Advertisement
Guest User

Untitled

a guest
Jun 29th, 2015
264
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 5.45 KB | None | 0 0
  1. #include <stdlib.h>
  2. #include <fstream>
  3. #include <iostream>
  4. #include <string>
  5. #include <sstream>
  6. #include <iomanip>
  7. #include <stdio.h>
  8. #include <vector>
  9. #include "boost/filesystem/operations.hpp"
  10. #include "boost/filesystem/path.hpp"
  11. #include <pe_lib/pe_bliss.h>
  12.  
  13.  
  14. //TODO clean all this crap up.
  15. //using pointer tmp_image to image and -> to access member functions
  16.  
  17. class PE{
  18.   private:
  19.  
  20.     struct PeSection{
  21.       std::string name;
  22.       int offset;
  23.       int size;
  24.     };
  25.  
  26.     std::vector<PeSection> PE_Sections;
  27.     std::ifstream pe_file;
  28.     pe_bliss::pe_base *image; //<< pointer to an pe_base object
  29.  
  30.   public:
  31.     PE(std::string file_path);
  32.     ~PE();
  33.     int get_file_offset_entry_point();
  34.     void get_basic_pe_info();
  35.  
  36.  
  37. };
  38.  
  39.  
  40. PE::PE(std::string file_path){
  41.   using namespace pe_bliss;
  42.  
  43.   pe_file.open(file_path.c_str(), std::ifstream::in | std::ifstream::binary);
  44.   if(!pe_file){
  45.     std::cout << "PE Cannot open " << file_path << std::endl;
  46.   }
  47.  
  48.   try{
  49.     pe_bliss::pe_base new_image(pe_factory::create_pe(pe_file)); //creation of object
  50.     image = &new_image; //pointer to object is set
  51.   }
  52.   catch(const pe_exception& e){
  53.     std::cout << "Error: " << e.what() << std::endl;
  54.   }
  55. }
  56.  
  57. PE::~PE(){
  58.   //dtor
  59. }
  60.  
  61. int PE::get_file_offset_entry_point(){
  62.   int FileOffSet;
  63.   int AddressOfEntryPoint = image->get_ep(); //segfault here :(
  64.   const pe_bliss::section_list sections = image->get_image_sections();
  65.  
  66.   for(pe_bliss::section_list::const_iterator it = sections.begin(); it != sections.end(); ++it){
  67.     const pe_bliss::section& s = *it;
  68.     if((AddressOfEntryPoint >= s.get_virtual_address()) &&
  69.        AddressOfEntryPoint <= s.get_virtual_address() + s.get_size_of_raw_data()){
  70.       int FileOffSet = image->rva_to_file_offset(s.get_virtual_address()) + (AddressOfEntryPoint - s.get_virtual_address());
  71.       std::cout << "OEP FileOffSet: " << std::hex << (FileOffSet) << " in section: " << s.get_name() << std::endl;
  72.       return(FileOffSet);
  73.     }
  74.   }
  75.   return FileOffSet;
  76. }
  77.  
  78. using namespace pe_bliss;
  79.  
  80. void PE::get_basic_pe_info(){
  81.  
  82.   std::cout << "PE file type: " << (image->get_pe_type() == pe_type_32 ? "PE32 (PE)" : "PE64 (PE+)") << std::endl;
  83. }
  84.  
  85. /*
  86.  
  87.     try
  88.     {
  89.  
  90.         pe_base image(pe_factory::create_pe(pe_file));
  91.         std::cout << "PE file type: " << (image.get_pe_type() == pe_type_32 ? "PE32 (PE)" : "PE64 (PE+)") << std::endl;
  92.  
  93.         std::cout << "Calculated checksum: "<< std::hex << std::showbase << calculate_checksum(pe_file) << std::endl;
  94.         std::cout << "Stored checksum: " << image.get_checksum() << std::endl;
  95.  
  96.         std::cout << "Characteristics: " << image.get_characteristics() << std::endl;
  97.  
  98.         std::cout << "Entry point: " << image.get_ep() << std::endl;
  99.  
  100.         std::cout << "File alignment: " << image.get_file_alignment() << std::endl;
  101.         std::cout << "Section alignment: " << image.get_section_alignment() << std::endl;
  102.  
  103.         std::cout << "Image base: " << image.get_image_base_64() << std::endl;
  104.  
  105.         std::cout << "Subsystem: " << image.get_subsystem() << std::endl;
  106.         std::cout << "Is console: " << (image.is_console() ? "YES" : "NO") << std::endl;
  107.         std::cout << "Is windows GUI: " << (image.is_gui() ? "YES" : "NO") << std::endl;
  108.  
  109.         std::cout << "Has bound import: " << (image.has_bound_import() ? "YES" : "NO") << std::endl;
  110.         std::cout << "Has config: " << (image.has_config() ? "YES" : "NO") << std::endl;
  111.         std::cout << "Has debug: " << (image.has_debug() ? "YES" : "NO") << std::endl;
  112.         std::cout << "Has delay import: " << (image.has_delay_import() ? "YES" : "NO") << std::endl;
  113.         std::cout << "Has exception directory: " << (image.has_exception_directory() ? "YES" : "NO") << std::endl;
  114.         std::cout << "Has exports: " << (image.has_exports() ? "YES" : "NO") << std::endl;
  115.         std::cout << "Has imports: " << (image.has_imports() ? "YES" : "NO") << std::endl;
  116.         std::cout << "Has reloc: " << (image.has_reloc() ? "YES" : "NO") << std::endl;
  117.         std::cout << "Has resources: " << (image.has_resources() ? "YES" : "NO") << std::endl;
  118.         std::cout << "Has security: " << (image.has_security() ? "YES" : "NO") << std::endl;
  119.         std::cout << "Has tls: " << (image.has_tls() ? "YES" : "NO") << std::endl;
  120.         std::cout << "Is .NET: " << (image.is_dotnet() ? "YES" : "NO") << std::endl;
  121.  
  122.  
  123.         int AddressOfEntryPoint = image.get_ep();
  124.         const section_list sections = image.get_image_sections();
  125.         PE_Sections.clear();
  126.  
  127.     for(section_list::const_iterator it = sections.begin(); it != sections.end(); ++it){
  128.             const section& s = *it; //Секция
  129.             PE_Section tmp_Section;
  130.             tmp_Section.name = s.get_name();
  131.             tmp_Section.offset = s.get_pointer_to_raw_data();
  132.             tmp_Section.size = s.get_size_of_raw_data();
  133.             PE_Sections.push_back(tmp_Section);
  134.  
  135.             cout << "Section Name: " << s.get_name() << endl;
  136.       cout << "Section Offset: " << tmp_Section.offset << endl;
  137.       cout << "Section Size: " << tmp_Section.size << endl;
  138.  
  139.             if((AddressOfEntryPoint >= s.get_virtual_address()) && AddressOfEntryPoint <= s.get_virtual_address() + s.get_size_of_raw_data()){
  140.         int FileOffSet = image.rva_to_file_offset(s.get_virtual_address()) + (AddressOfEntryPoint - s.get_virtual_address());
  141.         cout << "OEP FileOffSet: " << std::hex << (FileOffSet) << " in section: " << s.get_name() << endl;
  142.         return(FileOffSet);
  143.         //cout << " Decimal: " << std::dec << FileOffSet << endl;
  144.         //break;
  145.             }
  146.         }
  147.     }
  148.     catch(const pe_exception& e)
  149.     {
  150.         std::cout << "Error: " << e.what() << std::endl;
  151.         return 0;
  152.     }
  153. }
  154.  
  155. */
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement