PE window程序1 老弟们加油哦

maikehong

char* Base_memset(FILE * pFile ){
        char * buffer;
        int nFileLength = 0;

        fseek(pFile,0,SEEK_END);
        nFileLength = ftell(pFile);
        rewind(pFile);

        int imageLength = nFileLength * sizeof(char)+1;
        buffer = (char *)malloc(imageLength);
        memset(buffer,0,nFileLength * sizeof(char)+1);

        fread(buffer,1,imageLength,pFile);
         
        return buffer;
}

PIMAGE_DOS_HEADER DOS_tou(FILE * pFile){
       
        char * buffer = Base_memset(pFile);
       
        PIMAGE_DOS_HEADER ReadDosHeader = (PIMAGE_DOS_HEADER)buffer;
        cout<< "DOS_e_magic:\t"<<hex<< ReadDosHeader->e_magic<<endl;
        cout<<"DOS_e_lfanew:\t"<<hex<< ReadDosHeader->e_lfanew<<endl;

/*
        if (buffer != NULL)          // 释放内存                        ==========这里的注释是因为 这个子函数要被调用，如果释放内存了，buffer 清空了会报错
        {
                free(buffer);
                buffer = NULL;
        }
        // 最后不要忘记关闭文件
        fclose(pFile);
*/

        return ReadDosHeader;
}

void PE_tou(FILE * pFile, PIMAGE_DOS_HEADER ReadDosHeader){
       
        char * buffer = Base_memset(pFile);
        PIMAGE_NT_HEADERS ReadNTHeader;
        ReadNTHeader = (PIMAGE_NT_HEADERS)(buffer + ReadDosHeader->e_lfanew);

        cout<<endl<<"==================PE_Signature标识================="<<endl;

        cout<<"PE_biaozhi标志:\t"<<hex<<ReadNTHeader->Signature<<endl;

        cout<<endl<<"==================PE_FileHeader标准头================="<<endl;

        cout<<"PE_Machine_CPU:\t"<<hex<<ReadNTHeader->FileHeader.Machine<<endl;
        cout<<"PE_NumberOfSections区段数:\t\t"<<hex<<ReadNTHeader->FileHeader.NumberOfSections<<endl;
        cout<<"PE_SizeOfOptionalHeader扩展头大小:\t"<<hex<<ReadNTHeader->FileHeader.SizeOfOptionalHeader<<endl;
        cout<<"PE_Characteristics 文件属性 :\t\t"<<hex<<ReadNTHeader->FileHeader.Characteristics<<endl;

        cout<<endl<<"==================PE_OptionalHeader扩展头================="<<endl;
       
        cout<<"PE_Magic 32/64:\t\t\t\t"<<hex<<ReadNTHeader->OptionalHeader.Magic<<endl;
        cout<<"PE_AddressOfEntryPoint入口:\t\t"<<hex<<ReadNTHeader->OptionalHeader.AddressOfEntryPoint<<endl;
        cout<<"PE_ImageBase 内存基址:\t\t\t"<<hex<<ReadNTHeader->OptionalHeader.ImageBase<<endl;

        cout<<"PE_SectionAlignment内齐大小:\t\t"<<hex<<ReadNTHeader->OptionalHeader.SectionAlignment<<endl;
        cout<<"PE_FileAlignment 文齐大小:\t\t"<<hex<<ReadNTHeader->OptionalHeader.FileAlignment<<endl;
        cout<<"PE_SizeOfImage 内总大小:\t\t"<<hex<<ReadNTHeader->OptionalHeader.SizeOfImage<<endl;
        cout<<"PE_SizeOfHeaders 文所头+节表大小:\t"<<hex<<ReadNTHeader->OptionalHeader.SizeOfHeaders<<endl;

        cout<<"PE_CheckSum 校验和:\t\t"<<hex<<ReadNTHeader->OptionalHeader.CheckSum<<endl;
        cout<<"PE_NumberOfRvaAndSizes 子结构体数组:\t"<<hex<<ReadNTHeader->OptionalHeader.NumberOfRvaAndSizes<<endl;



        if (buffer != NULL)          // 释放内存

        {
                free(buffer);
                buffer = NULL;
        }
        // 最后不要忘记关闭文件
        fclose(pFile);
}

int main(){
        FILE * pFile = NULL;
        pFile = fopen("mfc001.exe","r+b");

        PIMAGE_DOS_HEADER ReadDosHeader = DOS_tou2(pFile);
        PE_tou( pFile, ReadDosHeader);

        return 0;
}