All pastes #508024 Raw Edit

Anonymous

public text v1 · immutable
·published 2007-05-24 20:57 UTC
rendered paste body
bool readPEInfo(char *fp2, MZHeader *outMZ, PE_Header *outPE, PE_ExtHeader *outpeXH,
				SectionHeader **outSecHdr)
{
	//fseek(fp, 0, SEEK_END);
	long fileSize =strlen(fp2);
	//fseek(fp, 0, SEEK_SET);
FILE *fp=NULL;
char Temp[128000];
wsprintf(Temp,"%s",fp2);
	if(fileSize < sizeof(MZHeader))
	{
		printf("File size too small\n");		
		return false;
	}

	// read MZ Header
	MZHeader mzH;
	//fread(&mzH, sizeof(MZHeader), 1, fp);
	memcpy(&mzH,fp2,sizeof(MZHeader));
	
	if(mzH.signature != 0x5a4d)		// MZ
	{
		printf("File does not have MZ header\n");
		return false;
	}

	//printf("Offset to PE Header = %X\n", mzH.offsetToPE);

	if((unsigned long)fileSize < mzH.offsetToPE + sizeof(PE_Header))
	{
		printf("File size too small\n");		
		return false;
	}

	// read PE Header
	//fseek(fp, mzH.offsetToPE, SEEK_SET);
	PE_Header peH;
	//fread(&peH, sizeof(PE_Header), 1, fp);
	memcpy(&peH,(void *)Temp[mzH.offsetToPE], sizeof(PE_Header));
	//printf("Size of option header = %d\n", peH.sizeOfOptionHeader);
	//printf("Number of sections = %d\n", peH.numSections);

	if(peH.sizeOfOptionHeader != sizeof(PE_ExtHeader))
	{
		printf("Unexpected option header size.\n");
		
		return false;
	}

	// read PE Ext Header
	PE_ExtHeader peXH;

	//fread(&peXH, sizeof(PE_ExtHeader), 1, fp);
	memcpy(&peXH,(void *)Temp[mzH.offsetToPE], sizeof(PE_ExtHeader));
	//printf("Import table address = %X\n", peXH.importTableAddress);
	//printf("Import table size = %X\n", peXH.importTableSize);
	//printf("Import address table address = %X\n", peXH.importAddressTableAddress);
	//printf("Import address table size = %X\n", peXH.importAddressTableSize);


	// read the sections
	SectionHeader *secHdr = new SectionHeader[peH.numSections];

	//fread(secHdr, sizeof(SectionHeader) * peH.numSections, 1, fp);
	memcpy(secHdr,(void *)Temp[mzH.offsetToPE], sizeof(SectionHeader) * peH.numSections);

	*outMZ = mzH;
	*outPE = peH;
	*outpeXH = peXH;
	*outSecHdr = secHdr;

	return true;
}