PE 学习 打印pe格式

// petool.cpp : Defines the entry point for the console application.//#include "stdafx.h"#include <stdlib.h>#include <windows.h>FILE *fp;IMAGE_DOS_HEADER  myDosHeader;IMAGE_FILE_HEADER myFileHeader;IMAGE_OPTIONAL_HEADER myOptionHeader;IMAGE_DATA_DIRECTORY  myDataDir[16];char szname[][50]={        "IMAGE_DIRECTORY_ENTRY_EXPORT",                "IMAGE_DIRECTORY_ENTRY_IMPORT" ,                "IMAGE_DIRECTORY_ENTRY_RESOURCE" ,              "IMAGE_DIRECTORY_ENTRY_EXCEPTION" ,            "IMAGE_DIRECTORY_ENTRY_SECURITY" ,              "IMAGE_DIRECTORY_ENTRY_BASERELOC ",             "IMAGE_DIRECTORY_ENTRY_DEBUG"   ,               "IMAGE_DIRECTORY_ENTRY_ARCHITECTURE ",          "IMAGE_DIRECTORY_ENTRY_GLOBALPTR"  ,            "IMAGE_DIRECTORY_ENTRY_TLS"    ,                "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG" ,          "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT" ,          "IMAGE_DIRECTORY_ENTRY_IAT",                   "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT"  ,         "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",        "Reserved"};    void ShowDosHeader();    void  ShowDosStub();    void ShowFileHeader();    void ShowOptionHeader();    void ShowDatadir();    int main(int argc, char* argv[])    {        printf("欢迎使用PEViewTool\r\n");        puts("请输入一个路径：");        char cfilepath[MAX_PATH]={0};        scanf("%s",&cfilepath);        fflush(stdin);        fp=fopen(cfilepath,"rb");        if (fp==NULL)        {            printf("打开文件失败\r\n");            return -1;        }        //读取pe头         fread(&myDosHeader,sizeof(myDosHeader),1,fp);        //找到pe的标志        fseek(fp,myDosHeader.e_lfanew,SEEK_SET);         fread(&lSig,4,1,fp);        if (myDosHeader.e_magic==IMAGE_DOS_SIGNATURE&&lSig==IMAGE_NT_SIGNATURE)        {            printf("正确有效pe文件\r\n");            ShowDosHeader();            ShowDosStub();            //定位FileHeader            fseek(fp,myDosHeader.e_lfanew+sizeof(lSig),SEEK_SET);            fread(&myFileHeader,sizeof(myFileHeader),1,fp);            ShowFileHeader();            //IMAGE_OPTIONAL_HEADER            fseek(fp,myDosHeader.e_lfanew+sizeof(lSig)+sizeof(myFileHeader),SEEK_SET);            fread(&myOptionHeader,sizeof(myOptionHeader),1,fp);            ShowOptionHeader();        }        else        {            printf("不是有效率的pe\r\n");        }        return 0;    }    //dos头显示    void ShowDosHeader()    {        printf("IMAGE_DOS_HEADER:\r\n");         printf("e_magic   : %04X\r\n",myDosHeader.e_magic);        printf("e_cblp　　: %04x\r\n",myDosHeader.e_cblp);         printf("e_cp　　　: %04X\r\n",myDosHeader.e_cp);         printf("e_crlc　　: %04X\r\n",myDosHeader.e_crlc);         printf("e_cparhdr : %04X\r\n",myDosHeader.e_cparhdr);         printf("e_minalloc: %04X\r\n",myDosHeader.e_minalloc);         printf("e_maXalloc: %04X\r\n",myDosHeader.e_maxalloc);         printf("e_ss　　　: %04X\r\n",myDosHeader.e_ss);         printf("e_sp　　　: %04X\r\n",myDosHeader.e_sp);         printf("e_csum　　: %04X\r\n",myDosHeader.e_csum);         printf("e_ip　　　: %04X\r\n",myDosHeader.e_ip);         printf("e_cs　　　: %04X\r\n",myDosHeader.e_cs);         printf("e_lfarlc　: %04X\r\n",myDosHeader.e_lfarlc);         printf("e_ovno　　: %04X\r\n",myDosHeader.e_ovno);         printf("e_res[0]　: %04X\r\n",myDosHeader.e_res[0]);         printf("e_res[1]　: %04X\r\n",myDosHeader.e_res[1]);         printf("e_res[2]　: %04X\r\n",myDosHeader.e_res[2]);         printf("e_res[3]　: %04X\r\n",myDosHeader.e_res[3]);         printf("e_oemid 　: %04X\r\n",myDosHeader.e_oemid);         printf("e_oeminfo : %04X\r\n",myDosHeader.e_oeminfo);         for (int i=0;i<10;i++)        {            printf("e_res2[%d] : %04X\r\n",i,myDosHeader.e_res2[i]);         }        printf("e_lfanew　: %08X\r\n",myDosHeader.e_lfanew);        puts("-------------------------------------------");    }    //Dos_stub 显示    void ShowDosStub()    {        printf("DOS_Stub:\r\n");         int nSize=myDosHeader.e_lfanew-0x40;        printf("DOS_Stub size %d:\r\n",nSize);         unsigned char nBuf[1000]={0};        fseek(fp,64,SEEK_SET);        fread(nBuf,nSize,1,fp);        printf("DOS_Stub data begin:\r\n");             for(int