c语言读取PE文件

c语言读取PE文件,代码如下:

#include <iostream>
#include<Windows.h>
IMAGE_DOS_HEADER myDosHeader;
IMAGE_NT_HEADERS myNTHeader;
IMAGE_FILE_HEADER myFileHeader;
IMAGE_OPTIONAL_HEADER myOptionHeader;
IMAGE_SECTION_HEADER* pmySectionHeader;
LONG e_lfanew;
int main(int argc, char* argv[])
{
	FILE* pfile;
	errno_t err;
	DWORD fileSize = 0;

	if ((err = fopen_s(&pfile, "c:/tion.exe", "r"))!= 0)
	{
		printf("打开文件错误!");
			getchar();
	}

	//DOS头部分
	printf("================IMAGE_DOS_HEADER================\n");
	fread(&myDosHeader,1 ,sizeof(IMAGE_DOS_HEADER), pfile);
	if (myDosHeader.e_magic!=0x5A4D)
	{
		printf("不是MZ开头的文件!");
		fclose(pfile);
		exit(0);
	}
	printf("WORD e_magic:				%04X\n", myDosHeader.e_magic);
	printf("DOWRD e_lfaner:				%08X\n\n", myDosHeader.e_lfanew);
	e_lfanew = myDosHeader.e_lfanew;
	//NT头部分
	printf("================IMAGE_NT_HEADER================\n");
	fseek(pfile, e_lfanew, SEEK_SET);
	fread(&myNTHeader, 1, sizeof(IMAGE_NT_HEADERS), pfile);
	if (myNTHeader.Signature != 0x4550)
	{
		printf("文件有问题!");
		fclose(pfile);
		exit(0);
	}
	printf("DWORD Signature:			%08X\n\n",myNTHeader.Signature);
	//FILE头部分
	printf("================IMAGE_FILE_HEADER================\n");
	printf("WORD Machine:				%04X\n", myNTHeader.FileHeader.Machine);
	printf("WORD NumberOfSection:			%04X\n", myNTHeader.FileHeader.NumberOfSections);
	printf("DWORD TimeDateStamp:			%08X\n", myNTHeader.FileHeader.TimeDateStamp);
	printf("DWORD pointerToSymbolTable		%08X\n", myNTHeader.FileHeader.PointerToSymbolTable);
	printf("DWORD NumberOfSymbols:			%08X\n", myNTHeader.FileHeader.NumberOfSymbols);
	printf("WORD SizeOfOptionHeader:		%04X\n", myNTHeader.FileHeader.SizeOfOptionalHeader);
	printf("WORD Characteristics:			%04X\n\n", myNTHeader.FileHeader.Characteristics);
	OPTIONAL头部分
	printf("================IMAGE_OPTION_HEADER================\n");
	printf("WORD Magic;					%04X\n", myNTHeader.OptionalHeader.Magic);
	printf("BYTE MajorLinkerVersion:			%02X\n", myNTHeader.OptionalHeader.MajorLinkerVersion);
	printf("BYTE MinorLinkerVersion:			%02X\n",myNTHeader.OptionalHeader.MinorLinkerVersion);
	printf("DWORD SizeOfCode;				%08X\n", myNTHeader.OptionalHeader.SizeOfCode);
	printf("DWORD SizeOfInitializedData:			%08X\n", myNTHeader.OptionalHeader.SizeOfInitializedData);
	printf(" DWORD SizeOfUninitializedData			%08X\n", myNTHeader.OptionalHeader.SizeOfUninitializedData);
	printf("DWORD AddressOfEntryPoint:			%08X\n", myNTHeader.OptionalHeader.AddressOfEntryPoint);
	printf("DWORD BaseOfCode:				%08X\n", myNTHeader.OptionalHeader.BaseOfCode);
	printf("DWORD BaseOfData:				%08X\n", myNTHeader.OptionalHeader.BaseOfData);
	printf("DWORD ImageBase:				%08X\n", myNTHeader.OptionalHeader.ImageBase);
	printf("DWORD SectionAlignmen:				%08X\n", myNTHeader.OptionalHeader.SectionAlignment);
	printf("DWORD FileAlignment:				%08X\n", myNTHeader.OptionalHeader.FileAlignment);
	printf("WORD MajorOperatingSystemVersion:		%04X\n", myNTHeader.OptionalHeader.MajorOperatingSystemVersion);
	printf("WORD MinorOperatingSystemVersion:		%04X\n", myNTHeader.OptionalHeader.MinorOperatingSystemVersion);
