PE解析器

最新推荐文章于 2024-09-28 10:25:06 发布
最新推荐文章于 2024-09-28 10:25:06 发布
阅读量1.1k 收藏 1
点赞数
分类专栏： windows # C/C++
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.youkuaiyun.com/Ga4ra/article/details/102481875
版权

文章目录


PE解析这东西，记着所有RVA转file offset然后加上缓冲区地址就行了。

main

因为控制台输入是多字节集，所以项目属性要设置为多字节。

#include <iostream>
#include "PE.h"

int main()
{
	TCHAR path[MAX_PATH] = { 0 };

	printf("input path:");
	_tscanf_s(_T("%s"), path, MAX_PATH);
	getchar();

	PE pe(path);

	if (!pe.bIsPe())
	{
		printf("This is not a PE file.\n");
		system("pause");
		return 0;
	}

	int opt = 0;
	DWORD dwRVA = 0;
	while (1)
	{
		wprintf(L"-1. exit\n");
		wprintf(L"0. dos/nt header info\n");
		wprintf(L"1. file header info\n");
		wprintf(L"2. optional header info\n");
		wprintf(L"3. Section header info\n");
		wprintf(L"4. export table info\n");
		wprintf(L"5. import table info\n");
		wprintf(L"6. resource info\n");
		wprintf(L"7. relocation info\n");
		wprintf(L"8. TLS	info\n");
		wprintf(L"9. delay-loaded dll info\n");


		scanf_s("%d", &opt);
		getchar();

		switch (opt)
		{
		case -1:
			system("pause");
			exit(0);
		case 0:
			pe.showDosHeader();
			pe.showNtHeader();
			break;
		case 1:
			pe.showFileHeader();
			break;
		case 2:
			pe.showOptHeader();
			break;
		case 3:
			pe.enumSectionHeaders();
			break;
		case 4:
			pe.showExpTable();
			break;
		case 5:
			pe.showImpTable();
			break;
		case 6:
			pe.showRes();
			break;
		case 7:
			pe.showReloc();
			break;
		case 8:
			pe.showTLS();
			break;
		case 9:
			pe.showDelay();
			break;
		default:
			break;
		}
		getchar();
		system("cls");
	}

	system("pause");
	return 0;
}

PE.h

#pragma once
#include <windows.h>
#include <iostream>
#include <tchar.h>
class PE
{
private:
	void *m_pFile;
	bool m_bIs64;

	PIMAGE_DOS_HEADER m_pDosHeader;
	PIMAGE_NT_HEADERS m_pNtHeader;
	PIMAGE_FILE_HEADER m_pFileHeader;

	PIMAGE_OPTIONAL_HEADER32 m_pOptHeader32;
	PIMAGE_OPTIONAL_HEADER64 m_pOptHeader64;

	PIMAGE_SECTION_HEADER m_pFirstSection;

	PIMAGE_EXPORT_DIRECTORY m_pIED;
	PIMAGE_IMPORT_DESCRIPTOR m_pIID;

	PIMAGE_RESOURCE_DIRECTORY m_pRes;
	PIMAGE_BASE_RELOCATION	m_pReloc;

	PIMAGE_TLS_DIRECTORY32	m_pTLS32;
	PIMAGE_TLS_DIRECTORY64	m_pTLS64;

	PIMAGE_DELAYLOAD_DESCRIPTOR m_pDelay;
public:
	PE(TCHAR* path);
	~PE();
	bool bIsPe();
	//int getDosHeader();
	//int getNtHeader();
	//int getOptHeader();

	void showDosHeader();
	void showNtHeader();
	void showFileHeader();
	void showOptHeader();
	void enumSectionHeaders();

	void showExpTable();
	void showImpTable();

	void showRes();
	void showReloc();
	void showTLS();
	void showDelay();

	DWORD RVA2FO(ULONGLONG dwRVA);

};

PE.cpp

Constructor_Destructor

#include "PE.h"

PE::PE(TCHAR* path)
{
	if (path == NULL) return;

	HANDLE hFile = CreateFile(path, GENERIC_READ, FILE_SHARE_READ,
		NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
	DWORD dwBytesRW = 0;
	DWORD dwFileSize = 0;


	if (hFile == INVALID_HANDLE_VALUE)
	{
		printf("CreateFile() error\n");
		system("pause");
		exit(0);
	}

	dwFileSize = GetFileSize(hFile, NULL);
	m_pFile = new char[dwFileSize]();
	ReadFile(hFile, m_pFile, dwFileSize, &dwBytesRW, NULL);


	if (m_pFile)
	{
		m_pDosHeader = (PIMAGE_DOS_HEADER)(m_pFile);
		m_pNtHeader = (PIMAGE_NT_HEADERS)((ULONGLONG)m_pFile + m_pDosHeader->e_lfanew);

		

		m_pFileHeader = (PIMAGE_FILE_HEADER)(&(m_pNtHeader->FileHeader));

		if (m_pFileHeader->Machine == 0x014c)
		{
			printf("x86 program.\n");
			m_bIs64 = false;
		}
		else if (m_pFileHeader->Machine == 0x8664)
		{
			printf("x64 program.\n");
			m_bIs64 = true;
		}

		m_pFirstSection = IMAGE_FIRST_SECTION(m_pNtHeader);

		if (m_bIs64)
		{
			m_pOptHeader64 = (PIMAGE_OPTIONAL_HEADER64)(&(m_pNtHeader->OptionalHeader));

			/*
			*	Export table.
			*/
			if (m_pFileHeader->Characteristics & IMAGE_FILE_DLL)
			{
				m_pIED = (m_pOptHeader64->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]).VirtualAddress ?
					(PIMAGE_EXPORT_DIRECTORY)(
						RVA2FO((m_pOptHeader64->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]).VirtualAddress)
						+ (ULONGLONG)m_pFile)
					: NULL;
			}

			/*
			*	Import table.
			*/
			m_pIID = (m_pOptHeader64->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]).VirtualAddress ?
				(PIMAGE_IMPORT_DESCRIPTOR)(
					RVA2FO((m_pOptHeader64->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]).VirtualAddress)
					+ (ULONGLONG)m_pFile)
				: NULL;

			/*
			*	Resource.
			*/
			m_pRes = (m_pOptHeader64->DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE]).VirtualAddress ?
				(PIMAGE_RESOURCE_DIRECTORY)(
					RVA2FO((m_pOptHeader64->DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE]).VirtualAddress)
					+ (ULONGLONG)m_pFile)
				: NULL;

			/*
			*	Relocation
			*/
			m_pReloc = (m_pOptHeader64->DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC]).VirtualAddress ?
				(PIMAGE_BASE_RELOCATION)(
					RVA2FO((m_pOptHeader64->DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC]).VirtualAddress)
					+ (ULONGLONG)m_pFile)
				: NULL;

			/*
			*	TLS
			*/
			m_pTLS64 = (m_pOptHeader64->DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS]).VirtualAddress ?
				(PIMAGE_TLS_DIRECTORY64)(
					RVA2FO((m_pOptHeader64->DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS]).VirtualAddress)
					+ (ULONGLONG)m_pFile)
				: NULL;

			/*
			*	Delay loaded dll
			*/
			m_pDelay = (m_pOptHeader64->DataDirectory[IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT]).VirtualAddress ?
				(PIMAGE_DELAYLOAD_DESCRIPTOR)(
					RVA2FO((m_pOptHeader64->DataDirectory[IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT]).VirtualAddress)
					+ (ULONGLONG)m_pFile)
				: NULL;
		}
		else
		{
			m_pOptHeader32 = (PIMAGE_OPTIONAL_HEADER32)(&(m_pNtHeader->OptionalHeader));
			/*
			*	Export table.
			*/
			if (m_pFileHeader->Characteristics & IMAGE_FILE_DLL)
			{
				m_pIED = (m_pOptHeader32->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]).VirtualAddress ?
					(PIMAGE_EXPORT_DIRECTORY)(
						RVA2FO((m_pOptHeader32->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]).VirtualAddress)
						+ (ULONGLONG)m_pFile)
					: NULL;
			}

			/*
			*	Import table.
			*/
			m_pIID = (m_pOptHeader32->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]).VirtualAddress ?
				(PIMAGE_IMPORT_DESCRIPTOR)(
					RVA2FO((m_pOptHeader32->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]).VirtualAddress)
					+ (ULONGLONG)m_pFile)
				: NULL;

			/*
			*	Resource.
			*/
			m_pRes = (m_pOptHeader32->DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE]).VirtualAddress ?
				(PIMAGE_RESOURCE_DIRECTORY)(
					RVA2FO((m_pOptHeader32->DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE]).VirtualAddress)
					+ (ULONGLONG)m_pFile)
				: NULL;

