- 读取文件到内存
LPVOID EXEToFileBuffer(LPCWSTR pFileName)
{
HANDLE hd = NULL;
HANDLE hFileMapping = NULL;
DWORD dwSize = 0;
LPVOID lpMemory = NULL;
//打开文件
hd = CreateFile(pFileName, GENERIC_READ,
FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL, OPEN_EXISTING,
FILE_ATTRIBUTE_ARCHIVE, NULL);
if (hd == INVALID_HANDLE_VALUE)
{
printf("open file fail!\n");
return NULL;
}
//获取文件大小
dwSize = GetFileSize(hd, NULL);
if (dwSize == 0)
{
printf("file size is zero!\n");
return NULL;
}
hFileMapping=CreateFileMapping(hd, NULL, PAGE_READONLY, 0, 0, NULL);
if (hFileMapping == INVALID_HANDLE_VALUE)
{
printf("createFileMapping is faild!\n");
return NULL;
}
lpMemory=MapViewOfFile(hFileMapping, FILE_MAP_READ, 0, 0, 0);
return lpMemory;
}
- RVA 转 FOA
DWORD _RVAToOffset(PVOID pFileBuffer,DWORD dwRVA)
{
PIMAGE_DOS_HEADER pDosHeader = NULL;
PIMAGE_NT_HEADERS pNtHeaders = NULL;
PIMAGE_SECTION_HEADER pSectionHeader = NULL;
PIMAGE_SECTION_HEADER pTempSction = NULL;
DWORD dwFOA = 0;
pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;
if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE)
{
printf("not a mz header!\n");
return 0;
}
pNtHeaders = (PIMAGE_NT_HEADERS)((DWORD)pDosHeader + pDosHeader->e_lfanew);
if (pNtHeaders->Signature != IMAGE_NT_SIGNATURE)
{
printf("not a ntpe header!\n");
return 0;
}
pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pNtHeaders + sizeof(IMAGE_NT_HEADERS));
pTempSction = pSectionHeader;
for (int i = 0; i < pNtHeaders->FileHeader.NumberOfSections; i++)
{
if (dwRVA >= pTempSction->VirtualAddress&&dwRVA < pTempSction->VirtualAddress+pTempSction->SizeOfRawData)
{
dwFOA = pTempSction->PointerToRawData + (dwRVA - pTempSction->VirtualAddress);
return dwFOA;
}
pTempSction++;
}
printf("not find dwRva!");
return 0;
}
本文是学习笔记,有错误的地方请不吝赐教!