1,编程思路:文件格式检查-〉fileheader读取-〉fileoptionheader读取-〉数据目录表读取-〉区块表读取-〉输出表-〉输入表
第一步,文件格式检查
dos头, IMAGE_DOS_HEADER STRUCT
{
WORD e_magic
..........
DWORD e_lfanew //指向pe文件头+3ch
}PIMAGE_DOS_HEADER ENDS
PIMAGE_DOS_HEADER pDH=NULL;
判断pDH->e_magic=='MZ'并通过pDH->e_ifanew找到IMAGE_NT_HEADERS
IMAGE_NT_HEADERS STRUCT
{
DWORD Signature
IMAGE_FILE_HEADER FileHeader
IMAGE_OPTIONAL_HEADER32 OptionlHeader
}PIMAGE_NT_HEADERS ENDS
PIMAGE_NT_HEADERS pNTH=NULL;
检测: pNTH->Signature=='PE';
第二部,FileHeader读取
PIMAGE_NT_HEADERS GetNtHeaders(LPVOID ImageBase)
{