早上起来看到这个代码 整理一下
1 // PETableDlg.cpp : 实现文件 2 // 3 4 #include "stdafx.h" 5 #include "PECheck.h" 6 #include "PETableDlg.h" 7 #include "afxdialogex.h" 8 9 10 // CPETableDlg 对话框 11 12 #define MakePtr(a,b,c) ((a)((char*)b+c)) 13 14 extern 15 ULONG g_SelectTab; 16 extern 17 int dpix; 18 19 UINT g_Column_Count_DirTable = 5; 20 COLUMNSTRUCT g_Column_DirTableList[] = 21 { 22 { L"Name", 180 }, //ldr 23 { L"RVA", 150 }, //传递 24 { L"Size", 150 }, // 25 {L"RAW", 150}, 26 {L"所属区块", 100} 27 }; 28 29 UINT g_Column_Count_SectionTable = 5; 30 COLUMNSTRUCT g_Column_SectionTableList[] = 31 { 32 { L"Name", 180 }, //ldr 33 { L"RVA", 150 }, //传递 34 { L"内存区块大小(未对齐)", 150 }, // 35 {L"文件偏移(offset)", 150}, 36 {L"文件大小", 150} 37 }; 38 39 UINT g_Column_Count_ImportTable = 4; 40 COLUMNSTRUCT g_Column_ImportTableList[] = 41 { 42 { L"函数序号", 150 }, //ldr 43 { L"函数名", 180 }, //传递 44 { L"函数地址", 150 }, // 45 {L"导入模块",150} 46 }; 47 48 UINT g_Column_Count_ExportTable = 5; 49 COLUMNSTRUCT g_Column_ExportTableList[] = 50 { 51 { L"函数序号", 150 }, //ldr 52 { L"函数名", 180 }, //传递 53 { L"函数地址", 150 }, // 54 {L"RVA", 150}, 55 {L"Offset", 150} 56 }; 57 58 UINT g_Column_Count_RelocTable = 7; 59 COLUMNSTRUCT g_Column_RelocTableList[] = 60 { 61 { L"重定位表RVA", 150 }, //ldr 62 {L"重定位表Offset",100}, 63 { L"重定位结构大小", 180 }, //传递 64 { L"TypeOffset", 150 }, 65 {L"重定位项RVA",150}, 66 {L"重定位项Offset",100}, 67 {L"需要重定位的数据",150} 68 }; 69 70 71 WCHAR wzDirTable[15][64] = {L"导出表地址",L"导入名称表",L"资源表",L"异常表",L"证书",L"重定向表",L"调试",L"版权",L"全局指针",L"LTS",L"加载配置",L"绑定导入表",L"导入地址表(IAT)",L"延迟加载导入表",L".NET 运行时"}; 72 73 74 IMPLEMENT_DYNAMIC(CPETableDlg, CDialog) 75 76 CPETableDlg::CPETableDlg(CWnd* pParent /*=NULL*/) 77 : CDialog(CPETableDlg::IDD, pParent) 78 , m_Table1(_T("")) 79 , m_Table2(_T("")) 80 , m_Table3(_T("")) 81 , m_Table4(_T("")) 82 , m_EditTable1(_T("")) 83 , m_EditTable2(_T("")) 84 , m_EditTable3(_T("")) 85 , m_EditTable4(_T("")) 86 { 87 88 } 89 90 CPETableDlg::~CPETableDlg() 91 { 92 } 93 94 void CPETableDlg::DoDataExchange(CDataExchange* pDX) 95 { 96 CDialog::DoDataExchange(pDX); 97 DDX_Control(pDX, IDC_LIST1, m_ListTable); 98 DDX_Text(pDX, IDC_STATIC_TABLE1, m_Table1); 99 DDX_Text(pDX, IDC_STATIC_TABLE2, m_Table2); 100 DDX_Text(pDX, IDC_STATIC_TABLE3, m_Table3); 101 DDX_Text(pDX, IDC_STATIC_TABLE4, m_Table4); 102 DDX_Text(pDX, IDC_EDIT_TABLE1, m_EditTable1); 103 DDX_Text(pDX, IDC_EDIT_TABLE2, m_EditTable2); 104 DDX_Text(pDX, IDC_EDIT_TABLE3, m_EditTable3); 105 DDX_Text(pDX, IDC_EDIT_TABLE4, m_EditTable4); 106 } 107 108 109 BEGIN_MESSAGE_MAP(CPETableDlg, CDialog) 110 // ON_EN_CHANGE(IDC_EDIT4, &CPETableDlg::OnEnChangeEdit4) 111 END_MESSAGE_MAP() 112 113 114 // CPETableDlg 消息处理程序 115 116 117 //void CPETableDlg::OnEnChangeEdit4() 118 //{ 119 // // TODO: 如果该控件是 RICHEDIT 控件，它将不 120 // // 发送此通知，除非重写 CDialog::OnInitDialog() 121 // // 函数并调用 CRichEditCtrl().SetEventMask()， 122 // // 同时将 ENM_CHANGE 标志“或”运算到掩码中。 123 // 124 // // TODO: 在此添加控件通知处理程序代码 125 //} 126 127 128 129 VOID 130 CPETableDlg::ShowPeTable(CHAR* FileData,PETYPE PeType) 131 { 132 UpdateData(TRUE); 133 134 switch(g_SelectTab) 135 { 136 case 1: 137 { 138 //m_GroupStatic.Format(L"目录表详细信息"); 139 m_Table1.Format(L""); 140 m_Table2.Format(L""); 141 m_Table3.Format(L""); 142 m_Table4.Format(L""); 143 144 ShowDataDirTable(FileData,PeType); 145 break; 146 } 147 148 case 2: 149 { 150 //m_GroupStatic.Format(L"区块表详细信息"); 151 m_Table1.Format(L""); 152 m_Table2.Format(L""); 153 m_Table3.Format(L""); 154 m_Table4.Format(L""); 155 156 ShowSectionTable(FileData,PeType); 157 break; 158 } 159 160 case 3: 161 { 162 //m_GroupStatic.Format(L"导入表详细信息"); 163 164 m_Table1.Format(L"输入表RVA"); 165 m_Table2.Format(L""); 166 m_Table3.Format(L""); 167 m_Table4.Format(L""); 168 169 ShowImportTable(FileData,PeType); 170 break; 171 } 172 173 case 4: 174 { 175 //m_GroupStatic.Format(L"导出表详细信息"); 176 177 m_Table1.Format(L"模块真实名称"); 178 m_Table2.Format(L"函数地址数组RVA"); 179 m_Table3.Format(L"函数名字指针RVA"); 180 m_Table4.Format(L"导出序号数组RVA"); 181 182 m_EditTable1.Format(L""); 183 184 ShowExportTable(FileData,PeType); 185 break; 186 } 187 188 case 5: 189 { 190 m_Table1.Format(L""); 191 m_Table2.Format(L""); 192 m_Table3.Format(L""); 193 m_Table4.Format(L""); 194 ShowRelocTable(FileData,PeType); 195 196 break; 197 } 198 199 default: 200 break; 201 } 202 203 UpdateData(FALSE); 204 } 205 206 207 VOID 208 CPETableDlg::ShowDataDirTable(CHAR* szFileData,PETYPE PeType) 209 { 210 211 PIMAGE_NT_HEADERS32 NtHead = NULL; 212 PIMAGE_NT_HEADERS64 NtHeader64 = NULL; 213 PIMAGE_NT_HEADERS32 NtHeader32 = NULL; 214 IMAGE_OPTIONAL_HEADER32 OptionHead32; 215 IMAGE_OPTIONAL_HEADER64 OptionHead64; 216 PIMAGE_SECTION_HEADER SectionHeader = NULL; 217 218 ULONG DataDirTable = 0; 219 ULONG DataSize = 0; 220 ULONG_PTR DataRaw = 0; 221 222 CString strRVA; 223 CString strSize; 224 CString strSection; 225 CString strRaw; 226 227 while(m_ListTable.DeleteColumn(0)); 228 m_ListTable.DeleteAllItems(); 229 230 m_ListTable.SetExtendedStyle(LVS_EX_FULLROWSELECT|LVS_EX_GRIDLINES|LVS_EX_HEADERDRAGDROP); 231 232 UINT i = 0; 233 for (i = 0;i<g_Column_Count_DirTable;i++) 234 { 235 m_ListTable.InsertColumn(i, g_Column_DirTableList[i].szTitle,LVCFMT_LEFT,(int)(g_Column_DirTableList[i].nWidth*(dpix/96.0))); 236 } 237 238 if (szFileData==NULL) 239 { 240 return; 241 } 242 243 PIMAGE_DOS_HEADER DosHead = (PIMAGE_DOS_HEADER)szFileData; //ReadFile()返回的szFileData地址 244 245 switch(PeType) 246 { 247 case PE: 248 { 249 NtHeader32 = (PIMAGE_NT_HEADERS32)((ULONG)szFileData+DosHead->e_lfanew); 250 OptionHead32 = NtHeader32->OptionalHeader; 251 252 for (int i = 0;i<OptionHead32.NumberOfRvaAndSizes;i++) 253 { 254 DataDirTable = OptionHead32.DataDirectory[i].VirtualAddress; 255 DataSize = OptionHead32.DataDirectory[i].Size; 256 257 //得到数据块在文件中的偏移 258 DataRaw = RVATwoOffset(NtHeader32,DataDirTable); 259 260 //计算数据块属于哪个节中 261 SectionHeader = GetSectionHeaderFromRva(DataDirTable,(PIMAGE_NT_HEADERS)NtHeader32); 262 263 strRVA.Format(L"0x%X",DataDirTable); 264 strSize.Format(L"0x%X",DataSize); 265 strSection = SectionHeader->Name; 266 strRaw.Format(L"0x%X",DataRaw); 267 268 int n = m_ListTable.GetItemCount(); 269 int j = m_ListTable.InsertItem(n, wzDirTable[i]); 270 m_ListTable.SetItemText(j, 1, strRVA); 271 m_ListTable.SetItemText(j, 2, strSize); 272 m_ListTable.SetItemText(j,3,strRaw); 273 m_ListTable.SetItemText(j,4,strSection); 274 275 } 276 277 278 break; 279 } 280 281 case PE64: 282 { 283 NtHeader64 = (PIMAGE_NT_HEADERS64)((ULONG)szFileData+DosHead->e_lfanew); 284 285 OptionHead64 = NtHeader64->OptionalHeader; 286 287 for (int i = 0;i<OptionHead64.NumberOfRvaAndSizes;i++) 288 { 289 DataDirTable = OptionHead64.DataDirectory[i].VirtualAddress; 290 DataSize = OptionHead64.DataDirectory[i].Size; 291 292 DataRaw = RVATwoOffset64(NtHeader64,DataDirTable); 293 294 SectionHeader = GetSectionHeaderFromRva(DataDirTable,(PIMAGE_NT_HEADERS)NtHeader64); 295 296 strRVA.Format(L"0x%X",DataDirTable); 297 strSize.Format(L"0x%X",DataSize); 298 strSection = SectionHeader->Name; 299 strRaw.Format(L"0x%X",DataRaw); 300 301 int n = m_ListTable.GetItemCount(); 302 int j = m_ListTable.InsertItem(n, wzDirTable[i]); 303 m_ListTable.SetItemText(j, 1, strRVA); 304 m_ListTable.SetItemText(j, 2, strSize); 305 m_ListTable.SetItemText(j,3,strRaw); 306 m_ListTable.SetItemText(j,4,strSection); 307 308 } 309 310 break; 311 } 312 default: 313 break; 314 315 } 316 } 317 318 PIMAGE_SECTION_HEADER 319 CPETableDlg::GetSectionHeaderFromRva(ULONG RVA,PIMAGE_NT_HEADERS NtHeader) //判断RVA是在那个节表当中 320 { 321 ULONG i = 0; 322 323 324 //Nt头得到节表 325 PIMAGE_SECTION_HEADER SectionHeader = IMAGE_FIRST_SECTION(NtHeader); 326 327 //Nt头中的File头中有区块表的个数 区块表是若干SECTION_HEADER个数据结构,个数是在文件头的NumberofSection中 328 for (i=0;i<NtHeader->FileHeader.NumberOfSections;i++,SectionHeader++) 329 { 330 331 if ((RVA>=SectionHeader->VirtualAddress)&& 332 (RVA<(SectionHeader->VirtualAddress + SectionHeader->Misc.VirtualSize))) 333 { 334 return SectionHeader; 335 } 336 } 337 338 return NULL; 339 } 340 341 DWORD RVATwoOffset(PIMAGE_NT_HEADERS32 NTHeader, ULONG ulRVA) 342 { 343 PIMAGE_SECTION_HEADER SectionHeader = 344 (PIMAGE_SECTION_HEADER)((ULONG)NTHeader + sizeof(IMAGE_NT_HEADERS)); //获得节表 345 346 for(int i = 0; i < NTHeader->FileHeader.NumberOfSections; i++) 347 { 348 //查询导出表是属于哪个节的 349 /*********************************************************************** 350 SectionHeader[i].VirtualAddress 节起始的RVA 0x1000 351 SectionHeader[i].SizeOfRawData 节在文件上的大小 352 SectionHeader[i].PointerToRawData 这是节基于文件的偏移量，PE 装载器通过本域值找到节数据在文件中的位置 353 354 假如导出表在.txt节中 355 SectionHeader[i].PointerToRawData == 0x200 SectionHeader[i].VirtualAddress == 0x1000 356 ulRVA = 0x1030 357 358 那么导出表在文件中的偏移就是0x230 返回 359 ***********************************************************************/ 360 if(ulRVA >= SectionHeader[i].VirtualAddress && ulRVA < 361 (SectionHeader[i].VirtualAddress 362 + SectionHeader[i].SizeOfRawData)) 363 { 364 //文件偏移 365 return SectionHeader[i].PointerToRawData + 366 (ulRVA - SectionHeader[i].VirtualAddress); 367 } 368 } 369 370 return 0; 371 } 372 373 ULONG_PTR RVATwoOffset64(PIMAGE_NT_HEADERS64 NTHeader, ULONG_PTR ulRVA) 374 { 375 PIMAGE_SECTION_HEADER SectionHeader = 376 (PIMAGE_SECTION_HEADER)((ULONG_PTR)NTHeader + sizeof(IMAGE_NT_HEADERS64)); //获得节表 377 378 for(int i = 0; i < NTHeader->FileHeader.NumberOfSections; i++) 379 { 380 //查询导出表是属于哪个节的 381 /*********************************************************************** 382 SectionHeader[i].VirtualAddress 节起始的RVA 0x1000 383 SectionHeader[i].SizeOfRawData 节在文件上的大小 384 SectionHeader[i].PointerToRawData 这是节基于文件的偏移量，PE 装载器通过本域值找到节数据在文件中的位置 385 386 假如导出表在.txt节中 387 SectionHeader[i].PointerToRawData == 0x200 SectionHeader[i].VirtualAddress == 0x1000 388 ulRVA = 0x1030 389 390 那么导出表在文件中的偏移就是0x230 返回 391 ***********************************************************************/ 392 if(ulRVA >= SectionHeader[i].VirtualAddress && ulRVA < 393 (SectionHeader[i].VirtualAddress 394 + SectionHeader[i].SizeOfRawData)) 395 { 396 //文件偏移 397 return SectionHeader[i].PointerToRawData + 398 (ulRVA - SectionHeader[i].VirtualAddress); 399 } 400 } 401 402 return 0; 403 } 404 405 406 407 VOID 408 CPETableDlg::ShowSectionTable(CHAR* szFileData,PETYPE PeType) 409 { 410 PIMAGE_NT_HEADERS NtHead = NULL; 411 PIMAGE_NT_HEADERS64 NtHeader64 = NULL; 412 PIMAGE_NT_HEADERS32 NtHeader32 = NULL; 413 414 IMAGE_FILE_HEADER FileHeader; 415 416 ULONG DataSize = 0; 417 PIMAGE_SECTION_HEADER SectionHeader; 418 419 CString SectionName; 420 CString strRVA; 421 CString strRSize; 422 423 CString strOffset; 424 CString strVsize; 425 426 while(m_ListTable.DeleteColumn(0)); 427 m_ListTable.DeleteAllItems(); 428 429 //CRect rect; 430 //GetWindowRect(rect); 431 ////设置ListContrl在对话框中的位置 432 //if (m_ListTable.m_hWnd != NULL) 433 //{ 434 // CRect rc; 435 // rc.left = 0; 436 // rc.top = 0; 437 // rc.right = rect.Width() - 10; 438 // rc.bottom = rect.Height() - 35; 439 // m_ListTable.MoveWindow(rc); 440 //} 441 442 m_ListTable.SetExtendedStyle(LVS_EX_FULLROWSELECT|LVS_EX_GRIDLINES|LVS_EX_HEADERDRAGDROP); 443 444 UINT i = 0; 445 for (i = 0;i<g_Column_Count_SectionTable;i++) 446 { 447 m_ListTable.InsertColumn(i, g_Column_SectionTableList[i].szTitle,LVCFMT_LEFT,(int)(g_Column_SectionTableList[i].nWidth*(dpix/96.0))); 448 } 449 450 if (szFileData==NULL) 451 { 452 return; 453 } 454 455 PIMAGE_DOS_HEADER DosHead = (PIMAGE_DOS_HEADER)szFileData; 456 457 //获得节表 458 if (PeType==PE) 459 { 460 NtHeader32 = (PIMAGE_NT_HEADERS32)((ULONG)szFileData+DosHead->e_lfanew); 461 FileHeader = NtHeader32->FileHeader; 462 SectionHeader = (PIMAGE_SECTION_HEADER)((ULONG_PTR)NtHeader32 + sizeof(IMAGE_NT_HEADERS32)); 463 } 464 else 465 { 466 NtHeader64 = (PIMAGE_NT_HEADERS64)((ULONG)szFileData+DosHead->e_lfanew); 467 FileHeader = NtHeader64->FileHeader; 468 469 SectionHeader = (PIMAGE_SECTION_HEADER)((ULONG_PTR)NtHeader64 + sizeof(IMAGE_NT_HEADERS64)); 470 } 471 472 473 for (int i = 0;i<FileHeader.NumberOfSections;i++,SectionHeader++) 474 { 475 SectionName = SectionHeader->Name; 476 strRVA.Format(L"0x%x",SectionHeader->VirtualAddress); 477 strRSize.Format(L"0x%x",SectionHeader->Misc.VirtualSize); 478 479 strOffset.Format(L"0x%x",SectionHeader->PointerToRawData); 480 strVsize.Format(L"0x%x",SectionHeader->SizeOfRawData); 481 482 int n = m_ListTable.GetItemCount(); 483 int j = m_ListTable.InsertItem(n, SectionName); 484 m_ListTable.SetItemText(j, 1, strRVA); 485 m_ListTable.SetItemText(j, 2, strRSize); 486 m_ListTable.SetItemText(j,3,strOffset); 487 m_ListTable.SetItemText(j,4,strVsize); 488 489 } 490 491 492 UpdateData(FALSE); 493 494 } 495 496 497 VOID 498 CPETableDlg::ShowImportTable(CHAR* szFileData,PETYPE PeType) 499 { 500 PIMAGE_NT_HEADERS NtHead = NULL; 501 PIMAGE_THUNK_DATA ImportOriFirstThunk = NULL; 502 PIMAGE_IMPORT_BY_NAME OrdinalName = NULL; 503 PIMAGE_NT_HEADERS64 NtHeader64 = NULL; 504 PIMAGE_NT_HEADERS32 NtHeader32 = NULL; 505 506 IMAGE_OPTIONAL_HEADER32 OptionHead32; 507 IMAGE_OPTIONAL_HEADER64 OptionHead64; 508 IMAGE_DATA_DIRECTORY ImportDirectory = {0}; 509 PIMAGE_IMPORT_DESCRIPTOR ImportTable = NULL; 510 ULONG_PTR ImportSize = 0; 511 ULONG_PTR ImportDiff = 0; 512 ULONG ulIndex = 0; 513 514 ULONG_PTR ulFuncRVA = 0; 515 516 517 CString strFuncName,strDllName; 518 CString strIndex = 0; 519 520 521 while(m_ListTable.DeleteColumn(0)); 522 m_ListTable.DeleteAllItems(); 523 524 m_ListTable.SetExtendedStyle(LVS_EX_FULLROWSELECT|LVS_EX_GRIDLINES|LVS_EX_HEADERDRAGDROP); 525 526 UINT i = 0; 527 for (i = 0;i<g_Column_Count_ImportTable;i++) 528 { 529 m_ListTable.InsertColumn(i, g_Column_ImportTableList[i].szTitle,LVCFMT_LEFT,(int)(g_Column_ImportTableList[i].nWidth*(dpix/96.0))); 530 } 531 532 if (szFileData==NULL) 533 { 534 return; 535 } 536 537 PIMAGE_DOS_HEADER DosHead = (PIMAGE_DOS_HEADER)szFileData; 538 539 NtHead = (PIMAGE_NT_HEADERS)((ULONG)szFileData+DosHead->e_lfanew); 540 541 switch(PeType) 542 { 543 case PE: 544 { 545 NtHeader32 = (PIMAGE_NT_HEADERS32)NtHead; 546 OptionHead32 = NtHeader32->OptionalHeader; 547 548 ImportDirectory = OptionHead32.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]; 549 550 m_EditTable1.Format(L"0x%p",ImportDirectory); 551 552 if (ImportDirectory.Size==0) 553 { 554 return; 555 } 556 557 ImportTable = (PIMAGE_IMPORT_DESCRIPTOR)((ULONG_PTR)szFileData+ RVATwoOffset(NtHeader32,ImportDirectory.VirtualAddress)); 558 559 while (ImportTable->Name) 560 { 561 char* DllName = (char*)((ULONG_PTR)szFileData+ RVATwoOffset(NtHeader32,ImportTable->Name)); 562 strDllName = DllName; 563 564 ImportOriFirstThunk = (PIMAGE_THUNK_DATA)((ULONG_PTR)szFileData + RVATwoOffset(NtHeader32,ImportTable->OriginalFirstThunk)); 565 566 while(ImportOriFirstThunk->u1.Function) 567 { 568 569 int n = m_ListTable.GetItemCount(); 570 strIndex.Format(L"%d",ulIndex); 571 int j = m_ListTable.InsertItem(n, strIndex); 572 573 //判断是以序数导入还是以Name导入 574 //最高位为1说明以序数导入 序号值为低31位 575 int Temp = ImportOriFirstThunk->u1.Ordinal&0x80000000; 576 577 if (Temp) 578 { 579 Temp = ImportOriFirstThunk->u1.Ordinal&0x7fffffff; 580 strIndex.Format(L"%d",Temp); 581 m_ListTable.SetItemText(j,1,strIndex); 582 } 583 else 584 { 585 OrdinalName = (PIMAGE_IMPORT_BY_NAME)((ULONG_PTR)szFileData + RVATwoOffset(NtHeader32,ImportOriFirstThunk->u1.AddressOfData)); 586 char* FuncName = (char*)OrdinalName->Name; 587 strFuncName = FuncName; 588 589 ulFuncRVA = (ULONG_PTR)((ULONG_PTR)szFileData + RVATwoOffset(NtHeader32,ImportOriFirstThunk->u1.ForwarderString)); 590 591 m_ListTable.SetItemText(j,1,strFuncName); 592 593 } 594 595 m_ListTable.SetItemText(j,3,strDllName); 596 597 ulIndex++; 598 ImportOriFirstThunk++; 599 600 } 601 602 ImportTable++; 603 } 604 605 606 break; 607 } 608 case PE64: 609 { 610 NtHeader64 = (PIMAGE_NT_HEADERS64)NtHead; 611 OptionHead64 = NtHeader64->OptionalHeader; 612 613 ImportDirectory = OptionHead64.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]; 614 if (ImportDirectory.Size==0) 615 { 616 return; 617 } 618 619 ImportTable = (PIMAGE_IMPORT_DESCRIPTOR)((ULONG_PTR)szFileData+ RVATwoOffset64(NtHeader64,ImportDirectory.VirtualAddress)); 620 621 622 while (ImportTable->Name) 623 { 624 char* DllName = (char*)((ULONG_PTR)szFileData+ RVATwoOffset64(NtHeader64,ImportTable->Name)); 625 strDllName = DllName; 626 627 ImportOriFirstThunk = (PIMAGE_THUNK_DATA)((ULONG_PTR)szFileData + RVATwoOffset64(NtHeader64,ImportTable->OriginalFirstThunk)); 628 629 while(ImportOriFirstThunk->u1.Function) 630 { 631 632 int n = m_ListTable.GetItemCount(); 633 strIndex.Format(L"%d",ulIndex); 634 int j = m_ListTable.InsertItem(n, strIndex); 635 636 INT64 Temp = ImportOriFirstThunk->u1.Ordinal&0x8000000000000000; 637 638 if (Temp) 639 { 640 Temp = ImportOriFirstThunk->u1.Ordinal&0x7fffffffffffffff; 641 strIndex.Format(L"%d",Temp); 642 m_ListTable.SetItemText(j,1,strIndex); 643 } 644 else 645 { 646 OrdinalName = (PIMAGE_IMPORT_BY_NAME)((ULONG_PTR)szFileData + RVATwoOffset64(NtHeader64,ImportOriFirstThunk->u1.AddressOfData)); 647 char* FuncName = (char*)OrdinalName->Name; 648 strFuncName = FuncName; 649 m_ListTable.SetItemText(j,1,strFuncName); 650 } 651 652 m_ListTable.SetItemText(j,3,strDllName); 653 654 ulIndex++; 655 ImportOriFirstThunk++; 656 657 } 658 659 ImportTable++; 660 } 661 662 663 break; 664 } 665 666 default: 667 break; 668 669 } 670 } 671 672 673 VOID 674 CPETableDlg::ShowRelocTable(CHAR* szFileData,PETYPE PeType) 