在c中读取PE文件

Question

我需要检查文件是否是PE文件。我需要检查前两个字节是否是MZ，我这样做了。

这是我的任务：在验证PE格式时，不仅要根据MZ表达式，还要使用以下条件：读取IMAGE_NT_HEADERS结构，通过读取IMAGE_FILE_HEADER字段验证Signature字段，并且Machine字段等于Th值IMAGE_FILE_Machine_I386或IMAGE_FFILE_Machine_AMD64。

我想不出其余的怎么做。我希望你能帮助我。

int checkPE(char *file){
int fd=open(file,READ_FLAGS,0777);
char buffer[TWOBYTE+1] = {''};
size_t bytes_read;
char ch;
if(fd==-1){ //if file cannot be opened give a error message.
perror("The file cannot be opened.n");
return -1;
}

bytes_read = read(fd,buffer,TWOBYTE); 
if(bytes_read==-1){ 
perror("Error while reading filen");
return -1;
}
if(strcmp(buffer,MZ)!=0){
return -1;
}

int closeFlag = close(fd); 
if(closeFlag==-1){ 
perror("The file cannot be closed.n");
return -1;
}
}

Answer 1

没有什么比解析一些结构更简单的了。你已经有了算法。我认为您只需要实现。考虑下面的实用程序示例。

PS ：有关更多详细信息，请在下面发表评论。

#include <stdio.h> 
#include <windows.h>

BOOL CheckValidity(BYTE* baseAddress);
int main(int argc, char* argv[]) {
if (argc != 2)
{
printf("You didn't specified a PE file.n");
printf("Usage: CheckPEImage.exe <Full path of PE File>n");
return -1;
}
HANDLE hFile = CreateFileA(argv[1], GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);
if (hFile == INVALID_HANDLE_VALUE)
return -1;
HANDLE hMemoryMap = CreateFileMappingA(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
if (!hMemoryMap)
return -2;
PBYTE baseAddress = (PBYTE)MapViewOfFile(hMemoryMap, FILE_MAP_READ, 0, 0, 0);
if (!baseAddress)
return -3;
printf("PE Image is %s.n", CheckValidity(baseAddress) ? "valid" : "invalid");
getchar();
return 0;
} 
BOOL CheckValidity(BYTE* baseAddress)
{
PIMAGE_DOS_HEADER lpDosHeader;
PIMAGE_FILE_HEADER lpFileHeader;
PIMAGE_NT_HEADERS lpNtHeaders;
PIMAGE_OPTIONAL_HEADER lpOptionalHeader;
lpDosHeader = (PIMAGE_DOS_HEADER)baseAddress;
lpNtHeaders = (PIMAGE_NT_HEADERS)(baseAddress + lpDosHeader->e_lfanew); 
if (lpDosHeader->e_magic != IMAGE_DOS_SIGNATURE) 
return FALSE;
if (lpNtHeaders->Signature != IMAGE_NT_SIGNATURE) 
return FALSE;
if (lpNtHeaders->FileHeader.Machine != IMAGE_FILE_MACHINE_I386 && lpNtHeaders->FileHeader.Machine != IMAGE_FILE_MACHINE_AMD64)
return FALSE;
return TRUE;
}