			/*
			*	Relocation
			*/
			m_pReloc = (m_pOptHeader32->DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC]).VirtualAddress ?
				(PIMAGE_BASE_RELOCATION)(
					RVA2FO((m_pOptHeader32->DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC]).VirtualAddress)
					+ (ULONGLONG)m_pFile)
				: NULL;

			/*
			*	TLS
			*/
			m_pTLS32 = (m_pOptHeader32->DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS]).VirtualAddress ?
				(PIMAGE_TLS_DIRECTORY32)(
					RVA2FO((m_pOptHeader32->DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS]).VirtualAddress)
					+ (ULONGLONG)m_pFile)
				: NULL;

			/*
			*	Delay loaded dll
			*/
			m_pDelay = (m_pOptHeader32->DataDirectory[IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT]).VirtualAddress ?
				(PIMAGE_DELAYLOAD_DESCRIPTOR)(
					RVA2FO((m_pOptHeader32->DataDirectory[IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT]).VirtualAddress)
					+ (ULONGLONG)m_pFile)
				: NULL;
		}


	}

}

PE::~PE()
{
	delete[] m_pFile;
	m_pFile = NULL;
	m_pDosHeader = NULL;
	m_pNtHeader = NULL;
	m_pFileHeader = NULL;
	
	m_pOptHeader32 = NULL;
	m_pOptHeader64 = NULL;

	m_pFirstSection = NULL;
	m_pIED = NULL;
	m_pIID = NULL;
	m_pRes = NULL;
	m_pReloc = NULL;

	m_pTLS32 = NULL;
	m_pTLS64 = NULL;

	m_pDelay = NULL;
}

RVA2FO

DWORD PE::RVA2FO(ULONGLONG dwRVA)
{
	PIMAGE_SECTION_HEADER pSectionHeader = m_pFirstSection;

	if (dwRVA == 0)
	{
		return 0;
	}

	while (!(dwRVA >= pSectionHeader->VirtualAddress
		&& dwRVA < pSectionHeader->VirtualAddress + pSectionHeader->SizeOfRawData))
	{
		++pSectionHeader;
		/*if (pSectionHeader->SizeOfRawData == 0)
		{
		return -1;
		}*/
	}
	return pSectionHeader->PointerToRawData
		+ (dwRVA - pSectionHeader->VirtualAddress);
}

bIsPe()

bool PE::bIsPe()
{
	if (m_pDosHeader->e_magic == IMAGE_DOS_SIGNATURE
		&& m_pNtHeader->Signature == IMAGE_NT_SIGNATURE)
	{
		return true;
	}
	return false;
}

FILE_HEADER()

/*
*	Functions to show PE info.
*/
void PE::showDosHeader()
{
}

void PE::showNtHeader()
{
}

void PE::showFileHeader()
{
	char* characteristics[] = {
		"IMAGE_FILE_RELOCS_STRIPPED			 ",
		"IMAGE_FILE_EXECUTABLE_IMAGE		 ",
		"IMAGE_FILE_LINE_NUMS_STRIPPED		 ",
		"IMAGE_FILE_LOCAL_SYMS_STRIPPED		 ",
		"IMAGE_FILE_AGGRESIVE_WS_TRIM		 ",
		"IMAGE_FILE_LARGE_ADDRESS_AWARE		 ",
		"",
		"IMAGE_FILE_BYTES_REVERSED_LO		 ",
		"IMAGE_FILE_32BIT_MACHINE			 ",
		"IMAGE_FILE_DEBUG_STRIPPED			 ",
		"IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP	 ",
		"IMAGE_FILE_NET_RUN_FROM_SWAP		 ",
		"IMAGE_FILE_SYSTEM					 ",
		"IMAGE_FILE_DLL						 ",
		"IMAGE_FILE_UP_SYSTEM_ONLY			 ",
		"IMAGE_FILE_BYTES_REVERSED_HI		 "
	};

	wprintf(L"Machine:	%04x\n", m_pFileHeader->Machine);
	wprintf(L"NumberOfSections:	%04x\n", m_pFileHeader->NumberOfSections);
	wprintf(L"SizeOfOptionalHeader:	%04x\n", m_pFileHeader->SizeOfOptionalHeader);
	wprintf(L"Characteristics:	%04x\n", m_pFileHeader->Characteristics);

	
	for (BYTE i = 0; i < 16; ++i)
	{
		if (m_pFileHeader->Characteristics & (1 << i))
		{
			printf("\t");
			printf(characteristics[i]);
			printf("\n");
		}
	}
}

