PE_Info 之DIY

 自己写的PE 信息查看工具(C代码),不甚完美,希望可以帮助初学PE 的读者从编程的角度认识PE文件,Good Luck!
       下面是源代码：

/*///
This program will output the values of important members in the PE file
Good Luck!
///*/
/*///
USAGE: peinfo.exe  DestinationFileName
///*/

#include<windows.h>
#include<stdio.h>
#include<shlwapi.h>

/*
This function is used for outputting the error information 
Please use GetLastError() to retrieve the dwErrorCode,Gook Luck!*/
void OutputErrorInfo(DWORD dwErrorCode)
{
TCHAR FormattedErrorInfo[MAX_PATH];
RtlZeroMemory(FormattedErrorInfo,MAX_PATH);//Initialization

  FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM,
    0,
    dwErrorCode,
    MAKELANGID(LANG_ENGLISH,SUBLANG_ENGLISH_US),//English
    //            0, //The default language of the current system
    FormattedErrorInfo,MAX_PATH,NULL);
    
      //    printf("/nCopyFile()'s ErrorInformation:%s/n",FormattedErrorInfo);
      MessageBox(NULL,FormattedErrorInfo,"Error",MB_OK|MB_ICONINFORMATION);
}
/*//
/*/
//Notice the file pointer all the time,this is very important.


void main(int argc,char *argv[])
{
  HANDLE hDestinationFile=NULL;
//
  DWORD i=0;
  DWORD j=0;
  DWORD k=0;
  DWORD NumberOfBytesRead=0;   //Number of bytes read
  WORD MZSignature=0; // MZ signature
  DWORD ImageNtSignature=0;  //PE signature
  DWORD OffsetOfNewHeader=0;
  DWORD NumberOfSections=0;
  DWORD SizeOfOptionalHeader=0;
  DWORD SizeOfSectionTable=0;           //size of section table

  HANDLE hGlobalAllocatedMemory=NULL;  //use GlobalAlloc();
  HANDLE hGlobalAllocatedMemoryOfDataDirectory=NULL;

  PIMAGE_SECTION_HEADER pImageSectionHeader=NULL; //a pointer to IMAGE_SECTION_TABLE
  PIMAGE_DATA_DIRECTORY  pImageDataDirectory; //a pointer to IMAGE_DATA_DIRECTORY

///
  IMAGE_DOS_HEADER ImageDosHeader;
  IMAGE_NT_HEADERS ImageNTHeaders;
  IMAGE_FILE_HEADER ImageFileHeader;

  IMAGE_OPTIONAL_HEADER ImageOptionalHeader;
  IMAGE_SECTION_HEADER ImageSectionHeader;
//
  IMAGE_EXPORT_DIRECTORY ImageExportDirectory;  //Export and Import
  IMAGE_IMPORT_DESCRIPTOR ImageImportDescriptor;
  PIMAGE_EXPORT_DIRECTORY pImageExportDirectory=NULL;
  PIMAGE_IMPORT_DESCRIPTOR pImageImportDescriptor=NULL;

  DWORD *pExportAddressTableEntry=NULL; //pointer
  DWORD *pExportNamePointerTableEntry=NULL;
  WORD *pExportOrdinalTableEntry=NULL;


  DWORD SizeOfRawData=0;
  DWORD PointerToRawData=0;
    DWORD VirtualAddress=0;
  DWORD CountOfImportDirectoryEntries=0;

  DWORD RvaOfExportDirectoryTable=0;  
  DWORD RvaOfImportDirectoryTable=0;
  DWORD DestinationSectionPosition=0; //Destination Section Position

  DWORD FilePointerToIMAGE_EXPORT_DERECTORY=0; //file pointer
  DWORD FilePointerToImportDirectoryTable=0;
  DWORD FilePointerOfExportedDllName=0;
  TCHAR ExportedDllName[MAX_PATH];
  TCHAR ImportedDllName[MAX_PATH]; //Imported Dll Name

  DWORD FilePointerOfExportAddressTable=0;  //file pointer
  DWORD FilePointerOfExportOrdinalTable=0;
  DWORD FilePointerOfExportNamePointerTable=0;
  
  HANDLE hGlobalMemoryForExportAddressTable=NULL; //Global memory allocated
  HANDLE hGlobalMemoryForExportOrdinalTable=NULL;
  HANDLE hGlobalMemoryForExportNamePointerTable=NULL;

  HANDLE hGlobalMemoryForImportDirectoryTable=NULL;
  HANDLE hGlobalMemoryForImportDirectoryTable2=NULL;
  HANDLE hGlobalMemoryForCount=NULL;

  

//
  RtlZeroMemory(&ImageDosHeader,sizeof(IMAGE_DOS_HEADER));
  RtlZeroMemory(&ImageNTHeaders,sizeof(IMAGE_NT_HEADERS));
  RtlZeroMemory(&ImageFileHeader,sizeof(IMAGE_FILE_HEADER));

  RtlZeroMemory(&ImageOptionalHeader,sizeof(IMAGE_OPTIONAL_HEADER));
  RtlZeroMemory(&ImageSectionHeader,sizeof(IMAGE_SECTION_HEADER));

  RtlZeroMemory(&ImageExportDirectory,sizeof(IMAGE_EXPORT_DIRECTORY));  //Export and Import
  RtlZeroMemory(&ImageImportDescriptor,sizeof(IMAGE_IMPORT_DESCRIPTOR));


  if(argc!=2)
  {
    printf("Error./nUSAGE:peinfo.exe DestinationFileName/n");
    return;
  }

  hDestinationFile=CreateFile(argv[1],
    FILE_WRITE_DATA|FILE_READ_DATA,
    FILE_SHARE_WRITE,NULL,OPEN_ALWAYS,FILE_ATTRIBUTE_ARCHIVE,NULL);

  OutputErrorInfo(GetLastError());

//  OpenFile(DestinationPEFile,NULL,NULL);
  if(hDestinationFile==INVALID_HANDLE_VALUE)
  {
    printf("/nCreateFile() fails!Can't open file. Please try again!/n");
    return;
  }

  if(!ReadFile(hDestinationFile,&MZSignature,2,&NumberOfBytesRead,NULL))
  {
    printf("/nReadFile() fails! Please try again./n");
    return;
  }
  if(NumberOfBytesRead!=2)
  {
    printf("/nReadFile() fails! Can't get the MZSignature./n");
    return;
  }

  if(MZSignature!=0x5A4D)
  {
    printf("/nThis file is not a valid PE file./n");
    printf("/nThe value of MZSignature is:%#x/n",MZSignature);
    return;
  }
  SetFilePointer(hDestinationFile,0,NULL,FILE_BEGIN); //Revert the file pointer,this is very important.

  ReadFile(hDestinationFile,&ImageDosHeader,
         sizeof(IMAGE_DOS_HEADER),&NumberOfBytesRead,NULL);
  if(NumberOfBytesRead!=sizeof(IMAGE_DOS_HEADER))
  {
    printf("/nReadFile() fails! Can't get IMAGE_DOS_HEADER./n");
    return;
  }
  else
  {
    printf("/nGet IMAGE_DOS_HEADER successfully!/n");
  }
  Output the information in the IMAGE_DOS_HEADER
  printf("ImageDosHeader.e_magic: %#x/n",ImageDosHeader.e_magic);
  printf("ImageDosHeader.e_crlc: %#x/n",ImageDosHeader.e_crlc); //Relocations
  printf("ImageDosHeader.e_ss: %#x/n",ImageDosHeader.e_ss);
  printf("ImageDosHeader.e_sp: %#x/n",ImageDosHeader.e_sp); 
  printf("ImageDosHeader.e_csum: %#x/n",ImageDosHeader.e_csum); //check sum
  printf("ImageDosHeader.e_ip: %#x/n",ImageDosHeader.e_ip); 
  printf("ImageDosHeader.e_cs: %#x/n",ImageDosHeader.e_cs);
  printf("ImageDosHeader.e_lfarlc: %#x/n",ImageDosHeader.e_lfarlc); //File address of relocation table
  printf("ImageDosHeader.e_oemid: %#x/n",ImageDosHeader.e_oemid);
  printf("ImageDosHeader.e_oeminfo: %#x/n",ImageDosHeader.e_oeminfo); 
  printf("ImageDosHeader.e_lfanew: %#x/n",ImageDosHeader.e_lfanew); //file address of new exe header
//  printf("ImageDosHeader.e_crlc%#x/n",ImageDosHeader.e_sp); 
  //......



  if(ImageDosHeader.e_magic!=MZSignature)  //MZ header
  {
    printf("/nValue of ImageDosHeader.e_magic is:");
    printf("%#x,%#d/n",ImageDosHeader.e_magic,ImageDosHeader.e_magic);
  }

  OffsetOfNewHeader=ImageDosHeader.e_lfanew; //File address of new exe header

  SetFilePointer(hDestinationFile,(LONG)OffsetOfNewHeader,NULL,FILE_BEGIN);
//  OutputErrorInfo(GetLastError());

  ReadFile(hDestinationFile,&ImageNTHeaders,
    sizeof(IMAGE_NT_HEADERS),&NumberOfBytesRead,NULL); //Retrieve IMAGE_NT_HEADERS
  if(NumberOfBytesRead!=sizeof(IMAGE_NT_HEADERS))
  {
    printf("/nReadFile() fails! Cant' get IMAGE_NT_HEADER./n");
    return;
  }