#include <Windows.h>
#include <iostream>
#include <time.h>

bool __stdcall InfoRoutine(LPVOID lpParam) {

    //Pointers to Struct
    PIMAGE_DOS_HEADER p_IMAGE_DOS_HEADER = reinterpret_cast<PIMAGE_DOS_HEADER>(GetModuleHandle(nullptr)); //Pega o modulo do binario
    PIMAGE_NT_HEADERS p_IMAGE_NT_HEADER = reinterpret_cast<PIMAGE_NT_HEADERS>((BYTE*)p_IMAGE_DOS_HEADER + p_IMAGE_DOS_HEADER->e_lfanew); //Deslocamento para o PE do IMAGE_NT_HEADER
    PIMAGE_FILE_HEADER p_IMAGE_FILE_HEADER = &p_IMAGE_NT_HEADER->FileHeader; //Struct do IMAGE_FILE_HEADER
    PIMAGE_OPTIONAL_HEADER p_IMAGE_OPTIONAL_HEADER = &p_IMAGE_NT_HEADER->OptionalHeader; //Struct do IMAGE_OPTIONAL_HEADER

    std::cout << "Getting information from the PE format!!!";
    std::cout << "\n\n----------------------------------------------------------\nIMAGE_DOS_HEADER\n----------------------------------------------------------\n";
    std::cout << "e_magic: 0x" << std::hex << p_IMAGE_DOS_HEADER->e_magic << " ( MZ ) //Little Endian  ( inverse bytes )\n"; // Determina o formato PE
    std::cout << "e_lfanew: 0x" << std::hex << p_IMAGE_DOS_HEADER->e_lfanew << "\n"; //Deslocamento para a struct IMAGE_NT_HEADER
    std::cout << "VA IMAGE_NT_HEADER: 0x" << std::hex << p_IMAGE_NT_HEADER << "\n\n"; //Endereço para a struct IMAGE_NT_HEADER


    std::cout << "----------------------------------------------------------\nIMAGE_NT_HEADER\n----------------------------------------------------------\n" ;

    std::cout << "Signature: " << reinterpret_cast<char*>(p_IMAGE_NT_HEADER) << "\n"; //IMAGE_NT_HEADERS ( PE )
    std::cout << "VA IMAGE_FILE_HEADER: 0x" << std::hex << p_IMAGE_FILE_HEADER << "\n"; //Endereço para a struct IMAGE_FILE_HEADER
    std::cout << "VA IMAGE_OPTIONAL_HEADER: 0x" << std::hex << p_IMAGE_OPTIONAL_HEADER << std::dec << "\n\n"; //Endereço para a struct IMAGE_OPTIONAL_HEADER

    std::cout << "----------------------------------------------------------\nIMAGE_FILE_HEADER\n----------------------------------------------------------\n";
    std::cout << "                           Machine Supports\n";

    if (p_IMAGE_FILE_HEADER->Machine == IMAGE_FILE_MACHINE_I386) //Verifica se sua máquina é compátivel
        std::cout <<  "\nMachine: Intel 386 or later processor and compatible processors\n" << "  Offset: 0x" << p_IMAGE_FILE_HEADER->Machine << "\n"; //Compatibilidade
    else
        FreeLibraryAndExitThread((HMODULE)lpParam, 0);
    std::cout << "Number of Sections: " << p_IMAGE_FILE_HEADER->NumberOfSections << "\n"; //Determina o número de seções do binário

