获取PE文件信息的封装

  工作之余，闲来无事，研究了一下PE文件的格式；虽然PE这方面的工具多如牛毛，用起来也非常直观，但是为了自己加深巩固理解，倒不如自己写一个小东东来一探PE究竟。代码如下【具体操纵可以参考注释】：

  首先是PEFile.h

//--------------------------------------------------------------------// Name: PEFile.h// Purpose: 封装了列举PE文件信息的操作。// Author: 陈相礼// Compiler:VC8// Modified by:// Created: 11/06/09// Licence: #pragma once #include <stdio.h>#include <time.h>#include <windows.h>#include <ImageHlp.h>#pragma comment( lib, "ImageHlp" ) typedef struct _struMAP_FILE_STRUCT {HANDLE hFile;HANDLE hMapping;LPVOID lpImageBase;}MAP_FILE_STRUCT, *PMAP_FILE_STRUCT; class CPEFile{public:// 构造CPEFile() {};// 析构~CPEFile() {}; bool LoadPEFile( char *szFilename );// 载入PE的void PrintPEHeader();// 打印PE头部void PrintOptionalHeader();// 打印可选头部void PrintSectionInfo();// 打印区块信息void PrintET();// 打印导出表void PrintIAT();// 打印导入表void UnLoadFile();// 释放文件 protected:static voidCharToWCHAR( WCHAR* wchar, char* szSource );// 字符串转化boolIsPEFile( LPVOID );// 检测是否为PE文件PIMAGE_FILE_HEADERGetFileHeader( LPVOID ImageBase );// 取得PE头部PIMAGE_NT_HEADERSGetNtHeaders( LPVOID ImageBase );// 取得NT头部PIMAGE_OPTIONAL_HEADERGetOptionalHeader( LPVOID ImageBase );// 取得可选头部PIMAGE_SECTION_HEADERGetFirstSectionHeader( LPVOID ImageBase );// 取得第一个节信息LPVOIDGetDirectoryEntryToData( LPVOID ImageBase, USHORT DirectoryEntry );// 转化LPVOIDRvaToPtr( PIMAGE_NT_HEADERS pNtH, LPVOID ImageBase, DWORD dwRVA );// 转化 private:MAP_FILE_STRUCT mMapFile;};

