打印PE输出表的信息

测试打印PE输出表信息

主要是RVA 和 FOA 之间的转换要注意, 单独写了一个函数进行转换

转换函数

DWORD RVAToFileOffset(LPVOID pFileBuffer,DWORD dwRva)
{
	PIMAGE_DOS_HEADER pDosHeader = NULL;
	PIMAGE_NT_HEADERS pNTHeader = NULL;
	PIMAGE_FILE_HEADER pPEHeader = NULL;
	PIMAGE_OPTIONAL_HEADER32 pOptionHeader = NULL;
	PIMAGE_SECTION_HEADER pSectionHeader = NULL;
	
	if(!pFileBuffer)
	{
		printf("文件读取失败\n");
		return NULL;
	}

	//Header信息
	pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;
	pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pFileBuffer+pDosHeader->e_lfanew);
	pPEHeader = (PIMAGE_FILE_HEADER)(((DWORD)pNTHeader)+4);
	pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pPEHeader+IMAGE_SIZEOF_FILE_HEADER);
	pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader+pPEHeader->SizeOfOptionalHeader);

	DWORD ImageSize = pOptionHeader->SizeOfImage;
	int Section_Number = pPEHeader->NumberOfSections;
	int i=0;
	for(i=0;i<Section_Number;i++)
	{
		printf("VirualSize : %x\n",pSectionHeader->Misc);
		printf("VirualAddress: %x\n",pSectionHeader->VirtualAddress);
		
		DWORD dumpVirualSize = pSectionHeader->Misc.VirtualSize;
		DWORD dumpVirualAddress = pSectionHeader->VirtualAddress;

		if(dwRva>=dumpVirualAddress && dwRva <=dumpVirualAddress+dumpVirualSize)
		{
			printf("地址在第:%d 节 %s \n",i+1,pSectionHeader->Name);
			break;
		}
		//下一个节表
		pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pSectionHeader+40);
	}
	
	//确定是第i+1节
	//确定偏移距离
	DWORD fileOff = pSectionHeader->PointerToRawData + (dwRva-pSectionHeader->VirtualAddress);

	return fileOff;
}

实际代码

void TestExportDirectory(LPSTR lpszFile)
{
	LPVOID pFileBuffer = NULL;
	pFileBuffer= ReadPEFile(lpszFile);
	if(!pFileBuffer)
	{
		printf("文件读取失败\n");
		return;
	}

	PIMAGE_DOS_HEADER pDosHeader = NULL;
	PIMAGE_NT_HEADERS pNTHeader = NULL;
	PIMAGE_FILE_HEADER pPEHeader = NULL;
	PIMAGE_OPTIONAL_HEADER32 pOptionHeader = NULL;
	PIMAGE_SECTION_HEADER pSectionHeader = NULL;
	PIMAGE_DATA_DIRECTORY DataDirectory=NULL;
	
	//Header信息
	pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;
	pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pFileBuffer+pDosHeader->e_lfanew);
	pPEHeader = (PIMAGE_FILE_HEADER)(((DWORD)pNTHeader)+4);
	pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pPEHeader+IMAGE_SIZEOF_FILE_HEADER);
	pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader+pPEHeader->SizeOfOptionalHeader);

	//定位Directory_Data;
	DataDirectory = pOptionHeader->DataDirectory;
	
	//导出表

	printf("IMAGE_DIRECTORY_ENTRY_EXPORT: Address: %x ,Size: %x \n",DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress,
		DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size);

	//DWORD RVAToFileOffset(LPVOID pFileBuffer,DWORD dwRva)
	DWORD FoA = RVAToFileOffset(pFileBuffer,0x2df10);
	//printf("%x \n",FoA);

	DWORD Export_Directory_Address = DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
	DWORD Export_Directory_Size = DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size;
	FoA = RVAToFileOffset(pFileBuffer,Export_Directory_Address);

	/*
	typedef struct _IMAGE_EXPORT_DIRECTORY {
		DWORD   Characteristics;
		DWORD   TimeDateStamp;
		WORD    MajorVersion;
		WORD    MinorVersion;
		DWORD   Name;					//指向该导出表文件名字符串
		DWORD   Base;					//导出函数起始序号
		DWORD   NumberOfFunctions;		//所有导出函数的个数
		DWORD   NumberOfNames;			//以函数名字导出的函数个数	
		DWORD   AddressOfFunctions;     // 导出函数地址表 RVA
		DWORD   AddressOfNames;         // 导出函数名称表 RVA
		DWORD   AddressOfNameOrdinals;  // 导出函数序号表 RVA
	} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;
	*/
	
