C語(yǔ)言怎么獲得進(jìn)程的PE文件信息
一、打印Sections信息。下面的程序打印出Windows_Graphics_Programming 1.1中第三個(gè)程序“Hello World Version 3:Create a Full-Screen Window"生成的可執(zhí)行文件的Sections結(jié)構(gòu)字節(jié)的信息
#include<stdio.h> #include<windows.h> char *strPath="C:/c1_hwv3/Debug/c1_hwv3.exe"; int main() { IMAGE_DOS_HEADER myDosHeader; LONG e_lfanew; FILE *pFile; pFile=fopen(strPath,"rb+"); fread(&myDosHeader,sizeof(IMAGE_DOS_HEADER),1,pFile); e_lfanew=myDosHeader.e_lfanew; IMAGE_FILE_HEADER myFileHeader; int nSectionCount; fseek(pFile,(e_lfanew+sizeof(DWORD)),SEEK_SET); fread(&myFileHeader,sizeof(IMAGE_FILE_HEADER),1,pFile); nSectionCount=myFileHeader.NumberOfSections; IMAGE_SECTION_HEADER *pmySectionHeader= (IMAGE_SECTION_HEADER *)calloc(nSectionCount,sizeof(IMAGE_SECTION_HEADER)); fseek(pFile,(e_lfanew+sizeof(IMAGE_NT_HEADERS)),SEEK_SET); fread(pmySectionHeader,sizeof(IMAGE_SECTION_HEADER),nSectionCount,pFile); for(int i=0;i<nSectionCount;i++,pmySectionHeader++) { printf("Name: %s\n", pmySectionHeader->Name); printf("union_PhysicalAddress: %08x\n", pmySectionHeader->Misc.PhysicalAddress); printf("union_VirtualSize: %04x\n", pmySectionHeader->Misc.VirtualSize); printf("VirtualAddress: %08x\n", pmySectionHeader->VirtualAddress); printf("SizeOfRawData: %08x\n", pmySectionHeader->SizeOfRawData); printf("PointerToRawData: %04x\n", pmySectionHeader->PointerToRawData); printf("PointerToRelocations: %04x\n", pmySectionHeader->PointerToRelocations); printf("PointerToLinenumbers: %04x\n", pmySectionHeader->PointerToLinenumbers); printf("NumberOfRelocations: %04x\n", pmySectionHeader->NumberOfRelocations); printf("NumberOfLinenumbers: %04x\n", pmySectionHeader->NumberOfLinenumbers); printf("Charateristics: %04x\n", pmySectionHeader->Characteristics); } // pmySectionHeader-=m_nSectionCount; if(pmySectionHeader!=NULL) { free(pmySectionHeader); pmySectionHeader=NULL; } fclose(pFile); return 0; }
運(yùn)行程序打印出如下信息
Name: .text union_PhysicalAddress: 00022350 union_VirtualSize: 22350 VirtualAddress: 00001000 SizeOfRawData: 00023000 PointerToRawData: 1000 PointerToRelocations: 0000 PointerToLinenumbers: 0000 NumberOfRelocations: 0000 NumberOfLinenumbers: 0000 Charateristics: 60000020 Name: .rdata union_PhysicalAddress: 00001615 union_VirtualSize: 1615 VirtualAddress: 00024000 SizeOfRawData: 00002000 PointerToRawData: 24000 PointerToRelocations: 0000 PointerToLinenumbers: 0000 NumberOfRelocations: 0000 NumberOfLinenumbers: 0000 Charateristics: 40000040 Name: .data union_PhysicalAddress: 00005650 union_VirtualSize: 5650 VirtualAddress: 00026000 SizeOfRawData: 00004000 PointerToRawData: 26000 PointerToRelocations: 0000 PointerToLinenumbers: 0000 NumberOfRelocations: 0000 NumberOfLinenumbers: 0000 Charateristics: c0000040 Name: .idata union_PhysicalAddress: 00000b23 union_VirtualSize: 0b23 VirtualAddress: 0002c000 SizeOfRawData: 00001000 PointerToRawData: 2a000 PointerToRelocations: 0000 PointerToLinenumbers: 0000 NumberOfRelocations: 0000 NumberOfLinenumbers: 0000 Charateristics: c0000040 Name: .reloc union_PhysicalAddress: 00000f00 union_VirtualSize: 0f00 VirtualAddress: 0002d000 SizeOfRawData: 00001000 PointerToRawData: 2b000 PointerToRelocations: 0000 PointerToLinenumbers: 0000 NumberOfRelocations: 0000 NumberOfLinenumbers: 0000 Charateristics: 42000040
