| 网站首页 | 业界新闻 | 小组 | 威客 | 人才 | 下载频道 | 博客 | 代码贴 | 在线编程 | 编程论坛
欢迎加入我们,一同切磋技术
用户名:   
 
密 码:  
共有 1061 人关注过本帖
标题:PE文件格式的问题
只看楼主 加入收藏
djxh77710
Rank: 2
来 自:中国
等 级:论坛游民
帖 子:71
专家分:88
注 册:2008-10-20
结帖率:80%
收藏
已结贴  问题点数:100 回复次数:2 
PE文件格式的问题
遍历DLL,除了C程序之外,貌似没有什么能遍历出来,遍历导入函数更是一个都遍历不出来,帮帮在下.感激不尽..
程序代码:
typedef struct _PE_INFO_STRUCT{
HANDLE hFile;//文件句柄
HANDLE hMap; //映像句柄
DWORD ImageBase;//映像基址
}PEInfo;


DWORD GetImageBase( LPVOID FilePath );//获取映像基址
PIMAGE_DOS_HEADER GetDosHeader( DWORD ImageBase );//获取Dos头
PIMAGE_NT_HEADERS GetNtHeader(PIMAGE_DOS_HEADER &pDos);//获取Nt头
PIMAGE_FILE_HEADER GetFileHeader( PIMAGE_NT_HEADERS &pNt );
PIMAGE_OPTIONAL_HEADER GetOptionHeader( PIMAGE_NT_HEADERS &pNt );
PIMAGE_SECTION_HEADER GetSectionHeader( PIMAGE_NT_HEADERS &pNt );

BOOL BianLiSection( PIMAGE_SECTION_HEADER &pSec, PIMAGE_FILE_HEADER &pFH );

PIMAGE_DATA_DIRECTORY GetDataDir( PIMAGE_OPTIONAL_HEADER &pOH,int Num );

PIMAGE_IMPORT_DESCRIPTOR GetImportDir( PIMAGE_OPTIONAL_HEADER &pOh );


PIMAGE_THUNK_DATA GetThunkData( PIMAGE_IMPORT_DESCRIPTOR &pImportor);
DWORD ImageBase = 0;
BOOL BianLiDll(PIMAGE_IMPORT_DESCRIPTOR &pImportor);

bool HookApi();

int main(int argc, char* argv[])
{
char FilePath[255];

scanf("%s",FilePath);

ImageBase = GetImageBase( FilePath );

PIMAGE_DOS_HEADER pDos = GetDosHeader( ImageBase );

PIMAGE_NT_HEADERS pNtH = GetNtHeader( pDos );

PIMAGE_OPTIONAL_HEADER pOH = GetOptionHeader( pNtH );
GetOptionHeader( pNtH );

PIMAGE_SECTION_HEADER pSec = GetSectionHeader( pNtH );

PIMAGE_FILE_HEADER pFH = GetFileHeader( pNtH );

PIMAGE_IMPORT_DESCRIPTOR pImportor = GetImportDir( pOH );
GetThunkData( pImportor );
//BianLiDll( pImportor );
//BianLiSection( pSec, pFH );

 return 0;
}


DWORD GetImageBase( LPVOID FilePath )
{
        PEInfo TempInfo;

    TempInfo.hFile = CreateFile( 
        (LPCTSTR)FilePath,
        GENERIC_READ,
        FILE_SHARE_READ,
        NULL,
        OPEN_EXISTING,
        FILE_ATTRIBUTE_NORMAL, 
        0
        );

    if ( INVALID_HANDLE_VALUE == TempInfo.hFile )
    {
        printf("CreateFile Error!\n");
        return 0;
    }

    TempInfo.hMap = CreateFileMapping(
        TempInfo.hFile,
        NULL,
        PAGE_READONLY,
        0,
        0,
        0
        );
    
    if ( TempInfo.hMap == NULL )
    {
        printf("CreateFileMap Error!\n");
        return 0;
    }

    LPVOID TempBase = MapViewOfFile(
        TempInfo.hMap,
        FILE_MAP_READ,
        0,
        0,
        GetFileSize( TempInfo.hFile, 0 )
        );

    if ( TempBase == NULL )
    {
        printf("MapView Error!\n");
        return 0;
    }
    else
    {
        TempInfo.ImageBase = (DWORD)TempBase;
        return TempInfo.ImageBase;
    }
}

PIMAGE_DOS_HEADER GetDosHeader( DWORD ImageBase )
{

    PIMAGE_DOS_HEADER pDos = NULL;

    if( !ImageBase)

        return 0;

    else

        pDos = (PIMAGE_DOS_HEADER)ImageBase;

    return pDos;
}

PIMAGE_NT_HEADERS GetNtHeader( PIMAGE_DOS_HEADER &pDos )
{
    PIMAGE_NT_HEADERS pNtH =NULL;
    if ( !pDos )
    {
        return 0;
    }
    else
    {
        pNtH = (PIMAGE_NT_HEADERS)( ImageBase + pDos->e_lfanew );
        return pNtH;
    }
}

