#include #include #include #include int main(int argc, char **argv) { if (argc != 2) { fprintf(stderr, "Usage: %s \n", argv[0]); return EXIT_FAILURE ; } Pe_Binary_t *pe_binary = pe_parse(argv[1]); fprintf(stdout, "Binary Name: %s\n", pe_binary->name); Pe_DosHeader_t dos_header = pe_binary->dos_header; uint16_t *reserved = dos_header.reserved; uint16_t *reserved2 = dos_header.reserved2; fprintf(stdout, "DosHeader\n"); fprintf(stdout, "=========\n"); fprintf(stdout, "Used bytes in the last page: 0x%x\n", dos_header.used_bytes_in_the_last_page); fprintf(stdout, "File size in pages: 0x%x\n", dos_header.file_size_in_pages); fprintf(stdout, "Number of relocations: 0x%x\n", dos_header.numberof_relocation); fprintf(stdout, "Header size in paragraphs: 0x%x\n", dos_header.header_size_in_paragraphs); fprintf(stdout, "Minimum extra paragraphs: 0x%x\n", dos_header.minimum_extra_paragraphs); fprintf(stdout, "Maximum extra paragraphs: 0x%x\n", dos_header.maximum_extra_paragraphs); fprintf(stdout, "Initial relative ss: 0x%x\n", dos_header.initial_relative_ss); fprintf(stdout, "Initial sp: 0x%x\n", dos_header.initial_sp); fprintf(stdout, "Checksum: 0x%x\n", dos_header.checksum); fprintf(stdout, "Initial ip: 0x%x\n", dos_header.initial_ip); fprintf(stdout, "Initial relative cs: 0x%x\n", dos_header.initial_relative_cs); fprintf(stdout, "Address of relocation table: 0x%x\n", dos_header.addressof_relocation_table); fprintf(stdout, "Overlay number: 0x%x\n", dos_header.overlay_number); fprintf(stdout, "Reserved: %x %x %x %x\n", reserved[0], reserved[1], reserved[2], reserved[3]); fprintf(stdout, "OEM id: 0x%x\n", dos_header.oem_id); fprintf(stdout, "OEM info: 0x%x\n", dos_header.oem_info); fprintf(stdout, "Reserved2: %x %x %x %x %x %x %x %x %x %x\n", reserved2[0], reserved2[1], reserved2[2], reserved2[3], reserved2[4], reserved2[5], reserved2[6], reserved2[7], reserved2[8], reserved2[9]); fprintf(stdout, "Address of new exeheader: 0x%x\n", dos_header.addressof_new_exeheader); Pe_Header_t header = pe_binary->header; fprintf(stdout, "Header\n"); fprintf(stdout, "======\n"); fprintf(stdout, "Machine: %s\n", MACHINE_TYPES_to_string(header.machine)); fprintf(stdout, "Number of sections: %d\n", header.numberof_sections); fprintf(stdout, "Timestamp: 0x%x\n", header.time_date_stamp); fprintf(stdout, "Pointer to symbol table: 0x%x\n", header.pointerto_symbol_table); fprintf(stdout, "Number of symbols: %d\n", header.numberof_symbols); fprintf(stdout, "Sizeof optional header: 0x%x\n", header.sizeof_optional_header); fprintf(stdout, "Characteristics: 0x%x\n", header.characteristics); Pe_OptionalHeader_t optional_header = pe_binary->optional_header; fprintf(stdout, "Optional Header\n"); fprintf(stdout, "===============\n"); fprintf(stdout, "Magic: %s\n", PE_TYPES_to_string(optional_header.magic)); fprintf(stdout, "Major linker version: 0x%x\n", optional_header.major_linker_version); fprintf(stdout, "Minor linker version: 0x%x\n", optional_header.minor_linker_version); fprintf(stdout, "Size ofcode: 0x%x\n", optional_header.sizeof_code); fprintf(stdout, "Size of initialized data: 0x%x\n", optional_header.sizeof_initialized_data); fprintf(stdout, "Size of uninitialized data: 0x%x\n", optional_header.sizeof_uninitialized_data); fprintf(stdout, "Address of entrypoint: 0x%x\n", optional_header.addressof_entrypoint); fprintf(stdout, "Base of code: 0x%x\n", optional_header.baseof_code); fprintf(stdout, "Base