PE分析
2024-10-19 12:09:28
1 #include<windows.h>
2 #include<RichEdit.h>
3 #include "resource.h"
4
5
6
7 BOOL CALLBACK DlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam);
8
9 //Pe文件处理函数声明
10
11 BOOL IsPeFile(LPVOID ImageBase);
12 PIMAGE_NT_HEADERS GetNtHeader(LPVOID ImageBase);
13 PIMAGE_FILE_HEADER WINAPI GetFileHeader(LPVOID Imagebase);
14 PIMAGE_OPTIONAL_HEADER GetOptionalHeader(LPVOID ImageBase);
15
16 int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowcmd)
17 {
18 DialogBox(hInstance, MAKEINTRESOURCE(IDD_DIALOG), NULL, DlgProc);
19
20 return 0;
21 }
22
23
24 BOOL CALLBACK DlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam)
25 {
26
27
28 OPENFILENAME FileName = { 0,0,0 }, *lpFileName = &FileName;
29 HANDLE hFile, hFileMap;
30 TCHAR szPe[] = "\"PE File(*.exe)\" \0*.exe;*.dll;*.scr;*.fon;*.drv;\0\"*.All File(*.*) \0*.*\0\0";
31 TCHAR szFileName[256] = { "" };
32
33 LPVOID lpMemory;
34
35 TCHAR Buff[16];
36 PIMAGE_FILE_HEADER pFileHeader = NULL;
37 PIMAGE_OPTIONAL_HEADER pOptionHeader = NULL;
38
39 switch (message)
40 {
41 case WM_INITDIALOG:
42 break;
43 case WM_CLOSE:
44
45 EndDialog(hDlg, NULL);
46 break;
47
48 case WM_COMMAND:
49 switch (LOWORD(wParam))
50 {
51 case IDM_OPEN:
52 FileName.hInstance = (HINSTANCE)hDlg;
53 FileName.hwndOwner = hDlg;
54 FileName.lStructSize = sizeof(OPENFILENAME);
55 FileName.lpstrFilter = szPe;
56 FileName.lpstrFile = szFileName;
57 FileName.Flags = OFN_FILEMUSTEXIST || OFN_PATHMUSTEXIST;
58 FileName.nMaxFile = sizeof(szFileName);
59
60
61 if (!GetOpenFileName(lpFileName))
62 {
63 MessageBox(hDlg, "GetOpenFileName 调用失败", "ERROR", NULL);
64 break;
65 }
66
67 SetDlgItemText(hDlg, IDC_FILENAME, szFileName);
68
69 hFile = CreateFile(FileName.lpstrFile, // open pe file
70
71 GENERIC_READ, // open for reading
72
73 FILE_SHARE_READ || FILE_SHARE_WRITE, // share for reading
74
75 NULL, // no security
76
77 OPEN_EXISTING, // existing file only
78
79 FILE_ATTRIBUTE_NORMAL, // normal file
80
81 NULL); // no attr. template
82
83
84 if (hFile == INVALID_HANDLE_VALUE)
85 {
86 MessageBox(hDlg, "Could not open file.", "ERROR", MB_ICONERROR);
87 break;// process error
88
89 }
90
91 if (GetFileSize(hFile, NULL) != 0)
92 {
93 hFileMap = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
94 if (hFileMap != 0)
95 {
96 lpMemory = MapViewOfFile(hFileMap, FILE_MAP_READ, NULL, NULL, NULL);
97 }
98 }
99
100 if (IsPeFile(lpMemory))
101 {
102
103 pFileHeader = GetFileHeader(lpMemory);
104 pOptionHeader = GetOptionalHeader(lpMemory);
105 if (!(pFileHeader&&pOptionHeader))
106 {
107 MessageBox(hDlg, "获取文件头指针失败", "PEINFO", MB_ICONERROR);
108 break;
109 }
110 else
111 {
112 wsprintf(Buff, "%04lX", pFileHeader->Machine);
113 SetDlgItemText(hDlg, IDC_MACHINE, Buff);
114
115 wsprintf(Buff, "%04lX", pFileHeader->NumberOfSections);
116 SetDlgItemText(hDlg, IDC_NUMSECTION, Buff);
117
118 wsprintf(Buff, "%04lX", pOptionHeader->Magic);
119 SetDlgItemText(hDlg, IDC_MAGIC, Buff);
120
121 wsprintf(Buff, "%08lX", pOptionHeader->AddressOfEntryPoint);
122 SetDlgItemText(hDlg, IDC_ENTERPOINT, Buff);
