把原来的整理了下,基本能用了


#include "stdafx.h"

#include <iostream>

#include <iomanip>

#include <fstream>

#include <string>

#include <windows.h>

using namespace std;

//读取文件,并返回文件流

//参数1:文件路径

//参数2:读取类型

FILE* ReadFile(LPSTR FilePath,char* Type)

{

	FILE* FileAddress;//定义文件流

	if (!(FileAddress = fopen(FilePath,Type)))

	{

		printf("没有读取文件失败,错误01");

		fclose(FileAddress);

		return 0;

	}

	return FileAddress;

}

//获得读取的文件流大小,返回文件流大小

//参数:文件流地址

int SizeOfFile(FILE* FileAddress)

{

	int size;

	//定位到文件末尾

	fseek(FileAddress, NULL, SEEK_END);

	//得到大小

	size = ftell(FileAddress);

	//重定位文件头到最开始的位置

	fseek(FileAddress, NULL, SEEK_SET);

	return size;

}

//申请动态内存,从文件流读取数据,并返回动态内存的文件指针

//参数1:文件流大小,字节

//参数2:文件流指针

//返回值:动态内存的文件指针

LPVOID File_to_FileBuffer(int size, FILE* FileAddress)

{

	if (!size)

	{

		printf("没有获得需要申请的内存大小");

		fclose(FileAddress);

		return 0;

	}

	LPVOID MalcMem = NULL;

	MalcMem = (char*)malloc(size);

	memset(MalcMem, 0, size);

	fread(MalcMem, 1,size, FileAddress);

	return MalcMem;

}

//把文件数据写内存中

//参数1:文件流地址,

//参数2:申请的Filebuffer动态内存地址,

//参数3:Filebuffer大小

LPVOID ReadFileMem(FILE* File_address, LPVOID pFilebuffer, int pFilebuffer_size)

{

	if (!(fread(pFilebuffer, 1, pFilebuffer_size, File_address)))

	{

		printf("错误,请查看代码1000");

		return 0;

	}

	return pFilebuffer;

}

//动态分配内存,并刷新分配的内存空间

//参数1:文件大小

char* Malloc(int buffer_size)

{

	char* buffer_address = (char*)malloc(buffer_size);

	if (!buffer_address)

	{

		printf("内存分配失败,检查代码1001");

		return 0;

	}

	memset(buffer_address, 0, buffer_size);

	return buffer_address;

}

//读取Filebuffer的信息,并打印出来

//参数1:buffer地址

void Read_Pe_info(IN LPVOID buffer_address)

{

	

	PIMAGE_DOS_HEADER pDosHeader = NULL;

	PIMAGE_NT_HEADERS pNTHeader = NULL;

	PIMAGE_FILE_HEADER pPEHeader = NULL;

	PIMAGE_OPTIONAL_HEADER32 pOptionHeader = NULL;

	PIMAGE_SECTION_HEADER pSectionHeader = NULL;

	pDosHeader = (PIMAGE_DOS_HEADER)buffer_address;

	// 获取PE头部偏移

	if (*((PDWORD)((DWORD)pDosHeader + pDosHeader->e_lfanew)) != IMAGE_NT_SIGNATURE)

	{

		printf("不是有效的PE标志!\n");

		free(buffer_address);

		

	}

	printf("pDosHeader:%x\n", pDosHeader->e_magic);

	pNTHeader = PIMAGE_NT_HEADERS((DWORD)pDosHeader + pDosHeader->e_lfanew);

	printf("=====================开始查找NT头中信息=============================\n\n");

	printf("pNTHeader:%08x\n", pNTHeader->Signature);

	//强制类型转化,指向标准PE头

	pPEHeader = PIMAGE_FILE_HEADER((DWORD)pNTHeader + 4);

	printf("=====================开始查找标准PE头中信息=========================\n");

	printf("pPEHeader:%x\n", pPEHeader->Machine);

	printf("节的数量:%d\n", pPEHeader->NumberOfSections);

	printf("SizeOfOptionalHeader(可选PE头的大小):%x\n", pPEHeader->SizeOfOptionalHeader);

	int NumberOfSections = pPEHeader->NumberOfSections;

	// 强制类型转换,指向可选PE头

	pOptionHeader = PIMAGE_OPTIONAL_HEADER32((DWORD)pPEHeader + IMAGE_SIZEOF_FILE_HEADER);

	printf("====================开始查找可选PE头中信息==========================\n");

	printf("SizeOfImage:%x\n", pOptionHeader->SizeOfImage);

	printf("SizeOfHeaders:%x\n", pOptionHeader->SizeOfHeaders);

	printf("SectionAlignment:%x\n", pOptionHeader->SectionAlignment);

	DWORD SizeOfHeaders = pOptionHeader->SizeOfHeaders;

	DWORD SizeOfImage = pOptionHeader->SizeOfImage;

	DWORD SectionAlignment = pOptionHeader->SectionAlignment;

	// 强制类型转换,指向节表中的信息

	printf("====================查找到节表中信息%d个==========================\n",pPEHeader->NumberOfSections);

	pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader + pPEHeader->SizeOfOptionalHeader);

	

	for (int i = 0; i<NumberOfSections; i++,pSectionHeader++)

	{

		printf("Section_Name:%s\n", pSectionHeader->Name);

		printf("VirtualAddress:%08X\n", pSectionHeader->VirtualAddress);

		printf("SizeOfRawData:%08X\n", pSectionHeader->SizeOfRawData);

		printf("PointerToRawData:%08X\n", pSectionHeader->PointerToRawData);

		printf("==============================================\n");

		//info_Address[i] = pSectionHeader->VirtualAddress;

		//info_RawData[i] = pSectionHeader->SizeOfRawData;

		//info_PointerToRawData[i] = pSectionHeader->PointerToRawData;

	}

	printf("打印PE信息结束!!\n");

	

}

//FileBuffer拉伸到Imagebuffer

//参数1:FileBuffer指针

void FileBufferToImagebuffer(IN LPVOID pFileBuffer,OUT LPVOID* pImagebuffer)

{

	LPVOID pTempImageBuffer = NULL;

	if (!pFileBuffer)

	{

		printf("没有获取到FileBuffer指针,请检查代码");

	}

	

	PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)pFileBuffer;

	if (*(PWORD)pDos!=IMAGE_DOS_SIGNATURE)

	{

		printf("不是有效的MZ标志,请检查代码或者是否为EXE程序");

	}

	PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)((DWORD)pDos+pDos->e_lfanew);

	if (*(PWORD)pNt != IMAGE_NT_SIGNATURE)

	{

		printf("不是有效的PE标志,请检查代码或者是否为EXE程序");

	}

	PIMAGE_FILE_HEADER pFile = (PIMAGE_FILE_HEADER)((DWORD)pNt + 4);

	PIMAGE_OPTIONAL_HEADER pOption = (PIMAGE_OPTIONAL_HEADER)((DWORD)pFile + IMAGE_SIZEOF_FILE_HEADER);

	PIMAGE_SECTION_HEADER pSetion = (PIMAGE_SECTION_HEADER)((DWORD)pOption + pFile->SizeOfOptionalHeader);

	

	//将sizeofimage的值扩展为SectionAlignment的整数倍(在内存中一般是0x1000的整数倍)

	int Sizeofimage_Alignment = pOption->SizeOfImage;

	int iTemp = pOption->SizeOfImage % pOption->SectionAlignment;

	if (iTemp!= 0)

	{

		Sizeofimage_Alignment = pOption->SizeOfImage + pOption->SectionAlignment - iTemp;

	}

	//申请动态内存

	pTempImageBuffer = (LPVOID)malloc(Sizeofimage_Alignment);

	//刷新内存

	memset(pTempImageBuffer, 0, pOption->SizeOfImage);

	//复制头到动态内存

	if (!pTempImageBuffer)

	{

		printf("内存分配失败,代码0009");

	}

	memcpy(pTempImageBuffer, pFileBuffer, pOption->SizeOfHeaders);

	//复制节表

	int CountSection = pFile->NumberOfSections;

	for (int i = 0; i < CountSection; i++, pSetion++)

	{

		memcpy((LPVOID)((DWORD)pTempImageBuffer + pSetion->VirtualAddress), (LPVOID)((DWORD)pDos+pSetion->PointerToRawData), pSetion->SizeOfRawData);

	}

	*pImagebuffer = pTempImageBuffer;

}

//计算文件大小

//参数:文件指针

//int返回值:文件大小

int compute_file_len(FILE* pfile)

{

	int len = 0;

	fseek(pfile, 0, SEEK_END);

	len = ftell(pfile);

	fseek(pfile, 0, SEEK_SET);

	return len;

}
  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值