    char b[20];
    {
        time_t TimeDateStamp = p_IMAGE_FILE_HEADER->TimeDateStamp;
        tm* Time = localtime(&TimeDateStamp);
        strftime(b, sizeof(b), "%D", Time);
    }
    std::cout << "Date Compilation: " << b << "\n"; //Exibe a data de compilação do binário
    std::cout << "Pointer to Symbol Table: 0x" << p_IMAGE_FILE_HEADER->PointerToSymbolTable << "\n"; //Ponteiro para a Symbol Table
    std::cout << "Number of Symbols: 0x" << p_IMAGE_FILE_HEADER->NumberOfSymbols << "\n"; //Número de symbols..
    std::cout << "Size of Optional Header: " << p_IMAGE_FILE_HEADER->SizeOfOptionalHeader << " byte(s)\n\n"; //Tamanho do IMAGE_OPTIONAL_HEADER
    std::cout << "- Characteristics: 0x" << reinterpret_cast<WORD*>(p_IMAGE_FILE_HEADER->Characteristics) << "\n\n";
    if (p_IMAGE_FILE_HEADER->Characteristics & IMAGE_FILE_RELOCS_STRIPPED)
        std::cout << "IMAGE_FILE_RELOCS_STRIPPED\n# This indicate that the file does not contain base relocations\n"; //Sem info de reloc ...
    if (p_IMAGE_FILE_HEADER->Characteristics & IMAGE_FILE_EXECUTABLE_IMAGE)
        std::cout << "IMAGE_FILE_EXECUTABLE_IMAGE\n# This indicates that the image file is valid and can be run\n"; //Define um executavel
    if (p_IMAGE_FILE_HEADER->Characteristics & IMAGE_FILE_LINE_NUMS_STRIPPED)
        std::cout << "IMAGE_FILE_LINE_NUMS_STRIPPED\n# COFF line numbers have been removed\n"; //Obsoleto e deve ser ZERO
    if (p_IMAGE_FILE_HEADER->Characteristics & IMAGE_FILE_LOCAL_SYMS_STRIPPED)
        std::cout << "IMAGE_FILE_LOCAL_SYMS_STRIPPED\n# COFF symbol table entries for local symbols have been removed\n"; // Obsoleto e deve ser ZERO
    if (p_IMAGE_FILE_HEADER->Characteristics & IMAGE_FILE_AGGRESIVE_WS_TRIM)
        std::cout << "IMAGE_FILE_AGGRESIVE_WS_TRIM\n# Aggressively trim working set\n"; //Obsoleto para Win 2000 e posterior e deve ser ZERO
    if (p_IMAGE_FILE_HEADER->Characteristics & IMAGE_FILE_LARGE_ADDRESS_AWARE)
        std::cout << "IMAGE_FILE_LARGE_ADDRESS_AWARE\n# Application can handle > 2 GB addresses\n"; //Aplicacao consegue trabalhar com maior que 2 GB de enderecos
    if (p_IMAGE_FILE_HEADER->Characteristics & IMAGE_FILE_BYTES_REVERSED_LO)
        std::cout << "IMAGE_FILE_BYTES_REVERSED_LO\n# Little endian: the least significant bit (LSB) precedes the most significant bit (MSB) in memory\n"; //Obsoleto e deve ser ZERO
    if (p_IMAGE_FILE_HEADER->Characteristics & IMAGE_FILE_32BIT_MACHINE)
        std::cout << "IMAGE_FILE_32BIT_MACHINE\n# Machine is based on a 32-bit-word architecture\n"; //32-bit arquitetura
    if (p_IMAGE_FILE_HEADER->Characteristics & IMAGE_FILE_DEBUG_STRIPPED)
        std::cout << "IMAGE_FILE_DEBUG_STRIPPED\n# Debugging information is removed from the image file\n"; //Remove info de depuracao
    if (p_IMAGE_FILE_HEADER->Characteristics & IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP)
        std::cout << "IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP\n# If the image is on removable media, fully load it and copy it to the swap file\n"; //Se estiver em midia removivel carregue e copie para arquivo de troca
    if (p_IMAGE_FILE_HEADER->Characteristics & IMAGE_FILE_NET_RUN_FROM_SWAP)
        std::cout << "IMAGE_FILE_NET_RUN_FROM_SWAP\n# If the image is on network media, fully load it and copy it to the swap file\n"; //Se estiver na rede carregue e copie para arquivo de troca
    if (p_IMAGE_FILE_HEADER->Characteristics & IMAGE_FILE_SYSTEM)
        std::cout << "IMAGE_FILE_SYSTEM\n# The image file is a system file, not a user program\n"; //Arquivo de imagem pertence ao sistema e nao ao user
    if (p_IMAGE_FILE_HEADER->Characteristics & IMAGE_FILE_DLL)
        std::cout << "IMAGE_FILE_DLL\n# The image file is a dynamic-link library (DLL)\n"; //Considerado um arquivo executavel porem nao diretamente
    if (p_IMAGE_FILE_HEADER->Characteristics & IMAGE_FILE_UP_SYSTEM_ONLY)
        std::cout << "IMAGE_FILE_UP_SYSTEM_ONLY\n# The file should be run only on a uniprocessor machine\n"; //Arquivo so pode ser executado em um unico processador
    if (p_IMAGE_FILE_HEADER->Characteristics & IMAGE_FILE_BYTES_REVERSED_HI)
        std::cout << "IMAGE_FILE_BYTES_REVERSED_HI\n# Big endian: the MSB precedes the LSB in memory\n\n"; //Obsoleto e deve ser ZERO

