WindowsPE

// windows pe code; 
// by:lostgg

#include <windows.h>
#include <stdio.h>
#include <ctime>

#define ERROR_HANDLE(cc,ret)	\
		{		\
		cc			;\
		return	ret	;\
		}


struct MPEStruct
{
	PIMAGE_DOS_HEADER pDos;
	PIMAGE_NT_HEADERS pNt ;//= (PIMAGE_NT_HEADERS)((LONG)lpMapAddress + pDos->e_lfanew);
	PIMAGE_SECTION_HEADER pSection;
	PIMAGE_IMPORT_DESCRIPTOR pImport;
	PIMAGE_EXPORT_DIRECTORY  pExport;
};

int VaToVf(PIMAGE_SECTION_HEADER fristSection,u_long count,u_long address,u_long baseaddr)
{
	PIMAGE_SECTION_HEADER tmpPSections = fristSection;
	for(int i = 0; i != count; ++i)
	{
		tmpPSections = fristSection + i;
		if(address > tmpPSections->VirtualAddress &&
			address < (tmpPSections->VirtualAddress + tmpPSections->Misc.VirtualSize))
		{
			return (address - tmpPSections->VirtualAddress + tmpPSections->PointerToRawData + baseaddr);
		}
	}
	return 0;
}

int main(int argc,char* argv[])
{
	//打开文件
	HANDLE hFile = CreateFile("D:\\cc.exe",GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);
	if(hFile == INVALID_HANDLE_VALUE)
		ERROR_HANDLE(printf("CreateFile Error:%d\r\n",GetLastError()),0);
	//创建映射对象
	HANDLE hMapFile = CreateFileMapping(hFile,NULL,PAGE_READONLY,0,0,0);
	if(hMapFile == NULL)
		ERROR_HANDLE(printf("CreateFileMapping Error:%d\r\n",GetLastError()),0);
	//获取映射对象地址
	LPVOID lpMapAddress = MapViewOfFile(hMapFile,FILE_MAP_READ,0,0,0);
	if(lpMapAddress == NULL)
		ERROR_HANDLE(printf("MapViewOfFile Error:%d\r\n",GetLastError()),0);
	

	MPEStruct pe;//自定义PE结构的结构体

	pe.pDos = (PIMAGE_DOS_HEADER)lpMapAddress;	//DOS头

	pe.pNt = (PIMAGE_NT_HEADERS)((LONG)lpMapAddress + pe.pDos->e_lfanew); //从DOS头获取NT头的文件偏移
	printf("CPU:%x\r\n",pe.pNt->FileHeader.Machine);
	printf("Section table count:%d\r\n",pe.pNt->FileHeader.NumberOfSections);
	time_t utm = pe.pNt->FileHeader.TimeDateStamp;

	//u_long type to tm_t;
	tm _tm;
	localtime_s(&_tm,&utm);
	printf("Create time:%d-%d-%d %d:%d:%d\r\n",_tm.tm_year + 1900,_tm.tm_mon + 1,_tm.tm_mday,_tm.tm_hour,_tm.tm_min,_tm.tm_sec);

	/*---------------------------------此处判断有问题↓Question1 star--------------------------------
	------------------------------------------------------------------------------------------------*/
	if((pe.pNt->FileHeader.Characteristics & IMAGE_FILE_32BIT_MACHINE))
		printf("FileType:exe\r\n");
	else if((pe.pNt->FileHeader.Characteristics & IMAGE_FILE_DLL))
		printf("FileType:dll\r\n");
	else
		printf("Unknown type:0x%xh\r\n",pe.pNt->FileHeader.Characteristics);
	/*---------------------------------此处判断有问题↑Question1 end--------------------------------
	------------------------------------------------------------------------------------------------*/

	printf("Base address:0x%p\r\n",/*程序基地址*/
		pe.pNt->OptionalHeader.ImageBase);
	printf("Run address :0x%p\r\n",/*基地址+偏移地址*/
		pe.pNt->OptionalHeader.ImageBase + pe.pNt->OptionalHeader.AddressOfEntryPoint);

	//节表
	pe.pSection = (PIMAGE_SECTION_HEADER)((int)&pe.pNt->OptionalHeader + pe.pNt->FileHeader.SizeOfOptionalHeader);
	//输出节表名字
	PIMAGE_SECTION_HEADER tmpPSection = 0;
	for(int i = 0;i != pe.pNt->FileHeader.NumberOfSections; ++i)
	{
		tmpPSection = pe.pSection + i;
		printf("Block:%s\r\n",/*块的名字 例如.text*/
			tmpPSection->Name);
		printf("Property:0x%x\r\n",/*块的属性,例如共享,只读 ---根据输出的值查询MSDN*/
			tmpPSection->Characteristics);
	}

	//输出表
	if(pe.pNt->OptionalHeader.DataDirectory[0].VirtualAddress == 0 )
	{
		printf("--------------------------------------------------\r\n");
		printf("                 no find explort information      \r\n");
		printf("--------------------------------------------------\r\n");
	}
	else
	{
		//输出表信息 此处没有写. 方法同下输入表.
	}
	if(pe.pNt->OptionalHeader.DataDirectory[1].VirtualAddress == 0 )
	{
		printf("--------------------------------------------------\r\n");
		printf("                 no find import information!      \r\n");
		printf("--------------------------------------------------\r\n");
	}
	else
	{
		//输入表信息
		pe.pImport = (PIMAGE_IMPORT_DESCRIPTOR)VaToVf(pe.pSection,pe.pNt->FileHeader.NumberOfSections,pe.pNt->OptionalHeader.DataDirectory[1].VirtualAddress,(u_long)lpMapAddress);
		PIMAGE_IMPORT_DESCRIPTOR tpImport = pe.pImport;
		while(tpImport->Name)
		{
			const char* str = (const char*)VaToVf(pe.pSection,pe.pNt->FileHeader.NumberOfSections,tpImport->Name,(u_long)lpMapAddress);
			printf("--------------------------------------------------\r\n");
			printf("                 Import File:%s                     \r\n",str);
			printf("--------------------------------------------------\r\n");
			PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA)VaToVf(pe.pSection,pe.pNt->FileHeader.NumberOfSections,tpImport->OriginalFirstThunk,(u_long)lpMapAddress);
			if(pThunk == 0)
				continue;
			while(pThunk->u1.Function)
			{
				const char* funname = (const char*)VaToVf(pe.pSection,pe.pNt->FileHeader.NumberOfSections,pThunk->u1.AddressOfData + 2,(u_long)lpMapAddress);
				printf("Import funciton:%s\r\n",funname);
				pThunk++;
			}
			tpImport++;
		}
	}


	return 0;
}