PeTools开发(五)

A- A+
流沙团 • • C/C++ • 4250View 0

功能:

01:展示输出表信息

02: 展示输入表信息

03:资源表信息

04:重定位表信息

05:绑定导入表信息


难点:

01: 定义全局变量, 区别每个点击按钮, 使用一个对话框,分别对消息进行接收

02: 读取PE信息, 对每个表的信息进行展示

03: 字符串的使用方法 sprintf  strcat  的用法

04 SendMessage


实例展示:

360截图20171224232343740.jpg


主要代码:


view source
print?
001VOID SetPeFileInfo(HWND hwndDlg,LPSTR lpszFile)
002{
003    HWND hInfoMation = GetDlgItem(hwndDlg,IDC_EDIT_INFOMATION);
004    TCHAR InfoStr[200240]={0};
005    TCHAR rn[100] = {0};
006     
007    LPVOID pFileBuffer = NULL;
008    pFileBuffer= ReadPEFile(lpszFile);
009    if(!pFileBuffer)
010    {
011        printf("文件读取失败\n");
012        return;
013    }
014 
015    PIMAGE_DOS_HEADER pDosHeader = NULL;
016    PIMAGE_NT_HEADERS pNTHeader = NULL;
017    PIMAGE_FILE_HEADER pPEHeader = NULL;
018    PIMAGE_OPTIONAL_HEADER32 pOptionHeader = NULL;
019    PIMAGE_SECTION_HEADER pSectionHeader = NULL;
020    PIMAGE_DATA_DIRECTORY DataDirectory=NULL;
021     
022    //Header信息
023    pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;
024    pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pFileBuffer+pDosHeader->e_lfanew);
025    pPEHeader = (PIMAGE_FILE_HEADER)(((DWORD)pNTHeader)+4);
026    pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pPEHeader+IMAGE_SIZEOF_FILE_HEADER);
027    pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader+pPEHeader->SizeOfOptionalHeader);
028 
029    //定位Directory_Data;
030    DataDirectory = pOptionHeader->DataDirectory;
031    DWORD FoA = 0;
032 
033    /*
034    TCHAR rn[100] = TEXT("www.gyarmy.com");
035    sprintf(InfoStr,"\r\n%d\r\n%d\r\n%d",InfoNum,InfoNum,InfoNum);
036    strcat(InfoStr,rn);
037    SendMessage(hInfoMation,WM_SETTEXT,0,(long)InfoStr);
038    */
039     
040    switch(InfoNum)
041    {
042    case INFO_EXPORT:
043        {  
044             
045            //确定导出表信息
046            //printf("%x \n",FoA);
047            DWORD Export_Directory_Address = DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
048            DWORD Export_Directory_Size = DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size;
049             
050            if(Export_Directory_Size == 0)
051            {
052                haveDirectory = FALSE;
053                MessageBox(0,TEXT("没有输出表"),TEXT("错误"),0);
054                return;
055            }else{
056                haveDirectory = TRUE;
057 
058            }
059 
060            FoA = RVAToFileOffset(pFileBuffer,Export_Directory_Address);
061            //定位导出表的位置
062            PIMAGE_EXPORT_DIRECTORY pExDirectory = NULL;
063            pExDirectory = (PIMAGE_EXPORT_DIRECTORY)((DWORD)pFileBuffer + FoA);
064             
065            //基本信息
066            sprintf(rn,"输出表基本信息 : \r\n");
067            strcat(InfoStr,rn);
068 
069            sprintf(rn,"Characteristics: %08X\r\n",pExDirectory->Characteristics);
070            strcat(InfoStr,rn);
071            sprintf(rn,"TimeDateStamp: %08X\r\n",pExDirectory->TimeDateStamp);
072            strcat(InfoStr,rn);
073            sprintf(rn,"MajorVersion: %08X\r\n",pExDirectory->MajorVersion);
074            strcat(InfoStr,rn);
075            sprintf(rn,"MinorVersion: %08X\r\n",pExDirectory->MinorVersion);
076            strcat(InfoStr,rn);
077            sprintf(rn,"Name: %08X\r\n",pExDirectory->Name);
078            strcat(InfoStr,rn);
079            sprintf(rn,"Base: %08X\r\n",pExDirectory->Base);
080            strcat(InfoStr,rn);
081            sprintf(rn,"NumberOfFunctions: %08X\r\n",pExDirectory->NumberOfFunctions);
082            strcat(InfoStr,rn);
