PE文件格式解析 LUA版本，兼容32/64位

local function readOnly (obj)
local proxy = {};

local mtReadOnly = {};
mtReadOnly.__index = obj;
mtReadOnly.__newindex = function(t, k, v)
error("attempt to update a read-only table");
end;
mtReadOnly.__pairs = function(t)
return pairs(obj);
end;

setmetatable(proxy, mtReadOnly);
return proxy;
end
local _G = readOnly(_G);
local _ENV = readOnly(_ENV);

local M = {};

M.Const = {};
M.Const.Magic = {};
M.Const.Machine = {};
M.Const.CharacteristicsFlags = {};
M.Const.Subsystem = {};
M.Const.DllCharacteristicsFlags = {};
M.Const.Sections = {};
M.Const.Sections.CharacteristicsFlags = {};

local M_Const = M.const;
local M_Const_Magic = M.Const.Magic;
local M_Const_Machine = M.Const.Machine;
local M_Const_CharacteristicsFlags = M.Const.CharacteristicsFlags;
local M_Const_Subsystem = M.Const.Subsystem;
local M_Const_DllCharacteristicsFlags = M.Const.DllCharacteristicsFlags;
local M_Const_Section = M.Const.Section;
local M_Const_Sections_CharacteristicsFlags = M.Const.Sections.CharacteristicsFlags;

M_Const_Magic[0x10b] = "PE32";
M_Const_Magic[0x20b] = "PE32+";

M_Const_Machine[0x0000] = "IMAGE_FILE_MACHINE_UNKNOWN";
M_Const_Machine[0x01d3] = "IMAGE_FILE_MACHINE_AM33";
M_Const_Machine[0x8664] = "IMAGE_FILE_MACHINE_AMD64";
M_Const_Machine[0x01c0] = "IMAGE_FILE_MACHINE_ARM";
M_Const_Machine[0x01c4] = "IMAGE_FILE_MACHINE_ARMNT";
M_Const_Machine[0xaa64] = "IMAGE_FILE_MACHINE_ARM64";
M_Const_Machine[0x0ebc] = "IMAGE_FILE_MACHINE_EBC";
M_Const_Machine[0x014c] = "IMAGE_FILE_MACHINE_I386";
M_Const_Machine[0x0200] = "IMAGE_FILE_MACHINE_IA64";
M_Const_Machine[0x9041] = "IMAGE_FILE_MACHINE_M32R";
M_Const_Machine[0x0266] = "IMAGE_FILE_MACHINE_MIPS16";
M_Const_Machine[0x0366] = "IMAGE_FILE_MACHINE_MIPSFPU";
M_Const_Machine[0x0466] = "IMAGE_FILE_MACHINE_MIPSFPU16";
M_Const_Machine[0x01f0] = "IMAGE_FILE_MACHINE_POWERPC";
M_Const_Machine[0x01f1] = "IMAGE_FILE_MACHINE_POWERPCFP";
M_Const_Machine[0x0166] = "IMAGE_FILE_MACHINE_R4000";
M_Const_Machine[0x01a2] = "IMAGE_FILE_MACHINE_SH3";
M_Const_Machine[0x01a3] = "IMAGE_FILE_MACHINE_SH3DSP";
M_Const_Machine[0x01a6] = "IMAGE_FILE_MACHINE_SH4";
M_Const_Machine[0x01a8] = "IMAGE_FILE_MACHINE_SH5";
M_Const_Machine[0x01c2] = "IMAGE_FILE_MACHINE_THUMB";
M_Const_Machine[0x0169] = "IMAGE_FILE_MACHINE_WCEMIPSV2";

