Obtain the OEP value of the PE file (source code)

Two methods are used to read the OEP value of a PE file: one is to directly read the file, and the other is to use memory ing.

# Include "stdafx. H"
# Include <afx. h>

//-------------------------------
// Read the file of. EXE get the OEP (original entry point)
//-------------------------------
Bool readopebyfile (lpcstr szfilename)
{
Handle hfile;
If (hfile = createfile (szfilename, generic_read, file_pai_read, 0, open_existing, file_flag_sequential_scan, 0) = invalid_handle_value)
{
Printf ("can't open the file ");
Return false;
}
DWORD dwoep, cbread;
Image_dos_header dos_head [sizeof (image_dos_header)];
If (! Readfile (hfile, dos_head, sizeof (image_dos_header), & cbread, null ))
{
Printf ("read image_dos_header failed./N ");
Closehandle (hfile );
Return false;
}
Int nentrypos = dos_head-> e_lfanew + 40;
Setfilepointer (hfile, nentrypos, null, file_begin );
If (! Readfile (hfile, & dwoep, sizeof (dwoep), & cbread, null )){
Printf ("read OEP failed./N ");
Closehandle (hfile );
Return false;
}

Closehandle (hfile );
Printf ("OEP by file: % d/N", dwoep );
Return true;
}
//-----------------------------------------
// Filemapping get the OEP
//-----------------------------------------

Bool readoepbymemory (lpcstr szfilename)
{
Struct pe_header_map
{
DWORD signature;
Image_file_header _ head;
Image_optional_header opt_head;
Image_section_header section_header [6];
} * Header;

Handle hfile;
Handle hmapping;
Void * basepointer;

// Open the file
If (hfile = createfile (szfilename, generic_read, file_pai_read, 0, open_existing, file_flag_sequential_scan, 0) = invalid_handle_value ){
Printf ("can't open the file ");
Return false;
}
If (! (Hmapping = createfilemapping (hfile, 0, page_readonly | sec_commit, 0, 0 ))){
Printf ("Mapping failed./N ");
Closehandle (hfile );
Return false;
}
If (! (Basepointer = mapviewoffile (hmapping, file_map_read, 0, 0 )))
{
Printf ("view failed./N ");
Closehandle (hmapping );
Closehandle (hfile );
Return false;
}

Image_dos_header * dos_head = (image_dos_header *) basepointer;
Header = (pe_header_map *) (char *) dos_head + dos_head-> e_lfanew );
DWORD dwoep = header-> opt_head.addressofentrypoint;

Unmapviewoffile (basepointer );
Closehandle (hmapping );
Closehandle (hfile );

Printf ("OEP by memory: % d/N", dwoep );
Return true;
}

Int main (INT argc, char * argv [])
{
Printf ("Hello world! /N ");
Readopebyfile ("D: // jp.exe ");
Readoepbymemory ("D: // jp.exe ");
Return 0;
}