pe文件結(jié)構(gòu)圖:
時(shí)間,時(shí)間,會(huì)給我答案 time will give me the answer
再給大家分享一則
#include <windows.h> #include <stdio.h> #define MAX_SECTION_NUM 16 #define MAX_IMPDESC_NUM 64 HANDLE hHeap; PIMAGE_DOS_HEADER pDosHeader; PCHAR pDosStub; DWORD dwDosStubSize; DWORD dwDosStubOffset; PIMAGE_NT_HEADERS pNtHeaders; PIMAGE_FILE_HEADER pFileHeader; PIMAGE_OPTIONAL_HEADER32 pOptHeader; PIMAGE_SECTION_HEADER pSecHeaders; PIMAGE_SECTION_HEADER pSecHeader[MAX_SECTION_NUM]; WORD wSecNum; PBYTE pSecData[MAX_SECTION_NUM]; DWORD dwSecSize[MAX_SECTION_NUM]; DWORD dwFileSize; void OutputPEInMem(HANDLE hd) { // 請(qǐng)?jiān)谶@里填入你的代碼 DWORD dwBase; dwBase = (DWORD)hd; pDosHeader = (PIMAGE_DOS_HEADER)dwBase; pNtHeaders = (PIMAGE_NT_HEADERS)(dwBase + pDosHeader->e_lfanew); pOptHeader = &(pNtHeaders->OptionalHeader); pFileHeader = &(pNtHeaders->FileHeader); printf("Address Of Entry Point: 0x%08x\n", pOptHeader->AddressOfEntryPoint); printf("ImageBase: 0x%08x\n", pOptHeader->ImageBase); printf("Number Of Sections: %d\n", pFileHeader->NumberOfSections); printf("Size Of Image: 0x%04x\n", pOptHeader->SizeOfImage); return; } int main(int argc, char *argv[]) { DWORD pid = 0; pid=atoi(argv[1]); HANDLE hd=OpenProcess(PROCESS_ALL_ACCESS,FALSE,pid); LPCSTR lpszFileName = "hello.exe"; LPCSTR lpszInjFileName = "hello_inj0.exe"; OutputPEInMem(hd); hHeap = GetProcessHeap(); if (! CopyPEFileToMem(lpszFileName)) { return 1; } return 0; }
- C語(yǔ)言編寫(xiě)Linux守護(hù)進(jìn)程實(shí)例
- c語(yǔ)言多進(jìn)程tcp服務(wù)器示例
- Linux中使用C語(yǔ)言的fork()函數(shù)創(chuàng)建子進(jìn)程的實(shí)例教程
- 舉例講解C語(yǔ)言的fork()函數(shù)創(chuàng)建子進(jìn)程的用法
- C語(yǔ)言實(shí)現(xiàn)在windows服務(wù)中新建進(jìn)程的方法
- 用c語(yǔ)言實(shí)現(xiàn)HUP信號(hào)重啟進(jìn)程的方法
- Linux下C語(yǔ)言修改進(jìn)程名稱(chēng)的方法
- C語(yǔ)言中設(shè)置進(jìn)程優(yōu)先順序的方法
- C語(yǔ)言中操作進(jìn)程信號(hào)的相關(guān)函數(shù)使用詳解
- Linux下C語(yǔ)言的fork()子進(jìn)程函數(shù)用法及相關(guān)問(wèn)題解析
- C語(yǔ)言中獲取進(jìn)程識(shí)別碼的相關(guān)函數(shù)
- C語(yǔ)言實(shí)現(xiàn)查看進(jìn)程是否存在的方法示例
相關(guān)文章
C語(yǔ)言實(shí)現(xiàn)簡(jiǎn)單的貪吃蛇游戲的示例代碼
這篇文章主要為大家詳細(xì)介紹了C語(yǔ)言如何實(shí)現(xiàn)經(jīng)典貪吃蛇游戲,文中的示例代碼講解詳細(xì),對(duì)我們學(xué)習(xí)C語(yǔ)言有一定的幫助,感興趣的小伙伴可以跟隨小編一起了解一下2023-01-01樹(shù)形結(jié)構(gòu)的3中搜索方式示例分享
樹(shù)的3中常見(jiàn)搜索方式,包括二叉樹(shù)方式(每一層只有0和1)、滿m叉樹(shù)(每一層都有0 到m - 1)、子集樹(shù),也稱(chēng)為全排列樹(shù),需要的朋友可以參考下2014-02-02C語(yǔ)言使用ffmpeg和sdl實(shí)現(xiàn)多路音頻播放
這篇文章主要為大家詳細(xì)介紹了一種基于ffmpeg和sdl實(shí)現(xiàn)的音頻多路混合的方法,文中的示例代碼講解詳細(xì),感興趣的小伙伴可以參考一下2023-06-06C語(yǔ)言文件操作實(shí)現(xiàn)數(shù)據(jù)持久化(幫你快速了解文件操作函數(shù))
持久數(shù)據(jù)其實(shí)就是將數(shù)據(jù)保存到數(shù)據(jù)庫(kù),下面這篇文章主要給大家介紹了關(guān)于C語(yǔ)言文件操作實(shí)現(xiàn)數(shù)據(jù)持久化(幫你快速了解文件操作函數(shù))的相關(guān)資料,文中通過(guò)實(shí)例代碼介紹的非常詳細(xì),需要的朋友可以參考下2022-11-11使用C++中string實(shí)現(xiàn)任意長(zhǎng)度的正小數(shù)、整數(shù)之間加減法方法實(shí)例
這篇文章主要介紹了利用C++中string函數(shù)實(shí)現(xiàn)任意長(zhǎng)度的正小數(shù)、整數(shù)之間加減法方法實(shí)例,文中通過(guò)示例代碼介紹的非常詳細(xì),對(duì)大家具有一定的參考學(xué)習(xí)價(jià)值,需要的朋友們下面跟著小編一起來(lái)學(xué)習(xí)學(xué)習(xí)吧。2017-06-06vc提示unexpected end of file found的原因分析
這篇文章主要介紹了vc提示unexpected end of file found的原因分析,給出了幾點(diǎn)常見(jiàn)錯(cuò)誤原因的分析,需要的朋友可以參考下2015-05-05