#include <Windows.h>
#include <stdio.h>
int main()
{
//调用函数LoadLibrary时返回的模块句柄
//用IMAGE_DOS_HEADER结构体变量指针指向返回的模块句柄
LPCTSTR lpname="C:\\Documents and Settings\\Administrator\\桌面\\魂斗罗4\\魂斗罗4\\gens.exe";
HMODULE hmodule;//调用函数LoadLibrary时返回的模块句柄
hmodule=LoadLibrary(lpname);
IMAGE_DOS_HEADER *image_dos;//dos头
IMAGE_NT_HEADERS *image_nt;//PE头
IMAGE_FILE_HEADER *image_file;//PE文件头
IMAGE_OPTIONAL_HEADER *image_optional;//PE可选文件
IMAGE_SECTION_HEADER *image_se;//数据块
IMAGE_IMPORT_DESCRIPTOR *image_import;//导入表结构体
//以下是为各个结构体分配内存
image_dos=(IMAGE_DOS_HEADER*)malloc(sizeof(hmodule)*1024);//为dos头分配内存
image_nt=(IMAGE_NT_HEADERS*)malloc(sizeof(image_nt)+sizeof(image_file)+sizeof(image_optional)*100);//为PE头分配内存
//以下是计算各个文件的入口
image_dos=(IMAGE_DOS_HEADER*)hmodule;
image_nt=(IMAGE_NT_HEADERS*)((BYTE*)image_dos+image_dos->e_lfanew);//计算PE入口偏移值
image_file=&image_nt->FileHeader;//取得PE文件头的入口地址
image_optional=&image_nt->OptionalHeader;//取得PE可选文件的入口地址
//判断文件是不是可执行文件
if ((image_dos->e_magic!=0x5A4D)&&(image_dos->e_lfanew!=0x4550))
{
printf("这不是一个可执行文件\n");
exit(0);
}
//打印数据
printf("DOS入口：%04X\n",image_dos->e_magic);
printf("PE入口：%08X\n",image_nt->Signature);
printf("CPU类型是：%04X\n",image_file->Machine);
printf("加载的文件类型的签名是：%04X\n",image_optional->Magic);
//为数据段分配内存
image_se=(IMAGE_SECTION_HEADER*)malloc(image_optional->SizeOfCode+image_optional->SizeOfInitializedData+sizeof(image_optional));//分配内存
//计算数据段的入口地址
//dos头加PE入口地址加偏移0x18字节加可选头的大小
image_se=(IMAGE_SECTION_HEADER*)((BYTE*)image_dos+image_dos->e_lfanew+0x18+image_file->SizeOfOptionalHeader);
//打印数据段信息
DWORD dwVirtualAddress;//数据段的RVA
DWORD dwPointerToRawData;//数据段的偏移地址
for (int i=0;i<image_file->NumberOfSections;i++,image_se++)
{
printf("数据表名称:%08s\n",image_se->Name);
printf("数据表真实长度：%08X\n",image_se->Misc.VirtualSize);
printf("数据表的 RVA 地址是:%08X\n",image_se->VirtualAddress);
printf("数据表在文件中对齐后的尺寸是：%08X\n",image_se->SizeOfRawData);
printf("数据表在文件中的偏移量是:%08X\n",image_se->PointerToRawData);
printf("数据表在OBJ文件中使用，重定位的偏移是：%08X\n",image_se->PointerToRelocations);
printf("数据表的偏移（供调试使用地）是:%08X\n",image_se->PointerToLinenumbers);
printf("数据在OBJ文件中使用，重定位项数目是：%04X\n",image_se->NumberOfRelocations);
printf("数据表中行号的数目是:%04X\n",image_se->NumberOfLinenumbers);
printf("数据属性是:%08X\n\n",image_se->Characteristics);
//计算导入表在那段
if (image_optional->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress>image_se->VirtualAddress)
{
dwVirtualAddress=image_se->VirtualAddress;//段的RVA地址
dwPointerToRawData=image_se->PointerToRawData;//段的偏移地址
}
}
//分配导入表信息
image_import=(IMAGE_IMPORT_DESCRIPTOR*)malloc(sizeof(image_import)*1024);
image_import=(IMAGE_IMPORT_DESCRIPTOR*)((BYTE*)image_dos+image_dos->e_magic+image_optional->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress-dwVirtualAddress+dwPointerToRawData);
printf("%08X\n",image_import->Name);
free(image_dos);//释放内存
free(image_nt);//释放内存
free(image_optional);//释放内存
free(image_import);//释放内存
return 0;
}