M_Const_CharacteristicsFlags[0x0001] = "IMAGE_FILE_RELOCS_STRIPPED";
M_Const_CharacteristicsFlags[0x0002] = "IMAGE_FILE_EXECUTABLE_IMAGE";
M_Const_CharacteristicsFlags[0x0004] = "IMAGE_FILE_LINE_NUMS_STRIPPED";
M_Const_CharacteristicsFlags[0x0008] = "IMAGE_FILE_LOCAL_SYMS_STRIPPED";
M_Const_CharacteristicsFlags[0x0010] = "IMAGE_FILE_AGGRESSIVE_WS_TRIM";
M_Const_CharacteristicsFlags[0x0020] = "IMAGE_FILE_LARGE_ADDRESS_AWARE";
M_Const_CharacteristicsFlags[0x0040] = "Reserved for future use";
M_Const_CharacteristicsFlags[0x0080] = "IMAGE_FILE_BYTES_REVERSED_LO";
M_Const_CharacteristicsFlags[0x0100] = "IMAGE_FILE_32BIT_MACHINE";
M_Const_CharacteristicsFlags[0x0200] = "IMAGE_FILE_DEBUG_STRIPPED";
M_Const_CharacteristicsFlags[0x0400] = "IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP";
M_Const_CharacteristicsFlags[0x0800] = "IMAGE_FILE_NET_RUN_FROM_SWAP";
M_Const_CharacteristicsFlags[0x1000] = "IMAGE_FILE_SYSTEM";
M_Const_CharacteristicsFlags[0x2000] = "IMAGE_FILE_DLL";
M_Const_CharacteristicsFlags[0x4000] = "IMAGE_FILE_UP_SYSTEM_ONLY";
M_Const_CharacteristicsFlags[0x8000] = "IMAGE_FILE_BYTES_REVERSED_HI";

M_Const_Subsystem[0x0] = "IMAGE_SUBSYSTEM_UNKNOWN";
M_Const_Subsystem[0x1] = "IMAGE_SUBSYSTEM_NATIVE";
M_Const_Subsystem[0x2] = "IMAGE_SUBSYSTEM_WINDOWS_GUI";
M_Const_Subsystem[0x3] = "IMAGE_SUBSYSTEM_WINDOWS_CUI";
M_Const_Subsystem[0x7] = "IMAGE_SUBSYSTEM_POSIX_CUI";
M_Const_Subsystem[0x9] = "IMAGE_SUBSYSTEM_WINDOWS_CE_GUI";
M_Const_Subsystem[0xa] = "IMAGE_SUBSYSTEM_EFI_APPLICATION";
M_Const_Subsystem[0xb] = "IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER";
M_Const_Subsystem[0xc] = "IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER";
M_Const_Subsystem[0xd] = "IMAGE_SUBSYSTEM_EFI_ROM";
M_Const_Subsystem[0xe] = "IMAGE_SUBSYSTEM_XBOX";

M_Const_DllCharacteristicsFlags[0x0040] = "IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE";
M_Const_DllCharacteristicsFlags[0x0080] = "IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY";
M_Const_DllCharacteristicsFlags[0x0100] = "IMAGE_DLL_CHARACTERISTICS_NX_COMPAT";
M_Const_DllCharacteristicsFlags[0x0200] = "IMAGE_DLLCHARACTERISTICS_NO_ISOLATION";
M_Const_DllCharacteristicsFlags[0x0400] = "IMAGE_DLLCHARACTERISTICS_NO_SEH";
M_Const_DllCharacteristicsFlags[0x0800] = "IMAGE_DLLCHARACTERISTICS_NO_BIND";
M_Const_DllCharacteristicsFlags[0x2000] = "IMAGE_DLLCHARACTERISTICS_WDM_DRIVER";
M_Const_DllCharacteristicsFlags[0x8000] = "IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE";