	//定位导出表的位置

	PIMAGE_EXPORT_DIRECTORY pExDirectory = NULL;
	pExDirectory = (PIMAGE_EXPORT_DIRECTORY)((DWORD)pFileBuffer + FoA);

	printf("Characteristics: %x\n",pExDirectory->Characteristics);
	printf("TimeDateStamp: %x\n",pExDirectory->TimeDateStamp);
	printf("MajorVersion: %x\n",pExDirectory->MajorVersion);
	printf("MinorVersion: %x\n",pExDirectory->MinorVersion);
	printf("Name: %x\n",pExDirectory->Name);
	printf("Base: %x\n",pExDirectory->Base);
	printf("NumberOfFunctions: %x\n",pExDirectory->NumberOfFunctions);
	printf("NumberOfNames: %x\n",pExDirectory->NumberOfNames);
	printf("AddressOfFunctions: %x\n",pExDirectory->AddressOfFunctions);
	printf("AddressOfNames: %x\n",pExDirectory->AddressOfNames);
	printf("AddressOfNameOrdinals: %x\n",pExDirectory->AddressOfNameOrdinals);
	
	printf("------------------------\n");
	//输出函数地址表信息
	//AddressOfFunctions
	DWORD ExAddressOfFunctions = pExDirectory->AddressOfFunctions;
	DWORD ExAddressOfFunctionsFoA = RVAToFileOffset(pFileBuffer,ExAddressOfFunctions);
	DWORD ExNumberOfFunctions = pExDirectory->NumberOfFunctions;
	
	PDWORD pExAddressOfFunctions = NULL;
	pExAddressOfFunctions = (PDWORD)((DWORD)pFileBuffer + ExAddressOfFunctionsFoA);

	//输出每个函数地址表信息
	DWORD k =0;
	for(k=0;k<ExNumberOfFunctions;k++)
	{
		printf("%d : %x \n",k,*pExAddressOfFunctions);
		pExAddressOfFunctions++;
	}
	printf("------------------------\n");
	//函数名称表
	DWORD ExAddressOfNames = pExDirectory->AddressOfNames;
	DWORD ExAddressOfNamesFoA = RVAToFileOffset(pFileBuffer,ExAddressOfNames);
	DWORD ExNumberOfNames = pExDirectory->NumberOfNames;
	
	PDWORD pExAddressOfNames = NULL;
	pExAddressOfNames = (PDWORD)((DWORD)pFileBuffer + ExAddressOfNamesFoA);

	for(k=0;k<ExNumberOfNames;k++)
	{
		printf("%d : %x   \n",k,*pExAddressOfNames);
		//函数名的地址转换为FoA ，输出函数名
		PDWORD NameAddress = (PDWORD)RVAToFileOffset(pFileBuffer,*pExAddressOfNames);
		//输出函数名
		printf("%s \n",(char*)((DWORD)pFileBuffer + (DWORD)NameAddress));
		pExAddressOfNames++;
	}
	
	//函数序号表
	printf("------------------------\n");
	DWORD ExAddressOfNameOrdinals = pExDirectory->AddressOfNameOrdinals;
	DWORD ExAddressOfNameOrdinalsFoA = RVAToFileOffset(pFileBuffer,ExAddressOfNameOrdinals);
	ExNumberOfNames = pExDirectory->NumberOfNames;
	
	PWORD pExAddressOfNameOrdinals = NULL;
	pExAddressOfNameOrdinals = (PWORD)((DWORD)pFileBuffer + ExAddressOfNameOrdinalsFoA);


	for(k=0;k<ExNumberOfNames;k++)
	{
		printf("%d : %x   \n",k,*pExAddressOfNameOrdinals);
		pExAddressOfNameOrdinals++;
	}

}

我写代码比较随意, 不好看,见谅, 明天要去考试科目一了, 今天早点睡觉!!

其实关键在于 理解PE结构,  然后 会对字节进行读写!!!