i=0;i<nSize;i++)        {            printf("%X",nBuf[i]);           }        puts("");        printf("DOS_Stub data end:\r\n");        puts("-------------------------------------------");            }    //文件头显示    void ShowFileHeader()    {        printf("IMAGE_FILE_HEADER Begin:\r\n");         printf("Signature              : %p\r\n",lSig);        printf("Machine                : %04X\r\n",myFileHeader.Machine);        printf("NumberOfSections       : %04X\r\n",myFileHeader.NumberOfSections);        printf("TimeDateStamp          : %08X\r\n",myFileHeader.TimeDateStamp);        printf("PointerToSymbolTable   : %08X\r\n",myFileHeader.PointerToSymbolTable);        printf("NumberOfSymbols        : %08X\r\n",myFileHeader.NumberOfSymbols);        printf("SizeOfOptionalHeader   : %04X\r\n",myFileHeader.SizeOfOptionalHeader);        printf("Characteristics        : %04X\r\n",myFileHeader.Characteristics);        printf("IMAGE_FILE_HEADER End:\r\n");         puts("-------------------------------------------");    }    //可选头显示    void ShowOptionHeader()    {        printf("myOptionHeader Begin:\r\n");         printf("Magic                       : %04X\r\n",myOptionHeader.Magic);        printf("MajorLinkerVersion          : %02X\r\n",myOptionHeader.MajorLinkerVersion);        printf("MinorLinkerVersion          : %02X\r\n",myOptionHeader.MinorLinkerVersion);        printf("SizeOfCode                  : %p\r\n",myOptionHeader.SizeOfCode);        printf("SizeOfInitializedData       : %08X\r\n",myOptionHeader.SizeOfInitializedData);        printf("SizeOfUninitializedData     : %08X\r\n",myOptionHeader.SizeOfUninitializedData);        printf("AddressOfEntryPoint         : %08X\r\n",myOptionHeader.AddressOfEntryPoint);        printf("BaseOfData                  : %08X\r\n",myOptionHeader.BaseOfData);        printf("ImageBase                   : %08X\r\n",myOptionHeader.ImageBase);        printf("SectionAlignment            : %08X\r\n",myOptionHeader.SectionAlignment);        printf("FileAlignment               : %08X\r\n",myOptionHeader.FileAlignment);        printf("MajorOperatingSystemVersion : %04X\r\n",myOptionHeader.MajorOperatingSystemVersion);        printf("MinorOperatingSystemVersion : %04X\r\n",myOptionHeader.MinorOperatingSystemVersion);        printf("MajorImageVersion           : %04X\r\n",myOptionHeader.MajorImageVersion);        printf("MinorImageVersion           : %04X\r\n",myOptionHeader.MinorImageVersion);        printf("MajorSubsystemVersion       : %04X\r\n",myOptionHeader.MajorSubsystemVersion);        printf("MinorSubsystemVersion       : %04X\r\n",myOptionHeader.MinorSubsystemVersion);        printf("Win32VersionValue           : %p\r\n",myOptionHeader.Win32VersionValue);        printf("SizeOfImage                 : %p\r\n",myOptionHeader.SizeOfImage);        printf("SizeOfHeaders               : %p\r\n",myOptionHeader.SizeOfHeaders);        printf("CheckSum                    : %p\r\n",myOptionHeader.CheckSum);        printf("Subsystem                   : %04X\r\n",myOptionHeader.Subsystem);        printf("DllCharacteristics          : %04X\r\n",myOptionHeader.DllCharacteristics);        printf("SizeOfStackReserve          : %p\r\n",myOptionHeader.SizeOfStackReserve);        printf("SizeOfStackCommit           : %p\r\n",myOptionHeader.SizeOfStackCommit);        printf("SizeOfHeapCommit            : %p\r\n",myOptionHeader.SizeOfHeapCommit);        printf("LoaderFlags                 : %p\r\n",myOptionHeader.LoaderFlags        );        printf("NumberOfRvaAndSizes         : %p\r\n",myOptionHeader.NumberOfRvaAndSizes);        puts("-------------------------------------------");        //文件字节定位        int nresult=ftell(fp)-0x80;        fseek(fp,nresult,SEEK_SET);        fread(&myDataDir,sizeof(myDataDir),1,fp);        ShowDatadir();    }    void ShowDatadir()    {        printf("IMAGE_DATA_DIRECTORY Begin:\r\n");        for (int i=0;i<16;i++)        {            printf("\t%s:\t\r\n\t\tVirtualAddress:%p, Size:%p\r\n",szname[i],myDataDir[i].VirtualAddress,myDataDir[i].Size);        }        printf("IMAGE_DATA_DIRECTORY End:\r\n");        puts("-------------------------------------------");        fclose(fp);    }

就是一个简单pe格式查看各各节区没有列举出来