083            sprintf(rn,"NumberOfNames: %08X\r\n",pExDirectory->NumberOfNames);
084            strcat(InfoStr,rn);
085            sprintf(rn,"AddressOfFunctions: %08X\r\n",pExDirectory->AddressOfFunctions);
086            strcat(InfoStr,rn);
087            sprintf(rn,"AddressOfNames: %08X\r\n",pExDirectory->AddressOfNames);
088            strcat(InfoStr,rn);
089            sprintf(rn,"AddressOfNameOrdinals: %08X\r\n-------------\r\n",pExDirectory->AddressOfNameOrdinals);
090            strcat(InfoStr,rn);
091     
092            //输出函数地址表信息
093            //AddressOfFunctions
094            DWORD ExAddressOfFunctions = pExDirectory->AddressOfFunctions;
095            DWORD ExAddressOfFunctionsFoA = RVAToFileOffset(pFileBuffer,ExAddressOfFunctions);
096            DWORD ExNumberOfFunctions = pExDirectory->NumberOfFunctions;
097             
098            PDWORD pExAddressOfFunctions = NULL;
099            pExAddressOfFunctions = (PDWORD)((DWORD)pFileBuffer + ExAddressOfFunctionsFoA);
100 
101             
102            sprintf(rn,"每个函数地址表信息: \r\n");
103            strcat(InfoStr,rn);
104 
105            //输出每个函数地址表信息
106            DWORD k =0;
107            for(k=0;k<ExNumberOfFunctions;k++)
108            {
109                //printf("%d : %x \n",k,);
110                sprintf(rn,"%d : %08X\r\n",k,*pExAddressOfFunctions);
111                strcat(InfoStr,rn);
112 
113                pExAddressOfFunctions++;
114            }
115            sprintf(rn,"-----------------\r\n");
116            strcat(InfoStr,rn);
117 
118             
119            sprintf(rn,"函数名称表: \r\n");
120            strcat(InfoStr,rn);
121 
122            //函数名称表
123            DWORD ExAddressOfNames = pExDirectory->AddressOfNames;
124            DWORD ExAddressOfNamesFoA = RVAToFileOffset(pFileBuffer,ExAddressOfNames);
125            DWORD ExNumberOfNames = pExDirectory->NumberOfNames;
126             
127            PDWORD pExAddressOfNames = NULL;
128            pExAddressOfNames = (PDWORD)((DWORD)pFileBuffer + ExAddressOfNamesFoA);
129 
130            for(k=0;k<ExNumberOfNames;k++)
131            {
132                //printf("%d : %x   \n",k,*pExAddressOfNames);
133                 
134                sprintf(rn,"%d : %08X\r\n",k,*pExAddressOfNames);
135                strcat(InfoStr,rn);
136 
137                //函数名的地址转换为FoA ，输出函数名
138                PDWORD NameAddress = (PDWORD)RVAToFileOffset(pFileBuffer,*pExAddressOfNames);
139                //输出函数名
140                printf("%s \n",(char*)((DWORD)pFileBuffer + (DWORD)NameAddress));
141 
142                sprintf(rn,"%s \r\n",(char*)((DWORD)pFileBuffer + (DWORD)NameAddress));
143                strcat(InfoStr,rn);
144 
145                pExAddressOfNames++;
146            }
147 
148            sprintf(rn,"-----------------\r\n");
149            strcat(InfoStr,rn);
150 
151             
152            //函数序号表
153 
154            sprintf(rn,"函数序号表: \r\n");
155            strcat(InfoStr,rn);
156             
157            DWORD ExAddressOfNameOrdinals = pExDirectory->AddressOfNameOrdinals;
158            DWORD ExAddressOfNameOrdinalsFoA = RVAToFileOffset(pFileBuffer,ExAddressOfNameOrdinals);
159            ExNumberOfNames = pExDirectory->NumberOfNames;
160            PWORD pExAddressOfNameOrdinals = NULL;
161            pExAddressOfNameOrdinals = (PWORD)((DWORD)pFileBuffer + ExAddressOfNameOrdinalsFoA);
162 
163            for(k=0;k<ExNumberOfNames;k++)
164            {
165                //printf("%d : %x   \n",k,*pExAddressOfNameOrdinals);  
