Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #![feature(old_io)]
- #![feature(old_path)]
- use std::old_io::{File, Open, Read, Seek, SeekStyle};
- // Windows 기본 데이터 형 ==============================================
- // WinDef.h
- type BYTE = u8;
- type WORD = u16;
- type DWORD = u32;
- type LONG = i32;
- type ULONGLONG = i64;
- // PE Headers ==========================================================
- // WinNT.h
- // MZ (Little Endian)
- const IMAGE_DOS_SIGNATURE : WORD = 0x5A4D;
- /// DOS .EXE header
- #[allow(dead_code)]
- #[allow(non_camel_case_types)]
- struct IMAGE_DOS_HEADER {
- e_magic : WORD, // Magic number
- e_cblp : WORD, // Bytes on last page of file
- e_cp : WORD, // Pages in file
- e_crlc : WORD, // Relocations
- e_cparhdr : WORD, // Size of header in paragraphs
- e_minalloc : WORD, // Minimum extra paragraphs needed
- e_maxalloc : WORD, // Maximum extra paragraphs needed
- e_ss : WORD, // Initial (relative) SS value
- e_sp : WORD, // Initial SP value
- e_csum : WORD, // Checksum
- e_ip : WORD, // Initial IP value
- e_cs : WORD, // Initial (relative) CS value
- e_lfarlc : WORD, // File address of relocation table
- e_ovno : WORD, // Overlay number
- e_res : [WORD; 4], // Reserved words
- e_oemid : WORD, // OEM identifier (for e_oeminfo)
- e_oeminfo : WORD, // OEM information, e_oemid specific
- e_res2 : [WORD; 10], // Reserved words
- e_lfanew : LONG, // File address of new exe header
- }
- /// File header format.
- #[allow(dead_code)]
- #[allow(non_camel_case_types)]
- #[allow(non_snake_case)]
- struct IMAGE_FILE_HEADER {
- Machine : WORD,
- NumberOfSections : WORD,
- TimeDateStamp : DWORD,
- PointerToSymbolTable: DWORD,
- NumberOfSymbols : DWORD,
- SizeOfOptionalHeader: WORD,
- Characteristics : WORD,
- }
- /// Directory format.
- #[allow(dead_code)]
- #[allow(non_camel_case_types)]
- #[allow(non_snake_case)]
- struct IMAGE_DATA_DIRECTORY {
- VirtualAddress : DWORD,
- Size : DWORD,
- }
- #[allow(dead_code)]
- const IMAGE_NUMBEROF_DIRECTORY_ENTRIES : usize = 16;
- /// Optional header format.
- #[allow(dead_code)]
- #[allow(non_camel_case_types)]
- #[allow(non_snake_case)]
- struct IMAGE_OPTIONAL_HEADER32 {
- // STANDARD FIELDS
- Magic : WORD,
- MajorLinkerVersion : BYTE,
- MinorLinkerVersion : BYTE,
- SizeOfCode : DWORD,
- SizeOfInitializedData : DWORD,
- SizeOfUninitializedData : DWORD,
- AddressOfEntryPoint : DWORD,
- BaseOfCode : DWORD,
- BaseOfData : DWORD,
- // NT ADDITIONAL FIELDS
- ImageBase : DWORD,
- SectionAlignment : DWORD,
- FileAlignment : DWORD,
- MajorOperationSystemVersion : WORD,
- MinorOperatingSystemVersion : WORD,
- MajorImageVersion : WORD,
- MinorImageVersion : WORD,
- MajorSubsystemVersion : WORD,
- MinorSubsystemVersion : WORD,
- Win32VersionValue : DWORD,
- SizeOfImage : DWORD,
- SizeOfHeaders : DWORD,
- CheckSum : DWORD,
- Subsystem : WORD,
- DllCharacteristics : WORD,
- SizeOfStackReserve : DWORD,
- SizeOfStackCommit : DWORD,
- SizeOfHeapReserve : DWORD,
- SizeOfHeapCommit : DWORD,
- LoaderFlags : DWORD,
- NumberOfRvaAndSizes : DWORD,
- DataDirectory : [IMAGE_DATA_DIRECTORY; IMAGE_NUMBEROF_DIRECTORY_ENTRIES],
- }
- #[allow(dead_code)]
- #[allow(non_camel_case_types)]
- #[allow(non_snake_case)]
- struct IMAGE_OPTIONAL_HEADER64 {
- Magic : WORD,
- MajorLinkerVersion : BYTE,
- MinorLinkerVersion : BYTE,
- SizeOfCode : DWORD,
- SizeOfInitializedData : DWORD,
- SizeOfUninitializedData : DWORD,
- AddressOfEntryPoint : DWORD,
- BaseOfCode : DWORD,
- ImageBase : ULONGLONG,
- SectionAlignment : DWORD,
- FileAlignment : DWORD,
- MajorOperationSystemVersion : WORD,
- MinorOperatingSystemVersion : WORD,
- MajorImageVersion : WORD,
- MinorImageVersion : WORD,
- MajorSubsystemVersion : WORD,
- MinorSubsystemVersion : WORD,
- Win32VersionValue : DWORD,
- SizeOfImage : DWORD,
- SizeOfHeaders : DWORD,
- CheckSum : DWORD,
- Subsystem : WORD,
- DllCharacteristics : WORD,
- SizeOfStackReserve : ULONGLONG,
- SizeOfStackCommit : ULONGLONG,
- SizeOfHeapReserve : ULONGLONG,
- SizeOfHeapCommit : ULONGLONG,
- LoaderFlags : DWORD,
- NumberOfRvaAndSizes : DWORD,
- DataDirectory : [IMAGE_DATA_DIRECTORY; IMAGE_NUMBEROF_DIRECTORY_ENTRIES],
- }
- #[allow(dead_code)]
- const IMAGE_NT_OPTIONAL_HDR32_MAGIC : WORD = 0x10b; // 32 bit image
- #[allow(dead_code)]
- const IMAGE_NT_OPTIONAL_HDR64_MAGIC : WORD = 0x20b; // 64 bit image
- #[allow(dead_code)]
- const IMAGE_ROM_OPTIONAL_HDR_MAGIC : WORD = 0x107; // ROM
- // PE00 (Little Endian)
- #[allow(dead_code)]
- const IMAGE_PE_SIGNATURE : DWORD = 0x004550;
- /// NT Header
- #[allow(dead_code)]
- #[allow(non_camel_case_types)]
- #[allow(non_snake_case)]
- struct IMAGE_NT_HEADERS32 {
- Signature : DWORD,
- FileHeader : IMAGE_FILE_HEADER,
- OptionalHeader : IMAGE_OPTIONAL_HEADER32,
- }
- #[allow(dead_code)]
- #[allow(non_camel_case_types)]
- #[allow(non_snake_case)]
- struct IMAGE_NT_HEADERS64 {
- Signature : DWORD,
- FileHeader : IMAGE_FILE_HEADER,
- OptionalHeader : IMAGE_OPTIONAL_HEADER64,
- }
- // 구현 ================================================================
- /// 파일에서 DOS 헤더를 읽는다.
