elhacker.net cabecera Bienvenido(a), Visitante. Por favor Ingresar o Registrarse
¿Perdiste tu email de activación?.

 

 


Tema destacado: AIO elhacker.NET 2021 Compilación herramientas análisis y desinfección malware


+  Foro de elhacker.net
|-+  Programación
| |-+  Programación General
| | |-+  .NET (C#, VB.NET, ASP)
| | | |-+  Programación Visual Basic (Moderadores: LeandroA, seba123neo)
| | | | |-+  formato portable ejecutable
0 Usuarios y 1 Visitante están viendo este tema.
Páginas: [1] Ir Abajo Respuesta Imprimir
Autor Tema: formato portable ejecutable  (Leído 2,052 veces)
malektaus27A

Desconectado Desconectado

Mensajes: 4


Ver Perfil
formato portable ejecutable
« en: 30 Enero 2008, 02:49 am »

cuando me dedique estudiar algo del formato portable ejecutable de winodws (en espavirus hay buena informacion, y en la msdn) decidi, hacer este code. Es un rustico analizador pe, analiza la cabecera pe, la tabla de importaciones, tabla de exportaciones, algo basico de el directorio de debug y el directorio de recursos.  hay algo de codigo por optimizar y no se la forma de convertir el formato de la fecha, tal vez debe haber alguna api. si alguien sabe por favor responder.

------------------------------------- inicio del code ----------------------------------


Código
  1. 'agregar un listbox llamado list1
  2. 'agregar un menu llamado archivo
  3. 'unos sub menus "o como se llamen " llamdos abrir, guardar, limpiar  y salir
  4.  
  5. Private Type IMAGE_DOS_HEADER
  6.    e_magic As Integer
  7.    e_cblp As Integer
  8.    e_cp As Integer
  9.    e_crlc As Integer
  10.    e_cparhdr As Integer
  11.    e_minalloc As Integer
  12.    e_maxalloc As Integer
  13.    e_ss As Integer
  14.    e_sp As Integer
  15.    e_csum As Integer
  16.    e_ip As Integer
  17.    e_cs As Integer
  18.    e_lfarlc As Integer
  19.    e_ovno As Integer
  20.    e_res(0 To 3) As Integer
  21.    e_oemid As Integer
  22.    e_oeminfo As Integer
  23.    e_res2(0 To 9) As Integer
  24.    e_lfanew As Long
  25. End Type
  26.  
  27. Const IMAGE_DOS_SIGNATURE = &H5A4D
  28. Const IMAGE_NUMBEROF_DIRECTORY_ENTRIES = 16
  29. Const IMAGE_NT_SIGNATURE = &H4550
  30.  
  31. Private Type IMAGE_FILE_HEADER
  32.    Machine                 As Integer
  33.    NumberOfSections        As Integer
  34.    TimeDateStamp           As Long
  35.    PointerToSymbolTable    As Long
  36.    NumberOfSymbols         As Long
  37.    SizeOfOptionalHeader    As Integer
  38.    Characteristics         As Integer
  39. End Type
  40.  
  41. Private Type IMAGE_DATA_DIRECTORY
  42.    VirtualAddress As Long
  43.    size As Long
  44. End Type
  45.  
  46. Private Type IMAGE_OPTIONAL_HEADER
  47.    Magic As Integer
  48.    MajorLinkerVersion As Byte
  49.    MinorLinkerVersion As Byte
  50.    SizeOfCode As Long
  51.    SizeOfInitializedData As Long
  52.    SizeOfUninitializedData As Long
  53.    AddressOfEntryPoint As Long
  54.    BaseOfCode  As Long
  55.    BaseOfData  As Long
  56.    ImageBase  As Long
  57.    SectionAlignment  As Long
  58.    FileAlignment As Long
  59.    MajorOperatingSystemVersion As Integer
  60.    MinorOperatingSystemVersion As Integer
  61.    MajorImageVersion As Integer
  62.    MinorImageVersion As Integer
  63.    MajorSubsystemVersion As Integer
  64.    MinorSubsystemVersion As Integer
  65.    Win32VersionValue As Long
  66.    SizeOfImage As Long
  67.    SizeOfHeaders As Long
  68.    CheckSum As Long
  69.    subsystem As Integer
  70.    DllCharacteristics As Integer
  71.    SizeOfStackReserve As Long
  72.    SizeOfStackCommit As Long
  73.    SizeOfHeapReserve As Long
  74.    SizeOfHeapCommit As Long
  75.    LoaderFlags As Long
  76.    NumberOfRvaAndSizes As Long
  77.    DataDirectory(0 To IMAGE_NUMBEROF_DIRECTORY_ENTRIES - 1) As IMAGE_DATA_DIRECTORY
  78. End Type
  79.  
