#include "stdafx.h"
#include <Windows.h>
#include <stdio.h>
#include <assert.h>

#define TEST(n) (n>>31)&0x1

int main(int argc, char* argv[])
{
  char szFile[MAX_PATH]="";
  GetModuleFileName(NULL,szFile,MAX_PATH);
  FILE *fp=fopen(szFile,"rb");
  assert(fp!=NULL);
  
  IMAGE_DOS_HEADER dosHeader;
  assert(fread(&dosHeader,sizeof dosHeader,1,fp)!=-1);

  fseek(fp,dosHeader.e_lfanew,SEEK_SET);
  IMAGE_NT_HEADERS ntHeaders;
  assert(fread(&ntHeaders,sizeof ntHeaders,1,fp)!=-1);

  DWORD RsAddr=ntHeaders.OptionalHeader.DataDirectory[2].VirtualAddress;
  DWORD RsRealAddr=0;
  
  //获取资源在文件中实际偏移量  
  IMAGE_SECTION_HEADER sectionHeader;
  for (int i=0;i<ntHeaders.FileHeader.NumberOfSections;++i)
  {
    assert(fread(§ionHeader,sizeof sectionHeader,1,fp)!=-1);
    char szName[9];
    memset(szName,0,9);
    memcpy(szName,sectionHeader.Name,8);
    puts(szName);
    if (RsAddr>=sectionHeader.VirtualAddress&&
      RsAddr<sectionHeader.VirtualAddress+sectionHeader.SizeOfRawData)
    {
      RsRealAddr=RsAddr-sectionHeader.VirtualAddress+sectionHeader.PointerToRawData;
      printf("res fileaddr:0x%x\n",RsRealAddr);
    }
  }
  //

  fseek(fp,RsRealAddr,SEEK_SET);
loop:
  IMAGE_RESOURCE_DIRECTORY resDir;
  IMAGE_RESOURCE_DIRECTORY_ENTRY resDirEntry;
  assert(fread(&resDir,sizeof resDir,1,fp)!=-1);
  assert(fread(&resDirEntry,sizeof resDirEntry,1,fp)!=-1);
  if (TEST(resDirEntry.OffsetToData))
  {
    DWORD nextPoint=resDirEntry.OffsetToData&0x7fff;
    fseek(fp,RsRealAddr+nextPoint,SEEK_SET);
    goto loop; 
  }
  else
  {
    fseek(fp,RsRealAddr+resDirEntry.OffsetToData,SEEK_SET);
    IMAGE_RESOURCE_DATA_ENTRY resDataEntry;
    assert(fread(&resDataEntry,sizeof resDataEntry,1,fp)!=-1);
    printf("res size:%d\n",resDataEntry.Size);
    printf("res offset:0x%x\n",resDataEntry.OffsetToData);
  }
  fclose(fp);
  getchar();
  return 0;
}

[课程]FART 脱壳王！加量不加价！FART作者讲授！