初始化仓库
This commit is contained in:
commit
1d997ecd1c
|
|
@ -0,0 +1,8 @@
|
||||||
|
# Default ignored files
|
||||||
|
/shelf/
|
||||||
|
/workspace.xml
|
||||||
|
# Editor-based HTTP Client requests
|
||||||
|
/httpRequests/
|
||||||
|
# Datasource local storage ignored files
|
||||||
|
/dataSources/
|
||||||
|
/dataSources.local.xml
|
||||||
|
|
@ -0,0 +1,9 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<module type="WEB_MODULE" version="4">
|
||||||
|
<component name="Go" enabled="true" />
|
||||||
|
<component name="NewModuleRootManager">
|
||||||
|
<content url="file://$MODULE_DIR$" />
|
||||||
|
<orderEntry type="inheritedJdk" />
|
||||||
|
<orderEntry type="sourceFolder" forTests="false" />
|
||||||
|
</component>
|
||||||
|
</module>
|
||||||
|
|
@ -0,0 +1,8 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<project version="4">
|
||||||
|
<component name="ProjectModuleManager">
|
||||||
|
<modules>
|
||||||
|
<module fileurl="file://$PROJECT_DIR$/.idea/PePase.iml" filepath="$PROJECT_DIR$/.idea/PePase.iml" />
|
||||||
|
</modules>
|
||||||
|
</component>
|
||||||
|
</project>
|
||||||
|
|
@ -0,0 +1,199 @@
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/binary"
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"os"
|
||||||
|
"strings"
|
||||||
|
)
|
||||||
|
|
||||||
|
type IMAGE_DOS_HEADER struct {
|
||||||
|
Emagic uint16
|
||||||
|
Ecblp uint16
|
||||||
|
Ecp uint16
|
||||||
|
Ecrlc uint16
|
||||||
|
Ecparhdr uint16
|
||||||
|
Eminalloc uint16
|
||||||
|
Emaxalloc uint16
|
||||||
|
Ess uint16
|
||||||
|
Esp uint16
|
||||||
|
Ecsum uint16
|
||||||
|
Eip uint16
|
||||||
|
Ecs uint16
|
||||||
|
Elfarlc uint16
|
||||||
|
Eovno uint16
|
||||||
|
Eres uint64
|
||||||
|
Eoemid uint16
|
||||||
|
Eoeminfo uint16
|
||||||
|
Eres2 [20]byte
|
||||||
|
Elfanew uint32
|
||||||
|
}
|
||||||
|
|
||||||
|
type IMAGE_NT_HEADERS32 struct {
|
||||||
|
Signature uint32
|
||||||
|
FileHeader IMAGE_FILE_HEADER
|
||||||
|
OptionalHeader IMAGE_OPTIONAL_HEADER32
|
||||||
|
}
|
||||||
|
|
||||||
|
type IMAGE_FILE_HEADER struct {
|
||||||
|
Machine uint16
|
||||||
|
NumberOfSections uint16
|
||||||
|
TimeDateStamp uint32
|
||||||
|
PointerToSymbolTable uint32
|
||||||
|
NumberOfSymbols uint32
|
||||||
|
SizeOfOptionalHeader uint16
|
||||||
|
Characteristics uint16
|
||||||
|
}
|
||||||
|
|
||||||
|
type IMAGE_OPTIONAL_HEADER32 struct {
|
||||||
|
Magic uint16
|
||||||
|
MajorLinkerVersion byte
|
||||||
|
MinorLinkerVersion byte
|
||||||
|
SizeOfCode uint32
|
||||||
|
SizeOfInitializedData uint32
|
||||||
|
SizeOfUninitializedData uint32
|
||||||
|
AddressOfEntryPoint uint32
|
||||||
|