675 { 676 PIMAGE_NT_HEADERS NtHead = NULL; 677 PIMAGE_NT_HEADERS64 NtHeader64 = NULL; 678 PIMAGE_NT_HEADERS32 NtHeader32 = NULL; 679 IMAGE_OPTIONAL_HEADER32 OptionHead32; 680 IMAGE_OPTIONAL_HEADER64 OptionHead64; 681 IMAGE_DATA_DIRECTORY RelocDirectory = {0}; 682 683 PIMAGE_BASE_RELOCATION RelocTable = NULL; 684 ULONG_PTR RelocRVA = 0; 685 ULONG_PTR BlocSize = 0; 686 ULONG_PTR RelocDataOffset = 0; 687 688 CString strRelocRVA,strRelocOffset,strRelocDataRVA,strRelcoDataOffset,strRelocDataOffset,strRelocData,strRelocSize; 689 CString strTypeOffset,strSizeOfBlock; 690 691 while(m_ListTable.DeleteColumn(0)); 692 m_ListTable.DeleteAllItems(); 693 694 m_ListTable.SetExtendedStyle(LVS_EX_FULLROWSELECT|LVS_EX_GRIDLINES|LVS_EX_HEADERDRAGDROP); 695 696 UINT i = 0; 697 for (i = 0;i<g_Column_Count_RelocTable;i++) 698 { 699 m_ListTable.InsertColumn(i, g_Column_RelocTableList[i].szTitle,LVCFMT_LEFT,(int)(g_Column_RelocTableList[i].nWidth*(dpix/96.0))); 700 } 701 702 if (szFileData==NULL) 703 { 704 return; 705 } 706 707 PIMAGE_DOS_HEADER DosHead = (PIMAGE_DOS_HEADER)szFileData; 708 NtHead = (PIMAGE_NT_HEADERS)((ULONG)szFileData+DosHead->e_lfanew); 709 710 switch (PeType) 711 { 712 case PE: 713 { 714 NtHeader32 = (PIMAGE_NT_HEADERS32)NtHead; 715 OptionHead32 = NtHeader32->OptionalHeader; 716 717 RelocDirectory = OptionHead32.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC]; 718 719 if (RelocDirectory.Size==0) 720 { 721 return; 722 } 723 724 725 RelocTable = (PIMAGE_BASE_RELOCATION)((ULONG_PTR)szFileData+ RVATwoOffset(NtHeader32,RelocDirectory.VirtualAddress)); 726 727 do 728 { 729 ULONG_PTR NumOfReloc=(RelocTable->SizeOfBlock-sizeof(IMAGE_BASE_RELOCATION))/2; 730 731 SHORT MiniOffset = 0; 732 733 PSHORT RelocData =(PSHORT)((ULONG_PTR)RelocTable+sizeof(IMAGE_BASE_RELOCATION)); 734 735 for (i=0; i<NumOfReloc; i++) 736 { 737 PULONG_PTR RelocAddress = 0;//需要重定位的地址 738 739 if (((*RelocData)>>12)==IMAGE_REL_BASED_DIR64||((*RelocData)>>12)==IMAGE_REL_BASED_HIGHLOW)//判断重定位类型是否为IMAGE_REL_BASED_HIGHLOW[32]或IMAGE_REL_BASED_DIR64[64] 740 { 741 MiniOffset = (*RelocData)&0xfff; 742 743 744 RelocDataOffset = (ULONG_PTR)RVATwoOffset(NtHeader32,MiniOffset+RelocTable->VirtualAddress); 745 746 strSizeOfBlock.Format(L"0x%x",RelocTable->SizeOfBlock); 747 strTypeOffset.Format(L"0x%x",(*RelocData)); 748 749 strRelocRVA.Format(L"0x%x",RelocTable->VirtualAddress); 750 strRelocOffset.Format(L"0x%x",RVATwoOffset(NtHeader32,RelocTable->VirtualAddress)); 751 752 strRelocDataRVA.Format(L"0x%x",MiniOffset+RelocTable->VirtualAddress); 753 strRelocDataOffset.Format(L"0x%x",RelocDataOffset); 754 755 strRelocData.Format(L"0x%x",*(PULONG_PTR)((ULONG_PTR)szFileData+ RelocDataOffset)); 756 757 int n = m_ListTable.GetItemCount(); 758 int j = m_ListTable.InsertItem(n, strRelocRVA); 759 m_ListTable.SetItemText(j, 1, strRelocOffset); 760 m_ListTable.SetItemText(j, 2, strSizeOfBlock); 761 m_ListTable.SetItemText(j,3,strTypeOffset); 762 m_ListTable.SetItemText(j,4,strRelocDataRVA); 763 m_ListTable.SetItemText(j,5,strRelocDataOffset); 764 m_ListTable.SetItemText(j,6,strRelocData); 765 766 767 } 768 769 RelocData++; 770 } 771 772 RelocTable=(PIMAGE_BASE_RELOCATION)((ULONG_PTR)RelocTable+RelocTable->SizeOfBlock); 773 774 } while (RelocTable->VirtualAddress); 775 776 777 break; 778 } 779 780 case PE64: 781 { 782 NtHeader64 = (PIMAGE_NT_HEADERS64)NtHead; 783 OptionHead64 = NtHeader64->OptionalHeader; 784 785 RelocDirectory = OptionHead64.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC]; 786 787 if (RelocDirectory.Size==0) 788 { 789 return; 790 } 791 792 793 RelocTable = (PIMAGE_BASE_RELOCATION)((ULONG_PTR)szFileData+ RVATwoOffset64(NtHeader64,RelocDirectory.VirtualAddress)); 794 795 do 796 { 797 ULONG_PTR NumOfReloc=(RelocTable->SizeOfBlock-sizeof(IMAGE_BASE_RELOCATION))/2; 798 799 SHORT MiniOffset = 0; 800 PUSHORT RelocData =(PUSHORT)((ULONG_PTR)RelocTable+sizeof(IMAGE_BASE_RELOCATION)); 801 802 for (i=0; i<NumOfReloc; i++) 803 { 804 PULONG_PTR RelocAddress = 0;//需要重定位的地址 805 806 if (((*RelocData)>>12)==IMAGE_REL_BASED_DIR64)//判断重定位类型是否为IMAGE_REL_BASED_HIGHLOW[32]或IMAGE_REL_BASED_DIR64[64] 807 { 808 MiniOffset = (*RelocData)&0xfff; 809 810 811 RelocDataOffset = (ULONG_PTR)RVATwoOffset64(NtHeader64,MiniOffset+RelocTable->VirtualAddress); 812 813 strSizeOfBlock.Format(L"0x%x",RelocTable->SizeOfBlock); 814 strTypeOffset.Format(L"0x%x",(*RelocData)); 815 816 strRelocRVA.Format(L"0x%x",RelocTable->VirtualAddress); 817 strRelocOffset.Format(L"0x%x",RVATwoOffset64(NtHeader64,RelocTable->VirtualAddress)); 818 819 strRelocDataRVA.Format(L"0x%x",MiniOffset+RelocTable->VirtualAddress); 820 strRelocDataOffset.Format(L"0x%x",RVATwoOffset64(NtHeader64,MiniOffset+RelocTable->VirtualAddress)); 821 822 strRelocData.Format(L"0x%x",*(PULONG_PTR)((ULONG_PTR)szFileData+ RelocDataOffset)); 823 824 int n = m_ListTable.GetItemCount(); 825 int j = m_ListTable.InsertItem(n, strRelocRVA); 826 m_ListTable.SetItemText(j, 1, strRelocOffset); 827 m_ListTable.SetItemText(j, 2, strSizeOfBlock); 828 m_ListTable.SetItemText(j,3,strTypeOffset); 829 m_ListTable.SetItemText(j,4,strRelocDataRVA); 830 m_ListTable.SetItemText(j,5,strRelocDataOffset); 831 m_ListTable.SetItemText(j,6,strRelocData); 832 833 834 } 835 836 RelocData++; 837 } 838 839 RelocTable=(PIMAGE_BASE_RELOCATION)((ULONG_PTR)RelocTable+RelocTable->SizeOfBlock); 840 841 } while (RelocTable->VirtualAddress); 842 843 844 break; 845 } 846 847 default: 848 break; 849 } 850 851 } 852 VOID 853 CPETableDlg::ShowExportTable(CHAR* szFileData,PETYPE PeType) 854 { 855 PIMAGE_NT_HEADERS NtHead = NULL; 856 PIMAGE_NT_HEADERS64 NtHeader64 = NULL; 857 PIMAGE_NT_HEADERS32 NtHeader32 = NULL; 858 IMAGE_OPTIONAL_HEADER32 OptionHead32; 859 IMAGE_OPTIONAL_HEADER64 OptionHead64; 860 IMAGE_DATA_DIRECTORY ExportDirectory = {0}; 861 PIMAGE_EXPORT_DIRECTORY ExportTable = NULL; 862 863 ULONG_PTR NameOfArrayRVA = NULL; 864 ULONG* NameOfArray = NULL; 865 ULONG_PTR OrdinalsOfArrayRVA = NULL; 866 WORD* OrdinalsOfArray = NULL; 867 ULONG_PTR FuncAddressOfArrayRVA = NULL; 868 ULONG* FuncAddressOfArray = NULL; 869 ULONG_PTR FuncAdress = NULL; 870 871 CString strIndex, strFuncName,strFuncAddr,strRVA,strOffset; 872 873 while(m_ListTable.DeleteColumn(0)); 874 m_ListTable.DeleteAllItems(); 875 876 m_ListTable.SetExtendedStyle(LVS_EX_FULLROWSELECT|LVS_EX_GRIDLINES|LVS_EX_HEADERDRAGDROP); 877 878 UINT i = 0; 879 for (i = 0;i<g_Column_Count_ExportTable;i++) 880 { 881 m_ListTable.InsertColumn(i, g_Column_ExportTableList[i].szTitle,LVCFMT_LEFT,(int)(g_Column_ExportTableList[i].nWidth*(dpix/96.0))); 882 } 883 884 if (szFileData==NULL) 885 { 886 return; 887 } 888 889 890 PIMAGE_DOS_HEADER DosHead = (PIMAGE_DOS_HEADER)szFileData; 891 NtHead = (PIMAGE_NT_HEADERS)((ULONG)szFileData+DosHead->e_lfanew); 892 893 switch(PeType) 894 { 895 case PE: 896 { 897 NtHeader32 = (PIMAGE_NT_HEADERS32)NtHead; 898 OptionHead32 = NtHeader32->OptionalHeader; 899 900 ExportDirectory = OptionHead32.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]; 901 if (ExportDirectory.Size==0) 902 { 903 return; 904 } 905 906 ExportTable = (PIMAGE_EXPORT_DIRECTORY)((ULONG_PTR)szFileData+ RVATwoOffset(NtHeader32,ExportDirectory.VirtualAddress)); 907 908 CHAR* DllName = (CHAR*)((ULONG_PTR)szFileData + RVATwoOffset(NtHeader32,ExportTable->Name)); 909 910 m_EditTable1.Format(L"%S",DllName); 911 912 // 913 NameOfArrayRVA = (ULONG_PTR)(ExportTable->AddressOfNames); 914 m_EditTable3.Format(L"0x%p",NameOfArrayRVA); 915 NameOfArrayRVA = RVATwoOffset(NtHeader32,NameOfArrayRVA); 916 NameOfArray = (ULONG*)((ULONG_PTR)szFileData + NameOfArrayRVA); 917 CHAR* wzFuncName = NULL; 918 919 // 920 OrdinalsOfArrayRVA = (ULONG_PTR)ExportTable->AddressOfNameOrdinals; 921 m_EditTable4.Format(L"0x%p",OrdinalsOfArrayRVA); 922 OrdinalsOfArrayRVA = RVATwoOffset(NtHeader32,OrdinalsOfArrayRVA); 923 OrdinalsOfArray = (WORD*)((ULONG_PTR)szFileData + OrdinalsOfArrayRVA); 924 925 // 926 FuncAddressOfArrayRVA = (ULONG_PTR)ExportTable->AddressOfFunctions; 927 m_EditTable2.Format(L"0x%p",FuncAddressOfArrayRVA); 928 FuncAddressOfArrayRVA = RVATwoOffset(NtHeader32,FuncAddressOfArrayRVA); 929 FuncAddressOfArray = (ULONG*)((ULONG_PTR)szFileData + FuncAddressOfArrayRVA); 930 931 932 for (int i=0;i<ExportTable->NumberOfNames;i++) 933 { 934 wzFuncName = (CHAR*)((ULONG_PTR)szFileData+RVATwoOffset(NtHeader32,NameOfArray[i])); 935 FuncAdress =(ULONG_PTR)szFileData + RVATwoOffset(NtHeader32,FuncAddressOfArray[OrdinalsOfArray[i]]); 936 937 strIndex.Format(L"%d",OrdinalsOfArray[i]); 938 strFuncName.Format(L"%S",wzFuncName); 939 strFuncAddr.Format(L"0x%x",FuncAdress); 940 strRVA.Format(L"0x%x",FuncAddressOfArray[OrdinalsOfArray[i]]); 941 strOffset.Format(L"0x%x",RVATwoOffset(NtHeader32,FuncAddressOfArray[OrdinalsOfArray[i]])); 942 943 944 int n = m_ListTable.GetItemCount(); 945 int j = m_ListTable.InsertItem(n, strIndex); 946 m_ListTable.SetItemText(j, 1, strFuncName); 947 m_ListTable.SetItemText(j, 2, strFuncAddr); 948 m_ListTable.SetItemText(j,3,strRVA); 949 m_ListTable.SetItemText(j,4,strOffset); 950 951 } 952 953 954 break; 955 } 956 957 case PE64: 958 { 959 NtHeader64 = (PIMAGE_NT_HEADERS64)NtHead; 960 OptionHead64 = NtHeader64->OptionalHeader; 961 962 ExportDirectory = OptionHead64.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]; 963 if (ExportDirectory.Size==0) 964 { 965 return; 966 } 967 968 ExportTable = (PIMAGE_EXPORT_DIRECTORY)((ULONG_PTR)szFileData+ RVATwoOffset64(NtHeader64,ExportDirectory.VirtualAddress)); 969 970 971 NameOfArrayRVA = (ULONG_PTR)(ExportTable->AddressOfNames); 972 m_EditTable3.Format(L"0x%p",NameOfArrayRVA); 973 NameOfArrayRVA = RVATwoOffset64(NtHeader64,NameOfArrayRVA); 974 NameOfArray = (ULONG*)((ULONG_PTR)szFileData + NameOfArrayRVA); 975 CHAR* wzFuncName = NULL; 976 977 978 OrdinalsOfArrayRVA = (ULONG_PTR)ExportTable->AddressOfNameOrdinals; 979 m_EditTable4.Format(L"0x%p",OrdinalsOfArrayRVA); 980 OrdinalsOfArrayRVA = RVATwoOffset64(NtHeader64,OrdinalsOfArrayRVA); 981 OrdinalsOfArray = (WORD*)((ULONG_PTR)szFileData + OrdinalsOfArrayRVA); 982 983 984 FuncAddressOfArrayRVA = (ULONG_PTR)ExportTable->AddressOfFunctions; 985 m_EditTable2.Format(L"0x%p",FuncAddressOfArrayRVA); 986 FuncAddressOfArrayRVA = RVATwoOffset64(NtHeader64,FuncAddressOfArrayRVA); 987 FuncAddressOfArray = (ULONG*)((ULONG_PTR)szFileData + FuncAddressOfArrayRVA); 988 989 990 for (int i=0;i<ExportTable->NumberOfNames;i++) 991 { 992 wzFuncName = (CHAR*)((ULONG_PTR)szFileData+RVATwoOffset64(NtHeader64,NameOfArray[i])); 993 FuncAdress =(ULONG_PTR)szFileData + RVATwoOffset64(NtHeader64,FuncAddressOfArray[OrdinalsOfArray[i]]); 994 995 strIndex.Format(L"%d",OrdinalsOfArray[i]); 996 strFuncName.Format(L"%S",wzFuncName); 997 strFuncAddr.Format(L"0x%x",FuncAdress); 998 strRVA.Format(L"0x%x",FuncAddressOfArray[OrdinalsOfArray[i]]); 999 strOffset.Format(L"0x%x",RVATwoOffset64(NtHeader64,FuncAddressOfArray[OrdinalsOfArray[i]])); 1000 1001 1002 int n = m_ListTable.GetItemCount(); 1003 int j = m_ListTable.InsertItem(n, strIndex); 1004 m_ListTable.SetItemText(j, 1, strFuncName); 1005 m_ListTable.SetItemText(j, 2, strFuncAddr); 1006 m_ListTable.SetItemText(j,3,strRVA); 1007 m_ListTable.SetItemText(j,4,strOffset); 1008 1009 } 1010 1011 1012 break; 1013 } 1014 default: 1015 break; 1016 1017 } 1018 1019 UpdateData(FALSE); 1020 }
