PE相关代码
2009-03-25 22:53
183 查看
查看PE文件重定位表
#include "stdafx.h"
#include <Windows.h>
DWORD RVA2Offset(PIMAGE_NT_HEADERS pNTHeader, DWORD dwRVA)
{
PIMAGE_SECTION_HEADER pSection = (PIMAGE_SECTION_HEADER)((DWORD)pNTHeader + sizeof(IMAGE_NT_HEADERS));
for(int i = 0; i < pNTHeader->FileHeader.NumberOfSections; i++)
{
if(dwRVA >= pSection[i].VirtualAddress && dwRVA < (pSection[i].VirtualAddress + pSection[i].SizeOfRawData))
{
return pSection[i].PointerToRawData + (dwRVA - pSection[i].VirtualAddress);
}
}
return 0;
}
int _tmain(int argc, _TCHAR* argv[])
{
HANDLE hFile = CreateFile(argv[1], GENERIC_ALL, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL);
HANDLE hMapping = CreateFileMapping(hFile, NULL, PAGE_READWRITE, 0, 0, NULL);
PVOID pbFile = MapViewOfFile(hMapping, FILE_MAP_ALL_ACCESS, 0, 0, 0);
if(INVALID_HANDLE_VALUE == hFile || NULL == hMapping || NULL == pbFile)
{
printf("/n/t---------- The File Inexistence! ----------/n");
goto EXIT;
}
PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)pbFile;
PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pbFile + pDosHeader->e_lfanew);
if(0x00004550 != pNTHeader->Signature)
{
printf("/n/t---------- Lawless PE File! ----------/n");
goto EXIT;
}
DWORD dwRelocOffset = RVA2Offset(pNTHeader, pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress);
PIMAGE_BASE_RELOCATION pReloc = (PIMAGE_BASE_RELOCATION)((DWORD)pbFile + dwRelocOffset);
if(0 == pReloc->VirtualAddress)
{
printf("/n/t---------- No Relocation Table! ----------/n");
goto EXIT;
}
while(pReloc->VirtualAddress)
{
printf("[0x%08X]/n/n", pReloc->VirtualAddress);
for(int i = 0; i < (pReloc->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / 2; i++)
{
printf(" <%04d> - 0x%08X/n", i, pReloc->VirtualAddress + ((*(WORD*)((DWORD)pReloc + sizeof(IMAGE_BASE_RELOCATION) + i * 2)) & 0x0FFF));
}
printf("/n");
pReloc = (PIMAGE_BASE_RELOCATION)((DWORD)pReloc + pReloc->SizeOfBlock);
}
EXIT:
if(NULL != pbFile)
{
UnmapViewOfFile(pbFile);
}
if(NULL != hMapping)
{
CloseHandle(hMapping);
}
if (INVALID_HANDLE_VALUE != hFile)
{
CloseHandle(hFile);
}
return 0;
}
查看PE文件导出表
#include "stdafx.h"
#include <Windows.h>
DWORD RVA2Offset(PIMAGE_NT_HEADERS pNTHeader, DWORD dwRVA)
{
PIMAGE_SECTION_HEADER pSection = (PIMAGE_SECTION_HEADER)((DWORD)pNTHeader + sizeof(IMAGE_NT_HEADERS));
for(int i = 0; i < pNTHeader->FileHeader.NumberOfSections; i++)
{
if(dwRVA >= pSection[i].VirtualAddress && dwRVA < (pSection[i].VirtualAddress + pSection[i].SizeOfRawData))
{
return pSection[i].PointerToRawData + (dwRVA - pSection[i].VirtualAddress);
}
}
return 0;
}
int _tmain(int argc, _TCHAR* argv[])
{
HANDLE hFile = CreateFile(argv[1], GENERIC_ALL, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL);
HANDLE hMapping = CreateFileMapping(hFile, NULL, PAGE_READWRITE, 0, 0, NULL);
PVOID pbFile = MapViewOfFile(hMapping, FILE_MAP_ALL_ACCESS, 0, 0, 0);
if(INVALID_HANDLE_VALUE == hFile || NULL == hMapping || NULL == pbFile)
{
printf("/n/t---------- The File Inexistence! ----------/n");
goto EXIT;
}
PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)pbFile;
PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pbFile + pDosHeader->e_lfanew);
if(0x00004550 != pNTHeader->Signature)
{
printf("/n/t---------- Lawless PE File! ----------/n");
goto EXIT;
}
DWORD dwExportOffset = RVA2Offset(pNTHeader, pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
PIMAGE_EXPORT_DIRECTORY pExport = (PIMAGE_EXPORT_DIRECTORY)((DWORD)pbFile + dwExportOffset);
DWORD dwFunctionNameOffset = (DWORD)pbFile + RVA2Offset(pNTHeader, pExport->Name);
DWORD* pdwNamesAddress = (DWORD*)((DWORD)pbFile + RVA2Offset(pNTHeader, pExport->AddressOfNames));
DWORD* pdwFunctionAddress = (DWORD*)((DWORD)pbFile + RVA2Offset(pNTHeader, pExport->AddressOfFunctions));
WORD* pwOrdinals = (WORD*)((DWORD)pbFile + RVA2Offset(pNTHeader, pExport->AddressOfNameOrdinals));
if(0 == pExport->NumberOfFunctions)
{
printf("/n/t---------- No Export Tabel! ----------/n");
goto EXIT;
}
printf("FileName: %s/n", dwFunctionNameOffset);
printf("NumberOfFunctions: %d/n", pExport->NumberOfFunctions);
printf("NumberOfNames: %d/n/n", pExport->NumberOfNames);
printf("NameExport:/n/n");
for(int i = 0; i < pExport->NumberOfNames; i++)
{
DWORD dwFunctionAddress = pdwFunctionAddress[pwOrdinals[i]];
DWORD pdwFunNameOffset = (DWORD)pbFile + RVA2Offset(pNTHeader, pdwNamesAddress[i]);
printf("[ExportNum]: %-4d [Name]: %-30s [RVA]: 0x%08X/n", pExport->Base + i, pdwFunNameOffset, dwFunctionAddress);
}
printf("/nNumberExport:/n/n");
for(int i = 0; i < pExport->NumberOfFunctions - pExport->NumberOfNames; i++)
{
printf("[ExportNum]: %-4d [RVA]: 0x%08X/n", pExport->Base + i, pdwFunctionAddress[i]);
}
printf("/n");
EXIT:
if(NULL != pbFile)
{
UnmapViewOfFile(pbFile);
}
if(NULL != hMapping)
{
CloseHandle(hMapping);
}
if (INVALID_HANDLE_VALUE != hFile)
{
CloseHandle(hFile);
}
return 0;
}
查看PE文件导入表
这个博客空间主席帮申请下来快一年了,都快忘了。最近一直在学习PE文件,贴段代码,功能如题,自己学习写的练习程序,VC2005编译,控制台程序,有很多不严谨和不完善的地方!
#include "stdafx.h"
#include <Windows.h>
DWORD RVA2Offset(PIMAGE_NT_HEADERS pNTHeader, DWORD dwRVA)
{
PIMAGE_SECTION_HEADER pSection = (PIMAGE_SECTION_HEADER)((DWORD)pNTHeader + sizeof(IMAGE_NT_HEADERS));
for(int i = 0; i < pNTHeader->FileHeader.NumberOfSections; i++)
{
if(dwRVA >= pSection[i].VirtualAddress && dwRVA < (pSection[i].VirtualAddress + pSection[i].SizeOfRawData))
{
return pSection[i].PointerToRawData + (dwRVA - pSection[i].VirtualAddress);
}
}
return 0;
}
int _tmain(int argc, _TCHAR* argv[])
{
HANDLE hFile = CreateFile(argv[1], GENERIC_ALL, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL);
HANDLE hMapping = CreateFileMapping(hFile, NULL, PAGE_READWRITE, 0, 0, NULL);
PVOID pbFile = MapViewOfFile(hMapping, FILE_MAP_ALL_ACCESS, 0, 0, 0);
if(INVALID_HANDLE_VALUE == hFile || NULL == hMapping || NULL == pbFile)
{
printf("/n/t---------- The File Inexistence! ----------/n");
goto EXIT;
}
PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)pbFile;
PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pbFile + pDosHeader->e_lfanew);
if(0x00004550 != pNTHeader->Signature)
{
printf("/n/t---------- Lawless PE File! ----------/n");
goto EXIT;
}
DWORD dwImportOffset = RVA2Offset(pNTHeader, pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
PIMAGE_IMPORT_DESCRIPTOR pImport = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD)pbFile + dwImportOffset);
DWORD dwOriginalThunkOffset = 0;
DWORD dwThunkData = 0;
PIMAGE_IMPORT_BY_NAME pImageFunName = NULL;
PIMAGE_THUNK_DATA pThunkData = NULL;
for(int i = 0; i < pNTHeader->OptionalHeader.DataDirectory[1].Size / sizeof(IMAGE_IMPORT_DESCRIPTOR) - 1; i++)
{
printf("[DLL Name]: %s/n/n", ((DWORD)pbFile + RVA2Offset(pNTHeader, pImport[i].Name)));
pThunkData = (PIMAGE_THUNK_DATA)((DWORD)pbFile + RVA2Offset(pNTHeader, pImport[i].FirstThunk));
for(int j = 0; pThunkData[j].u1.Ordinal != 0; j++)
{
if(pThunkData[j].u1.Ordinal & IMAGE_ORDINAL_FLAG32)
{
printf(" [%03d] --- Number: %04d Name: <NULL>/n", j + 1, pThunkData[j].u1.Ordinal & 0xFFFF);
}
else
{
pImageFunName = (PIMAGE_IMPORT_BY_NAME)((DWORD)pbFile + RVA2Offset(pNTHeader, pThunkData[j].u1.AddressOfData));
printf(" [%03d] --- Number: %04d Name: %s/n", j + 1, pImageFunName->Hint, pImageFunName->Name);
}
}
printf("/n");
}
EXIT:
if(NULL != pbFile)
{
UnmapViewOfFile(pbFile);
}
if(NULL != hMapping)
{
CloseHandle(hMapping);
}
if (INVALID_HANDLE_VALUE != hFile)
{
CloseHandle(hFile);
}
return 0;
}
#include "stdafx.h"
#include <Windows.h>
DWORD RVA2Offset(PIMAGE_NT_HEADERS pNTHeader, DWORD dwRVA)
{
PIMAGE_SECTION_HEADER pSection = (PIMAGE_SECTION_HEADER)((DWORD)pNTHeader + sizeof(IMAGE_NT_HEADERS));
for(int i = 0; i < pNTHeader->FileHeader.NumberOfSections; i++)
{
if(dwRVA >= pSection[i].VirtualAddress && dwRVA < (pSection[i].VirtualAddress + pSection[i].SizeOfRawData))
{
return pSection[i].PointerToRawData + (dwRVA - pSection[i].VirtualAddress);
}
}
return 0;
}
int _tmain(int argc, _TCHAR* argv[])
{
HANDLE hFile = CreateFile(argv[1], GENERIC_ALL, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL);
HANDLE hMapping = CreateFileMapping(hFile, NULL, PAGE_READWRITE, 0, 0, NULL);
PVOID pbFile = MapViewOfFile(hMapping, FILE_MAP_ALL_ACCESS, 0, 0, 0);
if(INVALID_HANDLE_VALUE == hFile || NULL == hMapping || NULL == pbFile)
{
printf("/n/t---------- The File Inexistence! ----------/n");
goto EXIT;
}
PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)pbFile;
PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pbFile + pDosHeader->e_lfanew);
if(0x00004550 != pNTHeader->Signature)
{
printf("/n/t---------- Lawless PE File! ----------/n");
goto EXIT;
}
DWORD dwRelocOffset = RVA2Offset(pNTHeader, pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress);
PIMAGE_BASE_RELOCATION pReloc = (PIMAGE_BASE_RELOCATION)((DWORD)pbFile + dwRelocOffset);
if(0 == pReloc->VirtualAddress)
{
printf("/n/t---------- No Relocation Table! ----------/n");
goto EXIT;
}
while(pReloc->VirtualAddress)
{
printf("[0x%08X]/n/n", pReloc->VirtualAddress);
for(int i = 0; i < (pReloc->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / 2; i++)
{
printf(" <%04d> - 0x%08X/n", i, pReloc->VirtualAddress + ((*(WORD*)((DWORD)pReloc + sizeof(IMAGE_BASE_RELOCATION) + i * 2)) & 0x0FFF));
}
printf("/n");
pReloc = (PIMAGE_BASE_RELOCATION)((DWORD)pReloc + pReloc->SizeOfBlock);
}
EXIT:
if(NULL != pbFile)
{
UnmapViewOfFile(pbFile);
}
if(NULL != hMapping)
{
CloseHandle(hMapping);
}
if (INVALID_HANDLE_VALUE != hFile)
{
CloseHandle(hFile);
}
return 0;
}
查看PE文件导出表
#include "stdafx.h"
#include <Windows.h>
DWORD RVA2Offset(PIMAGE_NT_HEADERS pNTHeader, DWORD dwRVA)
{
PIMAGE_SECTION_HEADER pSection = (PIMAGE_SECTION_HEADER)((DWORD)pNTHeader + sizeof(IMAGE_NT_HEADERS));
for(int i = 0; i < pNTHeader->FileHeader.NumberOfSections; i++)
{
if(dwRVA >= pSection[i].VirtualAddress && dwRVA < (pSection[i].VirtualAddress + pSection[i].SizeOfRawData))
{
return pSection[i].PointerToRawData + (dwRVA - pSection[i].VirtualAddress);
}
}
return 0;
}
int _tmain(int argc, _TCHAR* argv[])
{
HANDLE hFile = CreateFile(argv[1], GENERIC_ALL, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL);
HANDLE hMapping = CreateFileMapping(hFile, NULL, PAGE_READWRITE, 0, 0, NULL);
PVOID pbFile = MapViewOfFile(hMapping, FILE_MAP_ALL_ACCESS, 0, 0, 0);
if(INVALID_HANDLE_VALUE == hFile || NULL == hMapping || NULL == pbFile)
{
printf("/n/t---------- The File Inexistence! ----------/n");
goto EXIT;
}
PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)pbFile;
PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pbFile + pDosHeader->e_lfanew);
if(0x00004550 != pNTHeader->Signature)
{
printf("/n/t---------- Lawless PE File! ----------/n");
goto EXIT;
}
DWORD dwExportOffset = RVA2Offset(pNTHeader, pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
PIMAGE_EXPORT_DIRECTORY pExport = (PIMAGE_EXPORT_DIRECTORY)((DWORD)pbFile + dwExportOffset);
DWORD dwFunctionNameOffset = (DWORD)pbFile + RVA2Offset(pNTHeader, pExport->Name);
DWORD* pdwNamesAddress = (DWORD*)((DWORD)pbFile + RVA2Offset(pNTHeader, pExport->AddressOfNames));
DWORD* pdwFunctionAddress = (DWORD*)((DWORD)pbFile + RVA2Offset(pNTHeader, pExport->AddressOfFunctions));
WORD* pwOrdinals = (WORD*)((DWORD)pbFile + RVA2Offset(pNTHeader, pExport->AddressOfNameOrdinals));
if(0 == pExport->NumberOfFunctions)
{
printf("/n/t---------- No Export Tabel! ----------/n");
goto EXIT;
}
printf("FileName: %s/n", dwFunctionNameOffset);
printf("NumberOfFunctions: %d/n", pExport->NumberOfFunctions);
printf("NumberOfNames: %d/n/n", pExport->NumberOfNames);
printf("NameExport:/n/n");
for(int i = 0; i < pExport->NumberOfNames; i++)
{
DWORD dwFunctionAddress = pdwFunctionAddress[pwOrdinals[i]];
DWORD pdwFunNameOffset = (DWORD)pbFile + RVA2Offset(pNTHeader, pdwNamesAddress[i]);
printf("[ExportNum]: %-4d [Name]: %-30s [RVA]: 0x%08X/n", pExport->Base + i, pdwFunNameOffset, dwFunctionAddress);
}
printf("/nNumberExport:/n/n");
for(int i = 0; i < pExport->NumberOfFunctions - pExport->NumberOfNames; i++)
{
printf("[ExportNum]: %-4d [RVA]: 0x%08X/n", pExport->Base + i, pdwFunctionAddress[i]);
}
printf("/n");
EXIT:
if(NULL != pbFile)
{
UnmapViewOfFile(pbFile);
}
if(NULL != hMapping)
{
CloseHandle(hMapping);
}
if (INVALID_HANDLE_VALUE != hFile)
{
CloseHandle(hFile);
}
return 0;
}
查看PE文件导入表
这个博客空间主席帮申请下来快一年了,都快忘了。最近一直在学习PE文件,贴段代码,功能如题,自己学习写的练习程序,VC2005编译,控制台程序,有很多不严谨和不完善的地方!
#include "stdafx.h"
#include <Windows.h>
DWORD RVA2Offset(PIMAGE_NT_HEADERS pNTHeader, DWORD dwRVA)
{
PIMAGE_SECTION_HEADER pSection = (PIMAGE_SECTION_HEADER)((DWORD)pNTHeader + sizeof(IMAGE_NT_HEADERS));
for(int i = 0; i < pNTHeader->FileHeader.NumberOfSections; i++)
{
if(dwRVA >= pSection[i].VirtualAddress && dwRVA < (pSection[i].VirtualAddress + pSection[i].SizeOfRawData))
{
return pSection[i].PointerToRawData + (dwRVA - pSection[i].VirtualAddress);
}
}
return 0;
}
int _tmain(int argc, _TCHAR* argv[])
{
HANDLE hFile = CreateFile(argv[1], GENERIC_ALL, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL);
HANDLE hMapping = CreateFileMapping(hFile, NULL, PAGE_READWRITE, 0, 0, NULL);
PVOID pbFile = MapViewOfFile(hMapping, FILE_MAP_ALL_ACCESS, 0, 0, 0);
if(INVALID_HANDLE_VALUE == hFile || NULL == hMapping || NULL == pbFile)
{
printf("/n/t---------- The File Inexistence! ----------/n");
goto EXIT;
}
PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)pbFile;
PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pbFile + pDosHeader->e_lfanew);
if(0x00004550 != pNTHeader->Signature)
{
printf("/n/t---------- Lawless PE File! ----------/n");
goto EXIT;
}
DWORD dwImportOffset = RVA2Offset(pNTHeader, pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
PIMAGE_IMPORT_DESCRIPTOR pImport = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD)pbFile + dwImportOffset);
DWORD dwOriginalThunkOffset = 0;
DWORD dwThunkData = 0;
PIMAGE_IMPORT_BY_NAME pImageFunName = NULL;
PIMAGE_THUNK_DATA pThunkData = NULL;
for(int i = 0; i < pNTHeader->OptionalHeader.DataDirectory[1].Size / sizeof(IMAGE_IMPORT_DESCRIPTOR) - 1; i++)
{
printf("[DLL Name]: %s/n/n", ((DWORD)pbFile + RVA2Offset(pNTHeader, pImport[i].Name)));
pThunkData = (PIMAGE_THUNK_DATA)((DWORD)pbFile + RVA2Offset(pNTHeader, pImport[i].FirstThunk));
for(int j = 0; pThunkData[j].u1.Ordinal != 0; j++)
{
if(pThunkData[j].u1.Ordinal & IMAGE_ORDINAL_FLAG32)
{
printf(" [%03d] --- Number: %04d Name: <NULL>/n", j + 1, pThunkData[j].u1.Ordinal & 0xFFFF);
}
else
{
pImageFunName = (PIMAGE_IMPORT_BY_NAME)((DWORD)pbFile + RVA2Offset(pNTHeader, pThunkData[j].u1.AddressOfData));
printf(" [%03d] --- Number: %04d Name: %s/n", j + 1, pImageFunName->Hint, pImageFunName->Name);
}
}
printf("/n");
}
EXIT:
if(NULL != pbFile)
{
UnmapViewOfFile(pbFile);
}
if(NULL != hMapping)
{
CloseHandle(hMapping);
}
if (INVALID_HANDLE_VALUE != hFile)
{
CloseHandle(hFile);
}
return 0;
}
相关文章推荐
- 加载exe的PE信息并输出相关PE信息的一段c++代码
- PE文件相关代码
- STM8S105K4 SPI相关代码
- 关于对H264码流的PS的封装的相关代码实现
- js对象封装内部图片的相关代码,采用base64图片串
- 使用Capistrano向EC2部署Django代码--关于SSH相关的配置
- 深度学习 6. MatConvNet 相关函数解释说明,MatConvNet 代码理解(二)cnn_mnist_init.m 的注释
- 深度学习 7. MatConvNet 相关函数解释说明,MatConvNet 代码理解(三)cnn_mnist_experiments.m 的注释
- 深度学习 8. MatConvNet 相关函数解释说明,MatConvNet 代码理解(四)cnn_train.m 的注释
- 日期相关代码
- nodejs 连接Mysql相关操作的示例代码(orm)
- mybatis generator自动创建代码及相关问题
- C# 文件下载相关代码
- 如何在代码中动态添加布局以及相关的控件
- 语音和视频的相关代码(c++builder完整源代码)
- 嵌入式Linux启动相关代码分析
- PE 修改 NMI PIN 为普通中断脚后生成的代码有问题
- 与browser相关的代码
- U-Boot中关于TEXT_BASE,代码重定位,链接地址相关说明
- 相关代码网页