Question

我正在尝试阅读x64 exe的.pdata部分。我正在将文件映射到内存，找到.pdata部分，然后我使用它的PointerToRawData来获取该部分的实际数据...
但后来我的“pdata”指针指向一个非法地址:(
这就是我的工作：

void* mappingHandle = CreateFileMapping(fileHandle,
                    NULL,
                    PAGE_READONLY,
                    0,
                    1,
                    NULL);
char* fileMemory  = (char*)MapViewOfFile(mappingHandle, FILE_MAP_READ, 0, 0, 1);
IMAGE_DOS_HEADER* dosHeader = (IMAGE_DOS_HEADER*)fileMemory;
IMAGE_SECTION_HEADER* pdataSectionHeader = NULL;
if (dosHeader->e_magic == IMAGE_DOS_SIGNATURE) // "MZ" signature
{
    IMAGE_NT_HEADERS* ntHeaders = (IMAGE_NT_HEADERS*)(fileMemory + dosHeader->e_lfanew);
    if (ntHeaders->Signature == IMAGE_NT_SIGNATURE) // Supposed to be "PE"
    {
        unsigned int sectionCount = ntHeaders->FileHeader.NumberOfSections; 
        IMAGE_SECTION_HEADER* sectionHeaders = IMAGE_FIRST_SECTION(ntHeaders);
        pdataSectionHeader = sectionHeaders + 3; // Going to .pdata section.
    }
}
unsigned long pdataSize = pdataSectionHeader->SizeOfRawData;
char* pdata = fileMemory + pdataSectionHeader->PointerToRawData;

任何人都可以告诉我我做错了吗？

Answer 1

问题在于我将文件映射到内存的方式我应该这样做：

void* mappingHandle = CreateFileMapping(fileHandle,
                    NULL,
                    PAGE_READONLY,
                    0,
                    0, //Here: 0 instead of 1
                    NULL);

阅读PE32 +部分的原始数据

1 个答案: