Two methods to obtain the PE file structure

I have tried it and can run it. In fact, as long as you master the PE file structure, these two methods are not hard to understand. Haha .... These two pieces of code are written in a book (Windows bundled programming). I moved them here, huh, huh...

Bool readoepbyfile (lpcstr szfilename)

{

Handle hfile;

 

Hfile =: createfile (szfilename, generic_read, file_pai_read, 0, open_existing, file_flag_sequential_scan, 0 );

If (invalid_handle_value = hfile)

{

Printf ("can't open the file./N ");

Return false;

}

 

DWORD dwoep;

DWORD cbread;

 

Image_dos_header dos_head [sizeof (image_dos_header)];

If (! Readfile (hfile, dos_head, sizeof (image_dos_header), & cbread, null ))

{

Printf ("read image_dos_head failed/N ");

Closehandle (hfile );

Return false;

}

 

Int nentrypos = dos_head-> e_lfanew + 40;

Setfilepointer (hfile, nentrypos, null, file_begin );

 

If (! Readfile (hfile, & dwoep, sizeof (dwoep), & cbread, null ))

{

Printf ("read OEP failed/N ");

Closehandle (hfile );

Return false;

}

 

Closehandle (hfile );

Printf ("OEP by file: % d/N", dwoep );

 

Return true;

}

 

Bool readoepbymemory (lpcstr szfilename)

{

Handle hfile;

Handle hmapping;

Void * basepointer;

 

Struct pe_head_map

{

DWORD signature;

Image_file_header _ head;

Image_optional_header opt_head;

Image_section_header section_header [6];

};

 

Pe_head_map * Header;

 

Hfile =: createfile (szfilename, generic_read, file_pai_read, 0, open_existing, file_flag_sequential_scan, 0 );

If (invalid_handle_value = hfile)

{

Printf ("can't open the file./N ");

Return false;

}

Hmapping =: createfilemapping (hfile, null, page_readonly | sec_commit, 0, 0, 0 );

If (! Hmapping)

{

Printf ("Mapping failed/N ");

Closehandle (hfile );

Return false;

}

 

Basepointer =: mapviewoffile (hmapping, file_map_read, 0, 0, 0 );

If (! Basepointer)

{

Printf ("mapviewoffile failed/N ");

Closehandle (hfile );

Closehandle (hmapping );

Return false;

}

 

Image_dos_header * dos_head = (image_dos_header *) basepointer;

 

Header = (pe_head_map *) (char *) dos_head + dos_head-> e_lfanew );

 

DWORD dwoep = header-> opt_head.addressofentrypoint;

 

: Unmapviewoffile (basepointer );

Closehandle (hfile );

Closehandle (hmapping );

Printf ("OEP by memory: % d/N", dwoep );

 

Return true;

}