• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 509
  • Last Modified:

Read header of exe file

I want to write a program that read header of exe file (in Windows- PE).Can you help me?
And supporting full information about header exe file format.
Thanks.
0
chuonglv
Asked:
chuonglv
1 Solution
 
rajeev_devinCommented:
0
 
Infinity08Commented:
For file formats, this is a nice site :

http://www.wotsit.org/
0
 
aib_42Commented:
/* PE executable examiner - aib - 20030221 */

#include <stdlib.h>
#include <stdio.h>

int main(int argc, char *argv[])
{
      FILE *PE;
      int i;
      unsigned long int header;
      unsigned long int ul;
      unsigned short int w;
      unsigned short int sections;
      unsigned short int oh_size;
      char s_name[9];
      unsigned long int s_size;
      unsigned long int s_address;
      unsigned long int s_rawsize;
      unsigned long int base;

      printf("\n<< PE-examiner by aib >>\n\n");

      if (argc != 2) {
            printf("Please specify the file to examine.\n");
            return 1;
      }

      if ((PE = fopen(argv[1], "rb")) == NULL) {
            printf("Unable to open %s.\n", argv[1]);
            return 1;
      }

      printf("File:\t\t%s\n", argv[1]);

      fseek(PE, 0x3c, SEEK_SET);
      fread(&header, 1, sizeof(header), PE);
      fseek(PE, header, SEEK_SET);

      printf("Signature:\t%02x %02x %02x %02x\n", fgetc(PE), fgetc(PE), fgetc(PE), fgetc(PE));

      fseek(PE, 2, SEEK_CUR);
      fread(&sections, 1, sizeof(sections), PE);

//      printf("# of sections:\t%i\n", sections);

      fseek(PE, 12, SEEK_CUR);
      fread(&oh_size, 1, sizeof(oh_size), PE);

      printf("Opt. Hdr. Size:\t%i\n", oh_size);

      fseek(PE, 2, SEEK_CUR);
      fread(&w, 1, sizeof(w), PE);

      printf("Magic Number:\t0x%04x (%s)\n", w, (w==0x10b?"PE32":(w==0x20b?"PE32+":"other")));

      fseek(PE, 14, SEEK_CUR);
      fread(&ul, 1, sizeof(ul), PE);

      printf("Entry Address:\t0x%08x\n", ul);

      fseek(PE, 8, SEEK_CUR);
      fread(&base, 1, sizeof(base), PE);

      printf("Image Base:\t0x%08x\n", base);

      fseek(PE, header + oh_size + 24, SEEK_SET);

      printf("# of sections:\t%i\n", sections);

      printf("Sections:\n");

      for(i=0; i<sections; i++) {
            fread(s_name, 1, 8, PE);
            s_name[8] = 0;
            fread(&s_rawsize, 1, sizeof(s_rawsize), PE);
            fseek(PE, 4, SEEK_CUR);
            fread(&s_size, 1, sizeof(s_size), PE);
            fread(&s_address, 1, sizeof(s_address), PE);

//            printf("\t\t%-8s: 0x%08x, %08x/%08x (%i)\n", s_name, s_address, s_rawsize, s_size, s_size-s_rawsize);
            printf("\t\t%-8s: Offset: 0x%08x, Size: %08x\n", s_name, s_address, s_size);

            fseek(PE, 16, SEEK_CUR);
      }

      fclose(PE);

      return 0;
}
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 
aib_42Commented:
Of course, I meant to have a little introduction to the code, but I accidentally deleted it. Anyway:

This is a little program I have written a while ago. I'm not sure how portable it would be, especially assuming shorts are 2 bytes and longs are 4, but it does work.
0
 
chuonglvAuthor Commented:
To aib 42
Thank you very much!
I'll check your program and reference it
But I have a wonder , with a PE file, how's length of it's header  ?
And Have you detail information( meaning) about it ? can you support to me ?
I had litter information, but I want to have more from you .Thanks  
0
 
aib_42Commented:
You should check out the URL's on the first two posts.

I'm not exactly sure, but I think I wrote the program using information available on www.wotsit.org, as Infinity08 has suggested.
0
 
Infinity08Commented:
>> I'm not exactly sure, but I think I wrote the program using information available on www.wotsit.org, as Infinity08 has suggested.
It is a good site, isn't it ? :)
0
 
aib_42Commented:
Oh yeah, it's the first (and usually the only) site I check when looking for file format specs.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now