166                sprintf(rn,"%d : %08X \r\n",k,*pExAddressOfNameOrdinals);
167                strcat(InfoStr,rn);
168 
169                pExAddressOfNameOrdinals++;
170            }
171 
172 
173            sprintf(rn,"-----------------\r\n");
174            strcat(InfoStr,rn);
175            SendMessage(hInfoMation,WM_SETTEXT,0,(long)InfoStr);
176 
177            break;
178        }
179    case INFO_IMPORT:
180        {
181            //基本信息
182            //sprintf(rn,"%d : %08X \r\n",k,*pExAddressOfNameOrdinals);
183 
184             
185 
186            sprintf(rn,"输入表基本信息 : \r\n");
187            strcat(InfoStr,rn);
188 
189            //确定导入表
190            //pImportDirectory = NULL;
191            IMAGE_DATA_DIRECTORY pImportDirectory = DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
192             
193            DWORD ImportVirtualAddress = pImportDirectory.VirtualAddress;
194            DWORD ImportFoa = RVAToFileOffset(pFileBuffer,ImportVirtualAddress);
195             
196            if(pImportDirectory.Size == 0)
197            {
198                haveDirectory = FALSE;
199                MessageBox(0,TEXT("没有输入表"),TEXT("错误"),0);
200                return;
201            }else{
202                haveDirectory = TRUE;
203 
204            }
205             
206            sprintf(rn,"ImportVirtualAddress: %08X \r\n",ImportVirtualAddress);
207            strcat(InfoStr,rn);
208            sprintf(rn,"Size: %08X \r\n",pImportDirectory.Size);
209            strcat(InfoStr,rn);
210            sprintf(rn,"ImportFoa: %08X \r\n",ImportFoa);
211            strcat(InfoStr,rn);
212 
213            //输出所有的导入表
214            //PIMAGE_THUNK_DATA32 pThunkData = NULL;
215            //第一个导入表
216            PIMAGE_IMPORT_DESCRIPTOR pImportDes = NULL;
217            pImportDes = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD)pFileBuffer + ImportFoa);
218             
219            while(pImportDes->OriginalFirstThunk != 0x0 && pImportDes->FirstThunk != 0x0 )
220            {
221                //输出所有的dll
222                sprintf(rn,"OriginalFirstThunk: %08X \r\n",pImportDes->OriginalFirstThunk);
223                strcat(InfoStr,rn);
224                DWORD pNameAddress =  RVAToFileOffset(pFileBuffer,pImportDes->Name);
225                PSTR pDllName = (PSTR)((DWORD)pFileBuffer + pNameAddress);
226                 
227                sprintf(rn,"name: %s \r\n",pDllName);
228                strcat(InfoStr,rn);
229                sprintf(rn,"------------------------------- : \r\n");
230                strcat(InfoStr,rn);
231                //输出OriginalFirstThunk的信息
232                DWORD Thunk_Address = RVAToFileOffset(pFileBuffer,pImportDes->OriginalFirstThunk);
233                PIMAGE_THUNK_DATA32 pThunkData = (PIMAGE_THUNK_DATA32)((DWORD)pFileBuffer + Thunk_Address);
234                 
235                //根据pThunkData 的最高为来判断
236                DWORD ImportOrdinal = pThunkData->u1.Ordinal;
237                while(ImportOrdinal)
238                {
239                    //输出所有所有的信息
240                    //#define IMAGE_ORDINAL_FLAG32 0x80000000
241                    if(ImportOrdinal & IMAGE_ORDINAL_FLAG32)
242                    {
243                        sprintf(rn,"按序号导入: %08X \r\n",ImportOrdinal&0x0FFF);
244                        strcat(InfoStr,rn);
245                    }else
246                    {
247                        DWORD ImageNameAddress  = RVAToFileOffset(pFileBuffer,ImportOrdinal);
248                        PIMAGE_IMPORT_BY_NAME pImageName = (PIMAGE_IMPORT_BY_NAME)(DWORD(pFileBuffer)+ImageNameAddress);