OptHeader

void PE::showOptHeader()
{
	char* dllcharacteristics[] = {
		"",
		"",
		"",
		"",
		"",
		"IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA	0x0020		Image can handle a high entropy 64-bit virtual address space.",
		"IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE		0x0040      DLL can move.													 ",
		"IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY   0x0080      Code Integrity Image										 ",
		"IMAGE_DLLCHARACTERISTICS_NX_COMPAT			0x0100      Image is NX compatible											 ",
		"IMAGE_DLLCHARACTERISTICS_NO_ISOLATION		0x0200      Image understands isolation and doesn't want it				 ",
		"IMAGE_DLLCHARACTERISTICS_NO_SEH			0x0400      Image does not use SEH.  No SE handler may reside in this image ",
		"IMAGE_DLLCHARACTERISTICS_NO_BIND			0x0800      Do not bind this image.										 ",
		"IMAGE_DLLCHARACTERISTICS_APPCONTAINER		0x1000      Image should execute in an AppContainer						 ",
		"IMAGE_DLLCHARACTERISTICS_WDM_DRIVER		0x2000      Driver uses WDM model											 ",
		"IMAGE_DLLCHARACTERISTICS_GUARD_CF			0x4000      Image supports Control Flow Guard.								 ",
		"IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE     0x8000															 "
	};																													   

	if (m_bIs64)
	{
		wprintf(L"OEP:	%08x\n", m_pOptHeader64->AddressOfEntryPoint);
		wprintf(L"ImageBase:	%016x\n", m_pOptHeader64->ImageBase);
		wprintf(L"SectionAlignment:	%08x\n", m_pOptHeader64->SectionAlignment);
		wprintf(L"FileAlignment:	%08x\n", m_pOptHeader64->FileAlignment);
		wprintf(L"SizeOfImage:	%08x\n", m_pOptHeader64->SizeOfImage);
		wprintf(L"SizeOfHeaders:	%08x\n", m_pOptHeader64->SizeOfHeaders);
		wprintf(L"CheckSum:		%08x\n", m_pOptHeader64->CheckSum);
		wprintf(L"DllCharacteristics:		%08x\n", m_pOptHeader64->DllCharacteristics);

		for (BYTE i = 0; i < 16; ++i)
		{
			if (m_pOptHeader64->DllCharacteristics & (1 << i))
			{
				printf("\t");
				printf(dllcharacteristics[i]);
				printf("\n");
			}

		}
	}
	else
	{

		wprintf(L"OEP:	%08x\n", m_pOptHeader32->AddressOfEntryPoint);
		wprintf(L"ImageBase:	%016x\n", m_pOptHeader32->ImageBase);
		wprintf(L"SectionAlignment:	%08x\n", m_pOptHeader32->SectionAlignment);
		wprintf(L"FileAlignment:	%08x\n", m_pOptHeader32->FileAlignment);
		wprintf(L"SizeOfImage:	%08x\n", m_pOptHeader32->SizeOfImage);
		wprintf(L"SizeOfHeaders:	%08x\n", m_pOptHeader32->SizeOfHeaders);
		wprintf(L"CheckSum:		%08x\n", m_pOptHeader32->CheckSum);
		wprintf(L"DllCharacteristics:		%08x\n", m_pOptHeader32->DllCharacteristics);

		for(BYTE i = 0; i < 16; ++i)
		{
			if (m_pOptHeader32->DllCharacteristics & (1 << i))
			{
				printf("\t");
				printf(dllcharacteristics[i]);
				printf("\n");
			}
	
		}
	}
}

SectionHeader

void PE::enumSectionHeaders()
{
	PIMAGE_SECTION_HEADER pSectionHeader = m_pFirstSection;

	/*char* characteristics[] = {
		
	};
*/
	for (int i = 0; i < m_pFileHeader->NumberOfSections; 
		++i, ++pSectionHeader)
	{
		printf("section %d\n", i);
		printf("	name:	%s\n", pSectionHeader->Name);
		printf("	VirtualAddress:		0x%p\n", pSectionHeader->VirtualAddress);
		printf("	size of raw data:	0x%08x\n", pSectionHeader->SizeOfRawData);
		printf("	PointerToRawData:	0x%p\n", pSectionHeader->PointerToRawData);
		printf("	Characteristics:	0x%08x\n", pSectionHeader->Characteristics);
		//wprintf(L"		:	%08x\n", i);
	}
}

Export

void PE::showExpTable()
{
	if (!m_pFile || !m_pIED
		|| !(m_pFileHeader->Characteristics & IMAGE_FILE_DLL))
	{
		printf("No DLL file.\n");
		return;
	}

