程序代码：
;边理解PE结构边自己写查看的程序
;看别人的程序，还是要自己动手写一下才深刻一点的。
;简单的查看。未完成
;by onepc 153785587
.386
.model flat,stdcall
option casemap:none
include windows.inc
include user32.inc
include kernel32.inc
;include gdi32.inc ;图形
includelib user32.lib
includelib kernel32.lib
;includelib gde32.lib
include comdlg32.inc
includelib comdlg32.lib
include macro.asm ;ctxt("")
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
IDD_TEST_DIALOG equ 102
IDR_MAINFRAME equ 128
IDD_DIALOG1 equ 129
IDC_BUTTON1 equ 1000
IDC_BUTTON2 equ 1001
IDC_EDIT1 equ 1003
IDC_EDIT7 equ 1004
IDC_EDIT2 equ 1005
IDC_EDIT3 equ 1006
IDC_EDIT4 equ 1007
IDC_EDIT5 equ 1008
IDC_EDIT6 equ 1009
IDC_BUTTON3 equ 1010
IDC_LIST2 equ 1012
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
IMAGE_DOS_SIGNATURE equ 5A4Dh ;MZ
IMAGE_NT_SIGNATURE equ 4550h ;PE
.data
szFilter db 'Text Files(*.exe)',0,'*.exe',0,'Dll Files(*.dll)',0,'*.dll',0,0
szFmatTxt db '%08X',0
.data?
hInstance dd ? ;模块句柄
hMain dd ? ;对话框句柄
hFile dd ? ;CreateFile 返回文件句柄
hMapFile dd ? ;CreateFileMapping 返回内存映射文件句柄
lPMemory dd ? ;MapViewOfFile 返回文件映射到内存的第一个字节的指针
szPath db MAX_PATH dup(?) ;文件路径缓冲区
szTemBuffer db MAX_PATH dup (?)
.code
;***********************打开文件***********************
_OpenFile proc
local @stFile:OPENFILENAME
invoke RtlZeroMemory,addr @stFile,sizeof @stFile ;填零
mov @stFile.lStructSize,sizeof @stFile
push hMain
pop @stFile.hwndOwner
;mov @stFile.hwndOwner,hMin
mov @stFile.lpstrFilter,offset szFilter
mov @stFile.lpstrFile,offset szPath
mov @stFile.nMaxFile,MAX_PATH
mov @stFile.Flags,OFN_FILEMUSTEXIST or OFN_PATHMUSTEXIST
invoke GetOpenFileName,addr @stFile
.if eax ;getopenfilename打开成功的话返回非0值
;invoke MessageBox,NULL,addr szPath,addr szPath,MB_OK
invoke SetDlgItemText,hMain,IDC_EDIT7,addr szPath
invoke GetDlgItem,hMain,IDC_BUTTON1
invoke EnableWindow,eax,TRUE
invoke GetDlgItem,hMain,IDC_BUTTON2
invoke EnableWindow,eax,TRUE
;.else
; invoke MessageBox,NULL,CTXT("aa"),CTXT("aa"),0
.endif
ret
_OpenFile endp
;***********************打开文件***********************
;***********************映射文件***********************
_CreateFileMap proc
invoke CreateFile,addr szPath,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL
.if eax==INVALID_HANDLE_VALUE
invoke MessageBox,NULL,CTXT("打开文件出错!"),CTXT("Erorr"),NULL
ret
.endif
mov hFile,eax
invoke CreateFileMapping,hFile,NULL,PAGE_READONLY,0,0,NULL
.if !eax
invoke CloseHandle,hFile
invoke MessageBox,NULL,CTXT("映射文件出错!"),CTXT("Erorr"),NULL
ret
.endif
mov hMapFile,eax
invoke MapViewOfFile,hMapFile,FILE_MAP_READ,NULL,NULL,NULL
.if !eax
invoke CloseHandle,hMapFile
invoke CloseHandle,hFile
invoke MessageBox,NULL,CTXT("映射到内存出错!"),CTXT("Erorr"),NULL
ret
.endif
mov lPMemory,eax
ret
_CreateFileMap endp
;***********************映射文件***********************
;***********************PE CHECK***********************
_PeInfo proc uses esi edi ebx
mov esi,lPMemory
assume esi:ptr IMAGE_DOS_HEADER
.if [esi].e_magic==IMAGE_DOS_SIGNATURE
add esi,[esi].e_lfanew
assume esi:ptr IMAGE_NT_HEADERS
.if [esi].Signature==IMAGE_NT_SIGNATURE
;invoke MessageBox,NULL,CTXT("是一个PE文件!"),CTXT("OK"),NULL
; call _ShowPeInfo
;**************************************************************************
movzx eax,[esi].FileHeader.NumberOfSections
invoke SetDlgItemInt,hMain,IDC_EDIT6,eax,FALSE
mov eax,[esi].OptionalHeader.ImageBase
invoke wsprintf,addr szTemBuffer,addr szFmatTxt,eax
invoke SetDlgItemText,hMain,IDC_EDIT1,addr szTemBuffer
;invoke SetDlgItemInt,hMain,IDC_EDIT1,eax,FALSE
mov eax,[esi].OptionalHeader.AddressOfEntryPoint
;invoke SetDlgItemInt,hMain,IDC_EDIT2,eax,FALSE
invoke wsprintf,addr szTemBuffer,addr szFmatTxt,eax