249                        //printf("按名字导入:%x - %s \n",pImageName->Hint,pImageName->Name);
250                        sprintf(rn,"按名字导入: %08X  -- %s \r\n",pImageName->Hint,pImageName->Name);
251                        strcat(InfoStr,rn);
252                    }
253                    //向下移动
254                    pThunkData = (PIMAGE_THUNK_DATA32)((DWORD)pThunkData + 4);
255                    ImportOrdinal = pThunkData->u1.Ordinal;
256                }
257 
258                sprintf(rn,"------------------------------- : \r\n");
259                strcat(InfoStr,rn);
260                //printf("FirstThunk:%x \n",pImportDes->FirstThunk);
261                DWORD pFirstThunk = (DWORD)pImportDes->FirstThunk;
262                printf("FirstThunk:%x \n",pImportDes->FirstThunk);
263                 
264                sprintf(rn,"FirstThunk:%08X \r\n",pImportDes->FirstThunk);
265                strcat(InfoStr,rn);
266                sprintf(rn,"------------------------------- : \r\n");
267                strcat(InfoStr,rn);
268                 
269                DWORD FirstThunk_Address = RVAToFileOffset(pFileBuffer,pFirstThunk);
270                PIMAGE_THUNK_DATA32 pNewThunkData = (PIMAGE_THUNK_DATA32)((DWORD)pFileBuffer + FirstThunk_Address);
271 
272                 
273                DWORD newImportOrdinal = pNewThunkData->u1.Ordinal;
274 
275                while(newImportOrdinal)
276                {
277                    //输出所有所有的信息
278                    //#define IMAGE_ORDINAL_FLAG32 0x80000000
279                    if(newImportOrdinal & IMAGE_ORDINAL_FLAG32)
280                    {
281                        //printf("按序号导入:%x\n",newImportOrdinal&0x0FFF);
282                        sprintf(rn,"按序号导入:%08X \r\n",newImportOrdinal&0x0FFF);
283                        strcat(InfoStr,rn);
284 
285                    }else
286                    {
287                        DWORD newImageNameAddress  = RVAToFileOffset(pFileBuffer,newImportOrdinal);
288                        PIMAGE_IMPORT_BY_NAME pNewImageName = (PIMAGE_IMPORT_BY_NAME)(DWORD(pFileBuffer)+newImageNameAddress);
289                        //printf("按名字导入:%x - %s \n",pNewImageName->Hint,pNewImageName->Name);
290                        sprintf(rn,"按名字导入::%08X - %s  \r\n",pNewImageName->Hint,pNewImageName->Name);
291                        strcat(InfoStr,rn);
292 
293                    }
294                    //向下移动
295                    pNewThunkData = (PIMAGE_THUNK_DATA32)((DWORD)pNewThunkData + 4);
296                    newImportOrdinal = pNewThunkData->u1.Ordinal;
297                }
298                 
299                 
300                sprintf(rn,"-------------------------------  \r\n");
301                strcat(InfoStr,rn);
302                pImportDes = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD)pImportDes + 20);
303 
304                //getchar();
305            }
306             
307            SendMessage(hInfoMation,WM_SETTEXT,0,(long)InfoStr);
308            break;
309        }
310 
311    case INFO_RES:
312        {
313            sprintf(rn,"资源表基本信息 : \r\n");
314            strcat(InfoStr,rn);
315 
316            IMAGE_DATA_DIRECTORY ResourceDirectory = DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE];
317     
318            DWORD ResourceVirtualAddress = ResourceDirectory.VirtualAddress;
319            DWORD ResourceSize = ResourceDirectory.Size;
320 
321            if(ResourceSize== 0)
322            {
