PE

#include <iostream>
#include <windows.h>


//DOC结构
typedef struct _DOC_HEADER
{
	WORD  e_magic;
	WORD  e_cblp;
	WORD  e_cp;
	WORD  e_crlc;
	WORD  e_cparhar;
	WORD  e_minalloc;
	WORD  e_maxalloc;
	WORD  e_ss;
	WORD  e_sp;
	WORD  e_csum;
	WORD  e_ip;
	WORD  e_cs;
	WORD  e_lfarlc;
	WORD  e_ovno;
	WORD  e_res[4];
	WORD  e_oemid;
	WORD  e_oeminfo;
	WORD  e_res2[10];
	DWORD e_lfanew;
}PeDoc;
//FILE结构
typedef struct _STANDARD_PE_HEADER
{
	WORD Machine;
	WORD NumberOfSections;
	DWORD TimeDateStamp;
	DWORD PointerToSymbolTable;
	DWORD NumberOfSymbols;
	WORD SizeOfOptionalHeader;
	WORD Characteristics;
}StandardPeHeader;
//OPTIONAL结构
typedef struct _OPTIONAL_PE_HEADER
{
	WORD Magic;
	BYTE MajorLinkerVersion;
	BYTE MinorLinkerVersion;
	DWORD SizeOfCode;
	DWORD SizeOfInitializedData;
	DWORD SizeOfUninitializedData;
	DWORD AddressOfEntryPoint;
	DWORD BaseOfCode;
	DWORD BaseOfData;
	DWORD ImageBase;
	DWORD SectionAlignment;
	DWORD FileAlignment;
	WORD MajorOperatingSystemVersion;
	WORD MinorOperatingSystemVersion;
	WORD MajorImageVersion;
	WORD MinorImageVersion;
	WORD MajorSubsystemVersion;
	WORD MinorSubsystemVersion;
	DWORD Win32VersionValue;
	DWORD SizeOfImage;
	DWORD SizeOfHeaders;
	DWORD CheckSum;
	WORD Subsystem;
	WORD DllCharacteristics;
	DWORD SizeOfStackReserve;
	DWORD SizeOfStackCommit;
	DWORD SizeOfHeapReserve;
	DWORD SizeOfHeapCommit;
	DWORD LoaderFlags;
	DWORD NumberOfRvaAndSizes;
}OptionalPeHeader;

/// <summary>
/// 读取pe数据
/// </summary>
/// <param name="lpszFile">pe文件路径</param>
/// <returns>pe数据数组</returns>
char* ReadPeFile(const char* peFIle)
{
	//变量声明
	FILE* peFile = fopen( peFIle, "rb");   //pe文件对象
	unsigned int peSize = NULL;           //pe文件大小
	char* peData = nullptr;               //pe数据（所有字节）

	if (peFile == NULL)
	{
		printf("文件打开失败！（%d）\n", __LINE__);
		goto END;
	}

	//获取pe文件大小
	if (fseek(peFile, 0, SEEK_END) != 0)
	{
		printf("指针移动失败！（%d）\n", __LINE__);
		goto END;
	}
	peSize = ftell(peFile);
	if (peSize == 0)
	{
		printf("程序没有任何数据！（%d）\n", __LINE__);
		goto END;
	}

	if (fseek(peFile, 0, SEEK_SET) != 0)
	{
		printf("指针移动失败！（%d）\n", __LINE__);
		goto END;
	}

	//根据pe文件大小开辟内存存放pe数据
	peData = (char*)malloc(peSize);
	if (peData != NULL)
	{
		memset(peData, '0', peSize);
		//读取pe数据
		fread(peData, sizeof(char), peSize, peFile);
	}

END:
	if (peFile)
		fclose(peFile);

	return peData;
}

/// <summary>
/// 读取DOC/FILE/OPTIONAL表数据
/// </summary>
/// <param name="peData">pe结构数组头</param>
/// <param name="doc">doc结构指针</param>
/// <param name="standard">file结构指针</param>
/// <param name="optional">optional结构指针</param>
void ReadPeData(char* peData, PeDoc*& doc, StandardPeHeader*& standard, OptionalPeHeader*& optional)
{
	doc = (PeDoc*)peData;
	peData = &peData[doc->e_lfanew + 4];
	standard = (StandardPeHeader*)peData;
	peData = &peData[20];
	optional = (OptionalPeHeader*)peData;
}

