代码解析

#include <Windows.h>
#include <iostream>

#define path L"C:\\Users\\Administrator\\Desktop\\FileCleaner2.0.exe"

int main()
{
    //读取文件
    HANDLE hfile= CreateFile(path, GENERIC_READ | GENERIC_WRITE, 0, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
    if (hfile == INVALID_HANDLE_VALUE)
    {
        printf("无效句柄");
    }
    DWORD readsize = 0;
    DWORD Filesize;
    Filesize = GetFileSize(hfile, NULL);
    char* pfile = new char[Filesize] {0};
    ReadFile(hfile, pfile, Filesize, &readsize, NULL);


    //将指针类型转换成 DOS的结构体类型
    PIMAGE_DOS_HEADER pdos = (PIMAGE_DOS_HEADER)pfile;
    printf("%x \n",pdos->e_magic);

    //e_lfanew 是对文件头 的RVA  所以 加上文件的位置就相当于 Va
    PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(pdos->e_lfanew + pfile);
    printf("%x\n", pNt->Signature);
    PIMAGE_FILE_HEADER pHfile = &pNt->FileHeader;
    //
    printf("运行平台:%x\n", pHfile->Machine);
    //14c
    printf("区段数量:%x\n", pHfile->NumberOfSections);
    //5
    printf("扩展头大小:%x\n", pHfile->SizeOfOptionalHeader);
    //e0
    
    PIMAGE_OPTIONAL_HEADER pOphand = &pNt->OptionalHeader;
    //程序执行入口 Rva
    printf("AddressOfEntryPoint:%x\n", pOphand->AddressOfEntryPoint);
    //1273d4
    
    //代码区块起始的Rva
    printf("ImageBase:%x\n", pOphand->BaseOfCode);
    //1000

    //数据区块起始的Rva
    printf("Imagedata:%x\n", pOphand->BaseOfData);
    //150000

    //文件在内存中的入口点
    printf("ImageBase:%x\n", pOphand->ImageBase);
    //400000
    
    //内存对齐的大小
    printf("内存对齐大小:%x\n", pOphand->SectionAlignment);
    //10000

    //文件对齐的大小
    printf("文件对齐大小:%x\n", pOphand->FileAlignment);
    //200

}