323                haveDirectory = FALSE;
324                MessageBox(0,TEXT("没有资源表"),TEXT("错误"),0);
325                return;
326            }else{
327                haveDirectory = TRUE;
328 
329            }
330 
331            sprintf(rn,"ResourceVirtualAddress :%08X \r\n",ResourceVirtualAddress);
332            strcat(InfoStr,rn);
333            sprintf(rn,"ResourceSize :%08X \r\n",ResourceSize);
334            strcat(InfoStr,rn);
335 
336            DWORD dwFoa = RVAToFileOffset(pFileBuffer,ResourceVirtualAddress);
337            PIMAGE_RESOURCE_DIRECTORY  pResource = (PIMAGE_RESOURCE_DIRECTORY)((DWORD)pFileBuffer + dwFoa);
338             
339            //输出PIMAGE_RESOURCE_DIRECTORY 的信息
340 
341            sprintf(rn,"NumberOfNamedEntries :%08X \r\n",pResource->NumberOfNamedEntries);
342            strcat(InfoStr,rn);
343            sprintf(rn,"NumberOfIdEntries :%08X \r\n",pResource->NumberOfIdEntries);
344            strcat(InfoStr,rn);
345 
346            //第一层类型的解析
347            //第一个资源表
348            PIMAGE_RESOURCE_DIRECTORY_ENTRY pResdirectoryEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((DWORD)pResource + sizeof(IMAGE_RESOURCE_DIRECTORY));
349            DWORD NumberOfResType  =  pResource->NumberOfNamedEntries + pResource->NumberOfIdEntries;
350 
351            //找到图标资源
352            PIMAGE_RESOURCE_DIRECTORY pResICODir=NULL;
353             
354 
355            for(DWORD i=0;i<NumberOfResType;i++)
356            {
357                //解析内容:
358                DWORD NameIsString = pResdirectoryEntry->NameIsString;
359                DWORD ResName = pResdirectoryEntry->Name;
360                DWORD OffsetToData = pResdirectoryEntry->OffsetToData;
361                DWORD DataIsDirectory = pResdirectoryEntry->DataIsDirectory;
362                 
363                //printf("Info: %d -NameIsString: %d - Name: %x -- OffToDa: %x - IsD - %d \n",i+1,
364                //NameIsString,ResName,OffsetToData,DataIsDirectory);
365                sprintf(rn,"Info: %08X -NameIsString: %08X - Name: %08X -- OffToDa: %08X :  IsD - %08X \r\n",i+1,NameIsString,ResName,OffsetToData,DataIsDirectory);
366                strcat(InfoStr,rn);
367 
368                if(ResName == 0x3)
369                {
370                    //PIMAGE_RESOURCE_DIRECTORY  pResource = (PIMAGE_RESOURCE_DIRECTORY)((DWORD)pFileBuffer + dwFoa);
371                    pResICODir = (PIMAGE_RESOURCE_DIRECTORY)((DWORD)pResource +pResdirectoryEntry->OffsetToDirectory);
372                    break;
373                }
374 
375                pResdirectoryEntry  = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((DWORD)pResdirectoryEntry + 8);
376            }
377             
378            //确定图标的地址，找第二层
379            DWORD NumberOffICO = pResICODir->NumberOfIdEntries + pResICODir->NumberOfNamedEntries;
380            //printf("NumberOffICO : %d \n",NumberOffICO);
381            sprintf(rn,"NumberOffICO :%08X \r\n",NumberOffICO);
382            strcat(InfoStr,rn);
383             
384            //第一个图标描述
385            PIMAGE_RESOURCE_DIRECTORY_ENTRY pICOEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((DWORD)pResICODir + sizeof(IMAGE_RESOURCE_DIRECTORY));
386             
387            PIMAGE_RESOURCE_DIRECTORY pICOContent = NULL;
388 
389            for(DWORD j = 0;j<NumberOffICO;j++)
390            {
391                //解析内容:
392                DWORD NameIsString = pICOEntry->NameIsString;
393                DWORD ResName = pICOEntry->Name;
394                DWORD OffsetToData = pICOEntry->OffsetToData;
