE ) { printf ( "Unknow File Format./n" ) ; goto End; } printf ( "%-35s%s/n/n" , "FileName:" , argv[ 1] ) ; printf ( "%-35s%#010x/n" , "Dos Stub Size:" , pDosHeader- > e_lfanew - sizeof ( IMAGE_DOS_HEADER) ) ; printf ( "%-35s%#010x/n" , "NT File RVA:" , pDosHeader- > e_lfanew) ; // get the nt header pointer pNTHeader = ( IMAGE_NT_HEADERS* ) ( ( char * ) pFileBase + pDosHeader- > e_lfanew) ; if ( pNTHeader- > Signature ! = IMAGE_NT_SIGNATURE ) { printf ( "Not NT File./n" ) ; goto End; } // get the section header pointer pSectionHeader = ( IMAGE_SECTION_HEADER* ) ( ( char * ) pNTHeader + sizeof ( IMAGE_NT_HEADERS) ) ; printf ( "/n%-35s%s/n" , "nRun Platform:" , ( pNTHeader- > FileHeader. Machine = = IMAGE_FILE_MACHINE_I386) ? "Intel 386" : "Other" ) ; printf ( "%-35s%d/n" , "NumOfSections:" , pNTHeader- > FileHeader. NumberOfSections) ; ptm = localtime ( & pNTHeader- > FileHeader. TimeDateStamp) ; printf ( "%-35s%02d/%02d/%04d %02d:%02d:%02d/n" , "FileCreateTime:" , ptm- > tm_mon + 1, ptm- > tm_mday, ptm- > tm_year + 1900, ptm- > tm_hour, ptm- > tm_min, ptm- > tm_sec) ; //printf("%.19s/n", asctime(ptm)); printf ( "%-35s%#010x/n" , "SizeofOptionHdr:" , pNTHeader- > FileHeader. SizeOfOptionalHeader) ; printf ( "%-35s%s/n" , "File Type:" , ( pNTHeader- > FileHeader. Characteristics & IMAGE_FILE_DLL) ? "DLL" : "EXE" ) ; printf ( "/n%-35s%s/n" , "Image Type:" , ( pNTHeader- > OptionalHeader. Magic = = 0x10B) ? "Exe Image" : "Other" ) ; printf ( "%-35s%d.%d/n" , "Linker Version:" , pNTHeader- > OptionalHeader. MajorLinkerVersion, pNTHeader- > OptionalHeader. MinorLinkerVersion) ; printf ( "%-35s%#010x/n" , "SizeofCode:" , pNTHeader- > OptionalHeader. SizeOfCode) ; printf ( "%-35s%#010x/n" , "AddressOfEntryPoint:" , pNTHeader- > OptionalHeader. AddressOfEntryPoint) ; printf ( "%-35s%#010x/n" , "DefaultLoadAddress:" , pNTHeader- > OptionalHeader. ImageBase) ; printf ( "%-35s%#010x/n" , "SectionAlignment:" , pNTHeader- > OptionalHeader. SectionAlignment) ; printf ( "%-35s%#010x/n" , "FileAlignment:" , pNTHeader- > OptionalHeader. FileAlignment) ; printf ( "%-35s%d.%d/n" , "OS SystemVersion:" , pNTHeader- > OptionalHeader. MajorOperatingSystemVersion, pNTHeader- > OptionalHeader. MinorOperatingSystemVersion) ; printf ( "%-35s%d.%d/n" , "ImageVersion:" , pNTHeader- > OptionalHeader. MajorImageVersion, pNTHeader- > OptionalHeader. MinorImageVersion) ; printf ( "%-35s%d.%d/n" , "SubSystemVersion:" , pNTHeader- > OptionalHeader. MajorSubsystemVersion, pNTHeader- > OptionalHeader. MinorSubsystemVersion) ; printf ( "%-35s%#010d/n" , "SizeOfIamge:" , pNTHeader- > OptionalHeader. SizeOfImage) ; printf ( "%-35s%#010d/n" , "SizeOfHeaders:" , pNTHeader- > OptionalHeader. SizeOfHeaders) ; if ( pNTHeader- > OptionalHeader. Subsystem = = IMAGE_SUBSYSTEM_WINDOWS_GUI ) printf ( "%-35s%s/n" , "GUI System:" , "Windows GUI" ) ; else if ( pNTHeader- > OptionalHeader. Subsystem = = IMAGE_SUBSYSTEM_WINDOWS_CUI) printf ( "%-35s%s/n" , "GUI System:" , "Windows Console" ) ; else printf ( "%-35s%s/n" , "GUI System:" , "Other" ) ; printf ( "/n-----------------------------Data Directory----------------------------------/n" ) ; printf ( "#Index/t#Virtual Address/t#Size/t/t#%-32s/n" , "Directory Name" ) ; for ( dwIndex = 0; dwIndex < IMAGE_NUMBEROF_DIRECTORY_ENTRIES; dwIndex+ + ) { printf ( "0x%02x/t0x%08x/t0x%08x/t%-50s/n" , dwIndex, pNTHeader- > OptionalHeader. DataDirectory[ dwIndex] . VirtualAddress, pNTHeader- > OptionalHeader. DataDirectory[ dwIndex] . Size, szDataDirectory[ dwIndex] ) ; } printf ( "/n/n-----------------------------Section Headers----------------------------------/n" ) ; printf ( "#VirtualAddress/t#VirtualSize/t#PointerToRawData/t#SizeOfRawData/t#Name/n" ) ; for ( dwIndex = 0; dwIndex < pNTHeader- > FileHeader. NumberOfSections; dwIndex+ + ) { printf ( "0x%08x/t0x%08x/t0x%08x/t/t0x%08x/t%-10s/n" , pSectionHeader[ dwIndex] . VirtualAddress, pSectionHeader[ dwIndex] . Misc. VirtualSize, pSectionHeader[ dwIndex] . PointerToRawData, pSectionHeader[ dwIndex] . SizeOfRawData, pSectionHeader[ dwIndex] . Name) ; } // Import Table printf ( "/n/n-------------------------Import Table-------------------------------------/n" ) ; pImportDescriptor = ( IMAGE_IMPORT_DESCRIPTOR* ) ( ( char * ) pFileBase + RVA2FileOffset( pNTHeader- > OptionalHeader. DataDirectory[ 1] . VirtualAddress) ) ; for ( ; * ( char * ) pImportDescriptor ; pImportDescriptor+ + ) { printf ( "Import Lib: %s/n" , ( char * ) ( RVA2FileOffset( pImportDescriptor- > Name) + ( char * ) pFileBase) ) ; pThunkData = ( IMAGE_THUNK_DATA* ) ( RVA2FileOffset( pImportDescriptor- > OriginalFirstThunk) + ( char * ) pFileBase) ; for ( ; pThunkData- > u1. AddressOfData; pThunkData+ + ) { if ( pThunkData- > u1. Ordinal & IMAGE_ORDINAL_FLAG32 ) // import by index { printf ( "/t0x%04x/n" , pThunkData- > u1. Ordinal & 0xffff) ; } else // import by name { pImportByName = ( IMAGE_IMPORT_BY_NAME* ) ( RVA2FileOffset( pThunkData- > u1. Ordinal) + ( char * ) pFileBase) ; printf ( "/t0x%04x/t%s/n" , pImportByName- > Hint, pImportByName- > Name) ; } } printf ( "/n" ) ; } if ( pNTHeader- > OptionalHeader. DataDirectory[ 0] . Size = = 0 ) // Export Table Not Exist goto End; // Export Table printf ( "/n/n------------------------Export Table---------------------------------/n" ) ; pExportDirectory = ( IMAGE_EXPORT_DIRECTORY* ) ( RVA2FileOffset( pNTHeader- > OptionalHeader. DataDirectory[ 0] . VirtualAddress) + ( char * ) pFileBase) ; printf ( "Export Lib: /t%s/n" , ( char * ) ( RVA2FileOffset( pExportDirectory- > Name) + ( char * ) pFileBase) ) ; printf ( "/tIndex/tName/t/t/n" ) ; printf ( "/t------------------------------/n" ) ; for ( dwIndex = 0; dwIndex < pExportDirectory- > NumberOfNames; dwIndex+ + ) { pdw = ( DWORD* ) ( RVA2FileOffset( pExportDirectory- > AddressOfNames) + ( char * ) pFileBase) ; pw = ( WORD* ) ( RVA2FileOffset( pExportDirectory- > AddressOfFunctions) + ( char * ) pFileBase) ; printf ( "/t0x%04x/t%-20s/n" , dwIndex, ( char * ) ( RVA2FileOffset( pdw[ dwIndex] ) + ( char * ) pFileBase) , pw[ dwIndex] ) ; } End: UnmapViewOfFile( pFileBase) ; CloseHandle( hFileMapping) ; CloseHandle( hFile) ; return 0; } /* Convert RVA To File Offset */ DWORD RVA2FileOffset( DWORD dwRVA) { DWORD dwNum, dwIndex; if ( pNTHeader = = NULL ) return 0; if ( pSectionHeader = = NULL ) return 0; dwNum = pNTHeader- > FileHeader. NumberOfSections; for ( dwIndex = 0; dwIndex < dwNum; dwIndex+ + ) { if ( dwRVA > = pSectionHeader[ dwIndex] . VirtualAddress & & dwRVA < = pSectionHeader[ dwIndex] . VirtualAddress + pSectionHeader[ dwIndex] . SizeOfRawData) { return dwRVA - pSectionHeader[ dwIndex] . VirtualAddress + pSectionHeader[ dwIndex] . PointerToRawData; } } return 0; }