如何解析EXE文件并使用C++和Window.h从IMAGE_DOS_HEADER结构中获取数据？

问题描述：

我试图解析PE文件中的窗口，并从这种结构如何解析EXE文件并使用C++和Window.h从IMAGE_DOS_HEADER结构中获取数据？

IMAGE_DOS_HEADER

我写了这个代码，读取从exe文件字节获取数据。

#include <Windows.h> 

    int main() 
    { 
     // open the file for binary reading 
     std::ifstream file; 
      file.open("D:/SomeProgram.exe", ios_base::binary); 

     if (!file.is_open()) 
      return 1; 

     // get the length of the file 
     file.seekg(0, ios::end); 
     size_t fileSize = file.tellg(); 
     file.seekg(0, ios::beg); 

     // create a vector to hold all the bytes in the file 
     std::vector<byte> data(fileSize, 0); 

     // read the file 
     file.read(reinterpret_cast<char*>(&data[0]), fileSize);

我不知道，如何获得数据，包含e_magic，e_cbip，e_cp ....和最重要的e_ifanew。我知道，这个结构IMAGE_DOS_HEADER存储在Windows.h中，但我不知道如何使用它来从任何exe文件中获取字段。

你为什么想这么做？ – MKR

[PE格式在MSDN上描述]（https://msdn.microsoft.com/en-us/library/windows/desktop/ms680547（v = vs.85）.aspx）。 – VTT

嘿，我在MSDN上看到它，但我怎么能得到特定领域，例如，我想，我的程序显示： e_magic：MZ e_cbip：P ........ e_ifnew：00000100 – Dsdsd

答

声明该结构的实例，并复制数据到它：

IMAGE_DOS_HEADER idh; 

if (fileSize >= sizeof(idh)) 
{ 
    std::memcpy(&idh, &data[0], sizeof(idh)); 
}

嘿，谢谢你的回答，它真的帮助了我！它现在运作良好 – Dsdsd

答

查找下面的过程，从不同的页眉得到的数据：

LPCSTR fileName; //exe file to parse 
HANDLE hFile; 
HANDLE hFileMapping; 
LPVOID lpFileBase; 
PIMAGE_DOS_HEADER dosHeader; 
PIMAGE_NT_HEADERS peHeader; 

hFile = CreateFileA(fileName,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0); 

if(hFile==INVALID_HANDLE_VALUE) 
{ 
    printf("\n CreateFile failed in read mode \n"); 
    return 1; 
} 

hFileMapping = CreateFileMapping(hFile,NULL,PAGE_READONLY,0,0,NULL); 

if(hFileMapping==0) 
{ 
    printf("\n CreateFileMapping failed \n"); 
    CloseHandle(hFile); 
    return 1; 
} 

lpFileBase = MapViewOfFile(hFileMapping,FILE_MAP_READ,0,0,0); 

if(lpFileBase==0) 
{ 
    printf("\n MapViewOfFile failed \n"); 
    CloseHandle(hFileMapping); 
    CloseHandle(hFile); 
    return 1; 
} 

dosHeader = (PIMAGE_DOS_HEADER) lpFileBase; //pointer to dos headers 

if(dosHeader->e_magic==IMAGE_DOS_SIGNATURE) 
{ 
    //if it is executable file print different fileds of structure 
    //dosHeader->e_lfanew : RVA for PE Header 
    printf("\n DOS Signature (MZ) Matched"); 

    //pointer to PE/NT header 
    peHeader = (PIMAGE_NT_HEADERS) ((u_char*)dosHeader+dosHeader->e_lfanew); 

    if(peHeader->Signature==IMAGE_NT_SIGNATURE) 
    { 
     printf("\n PE Signature (PE) Matched \n"); 
     //important fileds 
     //peHeader->FileHeader : Refrence to FileHeader 
     //peHeader->OptionalHeader : Refrence to Optional Header 
     // lots of imprtant fileds are present in File header and Optional header to retrive code/data/different sections address of exe 

    } 

    UnmapViewOfFile(lpFileBase); 
    CloseHandle(hFileMapping); 
    CloseHandle(hFile); 
    return 0; 
} 
else 
{ 
    printf("\n DOS Signature (MZ) Not Matched \n"); 
    UnmapViewOfFile(lpFileBase); 
    CloseHandle(hFileMapping); 
    CloseHandle(hFile); 
    return 1; 
}

答

文件读入到缓冲区，并投下的一部分它作为结构。

// READ FILE ASSUMING IT EXISTS AND IS A VALID PE FILE 
char* buffer = nullptr; 
std::ifstream infile("C:\\file.exe", std::ios::binary); 

std::filebuf* pbuf = infile.rdbuf(); 

size_t size = pbuf->pubseekoff(0, infile.end, infile.in); 

buffer = new char[size]; 

pbuf->pubseekpos(0, infile.in); 
pbuf->sgetn(buffer, size); 

infile.close(); 

// CAST 
IMAGE_DOS_HEADER* MS_DOS = (IMAGE_DOS_HEADER*)buffer; 
IMAGE_NT_HEADERS* PE = (IMAGE_NT_HEADERS*)((DWORD)buffer + MS_DOS->e_lfanew); 

// DO YOUR STUFF 
// ... 

delete[] buffer;

如何解析EXE文件并使用C++和Window.h从IMAGE_DOS_HEADER结构中获取数据？

相关推荐