编码实现PE文件解析(C源代码)

// GetPEInfo.cpp : Defines the entry point for the console application.
//




#include <windows.h>
#include <stdio.h>


DWORD NumberOfSections=0;//global
DWORD difK=0;//file offset
DWORD *difA=NULL;//virtual address
DWORD *difS=NULL;//offset
int exportFlag=1;
int debugFlag=1;


BOOL IsPEFile(HANDLE ImageBase)
{
PIMAGE_DOS_HEADER pDH=NULL;
PIMAGE_NT_HEADERS pNtH=NULL;


if(ImageBase==NULL)
return FALSE;


pDH=(PIMAGE_DOS_HEADER)ImageBase;
if(IMAGE_DOS_SIGNATURE!=pDH->e_magic)
return FALSE;


pNtH=(PIMAGE_NT_HEADERS)((DWORD)pDH+pDH->e_lfanew);//
if(IMAGE_NT_SIGNATURE!=pNtH->Signature)
return FALSE;


return TRUE;
}


PIMAGE_NT_HEADERS GetNtHeaders(HANDLE ImageBase)
{
PIMAGE_DOS_HEADER pDH=NULL;
PIMAGE_NT_HEADERS pNtH=NULL;


if(!IsPEFile(ImageBase))
return NULL;


pDH=(PIMAGE_DOS_HEADER)ImageBase;
pNtH=(PIMAGE_NT_HEADERS)((DWORD)pDH+pDH->e_lfanew);


return pNtH;
}


PIMAGE_FILE_HEADER WINAPI GetFileHeader(HANDLE ImageBase)
{
PIMAGE_NT_HEADERS pNtH=NULL;
pNtH=GetNtHeaders(ImageBase);
if(!pNtH)
return NULL;
PIMAGE_FILE_HEADER pFH=NULL;
pFH=&pNtH->FileHeader;
return pFH;
}


PIMAGE_OPTIONAL_HEADER WINAPI GetOptionalHeader(HANDLE ImageBase)
{
PIMAGE_NT_HEADERS pNtH=NULL;
pNtH=GetNtHeaders(ImageBase);
if(!pNtH)
return NULL;
PIMAGE_OPTIONAL_HEADER pOH=NULL;
pOH=&pNtH->OptionalHeader;
return pOH;
}


void ShowFileHeaderInfo(HANDLE ImageBase)
{
PIMAGE_FILE_HEADER pFH=NULL;
pFH=GetFileHeader(ImageBase);
if(!pFH)
return ;
printf("Machine: 0x%.4X\n",pFH->Machine);
printf("NumberOfSections: 0x%.4X\n",pFH->NumberOfSections);
printf("TimeDateStamp: 0x%.8X\n",pFH->TimeDateStamp);
printf("PointerToSymbolTable: 0x%.8X\n",pFH->PointerToSymbolTable);
printf("NumberOfSymbols: 0x%.8X\n",pFH->NumberOfSymbols);
printf("SizeOfOptionalHeader: 0x%.4X\n",pFH->SizeOfOptionalHeader);
printf("Characteristics: 0x%.4X\n",pFH->Characteristics);
}


void ShowOptionalHeaderInfo(HANDLE ImageBase)
{
PIMAGE_OPTIONAL_HEADER pOH=NULL;
pOH=GetOptionalHeader(ImageBase);
if(!pOH)
return ;
printf("Magic: 0x%.4X\n",pOH->Magic);
printf("MajorLinkerVersion: 0x%.2X\n",pOH->MajorLinkerVersion);
printf("SizeOfCode: 0x%.8X\n",pOH->SizeOfCode);//.text
printf("SizeOfInitializedData: 0x%.8X\n",pOH->SizeOfInitializedData);
printf("SizeOfUninitializedData: 0x%.8X\n",pOH->SizeOfUninitializedData);//.bss
printf("AddressOfEntryPoint: 0x%.8X\n",pOH->AddressOfEntryPoint);
printf("BaseOfCode: 0x%.8X\n",pOH->BaseOfCode);//code section RVA
printf("BaseOfData: 0x%.8X\n",pOH->BaseOfData);//data section RVA
printf("ImageBase: 0x%.8X\n",pOH->ImageBase);
printf("Subsystem: 0x%.8X\n",pOH->Subsystem);
printf("NumberOfRvaAndSizes: 0x%.8X\n",pOH->NumberOfRvaAndSizes);//number of DataDirectory
}


void ShowDataDirInfo(HANDLE ImageBase)
{
PIMAGE_OPTIONAL_HEADER pOH=NULL;
pOH=GetOptionalHeader(ImageBase);
if(!pOH)
return ;
if(pOH->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size==0)exportFlag=0;//no Export Table
if(pOH->DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].Size==0)debugFlag=0;//no Debug Table
printf("DataDirectory RVA