	PIMAGE_EXPORT_DIRECTORY pExportTab = m_pIED;

	DWORD *pFuncAddr = (DWORD *)(RVA2FO(pExportTab->AddressOfFunctions) + (ULONGLONG)m_pFile);
	DWORD *pFuncName = (DWORD *)(RVA2FO(pExportTab->AddressOfNames) + (ULONGLONG)m_pFile);
	WORD *pFuncOrd = (WORD *)(RVA2FO(pExportTab->AddressOfNameOrdinals) + (ULONGLONG)m_pFile);

	DWORD cNames = pExportTab->NumberOfNames;
	DWORD cFuncs = pExportTab->NumberOfFunctions;

	printf("DLL name:	%s\n", RVA2FO(pExportTab->Name) + (ULONGLONG)m_pFile);

	for (int nIndexAddr = 0; nIndexAddr < cFuncs; ++nIndexAddr)
	{
		for (int nIndexOrd = 0; nIndexOrd < cNames; ++nIndexOrd)
		{
			if (nIndexAddr == pFuncOrd[nIndexOrd])
			{
				printf("	Ordinal:	%d		FuncNanme:		%s		FuncAddr:	0x%p\n", 
					nIndexOrd, RVA2FO(pFuncName[nIndexOrd]) + (ULONGLONG)m_pFile, pFuncAddr[nIndexAddr]);
				break;
			}
			else if(nIndexOrd == cNames - 1)
			{
				printf("	FuncAddr:		0x%p\n", pFuncAddr[nIndexAddr]);
			}
		}
	}

}

Import

void PE::showImpTable()
{
	PIMAGE_IMPORT_DESCRIPTOR pImpTab = m_pIID;
	PIMAGE_THUNK_DATA pINT = NULL, pIAT = NULL;
	while (pImpTab->Name)
	{
		printf("dll name:	%s\n", (char*)(RVA2FO(pImpTab->Name) + (ULONGLONG)m_pFile));

		/*printf("INT:\n");
		pINT = (PIMAGE_THUNK_DATA)(pImpTab->OriginalFirstThunk + (ULONGLONG)pDos);
		while (pINT->u1.Ordinal)
		{
			if (pINT->u1.Ordinal
				& 1 << (8 * sizeof(pINT->u1.Ordinal) - 1))
			{
				printf("ordinal:	%d\n", pINT->u1.Ordinal & ~(1 << (8 * sizeof(pINT->u1.Ordinal) - 1)));
			}
			else
			{
				PIMAGE_IMPORT_BY_NAME pName = (PIMAGE_IMPORT_BY_NAME)RVA2FO(pINT->u1.AddressOfData);
				printf("ordinal:	%d		func name:		%s\n", pName->Hint, pName->Name);
			}

			++pINT;
		}*/

		printf("IAT:\n");
		pIAT = (PIMAGE_THUNK_DATA)(RVA2FO(pImpTab->FirstThunk) + (ULONGLONG)m_pFile);
		while (pIAT->u1.Ordinal)
		{
			if (pIAT->u1.Ordinal
				& 1 << (8 * sizeof(pIAT->u1.Ordinal) - 1))
			{
				printf("	ordinal:	%04x\n", pIAT->u1.Ordinal & ~(1 << (8 * sizeof(pIAT->u1.Ordinal) - 1)));
			}
			else
			{
				PIMAGE_IMPORT_BY_NAME pName = (PIMAGE_IMPORT_BY_NAME)(RVA2FO(pIAT->u1.AddressOfData) + (ULONGLONG)m_pFile);
				printf("	ordinal:	%04x		func name:		%s\n", pName->Hint, pName->Name);
			}

			++pIAT;
		}

		++pImpTab;
	}
}

Resource

void PE::showRes()
{
	PIMAGE_RESOURCE_DIRECTORY pRes_1 = m_pRes, pRes_2 = NULL, pRes_3 = NULL;
	PIMAGE_RESOURCE_DIRECTORY_ENTRY pResEntry_1 = NULL,
		pResEntry_2 = NULL,
		pResEntry_3 = NULL;

	DWORD dwEntry_1 = 0,
		dwEntry_2 = 0,
		dwEntry_3 = 0;
	PIMAGE_RESOURCE_DIR_STRING_U pName = NULL;
	PIMAGE_RESOURCE_DATA_ENTRY pData = NULL;

	char *aResTypes[] = {
		"",
		"cursor", "bitmap",
		"icon", "menu",
		"dialog", "string table",
		"font directory", "font",
		"accelerator", "unformatted",
		"message table", "group cursor",
		"",
		"group icon",
		"",
		"version",
	};

	pRes_1 = m_pRes;
	dwEntry_1 = pRes_1->NumberOfIdEntries + pRes_1->NumberOfNamedEntries;
	if (!dwEntry_1)
	{
		printf("No resource\n");
		system("pause");
		return;
	}


	printf("There are %d types of resources.\t"
		"%d typed hava name\n",
		dwEntry_1, pRes_1->NumberOfNamedEntries);
	/*
	*	Layer 1
	*/
	pResEntry_1 = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(pRes_1 + 1);
	for (int i = 0; i < dwEntry_1; ++i)
	{
		
		/*
		*	Layer 2
		*/
		if (pResEntry_1[i].DataIsDirectory)
		{
			pRes_2 = (PIMAGE_RESOURCE_DIRECTORY)
				(pResEntry_1[i].OffsetToDirectory + (DWORD)pRes_1);
			dwEntry_2 = pRes_2->NumberOfIdEntries + pRes_2->NumberOfNamedEntries;
			
			printf("\t%d %s resources .\n"
					"\t%d hava name\n",
				dwEntry_2, 
				pResEntry_1[i].Id <= 0x10 ? aResTypes[pResEntry_1[i].Name] : "Unknown type",
				pRes_2->NumberOfNamedEntries);


			/*
			*	Layer 3
			*/
			pResEntry_2 = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(pRes_2 + 1);
			for (int j = 0; j < dwEntry_2; ++j)
			{

				if (pResEntry_2[j].DataIsDirectory)
				{
					pRes_3 = (PIMAGE_RESOURCE_DIRECTORY)
						(pResEntry_2[j].OffsetToDirectory + (DWORD)pRes_1);
					dwEntry_3 = pRes_3->NumberOfIdEntries + pRes_3->NumberOfNamedEntries;


					/*
					*	Data layer 
					*/
					pResEntry_3 = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(pRes_3 + 1);
					for (int k = 0; k < dwEntry_3; ++k)
					{
						pData = (PIMAGE_RESOURCE_DATA_ENTRY)(pResEntry_3[k].OffsetToData + (DWORD)pRes_1);


						if (pResEntry_2[j].NameIsString)
						{
							pName = (PIMAGE_RESOURCE_DIR_STRING_U)(pResEntry_2[j].NameOffset + pRes_1);
							printf("\t\tRVA: 0x%p	size: %08x\t", pData->OffsetToData, pData->Size);
							printf("\t\t%s	%s ---%08x\n",
								pResEntry_1[i].Id <= 0x10 ? aResTypes[pResEntry_1[i].Id] : "Unknown type",
								pName->NameString,
								pResEntry_3[k].Name);
						}
						else
						{
							printf("\t\tRVA: 0x%p	size: %08x\t", pData->OffsetToData, pData->Size);
							printf("\t\t%s	%08x ---%08x\n", 
								pResEntry_1[i].Id <= 0x10 ? aResTypes[pResEntry_1[i].Id] : "Unknown type",
								pResEntry_2[j].Name,
								pResEntry_3[k].Name);
						}
					}
				}
			}

		}
	}
}

Relocation

void PE::showReloc()
{
	if (!m_pFile || !m_pReloc)
	{
		printf("No relocation\n");
		return;
	}
	typedef struct {
		WORD	offset : 12;
		WORD	type : 4;
	}TypeOffset, *PTypeOffset;

	PIMAGE_BASE_RELOCATION pReloc = m_pReloc;
	DWORD dwCount = ((pReloc->SizeOfBlock) - 8) / 2;

	PTypeOffset pTypeOffset = (PTypeOffset)(pReloc + 1);
	ULONGLONG RVA = 0;

	while (pReloc->SizeOfBlock)
	{
		printf("Block RVA: %08x\n", pReloc->VirtualAddress);
		for (int i = 0; i < dwCount;
			++i)
		{
			RVA = 0;
			if (pTypeOffset[i].type == IMAGE_REL_BASED_HIGHLOW)
			{
				RVA = pTypeOffset[i].offset + pReloc->VirtualAddress;
				printf("\tRVA : %08X\n\tFOA : %08X\n\n", RVA, RVA2FO(RVA));
			}
			else if (pTypeOffset[i].type == IMAGE_REL_BASED_DIR64)
			{
				RVA = pTypeOffset[i].offset + pReloc->VirtualAddress;
				printf("\tRVA : %016X\n\tFOA : %016X\n\n", RVA, RVA2FO(RVA));
			}
		}