  80. Private Type IMAGE_NT_HEADERS
  81.    Signature As Long
  82.    FileHeader As IMAGE_FILE_HEADER
  83.    OptionalHeader As IMAGE_OPTIONAL_HEADER
  84. End Type
  85.  
  86. Const IMAGE_SIZEOF_SHORT_NAME = 8
  87.  
  88. Private Type IMAGE_SECTION_HEADER
  89.   SectionName(IMAGE_SIZEOF_SHORT_NAME - 1)  As Byte
  90.   Address           As Long
  91.   VirtualAddress    As Long
  92.   SizeOfData        As Long
  93.   PData             As Long
  94.   PReloc            As Long
  95.   PLineNums         As Long
  96.   RelocCount        As Integer
  97.   LineCount         As Integer
  98.   Characteristics   As Long
  99. End Type
  100.  
  101. Private Type IMAGE_IMPORT_DESCRIPTOR
  102. OriginalFirstThunk As Long
  103. TimeDateStamp As Long
  104. ForwarderChain As Long
  105. Name As Long
  106. FirstThunk As Long
  107. End Type
  108.  
  109. Private Type IMAGE_EXPORT_DIRECTORY
  110. Characteristics As Long
  111. TimeDateStamp As Long
  112. MajorVersion As Integer
  113. MinorVersion As Integer
  114. Name As Long
  115. base As Long
  116. NumberOfFunctions As Long
  117. NumberOfNames As Long
  118. AddressOfFunctions As Long
  119. AddressOfNames As Long
  120. AddressOfNameOrdinals As Long
  121. End Type
  122.  
  123. Private Type IMAGE_RESOURCE_DATA_ENTRY
  124. OffsetToData As Long
  125. size As Long
  126. CodePage As Long
  127. Reserved As Long
  128. End Type
  129.  
  130. Private Type IMAGE_RESOURCE_DIRECTORY
  131. Characteristics As Long
  132. TimeDateStamp As Long
  133. MajorVersion As Integer
  134. MinorVersion As Integer
  135. NumberOfNamedEntries As Integer
  136. NumberOfIdEntries As Integer
  137. End Type
  138.  
  139. Private Type RESORUCE
  140. Id As Long
  141. Offset_to_directory As Long
  142. End Type
  143.  
  144. Private Type IMAGE_DEBUG_DIRECTORY
  145. Characteristics As Long
  146. TimeDateStamp As Long
  147. MajorVersion As Integer
  148. MinorVersion As Integer
  149. Type As Long
  150. SizeOfData As Long
  151. AddressOfRawData As Long
  152. PointerToRawData As Long
  153. End Type
  154.  
  155. Private Type IMAGE_BOUND_IMPORT_DESCRIPTOR
  156. TimeDateStamp As Long
  157. OffsetModuleName As Integer
  158. NumberOfModuleForwarderRefs As Integer
  159. End Type
  160.  
  161. Private Type OPENFILENAME
  162.    lStructSize As Long
  163.    hwndOwner As Long
  164.    hInstance As Long
  165.    lpstrFilter As String
  166.    lpstrCustomFilter As String
  167.    nMaxCustFilter As Long
  168.    nFilterIndex As Long
  169.    lpstrFile As String
  170.    nMaxFile As Long
  171.    lpstrFileTitle As String
  172.    nMaxFileTitle As Long
  173.    lpstrInitialDir As String
  174.    lpstrTitle As String
  175.    flags As Long
  176.    nFileOffset As Integer
  177.    nFileExtension As Integer
  178.    lpstrDefExt As String
  179.    lCustData As Long
  180.    lpfnHook As Long
  181.    lpTemplateName As String
  182. End Type
  183.  
