• PE文件格式分析


    void pe_print()
    {
        IMAGE_DOS_HEADER myDosHeader;
        IMAGE_FILE_HEADER myFileHeader;
        int nSectionCount;//PE文件ection数目
        LONG e_lfanew;//为DOS头部的偏移
        FILE *fp;
        if(fp=fopen("e:\1000.exe","rb"))  //打开一个文件
            {
            printf("[+]成功打开了文件 ");
            fread(&myDosHeader,sizeof(IMAGE_DOS_HEADER),1,fp);  //打开一个文件流,读取一个数据块
            e_lfanew = myDosHeader.e_lfanew;  //为DOS头部的偏移
            fseek(fp, (e_lfanew + sizeof(DWORD)), SEEK_SET);
            fread(&myFileHeader,sizeof(IMAGE_FILE_HEADER),1,fp);
            nSectionCount=myFileHeader.NumberOfSections;
            IMAGE_SECTION_HEADER *pmySectionHeader = (IMAGE_SECTION_HEADER *)calloc(nSectionCount, sizeof(IMAGE_SECTION_HEADER));
            fseek(fp, (e_lfanew + sizeof(IMAGE_NT_HEADERS)), SEEK_SET); //从文件起始位置偏移
            fread(pmySectionHeader, sizeof(IMAGE_SECTION_HEADER), nSectionCount, fp);
            int i = 0;
            //printf("%d",nSectionCount);
            for(i = 0; i <nSectionCount; i++,pmySectionHeader++)
                {
                printf("Name: %s ", pmySectionHeader->Name);
                printf("union_PhysicalAddress: %08x ", pmySectionHeader->Misc.PhysicalAddress);
                printf("union_VirtualSize: %04x ", pmySectionHeader->Misc.VirtualSize);
                printf("VirtualAddress: %08x ", pmySectionHeader->VirtualAddress);
                printf("SizeOfRawData: %08x ", pmySectionHeader->SizeOfRawData);
                printf("PointerToRawData: %04x ", pmySectionHeader->PointerToRawData);
                printf("PointerToRelocations: %04x ", pmySectionHeader->PointerToRelocations);
                printf("PointerToLinenumbers: %04x ", pmySectionHeader->PointerToLinenumbers);
                printf("NumberOfRelocations: %04x ", pmySectionHeader->NumberOfRelocations);
                printf("NumberOfLinenumbers: %04x ", pmySectionHeader->NumberOfLinenumbers);
                printf("Charateristics: %04x ", pmySectionHeader->Characteristics);
                }
            if(pmySectionHeader != NULL)          // 释放内存
                {
                free(pmySectionHeader);
                pmySectionHeader = NULL;
                }
            fclose(fp);
            }
        else printf("[-]打开文件失败 ");
    }

    C语言实现打印section信息

  • 相关阅读:
    学校的SQLServer的笔记
    Javaの集合学习
    XML的学习
    Java中学校没学过的东西
    MySQL的学习
    牛顿法及其收敛性
    c++编码规范
    C++标准库
    MATLAB编程技巧
    Matlab学习记录(函数)
  • 原文地址:https://www.cnblogs.com/wj2ge/p/6505042.html
Copyright © 2020-2023  润新知