395                DWORD DataIsDirectory = pICOEntry->DataIsDirectory;
396                 
397                //printf("Info: %d -NameIsString: %d - Name: %x -- OffToDa: %x - IsD - %d \n",i+1,
398                //  NameIsString,ResName,OffsetToData,DataIsDirectory);
399 
400                sprintf(rn,"Info: %d -NameIsString: %d - Name: %08X -- OffToDa: %08X - IsD - %08X \n",i+1,
401                    NameIsString,ResName,OffsetToData,DataIsDirectory);
402                strcat(InfoStr,rn);
403             
404                //依次解析页码表
405                pICOContent = (PIMAGE_RESOURCE_DIRECTORY)((DWORD)pResource +pICOEntry->OffsetToDirectory);
406                //页码表解析
407                DWORD NumberOfICOContent = pICOContent->NumberOfIdEntries + pICOContent->NumberOfNamedEntries;
408                //printf("NumberOfICOContent: %d \n",NumberOfICOContent);
409                sprintf(rn,"NumberOfICOContent :%08X \r\n",NumberOfICOContent);
410                strcat(InfoStr,rn);
411 
412                //图标测试只有一个，不循环测试
413                //找到关键点:
414                PIMAGE_RESOURCE_DIRECTORY_ENTRY pICOGetVS =  (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((DWORD)pICOContent + sizeof(IMAGE_RESOURCE_DIRECTORY));
415                //找到图标资源的VistrualAddress 和 Size
416                PIMAGE_DATA_DIRECTORY pDataIco = (PIMAGE_DATA_DIRECTORY)((DWORD)pResource + pICOGetVS->OffsetToDirectory);
417                //输出每个图标信息
418                //printf("VirtualAddress: %x, Size: %x \n",pDataIco->VirtualAddress,pDataIco->Size);
419                sprintf(rn,"VirtualAddress: %08X, Size: %08X \n",pDataIco->VirtualAddress,pDataIco->Size);
420                strcat(InfoStr,rn);
421                pICOEntry  = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((DWORD)pICOEntry + 8);
422            }
423            SendMessage(hInfoMation,WM_SETTEXT,0,(long)InfoStr);
424            break;
425        }
426         
427    case INFO_RELOC:
428        {
429            sprintf(rn,"重定位表的基本信息 : \r\n");
430            strcat(InfoStr,rn);
431 
432            DWORD BaseReloc_Directory_Address = DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress;
433            DWORD BaseReloc_Directory_Size = DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size;
434            FoA = RVAToFileOffset(pFileBuffer,BaseReloc_Directory_Address);
435             
436            if(BaseReloc_Directory_Size == 0)
437            {
438                haveDirectory = FALSE;
439                MessageBox(0,TEXT("没有重定位表"),TEXT("错误"),0);
440                return;
441            }else{
442                haveDirectory = TRUE;
443 
444            }
445 
446            //定位到第一个重定位块
447            PIMAGE_BASE_RELOCATION pRelocData = (PIMAGE_BASE_RELOCATION)((DWORD)pFileBuffer + FoA);
448             
449            //输出所有的标信息
450            while(pRelocData->VirtualAddress||pRelocData->SizeOfBlock)
451            {
452                DWORD RelocVirtualAddress = pRelocData->VirtualAddress;
453                DWORD RelocSize = pRelocData->SizeOfBlock;
454 
455                sprintf(rn,"VirtualSize: %08X ,Size: %08X , Number: %08X  \r\n",RelocVirtualAddress,RelocSize,(RelocSize-8)/2);
456                strcat(InfoStr,rn);
457                 
458                int k = (RelocSize-8)/2;
459                PWORD pMyRelocAddress = NULL;
460                pMyRelocAddress = (PWORD)((DWORD)pRelocData+8);
461                 
462                for(int i=0;i<k;i++)
463                {
464                    //printf();
