静水流深

程序公司程序间，程序间里程序员，程序人员写程序，写得程序换酒钱！
博客园 首页 新随笔 联系 订阅 管理
  3 Posts :: 0 Stories :: 0 Comments :: 0 Trackbacks

公告

2008年4月8日 #

查看PE文件重定位表

#include "stdafx.h"
#include <Windows.h>


DWORD RVA2Offset(PIMAGE_NT_HEADERS pNTHeader, DWORD dwRVA)
{
    PIMAGE_SECTION_HEADER pSection = (PIMAGE_SECTION_HEADER)((DWORD)pNTHeader + sizeof(IMAGE_NT_HEADERS));

    for(int i = 0; i < pNTHeader->FileHeader.NumberOfSections; i++)
    {
        if(dwRVA >= pSection[i].VirtualAddress && dwRVA < (pSection[i].VirtualAddress + pSection[i].SizeOfRawData))
        {
            return pSection[i].PointerToRawData + (dwRVA - pSection[i].VirtualAddress);
        }
    }

    return 0;
}


int _tmain(int argc, _TCHAR* argv[])
{
    HANDLE hFile = CreateFile(argv[1], GENERIC_ALL, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL);
    HANDLE hMapping = CreateFileMapping(hFile, NULL, PAGE_READWRITE, 0, 0, NULL);
    PVOID pbFile = MapViewOfFile(hMapping, FILE_MAP_ALL_ACCESS, 0, 0, 0);

    if(INVALID_HANDLE_VALUE == hFile || NULL == hMapping || NULL == pbFile)
    {
        printf("\n\t---------- The File Inexistence! ----------\n");
        goto EXIT;
    }

    PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)pbFile;
    PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pbFile + pDosHeader->e_lfanew);

    if(0x00004550 != pNTHeader->Signature)
    {
        printf("\n\t---------- Lawless PE File! ----------\n");
        goto EXIT;
    }

    DWORD dwRelocOffset = RVA2Offset(pNTHeader, pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress);
    PIMAGE_BASE_RELOCATION pReloc = (PIMAGE_BASE_RELOCATION)((DWORD)pbFile + dwRelocOffset);

    if(0 == pReloc->VirtualAddress)
    {
        printf("\n\t---------- No Relocation Table! ----------\n");
        goto EXIT;
    }

    while(pReloc->VirtualAddress)
    {
        printf("[0x%08X]\n\n", pReloc->VirtualAddress);

        for(int i = 0; i < (pReloc->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / 2; i++)
        {
            printf("   <%04d> - 0x%08X\n", i, pReloc->VirtualAddress + ((*(WORD*)((DWORD)pReloc + sizeof(IMAGE_BASE_RELOCATION) + i * 2)) & 0x0FFF));
        }

        printf("\n");

        pReloc = (PIMAGE_BASE_RELOCATION)((DWORD)pReloc + pReloc->SizeOfBlock);
    }

EXIT:
    if(NULL != pbFile)
    {
        UnmapViewOfFile(pbFile);
    }

    if(NULL != hMapping)
    {
        CloseHandle(hMapping);
    }

    if (INVALID_HANDLE_VALUE != hFile)
    {
        CloseHandle(hFile);
    }

    return 0;
}

posted @ 2008-04-08 09:49 Ampere 阅读(868) 评论(0) 编辑

2008年4月5日 #

查看PE文件导出表

#include "stdafx.h"
#include <Windows.h>


DWORD RVA2Offset(PIMAGE_NT_HEADERS pNTHeader, DWORD dwRVA)
{
    PIMAGE_SECTION_HEADER pSection = (PIMAGE_SECTION_HEADER)((DWORD)pNTHeader + sizeof(IMAGE_NT_HEADERS));

    for(int i = 0; i < pNTHeader->FileHeader.NumberOfSections; i++)
    {
        if(dwRVA >= pSection[i].VirtualAddress && dwRVA < (pSection[i].VirtualAddress + pSection[i].SizeOfRawData))
        {
            return pSection[i].PointerToRawData + (dwRVA - pSection[i].VirtualAddress);
        }
    }

    return 0;
}


int _tmain(int argc, _TCHAR* argv[])
{
    HANDLE hFile = CreateFile(argv[1], GENERIC_ALL, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL);
    HANDLE hMapping = CreateFileMapping(hFile, NULL, PAGE_READWRITE, 0, 0, NULL);
    PVOID pbFile = MapViewOfFile(hMapping, FILE_MAP_ALL_ACCESS, 0, 0, 0);

    if(INVALID_HANDLE_VALUE == hFile || NULL == hMapping || NULL == pbFile)
    {
        printf("\n\t---------- The File Inexistence! ----------\n");
        goto EXIT;
    }

    PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)pbFile;
    PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pbFile + pDosHeader->e_lfanew);

    if(0x00004550 != pNTHeader->Signature)
    {
        printf("\n\t---------- Lawless PE File! ----------\n");
        goto EXIT;
    }

