PE文件是Portable Executable的简称，最近一直在看一些手动脱壳的书籍，但是这些书籍普遍存在一个问题是没有一个完整的代码，于是我想在以后的学习过程中和看雪上的各位兄弟姐妹一起共勉之，我们大家把这些不完善的地方给完善，把支离破碎的代码整合成可运行的代码，希望对以后探索的人提供一个更顺利的起点。
下面是我的读取PE文件的代码，由于水平有限，实现相对比较简单，里面有些特殊的定义，请参见winnt.h中的定义，查看方法是使用C-Free或者其他编辑器，右键点击转到定义处。
其实里面很多的定义都是使用C语言的简单的结构，指针，结构体，只不过是名称变了变，所以我们也能够去做Windows操作系统的，呵呵，是吧？ 废话不说了，请见读取PE文件信息代码：
有些定义不明白的比如CreateFile，请参看WIN32.HLP文档
#include <stdio.h>
#include <windows.h>
//参数是传入文件的路径 读取文件中的DOS_HEADER部分的内容已经实现
BOOL aNalyticsPeFile(LPCSTR szFilePath){
HANDLE hFile;
hFile=CreateFile(szFilePath,GENERIC_READ,FILE_SHARE_READ,0,OPEN_EXISTING,FILE_ATTRIBUTE_READONLY,0);
IMAGE_DOS_HEADER dos_header[sizeof(IMAGE_DOS_HEADER)];
DWORD cdReader;
if(ReadFile(hFile,dos_header,sizeof(IMAGE_DOS_HEADER),&cdReader,NULL)==FALSE)
{
printf("ERROR!Not PE File");
}
if(dos_header->e_magic!=IMAGE_DOS_SIGNATURE){printf("Not Pe!");}
/*
读取dos_header文件头
*/
printf("->Dos_Header\n");
printf("e_cblp:");
printf("%x",dos_header->e_cblp);printf("\n");
printf("e_cp:");
printf("%x",dos_header->e_cp);printf("\n");
printf("e_cparhdr:");
printf("%x",dos_header->e_cparhdr);printf("\n");
printf("e_crlc:");
printf("%x",dos_header->e_crlc);printf("\n");
printf("e_cs:");
printf("%x",dos_header->e_cs);printf("\n");
printf("e_csum:");
printf("%x",dos_header->e_csum);printf("\n");
printf("e_ip:");
printf("%x",dos_header->e_ip);printf("\n");
printf("e_lfanew:");
printf("%x",dos_header->e_lfanew);printf("\n");
printf("e_lfarlc:");
printf("%x",dos_header->e_lfarlc);printf("\n");
printf("e_magic:");
printf("%x",dos_header->e_magic);printf("\n");
printf("e_maxalloc:");
printf("%x",dos_header->e_maxalloc);printf("\n");
printf("e_minalloc:");
printf("%x",dos_header->e_minalloc);printf("\n");
printf("e_oemid:");
printf("%x",dos_header->e_oemid);printf("\n");
printf("e_oeminfo:");
printf("%x",dos_header->e_oeminfo);printf("\n");
printf("e_ovno:");
printf("%x",dos_header->e_ovno);printf("\n");
printf("e_res:");
printf("%x",dos_header->e_res);printf("\n");
printf("e_res2:");
printf("%x",dos_header->e_res2);printf("\n");
printf("e_sp:");
printf("%x",dos_header->e_sp);printf("\n");
printf("e_ss:");
printf("%x",dos_header->e_ss);printf("\n");
/*
读取nt_header文件头
*/
SetFilePointer(hFile,dos_header->e_lfanew,NULL,FILE_BEGIN);
IMAGE_NT_HEADERS nt_header[sizeof(IMAGE_NT_HEADERS)];
DWORD cp;
ReadFile(hFile,nt_header,sizeof(nt_header),&cp,NULL);
printf("\n->NT_Header\n");
printf("The FileHeader is %x \n",nt_header->FileHeader);
printf("The OptionalHeader is %x \n",nt_header->OptionalHeader);
printf("The Signature is %x \n",nt_header->Signature);
/*
读取file_header文件头
*/
printf("\n->file_header\n");
printf("The Characteristics is %x \n",nt_header->FileHeader.Characteristics);
printf("The Machine is %x \n",nt_header->FileHeader.Machine);
printf("The NumberOfSections is %x \n",nt_header->FileHeader.NumberOfSections);
printf("The NumberOfSymbols is %x \n",nt_header->FileHeader.NumberOfSymbols);
printf("The PointerToSymbolTable is %x \n",nt_header->FileHeader.PointerToSymbolTable);
printf("The SizeOfOptionalHeader is %x \n",nt_header->FileHeader.SizeOfOptionalHeader);
printf("The TimeDateStamp is %x \n",nt_header->FileHeader.TimeDateStamp);
/*
读取option_header文件头
*/
printf("\n->option_header\n");
printf("The AddressOfEntryPoint is %x \n",nt_header->OptionalHeader.AddressOfEntryPoint);
printf("The SizeOfStackReserve is %x \n",nt_header->OptionalHeader.SizeOfStackReserve);
printf("The BaseOfCode is %x \n",nt_header->OptionalHeader.BaseOfCode);
printf("The BaseOfData is %x \n",nt_header->OptionalHeader.BaseOfData);
printf("The Magic is %x \n",nt_header->OptionalHeader.Magic);
printf("The MajorLinkerVersion is %x \n",nt_header->OptionalHeader.MajorLinkerVersion);
printf("The MinorLinkerVersion is %x \n",nt_header->OptionalHeader.MinorLinkerVersion);
printf("The MinorLinkerVersion is %x \n",nt_header->OptionalHeader.MinorLinkerVersion);
printf("The SizeOfCode is %x \n",nt_header->OptionalHeader.SizeOfCode);
printf("The SizeOfInitializedData is %x \n",nt_header->OptionalHeader.SizeOfInitializedData);
printf("The SizeOfUninitializedData is %x \n",nt_header->OptionalHeader.SizeOfUninitializedData);
}
int main(int argc, char *argv[])
{
printf("\n请输入绝对路径:\n");
const char* aFile;
scanf("%s",aFile);
aNalyticsPeFile(aFile);
return 0;
}
[课程]Linux pwn 探索篇！
