pe文件解析解决方案

宽带有毒

已于 2023-03-25 22:13:39 修改

阅读量89

点赞数

文章标签： servlet java c++

于 2023-03-24 16:02:44 首次发布

本文链接：https://blog.csdn.net/m0_67990462/article/details/129752748

版权

#include<windows.h>
#include<iostream>
int main()
{

   HANDLE hfile = CreateFile(L"d:\\123.exe", GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
   DWORD filesize = GetFileSize(hfile, NULL);
   char*filebuff = new char[filesize];
   DWORD realread = 0;
   BOOL bsucess = 0;
   PIMAGE_NT_HEADERS pntheadsers = 0;
   PIMAGE_FILE_HEADER pfileheader = 0;
   PIMAGE_DOS_HEADER pdosheaders=0;
   bsucess=ReadFile(hfile, filebuff, filesize, &realread, NULL);
   if (bsucess)
   {

       pdosheaders = (PIMAGE_DOS_HEADER)filebuff;
       if ((pdosheaders->e_magic != 0x5a4d))
       {
           printf("不是有效的pe文件");
           delete[] filebuff;
           return 0;
       }
       printf("e_lfanew=%d \n", pdosheaders->e_lfanew);

   }//
   pntheadsers = (PIMAGE_NT_HEADERS)(pdosheaders->e_lfanew + (DWORD)filebuff);
   DWORD pe = pntheadsers->Signature;

   if (pe!=0x4550)
   {
       printf("不是有效的pe文件");
       delete[] filebuff;
   }
   pfileheader = &pntheadsers->FileHeader;
   printf("Machine- %x \n", pfileheader->Machine);
   printf("Characteristics- %x \n", pfileheader->Characteristics);
   printf("NumberOfSections- %x \n", pfileheader->NumberOfSections);
   printf("SizeOfOptionalHeader- %x \n", pfileheader->SizeOfOptionalHeader);
   delete[] filebuff;
   CloseHandle(hfile);

getchar();
return 0;
}