DOS版PE工具制作

// PE.cpp : 定义控制台应用程序的入口点。
//DOS版PE工具制作

#include "stdafx.h"
#include <windows.h>
#include <winnt.h>

int filelength(FILE *fp);
int _tmain(int argc, _TCHAR* argv[])
{
	FILE *Fp;
	int FpSize = 0;
	short e_lfanew = 0;
	fopen_s(&Fp, "C:\\Users\\Administrator\\Desktop\\MSG.exe", "rb");
	FpSize = filelength(Fp);//获取文件大小
	char * TempBuffer = (char *)malloc(FpSize);//申请存放文件的内存空间
	if (TempBuffer == NULL)
	{
		fclose(Fp);
		free(TempBuffer);
		return 0;
	}
	fread_s(TempBuffer, FpSize + 1, 1, FpSize, Fp);//将文件读入内存中
	TempBuffer = (char *)(TempBuffer + *(int *)(TempBuffer + 0x3c));//获取PE标志地址
	PIMAGE_FILE_HEADER MyFileHeader;
	printf("----------------------------------------------\n");
	printf("PE标记:%08x\n", *(int *)TempBuffer);
	printf("----------------------------------------------\n");
	TempBuffer = TempBuffer + 0x4;//指针指向标准PE头首地址
	MyFileHeader = (PIMAGE_FILE_HEADER)TempBuffer;
	printf("IMAGE_FILE_HEADER结构:\n");
	printf("----------------------------------------------\n");
	printf("Machine                      : %04X\n", MyFileHeader->Machine);//运行平台
	printf("NumberOfSections             : %04X\n", MyFileHeader->NumberOfSections);//区块数目
	printf("TimeDateStamp                : %08X\n", MyFileHeader->TimeDateStamp);//文件日期时间戳
	printf("PointerToSymbolTable         : %08X\n", MyFileHeader->PointerToSymbolTable);//指向符号表
	printf("NumberOfSymbols              : %08X\n", MyFileHeader->NumberOfSymbols);//符号表中的符号数量
	printf("SizeOfOptionalHeader         : %04X\n", MyFileHeader->SizeOfOptionalHeader);//映像可选头结构的大小
	printf("Characteristics              : %04X\n", MyFileHeader->Characteristics);//文件特征值
	printf("----------------------------------------------\n");
	TempBuffer = TempBuffer + 0x14;//指针指向可选PE头首地址
	PIMAGE_OPTIONAL_HEADER  MyOptionalHeader;
	MyOptionalHeader = (PIMAGE_OPTIONAL_HEADER)TempBuffer;
	printf("IMAGE_OPTIONAL_HEADER结构:\n");
	printf("----------------------------------------------\n");
	printf("Magic                        : %04X\n", MyOptionalHeader->Magic);//幻数,32位pe文件总为010bh
	printf("MajorLinkerVersion           : %02X\n", MyOptionalHeader->MajorLinkerVersion);//连接器主版本号
	printf("MinorLinkerVersion           : %02X\n", MyOptionalHeader->MinorLinkerVersion);//连接器副版本号
	printf("SizeOfCode                   : %08X\n", MyOptionalHeader->SizeOfCode);//代码段总大小
	printf("SizeOfInitializedData        : %08X\n", MyOptionalHeader->SizeOfInitializedData);//已初始化数据段总大小
	printf("SizeOfUninitializedData      : %08X\n", MyOptionalHeader->SizeOfUninitializedData);//未初始化数据段总大小
	printf("AddressOfEntryPoint          : %08X\n", MyOptionalHeader->AddressOfEntryPoint);//程序执行入口地址(RVA)
	printf("BaseOfCode                   : %08X\n", MyOptionalHeader->BaseOfCode);//代码段起始地址(RVA)
	printf("BaseOfData                   : %08X\n", MyOptionalHeader->BaseOfData);//数据段起始地址(RVA)
	printf("ImageBase                    : %08X\n", MyOptionalHeader->ImageBase);//程序默认的装入起始地址
	printf("SectionAlignment             : %08X\n", MyOptionalHeader->SectionAlignment);//内存中区块的对齐单位
	printf("FileAlignment                : %08X\n", MyOptionalHeader->FileAlignment);//文件中区块的对齐单位
	printf("MajorOperatingSystemVersion  : %04X\n", MyOptionalHeader->MajorOperatingSystemVersion);//所需操作系统主版本号