  然后是PEFile.cpp

//--------------------------------------------------------------------// Name: PEFile.cpp// Purpose: 实现文件。// Author: 陈相礼// Compiler:VC8// Modified by:// Created: 11/06/09// Licence: #include "PEFile.h" //--------------------------------------------------------------------// Function:载入PE文件// Param:<in>文件路径名//<out>// Return:成功：true; 失败：falsebool CPEFile::LoadPEFile( char *szFilename ){HANDLE hFile;HANDLE hMapping;LPVOID lpImageBase;LPTSTR lpFilename; lpFilename = new WCHAR[MAX_PATH];CharToWCHAR( lpFilename, szFilename ); hFile = CreateFile(// 打开载入文件lpFilename,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0); if ( !hFile ){return false;} hMapping = CreateFileMapping(hFile,NULL,PAGE_READONLY,0,0,NULL);if ( !hMapping ){CloseHandle( hFile );return false;} lpImageBase = MapViewOfFile( hMapping,FILE_MAP_READ,0,0,0);if ( !lpImageBase ){CloseHandle( hFile );CloseHandle( hMapping );return false;}if ( !IsPEFile( lpImageBase ) ){printf_s( "PE文件信息获取失败。请确保是PE文件，且文件未被使用！/n" );return false;} mMapFile.hFile = hFile;mMapFile.hMapping = hMapping;mMapFile.lpImageBase = lpImageBase; delete []lpFilename; return true;} //--------------------------------------------------------------------// Function:输出PE文件头部信息// Param:<in>//<out>// Return:voidvoid CPEFile::PrintPEHeader(){PIMAGE_FILE_HEADER pFileHeader = GetFileHeader( mMapFile.lpImageBase ); tm createTime;printf_s("----------------------------PE头部信息----------------------------/n");switch ( pFileHeader->Machine ){case 0x14C:printf_s("可执行文件的目标CPU是：Intel i386/n");break;case 0x162:printf_s("可执行文件的目标CPU是：MIP R3000/n");break;case 0x166:printf_s("可执行文件的目标CPU是：MIP R4000/n");break;case 0x184:printf_s("可执行文件的目标CPU是：Alpha AXP/n");break;case 0x1F0:printf_s("可执行文件的目标CPU是：Power PC/n");break;default: printf_s("可执行文件的目标CPU未知！/n");} printf_s("文件的区块数目：%d/n", pFileHeader->NumberOfSections);gmtime_s( &createTime, (time_t *)&pFileHeader->TimeDateStamp );WCHARwBuf[64];charcBuf[64];asctime_s(cBuf, 64, &createTime);CharToWCHAR( wBuf, cBuf );printf_s( "文件的创建时间GMT是：%ws/n", wBuf ); printf_s("IAMGE_OPTIONAL_HEADER32结构大小：%d/n", pFileHeader->SizeOfOptionalHeader);if ( pFileHeader->Characteristics == 0x1000 ){printf_s("该文件为系统文件!/n");} if ( pFileHeader->Characteristics == 0x2000 ){printf_s("该文件为DLL文件!/n");}} //--------------------------------------------------------------------// Function:打印可选头部// Param:<in> //<out>// Return:voidvoid CPEFile::PrintOptionalHeader(){PIMAGE_OPTIONAL_HEADERpOH = GetOptionalHeader( mMapFile.lpImageBase ); printf_s("----------------------------可选头部信息----------------------------/n");printf_s("/n连接器的主版本号：%d,次版本号：%d/n",pOH->MajorLinkerVersion,pOH->MinorLinkerVersion);printf_s("所有含有代码区块的总大小：%ld/n",pOH->SizeOfCode);printf_s("所有初始化数据区块的总大小：%ld/n",pOH->SizeOfInitializedData);printf_s("所有未初始化数据区块的总大小：%ld/n",pOH->SizeOfUninitializedData);printf_s("程序执行入口RAV(AddressOfEntryPoint)：%X/n",pOH->AddressOfEntryPoint);printf_s("代码区块起始RVA(BaseOfCode)：%X/n",pOH->BaseOfCode);printf_s("数据区块起始RVA(BaseOfData)：%X/n",pOH->BaseOfData);printf_s("数据默认装入基地址(ImageBase)：%X/n",pOH->ImageBase);printf_s("操作系统主版本号：%d/n",pOH->MajorOperatingSystemVersion);printf_s("操作系统次版本号：%d/n",pOH->MinorOperatingSystemVersion);printf_s("所需要的的子系统主版本号：%d/n",pOH->MajorSubsystemVersion);printf_s("所需要的的子系统次版本号：%d/n",pOH->MinorSubsystemVersion);printf_s("映像装入内存后的总尺寸(SizeOfIamge)：%d/n",pOH->SizeOfImage);printf_s("DOS头,PE头,区块表总大小：%d/n",pOH->SizeOfHeaders);printf_s("映像效验和：%ld/n",pOH->CheckSum);printf_s("文件子系统：%d/n",pOH->Subsystem);printf_s("数据目录表的项数：%d/n",pOH->NumberOfRvaAndSizes);} //--------------------------------------------------------------------// Function:打印PE区块信息// Param:<in> //<out>// Return:voidvoid