信息安全病毒分析报告

编写PE文件分析工具一、实验目的：编写一个工具，自动分析PE文件，要能判断是否是PE文件，能分析PE文件头文件个数据项的分析二、实验原理：可以通过一个叫做IMAGE_DOS_HEADER的结构来识别一个合法的DOS 头。

这个结构的头两个字节一定是“MZ”（#define IMAGE_DOS_SIGNATURE "MZ"）。

你通过该结构的一个叫做“e_lfanew”（offset 60，32bits）的成员来找到PE开始的标志它。

通过DOS头，可以找到一个叫做IMAGE_FILE_HEADER的结构。

文件头下面就是可选头，这是一个叫做IMAGE_OPTIONAL_HEADER的结构。

它包含很多关于PE文件定位的信息。

三、主要功能实现：1、加载PE文件BOOL OpenFileDlg(HWND hwnd){OPENFILENAME ofn;memset(szFilePath,0,MAX_PATH);memset(&ofn, 0, sizeof(ofn));ofn.lStructSize =sizeof(ofn);ofn.hwndOwner =hwnd;ofn.hInstance =GetModuleHandle(NULL);ofn.nMaxFile =MAX_PATH;ofn.lpstrInitialDir =".";ofn.lpstrFile =szFilePath;ofn.lpstrTitle ="Open ...[PEInfo_example] by A.Yong(信息安全)";ofn.Flags =OFN_PATHMUSTEXIST | OFN_FILEMUSTEXIST | OFN_HIDEREADONLY;ofn.lpstrFilter ="*.*\0*.*\0";if(!GetOpenFileName(&ofn))return FALSE;return TRUE;}如果加载的文件不是PE文件，提示，在主窗口的处理函数中加入如下处理过程if(!IsPEFile(stMapFile.ImageBase)){MessageBox(hWnd,"Invalid PEFormat file!:(","PEInfo_Example",MB_OK);UnLoadFile(&stMapFile);EnableEditCtrl(hWnd,FALSE);return FALSE;}这样，在加载的文件不是PE文件是，就会弹出消息窗口void UnLoadFile(PMAP_FILE_STRUCT pstMapFile){if(pstMapFile->ImageBase)UnmapViewOfFile(pstMapFile->ImageBase);if(pstMapFile->hMapping)CloseHandle(pstMapFile->hMapping);if(pstMapFile->hFile)CloseHandle(pstMapFile->hFile);}BOOL LoadFileR(LPTSTR lpFilename,PMAP_FILE_STRUCT pstMapFile){HANDLE hFile;HANDLE hMapping;LPVOID ImageBase;memset(pstMapFile,0,sizeof(MAP_FILE_STRUCT));hFile=CreateFile(lpFilename,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXIS TING,FILE_ATTRIBUTE_NORMAL,0);if (!hFile)return FALSE;hMapping=CreateFileMapping(hFile,NULL,PAGE_READONL Y,0,0,NULL);if(!hMapping){CloseHandle(hFile);return FALSE;}ImageBase=MapViewOfFile(hMapping,FILE_MAP_READ,0,0,0);if(!ImageBase){CloseHandle(hMapping);CloseHandle(hFile);return FALSE;}pstMapFile->hFile=hFile;pstMapFile->hMapping=hMapping;pstMapFile->ImageBase=ImageBase;return TRUE;}得到ODS头文件结构IMAGE_FILE_HEADER GetFileHeader(LPVOID ImageBase){PIMAGE_DOS_HEADER pDH=NULL;PIMAGE_NT_HEADERS pNtH=NULL;PIMAGE_FILE_HEADER pFH=NULL;if(!IsPEFile(ImageBase))return NULL;pDH=(PIMAGE_DOS_HEADER)ImageBase;pNtH=(PIMAGE_NT_HEADERS)((DWORD)pDH+pDH->e_lfanew);pFH=&pNtH->FileHeader;return pFH;}得到NT映像头结构PIMAGE_NT_HEADERS GetNtHeaders(LPVOID ImageBase){if(!IsPEFile(ImageBase))return NULL;PIMAGE_NT_HEADERS pNtH;PIMAGE_DOS_HEADER pDH;pDH=(PIMAGE_DOS_HEADER)ImageBase;pNtH=(PIMAGE_NT_HEADERS)((DWORD)pDH+pDH->e_lfanew);return pNtH;}得到可选头结构PIMAGE_OPTIONAL_HEADER GetOptionalHeader(LPVOID ImageBase) {PIMAGE_DOS_HEADER pDH=NULL;PIMAGE_NT_HEADERS pNtH=NULL;PIMAGE_OPTIONAL_HEADER pOH=NULL;if(!IsPEFile(ImageBase))return NULL;pDH=(PIMAGE_DOS_HEADER)ImageBase;pNtH=(PIMAGE_NT_HEADERS)((DWORD)pDH+pDH->e_lfanew);pOH=&pNtH->OptionalHeader;return pOH;}显示dos头信息void ShowFileHeaderInfo(HWND hWnd){char cBuff[10];PIMAGE_FILE_HEADER pFH=NULL;pFH=GetFileHeader(stMapFile.ImageBase);if(!pFH){MessageBox(hWnd,"Can't get File Header ! :(","PEInfo_Example",MB_OK);return;}wsprintf(cBuff, "%04lX", pFH->Machine);SetDlgItemText(hWnd,IDC_EDIT_FH_MACHINE,cBuff);wsprintf(cBuff, "%04lX", pFH->NumberOfSections);SetDlgItemText(hWnd,IDC_EDIT_FH_NUMOFSECTIONS,cBuff);wsprintf(cBuff, "%08lX", pFH->TimeDateStamp);SetDlgItemText(hWnd,IDC_EDIT_FH_TDS,cBuff);wsprintf(cBuff, "%08lX", pFH->PointerToSymbolTable);SetDlgItemText(hWnd,IDC_EDIT_FH_PTSYMBOL,cBuff);wsprintf(cBuff, "%08lX", pFH->NumberOfSymbols);SetDlgItemText(hWnd,IDC_EDIT_FH_NUMOFSYM,cBuff);wsprintf(cBuff, "%04lX", pFH->SizeOfOptionalHeader);SetDlgItemText(hWnd,IDC_EDIT_FH_SIZEOFOH,cBuff);wsprintf(cBuff, "%04lX", pFH->Characteristics);SetDlgItemText(hWnd,IDC_EDIT_FH_CHARACTERISTICS,cBuff);}显示可选头信息void ShowOptionHeaderInfo(HWND hWnd){char cBuff[10];PIMAGE_OPTIONAL_HEADER pOH=NULL;pOH=GetOptionalHeader(stMapFile.ImageBase);if(!pOH){MessageBox(hWnd,"Can't get Optional Header !:(","PEInfo_Example",MB_OK);return;}wsprintf(cBuff, "%08lX", pOH->AddressOfEntryPoint);SetDlgItemText(hWnd,IDC_EDIT_OH_EP,cBuff);wsprintf(cBuff, "%08lX", pOH->ImageBase);SetDlgItemText(hWnd,IDC_EDIT_OH_IMAGEBASE,cBuff);wsprintf(cBuff, "%08lX", pOH->BaseOfCode);SetDlgItemText(hWnd,IDC_EDIT_OH_CODEBASE,cBuff);wsprintf(cBuff, "%08lX", pOH->BaseOfData);SetDlgItemText(hWnd,IDC_EDIT_OH_DA TABASE,cBuff);wsprintf(cBuff, "%08lX", pOH->SizeOfImage);SetDlgItemText(hWnd,IDC_EDIT_OH_IMAGESIZE,cBuff);wsprintf(cBuff, "%08lX", pOH->SizeOfHeaders);SetDlgItemText(hWnd,IDC_EDIT_OH_HEADERSIZE,cBuff);wsprintf(cBuff, "%08lX", pOH->SectionAlignment);SetDlgItemText(hWnd,IDC_EDIT_OH_SECTIONALIGN,cBuff);wsprintf(cBuff, "%08lX", pOH->FileAlignment);SetDlgItemText(hWnd,IDC_EDIT_OH_FILEALIGN,cBuff);wsprintf(cBuff, "%08lX", pOH->Subsystem);SetDlgItemText(hWnd,IDC_EDIT_OH_SUBSYSTEM,cBuff);wsprintf(cBuff, "%04lX", pOH->CheckSum);SetDlgItemText(hWnd,IDC_EDIT_OH_CHECKSUM,cBuff);wsprintf(cBuff, "%04lX", pOH->DllCharacteristics);SetDlgItemText(hWnd,IDC_EDIT_OH_DLLFLAGS,cBuff);}显示数据目录信息void ShowDataDirInfo(HWND hDlg){char cBuff[9];PIMAGE_OPTIONAL_HEADER pOH=NULL;pOH=GetOptionalHeader(stMapFile.ImageBase);if(!pOH)return;for(int i=0;i<16;i++){wsprintf(cBuff, "%08lX", pOH->DataDirectory[i].VirtualAddress);SetDlgItemText(hDlg,EditID_Array[i].ID_RV A,cBuff);wsprintf(cBuff, "%08lX", pOH->DataDirectory[i].Size);SetDlgItemText(hDlg,EditID_Array[i].ID_SIZE,cBuff);}}显示节表信息void ShowSectionHeaderInfo(HWND hDlg){LVITEM lvItem;char cBuff[9],cName[9];WORD i;PIMAGE_FILE_HEADER pFH=NULL;PIMAGE_SECTION_HEADER pSH=NULL;pFH=GetFileHeader(stMapFile.ImageBase);if(!pFH)return;pSH=GetFirstSectionHeader(stMapFile.ImageBase);for( i=0;i<pFH->NumberOfSections;i++){memset(&lvItem, 0, sizeof(lvItem));lvItem.mask = LVIF_TEXT;lvItem.iItem = i;memset(cName,0,sizeof(cName));memcpy(cName, pSH->Name, 8);lvItem.pszText = cName;SendDlgItemMessage(hDlg,IDC_SECTIONLIST,LVM_INSERTITEM,0,(LPARAM)&lvIte m);lvItem.pszText = cBuff;wsprintf(cBuff, "%08lX", pSH->VirtualAddress);lvItem.iSubItem = 1;SendDlgItemMessage(hDlg,IDC_SECTIONLIST, LVM_SETITEM, 0, (LPARAM)&lvItem);wsprintf(cBuff, "%08lX", pSH->Misc.VirtualSize);lvItem.iSubItem = 2;SendDlgItemMessage(hDlg,IDC_SECTIONLIST, LVM_SETITEM, 0, (LPARAM)&lvItem);wsprintf(cBuff, "%08lX", pSH->PointerToRawData);lvItem.iSubItem = 3;SendDlgItemMessage(hDlg,IDC_SECTIONLIST, LVM_SETITEM, 0, (LPARAM)&lvItem);wsprintf(cBuff, "%08lX", pSH->SizeOfRawData);lvItem.iSubItem = 4;SendDlgItemMessage(hDlg,IDC_SECTIONLIST, LVM_SETITEM, 0, (LPARAM)&lvItem);wsprintf(cBuff, "%08lX", pSH->Characteristics);lvItem.iSubItem = 5;SendDlgItemMessage(hDlg,IDC_SECTIONLIST, LVM_SETITEM, 0, (LPARAM)&lvItem);++pSH;}}运行效果如下：1>显示可选头信息和文件头信息。