PE文件格式解析 LUA版本，兼容32/64位

来源：互联网发布：小意思tpo for mac 编辑：程序博客网时间：2024/04/30 14:05
local function readOnly (obj)    local proxy = {};    local mtReadOnly = {};    mtReadOnly.__index = obj;    mtReadOnly.__newindex = function(t, k, v)        error("attempt to update a read-only table");    end;    mtReadOnly.__pairs = function(t)        return pairs(obj);    end;    setmetatable(proxy, mtReadOnly);    return proxy;endlocal _G = readOnly(_G);local _ENV = readOnly(_ENV);local M = {};M.Const = {};M.Const.Magic = {};M.Const.Machine = {};M.Const.CharacteristicsFlags = {};M.Const.Subsystem = {};M.Const.DllCharacteristicsFlags = {};M.Const.Sections = {};M.Const.Sections.CharacteristicsFlags = {};local M_Const = M.const;local M_Const_Magic = M.Const.Magic;local M_Const_Machine = M.Const.Machine;local M_Const_CharacteristicsFlags = M.Const.CharacteristicsFlags;local M_Const_Subsystem = M.Const.Subsystem;local M_Const_DllCharacteristicsFlags = M.Const.DllCharacteristicsFlags;local M_Const_Section = M.Const.Section;local M_Const_Sections_CharacteristicsFlags = M.Const.Sections.CharacteristicsFlags;M_Const_Magic[0x10b] = "PE32";M_Const_Magic[0x20b] = "PE32+";M_Const_Machine[0x0000] = "IMAGE_FILE_MACHINE_UNKNOWN";M_Const_Machine[0x01d3] = "IMAGE_FILE_MACHINE_AM33";M_Const_Machine[0x8664] = "IMAGE_FILE_MACHINE_AMD64";M_Const_Machine[0x01c0] = "IMAGE_FILE_MACHINE_ARM";M_Const_Machine[0x01c4] = "IMAGE_FILE_MACHINE_ARMNT";M_Const_Machine[0xaa64] = "IMAGE_FILE_MACHINE_ARM64";M_Const_Machine[0x0ebc] = "IMAGE_FILE_MACHINE_EBC";M_Const_Machine[0x014c] = "IMAGE_FILE_MACHINE_I386";M_Const_Machine[0x0200] = "IMAGE_FILE_MACHINE_IA64";M_Const_Machine[0x9041] = "IMAGE_FILE_MACHINE_M32R";M_Const_Machine[0x0266] = "IMAGE_FILE_MACHINE_MIPS16";M_Const_Machine[0x0366] = "IMAGE_FILE_MACHINE_MIPSFPU";M_Const_Machine[0x0466] = "IMAGE_FILE_MACHINE_MIPSFPU16";M_Const_Machine[0x01f0] = "IMAGE_FILE_MACHINE_POWERPC";M_Const_Machine[0x01f1] = "IMAGE_FILE_MACHINE_POWERPCFP";M_Const_Machine[0x0166] = "IMAGE_FILE_MACHINE_R4000";M_Const_Machine[0x01a2] = "IMAGE_FILE_MACHINE_SH3";M_Const_Machine[0x01a3] = "IMAGE_FILE_MACHINE_SH3DSP";M_Const_Machine[0x01a6] = "IMAGE_FILE_MACHINE_SH4";M_Const_Machine[0x01a8] = "IMAGE_FILE_MACHINE_SH5";M_Const_Machine[0x01c2] = "IMAGE_FILE_MACHINE_THUMB";M_Const_Machine[0x0169] = "IMAGE_FILE_MACHINE_WCEMIPSV2";M_Const_CharacteristicsFlags[0x0001] = "IMAGE_FILE_RELOCS_STRIPPED";M_Const_CharacteristicsFlags[0x0002] = "IMAGE_FILE_EXECUTABLE_IMAGE";M_Const_CharacteristicsFlags[0x0004] = "IMAGE_FILE_LINE_NUMS_STRIPPED";M_Const_CharacteristicsFlags[0x0008] = "IMAGE_FILE_LOCAL_SYMS_STRIPPED";M_Const_CharacteristicsFlags[0x0010] = "IMAGE_FILE_AGGRESSIVE_WS_TRIM";M_Const_CharacteristicsFlags[0x0020] = "IMAGE_FILE_LARGE_ADDRESS_AWARE";M_Const_CharacteristicsFlags[0x0040] = "Reserved for future