- fn read_dos_header( pe: &mut File ) -> IMAGE_DOS_HEADER
- {
- let dos_h = IMAGE_DOS_HEADER
- {
- e_magic : pe.read_le_u16().unwrap(),
- e_cblp : pe.read_le_u16().unwrap(),
- e_cp : pe.read_le_u16().unwrap(),
- e_crlc : pe.read_le_u16().unwrap(),
- e_cparhdr : pe.read_le_u16().unwrap(),
- e_minalloc : pe.read_le_u16().unwrap(),
- e_maxalloc : pe.read_le_u16().unwrap(),
- e_ss : pe.read_le_u16().unwrap(),
- e_sp : pe.read_le_u16().unwrap(),
- e_csum : pe.read_le_u16().unwrap(),
- e_ip : pe.read_le_u16().unwrap(),
- e_cs : pe.read_le_u16().unwrap(),
- e_lfarlc : pe.read_le_u16().unwrap(),
- e_ovno : pe.read_le_u16().unwrap(),
- e_res : [
- pe.read_le_u16().unwrap(),
- pe.read_le_u16().unwrap(),
- pe.read_le_u16().unwrap(),
- pe.read_le_u16().unwrap()
- ],
- e_oemid : pe.read_le_u16().unwrap(),
- e_oeminfo : pe.read_le_u16().unwrap(),
- e_res2 : [
- pe.read_le_u16().unwrap(),
- pe.read_le_u16().unwrap(),
- pe.read_le_u16().unwrap(),
- pe.read_le_u16().unwrap(),
- pe.read_le_u16().unwrap(),
- pe.read_le_u16().unwrap(),
- pe.read_le_u16().unwrap(),
- pe.read_le_u16().unwrap(),
- pe.read_le_u16().unwrap(),
- pe.read_le_u16().unwrap(),
- ],
- e_lfanew : pe.read_le_i32().unwrap(),
- };
- return dos_h;
- }
- /// 파일에서 IMAGE_FILE_HEADER를 읽는다.
- fn read_img_fileheader( pe: &mut File ) -> Option<IMAGE_FILE_HEADER>
- {
- let signature = pe.read_le_u32().unwrap();
- if signature != IMAGE_PE_SIGNATURE
- {
- return None;
- }
- else
- {
- let fh = IMAGE_FILE_HEADER
- {
- Machine : pe.read_le_u16().unwrap(),
- NumberOfSections : pe.read_le_u16().unwrap(),
- TimeDateStamp : pe.read_le_u32().unwrap(),
- PointerToSymbolTable: pe.read_le_u32().unwrap(),
- NumberOfSymbols : pe.read_le_u32().unwrap(),
- SizeOfOptionalHeader: pe.read_le_u16().unwrap(),
- Characteristics : pe.read_le_u16().unwrap(),
- };
- return Some(fh);
- }
- }
- // EP
- fn main()
- {
- let myself = Path::new( "./pe.exe" );
- let mut file = match File::open_mode( &myself, Open, Read )
- {
- Ok(f) => f,
- Err(e) => panic!( "file error: {}", e )
- };
- let dos_header = read_dos_header( &mut file );
- if dos_header.e_magic == IMAGE_DOS_SIGNATURE
- {
- println!( "DOS HEADER." );
- println!( " * EXE Header offset = 0x{:X}\n", dos_header.e_lfanew );
- }
- else
- {
- println!( "MZ를 찾을 수 없음." );
- return;
- }
- match file.seek( (dos_header.e_lfanew as i64), SeekStyle::SeekSet )
- {
- Ok(_)=>{},
- Err(e) => panic!("EXE Header Offet으로 Seek 할 수 없음: {}", e)
- }
- let fh_res = read_img_fileheader( &mut file );
- match fh_res
- {
- None =>
- {
- println!( "PE Image File Header를 찾을 수 없음." );
- return;
- }
- Some(_)=>{},
- }
- let file_header = fh_res.unwrap();
- println!( "PE Image File Header." );
- println!( " * Machine = 0x{:X}", file_header.Machine );
- println!( " * {} Section(s).", file_header.NumberOfSections );
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement