【原创&交流】PE文件格式的一些研究 - VC/MFC / 基础类

/*!* @brief tString类主要是为了兼容unicode字符集和多字节字符集***/#ifdef UNICODE#define tString  std::wstring#else#define tString  std::string #endif/*! @struct stImportDll* @brief 导入的DLL的信息结构体***/struct stImportDll{/* @brief 导入的DLL名***/tString m_strDllName;/* @brief 导入的DLL中的函数***/std::vector m_vecStrFunname; //};/*!*  @brief KPEFile类构造函数**  @param [in]strBinPath exe文件全路径，主要是获取DOS部首和PE文件头的位置*  \return*/KPEFile::KPEFile( tString strBinPath ){DWORD dwRead = 0;m_pModule = NULL;// 打开exe文件    HANDLE hFile = CreateFile(strBinPath.c_str(), //PE文件名        GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);if(hFile == INVALID_HANDLE_VALUE){return;}// 获取文件大小    DWORD dwSize = GetFileSize(hFile,NULL);if (dwSize == 0xFFFFFFFF){return ;}// 开辟读取缓冲区    m_pModule = (LPBYTE)VirtualAlloc( NULL,dwSize,MEM_COMMIT,PAGE_READWRITE);// 读取文件    ReadFile(hFile,m_pModule,dwSize,&dwRead,NULL);if( dwRead != dwSize)return ;// 关闭文件    CloseHandle(hFile);// 获取DOS部首和PE文件头的位置    m_pDosHeader = (PIMAGE_DOS_HEADER)m_pModule;m_pNTHeader = (PIMAGE_NT_HEADERS)(m_pModule + m_pDosHeader->e_lfanew);}/*!*  @brief 由虚拟地址获取偏移距离**  @param [in]VirtualAddr 虚拟地址*  \return*/DWORD KPEFile::VirtualToRaw(DWORD VirtualAddr){int i;PIMAGE_SECTION_HEADER pSectionHeader = (PIMAGE_SECTION_HEADER)((LPBYTE)m_pNTHeader + sizeof(IMAGE_NT_HEADERS));for( i = 0; i < m_pNTHeader->FileHeader.NumberOfSections; i++){if (VirtualAddr >= pSectionHeader->VirtualAddress&& VirtualAddr < pSectionHeader->VirtualAddress + pSectionHeader->Misc.VirtualSize)return pSectionHeader->PointerToRawData + (DWORD)VirtualAddr - (DWORD)pSectionHeader->VirtualAddress;pSectionHeader ++;}return 0;}/*!*  @brief 获取所有的导入表**  @param [in]vecImportDll 导入的DLL的信息结构体*  \return*/BOOL KPEFile::GetAllImportSymbol(std::vector &vecImportDll){if((m_pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress==0)||(m_pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size==0))return FALSE;DWORD ITableRAoffset = VirtualToRaw(m_pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);PIMAGE_IMPORT_DESCRIPTOR pImport = (PIMAGE_IMPORT_DESCRIPTOR)(m_pModule+ITableRAoffset);if (pImport==NULL)return FALSE;DWORD Nameoffset ;DWORD OFToffset ;DWORD Funcoffset;while((Nameoffset = VirtualToRaw(pImport->Name))!= 0){stImportDll ImportDll;LPCSTR szDllName = reinterpret_cast(m_pModule + Nameoffset);#ifdef UNICODETCHAR szwszDllName[MAX_PATH];::MultiByteToWideChar(CP_ACP,MB_PRECOMPOSED,szDllName,-1,szwszDllName,MAX_PATH);ImportDll.m_strDllName = szwszDllName;#elseImportDll.m_strDllName = szDllName;#endifPIMAGE_THUNK_DATA32 pThunk;OFToffset = VirtualToRaw(pImport->OriginalFirstThunk);pThunk = (PIMAGE_THUNK_DATA)(m_pModule + OFToffset);for (int i = 0;pThunk->u1.Function;i++){if (pThunk->u1.Ordinal&IMAGE_ORDINAL_FLAG32){// 按序号导入不予处理             break;}else{PIMAGE_IMPORT_BY_NAME pFuncName;Funcoffset = VirtualToRaw(pThunk->u1.AddressOfData);pFuncName = (PIMAGE_IMPORT_BY_NAME)(m_pModule + Funcoffset);#ifdef UNICODETCHAR szwFunctionName[MAX_PATH];::MultiByteToWideChar(CP_ACP,MB_PRECOMPOSED,reinterpret_cast(pFuncName->Name),-1,szwFunctionName,MAX_PATH);tString strFuncname = szwFunctionName;ImportDll.m_vecStrFunname.push_back(strFuncname);#elsetString strFuncname = reinterpret_cast(pFuncName->Name);ImportDll.m_vecStrFunname.push_back(strFuncname);#endif}pThunk++;}vecImportDll.push_back(ImportDll);pImport++;}return TRUE;}