1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
| #include<stdio.h>
#include<stdlib.h>
#include<memory.h>
#include<windows.h>
#pragma warning(disable : 4996)
/*编写程序读取一个.exe文件，输出所有的PE头信息*/
/*获取的是扫雷exe，PE头信息
*/
int PE() {
PIMAGE_DOS_HEADER pDosHeader = NULL;
PIMAGE_NT_HEADERS pNTHeader = NULL;
PIMAGE_FILE_HEADER pFileHeader = NULL;
PIMAGE_OPTIONAL_HEADER32 pOPtionHeader = NULL;
int A = 0;
FILE* pa = NULL; //文件指针
pa = fopen("C:\\Users\\28611\\Desktop\\桌面的文件\\初赛.ring3\\winmine.exe", "rb");
if (pa == NULL) {
printf("文件打开失败");
return 0;
}
fseek(pa, 0, SEEK_END);
A = ftell(pa);
char* pb; //堆指针
pb = (char*)malloc(A);
if (pb == NULL) {
printf("堆空间分配失败");
return 0;
}
memset(pb, 0, A);
fseek(pa, 0, SEEK_SET);
fread(pb, A, 1, pa);
fclose(pa);
pa = NULL;
//文件的二进制已经传到了堆空间中
if (*(short*)pb != IMAGE_DOS_SIGNATURE) {
printf("MZ标识失败");
free(pb);
pb = NULL;
return 0;
}
pDosHeader = (PIMAGE_DOS_HEADER)pb;
printf("DOS头: \n");
printf("E_magic: %x\n", pDosHeader->e_magic);
printf("E_lfanew: %x\n", pDosHeader->e_lfanew);
if (*(int*)(pb + (pDosHeader->e_lfanew)) != IMAGE_NT_SIGNATURE) {
printf("PE标识失败");
free(pb);
pb = NULL;
return 0;
}
pNTHeader = (PIMAGE_NT_HEADERS)(pb + pDosHeader->e_lfanew);
printf("NT头: \n");
printf("Signature: %x\n", pNTHeader->Signature);
printf("标准PE头: \n");
pFileHeader = (PIMAGE_FILE_HEADER)(pb + pDosHeader->e_lfanew + 4);
printf("Machine: %x\n", pFileHeader->Machine);
printf("NumberOfSections: %x\n", pFileHeader->NumberOfSections);
printf("TimeDateStamp: %x\n", pFileHeader->TimeDateStamp);
printf("SizeOfOptionalheader: %x\n", pFileHeader->SizeOfOptionalHeader);
printf("Characteristics: %x\n", pFileHeader->Characteristics);
printf("扩展PE头: \n");
pOPtionHeader = (PIMAGE_OPTIONAL_HEADER32)(pb + pDosHeader->e_lfanew + 24);
printf("Magic: %x\n", pOPtionHeader->Magic);
printf("SizeOfCode: %x\n", pOPtionHeader->SizeOfCode);
printf("SizeOfInitializedData: %x\n", pOPtionHeader->SizeOfInitializedData);
printf("SizeOfUninitializedData: %x\n", pOPtionHeader->SizeOfUninitializedData);
printf("AddressOfEntryPoint: %x\n", pOPtionHeader->AddressOfEntryPoint);
printf("BaseOfCode: %x\n", pOPtionHeader->BaseOfCode);
printf("BaseOfData: %x\n", pOPtionHeader->BaseOfData);
printf("ImageBase: %x\n", pOPtionHeader->ImageBase);
printf("SectionAlignment: %x\n", pOPtionHeader->SectionAlignment);
printf("FileAlignment: %x\n", pOPtionHeader->FileAlignment);
printf("SizeOfImage: %x\n", pOPtionHeader->SizeOfImage);
printf("SizeOfHeaders: %x\n", pOPtionHeader->SizeOfHeaders);
printf("CheckSum: %x\n", pOPtionHeader->CheckSum);
printf("SizeOfStackReserve: %x\n", pOPtionHeader->SizeOfStackReserve);
printf("SizeOfStackCommit: %x\n", pOPtionHeader->SizeOfStackCommit);
printf("SizeOfHeapReserve: %x\n", pOPtionHeader->SizeOfHeapReserve);
printf("SizeOfHeapCommit: %x\n", pOPtionHeader->SizeOfHeapCommit);
free(pb);
pb = NULL;
}
int main() {
PE();
return 0;
}
|
