资源表、重定位表

  1. // win原理Day003.cpp : 定义控制台应用程序的入口点。
  2. //
  4. #include "stdafx.h"
  5. #include <windows.h>
  6. //1 把文件读到内存中
  7. char* ReadFileToMemory(char* pFilePath)
  8. {
  9.     //1 获取文件句柄
  10.     HANDLE hFile = CreateFileA(pFilePath,
  11.         GENERIC_READ | GENERIC_WRITE,
  12.         FALSE,
  13.         NULL,
  14.         OPEN_EXISTING,
  15.         FILE_ATTRIBUTE_NORMAL,
  16.         NULL);
  17.     if (hFile == INVALID_HANDLE_VALUE)
  18.     {
  19.         printf("文件打开失败\n");
  20.         return 0;
  21.     }
  22.     //2.获取文件大小
  23.     DWORD dwFileSize = GetFileSize(hFile, NULL);
  24.     //3.申请内存空间
  25.     char* pBuf = new char[dwFileSize]{};
  26.     if (!pBuf)
  27.     {
  28.         CloseHandle(hFile);
  29.         printf("内存申请失败\n");
  30.         return 0;
  31.     }
  32.     //4.读取文件内容到内存空间
  33.     DWORD dwRead;
  34.     ReadFile(hFile, pBuf, dwFileSize, &dwRead, NULL);
  35.     //5. 返回内存地址
  36.     return pBuf;
  37. }
  38. //2 是否是PE文件
  39. bool IsPeFile(char* pBuf)
  40. {
  41.     PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)pBuf;
  42.     if (pDos->e_magic != IMAGE_DOS_SIGNATURE)
  43.     {
  44.         printf("不是PE文件\n");
  45.         return false;
  46.     }
  47.     PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)
  48.         (pDos->e_lfanew + pBuf);
  49.     if (pNt->Signature != IMAGE_NT_SIGNATURE)
  50.     {
  51.         printf("不是PE文件\n");
  52.         return false;
  53.     }
  54.     return true;
  55. }
  57. //RVA to FOA
  58. DWORD RVAtoFOA(DWORD dwRVA, char* pBuf)
  59. {
  60.     PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)pBuf;
  61.     PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(pDos->e_lfanew + pBuf);
  62.     //区段个数（文件头第二个字段）
  63.     DWORD dwCount = pNt->FileHeader.NumberOfSections;
  64.     //区段首地址（IMAGE_FIRST_SECTION）
  65.     PIMAGE_SECTION_HEADER pSec = IMAGE_FIRST_SECTION(pNt);
  67.     for (DWORD i = 0; i < dwCount; i++)
  68.     {
  69.         //FOA = RVA - 内存中区段首地址 + 文件中区段首地址
  70.         if (dwRVA >= pSec->VirtualAddress &&
  71.             dwRVA < pSec->VirtualAddress + pSec->SizeOfRawData)
  72.         {
  73.             return dwRVA - pSec->VirtualAddress + pSec->PointerToRawData;
  74.         }
  75.         //下一个区段表
  76.         pSec++;
  77.     }
  78.     return 0;
  79. }
  80. /*
  81. //低16位是其ID
  82. char* arryResType[] = { "", "鼠标指针（Cursor）", "位图（Bitmap）", "图标（Icon）", "菜单（Menu）"
  83. , "对话框（Dialog）", "字符串列表（String Table）", "字体目录（Font Directory）", "字体（Font）", "快捷键（Accelerators）"
  84. , "非格式化资源（Unformatted）", "消息列表（Message Table）", "鼠标指针组（Croup Cursor）", "", "图标组（Group Icon）", ""
  85. , "版本信息（Version Information）" };
  86. */
  88. //解析资源表
  89. void ShowResouceTable(char* pBuf)
  90. {
  91.     PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)pBuf;
  92.     PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(pDos->e_lfanew + pBuf);
  93.     //找到资源表（数据目录表的第三项）
  94.     DWORD dwResRVA = pNt->OptionalHeader.DataDirectory[2].VirtualAddress;
  95.     //资源表在文件中的具体文件地址
  96.     DWORD dwResRoot = (DWORD)(RVAtoFOA(dwResRVA, pBuf) + pBuf);
  97.     //开始解析
  98.     //第一层地址
  99.     PIMAGE_RESOURCE_DIRECTORY pRes1 = (PIMAGE_RESOURCE_DIRECTORY)dwResRoot;
  100.     //第一层总个数
  101.     DWORD dwCount_1 = pRes1->NumberOfIdEntries + pRes1->NumberOfNamedEntries;
  102.     //第一层资源项的起始地址
  103.     PIMAGE_RESOURCE_DIRECTORY_ENTRY pEntry1 = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(pRes1 + 1);
  104.     for (DWORD i = 0; i < dwCount_1; i++)
  105.     {
  106.         //判断资源命名方式
  107.         if (pEntry1->NameIsString)
  108.         {
  109.             //字符串命名
  110.             PIMAGE_RESOURCE_DIR_STRING_U pName = 
  111.                 (PIMAGE_RESOURCE_DIR_STRING_U)
  112.                 (pEntry1->NameOffset + dwResRoot);
  113.             //资源字符是WCHAR类型
  114.             //在文件中并不是以0为结尾存储的
  115.             WCHAR * wcName = new WCHAR[pName->Length+1]{};
  116.             memcpy(wcName, pName->NameString, pName->Length * 2);
  117.             printf("资源种类名称：【%S】\n", wcName);
  118.             delete wcName;
  119.         }
  120.         else
  121.         {
  122.             //ID命名
  123.             //低16位是其ID
  124.             char* arryResType[] = { "", "鼠标指针（Cursor）", "位图（Bitmap）", "图标（Icon）", "菜单（Menu）"
  125.                 , "对话框（Dialog）", "字符串列表（String Table）", "字体目录（Font Directory）", "字体（Font）", "快捷键（Accelerators）"
  126.                 , "非格式化资源（Unformatted）", "消息列表（Message Table）", "鼠标指针组（Croup Cursor）", "", "图标组（Group Icon）", ""
  127.                 , "版本信息（Version Information）" };
  128.             if (pEntry1->Id > 17)
  129.             {
  130.                 printf("资源种类ID:【%d】\n", pEntry1->Id);
  131.             } 
  132.             else
  133.             {
  134.                 printf("资源种类ID:【%s】\n", arryResType[pEntry1->Id]);
  135.             }
  136.         }
  137.         //判断是否有下一层
  138.         if (pEntry1->DataIsDirectory)
  139.         {
  140.             //第二层起始地址
  141.             PIMAGE_RESOURCE_DIRECTORY pRes2 = 
  142.                 (PIMAGE_RESOURCE_DIRECTORY)
  143.                 (pEntry1->OffsetToDirectory + dwResRoot);
  144.             //第二层资源个数
  145.             DWORD dwCount2 = pRes2->NumberOfIdEntries + pRes2->NumberOfNamedEntries;
  146.             //第二层资源项的起始地址
  147.             PIMAGE_RESOURCE_DIRECTORY_ENTRY pEntry2 = 
  148.                 (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(pRes2 + 1);
  149.             for (DWORD i2 = 0; i2 < dwCount2; i2++)
  150.             {
  151.                 //判断资源命名方式
  152.                 if (pEntry2->NameIsString)
  153.                 {
  154.                     //字符串命名
  155.                     PIMAGE_RESOURCE_DIR_STRING_U pName =
  156.                         (PIMAGE_RESOURCE_DIR_STRING_U)
  157.                         (pEntry2->NameOffset + dwResRoot);
  158.                     //资源字符是WCHAR类型
  159.                     WCHAR * wcName = new WCHAR[pName->Length + 1]{};
  160.                     memcpy(wcName, pName->NameString, pName->Length * 2);
  161.                     printf("\t资源名称：【%S】\n", wcName);
  162.                     delete wcName;
  163.                 }
  164.                 else
  165.                 {
  166.                     //ID命名
  167.                     printf("\t资源ID:【%d】\n", pEntry2->Id);
  168.                 }
  170.                 //判断是否有下一层
  171.                 if (pEntry2->DataIsDirectory)
  172.                 {
  173.                     //第三层
  174.                     PIMAGE_RESOURCE_DIRECTORY pRes3 = 
  175.                         (PIMAGE_RESOURCE_DIRECTORY)
  176.                         (pEntry2->OffsetToDirectory + dwResRoot);
