#define WIN32_LEAN_AND_MEAN
[ATTACH]53940[/ATTACH]
#include <windows.h>
#include <commdlg.h>
#include "1.h"
PIMAGE_FILE_HEADER	pFileHeadera = NULL;
PIMAGE_OPTIONAL_HEADER	pOptionHeader = NULL;
BOOL  IsPeFile(LPVOID  ImageBase)   //判断是否是PE文件结构

{
  PIMAGE_DOS_HEADER  pDosHeader = NULL;  //定义IMAGE_DOS_HEADER结构变量
  PIMAGE_NT_HEADERS  pNtHeader  = NULL;  //定义IMAGE_NT_HEADERS结构变量
  if(!ImageBase)    //判断映像基址，映像基址由下面的MapViewOfFile函数传入进来
    return FALSE;
  pDosHeader = (PIMAGE_DOS_HEADER) ImageBase; //转换ImageBase为PIMAGE_DOS_HEADER结构变量类型
  if(pDosHeader->e_magic != IMAGE_DOS_SIGNATURE)  //指向IMAGE_DOS_HEADER结构变量中的e_magic成员，e_magic是0x5A4D,名为IMAGE_DOS_SIGNATURE
    return FALSE;
  pNtHeader = (PIMAGE_NT_HEADERS32)((DWORD)pDosHeader+pDosHeader->e_lfanew); //从IMAGE_DOS_HEADER结构变量中找到e_lfanew成员里面的起始偏移量和加上映像基址得到PE文件头的指针
  if(pNtHeader->Signature != IMAGE_NT_SIGNATURE ) //指向IMAGE_NT_HEADERS结构变量中的Signature成员,Signature是0x4550,名为IMAGE_NT_SIGNATURE
    return  FALSE;
  return    TRUE;
}
PIMAGE_NT_HEADERS	GetNtHeader(LPVOID	ImageBase) //PE头由3部分组成，IMAGE_NT_HEADERS，IMAGE_FILE_HEADER和IMAGE_OPTIONAL_HEADER组成。
{
	PIMAGE_DOS_HEADER	pDosHeader = NULL;
	PIMAGE_NT_HEADERS	pNtHeader  = NULL;

	if(!IsPeFile(ImageBase))
		return	NULL;
	pDosHeader = (PIMAGE_DOS_HEADER)ImageBase;                                 //上面有注释，自己观看
	pNtHeader = (PIMAGE_NT_HEADERS32)((DWORD)pDosHeader+pDosHeader->e_lfanew);     //上面有注释，自己观看
	return		pNtHeader;
}

