BOOL ReadFileToMem(HANDLE hFile,LPVOID ImageBase)
{
PIMAGE_FILE_HEADER pFH=NULL;
PIMAGE_SECTION_HEADER pSH=NULL;
PIMAGE_NT_HEADERS pNtH=NULL;
LPDWORD lpNumberOfBytsRead=0;
DWORD SizeOfImage=0; //内存中整个PE映像尺寸
DWORD SizeOfHeader=0; //PE头大小
DWORD MapOfFile=0; //申请所得内存的基址
DWORD SectionAlignment=0; //内存中的块对齐粒度
if (!hFile)
return FALSE;
pFH=GetFileHeader(ImageBase); //得到文件头指针(PE头中的文件头)
if(!pFH)
return FALSE;
pNtH=GetNtHeaders(ImageBase); //取得PE文件头
if(!pNtH)
return FALSE;
SizeOfImage = pNtH->OptionalHeader.SizeOfImage;
MapOfFile=(DWORD)VirtualAlloc(NULL,SizeOfImage,MEM_COMMIT,PAGE_READWRITE); //申请内存
if(!MapOfFile)
MessageBox(hwnd,"内存分配失败!","mypack",MB_OK);
//取PE头大小,读入PE头
SizeOfHeader = pNtH->OptionalHeader.SizeOfHeaders;
SetFilePointer(hFile,0,NULL,FILE_BEGIN);
ReadFile(hFile,(LPDWORD)MapOfFile,SizeOfHeader,lpNumberOfBytsRead, NULL);
pNtH->OptionalHeader.FileAlignment=0x200; //文件中的块对齐粒度 (默认的就是0x200)
SectionAlignment = pNtH->OptionalHeader.SectionAlignment;
pSH = GetFirstSectionHeader(ImageBase); //得到第一个区块表的指针
for(int i=0;i<pFH->NumberOfSections;i++)
{
SetFilePointer(hFile,pSH->PointerToRawData,NULL,FILE_BEGIN);
ReadFile(hFile,(LPDWORD)(MapOfFile+pSH->VirtualAddress),pSH->SizeOfRawData,lpNumberOfBytsRead,NULL);
//对区块映像大小对齐
pSH->Misc.VirtualSize=GetIntegral(pSH->Misc.VirtualSize,SectionAlignment);
pSH++; //指向下一区块.
}
//对整个文件大小对齐
pNtH->OptionalHeader.SizeOfImage = GetIntegral(SizeOfImage,SectionAlignment);
return TRUE;
}
我欲将文件读入内存,调试到ReadFile时出现0xC0000005: Access Violation.
错误.我定义MapOfFile为DWORD,传入ReadFile时显示转换为(LPDWORD)是否正确?
不转换出现cannot convert parameter 2 from 'unsigned long' to 'void *'
Conversion from integral type to pointer type requires reinterpret_cast, C-style cast or function-style cast
Error executing cl.exe.
错误.
哪位前辈看看问题在哪?
[课程]Linux pwn 探索篇！