  184. Private Type SYSTEMTIME
  185.    wYear As Integer
  186.    wMonth As Integer
  187.    wDayOfWeek As Integer
  188.    wDay As Integer
  189.    wHour As Integer
  190.    wMinute As Integer
  191.    wSecond As Integer
  192.    wMilliseconds As Integer
  193. End Type
  194. Private Type FILETIME
  195.        dwLowDateTime As Long
  196.        dwHighDateTime As Long
  197. End Type
  198.  
  199. Const MAX_PATH = 260
  200.  
  201. Private Type WIN32_FIND_DATA
  202.        dwFileAttributes As Long
  203.        ftCreationTime As FILETIME
  204.        ftLastAccessTime As FILETIME
  205.        ftLastWriteTime As FILETIME
  206.        nFileSizeHigh As Long
  207.        nFileSizeLow As Long
  208.        dwReserved0 As Long
  209.        dwReserved1 As Long
  210.        cFileName As String * MAX_PATH
  211.        cAlternate As String * 14
  212. End Type
  213.  
  214. Private Type my_res
  215. nombre_res As String
  216. rva As Long
  217. End Type
  218.  
  219. Const IMAGE_FILE_MACHINE_UNKNOWN = 0
  220. Const IMAGE_FILE_MACHINE_I386 = &H14C
  221. Const IMAGE_FILE_MACHINE_BIG_ENDIAN = &H160
  222. Const IMAGE_FILE_MACHINE_R3000 = &H162
  223. Const IMAGE_FILE_MACHINE_R4000 = &H166
  224. Const IMAGE_FILE_MACHINE_R10000 = &H168
  225. Const IMAGE_FILE_MACHINE_WCEMIPSV2 = &H169
  226. Const IMAGE_FILE_MACHINE_ALPHA = &H184
  227. Const IMAGE_FILE_MACHINE_POWERPC = &H1F0
  228. Const IMAGE_FILE_MACHINE_SH3 = &H1A2
  229. Const IMAGE_FILE_MACHINE_SH3E = &H1A4
  230. Const IMAGE_FILE_MACHINE_SH4 = &H1A6
  231. Const IMAGE_FILE_MACHINE_ARM = &H1C0
  232. Const IMAGE_FILE_MACHINE_THUMB = &H1C2
  233. Const IMAGE_FILE_MACHINE_IA64 = &H200
  234. Const IMAGE_FILE_MACHINE_MIPS16 = &H266
  235. Const IMAGE_FILE_MACHINE_MIPSFPU = &H366
  236. Const IMAGE_FILE_MACHINE_MIPSFPU16 = &H466
  237. Const IMAGE_FILE_MACHINE_ALPHA64 = &H284
  238.  
  239. Const IMAGE_SUBSYSTEM_UNKNOWN = 0
  240. Const IMAGE_SUBSYSTEM_NATIVE = 1
  241. Const IMAGE_SUBSYSTEM_WINDOWS_GUI = 2
  242. Const IMAGE_SUBSYSTEM_WINDOWS_CUI = 3
  243. Const IMAGE_SUBSYSTEM_OS2_CUI = 5
  244. Const IMAGE_SUBSYSTEM_POSIX_CUI = 7
  245. Const IMAGE_SUBSYSTEM_NATIVE_WINDOWS = 8
  246. Const IMAGE_SUBSYSTEM_WINDOWS_CE_GUI = 9
  247.  
  248. Const IMAGE_FILE_RELOCS_STRIPPED = &H1
  249. Const IMAGE_FILE_EXECUTABLE_IMAGE = &H2
  250. Const IMAGE_FILE_LINE_NUMS_STRIPPED = &H4
  251. Const IMAGE_FILE_LOCAL_SYMS_STRIPPED = &H8
  252. Const IMAGE_FILE_AGGRESIVE_WS_TRIM = &H10
  253. Const IMAGE_FILE_LARGE_ADDRESS_AWARE = &H20
  254. Const IMAGE_FILE_BYTES_REVERSED_LO = &H80
  255. Const IMAGE_FILE_32BIT_MACHINE = &H100
  256. Const IMAGE_FILE_DEBUG_STRIPPED = &H200
  257. Const IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP = &H400
  258. Const IMAGE_FILE_NET_RUN_FROM_SWAP = &H800
  259. Const IMAGE_FILE_SYSTEM = &H1000
  260. Const IMAGE_FILE_DLL = &H2000
  261. Const IMAGE_FILE_UP_SYSTEM_ONLY = &H4000
  262. Const IMAGE_FILE_BYTES_REVERSED_HI = &H8000
  263.  