PIMAGE_FILE_HEADER	WINAPI	GetFileHeader(LPVOID	Imagebase)
{
	PIMAGE_FILE_HEADER	pFileHeader;   //PIMAGE_FILE_HEADER类型同下面注释的IMAGE_FILE_HEADER结构类型
	PIMAGE_NT_HEADERS	pNtHeader = NULL;
	pNtHeader = GetNtHeader(Imagebase);
	if(!pNtHeader)
		return	NULL;
	pFileHeader = & pNtHeader->FileHeader; 
	return	pFileHeader;
}
//参见这个结构
// typedef struct _IMAGE_NT_HEADERS {
    // DWORD Signature;
    // IMAGE_FILE_HEADER FileHeader;
    // IMAGE_OPTIONAL_HEADER32 OptionalHeader;
// } IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;这两个FileHeader和OptionalHeader成员都被定义了类型，所以返回的类型为就是这个定义的类型
PIMAGE_OPTIONAL_HEADER	GetOptionalHeader(LPVOID	ImageBase)
{
	PIMAGE_OPTIONAL_HEADER	pOptionHeader = NULL;  // PIMAGE_OPTIONAL_HEADER32 类型同上面注释中的类型，这里名字不一样是因为有一个typedef，typedef PIMAGE_OPTIONAL_HEADER32  PIMAGE_OPTIONAL_HEADER;
	PIMAGE_NT_HEADERS	pNtHeader = NULL;
	pNtHeader = GetNtHeader(ImageBase);
	if(!pNtHeader)
		return	NULL;
	pOptionHeader = & pNtHeader->OptionalHeader;
	return	pOptionHeader;
}
void OpenFileA(HWND hwnd)
{   HANDLE hFile;
	HANDLE hMapping;
	LPVOID ImageBase;
	char         szFileName[MAX_PATH] = {0};
    TCHAR	     Buff[100];
	OPENFILENAME ofn;
    ZeroMemory(&ofn, sizeof(OPENFILENAME));	                    
	ofn.lStructSize  = sizeof(OPENFILENAME);
	ofn.lpstrFile	 = szFileName;
	ofn.nMaxFile     = MAX_PATH;
	ofn.lpstrFilter  = "Exe Files(*.exe)\0*.exe\0All Files(*.*)\0*.*\0\0";
	ofn.nFilterIndex = 1;
	if( !GetOpenFileName(&ofn) )
	{ 
		Sleep(1000);
	}
	wsprintf(Buff,"%s",ofn.lpstrFile);
	SetDlgItemText(hwnd,IDE_Edit,Buff);
    hFile=CreateFile(szFileName,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0);//创建文件
	if (!hFile){;}
    hMapping=CreateFileMapping(hFile,NULL,PAGE_READONLY,0,0,NULL); //创建文件映像
	if(!hMapping)
	{									
		CloseHandle(hFile);
	}
	ImageBase=MapViewOfFile(hMapping,FILE_MAP_READ,0,0,0); //映射文件基址
    if(!ImageBase)
	{									
		CloseHandle(hMapping);
		CloseHandle(hFile);
	}
	if(!IsPeFile(ImageBase))
	{
		MessageBox(hwnd,"不是PE文件!","提示信息",MB_ICONERROR);
		return ;
	}
	else
	pFileHeadera = GetFileHeader(ImageBase);
	pOptionHeader = GetOptionalHeader(ImageBase);
	if(!(pFileHeadera&&pOptionHeader))
	{
	    MessageBox(hwnd,"获取文件头失败","PEINFO",MB_ICONERROR);
		return ;
	}
	wsprintf(Buff,"%08lX",pFileHeadera->Machine);  //IMAGE_FILE_HEADER结构内容读取，下面一样，具体观看http://bbs.pediy.com/showthread.php?t=100823 
	SetDlgItemText(hwnd,IDE_Machine,Buff);
	wsprintf(Buff,"%08lX",pFileHeadera->NumberOfSections);
	SetDlgItemText(hwnd,IDE_NumberOfSections,Buff);
	wsprintf(Buff,"%08lX",pFileHeadera->TimeDateStamp);
	SetDlgItemText(hwnd,IDE_TimeDateStamp,Buff);
	wsprintf(Buff,"%08lX",pFileHeadera->PointerToSymbolTable);
	SetDlgItemText(hwnd,IDE_PointerToSymbolTable,Buff);
	wsprintf(Buff,"%08lX",pFileHeadera->NumberOfSymbols);
	SetDlgItemText(hwnd,IDE_NumberOfSymbols,Buff);
	wsprintf(Buff,"%08lX",pFileHeadera->SizeOfOptionalHeader);
	SetDlgItemText(hwnd,IDE_SizeOfOptionalHeader,Buff);
	wsprintf(Buff,"%08lX",pFileHeadera->Characteristics);
	SetDlgItemText(hwnd,IDE_Characteristics,Buff);
}
BOOL CALLBACK DialogProc(HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
    switch(uMsg)
    {
        case WM_INITDIALOG:
            return TRUE;

        case WM_CLOSE:
            DestroyWindow(hwndDlg);
            return TRUE;
        case WM_COMMAND:
            switch(LOWORD(wParam))
            {
                case 4003:
                    OpenFileA(hwndDlg);
                    return FALSE;
				case 4005:
					return FALSE;


            }
    }

    return FALSE;
}
int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
{
	WNDCLASSEX wcx;
    wcx.cbSize = sizeof(wcx);
	wcx.hInstance = hInstance;
    wcx.hIcon = LoadIcon(hInstance, MAKEINTRESOURCE(IDI_ICON));
	wcx.hIconSm = LoadIcon(hInstance, MAKEINTRESOURCE(IDI_ICON));
    // The user interface is a modal dialog box
    return DialogBox(hInstance, MAKEINTRESOURCE(1001), NULL, DialogProc);
}