PE解析一

• 讀取文件到內存

LPVOID EXEToFileBuffer(LPCWSTR pFileName)
{
    HANDLE hd = NULL;
    HANDLE hFileMapping = NULL;
    DWORD dwSize = 0;
    LPVOID lpMemory = NULL;
    //打開文件
    hd = CreateFile(pFileName, GENERIC_READ, 
                    FILE_SHARE_READ | FILE_SHARE_WRITE,
                    NULL, OPEN_EXISTING,
                    FILE_ATTRIBUTE_ARCHIVE, NULL);
    if (hd == INVALID_HANDLE_VALUE)
    {
        printf("open file fail!\n");
        return NULL;
    }
    //獲取文件大小
    dwSize = GetFileSize(hd, NULL);
    if (dwSize == 0)
    {
        printf("file size is zero!\n");
        return NULL;
    }
    hFileMapping=CreateFileMapping(hd, NULL, PAGE_READONLY, 0, 0, NULL);
    if (hFileMapping == INVALID_HANDLE_VALUE)
    {
        printf("createFileMapping is faild!\n");
        return NULL;
    }
    lpMemory=MapViewOfFile(hFileMapping, FILE_MAP_READ, 0, 0, 0);
    return lpMemory;
}

• RVA 轉 FOA

DWORD _RVAToOffset(PVOID pFileBuffer,DWORD dwRVA)
{
    PIMAGE_DOS_HEADER pDosHeader = NULL;
    PIMAGE_NT_HEADERS pNtHeaders = NULL;
    PIMAGE_SECTION_HEADER pSectionHeader = NULL;

    PIMAGE_SECTION_HEADER pTempSction = NULL;
    DWORD dwFOA = 0;

    pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;
    if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE)
    {
        printf("not a mz header!\n");
        return 0;
    }
    pNtHeaders = (PIMAGE_NT_HEADERS)((DWORD)pDosHeader + pDosHeader->e_lfanew);
    if (pNtHeaders->Signature != IMAGE_NT_SIGNATURE)
    {
        printf("not a ntpe header!\n");
        return 0;
    }
    pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pNtHeaders + sizeof(IMAGE_NT_HEADERS));

    pTempSction = pSectionHeader;
    for (int i = 0; i < pNtHeaders->FileHeader.NumberOfSections; i++)
    {
        if (dwRVA >= pTempSction->VirtualAddress&&dwRVA < pTempSction->VirtualAddress+pTempSction->SizeOfRawData)
        {
            dwFOA = pTempSction->PointerToRawData + (dwRVA - pTempSction->VirtualAddress);
            return dwFOA;
        }
        pTempSction++;
    }
    printf("not find dwRva!");
    return 0;
}

本文是學習筆記，有錯誤的地方請不吝賜教！