  264. Const IMAGE_SCN_TYPE_REG = &H0
  265. Const IMAGE_SCN_TYPE_DSECT = &H1
  266. Const IMAGE_SCN_TYPE_NOLOAD = &H2
  267. Const IMAGE_SCN_TYPE_GROUP = &H4
  268. Const IMAGE_SCN_TYPE_NO_PAD = &H8
  269. Const IMAGE_SCN_TYPE_COPY = &H10
  270. Const IMAGE_SCN_CNT_CODE = &H20
  271. Const IMAGE_SCN_CNT_INITIALIZED_DATA = &H40
  272. Const IMAGE_SCN_CNT_UNINITIALIZED_DATA = &H80
  273. Const IMAGE_SCN_LNK_OTHER = &H100
  274. Const IMAGE_SCN_LNK_INFO = &H200
  275. Const IMAGE_SCN_TYPE_OVER = &H400
  276. Const IMAGE_SCN_LNK_REMOVE = &H800
  277. Const IMAGE_SCN_LNK_COMDAT = &H1000
  278. Const IMAGE_SCN_NO_DEFER_SPEC_EXC = &H4000
  279. Const IMAGE_SCN_GPREL = &H8000
  280. Const IMAGE_SCN_MEM_FARDATA = &H8000
  281. Const IMAGE_SCN_MEM_SYSHEAP = &H10000
  282. Const IMAGE_SCN_MEM_PURGEABLE = &H20000
  283. Const IMAGE_SCN_MEM_16BIT = &H20000
  284. Const IMAGE_SCN_MEM_LOCKED = &H40000
  285. Const IMAGE_SCN_MEM_PRELOAD = &H80000
  286. Const IMAGE_SCN_ALIGN_1BYTES = &H100000
  287. Const IMAGE_SCN_ALIGN_2BYTES = &H200000
  288. Const IMAGE_SCN_ALIGN_4BYTES = &H300000
  289. Const IMAGE_SCN_ALIGN_8BYTES = &H400000
  290. Const IMAGE_SCN_ALIGN_16BYTES = &H500000
  291. Const IMAGE_SCN_ALIGN_32BYTES = &H600000
  292. Const IMAGE_SCN_ALIGN_64BYTES = &H700000
  293. Const IMAGE_SCN_ALIGN_128BYTES = &H800000
  294. Const IMAGE_SCN_ALIGN_256BYTES = &H900000
  295. Const IMAGE_SCN_ALIGN_512BYTES = &HA00000
  296. Const IMAGE_SCN_ALIGN_1024BYTES = &HB00000
  297. Const IMAGE_SCN_ALIGN_2048BYTES = &HC00000
  298. Const IMAGE_SCN_ALIGN_4096BYTES = &HD00000
  299. Const IMAGE_SCN_ALIGN_8192BYTES = &HE00000
  300. Const IMAGE_SCN_LNK_NRELOC_OVFL = &H1000000
  301. Const IMAGE_SCN_MEM_DISCARDABLE = &H2000000
  302. Const IMAGE_SCN_MEM_NOT_CACHED = &H4000000
  303. Const IMAGE_SCN_MEM_NOT_PAGED = &H8000000
  304. Const IMAGE_SCN_MEM_SHARED = &H10000000
  305. Const IMAGE_SCN_MEM_EXECUTE = &H20000000
  306. Const IMAGE_SCN_MEM_READ = &H40000000
  307. Const IMAGE_SCN_MEM_WRITE = &H80000000
  308.  
  309. Const IMAGE_DEBUG_TYPE_UNKNOWN = 0
  310. Const IMAGE_DEBUG_TYPE_COFF = 1
  311. Const IMAGE_DEBUG_TYPE_CODEVIEW = 2
  312. Const IMAGE_DEBUG_TYPE_FPO = 3
  313. Const IMAGE_DEBUG_TYPE_MISC = 4
  314. Const IMAGE_DEBUG_TYPE_EXCEPTION = 5
  315. Const IMAGE_DEBUG_TYPE_FIXUP = 6
  316. Const IMAGE_DEBUG_TYPE_OMAP_TO_SRC = 7
  317. Const IMAGE_DEBUG_TYPE_OMAP_FROM_SRC = 8
  318. Const IMAGE_DEBUG_TYPE_BORLAND = 9
  319. Const IMAGE_DEBUG_TYPE_RESERVED10 = 10
  320.  