BaseOfCode uint32
|
||||||
|
BaseOfData uint32
|
||||||
|
ImageBase uint32
|
||||||
|
//ImageBase uint64
|
||||||
|
SectionAlignment uint32
|
||||||
|
FileAlignment uint32
|
||||||
|
MajorOperatingSystemVersion uint16
|
||||||
|
MinorOperatingSystemVersion uint16
|
||||||
|
MajorImageVersion uint16
|
||||||
|
MinorImageVersion uint16
|
||||||
|
MajorSubsystemVersion uint16
|
||||||
|
MinorSubsystemVersion uint16
|
||||||
|
Win32VersionValue uint32
|
||||||
|
SizeOfImage uint32
|
||||||
|
SizeOfHeaders uint32
|
||||||
|
CheckSum uint32
|
||||||
|
Subsystem uint16
|
||||||
|
DllCharacteristics uint16
|
||||||
|
SizeOfStackReserve uint32
|
||||||
|
SizeOfStackCommit uint32
|
||||||
|
SizeOfHeapReserve uint32
|
||||||
|
SizeOfHeapCommit uint32
|
||||||
|
//SizeOfStackReserve uint64
|
||||||
|
//SizeOfStackCommit uint64
|
||||||
|
//SizeOfHeapReserve uint64
|
||||||
|
//SizeOfHeapCommit uint64
|
||||||
|
LoaderFlags uint32
|
||||||
|
NumberOfRvaAndSizes uint32
|
||||||
|
DataDirectory [IMAGE_NUMBEROF_DIRECTORY_ENTRIES]IMAGE_DATA_DIRECTORY
|
||||||
|
}
|
||||||
|
|
||||||
|
type IMAGE_DATA_DIRECTORY struct {
|
||||||
|
VirtualAddress uint32
|
||||||
|
Size uint32
|
||||||
|
}
|
||||||
|
|
||||||
|
const IMAGE_NUMBEROF_DIRECTORY_ENTRIES = 16
|
||||||
|
|
||||||
|
type IMAGE_SECTION_HEADER struct {
|
||||||
|
Name [8]byte
|
||||||
|
Misc uint32
|
||||||
|
VirtualAddress uint32
|
||||||
|
SizeOfRawData uint32
|
||||||
|
PointerToRawData uint32
|
||||||
|
PointerToRelocations uint32
|
||||||
|
PointerToLinenumbers uint32
|
||||||
|
NumberOfRelocations uint16
|
||||||
|
NumberOfLinenumbers uint16
|
||||||
|
Characteristics uint32
|
||||||
|
}
|
||||||
|
|
||||||
|
type IMAGE_RESOURCE_DIRECTORY struct {
|
||||||
|
Characteristics uint32
|
||||||
|
TimeDateStamp uint32
|
||||||
|
MajorVersion uint16
|
||||||
|
MinorVersion uint16
|
||||||
|
NumberOfNamedEntries uint16
|
||||||
|
NumberOfIdEntries uint16
|
||||||
|
}
|
||||||
|
|
||||||
|
type IMAGE_RESOURCE_Entity struct {
|
||||||
|
Id uint32
|
||||||
|
Offset uint32
|
||||||
|
}
|
||||||
|
|
||||||
|
type Resource struct {
|
||||||
|
Directory *IMAGE_RESOURCE_DIRECTORY
|
||||||
|
Entities []RealEntity
|
||||||
|
}
|
||||||
|
|
||||||
|
type RealEntity struct {
|
||||||
|
IMAGE_RESOURCE_Entity
|
||||||
|
Childern Resource
|
||||||
|
IsFolder bool
|
||||||
|
}
|
||||||
|
|
||||||
|
func ParsePe() {
|
||||||
|
data, _ := os.Open("D:\\software\\qq\\Bin\\QQ.exe")
|
||||||
|
doc := new(IMAGE_DOS_HEADER)
|
||||||
|
binary.Read(data, binary.LittleEndian, doc)
|
||||||
|
data.Seek(int64(doc.Elfanew), 0)
|
||||||
|
nt := new(IMAGE_NT_HEADERS32)
|
||||||
|
