pe工具03-获取节表信息

1.目标
点击按钮“区段”弹出节表框，显示当前所选pe文件的节表信息
2.分析
1）画一个新对话框；只需要一个listView即可；
2）按钮的点击事件中调用DialogBox弹出该对话框；
3）在新对话框的回调函数的窗口加载事件中初始化listview；
4）为了得到节表信息，需要知道pe文件的路径；该路径在获取pe信息是已经得到，用全局变量来保存即可；
3.主要代码
//遍历节信息
void getSectionInfo(HWND hSection){
    PIMAGE_DOS_HEADER dosHeader = NULL;            //dos头指针
    PIMAGE_FILE_HEADER peHeader = NULL;        //pe头指针
    PIMAGE_OPTIONAL_HEADER32 opHeader = NULL;    //可选pe头指针
    PIMAGE_SECTION_HEADER secHeader = NULL;    //节表指针
 
    //读入pe文件
    LPVOID pFileBuffer = NULL;
    ::readPeFile(szFileName, &pFileBuffer);
    if(!pFileBuffer){
        return;
    }
 
    //给pe结构头指针赋值
    dosHeader = (PIMAGE_DOS_HEADER) pFileBuffer;
    peHeader = (PIMAGE_FILE_HEADER) ((DWORD)pFileBuffer + dosHeader->e_lfanew + 4);
    opHeader = (PIMAGE_OPTIONAL_HEADER32) ((DWORD)peHeader + IMAGE_SIZEOF_FILE_HEADER);
    secHeader = (PIMAGE_SECTION_HEADER) ((DWORD)opHeader + peHeader->SizeOfOptionalHeader);
 
    DWORD secNum = peHeader->NumberOfSections;
    for(int i=0;i<secNum;i++){
        PIMAGE_SECTION_HEADER pSec = secHeader + i;
 
        LV_ITEM vitem;
        //初始化                
        memset(&vitem,0,sizeof(LV_ITEM));                
        vitem.mask = LVIF_TEXT;                
        
        //节名
        TCHAR szSecName[9]={0};
        memcpy(szSecName, pSec->Name, 8);
        vitem.pszText = szSecName;    //值                
        vitem.iItem = i;                //行                
        vitem.iSubItem = 0;                //列            
        SendMessage(hSection, LVM_INSERTITEM,0,(DWORD)&vitem);    
 
        //内存偏移
        TCHAR szVirtualAddress[10] = {0};
        sprintf(szVirtualAddress,"%08x",pSec->VirtualAddress);    //数字转字符串
        vitem.pszText = szVirtualAddress;                
        vitem.iItem = i;                
        vitem.iSubItem = 1;                
        ListView_SetItem(hSection, &vitem);   
        
        //内存大小
        TCHAR szMisc[10] = {0};
        sprintf(szMisc,"%08x",pSec->Misc.VirtualSize);    //数字转字符串
        vitem.pszText = szMisc;                
        vitem.iItem = i;                
        vitem.iSubItem = 2;                
        ListView_SetItem(hSection, &vitem);  
 
        //文件偏移
        TCHAR szPointerToRawData[10] = {0};
        sprintf(szPointerToRawData,"%08x",pSec->PointerToRawData);    //数字转字符串
        vitem.pszText = szPointerToRawData;                
        vitem.iItem = i;                
        vitem.iSubItem = 3;                
        ListView_SetItem(hSection, &vitem);  
 
        //文件大小
        TCHAR szSizeOfRawData[10] = {0};
        sprintf(szSizeOfRawData,"%08x",pSec->SizeOfRawData);    //数字转字符串
        vitem.pszText = szSizeOfRawData;                
        vitem.iItem = i;                
        vitem.iSubItem = 4;                
        ListView_SetItem(hSection, &vitem);  
 
        //属性
        TCHAR szChar[10] = {0};
        sprintf(szChar,"%08x",pSec->Characteristics);    //数字转字符串
        vitem.pszText = szChar;                
        vitem.iItem = i;                
        vitem.iSubItem = 5;                
        ListView_SetItem(hSection, &vitem);  
    }
    
    free(pFileBuffer);
}
 
 
//节表列
void initSectionView(HWND hDlg){
    LV_COLUMN lv;                                
    HWND hSection;                                
                                
    //初始化，局部变量堆栈中分配，不知道是什么数据所以先清零                                
    memset(&lv,0,sizeof(LV_COLUMN));                                
    //获取listview控件句柄                                
    hSection = GetDlgItem(hDlg,IDC_LIST_SEC);                                
    //设置整行选中，窗口是windows来管理的无法直接操作，程序能做的只能发送一个消息来让windows直到该怎么做                                
    SendMessage(hSection,LVM_SETEXTENDEDLISTVIEWSTYLE,LVS_EX_FULLROWSELECT,LVS_EX_FULLROWSELECT);                                
                                
    //第一列                                
    lv.mask = LVCF_TEXT | LVCF_WIDTH | LVCF_SUBITEM;                                
    lv.pszText = TEXT("节名");                //列标题                
    lv.cx = 160;                                //列宽
    lv.iSubItem = 0;                                
    //ListView_InsertColumn(hListProcess, 0, &lv);                                
    SendMessage(hSection,LVM_INSERTCOLUMN,0,(DWORD)&lv);                                
    //第二列                                
    lv.pszText = TEXT("内存偏移");                                
    lv.cx = 100;                                
    lv.iSubItem = 1;                                
    //ListView_InsertColumn(hListProcess, 1, &lv);                                
    SendMessage(hSection,LVM_INSERTCOLUMN,1,(DWORD)&lv);
                                
    lv.pszText = TEXT("内存大小");                                
    lv.cx = 100;                                
    lv.iSubItem = 2;                                                                
    SendMessage(hSection,LVM_INSERTCOLUMN,2,(DWORD)&lv);
                              
    lv.pszText = TEXT("文件偏移");                                
    lv.cx = 100;                                
    lv.iSubItem = 3;                                                             
    SendMessage(hSection,LVM_INSERTCOLUMN,3,(DWORD)&lv);
                                
    lv.pszText = TEXT("文件大小");                                
    lv.cx = 100;                                
    lv.iSubItem = 4;                                                              
    SendMessage(hSection,LVM_INSERTCOLUMN,4,(DWORD)&lv);
                               
    lv.pszText = TEXT("属性");                                
    lv.cx = 100;                                
    lv.iSubItem = 5;                                                               
    SendMessage(hSection,LVM_INSERTCOLUMN,5,(DWORD)&lv);
 
    getSectionInfo(hSection);                          
}
pe工具03-获取节表信息

推荐阅读