  177.                     //资源个数
  178.                     DWORD dwCount3 = pRes3->NumberOfIdEntries + pRes3->NumberOfNamedEntries;
  179.                     PIMAGE_RESOURCE_DIRECTORY_ENTRY pEntry3 = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(pRes3 + 1);
  181.                     //资源类别（英文的或者中文的等等）
  182.                     //pEntry3->Name;
  183.                     PIMAGE_RESOURCE_DATA_ENTRY pData = (PIMAGE_RESOURCE_DATA_ENTRY)(pEntry3->OffsetToData + dwResRoot);
  184.                     //资源的数据大小
  185.                     DWORD dwDataSize = pData->Size;
  186.                     //pData->OffsetToData,资源数据的RVA
  187.                     DWORD dwDataFOA = RVAtoFOA(pData->OffsetToData, pBuf);
  188.                     PBYTE pByteData = (PBYTE)(dwDataFOA + pBuf);
  189.                     //这里输出前10个字节
  190.                     printf("\t\t");
  191.                     for (int n = 0; n < 10; n++)
  192.                     {
  193.                         printf("%02X ", pByteData[n]);
  194.                     }
  195.                     printf("\n");
  196.                 }
  197.                 //下一个资源
  198.                 pEntry2++;
  199.             }
  200.         }
  201.         //下一种资源
  202.         pEntry1++;
  203.     }
  205. }
  207. //解析重定位表
  208. void ShowRelocTable(char* pBuf)
  209. {
  210.     PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)pBuf;
  211.     PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(pDos->e_lfanew + pBuf);
  212.     //找到重定位表（数据目录表第六项）
  213.     //解析
  214.     DWORD dwRelocRVA = pNt->OptionalHeader.DataDirectory[5].VirtualAddress;
  215.     //得到重定位表在文件中的地址
  216.     PIMAGE_BASE_RELOCATION pReloc = 
  217.         (PIMAGE_BASE_RELOCATION)
  218.         (RVAtoFOA(dwRelocRVA, pBuf) + pBuf);
  220.     struct TypeOffset //重定位项结构
  221.     {
  222.         WORD offset : 12;  //低12位表示相对于本块记录的内存页的偏移量
  223.         WORD type : 4;     //高4位表示需要修正几个字节（0：不需要修正；3：修正4个字节；0x10：修正8个字节）
  224.     };
  225.     int n = 1;//重定位块个数
  226.     while (pReloc->SizeOfBlock)
  227.     {
  228.         printf("第%d块【0x%08X】\n", n++, pReloc->VirtualAddress);
  229.         //计算重定位项的个数
  230.         DWORD dwCount = (pReloc->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / sizeof(WORD);
  231.         //重定位项数组的首地址
  232.         TypeOffset* pOffset = (TypeOffset*)(pReloc + 1);
  233.         for (int i = 0; i < dwCount; i++)
  234.         {
  235.             if (pOffset->type == 3)
  236.             {
  237.                 DWORD dwDataRVA = pOffset->offset + pReloc->VirtualAddress;
  238.                 DWORD* pRelocData = (DWORD*)(RVAtoFOA(dwDataRVA, pBuf) + pBuf);
  239.                 printf("\t需要修正的数据：0x%08X\n", *pRelocData);
  240.                 //如果程序运行起来，修正的方式
  241.                 //*pRelocData = *pRelocData - 默认加载基址 + 新的加载基址；
  242.             }
  243.             //下一个重定位项
  244.             pOffset++;
  245.         }
  247.         //下一个重定位块的地址
  248.         pReloc = (PIMAGE_BASE_RELOCATION)
  249.             ((DWORD)pReloc + pReloc->SizeOfBlock);
  250.     }
  251. }
  253. int _tmain(int argc, _TCHAR* argv[])
  254. {
  255.     char* pBuf = ReadFileToMemory("123.exe");
  256.     if (IsPeFile(pBuf))
  257.     {
  258.         //ShowResouceTable(pBuf);
  259.         ShowRelocTable(pBuf);
  260.     }
  261.     //释放内存
  262.     delete pBuf;
  263.     return 0;
  264. }