资源表解析+下载图标

资源表分为三层
资源类型->编号->具体项
我选择使用两个for循环遍历出所有的具体项，说复杂也不算。

VOID PrintResourceTable(PVOID fileName) {
	//定位资源表
	PVOID pFileBuffer = FileToFileBuffer(fileName);
	PIMAGE_DOS_HEADER pDosHeader = pFileBuffer;
	PIMAGE_NT_HEADERS pNTHeader = (DWORD)pDosHeader + pDosHeader->e_lfanew;
	if (pNTHeader->Signature != IMAGE_NT_SIGNATURE) {
		printf("File is not PE\n");
		free(pFileBuffer);
		return FALSE;
	}
	PIMAGE_FILE_HEADER pFileHeader = &pNTHeader->FileHeader;
	PIMAGE_OPTIONAL_HEADER pOptHeader = (DWORD)pFileHeader + sizeof(IMAGE_FILE_HEADER);
	PIMAGE_SECTION_HEADER pSecHeader = (DWORD)pOptHeader + pFileHeader->SizeOfOptionalHeader;
	PIMAGE_SECTION_HEADER pLastSecHeader = pSecHeader + pFileHeader->NumberOfSections - 1;
	PIMAGE_RESOURCE_DIRECTORY pResourceTable = VAToFOA(
		pOptHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress, pFileBuffer);
	//入口位置
	PIMAGE_RESOURCE_DIRECTORY_ENTRY pResourceDireEntry = (DWORD)pResourceTable +
		sizeof(IMAGE_RESOURCE_DIRECTORY);
	pResourceDireEntry--;
	//遍历
	DWORD numbersResource = pResourceTable->NumberOfNamedEntries + pResourceTable->NumberOfIdEntries;
	printf("Numbers of all entries:%x\n", numbersResource);
	for (size_t i = 0; i < numbersResource; i++) {
		pResourceDireEntry++;
		if (pResourceDireEntry->NameIsString) {
			PIMAGE_RESOURCE_DIR_STRING_U pDataName = VAToFOA(pResourceDireEntry->NameOffset, pFileBuffer);
			printf("Resouce name:");
			for (size_t i = 0; i < pDataName->Length; i++) {
				printf(L"%c", pDataName->NameString[i]);
			}
			printf("\n");
		}
		else {
			printf("Resouce ID:%x\n", pResourceDireEntry->Id);
		}
		printf("offsetData:%x\n", pResourceDireEntry->OffsetToDirectory);
		PIMAGE_RESOURCE_DIRECTORY pResouceEntriesTable = (DWORD)pResourceTable + pResourceDireEntry->OffsetToDirectory;
		DWORD numbersEntries = pResouceEntriesTable->NumberOfIdEntries + pResouceEntriesTable->NumberOfNamedEntries;
		PIMAGE_RESOURCE_DIRECTORY_ENTRY pEntreisDireEntry = (DWORD)pResouceEntriesTable +
			sizeof(IMAGE_RESOURCE_DIRECTORY);
		pEntreisDireEntry--;
		printf("\tNumbers of all entries:%x\n", numbersEntries);
		for (size_t i = 0; i < numbersEntries; i++) {
			pEntreisDireEntry++;
			if (pEntreisDireEntry->NameIsString) {
				PIMAGE_RESOURCE_DIR_STRING_U pDataName = VAToFOA(pEntreisDireEntry->NameOffset, pFileBuffer);
				printf("\tResouce name:");
				for (size_t i = 0; i < pDataName->Length; i++) {
					printf(L"%c", pDataName->NameString[i]);
				}
				printf("\n");
			}
			else {
				printf("\tResouce ID:%x\n", pEntreisDireEntry->Id);
			}
			printf("\toffsetData:%x\n", pEntreisDireEntry->OffsetToDirectory);
			PIMAGE_RESOURCE_DIRECTORY pItem = (DWORD)pResourceTable + pEntreisDireEntry->OffsetToDirectory;
			PIMAGE_RESOURCE_DIRECTORY_ENTRY pItemEntry = (DWORD)pItem + sizeof(IMAGE_RESOURCE_DIRECTORY);
			PIMAGE_DATA_DIRECTORY pDataDire = (DWORD)pResourceTable + pItemEntry->OffsetToData;
			printf("\t\titem VA : % 08x size : % 08x\n", pDataDire->VirtualAddress, pDataDire->Size);
		}
	} 
	free(pFileBuffer);
}

下载图标则是在上面解析的基础上做一个判断ID?=3，是的话就是全部从fileBuffer转化成文件，转化名字可能要用点字符串处理函数

			printf("\t\titem VA : % 08x size : % 08x\n", pDataDire->VirtualAddress, pDataDire->Size);
			PVOID resourceFOA = VAToFOA(pDataDire->VirtualAddress, pFileBuffer);
			PBYTE resourceName[20] = { 0 };
			PBYTE newOutFileName[50] = { 0 };
			sprintf(resourceName, "%d.ico", pEntreisDireEntry->Id);
			sprintf(newOutFileName, "%s%s", pOutFileName, resourceName);
			FileBufferToFile(newOutFileName, resourceFOA, pDataDire->Size);

改名字就没去做了，反复造轮子而已