两种方法获取文件OEP

读取的字段都是一样的，只是一个直接从PE文件中读取，一个映射到内存后再读取

1.文件直接访问法

BOOL ReadOEPByFile(LPCTSTR szFileName)
{
	HANDLE hFile;
	hFile=CreateFile(szFileName,GENERIC_READ,FILE_SHARE_READ,0,OPEN_EXISTING,FILE_FLAG_SEQUENTIAL_SCAN,0);
	if (INVALID_HANDLE_VALUE==hFile)
	{
		AfxMessageBox(_T("打开文件失败！"));
		return FALSE;
	}
	DWORD dwOEP,cbRead;
	IMAGE_DOS_HEADER dos_header[sizeof(IMAGE_DOS_HEADER)];//IMAGE_DOS_HEADER dos_header[1];
	if (!ReadFile(hFile,dos_header,sizeof(IMAGE_DOS_HEADER),&cbRead,NULL))
	{
		AfxMessageBox(_T("读取DOS头部失败！"));
		CloseHandle(hFile);
		return FALSE;
	}
	int nEntryPos=dos_header->e_lfanew+40;
	SetFilePointer(hFile,nEntryPos,NULL,FILE_BEGIN);
	if (!ReadFile(hFile,&dwOEP,sizeof(dwOEP),&cbRead,NULL))
	{
		CloseHandle(hFile);
		return FALSE;
	}
	CloseHandle(hFile);
	CString strOEP;
	strOEP.Format(_T("OEP:0x%X"),dwOEP);
	AfxMessageBox(strOEP);
	return TRUE;
}

2.通过内存映射读取

BOOL ReadOEPByMemory(LPCTSTR szFileName)
{
	HANDLE hFile;
	HANDLE hMapping;
	PVOID pBaseAddr;
	if ((hFile=CreateFile(szFileName,GENERIC_READ,FILE_SHARE_READ,
		0,OPEN_EXISTING,FILE_FLAG_SEQUENTIAL_SCAN,0))==INVALID_HANDLE_VALUE)
	{
		AfxMessageBox(_T("打开文件失败！"));
		return FALSE;
	}
	//创建内存映射文件
	if (!(hMapping=CreateFileMapping(hFile,0,PAGE_READONLY|SEC_COMMIT,0,0,0)))
	{
		AfxMessageBox(_T("Mapping failed."));
		CloseHandle(hFile);
		return FALSE;
	}
	//把文件映像存入pBaseAddr
	if (!(pBaseAddr=MapViewOfFile(hMapping,FILE_MAP_READ,0,0,0)))
	{
		AfxMessageBox(_T("View Failed."));
		CloseHandle(hMapping);
		CloseHandle(hFile);
		return FALSE;
	}
	IMAGE_DOS_HEADER *dos_header=(IMAGE_DOS_HEADER *)pBaseAddr;
	IMAGE_NT_HEADERS *nt_header=(IMAGE_NT_HEADERS *)((DWORD)pBaseAddr+dos_header->e_lfanew);
	DWORD dwOEP=nt_header->OptionalHeader.AddressOfEntryPoint;
	//清除内存映射和关闭文件
	UnmapViewOfFile(pBaseAddr);
	CloseHandle(hMapping);
	CloseHandle(hFile);

	CString strOEP;
	strOEP.Format(_T("OEP:0x%X"),dwOEP);
	AfxMessageBox(strOEP);
	return TRUE;
}

第二种方法要注意DOS STUP与PE头不一定是紧挨着的，一定要通过(DWORD)pBaseAddr+dos_header->e_lfanew定位到IMAGE_NT_HEADERS

如果还要读入口点的代码或其它东西，把PAGE_READONLY|SEC_COMMIT换成PAGE_READONLY|SEC_COMMIT|SEC_IMAGE会给你带来很大的便利

谢谢列宁。