[滴水逆向]03-13 用c++打印出节表结构

cccsl_

已于 2023-10-02 20:07:40 修改

阅读量761

点赞数

分类专栏：滴水逆向文章标签： c++ 开发语言

于 2023-09-22 23:35:14 首次发布

本文链接：https://blog.csdn.net/fzucaicai/article/details/133190719

版权

滴水逆向专栏收录该内容

11 篇文章 0 订阅

订阅专栏

#include <iostream>
#include <windows.h>
#include <malloc.h>
using namespace std;
char* ReadFilePe(const char* peFileName)
{
	FILE* peFile = nullptr;
	fopen_s(&peFile, peFileName, "rb");
	int pesize = 0;
	char* peData = nullptr;
	if (peFile != NULL) //说明打开成功
	{
		if (fseek(peFile, 0, SEEK_END) == 0)
		{
			pesize = ftell(peFile);
			fseek(peFile, 0, SEEK_SET);
			peData = (char*)malloc(pesize);
			if (peData != nullptr)
			{
				memset(peData, '\x00', pesize);
				fread_s(peData, pesize, 1,pesize, peFile);
			}
			else
			{
				cout << "申请内存空间失败" << endl;
			}
		}
		else
		{
			cout << "指针移动到末尾失败" << endl;
		}
	}
	else
	{
		cout << "打开文件失败" << endl;
	}

	if (peFile)
	{
		fclose(peFile);
	}
	return peData;

}

void printSectionTable(const char* peFileName)
{
	char* pedata = ReadFilePe(peFileName);
	char* tempdata = pedata;
	if (pedata == nullptr)
	{
		cout << "数据获取失败" << endl;
	}

	WORD(*wp)[1];
	wp = (WORD(*)[1])pedata;
	DWORD(*dp)[1];
	dp = (DWORD(*)[1])pedata;

	size_t docSize = 0x3c;
	size_t fileSize = 0x14;

	size_t lfanew = *(*(dp)+15);
	size_t OptionalSize = *(*(wp)+(lfanew / 2) + 10);

	size_t NumberOfSection = *(*(wp)+(lfanew / 2) + 3);

	//转到FILE结构:
	tempdata = &tempdata[lfanew + 4];
	//转到OPTIONAL结构
	tempdata = &tempdata[20];
	//转到节表
	tempdata = &tempdata[OptionalSize];

	PIMAGE_SECTION_HEADER tempSectionHeader = nullptr;
	for (size_t i = 0; i < NumberOfSection; i++)
	{
		tempSectionHeader = (PIMAGE_SECTION_HEADER)tempdata;
		tempdata = &tempdata[40]; //两个节表之间得距离
		printf(">>>>>>>>>> 节表:%d <<<<<<<<<<<\n", i);
		printf("Name                 = %s\n", tempSectionHeader->Name);
		printf("Misc                 = %x\n", tempSectionHeader->Misc.VirtualSize);
		printf("VirtualAddress       = %x\n", tempSectionHeader->VirtualAddress);
		printf("SizeOfRawData        = %x\n", tempSectionHeader->SizeOfRawData);
		printf("PointerToRawData     = %x\n", tempSectionHeader->PointerToRawData);
		printf("PointerToRelocations = %x\n", tempSectionHeader->PointerToRelocations);
		printf("PointerToLinenumbers = %x\n", tempSectionHeader->PointerToLinenumbers);
		printf("NumberOfRelocations  = %x\n", tempSectionHeader->NumberOfRelocations);
		printf("NumberOfLinenumbers  = %x\n", tempSectionHeader->NumberOfLinenumbers);
		printf("Characteristics      = %x\n", tempSectionHeader->Characteristics);
	}
	free(pedata);
}

int main()
{
	printSectionTable("Afkayas.1.Exe");
	getchar();
	return 0;
}