    std::cout << "----------------------------------------------------------\nIMAGE_OPTIONAL_HEADER\n----------------------------------------------------------\n";
    std::cout << std::hex << "Magic: 0x" << p_IMAGE_OPTIONAL_HEADER->Magic << "\n"; //Identificaçao do tipo de IMAGEM
    std::cout << "MajorLinkVersion: " << reinterpret_cast<int*>(p_IMAGE_OPTIONAL_HEADER->MajorLinkerVersion) << "\n"; //Maior versao do link
    std::cout << "MinorLinkVersion: " << reinterpret_cast<int*>(p_IMAGE_OPTIONAL_HEADER->MinorLinkerVersion) << "\n"; //Menor versao do link
    std::cout << "SizeOfCode: 0x" << p_IMAGE_OPTIONAL_HEADER->SizeOfCode << "\n"; //Tamanho da secao CODE ( Normalmente .text nas aplicacoes por ai )
    std::cout << "SizeOfInitializedData: 0x" << p_IMAGE_OPTIONAL_HEADER->SizeOfInitializedData << "\n"; //Tamanho da secao DATA ( Normalmente .data nas aplicacoes por ai )
    std::cout << "SizeOfUnitializedData: 0x" << p_IMAGE_OPTIONAL_HEADER->SizeOfHeaders << "\n"; //Tamanho da secao de dados ( Normalmente .bss nas aplicacoes por ai )
    std::cout << "AddressOfEntryPoint: 0x" << p_IMAGE_OPTIONAL_HEADER->AddressOfEntryPoint << "\n"; //RVA do entry point no caso em relacao ao ImageBase ( 0x400000 )
    std::cout << "BaseOfCode: 0x" << p_IMAGE_OPTIONAL_HEADER->BaseOfCode << "\n"; //RVA do comeco da secao code ( .text )
    std::cout << "BaseOfData: 0x" << p_IMAGE_OPTIONAL_HEADER->BaseOfData << "\n"; //O nome da diz e a mesma coisa acima porem o RVA e para a secao de dados ( .data )
    std::cout << "ImageBase: 0x" << p_IMAGE_OPTIONAL_HEADER->ImageBase << "\n"; //ImageBase do binario, no caso quando uma aplicacao e executada ela recebe um valor inicial de memoria ( 0x400000 )
    std::cout << "SectionAlignment: 0x" << p_IMAGE_OPTIONAL_HEADER->SectionAlignment << "\n"; //Alinhamento das secoes em bytes
    std::cout << "FileAlignment: 0x" << p_IMAGE_OPTIONAL_HEADER->FileAlignment << "\n"; //Alinhamento das secoes de dados e caso o SectionAlignment seja menor que o size de uma pagina ela vai possuir o mesmo tamanho da FileAlignment
    std::cout << "MajorImageVersion: " << p_IMAGE_OPTIONAL_HEADER->MajorImageVersion << "\n"; //Indicam o maior tamanho da image
    std::cout << "MinorImageVersion: " << p_IMAGE_OPTIONAL_HEADER->MinorImageVersion << "\n"; //Indicam o menor tamanho da image ( No caso sao 2 WORDS )
    std::cout << "MajorSubsystemVersion: " << p_IMAGE_OPTIONAL_HEADER->MajorSubsystemVersion << "\n"; //Indica o maior tamanho da subsystem
    std::cout << "MinorSubsystemVersion: " << p_IMAGE_OPTIONAL_HEADER->MinorSubsystemVersion << "\n"; //Indica o menor tamanho da Subsystem e isso vai influenciar como uma aplicacao roda ( questao grafica por ex... )
    std::cout << "Win32VersionValue: " << p_IMAGE_OPTIONAL_HEADER->Win32VersionValue << "\n"; //A principio e sempre ZERO
    std::cout << "SizeOfImage: 0x" << p_IMAGE_OPTIONAL_HEADER->SizeOfImage << "\n"; //Tamanho total da Image quando carregada na memoria
    std::cout << "SizeOfHeader: 0x" << p_IMAGE_OPTIONAL_HEADER->SizeOfHeaders << "\n"; //Tamanho de todos cabecalhos data, code, etc..
    std::cout << "CheckSum: 0x" << p_IMAGE_OPTIONAL_HEADER->CheckSum << "\n"; //So e checada se a image for um Driver NT
    std::cout << "- Subsystem: " << std::dec << p_IMAGE_OPTIONAL_HEADER->Subsystem << std::hex << "\n"; //Espera o subsystem adequado para executar a imagem
