ANALYSE DE FORMAT D'ENTETE PE

#include <windows.h>
#include <winnt.h>
#include <fstream.h>

char directorylabel[16][255] = {"IMAGE_DIRECTORY_ENTRY_EXPORT (0)",
			"IMAGE_DIRECTORY_ENTRY_IMPORT (1)",
	"IMAGE_DIRECTORY_ENTRY_RESOURCE (2)",
                "IMAGE_DIRECTORY_ENTRY_EXCEPTION (3)",
	"IMAGE_DIRECTORY_ENTRY_SECURITY (4)",
	"IMAGE_DIRECTORY_ENTRY_BASERELOC (5)",
	"IMAGE_DIRECTORY_ENTRY_DEBUG (6)",
	"IMAGE_DIRECTORY_ENTRY_COPYRIGHT (7)",
	"IMAGE_DIRECTORY_ENTRY_GLOBALPTR (8)",
	"IMAGE_DIRECTORY_ENTRY_TLS (9)",
	"IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG (10)",
	"IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (11)",
	"IMAGE_DIRECTORY_ENTRY_IAT (12)",
	"IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT (13)",						"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR (14)",
	"??????? (15)"
	};

int main(int argc, char* argv[])
{
ifstream f3;
IMAGE_DOS_HEADER ff;
IMAGE_NT_HEADERS pe;
IMAGE_SECTION_HEADER *section;

f3.open("essai.exe",ios::binary | ios::nocreate ,filebuf::sh_read); // j'ai mis sh_read parceque j'essai de lire mon propre exe, mais ca marche pas, on m'a dit sur les news qu'il fallait qu'il soit ouvert en read shared, si quelqu'un peut me depanner!!!!

if (!f3.is_open()) return 0; //si erreur

f3.read((char *)&ff,sizeof(IMAGE_DOS_HEADER));

if (ff.e_magic != IMAGE_DOS_SIGNATURE ) { // MZ
	cout << "ce nest pas un format executable MZ" <<endl;
	f3.close();
	return 0;
}

cout << "magic entete: 0x" << hex << ff.e_magic << endl;
cout << "pe header: 0x" << hex << ff.e_lfanew << endl;

f3.seekg(ff.e_lfanew); // on se positionne sur le format PE

f3.read((char *)&pe,sizeof(IMAGE_NT_HEADERS));

if (pe.Signature != IMAGE_NT_SIGNATURE ) { // PE
	cout << "ce nest pas un format PE" <<endl;
	f3.close();
	return 0;
}

cout << "nombre de section trouvee: " << dec << pe.FileHeader.NumberOfSections <<endl;
cout << "taille du code: " << dec << pe.OptionalHeader.SizeOfCode <<endl;
cout << "taille des donnees initialisees: " << dec << pe.OptionalHeader.SizeOfInitializedData <<endl;
cout << "taille des donnees non initialisees: " << dec << pe.OptionalHeader.SizeOfUninitializedData <<endl;
cout << "adresse du point d'entree dans le fichier: 0x" << hex << pe.OptionalHeader.AddressOfEntryPoint << " memoire: 0x" << hex << pe.OptionalHeader.AddressOfEntryPoint + pe.OptionalHeader.ImageBase << endl;
cout << "image base (position en memoire): 0x" << hex << pe.OptionalHeader.ImageBase <<endl;
cout << "alignement de "<< dec << pe.OptionalHeader.SectionAlignment << " octets pour les sections" << endl;
cout << "alignement de "<< dec << pe.OptionalHeader.FileAlignment << " octets pour le fichier" << endl;
cout << "taille du fichier en memoire: "<< dec << pe.OptionalHeader.SizeOfImage <<  endl;
cout << "position de la 1ere section ds le fichier: 0x " << hex << pe.OptionalHeader.SizeOfHeaders << endl;

cout << "------------Directory------------------" << endl;
for (int d=0;d<IMAGE_NUMBEROF_DIRECTORY_ENTRIES;d++)
{
	if (pe.OptionalHeader.DataDirectory[d].VirtualAddress != 0 || pe.OptionalHeader.DataDirectory[d].Size != 0)
	{
		cout << "nom: " << (char*)&directorylabel[d][0] << endl;
		cout << "adresse virtuelle: 0x" << hex << pe.OptionalHeader.DataDirectory[d].VirtualAddress << "   taille: " << dec << pe.OptionalHeader.DataDirectory[d].Size << " (0x" << hex << pe.OptionalHeader.DataDirectory[d].Size << ")" << endl;
	}
}


section = new IMAGE_SECTION_HEADER[pe.FileHeader.NumberOfSections]; // allocation des entetes de section

for (int s=0;s<pe.FileHeader.NumberOfSections;s++)
{
	char nom[9]="";
	f3.read((char *)&section[s],sizeof(IMAGE_SECTION_HEADER));
	strncpy(nom,(char *)section[s].Name,8);
	
	cout << "-------------------------------------------" << endl;
	
	cout << "nom de la section: " << nom << endl;
	cout << "adresse physique: 0x" <<hex << section[s].Misc.PhysicalAddress << endl;
	cout << "taille virtuelle: " << dec << section[s].Misc.VirtualSize << " (0x" << hex << section[s].Misc.VirtualSize << ")" << endl;
	cout << "adresse en memoire: 0x" << hex << section[s].VirtualAddress << " reel: 0x" << hex << pe.OptionalHeader.ImageBase + section[s].VirtualAddress << endl;
	cout << "taille dans le fichier: " << dec << section[s].SizeOfRawData << endl;
	cout << "adresse dans le fichier: 0x" << hex << section[s].PointerToRawData << endl;
	if (section[s].Characteristics & IMAGE_SCN_CNT_CODE)
		cout << "section contenant du code" << endl;
	if (section[s].Characteristics & IMAGE_SCN_CNT_INITIALIZED_DATA)
		cout << "section contenant des constantes" << endl;
	if (section[s].Characteristics & IMAGE_SCN_CNT_UNINITIALIZED_DATA)
		cout << "section contenant des donnees non initialisees (remplis pr 0)" << endl;
	if (section[s].Characteristics & IMAGE_SCN_MEM_SHARED)
		cout << "section paratgee en memoire" << endl;
	if (section[s].Characteristics & IMAGE_SCN_MEM_EXECUTE)
		cout << "section executable" << endl;
	if (section[s].Characteristics & IMAGE_SCN_MEM_READ)
		cout << "section en lecture possible" << endl;
	if (section[s].Characteristics & IMAGE_SCN_MEM_WRITE)
		cout << "section en ecriture possible" << endl;
}

delete [] section;
f3.close();
return 0;
}