浏览PE文件的资源

void walkres(void *NewBase , PIMAGE_RESOURCE_DIRECTORY  pRes , PIMAGE_NT_HEADERS  pNTHeader)
{   
    char msg[256] = {0};
    PIMAGE_RESOURCE_DIRECTORY pRootRes = (PIMAGE_RESOURCE_DIRECTORY)((unsigned long)NewBase +
        pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress) ;
    DWORD dwVA = pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress;
    PBYTE pResBase = (PBYTE)pRes;
    int resize =  pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].Size;
    WORD NumberOfNamedEntries = pRes->NumberOfNamedEntries;
    WORD NumberOfIdEntries = pRes->NumberOfIdEntries;
    DWORD tEntrys = NumberOfNamedEntries+NumberOfIdEntries ;
    DWORD dwoffset = 0;
    for (WORD i=0;i<tEntrys;i++){
        dwoffset = sizeof(IMAGE_RESOURCE_DIRECTORY_ENTRY);
        PIMAGE_RESOURCE_DIRECTORY_ENTRY prde = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((PBYTE)pRes + sizeof(IMAGE_RESOURCE_DIRECTORY) + i*dwoffset);       
        WCHAR  wbuf[32] = {0};
        if (prde->NameIsString==1){
            dwoffset = prde-&gt;NameOffset;
            dwoffset+=(DWORD)pRootRes;
            PIMAGE_RESOURCE_DIR_STRING_U pirds = (PIMAGE_RESOURCE_DIR_STRING_U)dwoffset;
            WCHAR * wname = pirds-&gt;NameString;
            memcpy(wbuf,wname,pirds-&gt;Length*2);
//            TRACE("ResoureceID name:%s  \n" , W2A(wbuf));
        }else{
//            TRACE("ResoureceID:%d \n",prde-&gt;Id);
        }
        if (prde-&gt;DataIsDirectory==1){
            dwoffset = prde-&gt;OffsetToDirectory;   
            dwoffset+=(DWORD)pRootRes;
            walkres(NewBase , (PIMAGE_RESOURCE_DIRECTORY)dwoffset , pNTHeader);               
        }else{
            dwoffset = prde-&gt;OffsetToData;
            dwoffset+=(DWORD)pRootRes;
            PIMAGE_RESOURCE_DATA_ENTRY prdatae = (PIMAGE_RESOURCE_DATA_ENTRY)dwoffset;   
            dwoffset = prdatae-&gt;OffsetToData;
            dwoffset -= dwVA;  dwoffset+=(DWORD)pRootRes;
//            TRACE("resource data:%X [%d] \n" ,dwoffset , prdatae-&gt;Size);
        }
    }
    //    IMAGE_RESOURCE_DIRECTORY_ENTRY    
    //    IMAGE_RESOURCE_DATA_ENTRY
}

你可能感兴趣的:(浏览,职场,资源,文件,休闲)