    DWORD dwExportOffset = RVA2Offset(pNTHeader, pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
    PIMAGE_EXPORT_DIRECTORY pExport = (PIMAGE_EXPORT_DIRECTORY)((DWORD)pbFile + dwExportOffset);
    DWORD dwFunctionNameOffset = (DWORD)pbFile + RVA2Offset(pNTHeader, pExport->Name);
    DWORD* pdwNamesAddress = (DWORD*)((DWORD)pbFile + RVA2Offset(pNTHeader, pExport->AddressOfNames));
    DWORD* pdwFunctionAddress = (DWORD*)((DWORD)pbFile + RVA2Offset(pNTHeader, pExport->AddressOfFunctions));
    WORD* pwOrdinals = (WORD*)((DWORD)pbFile + RVA2Offset(pNTHeader, pExport->AddressOfNameOrdinals));
 
    if(0 == pExport->NumberOfFunctions)
    {
        printf("\n\t---------- No Export Tabel! ----------\n");
        goto EXIT;
    }
   
    printf("FileName: %s\n", dwFunctionNameOffset);
    printf("NumberOfFunctions: %d\n", pExport->NumberOfFunctions);
    printf("NumberOfNames: %d\n\n", pExport->NumberOfNames);
    printf("NameExport:\n\n");

    for(int i = 0; i < pExport->NumberOfNames; i++)
    {
        DWORD dwFunctionAddress = pdwFunctionAddress[pwOrdinals[i]];
        DWORD pdwFunNameOffset = (DWORD)pbFile + RVA2Offset(pNTHeader, pdwNamesAddress[i]);

        printf("[ExportNum]: %-4d  [Name]: %-30s  [RVA]: 0x%08X\n", pExport->Base + i, pdwFunNameOffset, dwFunctionAddress);
    }

    printf("\nNumberExport:\n\n");

    for(int i = 0; i < pExport->NumberOfFunctions - pExport->NumberOfNames; i++)
    {
        printf("[ExportNum]: %-4d  [RVA]: 0x%08X\n", pExport->Base + i, pdwFunctionAddress[i]);
    }

    printf("\n");

EXIT:
    if(NULL != pbFile)
    {
        UnmapViewOfFile(pbFile);
    }

    if(NULL != hMapping)
    {
        CloseHandle(hMapping);
    }

    if (INVALID_HANDLE_VALUE != hFile)
    {
        CloseHandle(hFile);
    }

    return 0;
}
posted @ 2008-04-05 21:37 Ampere 阅读(727) 评论(0) 编辑

2008年3月27日 #

查看PE文件导入表
这个博客空间主席帮申请下来快一年了，都快忘了。最近一直在学习PE文件，贴段代码，功能如题，自己学习写的练习程序，VC2005编译，控制台程序，有很多不严谨和不完善的地方！

#include "stdafx.h"
#include <Windows.h>

DWORD RVA2Offset(PIMAGE_NT_HEADERS pNTHeader, DWORD dwRVA)
{
    PIMAGE_SECTION_HEADER pSection = (PIMAGE_SECTION_HEADER)((DWORD)pNTHeader + sizeof(IMAGE_NT_HEADERS));

    for(int i = 0; i < pNTHeader->FileHeader.NumberOfSections; i++)
    {
        if(dwRVA >= pSection[i].VirtualAddress && dwRVA < (pSection[i].VirtualAddress + pSection[i].SizeOfRawData))
        {
            return pSection[i].PointerToRawData + (dwRVA - pSection[i].VirtualAddress);
        }
    }

    return 0;
}


int _tmain(int argc, _TCHAR* argv[])
{
    HANDLE hFile = CreateFile(argv[1], GENERIC_ALL, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL);
    HANDLE hMapping = CreateFileMapping(hFile, NULL, PAGE_READWRITE, 0, 0, NULL);
    PVOID pbFile = MapViewOfFile(hMapping, FILE_MAP_ALL_ACCESS, 0, 0, 0);

    if(INVALID_HANDLE_VALUE == hFile || NULL == hMapping || NULL == pbFile)
    {
        printf("\n\t---------- The File Inexistence! ----------\n");
        goto EXIT;
    }

    PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)pbFile;
    PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pbFile + pDosHeader->e_lfanew);

    if(0x00004550 != pNTHeader->Signature)
    {
        printf("\n\t---------- Lawless PE File! ----------\n");
        goto EXIT;
    }

    DWORD dwImportOffset = RVA2Offset(pNTHeader, pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
    PIMAGE_IMPORT_DESCRIPTOR pImport = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD)pbFile + dwImportOffset);

    DWORD dwOriginalThunkOffset = 0;
    DWORD dwThunkData = 0;
    PIMAGE_IMPORT_BY_NAME pImageFunName = NULL;
    PIMAGE_THUNK_DATA pThunkData = NULL;

    for(int i = 0; i < pNTHeader->OptionalHeader.DataDirectory[1].Size / sizeof(IMAGE_IMPORT_DESCRIPTOR) - 1; i++)
    {
        printf("[DLL Name]: %s\n\n", ((DWORD)pbFile + RVA2Offset(pNTHeader, pImport[i].Name)));

        pThunkData = (PIMAGE_THUNK_DATA)((DWORD)pbFile + RVA2Offset(pNTHeader, pImport[i].FirstThunk));

        for(int j = 0; pThunkData[j].u1.Ordinal != 0; j++)
        {
            if(pThunkData[j].u1.Ordinal & IMAGE_ORDINAL_FLAG32)
            {
                printf("    [%03d]  ---  Number: %04d    Name: <NULL>\n", j + 1, pThunkData[j].u1.Ordinal & 0xFFFF);
            }
            else
            {
                pImageFunName = (PIMAGE_IMPORT_BY_NAME)((DWORD)pbFile + RVA2Offset(pNTHeader, pThunkData[j].u1.AddressOfData));
                printf("    [%03d]  ---  Number: %04d    Name: %s\n", j + 1, pImageFunName->Hint, pImageFunName->Name);
            }
        }

        printf("\n");
    }

EXIT:
    if(NULL != pbFile)
    {
        UnmapViewOfFile(pbFile);
    }

    if(NULL != hMapping)
    {
        CloseHandle(hMapping);
    }

    if (INVALID_HANDLE_VALUE != hFile)
    {
        CloseHandle(hFile);
    }

    return 0;
} 
posted @ 2008-03-27 21:44 Ampere 阅读(580) 评论(0) 编辑

仅列出标题