We help IT Professionals succeed at work.

We've partnered with Certified Experts, Carl Webster and Richard Faulkner, to bring you a podcast all about Citrix Workspace, moving to the cloud, and analytics & intelligence. Episode 2 coming soon!Listen Now

x

Read header of exe file

chuonglv
chuonglv asked
on
Medium Priority
523 Views
Last Modified: 2010-08-05
I want to write a program that read header of exe file (in Windows- PE).Can you help me?
And supporting full information about header exe file format.
Thanks.
Comment
Watch Question

CERTIFIED EXPERT
Top Expert 2009

Commented:
For file formats, this is a nice site :

http://www.wotsit.org/

Commented:
/* PE executable examiner - aib - 20030221 */

#include <stdlib.h>
#include <stdio.h>

int main(int argc, char *argv[])
{
      FILE *PE;
      int i;
      unsigned long int header;
      unsigned long int ul;
      unsigned short int w;
      unsigned short int sections;
      unsigned short int oh_size;
      char s_name[9];
      unsigned long int s_size;
      unsigned long int s_address;
      unsigned long int s_rawsize;
      unsigned long int base;

      printf("\n<< PE-examiner by aib >>\n\n");

      if (argc != 2) {
            printf("Please specify the file to examine.\n");
            return 1;
      }

      if ((PE = fopen(argv[1], "rb")) == NULL) {
            printf("Unable to open %s.\n", argv[1]);
            return 1;
      }

      printf("File:\t\t%s\n", argv[1]);

      fseek(PE, 0x3c, SEEK_SET);
      fread(&header, 1, sizeof(header), PE);
      fseek(PE, header, SEEK_SET);

      printf("Signature:\t%02x %02x %02x %02x\n", fgetc(PE), fgetc(PE), fgetc(PE), fgetc(PE));

      fseek(PE, 2, SEEK_CUR);
      fread(&sections, 1, sizeof(sections), PE);

//      printf("# of sections:\t%i\n", sections);

      fseek(PE, 12, SEEK_CUR);
      fread(&oh_size, 1, sizeof(oh_size), PE);

      printf("Opt. Hdr. Size:\t%i\n", oh_size);

      fseek(PE, 2, SEEK_CUR);
      fread(&w, 1, sizeof(w), PE);

      printf("Magic Number:\t0x%04x (%s)\n", w, (w==0x10b?"PE32":(w==0x20b?"PE32+":"other")));

      fseek(PE, 14, SEEK_CUR);
      fread(&ul, 1, sizeof(ul), PE);

      printf("Entry Address:\t0x%08x\n", ul);

      fseek(PE, 8, SEEK_CUR);
      fread(&base, 1, sizeof(base), PE);

      printf("Image Base:\t0x%08x\n", base);

      fseek(PE, header + oh_size + 24, SEEK_SET);

      printf("# of sections:\t%i\n", sections);

      printf("Sections:\n");

      for(i=0; i<sections; i++) {
            fread(s_name, 1, 8, PE);
            s_name[8] = 0;
            fread(&s_rawsize, 1, sizeof(s_rawsize), PE);
            fseek(PE, 4, SEEK_CUR);
            fread(&s_size, 1, sizeof(s_size), PE);
            fread(&s_address, 1, sizeof(s_address), PE);

//            printf("\t\t%-8s: 0x%08x, %08x/%08x (%i)\n", s_name, s_address, s_rawsize, s_size, s_size-s_rawsize);
            printf("\t\t%-8s: Offset: 0x%08x, Size: %08x\n", s_name, s_address, s_size);

            fseek(PE, 16, SEEK_CUR);
      }

      fclose(PE);

      return 0;
}
Commented:
Of course, I meant to have a little introduction to the code, but I accidentally deleted it. Anyway:

This is a little program I have written a while ago. I'm not sure how portable it would be, especially assuming shorts are 2 bytes and longs are 4, but it does work.

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts

Author

Commented:
To aib 42
Thank you very much!
I'll check your program and reference it
But I have a wonder , with a PE file, how's length of it's header  ?
And Have you detail information( meaning) about it ? can you support to me ?
I had litter information, but I want to have more from you .Thanks  

Commented:
You should check out the URL's on the first two posts.

I'm not exactly sure, but I think I wrote the program using information available on www.wotsit.org, as Infinity08 has suggested.
CERTIFIED EXPERT
Top Expert 2009

Commented:
>> I'm not exactly sure, but I think I wrote the program using information available on www.wotsit.org, as Infinity08 has suggested.
It is a good site, isn't it ? :)

Commented:
Oh yeah, it's the first (and usually the only) site I check when looking for file format specs.
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.