M_Const_Sections_CharacteristicsFlags[0x00000008] = "IMAGE_SCN_TYPE_NO_PAD";
M_Const_Sections_CharacteristicsFlags[0x00000020] = "IMAGE_SCN_CNT_CODE";
M_Const_Sections_CharacteristicsFlags[0x00000040] = "IMAGE_SCN_CNT_INITIALIZED_DATA";
M_Const_Sections_CharacteristicsFlags[0x00000080] = "IMAGE_SCN_CNT_UNINITIALIZED_ DATA";
M_Const_Sections_CharacteristicsFlags[0x00000100] = "IMAGE_SCN_LNK_OTHER";
M_Const_Sections_CharacteristicsFlags[0x00000200] = "IMAGE_SCN_LNK_INFO";
M_Const_Sections_CharacteristicsFlags[0x00000800] = "IMAGE_SCN_LNK_REMOVE";
M_Const_Sections_CharacteristicsFlags[0x00001000] = "IMAGE_SCN_LNK_COMDAT";
M_Const_Sections_CharacteristicsFlags[0x00008000] = "IMAGE_SCN_GPREL";
M_Const_Sections_CharacteristicsFlags[0x00020000] = "IMAGE_SCN_MEM_PURGEABLE";
M_Const_Sections_CharacteristicsFlags[0x00020000] = "IMAGE_SCN_MEM_16BIT";
M_Const_Sections_CharacteristicsFlags[0x00040000] = "IMAGE_SCN_MEM_LOCKED";
M_Const_Sections_CharacteristicsFlags[0x00080000] = "IMAGE_SCN_MEM_PRELOAD";
M_Const_Sections_CharacteristicsFlags[0x00100000] = "IMAGE_SCN_ALIGN_1BYTES";
M_Const_Sections_CharacteristicsFlags[0x00200000] = "IMAGE_SCN_ALIGN_2BYTES";
M_Const_Sections_CharacteristicsFlags[0x00300000] = "IMAGE_SCN_ALIGN_4BYTES";
M_Const_Sections_CharacteristicsFlags[0x00400000] = "IMAGE_SCN_ALIGN_8BYTES";
M_Const_Sections_CharacteristicsFlags[0x00500000] = "IMAGE_SCN_ALIGN_16BYTES";
M_Const_Sections_CharacteristicsFlags[0x00600000] = "IMAGE_SCN_ALIGN_32BYTES";
M_Const_Sections_CharacteristicsFlags[0x00700000] = "IMAGE_SCN_ALIGN_64BYTES";
M_Const_Sections_CharacteristicsFlags[0x00800000] = "IMAGE_SCN_ALIGN_128BYTES";
M_Const_Sections_CharacteristicsFlags[0x00900000] = "IMAGE_SCN_ALIGN_256BYTES";
M_Const_Sections_CharacteristicsFlags[0x00a00000] = "IMAGE_SCN_ALIGN_512BYTES";
M_Const_Sections_CharacteristicsFlags[0x00b00000] = "IMAGE_SCN_ALIGN_1024BYTES";
M_Const_Sections_CharacteristicsFlags[0x00c00000] = "IMAGE_SCN_ALIGN_2048BYTES";
M_Const_Sections_CharacteristicsFlags[0x00d00000] = "IMAGE_SCN_ALIGN_4096BYTES";
M_Const_Sections_CharacteristicsFlags[0x00e00000] = "IMAGE_SCN_ALIGN_8192BYTES";
M_Const_Sections_CharacteristicsFlags[0x01000000] = "IMAGE_SCN_LNK_NRELOC_OVFL";
M_Const_Sections_CharacteristicsFlags[0x02000000] = "IMAGE_SCN_MEM_DISCARDABLE";
M_Const_Sections_CharacteristicsFlags[0x04000000] = "IMAGE_SCN_MEM_NOT_CACHED";
M_Const_Sections_CharacteristicsFlags[0x08000000] = "IMAGE_SCN_MEM_NOT_PAGED";
M_Const_Sections_CharacteristicsFlags[0x10000000] = "IMAGE_SCN_MEM_SHARED";
M_Const_Sections_CharacteristicsFlags[0x20000000] = "IMAGE_SCN_MEM_EXECUTE";
M_Const_Sections_CharacteristicsFlags[0x40000000] = "IMAGE_SCN_MEM_READ";
M_Const_Sections_CharacteristicsFlags[0x80000000] = "IMAGE_SCN_MEM_WRITE";

local function printf(fmt, ...)
local str = string.format(fmt, ...);
print(str);
end

local function dump_flags(flags, tbFlags)
local r = {};
for k,v in pairs(tbFlags) do
if (k & flags ~= 0) then
r[#r+1]=v;
end
end
return table.concat(r, " | ");
end

local function ReadFile(filepath)
local f, err = io.open(filepath, "rb");
local buf = f:read("*all");
f:close();
return buf;
end

local function ReadUInt(buf, offset, size)
local data = buf:sub(offset+1, offset+size);
assert(data:len() == size, "assert:" .. offset .. " " .. data:len() .. "~=" .. size);
if (size==4) then
data = string.unpack("=L", data);
elseif (size==2) then
data = string.unpack("=H", data);
elseif (size==1) then
data = string.unpack("=B", data);
elseif (size==8) then
data = string.unpack("=I8", data);
end
return offset+size, data;
end

