asked on

How to read PE header with "CArchive" or "fstream"

i want to read the PE header , here is my code, i see it ok, but i alway give the result is "0xeba1f0e" in my edit box for the "ntHeader.Signature" while it must be "0x00004550"(PE00), though i get the right result in "dosHeader.e_magic"=0x5a4d(MZ)

void CNewDlg::OnOpen()
{
     IMAGE_DOS_HEADER dosHeader;
IMAGE_NT_HEADERS ntHeader;
CString Display;
UpdateData();

      char strFilter[] = { "EXE File(*.exe)|*exe|All Files (*.*)|*.*||" };
      CFileDialog dlgFile(TRUE, ".exe", NULL, 0, strFilter);

      if( dlgFile.DoModal() == IDOK )
      {
ifstream stmHeader(dlgFile.GetFileName(), ios::binary);
       stmHeader.read((char *)&dosHeader, sizeof(dosHeader));
       stmHeader.read((char *)&ntHeader, sizeof(ntHeader));

Display.Format("%x",ntHeader.Signature);
       m_headerInfo=Display; // m_headerInfo is a variable of an edit box that i use to display the result

      }
UpdateData(FALSE);

}

ASKER CERTIFIED SOLUTION

jkr

membership

Create a free account to see this answer

Signing up is free and takes 30 seconds. No credit card required.

See answer

anhtuaninfo

ASKER

thank you very much,it's very useful for my shoolwork.

now ,i 've understanded why my code failed. it is simply because i don't know the exactly PE header which has some differrences from msdn:
http://search.msdn.microsoft.com/search/results.aspx?qu=An+In-Depth+Look+into+the+Win32+Portable+Executable+File+Format&View=msdn&st=b&c=0&s=1&swc=0

The difference is "MoreDosHeader[16]".
But when i Insert the line :
stmHeader.read((char*)MoreDosHeader,sizeof(MoreDosHeader));
after read dosHeader anh before read ntHeader, my code still dispaly the wrong result.
Do you know why???

jkr

I'd start with opening the file in a hex editor to check where the difference comes from.

SOLUTION

wayside

membership

Create a free account to see this answer

Signing up is free and takes 30 seconds. No credit card required.

See answer

anhtuaninfo

ASKER

i think we read the file on disk, so the parts of file follows the sequence order and needn't to seekoff, isn't it ???

wayside

There's a variable-sized chunk in there that holds the DOS stub program - this is the part that prints a message like "This program cannot be run in DOS mode" or "This program must be run under Win32" if you try and run it in DOS. Different linkers put different stubs in there, and leave different amounts of space before the NT header. The way you get around this variable-sized chunk is to look at the e_lfanew field in the dos header. This tells you the offset *from the beginning of the file* of where the NT header starts.

So you can figure out how many bytes to read by figuring out how many bytes you've already read and subtract that from e_lfanew and then read that many more to get to the NT header, or you can just jump there using seekoff(). There's nothing interesting in the DOS stub, so there's no reason to read it if you don't have to.

How to read PE header with &quot;CArchive&quot; or &quot;fstream&quot;

How to read PE header with "CArchive" or "fstream"