学习PE文件格式后编写的简单代码(C代码)

help()
{
  printf();
  printf();
  getch();
}
main(argc,*argv[])
{
  IMAGE_DOS_HEADER *pDosHead;
  IMAGE_NT_HEADERS *pPeHead;
  IMAGE_SECTION_HEADER *pSectionHead;
  HANDLE hFile,hMapping;
  *pBasePoint;
i;
  (argc<)
  {
    help();
    exit();
  }
  hFile=CreateFile(argv[],GENERIC_READ,FILE_SHARE_READ,,OPEN_EXISTING, 
    FILE_ATTRIBUTE_NORMAL,);    (hFile==INVALID_HANDLE_VALUE)
  {  GetLastError(); 
    ; 
  } 
  (!(hMapping=CreateFileMapping(hFile,,PAGE_READONLY|SEC_COMMIT,,,)))
  {                  CloseHandle(hFile);
    ;
  }
  (!(pBasePoint=MapViewOfFile(hMapping,FILE_MAP_READ,,,)))
  {                  
    CloseHandle(hFile);
    CloseHandle(hMapping);
    ;
  } pDosHead=(IMAGE_DOS_HEADER *)pBasePoint;
  (IMAGE_DOS_SIGNATURE!=pDosHead->e_magic)
  {
    printf();
    exit();
  }
  pPeHead=(IMAGE_NT_HEADERS *)(pBasePoint+pDosHead->e_lfanew);
  (IMAGE_NT_SIGNATURE!=pPeHead->Signature)
  {
    printf();
    exit();
  }
  printf();
  (IMAGE_FILE_MACHINE_I386==pPeHead->FileHeader.Machine)
    printf(,);
  printf(,pPeHead->FileHeader.Machine);
  printf(,pPeHead->FileHeader.NumberOfSections);
  printf(,pPeHead->FileHeader.TimeDateStamp);
  printf(,pPeHead->FileHeader.PointerToSymbolTable);
  printf(,pPeHead->FileHeader.NumberOfSymbols);
  printf(,pPeHead->FileHeader.SizeOfOptionalHeader);
  printf(,pPeHead->FileHeader.Characteristics);
  printf(,pPeHead->OptionalHeader.AddressOfEntryPoint);
  printf(,pPeHead->OptionalHeader.ImageBase);
  printf(,pPeHead->OptionalHeader.SectionAlignment);
  printf(,pPeHead->OptionalHeader.FileAlignment);
  printf(,pPeHead->OptionalHeader.MajorSubsystemVersion);
  printf(,pPeHead->OptionalHeader.MinorSubsystemVersion);
  printf(,pPeHead->OptionalHeader.SizeOfImage);
  printf(,pPeHead->OptionalHeader.SizeOfHeaders);
  printf(,pPeHead->OptionalHeader.Subsystem);
  for(i=;iFileHeader.NumberOfSections;i++)
  {
    j;
    pSectionHead=(IMAGE_SECTION_HEADER *)((*)pPeHead+*pPeHead+i**pSectionHead);
    printf();
    for(j=;jName;j++)
    {
      (==pSectionHead->Name[j])
        ;
      putchar(pSectionHead->Name[j]);
    }
    printf(,pSectionHead->VirtualAddress);
    printf(,pSectionHead->SizeOfRawData);
    printf(,pSectionHead->PointerToRawData);
    printf(,pSectionHead->Characteristics);
  }
for(i=;iFileHeader.NumberOfSections;i++)
  {
    IMAGE_DATA_DIRECTORY *pData=&pPeHead->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
    pSectionHead=(IMAGE_SECTION_HEADER *)((*)pPeHead+*pPeHead+i**pSectionHead);
   (pData->VirtualAddress>=pSectionHead->VirtualAddress
      &&pData->VirtualAddress+pData->Size<=pSectionHead->VirtualAddress+pSectionHead->SizeOfRawData)
    {
      IMAGE_IMPORT_DESCRIPTOR *pImport=addr(pData->VirtualAddress);
      while(pImport->Name)
      {
        IMAGE_THUNK_DATA *imThunk_data=addr(pImport->Characteristics);
        printf(,(*)addr(pImport->Name));
        while(imThunk_data->u1 .Ordinal)
        {
          (IMAGE_SNAP_BY_ORDINAL(imThunk_data->u1.Ordinal))
          {
            printf(,IMAGE_ORDINAL(imThunk_data->u1 .Ordinal ));
          }
          {
            IMAGE_IMPORT_BY_NAME *imImport_Name=(IMAGE_IMPORT_BY_NAME *) addr(imThunk_data->u1.AddressOfData);
            printf(,(*)imImport_Name->Name);
          }
          imThunk_data++;
        }pImport++;
      }
      ;
    }
  }
  CloseHandle(hFile);
  CloseHandle(hMapping);

  ;
}

你可能感兴趣的:(代码片段,c,image,header,dos,descriptor,import)