C語言怎么獲得進(jìn)程的PE文件信息
一、打印Sections信息。下面的程序打印出Windows_Graphics_Programming 1.1中第三個程序“Hello World Version 3:Create a Full-Screen Window"生成的可執(zhí)行文件的Sections結(jié)構(gòu)字節(jié)的信息
#include<stdio.h>
#include<windows.h>
char *strPath="C:/c1_hwv3/Debug/c1_hwv3.exe";
int main()
{
IMAGE_DOS_HEADER myDosHeader;
LONG e_lfanew;
FILE *pFile;
pFile=fopen(strPath,"rb+");
fread(&myDosHeader,sizeof(IMAGE_DOS_HEADER),1,pFile);
e_lfanew=myDosHeader.e_lfanew;
IMAGE_FILE_HEADER myFileHeader;
int nSectionCount;
fseek(pFile,(e_lfanew+sizeof(DWORD)),SEEK_SET);
fread(&myFileHeader,sizeof(IMAGE_FILE_HEADER),1,pFile);
nSectionCount=myFileHeader.NumberOfSections;
IMAGE_SECTION_HEADER *pmySectionHeader=
(IMAGE_SECTION_HEADER *)calloc(nSectionCount,sizeof(IMAGE_SECTION_HEADER));
fseek(pFile,(e_lfanew+sizeof(IMAGE_NT_HEADERS)),SEEK_SET);
fread(pmySectionHeader,sizeof(IMAGE_SECTION_HEADER),nSectionCount,pFile);
for(int i=0;i<nSectionCount;i++,pmySectionHeader++)
{
printf("Name: %s\n", pmySectionHeader->Name);
printf("union_PhysicalAddress: %08x\n", pmySectionHeader->Misc.PhysicalAddress);
printf("union_VirtualSize: %04x\n", pmySectionHeader->Misc.VirtualSize);
printf("VirtualAddress: %08x\n", pmySectionHeader->VirtualAddress);
printf("SizeOfRawData: %08x\n", pmySectionHeader->SizeOfRawData);
printf("PointerToRawData: %04x\n", pmySectionHeader->PointerToRawData);
printf("PointerToRelocations: %04x\n", pmySectionHeader->PointerToRelocations);
printf("PointerToLinenumbers: %04x\n", pmySectionHeader->PointerToLinenumbers);
printf("NumberOfRelocations: %04x\n", pmySectionHeader->NumberOfRelocations);
printf("NumberOfLinenumbers: %04x\n", pmySectionHeader->NumberOfLinenumbers);
printf("Charateristics: %04x\n", pmySectionHeader->Characteristics);
}
// pmySectionHeader-=m_nSectionCount;
if(pmySectionHeader!=NULL)
{
free(pmySectionHeader);
pmySectionHeader=NULL;
}
fclose(pFile);
return 0;
}
運(yùn)行程序打印出如下信息
Name: .text union_PhysicalAddress: 00022350 union_VirtualSize: 22350 VirtualAddress: 00001000 SizeOfRawData: 00023000 PointerToRawData: 1000 PointerToRelocations: 0000 PointerToLinenumbers: 0000 NumberOfRelocations: 0000 NumberOfLinenumbers: 0000 Charateristics: 60000020 Name: .rdata union_PhysicalAddress: 00001615 union_VirtualSize: 1615 VirtualAddress: 00024000 SizeOfRawData: 00002000 PointerToRawData: 24000 PointerToRelocations: 0000 PointerToLinenumbers: 0000 NumberOfRelocations: 0000 NumberOfLinenumbers: 0000 Charateristics: 40000040 Name: .data union_PhysicalAddress: 00005650 union_VirtualSize: 5650 VirtualAddress: 00026000 SizeOfRawData: 00004000 PointerToRawData: 26000 PointerToRelocations: 0000 PointerToLinenumbers: 0000 NumberOfRelocations: 0000 NumberOfLinenumbers: 0000 Charateristics: c0000040 Name: .idata union_PhysicalAddress: 00000b23 union_VirtualSize: 0b23 VirtualAddress: 0002c000 SizeOfRawData: 00001000 PointerToRawData: 2a000 PointerToRelocations: 0000 PointerToLinenumbers: 0000 NumberOfRelocations: 0000 NumberOfLinenumbers: 0000 Charateristics: c0000040 Name: .reloc union_PhysicalAddress: 00000f00 union_VirtualSize: 0f00 VirtualAddress: 0002d000 SizeOfRawData: 00001000 PointerToRawData: 2b000 PointerToRelocations: 0000 PointerToLinenumbers: 0000 NumberOfRelocations: 0000 NumberOfLinenumbers: 0000 Charateristics: 42000040
pe文件結(jié)構(gòu)圖:
時間,時間,會給我答案 time will give me the answer
再給大家分享一則
#include <windows.h>
#include <stdio.h>
#define MAX_SECTION_NUM 16
#define MAX_IMPDESC_NUM 64
HANDLE hHeap;
PIMAGE_DOS_HEADER pDosHeader;
PCHAR pDosStub;
DWORD dwDosStubSize;
DWORD dwDosStubOffset;
PIMAGE_NT_HEADERS pNtHeaders;
PIMAGE_FILE_HEADER pFileHeader;
PIMAGE_OPTIONAL_HEADER32 pOptHeader;
PIMAGE_SECTION_HEADER pSecHeaders;
PIMAGE_SECTION_HEADER pSecHeader[MAX_SECTION_NUM];
WORD wSecNum;
PBYTE pSecData[MAX_SECTION_NUM];
DWORD dwSecSize[MAX_SECTION_NUM];
DWORD dwFileSize;
void OutputPEInMem(HANDLE hd)
{
// 請?jiān)谶@里填入你的代碼
DWORD dwBase;
dwBase = (DWORD)hd;
pDosHeader = (PIMAGE_DOS_HEADER)dwBase;
pNtHeaders = (PIMAGE_NT_HEADERS)(dwBase + pDosHeader->e_lfanew);
pOptHeader = &(pNtHeaders->OptionalHeader);
pFileHeader = &(pNtHeaders->FileHeader);
printf("Address Of Entry Point: 0x%08x\n", pOptHeader->AddressOfEntryPoint);
printf("ImageBase: 0x%08x\n", pOptHeader->ImageBase);
printf("Number Of Sections: %d\n", pFileHeader->NumberOfSections);
printf("Size Of Image: 0x%04x\n", pOptHeader->SizeOfImage);
return;
}
int main(int argc, char *argv[])
{
DWORD pid = 0;
pid=atoi(argv[1]);
HANDLE hd=OpenProcess(PROCESS_ALL_ACCESS,FALSE,pid);
LPCSTR lpszFileName = "hello.exe";
LPCSTR lpszInjFileName = "hello_inj0.exe";
OutputPEInMem(hd);
hHeap = GetProcessHeap();
if (! CopyPEFileToMem(lpszFileName)) {
return 1;
}
return 0;
}
上一篇:詳解C++中的增量運(yùn)算符++和減量運(yùn)算符--的用法
欄 目:C語言
本文標(biāo)題:C語言怎么獲得進(jìn)程的PE文件信息
本文地址:http://www.jygsgssxh.com/a1/Cyuyan/2589.html
您可能感興趣的文章
- 04-02c語言函數(shù)調(diào)用后清空內(nèi)存 c語言調(diào)用函數(shù)刪除字符
- 04-02c語言的正則匹配函數(shù) c語言正則表達(dá)式函數(shù)庫
- 04-02func函數(shù)+在C語言 func函數(shù)在c語言中
- 04-02c語言中對數(shù)函數(shù)的表達(dá)式 c語言中對數(shù)怎么表達(dá)
- 04-02c語言用函數(shù)寫分段 用c語言表示分段函數(shù)
- 04-02c語言編寫函數(shù)冒泡排序 c語言冒泡排序法函數(shù)
- 04-02c語言沒有round函數(shù) round c語言
- 04-02c語言分段函數(shù)怎么求 用c語言求分段函數(shù)
- 04-02C語言中怎么打出三角函數(shù) c語言中怎么打出三角函數(shù)的值
- 04-02c語言調(diào)用函數(shù)求fibo C語言調(diào)用函數(shù)求階乘


閱讀排行
本欄相關(guān)
- 04-02c語言函數(shù)調(diào)用后清空內(nèi)存 c語言調(diào)用
- 04-02func函數(shù)+在C語言 func函數(shù)在c語言中
- 04-02c語言的正則匹配函數(shù) c語言正則表達(dá)
- 04-02c語言用函數(shù)寫分段 用c語言表示分段
- 04-02c語言中對數(shù)函數(shù)的表達(dá)式 c語言中對
- 04-02c語言編寫函數(shù)冒泡排序 c語言冒泡排
- 04-02c語言沒有round函數(shù) round c語言
- 04-02c語言分段函數(shù)怎么求 用c語言求分段
- 04-02C語言中怎么打出三角函數(shù) c語言中怎
- 04-02c語言調(diào)用函數(shù)求fibo C語言調(diào)用函數(shù)求
隨機(jī)閱讀
- 08-05dedecms(織夢)副欄目數(shù)量限制代碼修改
- 01-10delphi制作wav文件的方法
- 01-11ajax實(shí)現(xiàn)頁面的局部加載
- 04-02jquery與jsp,用jquery
- 01-10使用C語言求解撲克牌的順子及n個骰子
- 08-05織夢dedecms什么時候用欄目交叉功能?
- 01-10C#中split用法實(shí)例總結(jié)
- 01-10SublimeText編譯C開發(fā)環(huán)境設(shè)置
- 08-05DEDE織夢data目錄下的sessions文件夾有什
- 01-11Mac OSX 打開原生自帶讀寫NTFS功能(圖文