use";M_Const_CharacteristicsFlags[0x0080] = "IMAGE_FILE_BYTES_REVERSED_LO";M_Const_CharacteristicsFlags[0x0100] = "IMAGE_FILE_32BIT_MACHINE";M_Const_CharacteristicsFlags[0x0200] = "IMAGE_FILE_DEBUG_STRIPPED";M_Const_CharacteristicsFlags[0x0400] = "IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP";M_Const_CharacteristicsFlags[0x0800] = "IMAGE_FILE_NET_RUN_FROM_SWAP";M_Const_CharacteristicsFlags[0x1000] = "IMAGE_FILE_SYSTEM";M_Const_CharacteristicsFlags[0x2000] = "IMAGE_FILE_DLL";M_Const_CharacteristicsFlags[0x4000] = "IMAGE_FILE_UP_SYSTEM_ONLY";M_Const_CharacteristicsFlags[0x8000] = "IMAGE_FILE_BYTES_REVERSED_HI";M_Const_Subsystem[0x0] = "IMAGE_SUBSYSTEM_UNKNOWN";M_Const_Subsystem[0x1] = "IMAGE_SUBSYSTEM_NATIVE";M_Const_Subsystem[0x2] = "IMAGE_SUBSYSTEM_WINDOWS_GUI";M_Const_Subsystem[0x3] = "IMAGE_SUBSYSTEM_WINDOWS_CUI";M_Const_Subsystem[0x7] = "IMAGE_SUBSYSTEM_POSIX_CUI";M_Const_Subsystem[0x9] = "IMAGE_SUBSYSTEM_WINDOWS_CE_GUI";M_Const_Subsystem[0xa] = "IMAGE_SUBSYSTEM_EFI_APPLICATION";M_Const_Subsystem[0xb] = "IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER";M_Const_Subsystem[0xc] = "IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER";M_Const_Subsystem[0xd] = "IMAGE_SUBSYSTEM_EFI_ROM";M_Const_Subsystem[0xe] = "IMAGE_SUBSYSTEM_XBOX";M_Const_DllCharacteristicsFlags[0x0040] = "IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE";M_Const_DllCharacteristicsFlags[0x0080] = "IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY";M_Const_DllCharacteristicsFlags[0x0100] = "IMAGE_DLL_CHARACTERISTICS_NX_COMPAT";M_Const_DllCharacteristicsFlags[0x0200] = "IMAGE_DLLCHARACTERISTICS_NO_ISOLATION";M_Const_DllCharacteristicsFlags[0x0400] = "IMAGE_DLLCHARACTERISTICS_NO_SEH";M_Const_DllCharacteristicsFlags[0x0800] = "IMAGE_DLLCHARACTERISTICS_NO_BIND";M_Const_DllCharacteristicsFlags[0x2000] = "IMAGE_DLLCHARACTERISTICS_WDM_DRIVER";M_Const_DllCharacteristicsFlags[0x8000] = "IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE";M_Const_Sections_CharacteristicsFlags[0x00000008] = "IMAGE_SCN_TYPE_NO_PAD";M_Const_Sections_CharacteristicsFlags[0x00000020] = "IMAGE_SCN_CNT_CODE";M_Const_Sections_CharacteristicsFlags[0x00000040] = "IMAGE_SCN_CNT_INITIALIZED_DATA";M_Const_Sections_CharacteristicsFlags[0x00000080] = "IMAGE_SCN_CNT_UNINITIALIZED_ DATA";M_Const_Sections_CharacteristicsFlags[0x00000100] = "IMAGE_SCN_LNK_OTHER";M_Const_Sections_CharacteristicsFlags[0x00000200] = "IMAGE_SCN_LNK_INFO";M_Const_Sections_CharacteristicsFlags[0x00000800] = "IMAGE_SCN_LNK_REMOVE";M_Const_Sections_CharacteristicsFlags[0x00001000] = "IMAGE_SCN_LNK_COMDAT";M_Const_Sections_CharacteristicsFlags[0x00008000] = "IMAGE_SCN_GPREL";M_Const_Sections_CharacteristicsFlags[0x00020000] = "IMAGE_SCN_MEM_PURGEABLE";M_Const_Sections_CharacteristicsFlags[0x00020000] = "IMAGE_SCN_MEM_16BIT";M_Const_Sections_CharacteristicsFlags[0x00040000] = "IMAGE_SCN_MEM_LOCKED";M_Const_Sections_CharacteristicsFlags[0x00080000] = "IMAGE_SCN_MEM_PRELOAD";M_Const_Sections_CharacteristicsFlags[0x00100000] = "IMAGE_SCN_ALIGN_1BYTES";M_Const_Sections_CharacteristicsFlags[0x00200000] = "IMAGE_SCN_ALIGN_2BYTES";M_Const_Sections_CharacteristicsFlags[0x00300000] = "IMAGE_SCN_ALIGN_4BYTES";M_Const_Sections_CharacteristicsFlags[0x00400000] = "IMAGE_SCN_ALIGN_8BYTES";M_Const_Sections_CharacteristicsFlags[0x00500000] = "IMAGE_SCN_ALIGN_16BYTES";M_Const_Sections_CharacteristicsFlags[0x00600000] = "IMAGE_SCN_ALIGN_32BYTES";M_Const_Sections_CharacteristicsFlags[0x00