	printf("MinorOperatingSystemVersion  : %04X\n", MyOptionalHeader->MinorOperatingSystemVersion);//所需操作系统副版本号
	printf("MajorImageVersion            : %04X\n", MyOptionalHeader->MajorImageVersion);//自定义主版本号
	printf("MinorImageVersion            : %04X\n", MyOptionalHeader->MinorImageVersion);//自定义副版本号
	printf("MajorSubsystemVersion        : %04X\n", MyOptionalHeader->MajorSubsystemVersion);//所需子系统主版本号
	printf("MinorSubsystemVersion        : %04X\n", MyOptionalHeader->MinorSubsystemVersion);//所需子系统副版本号
	printf("Win32VersionValue            : %08X\n", MyOptionalHeader->Win32VersionValue);//总是0
	printf("SizeOfImage                  : %08X\n", MyOptionalHeader->SizeOfImage);//pe文件在内存中的映像总大小
	printf("SizeOfHeaders                : %08X\n", MyOptionalHeader->SizeOfHeaders);//从pe文件开始到节表(包含节表)的总大小
	printf("CheckSum                     : %08X\n", MyOptionalHeader->CheckSum);//pe文件CRC校验和
	printf("Subsystem                    : %04X\n", MyOptionalHeader->Subsystem);//用户界面使用的子系统类型
	printf("DllCharacteristics           : %04X\n", MyOptionalHeader->DllCharacteristics);//为0
	printf("SizeOfStackReserve           : %08X\n", MyOptionalHeader->SizeOfStackReserve);//为线程的栈初始保留的虚拟内存的默认值
	printf("SizeOfStackCommit            : %08X\n", MyOptionalHeader->SizeOfStackCommit);//为线程的栈初始提交的虚拟内存的大小
	printf("SizeOfHeapReserve            : %08X\n", MyOptionalHeader->SizeOfHeapReserve);//为进程的堆保留的虚拟内存的大小
	printf("SizeOfHeapCommit             : %08X\n", MyOptionalHeader->SizeOfHeapCommit);//为进程的堆初始提交的虚拟内存的大小
	printf("LoaderFlags                  : %08X\n", MyOptionalHeader->LoaderFlags);//为0
	printf("NumberOfRvaAndSizes          : %08X\n", MyOptionalHeader->NumberOfRvaAndSizes);//数据目录结构数组的项数,总为 00000010h
	TempBuffer = TempBuffer + MyFileHeader->SizeOfOptionalHeader;//指针指向区块首地址
	printf("----------------------------------------------\n");
	printf("节表信息：\n");
	printf("----------------------------------------------\n");
	PIMAGE_SECTION_HEADER MySectionHeader;
	MySectionHeader = (PIMAGE_SECTION_HEADER)TempBuffer;
	for (int i = 0; i < MyFileHeader->NumberOfSections; i++)
	{
		printf("Name                     : %s\n", MySectionHeader->Name);//区块名字
		printf("Misc                     : %08X\n", MySectionHeader->Misc);//在没有对齐前的真实大小
		printf("VirtualAddress           : %08X\n", MySectionHeader->VirtualAddress);//节区在内存中的偏移地址
		printf("SizeOfRawData            : %08X\n", MySectionHeader->SizeOfRawData);//节在文件中对齐后的大小
		printf("PointerToRawData         : %08X\n", MySectionHeader->PointerToRawData);//节区在文件中的偏移
		printf("PointerToRelocations     : %08X\n", MySectionHeader->PointerToRelocations);//在OBJ文件中使用 无意义
		printf("PointerToLinenumbers     : %08X\n", MySectionHeader->PointerToLinenumbers);//行号表的位置 调试的时候用
		printf("NumberOfRelocations      : %04X\n", MySectionHeader->NumberOfRelocations);//在OBJ文件中使用 对EXE无意义
		printf("NumberOfLinenumbers      : %04X\n", MySectionHeader->NumberOfLinenumbers);//行号表中行号的数量 调试的时候用
		printf("Characteristics          : %08X\n", MySectionHeader->Characteristics);//节的属性
		printf("----------------------------------------------\n");
		MySectionHeader++;
	}

	fclose(Fp);
	getchar();
	free(TempBuffer);
	return 0;
}
//获取文件大小

int filelength(FILE *fp)
{
	int num;
	fseek(fp, 0, SEEK_END);
	num = ftell(fp);
	fseek(fp, 0, SEEK_SET);
	return num;

}