//输出doc数据
void printDoc(PeDoc* doc)
{
	printf(">>>> DOC <<<<\n");
	printf("e_magic    = %x\n", doc->e_magic);
	printf("e_cblp     = %x\n", doc->e_cblp);
	printf("e_cp       = %x\n", doc->e_cp);
	printf("e_crlc     = %x\n", doc->e_crlc);
	printf("e_cparhar  = %x\n", doc->e_cparhar);
	printf("e_minalloc = %x\n", doc->e_minalloc);
	printf("e_maxalloc = %x\n", doc->e_maxalloc);
	printf("e_ss       = %x\n", doc->e_ss);
	printf("e_sp       = %x\n", doc->e_ss);
	printf("e_csum     = %x\n", doc->e_csum);
	printf("e_ip       = %x\n", doc->e_ip);
	printf("e_cs       = %x\n", doc->e_cs);
	printf("e_lfarlc   = %x\n", doc->e_lfarlc);
	printf("e_ovno     = %x\n", doc->e_ovno);
	printf("e_res      = %x%x%x%x\n", doc->e_res[0], doc->e_res[1], doc->e_res[2], doc->e_res[3]);
	printf("e_oemid    = %x\n", doc->e_oemid);
	printf("e_oeminfo  = %x\n", doc->e_oeminfo);
	printf("e_res2[10] = %x%x%x%x%x%x%x%x%x%x\n", doc->e_res2[0], doc->e_res2[1], doc->e_res2[2], doc->e_res2[3], doc->e_res2[4], doc->e_res2[5], doc->e_res2[6], doc->e_res2[7], doc->e_res2[8], doc->e_res2[9]);
	printf("e_lfanew   = %x\n", doc->e_lfanew);
	printf(">>>> DOC <<<<\n\n\n");
}
//输出file数据
void printStandar(StandardPeHeader* standard)
{
	printf(">>>> STANDARD <<<<\n");
	printf("Machine               = %x\n", standard->Machine);
	printf("NumberOfSections      = %x\n", standard->NumberOfSections);
	printf("TimeDateStamp         = %x\n", standard->TimeDateStamp);
	printf("PointerToSymbolTable  = %x\n", standard->PointerToSymbolTable);
	printf("NumberOfSymbols	      = %x\n", standard->NumberOfSymbols);
	printf("SizeOfOptionalHeader  = %x\n", standard->SizeOfOptionalHeader);
	printf("Characteristics       = %x\n", standard->Characteristics);
	printf(">>>> STANDARD <<<<\n\n\n");
}
//输出optional数据
void printOptional(OptionalPeHeader* optional)
{
	printf(">>>> OPTIONAL <<<<\n");
	printf("Magic                       = %x\n", optional->Magic);
	printf("MajorLinkerVersion          = %x\n", optional->MajorLinkerVersion);
	printf("MinorLinkerVersion          = %x\n", optional->MinorLinkerVersion);
	printf("SizeOfCode                  = %x\n", optional->SizeOfCode);
	printf("SizeOfInitializedData       = %x\n", optional->SizeOfInitializedData);
	printf("SizeOfUninitializedData     = %x\n", optional->SizeOfUninitializedData);
	printf("AddressOfEntryPoint         = %x\n", optional->AddressOfEntryPoint);
	printf("BaseOfCode                  = %x\n", optional->BaseOfCode);
	printf("BaseOfData                  = %x\n", optional->BaseOfData);
	printf("ImageBase                   = %x\n", optional->ImageBase);
	printf("SectionAlignment            = %x\n", optional->SectionAlignment);
	printf("FileAlignment               = %x\n", optional->FileAlignment);
	printf("MajorOperatingSystemVersion = %x\n", optional->MajorOperatingSystemVersion);
	printf("MinorOperatingSystemVersion = %x\n", optional->MinorOperatingSystemVersion);
	printf("MajorImageVersion           = %x\n", optional->MajorImageVersion);
	printf("MinorImageVersion           = %x\n", optional->MinorImageVersion);
	printf("MajorSubsystemVersion	    = %x\n", optional->MajorSubsystemVersion);
	printf("MinorSubsystemVersion	    = %x\n", optional->MinorSubsystemVersion);
	printf("Win32VersionValue           = %x\n", optional->Win32VersionValue);
	printf("SizeOfImage                 = %x\n", optional->SizeOfImage);
	printf("SizeOfHeaders               = %x\n", optional->SizeOfHeaders);
	printf("CheckSum                    = %x\n", optional->CheckSum);
	printf("Subsystem                   = %x\n", optional->Subsystem);
	printf("DllCharacteristics          = %x\n", optional->DllCharacteristics);
	printf("SizeOfStackReserve          = %x\n", optional->SizeOfStackReserve);
	printf("SizeOfStackCommit           = %x\n", optional->SizeOfStackCommit);
	printf("SizeOfHeapReserve           = %x\n", optional->SizeOfHeapReserve);
	printf("SizeOfHeapCommit            = %x\n", optional->SizeOfHeapCommit);
	printf("LoaderFlags                 = %x\n", optional->LoaderFlags);
	printf("NumberOfRvaAndSizes         = %x\n", optional->NumberOfRvaAndSizes);
	printf(">>>> OPTIONAL <<<<\n\n\n");
}

//中控台
void printPeHeaderInfo(const char* peFile)
{
	char* peData = ReadPeFile(peFile);
	PeDoc* doc = { NULL };
	StandardPeHeader* peStandard = { NULL };
	OptionalPeHeader* peOptional = { NULL };
	ReadPeData(peData, doc, peStandard, peOptional);
	printDoc(doc);
	printStandar(peStandard);
	printOptional(peOptional);
	free(peData);
}


int main()
{
	printPeHeaderInfo("C:\\Users\\64107\\source\\repos\\PE\\PE\\Release\\PE.exe");
	getchar();
}
用PEtool查看二者是相同的