pe分析
#include<iostream>
#include<Windows.h>
using namespace std;
int len(FILE* pfile)
{
fseek(pfile, 0, SEEK_END);
int result = ftell(pfile);
rewind(pfile);
return result;
}
int main()
{
FILE* pfile = NULL;
pfile = fopen("C:\\Users\\52511\\Desktop\\1.exe", "rb");
int fileLength = len(pfile);
cout <<"文件大小:" << fileLength << " Bytes" << endl;
char* buffer = (char*)malloc(sizeof(char)*fileLength);
memset(buffer, 0, sizeof(char) * fileLength);
fread(buffer, 1, fileLength, pfile);
PIMAGE_DOS_HEADER readDosHeader;
readDosHeader = (PIMAGE_DOS_HEADER)buffer;
printf("===========DOS头============\n");
printf("MZ标志位:%x\n", readDosHeader->e_magic);
printf("PE头偏移:%x\n", readDosHeader->e_lfanew);
printf("===========NT头============\n");
PIMAGE_NT_HEADERS readNTheader;
readNTheader = (PIMAGE_NT_HEADERS)(buffer + readDosHeader->e_lfanew);
printf("PE标志位:%x\n", readNTheader->Signature);
printf("运行平台:%x\n", readNTheader->FileHeader.Machine);
printf("可选头大小:%x\n", readNTheader->FileHeader.SizeOfOptionalHeader);
printf("ImageBase:%x\n", readNTheader->OptionalHeader.ImageBase);
printf("===========节表============\n");
PIMAGE_SECTION_HEADER readSectionHeader = (PIMAGE_SECTION_HEADER)(buffer+readDosHeader->e_lfanew+4+20+readNTheader->FileHeader.SizeOfOptionalHeader);
PIMAGE_FILE_HEADER pfileheader = &readNTheader->FileHeader;
int length = pfileheader->NumberOfSections;
for (int i = 0; i < length; i++)
{
printf("==========name:%s===========\n", readSectionHeader[i].Name);
printf("磁盘中该节区开始位置:%x\n", readSectionHeader[i].PointerToRawData);
printf("磁盘中该节区大小:%x\n", readSectionHeader[i].SizeOfRawData);
printf("内存中该节区开始位置:%x\n", readSectionHeader[i].VirtualAddress);
}
free(buffer);
return 0;
}
filebuffer to imagebuffer to filebuffer
#include<stdio.h>
#include<Windows.h>
#include<iostream>
#pragma warning(disable:4996)
using namespace std;
int len(FILE* pfile)
{
fseek(pfile, 0, SEEK_END);
int result = ftell(pfile);
rewind(pfile);
return result;
}
int main()
{
FILE* filebuffer = NULL;
filebuffer = fopen("C://Users//52511//Desktop//1.exe", "rb");
FILE* filebuffer1 = fopen("C://Users//52511//Desktop//3.exe", "wb");
FILE* filebuffer2 = fopen("C://Users//52511//Desktop//4.exe", "wb");
char* buffer = NULL;
buffer = (char*)malloc(len(filebuffer));
memset(buffer, 0, len(filebuffer));
fread(buffer, 1, len(filebuffer), filebuffer);
//dos
PIMAGE_DOS_HEADER rdos = (PIMAGE_DOS_HEADER)buffer;
//optional
PIMAGE_OPTIONAL_HEADER rop = (PIMAGE_OPTIONAL_HEADER)(buffer + rdos->e_lfanew + 4 + 20);
//NT
PIMAGE_FILE_HEADER pfh = (PIMAGE_FILE_HEADER)(buffer + 4+rdos->e_lfanew);
//导入dos头
int imageLength = rop->SizeOfImage;
char* imagebuffer = (char*)malloc(imageLength * sizeof(char));
memset(imagebuffer, 0, imageLength);
int PEheaderSize = rop->SizeOfHeaders;
memcpy(imagebuffer, buffer, PEheaderSize);
//导入节
PIMAGE_SECTION_HEADER rSec = (PIMAGE_SECTION_HEADER)(buffer+rdos->e_lfanew + 4 + 20 + pfh->SizeOfOptionalHeader);
for (int i = 0; i < pfh->NumberOfSections; i++)
{
memcpy(imagebuffer+ rSec[i].VirtualAddress, buffer+ rSec[i].PointerToRawData, rSec[i].SizeOfRawData);
}
fwrite(imagebuffer, 1, imageLength, filebuffer1);
char* newbuffer = (char*)malloc(sizeof(char) * len(filebuffer));
memset(newbuffer, 0, len(filebuffer));
memcpy(newbuffer, imagebuffer, PEheaderSize);
for (int i = 0; i < pfh->NumberOfSections; i++)
{
memcpy(newbuffer+rSec[i].PointerToRawData, imagebuffer + rSec[i].VirtualAddress, rSec[i].SizeOfRawData);
}
fwrite(newbuffer, 1, len(filebuffer), filebuffer2);
fclose(filebuffer);
fclose(filebuffer1);
free(buffer);
free(imagebuffer);
return 0;
}