PE解析

// PE解析1.cpp : 定义控制台应用程序的入口点。
//1·获取文件到内存
//2·判断是否是PE文件
//3·解析字段
//
//f1·RVAtoFOA

#include "stdafx.h"
#include<windows.h>


char* ReadFileToMem(char* pFilePath)
{
	HANDLE hFile = CreateFileA(pFilePath,
		GENERIC_READ,
		FILE_SHARE_WRITE | FILE_SHARE_READ,//设置共享属性 默认为0会独占
		NULL,
		OPEN_EXISTING,
		FILE_ATTRIBUTE_NORMAL,
		NULL
		);
	if (hFile == INVALID_HANDLE_VALUE)
	{
		printf("File open failed\n");
		return 0;
	}
	//获取文件大小
	DWORD dwFileSize = GetFileSize(hFile, NULL);
	//申请内存空间
	char* pFileBuf = new char[dwFileSize] {};
	//读文件数据
	DWORD dwRead;
	BOOL bRet =
		ReadFile(hFile, pFileBuf, dwFileSize, &dwRead, NULL);

	if (bRet)
	{
		return pFileBuf;
	}
	delete pFileBuf;
	return 0;
}

/*2·判断是否是PE文件*/
BOOL IsPeFile(char* pFileBuf)
{
	PIMAGE_DOS_HEADER pDos=(PIMAGE_DOS_HEADER)pFileBuf;
	PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(pDos->e_lfanew + pFileBuf);

	if ((pDos->e_magic!=IMAG