1 #pragma once 2 #include "afxcmn.h" 3 enum PETYPE 4 { 5 PE = 0, 6 PE64, 7 Unkonw 8 }; 9 typedef struct _COLUMNSTRUCT 10 { 11 WCHAR* szTitle; 12 UINT nWidth; 13 }COLUMNSTRUCT; 14 // CPETableDlg 对话框 15 16 class CPETableDlg : public CDialog 17 { 18 DECLARE_DYNAMIC(CPETableDlg) 19 20 public: 21 CPETableDlg(CWnd* pParent = NULL); // 标准构造函数 22 virtual ~CPETableDlg(); 23 24 // 对话框数据 25 enum { IDD = IDD_DIALOG_TABLE }; 26 27 28 protected: 29 virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV 支持 30 31 DECLARE_MESSAGE_MAP() 32 public: 33 // afx_msg void OnEnChangeEdit4(); 34 CListCtrl m_ListTable; 35 CString m_Table1; 36 CString m_Table2; 37 CString m_Table3; 38 CString m_Table4; 39 CString m_EditTable1; 40 CString m_EditTable2; 41 CString m_EditTable3; 42 CString m_EditTable4; 43 VOID CPETableDlg::ShowPeTable(CHAR* FileData,PETYPE PeType); 44 VOID CPETableDlg::ShowDataDirTable(CHAR* szFileData,PETYPE PeType); 45 PIMAGE_SECTION_HEADER CPETableDlg::GetSectionHeaderFromRva(ULONG RVA,PIMAGE_NT_HEADERS NtHeader); 46 VOID CPETableDlg::ShowSectionTable(CHAR* szFileData,PETYPE PeType); 47 VOID CPETableDlg::ShowImportTable(CHAR* szFileData,PETYPE PeType); 48 VOID CPETableDlg::ShowExportTable(CHAR* szFileData,PETYPE PeType); 49 VOID CPETableDlg::ShowRelocTable(CHAR* szFileData,PETYPE PeType); 50 }; 51 ULONG_PTR RVATwoOffset64(PIMAGE_NT_HEADERS64 NTHeader, ULONG_PTR ulRVA) ; 52 DWORD RVATwoOffset(PIMAGE_NT_HEADERS32 NTHeader, ULONG ulRVA);
1 // PECheckDlg.h : 头文件 2 // 3 4 #pragma once 5 #include "afxcmn.h" 6 #include "PEHeaderDlg.h" 7 #include "PETableDlg.h" 8 // CPECheckDlg 对话框 9 10 class CPECheckDlg : public CDialogEx 11 { 12 // 构造 13 public: 14 CPECheckDlg(CWnd* pParent = NULL); // 标准构造函数 15 16 // 对话框数据 17 enum { IDD = IDD_PECHECK_DIALOG }; 18 19 20 protected: 21 virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV 支持 22 TCHAR m_FilePath[1024]; 23 CHAR* m_szFileData; 24 ULONG m_ulLow; 25 PETYPE PeType; 26 27 28 CPEHeaderDlg m_PeHeaderDlg; 29 CPETableDlg m_PeTableDlg; 30 // 实现 31 protected: 32 HICON m_hIcon; 33 34 // 生成的消息映射函数 35 virtual BOOL OnInitDialog(); 36 afx_msg void OnSysCommand(UINT nID, LPARAM lParam); 37 afx_msg void OnPaint(); 38 afx_msg HCURSOR OnQueryDragIcon(); 39 DECLARE_MESSAGE_MAP() 40 public: 41 afx_msg void OnDropFiles(HDROP hDropInfo); 42 CTabCtrl m_TabMain; 43 CString m_EditFilePath; 44 45 46 47 48 BOOL LoadFileData(WCHAR* wzFilePath,CHAR** szFileData,ULONG* ulLow); 49 BOOL IsPEFile(CHAR* szFileData,PETYPE* PeType); 50 CString m_EditFileType; 51 afx_msg void OnTcnSelchangeTabMain(NMHDR *pNMHDR, LRESULT *pResult); 52 };
1 // PECheckDlg.cpp : 实现文件 2 // 3 4 #include "stdafx.h" 5 #include "PECheck.h" 6 #include "PECheckDlg.h" 7 #include "afxdialogex.h" 8 9 #ifdef _DEBUG 10 #define new DEBUG_NEW 11 #endif 12 13 14 15 CHAR* g_szFileData = NULL; 16 ULONG g_SelectTab = 0; 17 int dpix; 18 int dpiy; 19 20 // 用于应用程序“关于”菜单项的 CAboutDlg 对话框 21 22 class CAboutDlg : public CDialogEx 23 { 24 public: 25 CAboutDlg(); 26 27 // 对话框数据 28 enum { IDD = IDD_ABOUTBOX }; 29 30 protected: 31 virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV 支持 32 33 // 实现 34 protected: 35 DECLARE_MESSAGE_MAP() 36 }; 37 38 CAboutDlg::CAboutDlg() : CDialogEx(CAboutDlg::IDD) 39 { 40 } 41 42 void CAboutDlg::DoDataExchange(CDataExchange* pDX) 43 { 44 CDialogEx::DoDataExchange(pDX); 45 } 46 47 BEGIN_MESSAGE_MAP(CAboutDlg, CDialogEx) 48 END_MESSAGE_MAP() 49 50 51 // CPECheckDlg 对话框 52 53 54 55 56 CPECheckDlg::CPECheckDlg(CWnd* pParent /*=NULL*/) 57 : CDialogEx(CPECheckDlg::IDD, pParent) 58 , m_EditFilePath(_T("")) 59 , m_EditFileType(_T("")) 60 { 61 m_hIcon = AfxGetApp()->LoadIcon(IDR_MAINFRAME); 62 m_szFileData = NULL; 63 } 64 65 void CPECheckDlg::DoDataExchange(CDataExchange* pDX) 66 { 67 CDialogEx::DoDataExchange(pDX); 68 DDX_Control(pDX, IDC_TAB_MAIN, m_TabMain); 69 DDX_Text(pDX, IDC_EDIT_DRAGFILE, m_EditFilePath); 70 DDX_Text(pDX, IDC_FILETYPE, m_EditFileType); 71 } 72 73 BEGIN_MESSAGE_MAP(CPECheckDlg, CDialogEx) 74 ON_WM_SYSCOMMAND() 75 ON_WM_PAINT() 76 ON_WM_QUERYDRAGICON() 77 ON_WM_DROPFILES() 78 ON_NOTIFY(TCN_SELCHANGE, IDC_TAB_MAIN, &CPECheckDlg::OnTcnSelchangeTabMain) 79 END_MESSAGE_MAP() 80 81 82 // CPECheckDlg 消息处理程序 83 84 BOOL CPECheckDlg::OnInitDialog() 85 { 86 CDialogEx::OnInitDialog(); 87 88 // 将“关于...”菜单项添加到系统菜单中。 89 90 // IDM_ABOUTBOX 必须在系统命令范围内。 91 ASSERT((IDM_ABOUTBOX & 0xFFF0) == IDM_ABOUTBOX); 92 ASSERT(IDM_ABOUTBOX < 0xF000); 93 94 CMenu* pSysMenu = GetSystemMenu(FALSE); 95 if (pSysMenu != NULL) 96 { 97 BOOL bNameValid; 98 CString strAboutMenu; 99 bNameValid = strAboutMenu.LoadString(IDS_ABOUTBOX); 100 ASSERT(bNameValid); 101 if (!strAboutMenu.IsEmpty()) 102 { 103 pSysMenu->AppendMenu(MF_SEPARATOR); 104 pSysMenu->AppendMenu(MF_STRING, IDM_ABOUTBOX, strAboutMenu); 105 } 106 } 107 108 // 设置此对话框的图标。当应用程序主窗口不是对话框时，框架将自动 109 // 执行此操作 110 SetIcon(m_hIcon, TRUE); // 设置大图标 111 SetIcon(m_hIcon, FALSE); // 设置小图标 112 113 // TODO: 在此添加额外的初始化代码 114 m_TabMain.InsertItem(0, _T("PE头")); // 115 m_TabMain.InsertItem(1, _T("目录表")); // 116 m_TabMain.InsertItem(2,_T("区块表")); 117 m_TabMain.InsertItem(3,_T("导入表")); 118 m_TabMain.InsertItem(4,_T("导出表")); 119 m_TabMain.InsertItem(5,_T("重定向表")); 120 121 122 m_PeHeaderDlg.Create(IDD_DIALOG_PEHEADER,GetDlgItem(IDC_TAB_MAIN)); 123 m_PeTableDlg.Create(IDD_DIALOG_TABLE,GetDlgItem(IDC_TAB_MAIN)); 124 125 126 CRect tabRect; 127 128 129 GetWindowRect(&tabRect); 130 131 CPaintDC dc(this); 132 dpix = GetDeviceCaps(dc.m_hDC,LOGPIXELSX); 133 dpiy = GetDeviceCaps(dc.m_hDC,LOGPIXELSY); 134 tabRect.bottom += (LONG)(1+21*(dpiy/96.0)); 135 136 MoveWindow(&tabRect); 137 138 m_TabMain.GetClientRect(&tabRect); // 获取标签控件客户区Rect 139 // 调整tabRect，使其覆盖范围适合放置标签页 140 tabRect.left += 1; 141 tabRect.right -= 1; 142 tabRect.top += 25; 143 tabRect.bottom -= 1; 144 // 根据调整好的tabRect放置m_jzmDlg子对话框，并设置为显示 145 m_PeHeaderDlg.SetWindowPos(NULL, tabRect.left, tabRect.top, tabRect.Width(), tabRect.Height(), SWP_SHOWWINDOW); 146 m_PeTableDlg.SetWindowPos(NULL, tabRect.left, tabRect.top, tabRect.Width(), tabRect.Height(), SWP_HIDEWINDOW); 147 148 149 150 return TRUE; // 除非将焦点设置到控件，否则返回 TRUE 151 } 152 153 void CPECheckDlg::OnSysCommand(UINT nID, LPARAM lParam) 154 { 155 if ((nID & 0xFFF0) == IDM_ABOUTBOX) 156 { 157 CAboutDlg dlgAbout; 158 dlgAbout.DoModal(); 159 } 160 else 161 { 162 CDialogEx::OnSysCommand(nID, lParam); 163 } 164 } 165 166 // 如果向对话框添加最小化按钮，则需要下面的代码 167 // 来绘制该图标。