700000] = "IMAGE_SCN_ALIGN_64BYTES";M_Const_Sections_CharacteristicsFlags[0x00800000] = "IMAGE_SCN_ALIGN_128BYTES";M_Const_Sections_CharacteristicsFlags[0x00900000] = "IMAGE_SCN_ALIGN_256BYTES";M_Const_Sections_CharacteristicsFlags[0x00a00000] = "IMAGE_SCN_ALIGN_512BYTES";M_Const_Sections_CharacteristicsFlags[0x00b00000] = "IMAGE_SCN_ALIGN_1024BYTES";M_Const_Sections_CharacteristicsFlags[0x00c00000] = "IMAGE_SCN_ALIGN_2048BYTES";M_Const_Sections_CharacteristicsFlags[0x00d00000] = "IMAGE_SCN_ALIGN_4096BYTES";M_Const_Sections_CharacteristicsFlags[0x00e00000] = "IMAGE_SCN_ALIGN_8192BYTES";M_Const_Sections_CharacteristicsFlags[0x01000000] = "IMAGE_SCN_LNK_NRELOC_OVFL";M_Const_Sections_CharacteristicsFlags[0x02000000] = "IMAGE_SCN_MEM_DISCARDABLE";M_Const_Sections_CharacteristicsFlags[0x04000000] = "IMAGE_SCN_MEM_NOT_CACHED";M_Const_Sections_CharacteristicsFlags[0x08000000] = "IMAGE_SCN_MEM_NOT_PAGED";M_Const_Sections_CharacteristicsFlags[0x10000000] = "IMAGE_SCN_MEM_SHARED";M_Const_Sections_CharacteristicsFlags[0x20000000] = "IMAGE_SCN_MEM_EXECUTE";M_Const_Sections_CharacteristicsFlags[0x40000000] = "IMAGE_SCN_MEM_READ";M_Const_Sections_CharacteristicsFlags[0x80000000] = "IMAGE_SCN_MEM_WRITE";local function printf(fmt, ...)    local str = string.format(fmt, ...);    print(str);endlocal function dump_flags(flags, tbFlags)    local r = {};    for k,v in pairs(tbFlags) do        if (k & flags ~= 0) then            r[#r+1]=v;        end    end    return table.concat(r, " | ");endlocal function ReadFile(filepath)    local f, err = io.open(filepath, "rb");    local buf = f:read("*all");    f:close();    return buf;endlocal function ReadUInt(buf, offset, size)    local data = buf:sub(offset+1, offset+size);    assert(data:len() == size, "assert:" .. offset .. " " .. data:len() .. "~=" .. size);    if (size==4) then        data = string.unpack("=L", data);    elseif (size==2) then        data = string.unpack("=H", data);    elseif (size==1) then        data = string.unpack("=B", data);    elseif (size==8) then        data = string.unpack("=I8", data);    end    return offset+size, data;end--文件头local function DumpFileHdr(buf, offset)    local FileHdr = {};    offset, FileHdr.Machine = ReadUInt(buf, offset, 2);    printf("%-24s %s", "Machine", M_Const_Machine[FileHdr.Machine]);    offset, FileHdr.NumberOfSections = ReadUInt(buf, offset, 2);    printf("%-24s %X", "NumberOfSections", FileHdr.NumberOfSections);    offset, FileHdr.TimeDateStamp = ReadUInt(buf, offset, 4);    printf("%-24s %X %s", "TimeDateStamp", FileHdr.TimeDateStamp, os.date("!%Y-%m-%d %H:%M:%S",FileHdr.TimeDateStamp));    offset, FileHdr.PointerToSymbolTable = ReadUInt(buf, offset, 4);    printf("%-24s %X", "PointerToSymbolTable", FileHdr.PointerToSymbolTable);    offset, FileHdr.NumberOfSymbols = ReadUInt(buf, offset, 4);    printf("%-24s %X", "NumberOfSymbols", FileHdr.NumberOfSymbols);    offset, FileHdr.SizeOfOptionalHeader= ReadUInt(buf, offset, 2);    printf("%-24s %X", "SizeOfOptionalHeader", FileHdr.SizeOfOptionalHeader);    offset, FileHdr.Characteristics= ReadUInt(buf, offset, 2);    printf("%-24s %s", "Characteristics", dump_flags(FileHdr.Characteristics, M_Const_CharacteristicsFlags));    return offset, FileHdr;endlocal function DumpOptHdr(buf, offset)    local OptHdr = {};    offset, OptHdr.Magic = ReadUInt(buf, offset, 2);    printf("%-24s %s", "Magic", M_Const_Magic[OptHdr.Magic]);    offset, OptHdr.MajorLinkerVersion = ReadUInt(buf, offset, 1);    offset, OptHdr.MinorLinkerVersion = ReadUInt(buf, offset, 1);    printf("%-24s %u.