pe.h

原理：对Pe文件的.data节

// PE.h: interface for the CPE class.
//
//////////////////////////////////////////////////////////////////////

#if !defined(AFX_PE_H__EFC04246_C7F6_49B4_A193_D46B72C4FECF__INCLUDED_)
#define AFX_PE_H__EFC04246_C7F6_49B4_A193_D46B72C4FECF__INCLUDED_

#if _MSC_VER > 1000
#pragma once
#endif // _MSC_VER > 1000

#include "common.h"
class CPE 
{
public:
	CPE();
	virtual ~CPE();
	bool CheckIfValidPE();
	void GetImportRVA();
	void CalculateDelta();
	void GetImportDest();
	void GetEntryPoint();
	void OnInitPE(CString strfilename);
	void CloseHandleOfPe(void);
	bool CheckifDLL();
	void CalculateNumberOfSection();
	CString GetSectionName(PIMAGE_SECTION_HEADER pSection);
	void GetPoniterToSection();
public:
	int NumberOfSection;
	PIMAGE_SECTION_HEADER pSection;
	//指向第一个sectiontable
    DWORD AddressOfEntryPoint;
	UINT FileSize;
	PBYTE pImageBase;
	PIMAGE_IMPORT_DESCRIPTOR pImportDest;
	UINT delta;
	DWORD importsStartRVA;
    HANDLE hFile;
	HANDLE hFileMapping;
	PBYTE g_pMappedFileBase;
	PIMAGE_DOS_HEADER dosHeader;
    PIMAGE_NT_HEADERS pNTHeader;
	PIMAGE_FILE_HEADER  pImageFileHeader;
	PIMAGE_OPTIONAL_HEADER pImageOptionalHeader;

};

#endif // !defined(AFX_PE_H__EFC04246_C7F6_49B4_A193_D46B72C4FECF__INCLUDED_)