invoke SetDlgItemText,hMain,IDC_EDIT2,addr szTemBuffer
mov eax,[esi].OptionalHeader.FileAlignment
;invoke SetDlgItemInt,hMain,IDC_EDIT3,eax,FALSE
invoke wsprintf,addr szTemBuffer,addr szFmatTxt,eax
invoke SetDlgItemText,hMain,IDC_EDIT3,addr szTemBuffer
mov eax,[esi].OptionalHeader.SectionAlignment
;invoke SetDlgItemInt,hMain,IDC_EDIT4,eax,FALSE
invoke wsprintf,addr szTemBuffer,addr szFmatTxt,eax
invoke SetDlgItemText,hMain,IDC_EDIT4,addr szTemBuffer
mov eax,[esi].OptionalHeader.SizeOfImage
;invoke SetDlgItemInt,hMain,IDC_EDIT4,eax,FALSE
invoke wsprintf,addr szTemBuffer,addr szFmatTxt,eax
invoke SetDlgItemText,hMain,IDC_EDIT5,addr szTemBuffer
;**************************************************************************
; ret
.else
invoke MessageBox,NULL,CTXT("不是有效PE文件"),CTXT("ERROR"),0
;call @F
.endif
.else
invoke MessageBox,NULL,CTXT("不是有效PE文件"),CTXT("ERROR"),0
;call @F
.endif
@@: invoke UnmapViewOfFile,lPMemory
invoke CloseHandle,hMapFile
invoke CloseHandle,hFile
ret
_PeInfo endp
;***********************PE CHECK***********************
;***********************PE SHOW***********************
_ShowPeInfo proc
ret
_ShowPeInfo endp
;***********************PE SHOW***********************
;;对话框回调过程
_DlgProc proc uses esi edi ebx hDlg,uMsg,wParam,lParam
.if uMsg==WM_INITDIALOG ;对话框初始化
push hDlg
pop hMain
invoke LoadIcon,hInstance,IDR_MAINFRAME
invoke SendMessage,hDlg,WM_SETICON,ICON_BIG,eax
;灰化Button
invoke GetDlgItem,hDlg,IDC_BUTTON1
invoke EnableWindow,eax,FALSE
invoke GetDlgItem,hDlg,IDC_BUTTON2
invoke EnableWindow,eax,FALSE
.elseif uMsg==WM_COMMAND
mov eax,wParam
.if ax==IDC_BUTTON1 ;ReadFile
;invoke EndDialog,hDlg,TRUE
call _CreateFileMap
call _PeInfo
.elseif ax==IDC_BUTTON2
.elseif ax==IDC_BUTTON3 ;OpenFile
call _OpenFile
.endif
.elseif uMsg==WM_CLOSE
invoke EndDialog,hDlg,FALSE
.else
mov eax,FALSE
ret
.endif
mov eax,TRUE
ret
_DlgProc endp
;;对话框回调过程
start:
invoke GetModuleHandle,NULL
mov hInstance,eax
invoke DialogBoxParam,hInstance,IDD_TEST_DIALOG,NULL,addr _DlgProc,NULL
invoke ExitProcess,NULL
end start
程序代码：
#include "resource.h"
#define IDD_TEST_DIALOG 102
#define IDR_MAINFRAME 128
#define IDD_DIALOG1 129
#define IDC_BUTTON1 1000
#define IDC_BUTTON2 1001
#define IDC_EDIT1 1003
#define IDC_EDIT7 1004
#define IDC_EDIT2 1005
#define IDC_EDIT3 1006
#define IDC_EDIT4 1007
#define IDC_EDIT5 1008
#define IDC_EDIT6 1009
#define IDC_BUTTON3 1010
#define IDC_LIST2 1012
IDR_MAINFRAME ICON DISCARDABLE "test.ico"
IDD_TEST_DIALOG DIALOGEX 0, 0, 230, 177
STYLE DS_MODALFRAME | DS_CENTER | WS_MINIMIZEBOX | WS_POPUP | WS_VISIBLE |
WS_CAPTION | WS_SYSMENU
EXSTYLE WS_EX_APPWINDOW
CAPTION "32ASM - PE AND 界面"
FONT 9, "宋体"
BEGIN
PUSHBUTTON "ReadFile",IDC_BUTTON1,47,146,50,17
PUSHBUTTON "ImportTable",IDC_BUTTON2,116,145,54,17
LTEXT "ImageBase：",IDC_STATIC,52,15,45,8
LTEXT "File Alignment：",IDC_STATIC,32,47,65,8
LTEXT "EntryPoint：",IDC_STATIC,48,31,49,8
LTEXT "Sections Alignment：",IDC_STATIC,15,64,81,8
LTEXT "SizeOfImage：",IDC_STATIC,44,79,65,8
LTEXT "Number of sections：",IDC_STATIC,15,94,81,8
EDITTEXT IDC_EDIT1,97,12,105,12,ES_AUTOHSCROLL
EDITTEXT IDC_EDIT2,97,28,105,12,ES_AUTOHSCROLL
EDITTEXT IDC_EDIT3,97,44,105,12,ES_AUTOHSCROLL
EDITTEXT IDC_EDIT4,97,61,105,12,ES_AUTOHSCROLL
EDITTEXT IDC_EDIT5,97,77,105,12,ES_AUTOHSCROLL
EDITTEXT IDC_EDIT6,97,93,105,12,ES_AUTOHSCROLL
EDITTEXT IDC_EDIT7,17,121,136,14,ES_AUTOHSCROLL
PUSHBUTTON "Open File",IDC_BUTTON3,163,119,47,16
END
IDD_DIALOG1 DIALOG DISCARDABLE 0, 0, 227, 156
STYLE DS_MODALFRAME | WS_POPUP | WS_CAPTION | WS_SYSMENU
CAPTION "PE"
FONT 10, "System"
BEGIN
END