CPEFile::PrintSectionInfo(){PIMAGE_FILE_HEADERpFH=GetFileHeader( mMapFile.lpImageBase );if ( !pFH ){return;}PIMAGE_SECTION_HEADERpSH=GetFirstSectionHeader( mMapFile.lpImageBase );printf_s("----------------------------PE文件区块信息----------------------------/n");for ( int i = 0; i < pFH->NumberOfSections; ++i, ++pSH ){printf_s("段名：%s/t",(char *)pSH->Name);printf_s("VirtualSize：%x/t",pSH->Misc);printf_s("VirtualAddress：%x/t",pSH->VirtualAddress);printf_s("SizeOfRawData：%x/t",pSH->SizeOfRawData);printf_s("SizeOfRawData：%x/t",pSH->SizeOfRawData);printf_s("文件属性(Characteristics)：%x/n",pSH->Characteristics);}} //--------------------------------------------------------------------// Function:打印导出表信息// Param:<in> //<out>// Return:voidvoid CPEFile::PrintET(){IMAGE_EXPORT_DIRECTORY*pExport=(IMAGE_EXPORT_DIRECTORY *)GetDirectoryEntryToData( mMapFile.lpImageBase, IMAGE_DIRECTORY_ENTRY_EXPORT );printf_s("----------------------------PE导出表----------------------------/n");if ( !pExport ){printf_s("不存在输出模块！/n");return ;} printf_s("模块的真实名称：%s/n", (char *)::ImageRvaToVa( GetNtHeaders( mMapFile.lpImageBase ), mMapFile.lpImageBase, pExport->Name, NULL ));int num;num = pExport->NumberOfFunctions;printf_s("函数中函数模块的个数为：%d/n", num);DWORD*AddressF=(DWORD *)::ImageRvaToVa( GetNtHeaders( mMapFile.lpImageBase ), mMapFile.lpImageBase, pExport->AddressOfFunctions, NULL );DWORD*AddressName=(DWORD *)::ImageRvaToVa( GetNtHeaders( mMapFile.lpImageBase ), mMapFile.lpImageBase, pExport->AddressOfNames, NULL );DWORD*AddressName0=(DWORD *)::ImageRvaToVa( GetNtHeaders( mMapFile.lpImageBase ), mMapFile.lpImageBase, pExport->AddressOfNameOrdinals, NULL ); for ( int i = 0; i < num; ++i, ++AddressName, ++AddressF, ++AddressName0 ){printf_s("函数名称：%-30s，地址：%-4x，序列号：%d/n", (char *)ImageRvaToVa( GetNtHeaders( mMapFile.lpImageBase ),mMapFile.lpImageBase, *AddressName, NULL ), *AddressF, *AddressName0 );}} //--------------------------------------------------------------------// Function:打印导入表信息// Param:<in> //<out>// Return:voidvoid CPEFile::PrintIAT(){PIMAGE_IMPORT_DESCRIPTORpImport = (IMAGE_IMPORT_DESCRIPTOR *)GetDirectoryEntryToData( mMapFile.lpImageBase, IMAGE_DIRECTORY_ENTRY_IMPORT ); printf_s("----------------------------PE导入表----------------------------/n");if ( !pImport ){printf_s("不存在输入模块！/n");return;} while ( pImport->FirstThunk ){char *pszDllName = (char *)RvaToPtr( GetNtHeaders(mMapFile.lpImageBase), mMapFile.lpImageBase, pImport->Name );printf_s( "/n输入模块：%s/n", pszDllName );IMAGE_THUNK_DATA*pThunk =(IMAGE_THUNK_DATA *)(::ImageRvaToVa( GetNtHeaders( mMapFile.lpImageBase ), mMapFile.lpImageBase,pImport->OriginalFirstThunk,NULL ) ); int num = 0;if ( pThunk == NULL ){return;} while ( pThunk->u1.Function ){char *pszFunName = (char *)(::ImageRvaToVa((PIMAGE_NT_HEADERS)GetNtHeaders( mMapFile.lpImageBase ), mMapFile.lpImageBase, (unsigned long)pThunk->u1.AddressOfData, NULL ));PDWORD lpAddr=(DWORD*)(::ImageRvaToVa(GetNtHeaders(mMapFile.lpImageBase), mMapFile.lpImageBase, pImport->FirstThunk, NULL )) + num; if ( pszFunName == NULL ){break;}printf_s("从此模块导入的函数：%-30s", pszFunName + 2);printf_s("函数地址：%x/n", lpAddr);num++;pThunk++;}pImport++;}} //--------------------------------------------------------------------// Function:释放文件// Param:<in> //<out>// Return:voidvoid CPEFile::UnLoadFile(){if ( mMapFile.lpImageBase ){UnmapViewOfFile( mMapFile.lpImageBase );} if ( mMapFile.hMapping ){CloseHandle( mMapFile.hMapping );} if ( mMapFile.hFile ){CloseHandle( mMapFile.hFile );}} //--------------------------------------------------------------------// Function:字符串转化为宽字符// Param:<in>源字符串指针//<out>转化后的宽字符指针// Return:voidvoid CPEFile::CharToWCHAR( WCHAR* wchar, char* szSource ){intnLen=strlen( szSource ) + 1;intnwLen=MultiByteToWideChar( CP_ACP, 0, szSource, nLen, NULL, 0 );MultiByteToWideChar( CP_ACP, 0, szSource, nLen, wchar, nwLen );} //--------------------------------------------------------------------// Function:检测PE有效性// Param:<in>文件内存镜像//<out>// Return:有效：true; 无效：falsebool CPEFile::IsPEFile( LPVOID ImageBase ){PIMAGE_DOS_HEADER pDH= NULL;PIMAGE_NT_HEADERS pNtH= NULL; if ( !ImageBase ){return false;} // 检测DOS头pDH = (PIMAGE_DOS_HEADER)ImageBase;if ( pDH->e_magic != IMAGE_DOS_SIGNATURE ){return false;} // 检测PE头部pNtH = (PIMAGE_NT_HEADERS32)( (DWORD)pDH + pDH->e_lfanew );if ( pNtH->Signature != IMAGE_NT_SIGNATURE ){return false;} return true;} //--------------------------------------------------------------------// Function:获取PE头部// Param:<in>文件内存镜像//<out>// Return:PE头部指针PIMAGE_FILE_HEADER CPEFile::GetFileHeader( LPVOID ImageBase ){PIMAGE_NT_HEADERSpNtH=NULL;PIMAGE_FILE_HEADERpFH=NULL;pNtH=GetNtHeaders( ImageBase );pFH=&pNtH->FileHeader;return pFH;} //--------------------------------------------------------------------// Function:获取NT头部// Param:<in>文件内存镜像//<out>// Return:NT结构指针PIMAGE_NT_HEADERS CPEFile::GetNtHeaders( LPVOID ImageBase ){if ( !IsPEFile( ImageBase ) ){return NULL;} PIMAGE_DOS_HEADERpDH=(PIMAGE_DOS_HEADER)ImageBase;PIMAGE_NT_HEADERSpNtH=(PIMAGE_NT_HEADERS)( (DWORD)pDH + pDH->e_lfanew ); return pNtH;} //--------------------------------------------------------------------// Function:获取可选头部// Param:<in>文件镜像基址//<out>// Return:PE可选头指针PIMAGE_OPTIONAL_HEADER CPEFile::GetOptionalHeader( LPVOID ImageBase ){PIMAGE_OPTIONAL_HEADER pOH=&(GetNtHeaders( ImageBase ))->OptionalHeader;return pOH;} //--------------------------------------------------------------------// Function:获取第一个节信息// Param:<in>文件镜像基址//<out>// Return:PE节头指针PIMAGE_SECTION_HEADER CPEFile::GetFirstSectionHeader( LPVOID ImageBase ){PIMAGE_NT_HEADERSpNtH=GetNtHeaders( ImageBase );PIMAGE_SECTION_HEADERpSH=IMAGE_FIRST_SECTION( pNtH ); return pSH;} LPVOID CPEFile::GetDirectoryEntryToData( LPVOID ImageBase, USHORT DirectoryEntry ){DWORDdwDataStartRVA;LPVOIDpDirData=NULL;PIMAGE_NT_HEADERSpNtH=NULL;PIMAGE_OPTIONAL_HEADERpOH=NULL; pNtH=GetNtHeaders( ImageBase );if ( !pNtH ){returnNULL;} pOH=GetOptionalHeader( ImageBase );if ( !pOH ){returnNULL;} dwDataStartRVA=pOH->DataDirectory[DirectoryEntry].VirtualAddress;if ( !dwDataStartRVA ){return NULL;} pDirData=RvaToPtr( pNtH, ImageBase, dwDataStartRVA );if ( !pDirData ){return NULL;} return pDirData;} LPVOID CPEFile::RvaToPtr( PIMAGE_NT_HEADERS pNtH, LPVOID ImageBase, DWORD dwRVA ){return ::ImageRvaToVa( pNtH, ImageBase, dwRVA, NULL );}

  最后是AppMain.cpp进行调用测试。

//--------------------------------------------------------------------// Name: AppMain.cpp// Purpose: 测试主程序。// Author: 陈相礼// Compiler:VC8// Modified by:// Created: 11/06/09// Licence: #include "PEFile.h" int main( int argc, char **argv ){//char *filename = "C://Documents and Settings//Administrator//桌面//Stud_PE//Stud_PE.exe";char *filename = "C://Documents and Settings//Administrator//桌面//Stud_PE//PSAPI.DLL";CPEFile pefile;pefile.LoadPEFile(filename);pefile.PrintPEHeader();pefile.PrintOptionalHeader();pefile.PrintSectionInfo();pefile.PrintET();pefile.PrintIAT();pefile.UnLoadFile();system( "pause" );return 0;}