binary.Read(data, binary.LittleEndian, nt)
|
||||||
|
fmt.Printf("%v", nt.FileHeader.NumberOfSections)
|
||||||
|
//for _, directory := range nt.OptionalHeader.DataDirectory {
|
||||||
|
// fmt.Printf("\n%X,%X ", directory.VirtualAddress, directory.Size)
|
||||||
|
//}
|
||||||
|
sectionTables := make(map[string]*IMAGE_SECTION_HEADER)
|
||||||
|
for i := 0; i < int(nt.FileHeader.NumberOfSections); i++ {
|
||||||
|
head := new(IMAGE_SECTION_HEADER)
|
||||||
|
binary.Read(data, binary.LittleEndian, head)
|
||||||
|
sectionTables[strings.ReplaceAll(fmt.Sprintf("%s", head.Name), "\x00", "")] = head
|
||||||
|
fmt.Println(strings.ReplaceAll(fmt.Sprintf("%s", head.Name), "\x00", "") == ".rsrc")
|
||||||
|
}
|
||||||
|
resourceTable := sectionTables[".rsrc"]
|
||||||
|
for s, h := range sectionTables {
|
||||||
|
fmt.Printf("\n%q,%v", s, h.PointerToRawData)
|
||||||
|
}
|
||||||
|
fmt.Println(resourceTable)
|
||||||
|
|
||||||
|
resource := ParseResource(data, int64(resourceTable.PointerToRawData), 0)
|
||||||
|
|
||||||
|
fmt.Println(resource)
|
||||||
|
}
|
||||||
|
|
||||||
|
func ParseResource(reader io.ReadSeeker, startOffset int64, offset int64) Resource {
|
||||||
|
reader.Seek(startOffset+offset, 0)
|
||||||
|
dir := new(IMAGE_RESOURCE_DIRECTORY)
|
||||||
|
binary.Read(reader, binary.LittleEndian, dir)
|
||||||
|
entities := make([]RealEntity, dir.NumberOfIdEntries+dir.NumberOfNamedEntries)
|
||||||
|
for i := 0; i < int(dir.NumberOfIdEntries+dir.NumberOfNamedEntries); i++ {
|
||||||
|
entity := new(IMAGE_RESOURCE_Entity)
|
||||||
|
binary.Read(reader, binary.LittleEndian, entity)
|
||||||
|
realEntity := &RealEntity{}
|
||||||
|
realEntity.IMAGE_RESOURCE_Entity = *entity
|
||||||
|
if isHighestBitSet(entity.Offset) {
|
||||||
|
realEntity.IsFolder = true
|
||||||
|
realEntity.Offset = entity.Offset & 0x7FFFFFFF
|
||||||
|
}
|
||||||
|
entities[i] = *realEntity
|
||||||
|
}
|
||||||
|
newEntities := make([]RealEntity, dir.NumberOfIdEntries+dir.NumberOfNamedEntries)
|
||||||
|
for i, entity := range entities {
|
||||||
|
if entity.IsFolder {
|
||||||
|
entity.Childern = ParseResource(reader, startOffset, int64(entity.Offset))
|
||||||
|
}
|
||||||
|
newEntities[i] = entity
|
||||||
|
|
||||||
|
}
|
||||||
|
return Resource{Directory: dir, Entities: newEntities}
|
||||||
|
}
|
||||||
|
|
||||||
|
func isHighestBitSet(value uint32) bool {
|
||||||
|
// 右移 24 位，使最高位移到最低位
|
||||||
|
highestBit := (value >> 31) & 0x01
|
||||||
|
|
||||||
|
// 判断最高位是否为 1
|
||||||
|
return highestBit == 1
|
||||||
|
}
|
||||||
|
|
||||||
|
func main() {
|
||||||
|
ParsePe()
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue