pe查看对比小工具

PE.asm

.386
.model flat,stdcall
option casemap:none

include    windows.inc
include    user32.inc
include    kernel32.inc
include    gdi32.inc
include    comctl32.inc
include    comdlg32.inc
include    advapi32.inc
include    shell32.inc
include    masm32.inc
include    netapi32.inc
include    winmm.inc
include    ws2_32.inc
include    psapi.inc
include    mpr.inc        ;WNetCancelConnection2
include    iphlpapi.inc   ;SendARP
includelib comctl32.lib
includelib comdlg32.lib
includelib gdi32.lib
includelib user32.lib
includelib kernel32.lib
includelib advapi32.lib
includelib shell32.lib
includelib masm32.lib
includelib netapi32.lib
includelib winmm.lib
includelib ws2_32.lib
includelib psapi.lib
includelib mpr.lib
includelib iphlpapi.lib

IDC_IMG1 equ 1102
ICO_MAIN equ 1000

IDR_MENU1 equ 10000
IDM_COMP equ 10001
IDM_DUMP equ 10002
IDM_EXIT equ 10003
IDM_LOOK  equ 10004
IDM_STOPDUMP equ 10005

IDD_MAIN equ 1000
IDC_INFO equ 1001


IDD_RESULT equ 1100
IDC_EDT1 equ 1103
IDC_EDT2 equ 1104
IDC_BTN1 equ 1105
IDC_BTN2 equ 1106
IDC_TAB equ 1107
IDC_OK equ 1108


.data 
	hInstance dd ?
	hRichEdit dd ?
	hWinMain dd ?
	hWinEdit dd ?
	szFileName db MAX_PATH dup(?)
	totalSize dd ?;PE文件字节数
	lpMemory dd ?;打开的文件内存映像在进程的起始地址
	;szT db 100 dup(0)
	;szF db '%d',0
	dwStop dd 0;多线程解决pe文件太长阻塞主线程消息循环问题
	lpServicesBuffer db 100 dup(0)
	bufDisplay db 50 dup(0)
	lpszFmt db '%08x ',0
	lpszBlank db ' ',0
	lpszManyBlanks db '  ',0
	lpszReturn db 0dh,0ah,0
	lpszHexArr db '0123456789ABCDEF',0
	
	szRec1      db 'IMAGE_DOS_HEADER.e_magic',0
	szRec2      db 'IMAGE_DOS_HEADER.e_cblp',0
	szRec3      db 'IMAGE_DOS_HEADER.e_cp',0
	szRec4      db 'IMAGE_DOS_HEADER.e_crlc',0
	szRec5      db 'IMAGE_DOS_HEADER.e_cparhdr',0
	szRec6      db 'IMAGE_DOS_HEADER.e_minalloc',0
	szRec7      db 'IMAGE_DOS_HEADER.e_maxalloc',0
	szRec8      db 'IMAGE_DOS_HEADER.e_ss',0
	szRec9      db 'IMAGE_DOS_HEADER.e_sp',0
	szRec10     db 'IMAGE_DOS_HEADER.e_csum',0
	szRec11     db 'IMAGE_DOS_HEADER.e_ip',0
	szRec12     db 'IMAGE_DOS_HEADER.e_cs',0
	szRec13     db 'IMAGE_DOS_HEADER.e_lfarlc',0
	szRec14     db 'IMAGE_DOS_HEADER.e_ovno',0
	szRec15     db 'IMAGE_DOS_HEADER.e_res',0
	szRec16     db 'IMAGE_DOS_HEADER.e_oemid',0
	szRec17     db 'IMAGE_DOS_HEADER.e_oeminfo',0
	szRec18     db 'IMAGE_DOS_HEADER.e_res2',0
	szRec19     db 'IMAGE_DOS_HEADER.e_lfanew',0

	szRec20     db 'IMAGE_NT_HEADERS.Signature',0

	szRec21     db 'IMAGE_FILE_HEADER.Machine',0
	szRec22     db 'IMAGE_FILE_HEADER.NumberOfSections',0
	szRec23     db 'IMAGE_FILE_HEADER.TimeDateStamp',0
	szRec24     db 'IMAGE_FILE_HEADER.PointerToSymbolTable',0
	szRec25     db 'IMAGE_FILE_HEADER.NumberOfSymbols',0
	szRec26     db 'IMAGE_FILE_HEADER.SizeOfOptionalHeader',0
	szRec27     db 'IMAGE_FILE_HEADER.Characteristics',0
	
	szRec28     db 'IMAGE_OPTIONAL_HEADER32.Magic',0
	szRec29     db 'IMAGE_OPTIONAL_HEADER32.MajorLinkerVersion',0
	szRec30     db 'IMAGE_OPTIONAL_HEADER32.MinorLinkerVersion',0
	szRec31     db 'IMAGE_OPTIONAL_HEADER32.SizeOfCode',0
	szRec32     db 'IMAGE_OPTIONAL_HEADER32.SizeOfInitializedData',0
	szRec33     db 'IMAGE_OPTIONAL_HEADER32.SizeOfUninitializedData',0
	szRec34     db 'IMAGE_OPTIONAL_HEADER32.AddressOfEntryPoint',0
	szRec35     db 'IMAGE_OPTIONAL_HEADER32.BaseOfCode',0
	szRec36     db 'IMAGE_OPTIONAL_HEADER32.BaseOfData',0
	szRec37     db 'IMAGE_OPTIONAL_HEADER32.ImageBase',0
	szRec38     db 'IMAGE_OPTIONAL_HEADER32.SectionAlignment',0
	szRec39     db 'IMAGE_OPTIONAL_HEADER32.FileAlignment',0
	szRec40     db 'IMAGE_OPTIONAL_HEADER32.MajorOperatingSystemVersion',0
	szRec41     db 'IMAGE_OPTIONAL_HEADER32.MinorOperatingSystemVersion',0
	szRec42     db 'IMAGE_OPTIONAL_HEADER32.MajorImageVersion',0
	szRec43     db 'IMAGE_OPTIONAL_HEADER32.MinorImageVersion',0
	szRec44     db 'IMAGE_OPTIONAL_HEADER32.MajorSubsystemVersion',0
	szRec45     db 'IMAGE_OPTIONAL_HEADER32.MinorSubsystemVersion',0
	szRec46     db 'IMAGE_OPTIONAL_HEADER32.Win32VersionValue',0
	szRec47     db 'IMAGE_OPTIONAL_HEADER32.SizeOfImage',0
	szRec48     db 'IMAGE_OPTIONAL_HEADER32.SizeOfHeaders',0
	szRec49     db 'IMAGE_OPTIONAL_HEADER32.CheckSum',0
	szRec50     db 'IMAGE_OPTIONAL_HEADER32.Subsystem',0
	szRec51     db 'IMAGE_OPTIONAL_HEADER32.DllCharacteristics',0
	szRec52     db 'IMAGE_OPTIONAL_HEADER32.SizeOfStackReserve',0
	szRec53     db 'IMAGE_OPTIONAL_HEADER32.SizeOfStackCommit',0
	szRec54     db 'IMAGE_OPTIONAL_HEADER32.SizeOfHeapReserve',0
	szRec55     db 'IMAGE_OPTIONAL_HEADER32.SizeOfHeapCommit',0
	szRec56     db 'IMAGE_OPTIONAL_HEADER32.LoaderFlags',0
	szRec57     db 'IMAGE_OPTIONAL_HEADER32.NumberOfRvaAndSizes',0
	
	szRec58     db 'IMAGE_DATA_DIRECTORY.VirtualAddress(Export)',0
	szRec59     db 'IMAGE_DATA_DIRECTORY.isize(Export)',0
	szRec60     db 'IMAGE_DATA_DIRECTORY.VirtualAddress(Import)',0
	szRec61     db 'IMAGE_DATA_DIRECTORY.isize(Import)',0
	szRec62     db 'IMAGE_DATA_DIRECTORY.VirtualAddress(Resource)',0
	szRec63     db 'IMAGE_DATA_DIRECTORY.isize(Resource)',0
	szRec64     db 'IMAGE_DATA_DIRECTORY.VirtualAddress(Exception)',0
	szRec65     db 'IMAGE_DATA_DIRECTORY.isize(Exception)',0
	szRec66     db 'IMAGE_DATA_DIRECTORY.VirtualAddress(Security)',0
	szRec67     db 'IMAGE_DATA_DIRECTORY.isize(Security)',0
	szRec68     db 'IMAGE_DATA_DIRECTORY.VirtualAddress(BaseReloc)',0
	szRec69     db 'IMAGE_DATA_DIRECTORY.isize(BaseReloc)',0
	szRec70     db 'IMAGE_DATA_DIRECTORY.VirtualAddress(Debug)',0
	szRec71     db 'IMAGE_DATA_DIRECTORY.isize(Debug)',0
	szRec72     db 'IMAGE_DATA_DIRECTORY.VirtualAddress(Architecture)',0
	szRec73     db 'IMAGE_DATA_DIRECTORY.isize(Architecture)',0
	szRec74     db 'IMAGE_DATA_DIRECTORY.VirtualAddress(GlobalPTR)',0
	szRec75     db 'IMAGE_DATA_DIRECTORY.isize(GlobalPTR)',0
	szRec76     db 'IMAGE_DATA_DIRECTORY.VirtualAddress(TLS)',0
	szRec77     db 'IMAGE_DATA_DIRECTORY.isize(TLS)',0
	szRec78     db 'IMAGE_DATA_DIRECTORY.VirtualAddress(Load_Config)',0
	szRec79     db 'IMAGE_DATA_DIRECTORY.isize(Load_Config)',0
	szRec80     db 'IMAGE_DATA_DIRECTORY.VirtualAddress(Bound_Import)',0
	szRec81     db 'IMAGE_DATA_DIRECTORY.isize(Bound_Import)',0
	szRec82     db 'IMAGE_DATA_DIRECTORY.VirtualAddress(IAT)',0
	szRec83     db 'IMAGE_DATA_DIRECTORY.isize(IAT)',0
	szRec84     db 'IMAGE_DATA_DIRECTORY.VirtualAddress(Delay_Import)',0
	szRec85     db 'IMAGE_DATA_DIRECTORY.isize(Delay_Import)',0
	szRec86     db 'IMAGE_DATA_DIRECTORY.VirtualAddress(Com_Descriptor)',0
	szRec87     db 'IMAGE_DATA_DIRECTORY.isize(Com_Descriptor)',0
	szRec88     db 'IMAGE_DATA_DIRECTORY.VirtualAddress(Reserved)',0
	szRec89     db 'IMAGE_DATA_DIRECTORY.isize(Reserved)',0
	
