PE的意思就是Portable Executable(可移植、可执行)

PE文件结构图:
这里写图片描述

PS:现在大多数PE文件都是加壳或者经过处理的,此程序只适用于最原始的PE文件

关于PE文件的解析问题,可以参考我的另一篇博文《用Winhex软件解析PE文件》

#include <stdio.h>
#include <stdlib.h>
#include <Windows.h>


//函数计算导出/导入表相对内存的偏移量
DWORD RVA2Offset(PIMAGE_NT_HEADERS pNTHeader, DWORD dwExpotRVA)
{
    PIMAGE_SECTION_HEADER pSection = (PIMAGE_SECTION_HEADER)((DWORD)pNTHeader + sizeof(IMAGE_NT_HEADERS));

    for(int i = 0; i < pNTHeader->FileHeader.NumberOfSections; i++)
    {
        if(dwExpotRVA >= pSection[i].VirtualAddress && dwExpotRVA < (pSection[i].VirtualAddress + pSection[i].SizeOfRawData))
        {
            return pSection[i].PointerToRawData + (dwExpotRVA - pSection[i].VirtualAddress);
        }
    }

    return 0;
}


int main(int argc, char* argv[])
{
    char szExePath[MAX_PATH]; //声明文件名
    //"C:\\Program Files (x86)\\Application Verifier\\vrfauto.dll"
    printf("Please input the execution file path:\n");
    scanf("%s",szExePath);
    HANDLE hFile = CreateFile(szExePath, GENERIC_ALL, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL); //获得PE文件句柄
    HANDLE hMapping = CreateFileMapping(hFile, NULL, PAGE_READWRITE, 0, 0, NULL); //创建一个新的文件映射内核对象
    //将一个文件映射对象映射到内存,得到指向映射到内存的第一个字节的指针pbFile
    PVOID pbFile = MapViewOfFile(hMapping, FILE_MAP_ALL_ACCESS, 0, 0, 0);

    if(INVALID_HANDLE_VALUE == hFile || NULL == hMapping || NULL == pbFile)
    {
        printf("\n\t---------- The File Inexistence! ----------\n");
        if(NULL != pbFile)
        {
            UnmapViewOfFile(pbFile);
        }

        if(NULL != hMapping)
        {
          CloseHandle(hMapping);
        }

        if (INVALID_HANDLE_VALUE != hFile)
        {
            CloseHandle(hFile);
         }

        return 0;
    }
    printf("<------------------------PE Header----------------------->\n");
    PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)pbFile;//pDosHeader指向DOS头起始位置
    printf("PE Header e_lfanew:0x%x\n",pDosHeader->e_lfanew);
    PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pbFile + pDosHeader->e_lfanew);//计算PE头位置

    if(0x00004550 != pNTHeader->Signature)
    {
        printf("\n\t---------- Lawless PE File! ----------\n");
        if(NULL != pbFile)
        {
            UnmapViewOfFile(pbFile);
        }

        if(NULL != hMapping)
        {
           CloseHandle(hMapping);
        }

        if (INVALID_HANDLE_VALUE != hFile)
        {
            CloseHandle(hFile);
         }

        return 0;
    }
    printf("<----------------------FileHeader---------------------->\n");
    WORD wNumberOfSections = (WORD)pNTHeader->FileHeader.NumberOfSections;//找到存放节数的项,并打印
    printf("NumberOfSections: %d\n",wNumberOfSections);

    WORD wSizeOfOptionalHeader= (WORD)pNTHeader->FileHeader.SizeOfOptionalHeader;//找到可选头长度,并打印
    printf("SizeOfOptionalHeader: %d\n",wSizeOfOptionalHeader);

    //可选映像头
    printf("<--------------------Optional Header-------------------->\n");
    DWORD dwSizeOfCode = (DWORD)pNTHeader->OptionalHeader.SizeOfCode;
    printf("SizeOfCode: 0x%08X\n",dwSizeOfCode);

    DWORD dwAddressOfEntryPoint = (DWORD)pNTHeader->OptionalHeader.AddressOfEntryPoint;
    printf("AddressOfEntryPoint: 0x%08X\n",dwAddressOfEntryPoint);

