获取PE文件的OEP值 （源码）

两种方法读取PE文件的OEP值：一是 直接读取文件，二是 通过内存映射。

#include "stdafx.h"
#include <afx.h>

//-------------------------------
//read the file of .exe  get the OEP (Original Entry Point)
//-------------------------------
BOOL ReadOPEbyFile(LPCSTR szFileName)
{
 HANDLE hFile;
 if ((hFile = CreateFile(szFileName,GENERIC_READ,FILE_SHARE_READ,0,OPEN_EXISTING,FILE_FLAG_SEQUENTIAL_SCAN,0))==INVALID_HANDLE_VALUE)
 {
  printf("Can't open the file");
  return FALSE;
 }
 DWORD dwOEP,cbRead;
 IMAGE_DOS_HEADER dos_head[sizeof(IMAGE_DOS_HEADER)];
 if (!ReadFile(hFile,dos_head,sizeof(IMAGE_DOS_HEADER),&cbRead,NULL))
 {
  printf("Read image_dos_header failed ./n");
  CloseHandle(hFile);
  return FALSE;
 }
 int nEntryPos = dos_head->e_lfanew+40;
 SetFilePointer(hFile,nEntryPos,NULL,FILE_BEGIN);
 if (!ReadFile(hFile,&dwOEP,sizeof(dwOEP),&cbRead,NULL)) {
  printf("Read OEP failed ./n");
  CloseHandle(hFile);
  return FALSE;
 }

 CloseHandle(hFile);
 printf("OEP by file: %d/n",dwOEP);
 return TRUE;
}
//-----------------------------------------
//fileMapping get the OEP
//-----------------------------------------

BOOL ReadOEPbyMemory(LPCSTR szFileName)
{
 struct PE_HEADER_MAP
 {
  DWORD signature;
  IMAGE_FILE_HEADER _head;
  IMAGE_OPTIONAL_HEADER opt_head;
  IMAGE_SECTION_HEADER section_header[6];
 }*header;

 HANDLE hFile;
 HANDLE hMapping;
 void *basepointer;

 //open the file
 if ((hFile = CreateFile(szFileName,GENERIC_READ,FILE_SHARE_READ,0,OPEN_EXISTING,FILE_FLAG_SEQUENTIAL_SCAN,0))==INVALID_HANDLE_VALUE) {
  printf("Can't open the file");
  return FALSE;
 }
 if (!(hMapping = CreateFileMapping(hFile,0,PAGE_READONLY|SEC_COMMIT,0,0,0))) {
  printf("Mapping failed./n");
  CloseHandle(hFile);
  return FALSE;
 }
 if (!(basepointer = MapViewOfFile(hMapping,FILE_MAP_READ,0,0,0)))
 {
  printf("View failed./n");
  CloseHandle(hMapping);
  CloseHandle(hFile);
  return FALSE;
 }

 IMAGE_DOS_HEADER *dos_head = (IMAGE_DOS_HEADER *)basepointer;
 header = (PE_HEADER_MAP *)((char *)dos_head+dos_head->e_lfanew);
 DWORD dwOEP = header->opt_head.AddressOfEntryPoint;

 UnmapViewOfFile(basepointer);
 CloseHandle(hMapping);
 CloseHandle(hFile);

 printf("OEP by memory :%d/n",dwOEP);
 return TRUE;
}

int main(int argc, char* argv[])
{
 printf("Hello World!/n");
ReadOPEbyFile("D://jp.exe");
ReadOEPbyMemory("D://jp.exe");
 return 0;
}