--文件头
local function DumpFileHdr(buf, offset)
local FileHdr = {};
offset, FileHdr.Machine = ReadUInt(buf, offset, 2);
printf("%-24s %s", "Machine", M_Const_Machine[FileHdr.Machine]);

offset, FileHdr.NumberOfSections = ReadUInt(buf, offset, 2);
printf("%-24s %X", "NumberOfSections", FileHdr.NumberOfSections);

offset, FileHdr.TimeDateStamp = ReadUInt(buf, offset, 4);
printf("%-24s %X %s", "TimeDateStamp", FileHdr.TimeDateStamp, os.date("!%Y-%m-%d %H:%M:%S",FileHdr.TimeDateStamp));

offset, FileHdr.PointerToSymbolTable = ReadUInt(buf, offset, 4);
printf("%-24s %X", "PointerToSymbolTable", FileHdr.PointerToSymbolTable);

offset, FileHdr.NumberOfSymbols = ReadUInt(buf, offset, 4);
printf("%-24s %X", "NumberOfSymbols", FileHdr.NumberOfSymbols);

offset, FileHdr.SizeOfOptionalHeader= ReadUInt(buf, offset, 2);
printf("%-24s %X", "SizeOfOptionalHeader", FileHdr.SizeOfOptionalHeader);

offset, FileHdr.Characteristics= ReadUInt(buf, offset, 2);
printf("%-24s %s", "Characteristics", dump_flags(FileHdr.Characteristics, M_Const_CharacteristicsFlags));

return offset, FileHdr;
end

local function DumpOptHdr(buf, offset)
local OptHdr = {};

offset, OptHdr.Magic = ReadUInt(buf, offset, 2);
printf("%-24s %s", "Magic", M_Const_Magic[OptHdr.Magic]);

offset, OptHdr.MajorLinkerVersion = ReadUInt(buf, offset, 1);
offset, OptHdr.MinorLinkerVersion = ReadUInt(buf, offset, 1);
printf("%-24s %u.%u", "LinkerVersion", OptHdr.MajorLinkerVersion, OptHdr.MinorLinkerVersion);

offset, OptHdr.SizeOfCode= ReadUInt(buf, offset, 4);
printf("%-24s %X", "SizeOfCode", OptHdr.SizeOfCode);

offset, OptHdr.SizeOfInitializedData= ReadUInt(buf, offset, 4);
printf("%-24s %X", "SizeOfInitializedData", OptHdr.SizeOfInitializedData);

offset, OptHdr.SizeOfUninitializedData= ReadUInt(buf, offset, 4);
printf("%-24s %X", "SizeOfUninitializedData", OptHdr.SizeOfUninitializedData);

offset, OptHdr.AddressOfEntryPoint= ReadUInt(buf, offset, 4);
printf("%-24s %X", "AddressOfEntryPoint", OptHdr.AddressOfEntryPoint);

offset, OptHdr.BaseOfCode= ReadUInt(buf, offset, 4);
printf("%-24s %X", "BaseOfCode", OptHdr.BaseOfCode);

if (M_Const_Magic[OptHdr.Magic] == "PE32") then
offset, OptHdr.BaseOfData = ReadUInt(buf, offset, 4);
printf("%-24s %X", "BaseOfData", OptHdr.BaseOfData);

offset, OptHdr.ImageBase = ReadUInt(buf, offset, 4);
printf("%-24s %X", "ImageBase", OptHdr.ImageBase);
elseif (M_Const_Magic[OptHdr.Magic] == "PE32+") then
offset, OptHdr.ImageBase = ReadUInt(buf, offset, 8);
printf("%-24s %X", "ImageBase", OptHdr.ImageBase);
else
assert(false);
end

offset, OptHdr.SectionAlignment = ReadUInt(buf, offset, 4);
printf("%-24s %X", "SectionAlignment", OptHdr.SectionAlignment);

offset, OptHdr.FileAlignment = ReadUInt(buf, offset, 4);
printf("%-24s %X", "FileAlignment", OptHdr.FileAlignment);

offset, OptHdr.MajorOperatingSystemVersion = ReadUInt(buf, offset, 2);
offset, OptHdr.MinorOperatingSystemVersion = ReadUInt(buf, offset, 2);
printf("%-24s %u.%u", "OperatingSystemVersion", OptHdr.MajorOperatingSystemVersion, OptHdr.MinorOperatingSystemVersion);

offset, OptHdr.MajorImageVersion = ReadUInt(buf, offset, 2);
offset, OptHdr.MinorImageVersion = ReadUInt(buf, offset, 2);
printf("%-24s %u.%u", "ImageVersion", OptHdr.MajorImageVersion, OptHdr.MinorImageVersion);

offset, OptHdr.MajorSubsystemVersion = ReadUInt(buf, offset, 2);
offset, OptHdr.MinorSubsystemVersion = ReadUInt(buf, offset, 2);
printf("%-24s %u.%u", "SubsystemVersion", OptHdr.MajorSubsystemVersion, OptHdr.MinorSubsystemVersion);

offset, OptHdr.Win32VersionValue = ReadUInt(buf, offset, 4);
printf("%-24s %X", "Win32VersionValue", OptHdr.Win32VersionValue);

offset, OptHdr.SizeOfImage = ReadUInt(buf, offset, 4);
printf("%-24s %X", "SizeOfImage", OptHdr.SizeOfImage);

offset, OptHdr.SizeOfHeaders = ReadUInt(buf, offset, 4);
printf("%-24s %X", "SizeOfHeaders", OptHdr.SizeOfHeaders);

offset, OptHdr.CheckSum = ReadUInt(buf, offset, 4);
printf("%-24s %X", "CheckSum", OptHdr.CheckSum);

offset, OptHdr.Subsystem = ReadUInt(buf, offset, 2);
printf("%-24s %s", "Subsystem", M_Const_Subsystem[OptHdr.Subsystem]);

offset, OptHdr.DllCharacteristics = ReadUInt(buf, offset, 2);
printf("%-24s %s", "DllCharacteristics", dump_flags(OptHdr.DllCharacteristics,M_Const_DllCharacteristicsFlags));

if (M_Const_Magic[OptHdr.Magic] == "PE32") then
offset, OptHdr.SizeOfStackReserve = ReadUInt(buf, offset, 4);
printf("%-24s %X", "SizeOfStackReserve", OptHdr.SizeOfStackReserve);

offset, OptHdr.SizeOfStackCommit = ReadUInt(buf, offset, 4);
printf("%-24s %X", "SizeOfStackCommit", OptHdr.SizeOfStackCommit);

offset, OptHdr.SizeOfHeapReserve = ReadUInt(buf, offset, 4);
printf("%-24s %X", "SizeOfHeapReserve", OptHdr.SizeOfHeapReserve);

offset, OptHdr.SizeOfHeapCommit = ReadUInt(buf, offset, 4);
printf("%-24s %X", "SizeOfHeapCommit", OptHdr.SizeOfHeapCommit);
elseif (M_Const_Magic[OptHdr.Magic] == "PE32+") then
offset, OptHdr.SizeOfStackReserve = ReadUInt(buf, offset, 8);
printf("%-24s %X", "SizeOfStackReserve", OptHdr.SizeOfStackReserve);

offset, OptHdr.SizeOfStackCommit = ReadUInt(buf, offset, 8);
printf("%-24s %X", "SizeOfStackCommit", OptHdr.SizeOfStackCommit);

offset, OptHdr.SizeOfHeapReserve = ReadUInt(buf, offset, 8);
printf("%-24s %X", "SizeOfHeapReserve", OptHdr.SizeOfHeapReserve);

offset, OptHdr.SizeOfHeapCommit = ReadUInt(buf, offset, 8);
printf("%-24s %X", "SizeOfHeapCommit", OptHdr.SizeOfHeapCommit);
else
assert(false);
end

offset, OptHdr.LoaderFlags = ReadUInt(buf, offset, 4);
printf("%-24s %X", "LoaderFlags", OptHdr.LoaderFlags);

offset, OptHdr.NumberOfRvaAndSizes = ReadUInt(buf, offset, 4);
printf("%-24s %X", "NumberOfRvaAndSizes", OptHdr.NumberOfRvaAndSizes);

return offset, OptHdr;
end

local function DumpDataDir(buf, offset)
local ddir = {};
for i=1, 16 do
ddir[i] = {};
local ddiri = ddir[i];

offset, ddiri.VirtualAddress = ReadUInt(buf, offset, 4);
offset, ddiri.Size = ReadUInt(buf, offset, 4);

printf("DataDirectory %.2d\tVirtualAddress = %.8X, Size = %.8X", i, ddiri.VirtualAddress, ddiri.Size);
end
return offset, ddir;
end

local function DumpSection(buf, offset, hdr_file)
local Section = {};
for i=1, hdr_file.NumberOfSections do
local SectionI = {};
Section[i] = SectionI;

local data = nil;
offset, data = ReadUInt(buf, offset, 8);
SectionI.Name = string.pack("=I8", data);

offset, data = ReadUInt(buf, offset, 4);
SectionI.Misc_PhysicalAddress = data;
SectionI.Misc_VirtualSize = data;

offset, SectionI.VirtualAddress = ReadUInt(buf, offset, 4);
offset, SectionI.SizeOfRawData = ReadUInt(buf, offset, 4);
offset, SectionI.PointerToRawData = ReadUInt(buf, offset, 4);
offset, SectionI.PointerToRelocations = ReadUInt(buf, offset, 4);
offset, SectionI.PointerToLinenumbers = ReadUInt(buf, offset, 4);
offset, SectionI.NumberOfRelocations = ReadUInt(buf, offset, 2);
offset, SectionI.NumberOfLinenumbers = ReadUInt(buf, offset, 2);
offset, SectionI.Characteristics = ReadUInt(buf, offset, 4);

printf("%-24s %s", "SectionName", SectionI.Name);
printf("%-24s %X", "Misc_PhysicalAddress", SectionI.Misc_PhysicalAddress);
printf("%-24s %X", "Misc_VirtualSize", SectionI.Misc_VirtualSize);
printf("%-24s %X", "VirtualAddress", SectionI.VirtualAddress);
printf("%-24s %X", "SizeOfRawData", SectionI.SizeOfRawData);
printf("%-24s %X", "PointerToRawData", SectionI.PointerToRawData);
printf("%-24s %X", "PointerToRelocations", SectionI.PointerToRelocations);
printf("%-24s %X", "PointerToLinenumbers", SectionI.PointerToLinenumbers);
printf("%-24s %X", "NumberOfRelocations", SectionI.NumberOfRelocations);
printf("%-24s %X", "NumberOfLinenumbers", SectionI.NumberOfLinenumbers);
printf("%-24s %s", "Characteristics", dump_flags(SectionI.Characteristics,M_Const_Sections_CharacteristicsFlags));
print();
end

return offset, Section;
end

local function DumpHdr(buf)
--判断MZ头
local offset, data = ReadUInt(buf, 0, 2);
assert(data==0x5A4D, "MZ fail");

--获取PE头偏移
offset, data= ReadUInt(buf, 0x3C, 2);
offset = data;

--判断PE头
offset, data = ReadUInt(buf, offset, 2);
assert(data==0x4550, "PE fail");

--跳过2字节
offset, data = ReadUInt(buf, offset, 2);

--读取文件头，可选头，数据目录和节目录
local hdr = {};

offset, hdr.file = DumpFileHdr(buf, offset);
print();

offset, hdr.opt = DumpOptHdr(buf, offset);
print();

offset, hdr.ddir = DumpDataDir(buf, offset);
print();

offset, hdr.sec = DumpSection(buf, offset, hdr.file);
print();

local hdr_sec = hdr.sec;

--工具函数
local helper = {};

--相对偏移转文件偏移
local function RVA2FOA(rva)
local foa = nil;
for i=1, #hdr_sec do
local first = hdr_sec[i].VirtualAddress;
local second = first + hdr_sec[i].SizeOfRawData;
if ( (rva >= first) and (rva < second ) ) then
foa = hdr_sec[i].PointerToRawData + ( rva - first );
break;
end
end
return foa;
end

--文件偏移转相对偏移
local function FOA2RVA(foa)
local rva = nil;
for i=1, #hdr_sec do
local first = hdr_sec[i].PointerToRawData;
local second = first + hdr_sec[i].SizeOfRawData;
if ( (foa >= first) and (foa < second ) ) then
rva = hdr_sec[i].VirtualAddress + ( foa - first );
break;
end
end
return rva;
end

--读取字符串
local function ReadStringByOffset(offset)
local End = buf:find("\0", offset+1);
return buf:sub(offset+1, End);
end

--读取字符串
local function ReadStringByRVA(rva)
local Offset = RVA2FOA(rva);
return ReadStringByOffset(Offset);
end

--读取字符串
local function ReadBufferByRVA(rva, size)
local Offset = RVA2FOA(rva);
return buf:sub(Offset+1, Offset+size);
end

helper.RVA2FOA = RVA2FOA;
helper.FOA2RVA = FOA2RVA;
helper.ReadStringByOffset = ReadStringByOffset;
helper.ReadStringByRVA = ReadStringByRVA;
helper.ReadBufferByRVA= ReadBufferByRVA;

return offset, hdr, helper;
end

local function DumpExport(buf, header, helper)
local hdr_ddir = header.ddir;

local RVA2FOA = helper.RVA2FOA;
local ReadStringByRVA = helper.ReadStringByRVA;

local ExportSize = hdr_ddir[1].Size;
local ExportAddress = hdr_ddir[1].VirtualAddress;

local Exports = {};
if (ExportAddress>0 and ExportSize>0) then
local offset = RVA2FOA(ExportAddress);
offset, Exports.Characteristics = ReadUInt(buf, offset, 4);
offset, Exports.TimeDateStamp = ReadUInt(buf, offset, 4);
offset, Exports.MajorVersion = ReadUInt(buf, offset, 2);
offset, Exports.MinorVersion = ReadUInt(buf, offset, 2);
offset, Exports.Name = ReadUInt(buf, offset, 4);
offset, Exports.Base = ReadUInt(buf, offset, 4);
offset, Exports.NumberOfFunctions = ReadUInt(buf, offset, 4);
offset, Exports.NumberOfNames = ReadUInt(buf, offset, 4);
offset, Exports.AddressOfFunctions = ReadUInt(buf, offset, 4);
offset, Exports.AddressOfNames = ReadUInt(buf, offset, 4);
offset, Exports.AddressOfNameOrdinals = ReadUInt(buf, offset, 4);

print("Export", ReadStringByRVA(Exports.Name));

Exports.AddressOfNames = RVA2FOA(Exports.AddressOfNames);
Exports.AddressOfFunctions = RVA2FOA(Exports.AddressOfFunctions);
Exports.AddressOfNameOrdinals = RVA2FOA(Exports.AddressOfNameOrdinals);

local mapNumberName = {};
for i=1, Exports.NumberOfNames do
local apiNumber = nil;
offset, apiNumber = ReadUInt(buf, Exports.AddressOfNameOrdinals+(i-1)*2, 2);
apiNumber = apiNumber + Exports.Base;

local apiName = nil;
offset, apiName = ReadUInt(buf, Exports.AddressOfNames+(i-1)*4, 4);
apiName = ReadStringByRVA(apiName);

mapNumberName[apiNumber] = apiName;
end

local tbExports = {};
for i=1, Exports.NumberOfFunctions do
local apiAddress = nil;
offset, apiAddress = ReadUInt(buf, Exports.AddressOfFunctions+(i-1)*4, 4);

local apiNumber = Exports.Base-1 + i;
local apiName = mapNumberName[apiNumber] or "";

if ( apiAddress >= ExportAddress) and (apiAddress < ExportAddress+ExportSize) then
apiAddress = ReadStringByRVA(apiAddress);
end

tbExports[1+#tbExports] = {["index"]=apiNumber, ["name"]=apiName, ["apiFun"]=apiAddress};
end

mapNumberName = nil;

table.sort(tbExports,   function(l,r)
if (l.name~="" and r.name~="") then
return l.name < r.name;
elseif (l.name=="" and r.name=="") then
return l.index < r.index;
elseif (l.name~="" and r.name=="") then
return true;
elseif (l.name=="" and r.name~="") then
return false;
end
end);

for _,v in ipairs(tbExports) do
if (type(v.apiFun)=="string") then
printf("%16d %24s %-48s", v.index, v.apiFun, v.name);
elseif (v.apiFun ~= 0) then
printf("%16d %24X %-48s", v.index, v.apiFun, v.name);
end
end -- for
end -- if

return Exports;
end

local function DumpImport(buf, header, helper)
local hdr_ddir = header.ddir;
local hdr_opt = header.opt;

local RVA2FOA = helper.RVA2FOA;
local FOA2RVA = helper.FOA2RVA;

local ReadStringByRVA = helper.ReadStringByRVA;
local ReadStringByOffset = helper.ReadStringByOffset;

local ImportSize = hdr_ddir[2].Size;
local ImportAddress = hdr_ddir[2].VirtualAddress;

local offset = RVA2FOA(ImportAddress);

local Imports = {};

repeat
if (ImportAddress<=0) then break; end
if (ImportSize<=0) then break; end

local Import = {};
Imports[#Imports+1] = Import;

offset, Import.Characteristics = ReadUInt(buf, offset, 4);
offset, Import.TimeDateStamp = ReadUInt(buf, offset, 4);
offset, Import.ForwarderChain = ReadUInt(buf, offset, 4);
offset, Import.Name = ReadUInt(buf, offset, 4);
offset, Import.FirstThunk = ReadUInt(buf, offset, 4);

if (0==Import.Name) then break; end
--if (0==Import.Characteristics) then break; end
if (0==Import.FirstThunk) then break; end

print("Import", ReadStringByRVA(Import.Name));

--local offINT = RVA2FOA(Import.Characteristics);
local offIAT = RVA2FOA(Import.FirstThunk);

repeat
local pINT = nil;
local pIAT = nil;

local rvaIAT = FOA2RVA(offIAT);
if (M_Const_Magic[hdr_opt.Magic] == "PE32") then
--offINT, pINT = ReadUInt(buf, offINT, 4);
offIAT, pIAT = ReadUInt(buf, offIAT, 4);
elseif (M_Const_Magic[hdr_opt.Magic] == "PE32+") then
--offINT, pINT = ReadUInt(buf, offINT, 8);
offIAT, pIAT = ReadUInt(buf, offIAT, 8);
else
assert(false);
end

--assert((pINT==0 and pIAT==0) or (pINT~=0 and pIAT~=0));

--if (0 == pINT) then break; end
if (0 == pIAT) then break; end

pINT = pIAT;
if (M_Const_Magic[hdr_opt.Magic] == "PE32") then
if (0 == pINT & 0x80000000) then
pINT = RVA2FOA(pINT);
printf("%16X %s", rvaIAT, ReadStringByOffset(pINT+2));
else
printf("%16X %d", rvaIAT, pINT-0x80000000);
end
elseif (M_Const_Magic[hdr_opt.Magic] == "PE32+") then
if (0 == pINT & 0x8000000000000000) then
pINT = RVA2FOA(pINT);
printf("\t%8X\t%s", rvaIAT, ReadStringByOffset(pINT+2));
else
printf("\t%8X\t%d", rvaIAT, pINT-0x8000000000000000);
end
end

until (false);
until (false);
end

local function parse(pe_filepath)
--读入PE文件
local buf = ReadFile(pe_filepath);
if (not buf) then
error("read fail");
end

local offset, header, helper = DumpHdr(buf);

DumpImport(buf, header, helper);
DumpExport(buf, header, helper);
end

parse(arg[1]);