123
124 wsprintf(Buff, "%08lX", pOptionHeader->DataDirectory[0].VirtualAddress);
125 SetDlgItemText(hDlg, IDC_EDIT_RVA_EXPORT, Buff);
126
127 wsprintf(Buff, "%08lX", pOptionHeader->DataDirectory[0].Size);
128 SetDlgItemText(hDlg, IDC_EDIT_SIZE_EXPORT, Buff);
129
130 wsprintf(Buff, "%08lX", pOptionHeader->DataDirectory[1].VirtualAddress);
131 SetDlgItemText(hDlg, IDC_EDIT_RVA_IMPORT, Buff);
132
133 wsprintf(Buff, "%08lX", pOptionHeader->DataDirectory[1].Size);
134 SetDlgItemText(hDlg, IDC_EDIT_SIZE_IMPORT, Buff);
135
136 wsprintf(Buff, "%08lX", pOptionHeader->DataDirectory[2].VirtualAddress);
137 SetDlgItemText(hDlg, IDC_EDIT_RVA_RES, Buff);
138
139 wsprintf(Buff, "%08lX", pOptionHeader->DataDirectory[2].Size);
140 SetDlgItemText(hDlg, IDC_EDIT_SIZE_RES, Buff);
141
142
143
144 }
145
146
147 }
148 else
149 {
150 MessageBox(hDlg, "你选择的不是PE文件", "error", MB_ICONERROR);
151 UnmapViewOfFile(lpMemory);
152 CloseHandle(hFileMap);
153 CloseHandle(hFile);
154 }
155 UnmapViewOfFile(lpMemory);
156 CloseHandle(hFileMap);
157 CloseHandle(hFile);
158
159 break;
160
161
162 }
163
164
165 }
166 return FALSE;
167 }
168
169 BOOL IsPeFile(LPVOID ImageBase) //判断是否是PE文件结构
170
171 {
172 PIMAGE_DOS_HEADER pDosHeader = NULL;
173 PIMAGE_NT_HEADERS pNtHeader = NULL;
174
175 if (!ImageBase)
176 return FALSE;
177 pDosHeader = (PIMAGE_DOS_HEADER)ImageBase;
178 if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE)
179 return FALSE;
180 pNtHeader = (PIMAGE_NT_HEADERS32)((DWORD)pDosHeader + pDosHeader->e_lfanew);
181 if (pNtHeader->Signature != IMAGE_NT_SIGNATURE )
182 return FALSE;
183 return TRUE;
184 }
185
186 //FileHeader 内容的读取
187
188
189 PIMAGE_NT_HEADERS GetNtHeader(LPVOID ImageBase) //获取NT结构指针
190
191 {
192 PIMAGE_DOS_HEADER pDosHeader = NULL;
193 PIMAGE_NT_HEADERS pNtHeader = NULL;
194
195 if (!IsPeFile(ImageBase))
196 return NULL;
197 pDosHeader = (PIMAGE_DOS_HEADER)ImageBase;
198 pNtHeader = (PIMAGE_NT_HEADERS32)((DWORD)pDosHeader + pDosHeader->e_lfanew);
199 return pNtHeader;
200 }
201
202 PIMAGE_FILE_HEADER WINAPI GetFileHeader(LPVOID Imagebase)
203 {
204 PIMAGE_FILE_HEADER pFileHeader;
205 PIMAGE_NT_HEADERS pNtHeader = NULL;
206 pNtHeader = GetNtHeader(Imagebase);
207 if (!pNtHeader)
208 return NULL;
209 pFileHeader = &pNtHeader->FileHeader;
210 return pFileHeader;
211 }
212
213 PIMAGE_OPTIONAL_HEADER GetOptionalHeader(LPVOID ImageBase)
214 {
215 PIMAGE_OPTIONAL_HEADER pOptionHeader = NULL;
216 PIMAGE_NT_HEADERS pNtHeader = NULL;
217 pNtHeader = GetNtHeader(ImageBase);
218 if (!pNtHeader)
219 return NULL;
220 pOptionHeader = &pNtHeader->OptionalHeader;
221 return pOptionHeader;
222 }
最新文章
- 一次sql注入中转
- 修改cdh5集群中主机节点IP或hostName
- DB2常用函数：字符串函数
- hide(1000)跟show(1000)
- HDU 1124 Factorial （数论）
- ODI 系列学习--整体架构概念
- 项目在JDK1.8环境下的一个Bug
- Spring Boot启动过程（七）：Connector初始化
- 从矩阵的定义开始谈OpenGL矩阵变换
- 小L的项链切割 （回文串）
- Confluence 6 基本性能问题诊断步骤
- FtpCopy数据定时自动备份软件（FTP定时备份）
- Xamarin.Android 无法检索到 Resource 问题
- HDU3987（最小割最少割边）
- 【系统移植】uboot详细分析
- 安装虚拟环境virtualenvwrapper和django
- split函数
- js字符串和控制语句
- HDU4185(KB10-G 二分图最大匹配)
- HashMap几个需要注意的知识点