对于使用文档/视图模型的 MFC 应用程序， 168 // 这将由框架自动完成。 169 170 void CPECheckDlg::OnPaint() 171 { 172 if (IsIconic()) 173 { 174 CPaintDC dc(this); // 用于绘制的设备上下文 175 176 SendMessage(WM_ICONERASEBKGND, reinterpret_cast<WPARAM>(dc.GetSafeHdc()), 0); 177 178 // 使图标在工作区矩形中居中 179 int cxIcon = GetSystemMetrics(SM_CXICON); 180 int cyIcon = GetSystemMetrics(SM_CYICON); 181 CRect rect; 182 GetClientRect(&rect); 183 int x = (rect.Width() - cxIcon + 1) / 2; 184 int y = (rect.Height() - cyIcon + 1) / 2; 185 186 // 绘制图标 187 dc.DrawIcon(x, y, m_hIcon); 188 } 189 else 190 { 191 CDialogEx::OnPaint(); 192 } 193 } 194 195 //当用户拖动最小化窗口时系统调用此函数取得光标 196 //显示。 197 HCURSOR CPECheckDlg::OnQueryDragIcon() 198 { 199 return static_cast<HCURSOR>(m_hIcon); 200 } 201 202 203 204 BOOL CPECheckDlg::LoadFileData(WCHAR* wzFilePath,CHAR** szFileData,ULONG* ulLow) 205 { 206 207 HANDLE hFile; 208 ULONG ulHigh = 0; 209 ULONG ulReturn = 0; 210 211 if (wzFilePath==NULL)//判断文件路径是否为空 212 { 213 return FALSE; 214 } 215 216 hFile = CreateFileW(wzFilePath,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL); 217 218 if (hFile==INVALID_HANDLE_VALUE) 219 { 220 return -1; 221 } 222 223 224 /* 225 // Case One: calling the function with 226 // lpFileSizeHigh == NULL 227 228 // Try to obtain hFile's size 229 dwSize = GetFileSize (hFile, NULL) ; 230 231 // If we failed ... 232 if (dwSize == 0xFFFFFFFF) { 233 234 // Obtain the error code. 235 dwError = GetLastError() ; 236 237 // Deal with that failure. 238 . 239 . 240 . 241 242 } // End of error handler 243 244 245 // 246 // Case Two: calling the function with 247 // lpFileSizeHigh != NULL 248 249 // Try to obtain hFile's huge size. 250 dwSizeLow = GetFileSize (hFile, & dwSizeHigh) ; 251 252 // If we failed ... 253 if (dwSizeLow == 0xFFFFFFFF 254 && 255 (dwError = GetLastError()) != NO_ERROR ){ 256 257 // Deal with that failure. 258 . 259 . 260 . 261 262 } // End of error handler. */ 263 264 *ulLow = GetFileSize(hFile,&ulHigh); 265 266 *szFileData = new char[*ulLow + 20]; 267 268 if (ReadFile(hFile,*szFileData,*ulLow,&ulReturn,NULL)==0) 269 { 270 CloseHandle(hFile); 271 delete *szFileData; 272 return FALSE; 273 } 274 275 276 return TRUE; 277 278 279 } 280 281 BOOL CPECheckDlg::IsPEFile(CHAR* szFileData,PETYPE* PeType) 282 { 283 PIMAGE_DOS_HEADER DosHead =NULL; 284 PIMAGE_NT_HEADERS NtHead = NULL; 285 IMAGE_FILE_HEADER FileHead = {0}; 286 287 DosHead = (PIMAGE_DOS_HEADER)szFileData; 288 if (DosHead->e_magic!=IMAGE_DOS_SIGNATURE) 289 { 290 return FALSE; 291 } 292 293 NtHead = (PIMAGE_NT_HEADERS)((ULONG)szFileData+DosHead->e_lfanew); 294 295 if (NtHead->Signature!=IMAGE_NT_SIGNATURE) 296 { 297 return FALSE; 298 } 299 300 FileHead = NtHead->FileHeader; 301 switch(FileHead.Machine) //根据NT头中的FileHeader.Machine判断是哪种PE文件 302 { 303 case IMAGE_FILE_MACHINE_IA64: 304 case IMAGE_FILE_MACHINE_AMD64: 305 *PeType = PE64; 306 break; 307 308 case IMAGE_FILE_MACHINE_I386: 309 *PeType = PE; 310 break; 311 312 default: *PeType = Unkonw; 313 } 314 315 return TRUE; 316 317 318 } 319 320 void CPECheckDlg::OnDropFiles(HDROP hDropInfo) 321 { 322 // TODO: 在此添加消息处理程序代码和/或调用默认值 323 UpdateData(TRUE); 324 325 CRect tabRect; 326 m_TabMain.GetClientRect(&tabRect); // 获取标签控件客户区Rect 327 // 调整tabRect，使其覆盖范围适合放置标签页 328 tabRect.left += 1; 329 tabRect.right -= 1; 330 tabRect.top += 25; 331 tabRect.bottom -= 1; 332 333 334 335 DragQueryFile(hDropInfo,0,m_FilePath,MAX_PATH);//取得第一个文件的路径 336 337 if(_wcsicmp(m_FilePath,m_EditFilePath.GetBuffer()) == 0) 338 { 339 goto END; 340 } 341 342 m_EditFilePath = m_FilePath; 343 344 //得到要检查文件的完整路径 345 346 347 if(LoadFileData(m_FilePath,&m_szFileData,&m_ulLow)==FALSE) 348 { 349 free(m_szFileData); 350 return ; 351 } 352 353 g_szFileData = m_szFileData; 354 355 if(IsPEFile(m_szFileData,&PeType)==FALSE) 356 { 357 MessageBox(L"不是PE文件",L"PECheck",0); 358 359 return; 360 } 361 362 switch(PeType) 363 { 364 case PE: 365 { 366 m_EditFileType.Format(L"32位 MZ (0x%p)",(ULONG_PTR)m_szFileData); 367 break; 368 } 369 370 case PE64: 371 { 372 m_EditFileType.Format(L"64位 MZ (0x%p)",(ULONG_PTR)m_szFileData); 373 break; 374 } 375 case Unkonw: 376 { 377 m_EditFileType = L"未知"; 378 break; 379 } 380 default: 381 break; 382 } 383 //m_PeHeaderDlg 384 m_PeHeaderDlg.SetWindowPos(NULL, tabRect.left, tabRect.top, tabRect.Width(), tabRect.Height(), SWP_SHOWWINDOW); 385 m_PeHeaderDlg.CheckPEHeader(); 386 UpdateData(FALSE); 387 388 END: 389 390 CDialogEx::OnDropFiles(hDropInfo); 391 } 392 393 394 void CPECheckDlg::OnTcnSelchangeTabMain(NMHDR *pNMHDR, LRESULT *pResult) 395 { 396 // TODO: 在此添加控件通知处理程序代码 397 398 ULONG m_SelectTab = 0; 399 400 m_SelectTab = m_TabMain.GetCurSel(); 401 g_SelectTab = m_SelectTab; 402 403 CRect tabRect; 404 m_TabMain.GetClientRect(&tabRect); // 获取标签控件客户区Rect 405 // 调整tabRect，使其覆盖范围适合放置标签页 406 tabRect.left += 1; 407 tabRect.right -= 1; 408 tabRect.top += 25; 409 tabRect.bottom -= 1; 410 411 switch(m_SelectTab) 412 { 413 case 0: 414 { 415 416 m_PeHeaderDlg.SetWindowPos(NULL, tabRect.left, tabRect.top, tabRect.Width(), tabRect.Height(), SWP_SHOWWINDOW); 417 m_PeTableDlg.SetWindowPos(NULL, tabRect.left, tabRect.top, tabRect.Width(), tabRect.Height(), SWP_HIDEWINDOW); 418 m_PeHeaderDlg.CheckPEHeader(); 419 420 break; 421 } 422 423 case 1: 424 case 2: 425 case 3: 426 case 4: 427 case 5: 428 { 429 m_PeHeaderDlg.SetWindowPos(NULL, tabRect.left, tabRect.top, tabRect.Width(), tabRect.Height(), SWP_HIDEWINDOW); 430 m_PeTableDlg.SetWindowPos(NULL, tabRect.left, tabRect.top, tabRect.Width(), tabRect.Height(), SWP_SHOWWINDOW); 431 432 m_PeTableDlg.ShowPeTable(m_szFileData,PeType); 433 434 break; 435 } 436 437 438 } 439 440 441 *pResult = 0; 442 }