  321. Const ROM_IMAGE = &H107
  322. Const NORMAL_EXECUTABLE_IMAGE = &H10B
  323. Const IMAGE_SIZEOF_FILE_HEADER = 20
  324. Const IMAGE_SIZEOF_NT_HEADER = 248
  325.  
  326. Private Declare Function CreateFile Lib "kernel32" Alias "CreateFileA" (ByVal lpFileName As String, ByVal dwDesiredAccess As Long, ByVal dwShareMode As Long, lpSecurityAttributes As Long, ByVal dwCreationDisposition As Long, ByVal dwFlagsAndAttributes As Long, ByVal hTemplateFile As Long) As Long
  327. Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
  328. Private Declare Function CreateFileMapping Lib "kernel32" Alias "CreateFileMappingA" (ByVal hFile As Long, lpFileMappigAttributes As Long, ByVal flProtect As Long, ByVal dwMaximumSizeHigh As Long, ByVal dwMaximumSizeLow As Long, ByVal lpName As String) As Long
  329. Private Declare Function MapViewOfFile Lib "kernel32" (ByVal hFileMappingObject As Long, ByVal dwDesiredAccess As Long, ByVal dwFileOffsetHigh As Long, ByVal dwFileOffsetLow As Long, ByVal dwNumberOfBytesToMap As Long) As Long
  330. Private Declare Function UnmapViewOfFile Lib "kernel32" (lpBaseAddress As Any) As Long
  331. Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal Length As Long)
  332. Private Declare Function GetModuleFileName Lib "kernel32.dll" Alias "GetModuleFileNameA" (ByVal hModule As Long, ByVal lpFileName As String, ByVal nSize As Long) As Long
  333. Private Declare Sub ExitProcess Lib "kernel32.dll" (ByVal uExitCode As Long)
  334. Private Declare Function GetOpenFileName Lib "comdlg32.dll" Alias "GetOpenFileNameA" (pOpenfilename As OPENFILENAME) As Long
  335. Private Declare Function FindFirstFile Lib "kernel32" Alias "FindFirstFileA" (ByVal lpFileName As String, lpFindFileData As WIN32_FIND_DATA) As Long
  336. Private Declare Function FindClose Lib "kernel32" (ByVal hFindFile As Long) As Long
  337. Private Declare Function FileTimeToSystemTime Lib "kernel32.dll" (ByRef lpFileTime As FILETIME, ByRef lpSystemTime As SYSTEMTIME) As Long
  338.  
  339. Const GENERIC_READ = &H80000000
  340. Const FILE_SHARE_READ = &H1
  341. Const OPEN_EXISTING = 3
  342. Const FILE_ATTRIBUTE_NORMAL = &H80
  343. Const PAGE_READONLY = &H2
  344. Const SECTION_MAP_READ = &H4
  345. Const FILE_MAP_READ = SECTION_MAP_READ
  346. Const MAXDWORD = &HFFFF
  347. Const INVALID_HANDLE_VALUE = -1
  348. Const IMAGE_ORDINAL_FLAG32 = &H80000000
  349.  
  350. Private Function directorio(num) As String
  351. Select Case num
  352. Case 0
  353. directorio = "EXPORT" 'IMAGE_DIRECTORY_ENTRY_EXPORT (0) => El directorio de simbolos exportados; mayormente usados por DLLs.
  354. Case 1
  355. directorio = "IMPORT" 'IMAGE_DIRECTORY_ENTRY_IMPORT (1) => El directorio de simbolos importados.
  356. Case 2
  357. directorio = "RESOURCE" 'IMAGE_DIRECTORY_ENTRY_RESOURCE (2) => Directorio de recursos.
  358. Case 3
  359. directorio = "EXCEPTION" 'IMAGE_DIRECTORY_ENTRY_EXCEPTION (3) => 'Directorio de Excepción – Propósito y estructura desconocida.
  360. Case 4
  361. directorio = "SECURITY" 'IMAGE_DIRECTORY_ENTRY_SECURITY (4) => Directorio de seguridad - Propósito y estructura desconocida.
  362. Case 5
  363. directorio = "BASERELOC" 'IMAGE_DIRECTORY_ENTRY_BASERELOC (5) => Tabla base de relocaciones.
