WindowsPE权威指南 第二章 小工具 pedump代码的C语言实现

2016-11-16 16:29:07

主程序代码 pedump.c

#include <windows.h>
#include <Richedit.h>
#include "resource.h"


HINSTANCE hInstance;

DWORD dwStop;
HWND hWinEdit;    //富文本框句柄


/*
初始化窗口程序
*/
void _Init(HWND hWinMain)
{
    HICON hIcon;
    CHARFORMAT stCf;
    TCHAR szFont[] = TEXT("宋体");


    hWinEdit = GetDlgItem(hWinMain, IDC_INFO);
    hIcon = LoadIcon(hInstance, MAKEINTRESOURCE(ICO_MAIN));
    SendMessage(hWinMain, WM_SETICON, ICON_BIG, (LPARAM)hIcon);//为窗口设置图标
    SendMessage(hWinEdit, EM_SETTEXTMODE, TM_PLAINTEXT, 0);//设置编辑控件

    RtlZeroMemory(&stCf, sizeof(stCf));
    stCf.cbSize = sizeof(stCf);
    stCf.yHeight = 10 * 20;
    stCf.dwMask = CFM_FACE | CFM_SIZE | CFM_BOLD;
    lstrcpy(stCf.szFaceName, szFont);
    SendMessage(hWinEdit, EM_SETCHARFORMAT, 0, (LPARAM)&stCf);
    SendMessage(hWinEdit, EM_EXLIMITTEXT, 0, -1);
}


/*
往文本框中追加文本
*/
void _appendInfo(TCHAR * _lpsz)
{
    CHARRANGE stCR;

    stCR.cpMin = GetWindowTextLength(hWinEdit);
    stCR.cpMax = GetWindowTextLength(hWinEdit);
    SendMessage(hWinEdit, EM_EXSETSEL, 0, (LPARAM)&stCR); //将插入点移动到最后
    SendMessage(hWinEdit, EM_REPLACESEL, FALSE, (LPARAM)_lpsz);
}



/*
打开PE文件并处理
*/
void _openFile(HWND hWinMain)
{
    OPENFILENAME stOF;
    HANDLE hFile, hMapFile;
    DWORD totalSize;        //文件大小
    LPVOID lpMemory;        //内存映像文件在内存的起始位置

    TCHAR szFileName[MAX_PATH] = {0};    //要打开的文件路径及名称名
    TCHAR bufTemp1[10];                    //每个字符的十六进制字节码
    TCHAR bufTemp2[20];                    //第一列
    TCHAR lpServicesBuffer[100];        //一行的所有内容
    TCHAR bufDisplay[50];                //第三列ASCII码字符
    DWORD dwCount;                        //计数，逢16则重新计
    DWORD dwCount1;                        //地址顺号
    DWORD dwBlanks;                        //最后一行空格数

    TCHAR szExtPe[] = TEXT("PE Files\0*.exe;*.dll;*.scr;*.fon;*.drv\0All Files(*.*)\0*.*\0\0"); 
    

    RtlZeroMemory(&stOF, sizeof(stOF));
    stOF.lStructSize = sizeof(stOF);
    stOF.hwndOwner = hWinMain;
    stOF.lpstrFilter = szExtPe;
    stOF.lpstrFile = szFileName;
    stOF.nMaxFile = MAX_PATH;
    stOF.Flags = OFN_PATHMUSTEXIST | OFN_FILEMUSTEXIST;
    if (GetOpenFileName(&stOF))        //让用户选择打开的文件
    {
        hFile = CreateFile(szFileName, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE,
            NULL, OPEN_EXISTING, FILE_ATTRIBUTE_ARCHIVE, NULL);
        if (hFile != INVALID_HANDLE_VALUE)
        {
            totalSize = GetFileSize(hFile, NULL);//获取文件大小
            if (totalSize)
            {
                hMapFile = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);//内存映射文件
                if (hMapFile)
                {
                    lpMemory = MapViewOfFile(hMapFile, FILE_MAP_READ, 0, 0, 0);//获得文件在内存的映象起始位置
                    if (lpMemory)
                    {
                        //开始处理文件

                        //缓冲区初始化
                        RtlZeroMemory(bufTemp1, 10);
                        RtlZeroMemory(bufTemp2, 20);
                        RtlZeroMemory(lpServicesBuffer, 100);
                        RtlZeroMemory(bufDisplay, 50);

                        dwCount = 1;