PIMAGE_FILE_HEADER GetFileHeader( PIMAGE_NT_HEADERS &pNt )
{
    PIMAGE_FILE_HEADER pFH = NULL;
    
    if ( !pNt)
    {
        return 0;
    }
    else
    {
        pFH = (PIMAGE_FILE_HEADER)&pNt->FileHeader;

        return pFH;
    }
}

PIMAGE_OPTIONAL_HEADER GetOptionHeader( PIMAGE_NT_HEADERS &pNt )
{
    PIMAGE_OPTIONAL_HEADER pOH = NULL;

    if ( !pNt)
    {
        return 0;
    }
    else
    {
        pOH = (PIMAGE_OPTIONAL_HEADER)&( pNt->OptionalHeader );
        
        return pOH;
    }
}

PIMAGE_SECTION_HEADER GetSectionHeader( PIMAGE_NT_HEADERS &pNt )
{
    PIMAGE_SECTION_HEADER pSecH = NULL;
    if ( !pNt)
    {
        return 0;
    }
    else
    {
        pSecH = IMAGE_FIRST_SECTION(pNt);
        
        return pSecH;
    }
}

PIMAGE_DATA_DIRECTORY GetDataDir( PIMAGE_OPTIONAL_HEADER &pOH,int Num )
{
    PIMAGE_DATA_DIRECTORY pDataDir = NULL;
    if ( !pOH )
    {
        return 0;
    }
    else
    {
        pDataDir = (PIMAGE_DATA_DIRECTORY)&pOH->DataDirectory[Num];

        return pDataDir;
    }
}

PIMAGE_IMPORT_DESCRIPTOR GetImportDir( PIMAGE_OPTIONAL_HEADER &pOh )
{
    PIMAGE_IMPORT_DESCRIPTOR pImportDir = NULL;

    if ( !pOh )
    {
        return 0;
    }
    else
    {
        pImportDir = ( PIMAGE_IMPORT_DESCRIPTOR )( ImageBase + pOh->DataDirectory[1].VirtualAddress );

    
        return pImportDir;
    }
}

BOOL BianLiSection( PIMAGE_SECTION_HEADER &pSec, PIMAGE_FILE_HEADER &pFH )
{
    WORD SecNum = pFH->NumberOfSections;

    if( !pSec && !pFH )
    {
        return FALSE;
    }
    else
    {
        for (int i=0; i<SecNum; i++)
        {
            printf("%s\n",pSec[i].Name);
        }

        return TRUE;
    }    
}

PIMAGE_THUNK_DATA GetThunkData( PIMAGE_IMPORT_DESCRIPTOR &pImportor)
{
    PIMAGE_THUNK_DATA pThunk = NULL;

    if ( !pImportor )
    {
        return 0;
    }
    else
    {
        pThunk = (PIMAGE_THUNK_DATA)(pImportor->FirstThunk+ImageBase);
        while (pImportor->FirstThunk)
    
        printf("%s\n",pThunk->u1.Function+ImageBase);
    
        return pThunk;
    }
}

BOOL BianLiDll(PIMAGE_IMPORT_DESCRIPTOR &pImportor)
{
    
    if ( !pImportor )
    {
        return FALSE;
    }
    else
    {
        while(pImportor->FirstThunk)
        {
            printf("%s\n",pImportor->Name+ImageBase);
            pImportor++;
        }
        return TRUE;
    }
}



[[it] 本帖最后由 djxh77710 于 2009-8-3 04:50 编辑 [/it]]
搜索更多相关主题的帖子: 格式 文件 
2009-08-03 04:14
djxh77710
Rank: 2
来 自:中国
等 级:论坛游民
帖 子:71
专家分:88
注 册:2008-10-20
收藏
得分:0 
懂PE结构的大哥们,帮帮忙呀..

No Pains ,No Gains....
2009-08-05 07:23
wzla333
Rank: 4
来 自:火星
等 级:业余侠客
威 望:2
帖 子:185
专家分:237
注 册:2006-8-24
收藏
得分:70 
麻烦你告诉我下 你的目的是什么???

我从来都非常缺少朋友,因为自己不善于表达,无论是工作,学习,生活,抑或是网络...ACG爱好者,标准一个无限接近30岁的大叔......
2009-08-08 11:57
快速回复:PE文件格式的问题
数据加载中...
 
   



关于我们 | 广告合作 | 编程中国 | 清除Cookies | TOP | 手机版

编程中国 版权所有,并保留所有权利。
Powered by Discuz, Processed in 0.076424 second(s), 7 queries.
Copyright©2004-2024, BCCN.NET, All Rights Reserved