1 #pragma once 2 3 4 // CPEHeaderDlg 对话框 5 6 class CPEHeaderDlg : public CDialog 7 { 8 DECLARE_DYNAMIC(CPEHeaderDlg) 9 10 public: 11 CPEHeaderDlg(CWnd* pParent = NULL); // 标准构造函数 12 virtual ~CPEHeaderDlg(); 13 CHAR* m_FileData; 14 // 对话框数据 15 enum { IDD = IDD_DIALOG_PEHEADER }; 16 17 protected: 18 virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV 支持 19 20 DECLARE_MESSAGE_MAP() 21 public: 22 CString m_EditFileSign; 23 CString m_EditNumberofSec; 24 CString m_EditSizeOfOption; 25 CString m_EditOptionMagic; 26 CString m_EditOpEntry; 27 CString m_EditOpBaseOfData; 28 CString m_EditOpBaseOfCode; 29 CString m_EditSectionAligment; 30 CString m_EditFileAligment; 31 CString m_EditOpNumOfDir; 32 CString m_EditOpImageBase; 33 CString m_NumberofSection; 34 35 virtual BOOL OnInitDialog(); 36 VOID CPEHeaderDlg::CheckPEHeader(); 37 };
1 // PEHeaderDlg.cpp : 实现文件 2 // 3 4 #include "stdafx.h" 5 #include "PECheck.h" 6 #include "PEHeaderDlg.h" 7 #include "afxdialogex.h" 8 9 10 11 extern CHAR* g_szFileData; 12 // CPEHeaderDlg 对话框 13 14 IMPLEMENT_DYNAMIC(CPEHeaderDlg, CDialog) 15 16 CPEHeaderDlg::CPEHeaderDlg(CWnd* pParent /*=NULL*/) 17 : CDialog(CPEHeaderDlg::IDD, pParent) 18 , m_EditFileSign(_T("")) 19 , m_EditNumberofSec(_T("")) 20 , m_EditSizeOfOption(_T("")) 21 , m_EditOptionMagic(_T("")) 22 , m_EditOpEntry(_T("")) 23 , m_EditOpBaseOfData(_T("")) 24 , m_EditOpBaseOfCode(_T("")) 25 , m_EditSectionAligment(_T("")) 26 , m_EditFileAligment(_T("")) 27 , m_EditOpNumOfDir(_T("")) 28 , m_EditOpImageBase(_T("")) 29 { 30 m_FileData = g_szFileData; 31 } 32 33 CPEHeaderDlg::~CPEHeaderDlg() 34 { 35 } 36 37 void CPEHeaderDlg::DoDataExchange(CDataExchange* pDX) 38 { 39 CDialog::DoDataExchange(pDX); 40 DDX_Text(pDX, IDC_EDIT_PEHEASER_SIGN, m_EditFileSign); 41 DDX_Text(pDX, IDC_NUMBER_SECTION, m_EditNumberofSec); 42 DDX_Text(pDX, IDC_EDIT_PEHEADER_FILE_NUMBEROFSECTION, m_EditSizeOfOption); 43 DDX_Text(pDX, IDC_NUMBER_SECTION3, m_EditOptionMagic); 44 DDX_Text(pDX, IDC_NUMBER_SECTION5, m_EditOpEntry); 45 DDX_Text(pDX, IDC_NUMBER_SECTION8, m_EditOpBaseOfData); 46 DDX_Text(pDX, IDC_NUMBER_SECTION2, m_EditOpBaseOfCode); 47 DDX_Text(pDX, IDC_NUMBER_SECTION6, m_EditSectionAligment); 48 DDX_Text(pDX, IDC_NUMBER_SECTION7, m_EditFileAligment); 49 DDX_Text(pDX, IDC_NUMBER_SECTION4, m_EditOpNumOfDir); 50 DDX_Text(pDX, IDC_NUMBER_SECTION9, m_EditOpImageBase); 51 } 52 53 54 BEGIN_MESSAGE_MAP(CPEHeaderDlg, CDialog) 55 END_MESSAGE_MAP() 56 57 58 // CPEHeaderDlg 消息处理程序 59 60 61 BOOL CPEHeaderDlg::OnInitDialog() 62 { 63 CDialog::OnInitDialog(); 64 65 // TODO: 在此添加额外的初始化 66 67 CheckPEHeader(); 68 return TRUE; // return TRUE unless you set the focus to a control 69 // 异常: OCX 属性页应返回 FALSE 70 } 71 72 VOID CPEHeaderDlg::CheckPEHeader() 73 { 74 UpdateData(TRUE); 75 //exture szFileData; 76 PIMAGE_DOS_HEADER DosHead; 77 PIMAGE_NT_HEADERS NtHead = NULL; 78 IMAGE_FILE_HEADER FileHead = {0}; 79 ULONG FileKind = 0; 80 PIMAGE_NT_HEADERS64 NtHeader64 = NULL; 81 PIMAGE_NT_HEADERS32 NtHeader32 = NULL; 82 IMAGE_OPTIONAL_HEADER32 OptionHead32; 83 IMAGE_OPTIONAL_HEADER64 OptionHead64; 84 85 m_FileData = g_szFileData; 86 87 if (m_FileData == NULL) 88 { 89 90 return ; 91 } 92 DosHead = (PIMAGE_DOS_HEADER)m_FileData; 93 NtHead = (PIMAGE_NT_HEADERS)((ULONG)m_FileData+DosHead->e_lfanew); 94 CHAR szMagic[64] = {0}; 95 memcpy(szMagic,(CHAR*)NtHead,4); 96 97 m_EditFileSign = szMagic; 98 99 FileHead = NtHead->FileHeader; 100 m_NumberofSection.Format(L"%d",FileHead.NumberOfSections); 101 m_EditSizeOfOption.Format(L"0x%x",FileHead.SizeOfOptionalHeader); 102 if (FileHead.Machine == IMAGE_FILE_MACHINE_IA64||FileHead.Machine == IMAGE_FILE_MACHINE_AMD64) 103 { 104 FileKind = 64; 105 106 } 107 else if (FileHead.Machine == IMAGE_FILE_MACHINE_I386) 108 { 109 FileKind = 32; 110 } 111 112 else 113 { 114 FileKind = -1; 115 } 116 117 switch(FileKind) 118 { 119 case 32:{ 120 121 NtHeader32 = (PIMAGE_NT_HEADERS32)NtHead; 122 OptionHead32 = NtHeader32->OptionalHeader; 123 124 if (OptionHead32.Magic==0x0107) 125 { 126 m_EditOptionMagic.Format(L"ROM映像"); 127 } 128 else if (OptionHead32.Magic==0x010B) 129 { 130 m_EditOptionMagic.Format(L"可执行映像"); 131 } 132 else 133 { 134 m_EditOptionMagic.Format(L"PE32+"); 135 } 136 137 m_EditOpEntry.Format(L"0x%x",OptionHead32.AddressOfEntryPoint); 138 m_EditOpBaseOfData.Format(L"0x%x",OptionHead32.BaseOfData); 139 m_EditOpBaseOfCode.Format(L"0x%x",OptionHead32.BaseOfCode); 140 m_EditSectionAligment.Format(L"0x%x",OptionHead32.SectionAlignment); 141 m_EditFileAligment.Format(L"0x%x",OptionHead32.FileAlignment); 142 m_EditOpNumOfDir.Format(L"%d",OptionHead32.NumberOfRvaAndSizes); 143 m_EditOpImageBase.Format(L"0x%x",OptionHead32.ImageBase); 144 145 break; 146 } 147 148 case 64: 149 { 150 NtHeader64 = (PIMAGE_NT_HEADERS64)NtHead; 151 OptionHead64 = NtHeader64->OptionalHeader; 152 153 if (OptionHead64.Magic==0x0107) 154 { 155 m_EditOptionMagic.Format(L"ROM映像"); 156 } 157 else if (OptionHead64.Magic==0x010B) 158 { 159 m_EditOptionMagic.Format(L"可执行映像"); 160 } 161 else 162 { 163 m_EditOptionMagic.Format(L"PE32+"); 164 } 165 166 m_EditOpEntry.Format(L"0x%x",OptionHead64.AddressOfEntryPoint); 167 m_EditOpBaseOfCode.Format(L"0x%x",OptionHead64.BaseOfCode); 168 m_EditSectionAligment.Format(L"0x%x",OptionHead64.SectionAlignment); 169 m_EditFileAligment.Format(L"0x%x",OptionHead64.FileAlignment); 170 m_EditOpNumOfDir.Format(L"%d",OptionHead64.NumberOfRvaAndSizes); 171 m_EditOpImageBase.Format(L"0x%p",OptionHead64.ImageBase); 172 break; 173 } 174 175 default: 176 break; 177 178 } 179 180 UpdateData(FALSE); 181 182 183 184 }