PE Header auslesen

    • Allgemein

    Es gibt 3 Antworten in diesem Thema. Der letzte Beitrag () ist von Myrax.

      PE Header auslesen

      Hallo,

      ich habe einen evtl seltenen Quellcode gefunden, mit dem man die Header einer PE Datei auslesen kann:
      DOS-, NT- und Sectionheader.

      Ich habe den Code nur auf das Auslesen der Header gekürzt, Credits gehen an w!cKed

      VB.NET-Quellcode

      1. 'all crediz to w!cKed
      3. Imports System.IO
      4. Imports System.Runtime.InteropServices
      6. Class PE_Header
      8. #Region "Structures"
      10. <StructLayout(LayoutKind.Sequential)> _
      11. Private Structure IMAGE_DOS_HEADER
      12. Public e_magic As UInt16
      13. Public e_cblp As UInt16
      14. Public e_cp As UInt16
      15. Public e_crlc As UInt16
      16. Public e_cparhdr As UInt16
      17. Public e_minalloc As UInt16
      18. Public e_maxalloc As UInt16
      19. Public e_ss As UInt16
      20. Public e_sp As UInt16
      21. Public e_csum As UInt16
      22. Public e_ip As UInt16
      23. Public e_cs As UInt16
      24. Public e_lfarlc As UInt16
      25. Public e_ovno As UInt16
      26. <MarshalAs(UnmanagedType.ByValArray, SizeConst:=4)> _
      27. Public e_res1 As UInt16()
      28. Public e_oemid As UInt16
      29. Public e_oeminfo As UInt16
      30. <MarshalAs(UnmanagedType.ByValArray, SizeConst:=10)> _
      31. Public e_res2 As UInt16()
      32. Public e_lfanew As Int32
      33. End Structure
      35. <StructLayout(LayoutKind.Sequential)> _
      36. Private Structure IMAGE_FILE_HEADER
      37. Public Machine As UInt16
      38. Public NumberOfSections As UInt16
      39. Public TimeDateStamp As UInt32
      40. Public PointerToSymbolTable As UInt32
      41. Public NumberOfSymbols As UInt32
      42. Public SizeOfOptionalHeader As UInt16
      43. Public Characteristics As UInt16
      44. End Structure
      46. <StructLayout(LayoutKind.Sequential)> _
      47. Private Structure IMAGE_DATA_DIRECTORY
      48. Public VirtualAddress As UInt32
      49. Public Size As UInt32
      50. End Structure
      52. <StructLayout(LayoutKind.Sequential)> _
      53. Private Structure IMAGE_OPTIONAL_HEADER32
      54. Public Magic As UInt16
      55. Public MajorLinkerVersion As [Byte]
      56. Public MinorLinkerVersion As [Byte]
      57. Public SizeOfCode As UInt32
      58. Public SizeOfInitializedData As UInt32
      59. Public SizeOfUninitializedData As UInt32
      60. Public AddressOfEntryPoint As UInt32
      61. Public BaseOfCode As UInt32
      62. Public BaseOfData As UInt32
      63. Public ImageBase As UInt32
      64. Public SectionAlignment As UInt32
      65. Public FileAlignment As UInt32
      66. Public MajorOperatingSystemVersion As UInt16
      67. Public MinorOperatingSystemVersion As UInt16
      68. Public MajorImageVersion As UInt16
      69. Public MinorImageVersion As UInt16
      70. Public MajorSubsystemVersion As UInt16
      71. Public MinorSubsystemVersion As UInt16
      72. Public Win32VersionValue As UInt32
      73. Public SizeOfImage As UInt32
      74. Public SizeOfHeaders As UInt32
      75. Public CheckSum As UInt32
      76. Public Subsystem As UInt16
      77. Public DllCharacteristics As UInt16
      78. Public SizeOfStackReserve As UInt32
      79. Public SizeOfStackCommit As UInt32
      80. Public SizeOfHeapReserve As UInt32
      81. Public SizeOfHeapCommit As UInt32
      82. Public LoaderFlags As UInt32