		pReloc = (PIMAGE_BASE_RELOCATION)((ULONGLONG)pReloc + pReloc->SizeOfBlock);
	}
}

TLS

void PE::showTLS()
{
	
	if (m_pTLS32)
	{
		printf("TLS Directory:");
		printf("\tStartAddressOfRawData :	0x%p\n", m_pTLS32->StartAddressOfRawData);
		printf("\tEndAddressOfRawData :		0x%p\n", m_pTLS32->EndAddressOfRawData);
		printf("\tAddressOfCallBacks :		0x%p\n", m_pTLS32->AddressOfCallBacks);
	}
	else if(m_pTLS64)
	{
		printf("TLS Directory:");
		printf("\tStartAddressOfRawData :	0x%p\n", m_pTLS64->StartAddressOfRawData);
		printf("\tEndAddressOfRawData :		0x%p\n", m_pTLS64->EndAddressOfRawData);
		printf("\tAddressOfCallBacks :		0x%p\n", m_pTLS64->AddressOfCallBacks);
	}
	else
	{
		printf("No TLS\n");
	}
}

delay

void PE::showDelay()
{
	if (m_pDelay)
	{
		printf("Delay-loaded dll name: %s\n", RVA2FO(m_pDelay->DllNameRVA) + (ULONGLONG)m_pFile);
		printf("RVA to IAT: %p\n", m_pDelay->ImportAddressTableRVA);
		printf("RVA to INT: %p\n", m_pDelay->ImportNameTableRVA);
		printf("RVA to bound IAT: %p\n", m_pDelay->BoundImportAddressTableRVA);
		printf("RVA to unload IAT: %p\n", m_pDelay->UnloadInformationTableRVA);
	}
	else
	{
		printf("No dalay-loaded dll.\n");
	}
}

RVA2FO

DWORD PE::RVA2FO(ULONGLONG dwRVA)
{
	PIMAGE_SECTION_HEADER pSectionHeader = m_pFirstSection;