                        //将第一列写入lpServicesBuffer
                        dwCount1 = 0;
                        wsprintf(bufTemp2, TEXT("%08x  "), dwCount1);
                        lstrcat(lpServicesBuffer, bufTemp2);
                    
                        dwBlanks = (16 - totalSize % 16) * 3;//求最后一行的空格数

                        while (TRUE)
                        {
                            if (totalSize == 0)//最后一行
                            {
                                while (dwBlanks)//填充空格
                                {
                                    lstrcat(lpServicesBuffer, TEXT(" "));
                                    --dwBlanks;
                                }
                            
                                lstrcat(lpServicesBuffer, TEXT("  "));//第二列与第三列中间的空格                            
                                lstrcat(lpServicesBuffer, bufDisplay);//第三列内容                            
                                lstrcat(lpServicesBuffer, TEXT("\n"));//回车换行符号
                                break;
                            }

                            //翻译成可以显示的ascii码字,写入第三列的值
                            if (*(TCHAR *)lpMemory > 0x20 && *(TCHAR *)lpMemory < 0x7e)
                            {
                                bufDisplay[dwCount-1] = *(TCHAR *)lpMemory;
                            }
                            else
                            {
                                bufDisplay[dwCount-1] = 0x2e;//如果不是ASCII码值，则显示“.”
                            }
                            
                            wsprintf(bufTemp1, TEXT("%02X "), *(TBYTE *)lpMemory);//字节的十六进制字符串到@bufTemp1中                            
                            lstrcat(lpServicesBuffer, bufTemp1);//将第二列写入lpServicesBuffer

                            if (dwCount == 16)//已到16个字节，
                            {
                                lstrcat(lpServicesBuffer, TEXT("  "));//第二列与第三列中间的空格
                                lstrcat(lpServicesBuffer, bufDisplay);//显示第三列字符 
                                lstrcat(lpServicesBuffer, TEXT("\n"));//回车换行

                                _appendInfo(lpServicesBuffer);//写入内容
                                RtlZeroMemory(lpServicesBuffer, 100);

                                if (dwStop == 1)
                                {
                                    break;
                                }

                                wsprintf(bufTemp2, TEXT("%08X  "), (++dwCount1) * 16); // 显示下一行的地址
                                lstrcat(lpServicesBuffer, bufTemp2);

                                dwCount = 0;
                                RtlZeroMemory(bufDisplay, 50);
                            }
                            --totalSize;
                            ++dwCount;
                            ++(TCHAR *)lpMemory;

                        }

                        _appendInfo(lpServicesBuffer); //添加最后一行
                        UnmapViewOfFile(lpMemory);
                    }
                    CloseHandle(hMapFile);
                }
            }
            CloseHandle(hFile);
        }
    }
}





/*
窗口程序
*/
INT_PTR CALLBACK _ProcDlgMain(HWND hWnd, UINT wMsg, WPARAM wParam, LPARAM lParam)
{
    switch (wMsg)
    {
    case WM_CLOSE:
        EndDialog(hWnd, 0);
        break;

    case WM_INITDIALOG:            //初始化
        _Init(hWnd);
        break;

    case WM_COMMAND:            //菜单
        switch (LOWORD(wParam))
        {
        case IDM_EXIT:            //退出
            EndDialog(hWnd, 0);
            break;

        case IDM_OPEN:            //打开文件
            dwStop = 0;
            CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)_openFile, hWnd, 0, NULL);
            break;
        
        case IDM_1:
            dwStop = 1;
            break;

        case IDM_2:
        case IDM_3:
        default:
            break;
        }
        break;

    default:
        return FALSE;
    }

    return TRUE;
}




int WINAPI WinMain(HINSTANCE hInst, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow)
{
    HMODULE hRichEdit;

    hInstance = hInst;
    hRichEdit = LoadLibrary(TEXT("RichEd20.dll"));
    DialogBoxParam(hInstance, MAKEINTRESOURCE(DLG_MAIN), NULL, _ProcDlgMain, (LPARAM)NULL);
    FreeLibrary(hRichEdit);
    return 0;
}

 

头文件 resource.h

//{{NO_DEPENDENCIES}}
// Microsoft Visual C++ 生成的包含文件。
// 供 Resource.rc 使用
//
#define ICO_MAIN                        101
#define DLG_MAIN                        102
#define IDM_MAIN                        103
#define IDC_INFO                        1001
#define IDM_OPEN                        40001
#define IDM_EXIT                        40002
#define IDM_1                           40003
#define IDM_2                           40004
#define IDM_3                           40005
#define IDM_4                           40006

// Next default values for new objects
// 
#ifdef APSTUDIO_INVOKED
#ifndef APSTUDIO_READONLY_SYMBOLS
#define _APS_NEXT_RESOURCE_VALUE        104
#define _APS_NEXT_COMMAND_VALUE         40007
#define _APS_NEXT_CONTROL_VALUE         1002
#define _APS_NEXT_SYMED_VALUE           101
#endif
#endif

 

资源文件 resource.rc

// Microsoft Visual C++ generated resource script.
//
#include "resource.h"

#define APSTUDIO_READONLY_SYMBOLS
/////////////////////////////////////////////////////////////////////////////
//
// Generated from the TEXTINCLUDE 2 resource.
//
#include "winres.h"

/////////////////////////////////////////////////////////////////////////////
#undef APSTUDIO_READONLY_SYMBOLS

/////////////////////////////////////////////////////////////////////////////
// 中文(简体，中国) resources

#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_CHS)
LANGUAGE LANG_CHINESE, SUBLANG_CHINESE_SIMPLIFIED

#ifdef APSTUDIO_INVOKED
/////////////////////////////////////////////////////////////////////////////
//
// TEXTINCLUDE
//

1 TEXTINCLUDE 
BEGIN
    "resource.h\0"
END

2 TEXTINCLUDE 
BEGIN
    "#include ""winres.h""\r\n"
    "\0"
END

3 TEXTINCLUDE 
BEGIN
    "\r\n"
    "\0"
END

#endif    // APSTUDIO_INVOKED


/////////////////////////////////////////////////////////////////////////////
//
// Icon
//

// Icon with lowest ID value placed first to ensure application icon
// remains consistent on all systems.
ICO_MAIN                ICON                    "main.ico"

/////////////////////////////////////////////////////////////////////////////
//
// Dialog
//

DLG_MAIN DIALOGEX 50, 50, 399, 399
STYLE DS_SETFONT | DS_MODALFRAME | WS_POPUP | WS_VISIBLE | WS_CAPTION | WS_SYSMENU
CAPTION "PEDump"
MENU IDM_MAIN
FONT 9, "宋体", 0, 0, 0x0
BEGIN
    CONTROL         "",IDC_INFO,"RichEdit20A",ES_MULTILINE | ES_AUTOVSCROLL | ES_AUTOHSCROLL | ES_READONLY | ES_WANTRETURN | WS_BORDER | WS_VSCROLL | WS_TABSTOP,0,0,395,394
END


/////////////////////////////////////////////////////////////////////////////
//
// DESIGNINFO
//

#ifdef APSTUDIO_INVOKED
GUIDELINES DESIGNINFO
BEGIN
    DLG_MAIN, DIALOG
    BEGIN
        RIGHTMARGIN, 395
        BOTTOMMARGIN, 394
    END
END
#endif    // APSTUDIO_INVOKED


/////////////////////////////////////////////////////////////////////////////
//
// Menu
//

IDM_MAIN MENU
BEGIN
    POPUP "文件(&F)"
    BEGIN
        MENUITEM "打开文件(&O)...",                 IDM_OPEN
        MENUITEM SEPARATOR
        MENUITEM "退出(&x)",                      IDM_EXIT
    END
    POPUP "编辑(&E)"
    BEGIN
        MENUITEM SEPARATOR
    END
    POPUP "格式(&O)"
    BEGIN
        MENUITEM SEPARATOR
    END
    POPUP "查看(&V)"
    BEGIN
        MENUITEM "停止Dump...",                   IDM_1
        MENUITEM "窗口透明度",                       IDM_2
        MENUITEM SEPARATOR
        MENUITEM "大小",                          IDM_3
        MENUITEM "宽度",                          IDM_4
    END
    POPUP "帮助(&H)"
    BEGIN
        MENUITEM SEPARATOR
    END
END

#endif    // 中文(简体，中国) resources
/////////////////////////////////////////////////////////////////////////////



#ifndef APSTUDIO_INVOKED
/////////////////////////////////////////////////////////////////////////////
//
// Generated from the TEXTINCLUDE 3 resource.
//


/////////////////////////////////////////////////////////////////////////////
#endif    // not APSTUDIO_INVOKED