c语言读取PE文件,代码如下:
#include <iostream>
#include<Windows.h>
IMAGE_DOS_HEADER myDosHeader;
IMAGE_NT_HEADERS myNTHeader;
IMAGE_FILE_HEADER myFileHeader;
IMAGE_OPTIONAL_HEADER myOptionHeader;
IMAGE_SECTION_HEADER* pmySectionHeader;
LONG e_lfanew;
int main(int argc, char* argv[])
{
FILE* pfile;
errno_t err;
DWORD fileSize = 0;
if ((err = fopen_s(&pfile, "c:/tion.exe", "r"))!= 0)
{
printf("打开文件错误!");
getchar();
}
//DOS头部分
printf("================IMAGE_DOS_HEADER================\n");
fread(&myDosHeader,1 ,sizeof(IMAGE_DOS_HEADER), pfile);
if (myDosHeader.e_magic!=0x5A4D)
{
printf("不是MZ开头的文件!");
fclose(pfile);
exit(0);
}
printf("WORD e_magic: %04X\n", myDosHeader.e_magic);
printf("DOWRD e_lfaner: %08X\n\n", myDosHeader.e_lfanew);
e_lfanew = myDosHeader.e_lfanew;
//NT头部分
printf("================IMAGE_NT_HEADER================\n");
fseek(pfile, e_lfanew, SEEK_SET);
fread(&myNTHeader, 1, sizeof(IMAGE_NT_HEADERS), pfile);
if (myNTHeader.Signature != 0x4550)
{
printf("文件有问题!");
fclose(pfile);
exit(0);
}
printf("DWORD Signature: %08X\n\n",myNTHeader.Signature);
//FILE头部分
printf("================IMAGE_FILE_HEADER================\n");
printf("WORD Machine: %04X\n", myNTHeader.FileHeader.Machine);
printf("WORD NumberOfSection: %04X\n", myNTHeader.FileHeader.NumberOfSections);
printf("DWORD TimeDateStamp: %08X\n", myNTHeader.FileHeader.TimeDateStamp);
printf("DWORD pointerToSymbolTable %08X\n", myNTHeader.FileHeader.PointerToSymbolTable);
printf("DWORD NumberOfSymbols: %08X\n", myNTHeader.FileHeader.NumberOfSymbols);
printf("WORD SizeOfOptionHeader: %04X\n", myNTHeader.FileHeader.SizeOfOptionalHeader);
printf("WORD Characteristics: %04X\n\n", myNTHeader.FileHeader.Characteristics);
OPTIONAL头部分
printf("================IMAGE_OPTION_HEADER================\n");
printf("WORD Magic; %04X\n", myNTHeader.OptionalHeader.Magic);
printf("BYTE MajorLinkerVersion: %02X\n", myNTHeader.OptionalHeader.MajorLinkerVersion);
printf("BYTE MinorLinkerVersion: %02X\n",myNTHeader.OptionalHeader.MinorLinkerVersion);
printf("DWORD SizeOfCode; %08X\n", myNTHeader.OptionalHeader.SizeOfCode);
printf("DWORD SizeOfInitializedData: %08X\n", myNTHeader.OptionalHeader.SizeOfInitializedData);
printf(" DWORD SizeOfUninitializedData %08X\n", myNTHeader.OptionalHeader.SizeOfUninitializedData);
printf("DWORD AddressOfEntryPoint: %08X\n", myNTHeader.OptionalHeader.AddressOfEntryPoint);
printf("DWORD BaseOfCode: %08X\n", myNTHeader.OptionalHeader.BaseOfCode);
printf("DWORD BaseOfData: %08X\n", myNTHeader.OptionalHeader.BaseOfData);
printf("DWORD ImageBase: %08X\n", myNTHeader.OptionalHeader.ImageBase);
printf("DWORD SectionAlignmen: %08X\n", myNTHeader.OptionalHeader.SectionAlignment);
printf("DWORD FileAlignment: %08X\n", myNTHeader.OptionalHeader.FileAlignment);
printf("WORD MajorOperatingSystemVersion: %04X\n", myNTHeader.OptionalHeader.MajorOperatingSystemVersion);
printf("WORD MinorOperatingSystemVersion: %04X\n", myNTHeader.OptionalHeader.MinorOperatingSystemVersion);
printf("WORD MajorImageVersion: %04X\n", myNTHeader.OptionalHeader.MajorImageVersion);
printf("WORD MinorImageVersion: %04X\n", myNTHeader.OptionalHeader.MinorImageVersion);
printf("WORD MajorSubsystemVersion: %04X\n", myNTHeader.OptionalHeader.MajorSubsystemVersion);
printf("WORD MinorSubsystemVersion: %04X\n", myNTHeader.OptionalHeader.MinorSubsystemVersion);
printf("DWORD Win32VersionValue: %08X\n", myNTHeader.OptionalHeader.Win32VersionValue);
printf("DWORD SizeOfImage: %08X\n", myNTHeader.OptionalHeader.SizeOfImage);
printf("DWORD SizeOfHeaders: %08X\n", myNTHeader.OptionalHeader.SizeOfHeaders);
printf("DWORD CheckSum: %08X\n", myNTHeader.OptionalHeader.CheckSum);
printf("WORD Subsystem: %04X\n", myNTHeader.OptionalHeader.Subsystem);
printf("WORD DllCharacteristics: %04X\n", myNTHeader.OptionalHeader.DllCharacteristics);
printf("DWORD SizeOfStackReserve: %08X\n", myNTHeader.OptionalHeader.SizeOfStackReserve);
printf("DWORD SizeOfStackCommit: %08X\n", myNTHeader.OptionalHeader.SizeOfStackCommit);
printf("DWORD SizeOfHeapReserve: %08X\n", myNTHeader.OptionalHeader.SizeOfHeapReserve);
printf("DWORD SizeOfHeapCommit: %08X\n", myNTHeader.OptionalHeader.SizeOfHeapCommit);
printf("DWORD LoaderFlags: %08X\n", myNTHeader.OptionalHeader.LoaderFlags);
printf("DWORD NumberOfRvaAndSizes : %08X\n\n", myNTHeader.OptionalHeader.NumberOfRvaAndSizes);
//节表目录
printf("================IMAGE_OPTIONAL_HEADER================\n");
pmySectionHeader = (IMAGE_SECTION_HEADER*)calloc(myNTHeader.FileHeader.NumberOfSections, sizeof(IMAGE_SECTION_HEADER));
fseek(pfile, (e_lfanew + sizeof(IMAGE_NT_HEADERS)), SEEK_SET);
fread(pmySectionHeader, sizeof(IMAGE_SECTION_HEADER), myNTHeader.FileHeader.NumberOfSections, pfile);
for (int i = 0; i < myNTHeader.FileHeader.NumberOfSections; i++, pmySectionHeader++)
{
printf("BYTE Name: %s\n", pmySectionHeader->Name);
printf(":DWORD PhysicalAddress %08X\n", pmySectionHeader->Misc.PhysicalAddress);
printf(":DWORD VirtualSize %08X\n", pmySectionHeader->Misc.VirtualSize);
printf(":DWORD VirtualAddress %08X\n", pmySectionHeader->VirtualAddress);
printf(":DWORD SizeOfRawData %08X\n", pmySectionHeader->SizeOfRawData);
printf(":DWORD PointerToRawData %08X\n", pmySectionHeader->PointerToRawData);
printf(":DWORD PointerToRelocations %08X\n", pmySectionHeader->PointerToRelocations);
printf(":DWORD PointerToLinenumbers %08X\n", pmySectionHeader->PointerToLinenumbers);
printf(":WORD NumberOfRelocations %04X\n", pmySectionHeader->NumberOfRelocations);
printf(":WORD NumberOfLinenumbers %04X\n", pmySectionHeader->NumberOfLinenumbers);
printf(":DWORD Characteristics %08X\n\n", pmySectionHeader->Characteristics);
}
pmySectionHeader = NULL;
free(pmySectionHeader);
fclose(pfile);
getchar();
return 0;
}