of data: 0x%x\n", optional_header.baseof_data); fprintf(stdout, "Imagebase: 0x%" PRIx64 "\n", optional_header.imagebase); fprintf(stdout, "Section alignment: 0x%x\n", optional_header.section_alignment); fprintf(stdout, "File alignment: 0x%x\n", optional_header.file_alignment); fprintf(stdout, "Major operating system version: 0x%x\n", optional_header.major_operating_system_version); fprintf(stdout, "Minor operating system version: 0x%x\n", optional_header.minor_operating_system_version); fprintf(stdout, "Major image version: 0x%x\n", optional_header.major_image_version); fprintf(stdout, "Minor image version: 0x%x\n", optional_header.minor_image_version); fprintf(stdout, "Major subsystem version: 0x%x\n", optional_header.major_subsystem_version); fprintf(stdout, "Minor subsystem version: 0x%x\n", optional_header.minor_subsystem_version); fprintf(stdout, "Win32 version value: 0x%x\n", optional_header.win32_version_value); fprintf(stdout, "Size of image: 0x%x\n", optional_header.sizeof_image); fprintf(stdout, "Size of headers: 0x%x\n", optional_header.sizeof_headers); fprintf(stdout, "Checksum: 0x%x\n", optional_header.checksum); fprintf(stdout, "subsystem: %s\n", SUBSYSTEM_to_string(optional_header.subsystem)); fprintf(stdout, "DLL characteristics: 0x%x\n", optional_header.dll_characteristics); fprintf(stdout, "Size of stack reserve: 0x%" PRIx64 "\n", optional_header.sizeof_stack_reserve); fprintf(stdout, "Size of stack commit: 0x%" PRIx64 "\n", optional_header.sizeof_stack_commit); fprintf(stdout, "Size of heap reserve: 0x%" PRIx64 "\n", optional_header.sizeof_heap_reserve); fprintf(stdout, "Size of heap commit: 0x%" PRIx64 "\n", optional_header.sizeof_heap_commit); fprintf(stdout, "Loader flags: 0x%x\n", optional_header.loader_flags); fprintf(stdout, "Number of rva and size: 0x%x\n", optional_header.numberof_rva_and_size); fprintf(stdout, "\nDataDirectories\n"); fprintf(stdout, "===============\n"); Pe_DataDirectory_t** data_directories = pe_binary->data_directories; for (size_t i = 0; data_directories[i] != NULL; ++i) { fprintf(stdout, "RVA 0x%" PRIx32 "\n", data_directories[i]->rva); fprintf(stdout, "Size 0x%" PRIx32 "\n", data_directories[i]->size); } fprintf(stdout, "\nSections\n"); fprintf(stdout, "========\n"); Pe_Section_t** sections = pe_binary->sections; for (size_t i = 0; sections[i] != NULL; ++i) { Pe_Section_t* section = sections[i]; fprintf(stdout, "" "%-20s " "0x%06" PRIx64 " " "0x%06" PRIx64 " " "0x%06" PRIx64 " " "0x%06" PRIx32 " " "0x%06" PRIx32 " " "0x%06" PRIx32 " " "0x%06" PRIx32 " " "%.6f " "\n", section->name, section->virtual_address, section->size, section->offset, section->virtual_size, section->pointerto_relocation, section->pointerto_line_numbers, section->characteristics, section->entropy ); if (section->size > 3 && section->content != NULL) { fprintf(stdout, "content[0..3]: %02x %02x %02x\n", section->content[0], section->content[1], section->content[2]); } } fprintf(stdout, "\nImports\n"); fprintf(stdout, "========\n"); Pe_Import_t** imports = pe_binary->imports; if (imports != NULL) { for (size_t i = 0; imports[i] != NULL; ++i) { fprintf(stdout, "Name: %s\n", imports[i]->name); Pe_ImportEntry_t** entries = imports[i]->entries; for (size_t i = 0; entries[i] != NULL; ++i) { if (entries[i]->name != NULL) { fprintf(stdout, " %s\n", entries[i]->name); } } } } pe_binary_destroy(pe_binary); return EXIT_SUCCESS; }