	if (dwRVA == 0)
	{
		return 0;
	}

	while (!(dwRVA >= pSectionHeader->VirtualAddress
		&& dwRVA < pSectionHeader->VirtualAddress + pSectionHeader->SizeOfRawData))
	{
		++pSectionHeader;
		/*if (pSectionHeader->SizeOfRawData == 0)
		{
		return -1;
		}*/
	}
	return pSectionHeader->PointerToRawData
		+ (dwRVA - pSectionHeader->VirtualAddress);
}
PE分析工具
08-19
PE分析工具, 这个PE分析工具功能挺全的.
PE文件解析器
宇丁加
06-29 1205
暂时先将代码贴出来。关于基础的知识，后续发。 /* ***************************** 这是逆向课程中老师讲过PE结构的一个实验，老师让参考博客的源码。但是我想着，好好熟悉一下，自己动手跟着博客的思路自己写下。 环境VS2010 ***************************** */ #include<stdio.h> #include<stdlib.h> #include<Windows.h> //#include"pe.h"
PE解析器，纯手工制作，用于分析可执行文件，逆向破解必备工具
07-18
用于解析windows系统平台的可执行文件解析 运行平台：WIN7 64bit/32bit,WIN8 64bit/32bit,WIN10 64bit/32bit； 暂不支持64位PE文件。
PE格式：手写PE结构解析工具
优快云
11-15 6450
PE格式是 Windows下最常用的可执行文件格式,理解PE文件格式不仅可以了解操作系统的加载流程,还可以更好的理解操作系统对进程和内存相关的管理知识,而有些技术必须建立在了解PE文件格式的基础上,如文件加密与解密,病毒分析,外挂技术等,在PE文件中我们最需要关注,PE结构,导入表,导出表,重定位表,下面将具体介绍PE的关键结构,并使用C语言编程获取到这些结构数据.
三个PE解析器代码学习
04-29
标题 "三个PE解析器代码学习" 涉及的核心知识点主要围绕着PE（Portable Executable）文件格式、PE解析、MFC（Microsoft Foundation Classes）框架以及C++编程语言在Windows环境下的应用。以下是对这些主题的详细阐述...
VS2022MFC非常基础的pe解析器（滴水三期自查用，只适用于64）
最新发布
10-10
VS2022环境下开发的MFC应用程序，通常被称为“非常基础的PE解析器”，旨在特定的项目环境中使用，即“滴水三期自查”项目。PE文件是Windows操作系统中常见的可执行文件格式，其全称为Portable Executable，它包括了...
DIYPE解析器（做事无痕）
02-05
DIYPE解析器，又被称为“做事无痕”，是一款专门针对PE（Portable Executable）文件格式进行解析的工具。在IT领域，尤其是系统分析、逆向工程和恶意软件检测中，PE解析器扮演着至关重要的角色。PE文件格式是Windows...
PE解析器python脚本
03-17
标题中的“PE解析器python脚本”指的是一个使用Python编程语言编写的程序，它的主要功能是解析PE（Portable Executable）文件格式。PE文件格式是Windows操作系统中的可执行文件和动态链接库（DLL）的标准格式。这个...
PE文件分析器
LoveQuietly
01-20 883
PE文件分析
PE文件解析类（轻松制作自己的PE文件解析器）
02-06
PE是Portable Executable File Format（可移植的执行体）简写，它是目前Windows平台上的主流可执行文件格式。 PE文件中包含的内容很多，具体我就不在这解释了，有兴趣的可以参看之后列出的参考资料及其他相关内容。 最近我也在学习PE文件格式，参考了许多资料，用C++封装了一个高效方便的PE文件格式解析的类。 该类对想学PE文件结构的朋友可算一份可贵的资料，代码均很易懂，考虑较全面，具有一定的通用性。 同时该类也可以让想创建自己的PE文件解析软件的朋可以轻松在此基础上实现。 最后，错误在所难免，如果大家发现有错误，欢迎大家指正。 具体参看：http://blog.youkuaiyun.com/paschen/article/details/50640421
PE文件解析器的原理（C语言代码）
01-16
用C语言实现对PE文件解析器的编写，只用到了几个的win32API函数，只保留框架
PE解析器（C语言）.zip
08-19
使用C语言完成PE解析器，对未加壳状态下的PE文件进行解析，查看其基本信息、导入表、导出表、资源表等
PE文件解析工具源代码
01-10
没什么高深的技术性可言。仅仅是根据微软的Pe格式来解析exe文件而已。作为新手学习PE的一个参考吧。。内附vc base论坛的PE格式说明文档。witch 2013-1-10
PE解析器（PEParser）使用指南
gitblog_00850的博客
09-11 635
PE解析器（PEParser）使用指南 peparser Win32 PE Parser 项目地址: https://gitcode.com/gh_mirrors/pe/peparser ...
【逆向】【PE入门】使用PEView分析PE文件
热门推荐
lanlanla的成长历程
01-08 2万+
目录 什么是PE？ 什么是PEView? 分析PE文件 什么是DOS头？ IMAGE_DOS_HEADER是干嘛的？ DOS块是干嘛的？ 什么是NT头？ Signatrue？ IMAGE_FILE_HEADER？ IMAGE_OPTIONAL_HEADER? section头？ 1.找到 NT 头的起始偏移地址、结束地址？ 什么是PE？ 参考博客：htt...
Win32汇编：实现PE结构解析器
优快云
06-16 8198
PE格式是Windows系统下最常用的可执行文件格式,有些应用必须建立在了解PE文件格式的基础之上,如可执行文件的加密与解密,文件型病毒的查杀等,熟练掌握PE文件结构,有助于软件的分析.
PE文件详解(C制作PE格式解析器)
CharlesGodX的博客
03-27 5857
0x00：前言 PE文件可以说是在逆向的各个领域都有涉及，特别是病毒领域，如果你是一名病毒制造者，那你肯定是对PE文件有详细的了解，那么这里我就详细介绍一下PE文件，最后我们用C来写一个PE格式解析器。 0x01：PE格式 要了解PE文件，首先要知道PE格式，那么什么是PE格式呢，既然是一个格式，那肯定是我们都需要遵循的定理，下面这张图就是PE文件格式的图片(来自看雪)，非常大一张图片，其实PE格...
PEDUMP：深入解析PE文件结构的开源工具
weixin_42309599的博客
09-28 1499
本文还有配套的精品资源，点击获取 简介：PEDUMP是一款能够解析Windows PE文件格式的开源工具，适用于软件开发者、逆向工程师和安全研究人员。它提取并展示PE文件的头标信息、节区详情、导出/导入函数、资源、符号表、重定位信息和安全特性。工具支持命令行操作和报告生成，源代码开放，便于定制和集成，广泛用于软件调试、逆向工程和安全分析。 1. PE文件解读源程序...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值