      83. Public NumberOfRvaAndSizes As UInt32
      84. <MarshalAs(UnmanagedType.ByValArray, SizeConst:=16)> _
      85. Public DataDirectory As IMAGE_DATA_DIRECTORY()
      86. End Structure
      88. <StructLayout(LayoutKind.Sequential)> _
      89. Private Structure IMAGE_NT_HEADERS
      90. Public Signature As UInt32
      91. Public FileHeader As IMAGE_FILE_HEADER
      92. Public OptionalHeader As IMAGE_OPTIONAL_HEADER32
      93. End Structure
      95. <StructLayout(LayoutKind.Sequential)> _
      96. Private Structure IMAGE_SECTION_HEADER
      97. <MarshalAs(UnmanagedType.ByValArray, SizeConst:=8)> _
      98. Public Name As Byte()
      99. Public VirtualSize As UIntPtr
      100. Public VirtualAddress As UInteger
      101. Public SizeOfRawData As UInteger
      102. Public PointerToRawData As UInteger
      103. Public PointerToRelocations As UInteger
      104. Public PointerToLinenumbers As UInteger
      105. Public NumberOfRelocations As Short
      106. Public NumberOfLinenumbers As Short
      107. Public Characteristics As UInteger
      108. End Structure
      109. #End Region
      111. Public Function Get_PE_Header(ByVal sFilePath As String) As Boolean
      112. Dim DHD As New IMAGE_DOS_HEADER()
      113. Dim NHD As New IMAGE_NT_HEADERS()
      114. Dim SHD As New IMAGE_SECTION_HEADER()
      116. Dim iPointer As Integer = 0
      117. Dim lLastSectPos As Long = 0
      118. Dim lSize As Long = 0
      119. Dim lAlign As Long = 0
      120. Dim lDataSize As Long = 0
      121. Dim fBytes As Byte() = New Byte(-1) {}
      123. Try
      124. Dim bReader As New BinaryReader(New FileStream(sFilePath, FileMode.Open, FileAccess.Read))
      125. fBytes = bReader.ReadBytes(CInt(bReader.BaseStream.Length))
      126. bReader.Close()
      127. Catch
      128. End Try
      129. If fBytes.Length <= 0 Then
      130. Return False
      131. End If
      133. Dim gHandle As GCHandle = GCHandle.Alloc(fBytes, GCHandleType.Pinned)
      134. iPointer = gHandle.AddrOfPinnedObject().ToInt32()
      136. 'IMAGE_DOS_HEADER
      137. DHD = CType(Marshal.PtrToStructure(New IntPtr(iPointer), GetType(IMAGE_DOS_HEADER)), IMAGE_DOS_HEADER)
      138. 'IMAGE_NT_HEADERS
      139. NHD = CType(Marshal.PtrToStructure(New IntPtr(iPointer + DHD.e_lfanew), GetType(IMAGE_NT_HEADERS)), IMAGE_NT_HEADERS)
      142. If NHD.Signature <> 17744 OrElse DHD.e_magic <> 23117 Then
      143. Return False
      144. End If
      146. lLastSectPos = DHD.e_lfanew + Marshal.SizeOf(New IMAGE_NT_HEADERS()) + (NHD.FileHeader.NumberOfSections - 1) * Marshal.SizeOf(New IMAGE_SECTION_HEADER())
      147. 'IMAGE_SECTION_HEADER
      148. SHD = CType(Marshal.PtrToStructure(New IntPtr(iPointer + lLastSectPos), GetType(IMAGE_SECTION_HEADER)), IMAGE_SECTION_HEADER)
      150. Return True
      151. End Function
      154. End Class
      Für ein Mindestmaß an Rechtschreibung, Interpunktion und Majuskeln!

      Wenn ich jetzt mal dumm fragen dürfte... wozu braucht man dass jetzt genau?
      Wird da lediglich nur überprüft ob das File ausführbar ist oder nicht?

      MFG
      GOOGLE ist mein Meister :)

      Naja, ist schon sehr speziell, aber hier ein Beispiel:
      du kannst mit dem IMAGE_NT_HEADER, den IMAGE_FILE_HEADER und somit die Machine-Flag auslesen. Damit kannst du herausfinden, ob die Datei für 64bit kompiliert ist (0x8664) oder für x386 (0x14c).
      Für ein Mindestmaß an Rechtschreibung, Interpunktion und Majuskeln!

    Facebook
    Telefonspende