    if (p_IMAGE_OPTIONAL_HEADER->Subsystem & IMAGE_SUBSYSTEM_UNKNOWN)
        std::cout << "An unknown subsystem\n";
    if (p_IMAGE_OPTIONAL_HEADER->Subsystem & IMAGE_SUBSYSTEM_NATIVE)
        std::cout << "Device drivers and native Windows processe\n";
    if (p_IMAGE_OPTIONAL_HEADER->Subsystem & IMAGE_SUBSYSTEM_WINDOWS_GUI)
        std::cout << "The Windows graphical user interface (GUI) subsystem\n";
    if (p_IMAGE_OPTIONAL_HEADER->Subsystem & IMAGE_SUBSYSTEM_WINDOWS_CUI)
        std::cout << "The Windows character subsystem\n";
    if (p_IMAGE_OPTIONAL_HEADER->Subsystem & IMAGE_SUBSYSTEM_OS2_CUI)
        std::cout << "The OS/2 character subsystem\n";
    if (p_IMAGE_OPTIONAL_HEADER->Subsystem & IMAGE_SUBSYSTEM_POSIX_CUI)
        std::cout << "The Posix character subsystem\n";
    if (p_IMAGE_OPTIONAL_HEADER->Subsystem & IMAGE_SUBSYSTEM_NATIVE_WINDOWS)
        std::cout << "Native Win9x driver\n";
    if (p_IMAGE_OPTIONAL_HEADER->Subsystem & IMAGE_SUBSYSTEM_WINDOWS_CE_GUI)
        std::cout << "Windows CE\n";
    if (p_IMAGE_OPTIONAL_HEADER->Subsystem & IMAGE_SUBSYSTEM_EFI_APPLICATION)
        std::cout << "An Extensible Firmware Interface (EFI) application\n";
    if (p_IMAGE_OPTIONAL_HEADER->Subsystem & IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER)
        std::cout << "An EFI driver with boot services\n";
    if (p_IMAGE_OPTIONAL_HEADER->Subsystem & IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER)
        std::cout << "An EFI driver with run-time services\n";
    if (p_IMAGE_OPTIONAL_HEADER->Subsystem & IMAGE_SUBSYSTEM_EFI_ROM)
        std::cout << "An EFI ROM image\n";
    if (p_IMAGE_OPTIONAL_HEADER->Subsystem & IMAGE_SUBSYSTEM_XBOX)
        std::cout << "XBOX\n";
    if (p_IMAGE_OPTIONAL_HEADER->Subsystem & IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION)
        std::cout << "Windows boot application\n";
    std::cout << "DllCharacteristics: " << p_IMAGE_OPTIONAL_HEADER->DllCharacteristics << "\n"; //Como nao e uma dll e sim um .exe o campo estara ZERADO
    std::cout << "SizeOfStackReserved: 0x" << p_IMAGE_OPTIONAL_HEADER->SizeOfStackReserve << "\n"; //Espaco que sera reservado para a stack ( pilha )
    std::cout << "SizeOfStackCommit: 0x" << p_IMAGE_OPTIONAL_HEADER->SizeOfStackCommit << "\n"; //Espaco que sera entregue a ela
    std::cout << "SizeOfHeapReserved: 0x" << p_IMAGE_OPTIONAL_HEADER->SizeOfHeapReserve << "\n"; //Espaco que sera entregue a ela
    std::cout << "SizeOfHeapCommit: 0x" << p_IMAGE_OPTIONAL_HEADER->SizeOfHeapCommit << "\n"; //Espaco que sera entregue a ela
    std::cout << "LoaderFlags: 0x" << p_IMAGE_OPTIONAL_HEADER->LoaderFlags << "\n"; //Reservado e ZERADA
    std::cout << "NumberOfRVAandSizes: 0x" << p_IMAGE_OPTIONAL_HEADER->NumberOfRvaAndSizes << "\n\n\n"; //Numero de entradadas do DataDirectory

    system("pause");
    return 0;
}

BOOL WINAPI DllMain(
    HINSTANCE hinstDLL,
    DWORD     fdwReason,
    LPVOID    lpvReserved
) {
    if (fdwReason == DLL_PROCESS_ATTACH) {
        FILE * File = { nullptr };
        AllocConsole();
        freopen_s(&File, "CONOUT$", "w", stdout);
        freopen_s(&File, "CONOUT$", "w", stderr);
        freopen_s(&File, "CONIN$", "r", stdin);
        fclose(File);
        CreateThread(nullptr, 0, (LPTHREAD_START_ROUTINE)InfoRoutine, hinstDLL, 0, 0);
        return TRUE;
    }
    return FALSE;
}