    DWORD dwImageBase = (DWORD)pNTHeader->OptionalHeader.ImageBase;
    printf("ImageBase: 0x%08X\n",dwImageBase);

    DWORD dwSectionAlignment = (DWORD)pNTHeader->OptionalHeader.SectionAlignment;
    printf("SectionAlignment: 0x%08X\n",dwSectionAlignment);

    DWORD dwFileAlignment = (DWORD)pNTHeader->OptionalHeader.FileAlignment;
    printf("FileAlignment: 0x%08X\n",dwFileAlignment);

    DWORD dwSizeOfImage = (DWORD)pNTHeader->OptionalHeader.SizeOfImage;
    printf("SizeOfImage: 0x%08X\n",dwSizeOfImage);

    DWORD dwNumberOfRvaAndSize = (DWORD)pNTHeader->OptionalHeader.NumberOfRvaAndSizes;
    printf("NumberOfRvaAndSizes: 0x%08X\n",dwNumberOfRvaAndSize);

    DWORD dwSectionHeaderOffset = (DWORD)pNTHeader+24+(DWORD)wSizeOfOptionalHeader;//计算节表的位置

    printf("<----------------------SectionTable---------------------->\n");
    int NumOfSec = 0;
    for(NumOfSec;NumOfSec<wNumberOfSections;NumOfSec++)
    {
        PIMAGE_SECTION_HEADER pSectionHeader = (PIMAGE_SECTION_HEADER)(dwSectionHeaderOffset + 40*NumOfSec);
        printf("%d 's Name):%s\n",NumOfSec+1,pSectionHeader->Name);
        DWORD dwVirtualAddress = (DWORD)pSectionHeader->VirtualAddress;
        printf("VirtualAddress: 0x%08X\n",dwVirtualAddress);
        DWORD dwSizeOfRawData = (DWORD)pSectionHeader->SizeOfRawData;
        printf("SizeOfRawData: 0x%08X\n",dwSizeOfRawData);
        DWORD dwPointerToRawData = (DWORD)pSectionHeader->PointerToRawData;
        printf("PointerToRawData: 0x%08X\n",dwPointerToRawData);
    }

    printf("<--------------------Export Table-------------------->\n");

    DWORD dwExportOffset = RVA2Offset(pNTHeader, pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
    PIMAGE_EXPORT_DIRECTORY pExport = (PIMAGE_EXPORT_DIRECTORY)((DWORD)pbFile + dwExportOffset);
    DWORD dwFunctionNameOffset = (DWORD)pbFile + RVA2Offset(pNTHeader, pExport->Name);
    DWORD* pdwNamesAddress = (DWORD*)((DWORD)pbFile + RVA2Offset(pNTHeader, pExport->AddressOfNames));
    DWORD* pdwFunctionAddress = (DWORD*)((DWORD)pbFile + RVA2Offset(pNTHeader, pExport->AddressOfFunctions));
    WORD* pwOrdinals = (WORD*)((DWORD)pbFile + RVA2Offset(pNTHeader, pExport->AddressOfNameOrdinals));

    printf("AddressOfNameOrdinals: 0x%08X\n",RVA2Offset(pNTHeader, pExport->AddressOfNameOrdinals));
    printf("AddressOfFunctions: 0x%08X\n",RVA2Offset(pNTHeader, pExport->AddressOfFunctions));
    printf("AddressOfNames: 0x%08X\n",RVA2Offset(pNTHeader, pExport->AddressOfNames));
    if(0 == pExport->NumberOfFunctions)
    {
        printf("\n\t---------- No Export Tabel! ----------\n");
        if(NULL != pbFile)
        {
            UnmapViewOfFile(pbFile);
        }

        if(NULL != hMapping)
        {
          CloseHandle(hMapping);
        }

        if (INVALID_HANDLE_VALUE != hFile)
        {
            CloseHandle(hFile);
         }

        return 0;
    }

    printf("FileName: %s\n", dwFunctionNameOffset);
    printf("NumberOfFunctions: %d\n", pExport->NumberOfFunctions);
    printf("NumberOfNames: %d\n\n", pExport->NumberOfNames);
    printf("============NameExport:\n\n");

    int IsFound[1000]={0};
    int k;
    for(k=0;k<pExport->NumberOfFunctions;k++)
    {
        IsFound[k]=0;
        //printf("%d ",IsFound[k]);
    }
    int i;
    for(i = 0; i < pExport->NumberOfNames; i++)
    {
        DWORD dwFunctionAddress = pdwFunctionAddress[pwOrdinals[i]];
        DWORD pdwFunNameOffset = (DWORD)pbFile + RVA2Offset(pNTHeader, pdwNamesAddress[i]);
        IsFound[pwOrdinals[i]]=1;
        printf("[ExportNum]: %-4d  [Name]: %-30s [RVA]: 0x%08X\n", pExport->Base + pwOrdinals[i], pdwFunNameOffset,dwFunctionAddress);
    }

    printf("\n============NumberExport:\n");

    int m;
    for(m = 0; m < pExport->NumberOfFunctions; m++)
    {
        if(IsFound[m]!=1)
        {
            DWORD dwFunctionAddress = pdwFunctionAddress[m];
            printf("[ExportNum]: %-4d [RVA]: 0x%08X\n", pExport->Base + m, dwFunctionAddress);
        }
    }

    printf("\n");

    printf("<--------------------Inport Table-------------------->\n");
    int cont = 0;
    do{
        DWORD dwInportOffset = RVA2Offset(pNTHeader, pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
        dwInportOffset = dwInportOffset + cont;
        PIMAGE_IMPORT_DESCRIPTOR  pInport = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD)pbFile + dwInportOffset);
        if(pInport->OriginalFirstThunk == 0&& pInport->TimeDateStamp == 0&& pInport->ForwarderChain== 0 && pInport->Name== 0 && pInport->FirstThunk== 0 )
            break;
        DWORD dwOriginalFirstThunk = (DWORD)pbFile + RVA2Offset(pNTHeader, pInport->OriginalFirstThunk);//VA to IAT
        DWORD dwFirstThunk = (DWORD)pbFile + RVA2Offset(pNTHeader, pInport->FirstThunk);//VA to IAT
        DWORD dwName = (DWORD)pbFile + RVA2Offset(pNTHeader, pInport->Name);
        printf("\n---------Inport File Name: %s\n\n",dwName);

        if(dwOriginalFirstThunk == 0x00000000)
        {
            dwOriginalFirstThunk = dwFirstThunk;
        }
        DWORD* pdwTrunkData= (DWORD*)dwOriginalFirstThunk;
        int n=0,x=0;
        while(pdwTrunkData[n] != 0)
        {
            DWORD TrunkData = pdwTrunkData[n];
            if(TrunkData < IMAGE_ORDINAL_FLAG32)//名字导入
            {
                PIMAGE_IMPORT_BY_NAME pInportByName = (PIMAGE_IMPORT_BY_NAME)((DWORD)pbFile + RVA2Offset(pNTHeader, TrunkData));
                printf("-----------InportByName: %s\n",pInportByName->Name);
            }
            else//序号导入
            {
                DWORD FunNumber = (DWORD)(TrunkData - IMAGE_ORDINAL_FLAG32);
                printf("-----------InportByNumber: %-4d ",FunNumber);
            }
            if(x != 0 && x%3==0) printf("\n");
            n++;
            x++;
        }
        cont=cont+40;
    }while(true);
    if(NULL != pbFile)
    {
        UnmapViewOfFile(pbFile);
    }

    if(NULL != hMapping)
    {
        CloseHandle(hMapping);
    }

    if (INVALID_HANDLE_VALUE != hFile)
    {
        CloseHandle(hFile);
    }
    return 0;
}

运行结果:

这里写图片描述

这里写图片描述

导出表部分:

这里写图片描述

中间省略

这里写图片描述

导入表部分:

这里写图片描述

这里写图片描述

中间省略

这里写图片描述