	szRec90     db 'IMAGE_SECTION_HEADER%d.Name1',0
	szRec91     db 'IMAGE_SECTION_HEADER%d.VirtualSize',0
	szRec92     db 'IMAGE_SECTION_HEADER%d.VirtualAddress',0
	szRec93     db 'IMAGE_SECTION_HEADER%d.SizeOfRawData',0
	szRec94     db 'IMAGE_SECTION_HEADER%d.PointerToRawData',0
	szRec95     db 'IMAGE_SECTION_HEADER%d.PointerToRelocations',0
	szRec96     db 'IMAGE_SECTION_HEADER%d.PointerToLinenumbers',0
	szRec97     db 'IMAGE_SECTION_HEADER%d.NumberOfRelocations',0
	szRec98     db 'IMAGE_SECTION_HEADER%d.NumberOfLinenumbers',0
	szRec99     db 'IMAGE_SECTION_HEADER%d.Characteristics',0
	
	
	hProcessModuleTable dd ?

	szResultColName1 db  'PE数据结构相关字段',0
	szResultColName2 db  '文件1的值(H)',0
	szResultColName3 db  '文件2的值(H)',0
	dwCount dd ?
	hFile dd ?
	szFileNameOpen1      db MAX_PATH dup(0)
	szFileNameOpen2      db MAX_PATH dup(0)
	
	stLVC LV_COLUMN <?>
	stLVI LV_ITEM <?>
	hText1      dd ?
	hText2      dd ?
	bufTemp1         db  200 dup(0),0
	bufTemp2         db  200 dup(0),0
	szBuffer         db  256 dup(0),0
	
.const 
	szDllEdit db 'RichEd20.dll',0
	szClassEdit db 'RichEdit20A',0
	szFont db '宋体',0
	szTest db 'OPEN!',0
	szlpstrFilter db 'PE File',0,'*.exe',0
	szErrFormat db '程序异常!',0
	szNotFound db '节区名称获取失败!',0
.code
	_init proc 
		
		;富文本编辑框需要使用的结构体:
		local @stCf:CHARFORMAT
		;获取富文本编辑框句柄
		invoke GetDlgItem,hWinMain,IDC_INFO
		mov hWinEdit,eax
		
		;设置图标
		invoke LoadIcon,hInstance,ICO_MAIN
		invoke SendMessage,hWinMain,WM_SETICON,ICON_BIG,eax
		
		;设置编辑控件
		invoke SendMessage,hWinEdit,EM_SETTEXTMODE,TM_PLAINTEXT,0
		invoke RtlZeroMemory,addr @stCf,sizeof @stCf
		mov @stCf.cbSize,sizeof @stCf
		mov @stCf.dwMask,CFM_FACE or CFM_SIZE or CFM_BOLD
		mov @stCf.yHeight,9*30
		invoke lstrcpy,addr @stCf.szFaceName,addr szFont
		invoke SendMessage,hWinEdit,EM_SETCHARFORMAT,0,addr @stCf
		invoke SendMessage,hWinEdit,EM_EXLIMITTEXT,0,-1
		ret
		
	_init endp
	
	;异常处理子程序
	_Handler proc _lpExceptionRecord,_lpSEH,_lpContext,_lpDispathcerContext
		
		pushad
		mov esi,_lpExceptionRec