%u", "LinkerVersion", OptHdr.MajorLinkerVersion, OptHdr.MinorLinkerVersion);    offset, OptHdr.SizeOfCode= ReadUInt(buf, offset, 4);    printf("%-24s %X", "SizeOfCode", OptHdr.SizeOfCode);    offset, OptHdr.SizeOfInitializedData= ReadUInt(buf, offset, 4);    printf("%-24s %X", "SizeOfInitializedData", OptHdr.SizeOfInitializedData);    offset, OptHdr.SizeOfUninitializedData= ReadUInt(buf, offset, 4);    printf("%-24s %X", "SizeOfUninitializedData", OptHdr.SizeOfUninitializedData);    offset, OptHdr.AddressOfEntryPoint= ReadUInt(buf, offset, 4);    printf("%-24s %X", "AddressOfEntryPoint", OptHdr.AddressOfEntryPoint);    offset, OptHdr.BaseOfCode= ReadUInt(buf, offset, 4);    printf("%-24s %X", "BaseOfCode", OptHdr.BaseOfCode);    if (M_Const_Magic[OptHdr.Magic] == "PE32") then        offset, OptHdr.BaseOfData = ReadUInt(buf, offset, 4);        printf("%-24s %X", "BaseOfData", OptHdr.BaseOfData);        offset, OptHdr.ImageBase = ReadUInt(buf, offset, 4);        printf("%-24s %X", "ImageBase", OptHdr.ImageBase);    elseif (M_Const_Magic[OptHdr.Magic] == "PE32+") then        offset, OptHdr.ImageBase = ReadUInt(buf, offset, 8);        printf("%-24s %X", "ImageBase", OptHdr.ImageBase);    else        assert(false);    end    offset, OptHdr.SectionAlignment = ReadUInt(buf, offset, 4);    printf("%-24s %X", "SectionAlignment", OptHdr.SectionAlignment);    offset, OptHdr.FileAlignment = ReadUInt(buf, offset, 4);    printf("%-24s %X", "FileAlignment", OptHdr.FileAlignment);    offset, OptHdr.MajorOperatingSystemVersion = ReadUInt(buf, offset, 2);    offset, OptHdr.MinorOperatingSystemVersion = ReadUInt(buf, offset, 2);    printf("%-24s %u.%u", "OperatingSystemVersion", OptHdr.MajorOperatingSystemVersion, OptHdr.MinorOperatingSystemVersion);    offset, OptHdr.MajorImageVersion = ReadUInt(buf, offset, 2);    offset, OptHdr.MinorImageVersion = ReadUInt(buf, offset, 2);    printf("%-24s %u.%u", "ImageVersion", OptHdr.MajorImageVersion, OptHdr.MinorImageVersion);    offset, OptHdr.MajorSubsystemVersion = ReadUInt(buf, offset, 2);    offset, OptHdr.MinorSubsystemVersion = ReadUInt(buf, offset, 2);    printf("%-24s %u.%u", "SubsystemVersion", OptHdr.MajorSubsystemVersion, OptHdr.MinorSubsystemVersion);    offset, OptHdr.Win32VersionValue = ReadUInt(buf, offset, 4);    printf("%-24s %X", "Win32VersionValue", OptHdr.Win32VersionValue);    offset, OptHdr.SizeOfImage = ReadUInt(buf, offset, 4);    printf("%-24s %X", "SizeOfImage", OptHdr.SizeOfImage);    offset, OptHdr.SizeOfHeaders = ReadUInt(buf, offset, 4);    printf("%-24s %X", "SizeOfHeaders", OptHdr.SizeOfHeaders);    offset, OptHdr.CheckSum = ReadUInt(buf, offset, 4);    printf("%-24s %X", "CheckSum", OptHdr.CheckSum);    offset, OptHdr.Subsystem = ReadUInt(buf, offset, 2);    printf("%-24s %s", "Subsystem", M_Const_Subsystem[OptHdr.Subsystem]);    offset, OptHdr.DllCharacteristics = ReadUInt(buf, offset, 2);    printf("%-24s %s", "DllCharacteristics", dump_flags(OptHdr.DllCharacteristics,M_Const_DllCharacteristicsFlags));    if (M_Const_Magic[OptHdr.Magic] == "PE32") then        offset, OptHdr.SizeOfStackReserve = ReadUInt(buf, offset, 4);        printf("%-24s %X", "SizeOfStackReserve", OptHdr.SizeOfStackReserve);        offset, OptHdr.SizeOfStackCommit = ReadUInt(buf, offset, 4);        printf("%-24s %X", "SizeOfStackCommit", OptHdr.SizeOfStackCommit);        offset, OptHdr.SizeOfHeapReserve = ReadUInt(buf, offset, 4);        printf("%-24s %X", "SizeOfHeapReserve", OptHdr.SizeOfHeapReserve);        offset, OptHdr.SizeOfHeapCommit = ReadUInt(buf, offset, 4);        printf("%-24s %X", "SizeOfHeapCommit", OptHdr.SizeOfHeapCommit);    elseif (M_Const_Magic[OptHdr.Magic] == "PE32+") then        offset, OptHdr.SizeOfStackReserve = ReadUInt(buf, offset, 8);        printf("%-24s %X", "SizeOfStackReserve", OptHdr.SizeOfStackReserve);        offset, OptHdr.SizeOfStackCommit = ReadUInt(buf, offset, 8);        printf("%-24s %X", "SizeOfStackCommit", OptHdr.SizeOfStackCommit);        offset, OptHdr.SizeOfHeapReserve = ReadUInt(buf, offset, 8);        printf("%-24s %X", "SizeOfHeapReserve", OptHdr.SizeOfHeapReserve);        offset, OptHdr.SizeOfHeapCommit = ReadUInt(buf, offset, 8);        printf("%-24s %X", "SizeOfHeapCommit", OptHdr.SizeOfHeapCommit);    else        assert(false);    end    offset, OptHdr.LoaderFlags = ReadUInt(buf, offset, 4);    printf("%-24s %X", "LoaderFlags", OptHdr.LoaderFlags);    offset, OptHdr.NumberOfRvaAndSizes = ReadUInt(buf, offset, 4);    printf("%-24s %X", "NumberOfRvaAndSizes", OptHdr.NumberOfRvaAndSizes);    return offset, OptHdr;endlocal function DumpDataDir(buf, offset)    local ddir = {};    for i=1, 16 do        ddir[i] = {};        local ddiri = ddir[i];        offset, ddiri.VirtualAddress = ReadUInt(buf, offset, 4);        offset, ddiri.Size = ReadUInt(buf, offset, 4);        printf("DataDirectory %.2d\tVirtualAddress = %.8X, Size = %.8X", i, ddiri.VirtualAddress, ddiri.Size);    end    return offset, ddir;endlocal function DumpSection(buf, offset, hdr_file)    local Section = {};    for i=1, hdr_file.NumberOfSections do        local SectionI = {};        Section[i] = SectionI;        local data = nil;        offset, data = ReadUInt(buf, offset, 8);        SectionI.Name = string.pack("=I8", data);        offset, data = ReadUInt(buf, offset, 4);        SectionI.Misc_PhysicalAddress = data;        SectionI.Misc_VirtualSize = data;        offset, SectionI.VirtualAddress = ReadUInt(buf, offset, 4);        offset, SectionI.SizeOfRawData = ReadUInt(buf, offset, 4);        offset, SectionI.PointerToRawData = ReadUInt(buf, offset, 4);        offset, SectionI.PointerToRelocations = ReadUInt(buf, offset, 4);        offset, SectionI.PointerToLinenumbers = ReadUInt(buf, offset, 4);        offset, SectionI.NumberOfRelocations = ReadUInt(buf, offset, 2);        offset, SectionI.NumberOfLinenumbers = ReadUInt(buf, offset, 2);        offset, SectionI.Characteristics = ReadUInt(buf, offset, 4);        printf("%-24s %s", "SectionName", SectionI.Name);        printf("%-24s %X", "Misc_PhysicalAddress", SectionI.Misc_PhysicalAddress);        printf("%-24s %X", "Misc_VirtualSize", SectionI.Misc_VirtualSize);        printf("%-24s %X", "VirtualAddress", SectionI.VirtualAddress);        printf("%-24s %X", "SizeOfRawData", SectionI.SizeOfRawData);        printf("%-24s %X", "PointerToRawData", SectionI.PointerToRawData);        printf("%-24s %X", "PointerToRelocations", SectionI.PointerToRelocations);        printf("%-24s %X", "PointerToLinenumbers", SectionI.PointerToLinenumbers);        printf("%-24s %X", "NumberOfRelocations", SectionI.NumberOfRelocations);        printf("%-24s %X", "NumberOfLinenumbers", SectionI.NumberOfLinenumbers);        printf("%-24s %s", "Characteristics", dump_flags(SectionI.Characteristics,M_Const_Sections_CharacteristicsFlags));        print();    end    return offset, Section;endlocal function DumpHdr(buf)    --判断MZ头    local offset, data = ReadUInt(buf, 0, 2);    assert(data==0x5A4D, "MZ fail");    --获取PE头偏移    offset, data= ReadUInt(buf, 0x3C, 2);    offset = data;    --判断PE头    offset, data = ReadUInt(buf, offset, 2);    assert(data==0x4550, "PE fail");    --跳过2字节    offset, data = ReadUInt(buf, offset, 2);    --读取文件头，可选头，数据目录和节目录    local hdr = {};    offset, hdr.file = DumpFileHdr(buf, offset);    print();    offset, hdr.opt = DumpOptHdr(buf, offset);    print();    offset, hdr.ddir = DumpDataDir(buf, offset);    print();    offset, hdr.sec = DumpSection(buf, offset, hdr.file);    print();    local hdr_sec = hdr.sec;    --工具函数    local helper = {};    --相对偏移转文件偏移    local function RVA2FOA(rva)        local foa = nil;        for i=1, #hdr_sec do            local first = hdr_sec[i].VirtualAddress;            local second = first + hdr_sec[i].SizeOfRawData;            if ( (rva >= first) and (rva < second ) ) then                foa = hdr_sec[i].PointerToRawData + ( rva - first );                break;            end        end        return foa;    end    --文件偏移转相对偏移    local function FOA2RVA(foa)        local rva = nil;        for i=1, #hdr_sec do            local first = hdr_sec[i].PointerToRawData;            local second = first + hdr_sec[i].SizeOfRawData;            if ( (foa >= first) and (foa < second ) ) then                rva = hdr_sec[i].VirtualAddress + ( foa - first );                break;            end        end        return rva;    end    --读取字符串    local function ReadStringByOffset(offset)        local End = buf:find("\0", offset+1);        return buf:sub(offset+1, End);    end    --读取字符串    local function ReadStringByRVA(rva)        local Offset = RVA2FOA(rva);        return ReadStringByOffset(Offset);    end    --读取字符串    local function ReadBufferByRVA(rva, size)        local Offset = RVA2FOA(rva);        return buf:sub(Offset+1, Offset+size);    end    helper.RVA2FOA = RVA2FOA;    helper.FOA2RVA = FOA2RVA;    helper.ReadStringByOffset = ReadStringByOffset;    helper.ReadStringByRVA = ReadStringByRVA;    helper.ReadBufferByRVA= ReadBufferByRVA;    