465                    sprintf(rn,"第%04X个 : 标志 : %08X 偏移 : %08X\r\n",i+1,pMyRelocAddress[i]&0xF000,RelocVirtualAddress+(pMyRelocAddress[i]&0x0FFF));
466                    strcat(InfoStr,rn);
467                }
468                pRelocData = (PIMAGE_BASE_RELOCATION)((DWORD)pRelocData + RelocSize);
469            }
470 
471            SendMessage(hInfoMation,WM_SETTEXT,0,(long)InfoStr);
472            break;
473        }
474    case INFO_BIND:
475        {
476            sprintf(rn,"绑定导入表的基本信息 : \r\n");
477            strcat(InfoStr,rn);
478 
479            IMAGE_DATA_DIRECTORY pBindImportDirectory = DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT];
480     
481            DWORD BindImportVirtualAddress = pBindImportDirectory.VirtualAddress;
482            DWORD BindImportFoa = BindImportVirtualAddress;
483 
484            PIMAGE_BOUND_IMPORT_DESCRIPTOR pBindImport = (PIMAGE_BOUND_IMPORT_DESCRIPTOR)((DWORD)pFileBuffer + BindImportFoa);
485 
486            if(pBindImportDirectory.Size == 0)
487            {
488                haveDirectory = FALSE;
489                MessageBox(0,TEXT("没有绑定导入表"),TEXT("错误"),0);
490                return;
491            }else{
492                haveDirectory = TRUE;
493 
494            }
495 
496 
497            while(pBindImport->TimeDateStamp !=0x0)
498            {
499                //输出第一个绑定
500                DWORD bindTime = pBindImport->TimeDateStamp;
501                WORD ModuleName = pBindImport->OffsetModuleName;
502                WORD numberModule = pBindImport->NumberOfModuleForwarderRefs;
503                 
504                //输出名字
505                PSTR pModuleName = (PSTR)((DWORD)pFileBuffer+(DWORD)BindImportVirtualAddress+ModuleName);
506 
507                sprintf(rn,"ModuleName:%s \r\n",pModuleName);
508                strcat(InfoStr,rn);
509                //printf("ModuleName:%s \n",pModuleName);
510                //printf("--numberModule:%x \n",numberModule);
511                sprintf(rn,"--numberModule:%08X \r\n",numberModule);
512                strcat(InfoStr,rn);
513 
514                for(int i=0;i<numberModule;i++)
515                {
516                    PIMAGE_BOUND_FORWARDER_REF pBoundRef = (PIMAGE_BOUND_FORWARDER_REF)((DWORD)pBindImport+i*8);
517                    pBindImport =  (PIMAGE_BOUND_IMPORT_DESCRIPTOR)((DWORD)pBindImport+i*8);
518 
519                    //输出名字
520                    DWORD refTime = pBoundRef->TimeDateStamp;
521                    WORD refName = pBoundRef->OffsetModuleName;
522                    PSTR pRefName = (PSTR)((DWORD)pFileBuffer+(DWORD)BindImportVirtualAddress+refName);
523                    //printf("        RefName:%s \r\n",pRefName);
524                    sprintf(rn,"        RefName:%s \r\n",pRefName);
525                    strcat(InfoStr,rn);
526                }
527 
528                pBindImport =  (PIMAGE_BOUND_IMPORT_DESCRIPTOR)((DWORD)pBindImport+8);
529            }
530 
531            SendMessage(hInfoMation,WM_SETTEXT,0,(long)InfoStr);
532            break;
533        }
534    case INFO_IAT:
535        {
536            sprintf(rn,"绑定导入表的基本信息 : \r\n");
537            strcat(InfoStr,rn);
538             
539            sprintf(rn,"测试使用，未实现 : \r\n");
540            strcat(InfoStr,rn);
541            SendMessage(hInfoMation,WM_SETTEXT,0,(long)InfoStr);
542            break;
543        }
544 
545    }
546     
547     
548    //释放内存
549    free(pFileBuffer);
550}



原文链接： PeTools开发(五) 版权所有，转载时请注明出处，违者必究。
注明出处格式：流沙团 ( http://www.gyarmy.com/?post=343 )

发表评论

0则评论给“PeTools开发(五)”