	printf("WORD MajorImageVersion:				%04X\n", myNTHeader.OptionalHeader.MajorImageVersion);
	printf("WORD MinorImageVersion:				%04X\n", myNTHeader.OptionalHeader.MinorImageVersion);
	printf("WORD MajorSubsystemVersion:			%04X\n", myNTHeader.OptionalHeader.MajorSubsystemVersion);
	printf("WORD MinorSubsystemVersion:			%04X\n", myNTHeader.OptionalHeader.MinorSubsystemVersion);
	printf("DWORD Win32VersionValue:			%08X\n", myNTHeader.OptionalHeader.Win32VersionValue);
	printf("DWORD SizeOfImage:				%08X\n", myNTHeader.OptionalHeader.SizeOfImage);
	printf("DWORD SizeOfHeaders:				%08X\n", myNTHeader.OptionalHeader.SizeOfHeaders);
	printf("DWORD CheckSum:					%08X\n", myNTHeader.OptionalHeader.CheckSum);
	printf("WORD Subsystem:					%04X\n", myNTHeader.OptionalHeader.Subsystem);
	printf("WORD DllCharacteristics:			%04X\n", myNTHeader.OptionalHeader.DllCharacteristics);
	printf("DWORD SizeOfStackReserve:			%08X\n", myNTHeader.OptionalHeader.SizeOfStackReserve);
	printf("DWORD SizeOfStackCommit:			%08X\n", myNTHeader.OptionalHeader.SizeOfStackCommit);
	printf("DWORD SizeOfHeapReserve:			%08X\n", myNTHeader.OptionalHeader.SizeOfHeapReserve);
	printf("DWORD SizeOfHeapCommit:				%08X\n", myNTHeader.OptionalHeader.SizeOfHeapCommit);
	printf("DWORD LoaderFlags:				%08X\n", myNTHeader.OptionalHeader.LoaderFlags);
	printf("DWORD NumberOfRvaAndSizes :			%08X\n\n", myNTHeader.OptionalHeader.NumberOfRvaAndSizes);
	//节表目录
	printf("================IMAGE_OPTIONAL_HEADER================\n");
	pmySectionHeader = (IMAGE_SECTION_HEADER*)calloc(myNTHeader.FileHeader.NumberOfSections, sizeof(IMAGE_SECTION_HEADER));
	fseek(pfile, (e_lfanew + sizeof(IMAGE_NT_HEADERS)), SEEK_SET);
	fread(pmySectionHeader, sizeof(IMAGE_SECTION_HEADER), myNTHeader.FileHeader.NumberOfSections, pfile);
	for (int i = 0; i < myNTHeader.FileHeader.NumberOfSections; i++, pmySectionHeader++)
	{
		printf("BYTE Name:				%s\n", pmySectionHeader->Name);
		printf(":DWORD PhysicalAddress			%08X\n", pmySectionHeader->Misc.PhysicalAddress);
		printf(":DWORD VirtualSize			%08X\n", pmySectionHeader->Misc.VirtualSize);
		printf(":DWORD VirtualAddress			%08X\n", pmySectionHeader->VirtualAddress);
		printf(":DWORD SizeOfRawData			%08X\n", pmySectionHeader->SizeOfRawData);
		printf(":DWORD PointerToRawData			%08X\n", pmySectionHeader->PointerToRawData);
		printf(":DWORD PointerToRelocations		%08X\n", pmySectionHeader->PointerToRelocations);
		printf(":DWORD PointerToLinenumbers		%08X\n", pmySectionHeader->PointerToLinenumbers);
		printf(":WORD NumberOfRelocations		%04X\n", pmySectionHeader->NumberOfRelocations);
		printf(":WORD NumberOfLinenumbers		%04X\n", pmySectionHeader->NumberOfLinenumbers);
		printf(":DWORD Characteristics			%08X\n\n", pmySectionHeader->Characteristics);

	}
	pmySectionHeader = NULL;
	free(pmySectionHeader);
	fclose(pfile);
	getchar();
	return 0;
}
  • 5
    点赞
  • 11
    收藏
    觉得还不错? 一键收藏
  • 1
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论 1
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值