IMAGE_DOS_HEADER MyDosHeader;
IMAGE_NT_HEADER MyNtHeader;
LONG e_lfanew;
WORD e_magic;
FILE *file;
file=fopen("c:\\Client.exe","r+b");
fread(&MyDosHeader,sizeof(IMAGE_DOS_HEADER),1,file);
e_magic=MyDosHeader.e_magic;
e_lfanew=MyDosHeader.e_lfanew;
if(e_magic!=IMAGE_DOS_SIGNATURE) //判断 ms-dos header
{
printf("Error\n");
fclose(file);
}
else
{
fseek(file,e_lfanew,SEEK_SET); // 从 pe 头开始读取
fread(&MyNtHeader,sizeof(IMAGE_NT_HEADERS),1,file);
Si=MyNtHeader.Signature;
if(Si==IMAGE_NT_SIGNATURE) //判断是否是pe文件
{
fseek(file,(e_lfanew + sizeof(DWORD) + sizeof(IMAGE_FILE_HEADER)),SEEK_SET);
fread(&MyOptional,sizeof(IMAGE_OPTIONAL_HEADER32),1,file);
printf("表的偏移量%08x\n",MyOptional.DataDirectory[0].VirtualAddress);
printf("表的大小%04x\n",MyOptional.DataDirectory[0].Size);
}
else
fclose(file);

为什么得不到 表的偏移量 ~