return offset, hdr, helper;endlocal function DumpExport(buf, header, helper)    local hdr_ddir = header.ddir;    local RVA2FOA = helper.RVA2FOA;    local ReadStringByRVA = helper.ReadStringByRVA;    local ExportSize = hdr_ddir[1].Size;    local ExportAddress = hdr_ddir[1].VirtualAddress;    local Exports = {};    if (ExportAddress>0 and ExportSize>0) then        local offset = RVA2FOA(ExportAddress);        offset, Exports.Characteristics = ReadUInt(buf, offset, 4);        offset, Exports.TimeDateStamp = ReadUInt(buf, offset, 4);        offset, Exports.MajorVersion = ReadUInt(buf, offset, 2);        offset, Exports.MinorVersion = ReadUInt(buf, offset, 2);        offset, Exports.Name = ReadUInt(buf, offset, 4);        offset, Exports.Base = ReadUInt(buf, offset, 4);        offset, Exports.NumberOfFunctions = ReadUInt(buf, offset, 4);        offset, Exports.NumberOfNames = ReadUInt(buf, offset, 4);        offset, Exports.AddressOfFunctions = ReadUInt(buf, offset, 4);        offset, Exports.AddressOfNames = ReadUInt(buf, offset, 4);        offset, Exports.AddressOfNameOrdinals = ReadUInt(buf, offset, 4);        print("Export", ReadStringByRVA(Exports.Name));        Exports.AddressOfNames = RVA2FOA(Exports.AddressOfNames);        Exports.AddressOfFunctions = RVA2FOA(Exports.AddressOfFunctions);        Exports.AddressOfNameOrdinals = RVA2FOA(Exports.AddressOfNameOrdinals);        local mapNumberName = {};        for i=1, Exports.NumberOfNames do            local apiNumber = nil;            offset, apiNumber = ReadUInt(buf, Exports.AddressOfNameOrdinals+(i-1)*2, 2);            apiNumber = apiNumber + Exports.Base;            local apiName = nil;            offset, apiName = ReadUInt(buf, Exports.AddressOfNames+(i-1)*4, 4);            apiName = ReadStringByRVA(apiName);            mapNumberName[apiNumber] = apiName;        end        local tbExports = {};        for i=1, Exports.NumberOfFunctions do            local apiAddress = nil;            offset, apiAddress = ReadUInt(buf, Exports.AddressOfFunctions+(i-1)*4, 4);            local apiNumber = Exports.Base-1 + i;            local apiName = mapNumberName[apiNumber] or "";            if ( apiAddress >= ExportAddress) and (apiAddress < ExportAddress+ExportSize) then                apiAddress = ReadStringByRVA(apiAddress);            end            tbExports[1+#tbExports] = {["index"]=apiNumber, ["name"]=apiName, ["apiFun"]=apiAddress};        end        mapNumberName = nil;        table.sort(tbExports,   function(l,r)                        if (l.name~="" and r.name~="") then                            return l.name < r.name;                        elseif (l.name=="" and r.name=="") then                            return l.index < r.index;                        elseif (l.name~="" and r.name=="") then                            return true;                        elseif (l.name=="" and r.name~="") then                            return false;                        end                    end);        for _,v in ipairs(tbExports) do            if (type(v.apiFun)=="string") then                printf("%16d %24s %-48s", v.index, v.apiFun, v.name);            elseif (v.apiFun ~= 0) then                printf("%16d %24X %-48s", v.index, v.apiFun, v.name);            end        end -- for    end -- if    return Exports;endlocal function DumpImport(buf, header, helper)    local hdr_ddir = header.ddir;    local hdr_opt = header.opt;    local RVA2FOA = helper.RVA2FOA;    local FOA2RVA = helper.FOA2RVA;    local ReadStringByRVA = helper.ReadStringByRVA;    local ReadStringByOffset = helper.ReadStringByOffset;    local ImportSize = hdr_ddir[2].Size;    local ImportAddress = hdr_ddir[2].VirtualAddress;    local offset = RVA2FOA(ImportAddress);    local Imports = {};    repeat        if (ImportAddress<=0) then break; end        if (ImportSize<=0) then break; end        local Import = {};        Imports[#Imports+1] = Import;        offset, Import.Characteristics = ReadUInt(buf, offset, 4);        offset, Import.TimeDateStamp = ReadUInt(buf, offset, 4);        offset, Import.ForwarderChain = ReadUInt(buf, offset, 4);        offset, Import.Name = ReadUInt(buf, offset, 4);        offset, Import.FirstThunk = ReadUInt(buf, offset, 4);        if (0==Import.Name) then break; end        --if (0==Import.Characteristics) then break; end        if (0==Import.FirstThunk) then break; end        print("Import", ReadStringByRVA(Import.Name));        --local offINT = RVA2FOA(Import.Characteristics);        local offIAT = RVA2FOA(Import.FirstThunk);        repeat            local pINT = nil;            local pIAT = nil;            local rvaIAT = FOA2RVA(offIAT);            if (M_Const_Magic[hdr_opt.Magic] == "PE32") then                --offINT, pINT = ReadUInt(buf, offINT, 4);                offIAT, pIAT = ReadUInt(buf, offIAT, 4);            elseif (M_Const_Magic[hdr_opt.Magic] == "PE32+") then                --offINT, pINT = ReadUInt(buf, offINT, 8);                offIAT, pIAT = ReadUInt(buf, offIAT, 8);            else                assert(false);            end            --assert((pINT==0 and pIAT==0) or (pINT~=0 and pIAT~=0));            --if (0 == pINT) then break; end            if (0 == pIAT) then break; end            pINT = pIAT;            if (M_Const_Magic[hdr_opt.Magic] == "PE32") then                if (0 == pINT & 0x80000000) then                    pINT = RVA2FOA(pINT);                    printf("%16X %s", rvaIAT, ReadStringByOffset(pINT+2));                else                    printf("%16X %d", rvaIAT, pINT-0x80000000);                end            elseif (M_Const_Magic[hdr_opt.Magic] == "PE32+") then                if (0 == pINT & 0x8000000000000000) then                    pINT = RVA2FOA(pINT);                    printf("\t%8X\t%s", rvaIAT, ReadStringByOffset(pINT+2));                else                    printf("\t%8X\t%d", rvaIAT, pINT-0x8000000000000000);                end            end        until (false);    until (false);endlocal function parse(pe_filepath)    --读入PE文件    local buf = ReadFile(pe_filepath);    if (not buf) then        error("read fail");    end    local offset, header, helper = DumpHdr(buf);    DumpImport(buf, header, helper);    DumpExport(buf, header, helper);endparse(arg[1]);
0 0