  364. Case 6
  365. directorio = "DEBUG" 'IMAGE_DIRECTORY_ENTRY_DEBUG (6) => Directorio de Debug.
  366. Case 7
  367. directorio = "COPYRIGHT" 'IMAGE_DIRECTORY_ENTRY_COPYRIGHT (7) => Cadena de descripción – alguna nota arbitraria de copyright o parecido.
  368. Case 8
  369. directorio = "GLOBALPTR" 'IMAGE_DIRECTORY_ENTRY_GLOBALPTR (8) => Valor Maquina (MIPS GP) - Propósito y estructura desconocida.
  370. Case 9
  371. directorio = "TLS" 'IMAGE_DIRECTORY_ENTRY_TLS (9) => Thread local storage directory – Estructura desconocida; contiene variables que son declaradas como "__declspec(thread)".
  372. Case 10
  373. directorio = "LOAD_CONFIG" 'IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG (10) => Directorio de configuracion de cargado - Propósito y estructura desconocida.
  374. Case 11
  375. directorio = "BOUND_IMPORT" 'IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (11) => Limite del directorio de importacion.
  376. Case 12
  377. directorio = "ENTRY_IAT" 'IMAGE_DIRECTORY_ENTRY_IAT (12) => Tabla de direcciones importadas.
  378. Case 13
  379. directorio = "DELAY_IMPORT" 'IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT (13) => Delay Load Import Descriptors
  380. Case 14
  381. directorio = "COM_DESCRIPTOR" 'IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR (14) => COM+ Runtime descriptor
  382. End Select
  383. End Function
  384.  
  385. Private Function maquina(num As Integer) As String
  386. Select Case num
  387. Case IMAGE_FILE_MACHINE_UNKNOWN
  388. maquina = "desconocido"
  389. Case IMAGE_FILE_MACHINE_I386
  390. maquina = "Intel 386"
  391. Case IMAGE_FILE_MACHINE_BIG_ENDIAN
  392. maquina = "Big Endian"
  393. Case IMAGE_FILE_MACHINE_R3000
  394. maquina = "MIPS little-endian"
  395. Case IMAGE_FILE_MACHINE_R4000
  396. maquina = "MIPS little-endian"
  397. Case IMAGE_FILE_MACHINE_R10000
  398. maquina = "MIPS little-endian"
  399. Case IMAGE_FILE_MACHINE_WCEMIPSV2
  400. maquina = "MIPS little-endian WCE v2"
  401. Case IMAGE_FILE_MACHINE_ALPHA
  402. maquina = "Alpha_AXP"
  403. Case IMAGE_FILE_MACHINE_POWERPC
  404. maquina = "IBM PowerPC Little-Endian"
  405. Case IMAGE_FILE_MACHINE_SH3
  406. maquina = "SH3 little-endian"
  407. Case IMAGE_FILE_MACHINE_SH3E
  408. maquina = "SH3E little-endian"
  409. Case IMAGE_FILE_MACHINE_SH4
  410. maquina = "SH4 little-endian"
  411. Case IMAGE_FILE_MACHINE_ARM
  412. maquina = "ARM Little-Endian"
  413. Case IMAGE_FILE_MACHINE_THUMB
  414. Case IMAGE_FILE_MACHINE_IA64
  415. maquina = "Intel 64"
  416. Case IMAGE_FILE_MACHINE_MIPS16
  417. maquina = "MIPS"
  418. Case IMAGE_FILE_MACHINE_MIPSFPU
  419. maquina = "MIPS"
  420. Case IMAGE_FILE_MACHINE_MIPSFPU16
  421. maquina = "MIPS"
  422. Case IMAGE_FILE_MACHINE_ALPHA64
  423. maquina = "ALPHA64"
  424. Case Else
  425. maquina = "Desconocida"
  426. End Select
  427. End Function
  428.  
  429. Private Function subsystem(num As Integer) As String
  430. Select Case num
  431. Case IMAGE_SUBSYSTEM_UNKNOWN
  432. subsystem = "UNKNOWN"
  433. Case IMAGE_SUBSYSTEM_NATIVE
  434. subsystem = "NATIVE"
  435. Case IMAGE_SUBSYSTEM_WINDOWS_GUI
  436. subsystem = "WINDOWS_GUI"
  437. Case IMAGE_SUBSYSTEM_WINDOWS_CUI
  438. subsystem = "WINDOWS_CUI"
  439. Case IMAGE_SUBSYSTEM_OS2_CUI
  440. subsystem = "OS2_CUI"
  441. Case IMAGE_SUBSYSTEM_POSIX_CUI
  442. subsystem = "POSIX_CUI"
  443. Case IMAGE_SUBSYSTEM_NATIVE_WINDOWS
  444. subsystem = "NATIVE_WINDOWS"
  445. Case IMAGE_SUBSYSTEM_WINDOWS_CE_GUI
  446. subsystem = "WINDOWS_CE_GUI"
  447. Case Else
  448. subsystem = "UNKNOWN"
  449. End Select
  450. End Function
  451.  
  452. Private Function chracteritics(num As Long) As String
  453. If num < 0 Then
  454. num = num - IMAGE_FILE_BYTES_REVERSED_HI
  455. temp = "BYTES_REVERSED_HI" & vbCrLf
  456. End If
  457. Dim arr(15) As Long
  458. For i = 0 To UBound(arr)
  459. arr(i) = 2 ^ i
  460. Next
  461. For i = UBound(arr) To 0 Step -1
  462. If (num - arr(i)) >= 0 Then
  463. num = num - arr(i)
  464. temp = temp & chract(arr(i)) & vbCrLf
  465. End If
  466. Next
  467. chracteritics = Mid(temp, 1, Len(temp) - 2)
  468. End Function
  469.  
  470. Private Function chract(num As Long) As String
  471. Select Case num
  472. Case IMAGE_FILE_RELOCS_STRIPPED
  473. chract = "RELOCS_STRIPPED"
  474. Case IMAGE_FILE_EXECUTABLE_IMAGE
  475. chract = "EXECUTABLE_IMAGE"
  476. Case IMAGE_FILE_LINE_NUMS_STRIPPED
  477. chract = "LINE_NUMS_STRIPPED"
  478. Case IMAGE_FILE_LOCAL_SYMS_STRIPPED
  479. chract = "LOCAL_SYMS_STRIPPED"
  480. Case IMAGE_FILE_AGGRESIVE_WS_TRIM
  481. chract = "AGGRESIVE_WS_TRIM"
  482. Case IMAGE_FILE_LARGE_ADDRESS_AWARE
  483. chract = "LARGE_ADDRESS_AWARE"
  484. Case IMAGE_FILE_BYTES_REVERSED_LO
  485. chract = "BYTES_REVERSED_LO"
  486. Case IMAGE_FILE_32BIT_MACHINE
  487. chract = "32BIT_MACHINE"
  488. Case IMAGE_FILE_DEBUG_STRIPPED
  489. chract = "DEBUG_STRIPPED"
  490. Case IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
  491. chract = "REMOVABLE_RUN_FROM_SWAP"
  492. Case IMAGE_FILE_NET_RUN_FROM_SWAP
  493. chract = "NET_RUN_FROM_SWAP"
  494. Case IMAGE_FILE_SYSTEM
  495. chract = "SYSTEM"
  496. Case IMAGE_FILE_DLL
  497. chract = "DLL"
  498. Case IMAGE_FILE_UP_SYSTEM_ONLY
  499. chract = "UP_SYSTEM_ONLY"
  500. Case Else
  501. chract = "UNKNOWN"
  502. End Select
  503. End Function
  504.  
  505. Private Function sec_chract(num As Variant) As String
  506. Select Case num
  507. Case IMAGE_SCN_TYPE_DSECT
  508. sec_chract = "TYPE_DSECT"
  509. Case IMAGE_SCN_TYPE_NOLOAD
  510. sec_chract = "TYPE_NOLOAD"
  511. Case IMAGE_SCN_TYPE_GROUP
  512. sec_chract = "TYPE_GROUP"
  513. Case IMAGE_SCN_TYPE_NO_PAD
  514. sec_chract = "TYPE_NO_PAD"
  515. Case IMAGE_SCN_TYPE_COPY
  516. sec_chract = "TYPE_COPY"
  517. Case IMAGE_SCN_CNT_CODE
  518. sec_chract = "CNT_CODE"
  519. Case IMAGE_SCN_CNT_INITIALIZED_DATA
  520. sec_chract = "CNT_INITIALIZED_DATA"
  521. Case IMAGE_SCN_CNT_UNINITIALIZED_DATA
  522. sec_chract = "CNT_UNINITIALIZED_DATA"
  523. Case IMAGE_SCN_LNK_OTHER
  524. sec_chract = "LNK_OTHER"
  525. Case IMAGE_SCN_LNK_INFO
  526. sec_chract = "LNK_INFO"
  527. Case IMAGE_SCN_TYPE_OVER
  528. sec_chract = "TYPE_OVER"
  529. Case IMAGE_SCN_LNK_REMOVE
  530. sec_chract = "LNK_REMOVE"
  531. Case IMAGE_SCN_LNK_COMDAT
  532. sec_chract = "LNK_COMDAT"
  533. Case IMAGE_SCN_NO_DEFER_SPEC_EXC
  534. sec_chract = "NO_DEFER_SPEC_EXC"
  535. Case IMAGE_SCN_MEM_FARDATA
  536. sec_chract = "MEM_FARDATA"
  537. Case IMAGE_SCN_MEM_SYSHEAP
  538. sec_chract = "MEM_SYSHEAP"
  539. Case IMAGE_SCN_MEM_PURGEABLE
  540. sec_chract = "MEM_PURGEABLE"
  541. Case IMAGE_SCN_MEM_LOCKED
  542. sec_chract = "MEM_LOCKED"
  543. Case IMAGE_SCN_MEM_PRELOAD
  544. sec_chract = "MEM_PRELOAD"
  545. Case IMAGE_SCN_ALIGN_1BYTES
  546. sec_chract = "ALIGN_1BYTES"
  547. Case IMAGE_SCN_ALIGN_2BYTES
  548. sec_chract = "ALIGN_2BYTES"
  549. 'Case IMAGE_SCN_ALIGN_4BYTES
  550. Case IMAGE_SCN_ALIGN_8BYTES
  551. sec_chract = "ALIGN_8BYTES"
  552. 'Case IMAGE_SCN_ALIGN_16BYTES
  553. 'Case IMAGE_SCN_ALIGN_32BYTES
  554. 'Case IMAGE_SCN_ALIGN_64BYTES
  555. Case IMAGE_SCN_ALIGN_128BYTES
  556. sec_chract = "ALIGN_128BYTES"
  557. 'Case IMAGE_SCN_ALIGN_256BYTES
  558. 'Case IMAGE_SCN_ALIGN_512BYTES
  559. 'Case IMAGE_SCN_ALIGN_1024BYTES
  560. 'Case IMAGE_SCN_ALIGN_2048BYTES
  561. 'Case IMAGE_SCN_ALIGN_4096BYTES
  562. 'Case IMAGE_SCN_ALIGN_8192BYTES
  563. Case IMAGE_SCN_LNK_NRELOC_OVFL
  564. sec_chract = "LNK_NRELOC_OVFL"
  565. Case IMAGE_SCN_MEM_DISCARDABLE
  566. sec_chract = "MEM_DISCARDABLE"
  567. Case IMAGE_SCN_MEM_NOT_CACHED
  568. sec_chract = "MEM_NOT_CACHED"
  569. Case IMAGE_SCN_MEM_NOT_PAGED
  570. sec_chract = "MEM_NOT_PAGED"
  571. Case IMAGE_SCN_MEM_SHARED
  572. sec_chract = "MEM_SHARED"
  573. Case IMAGE_SCN_MEM_EXECUTE
  574. sec_chract = "MEM_EXECUTE"
  575. Case IMAGE_SCN_MEM_READ
  576. sec_chract = "MEM_READ"
  577. Case IMAGE_SCN_MEM_WRITE
  578. sec_chract = "MEM_WRITE"
  579. Case Else
  580. sec_chract = "UNKNOWN"
  581. End Select
  582. End Function
  583.  
  584. Private Function secton_chracteritics(num) As String
  585. Dim arr(31)
  586. For i = 0 To UBound(arr)
  587. arr(i) = 2 ^ i
  588. Next
  589. secton_chracteritics = ""
  590.  
  591. If num = 0 Then
  592. secton_chracteritics = "TYPE_REG"
  593. Exit Function
  594. End If
  595.  
  596. If num < 0 Then
  597. If num > IMAGE_SCN_MEM_WRITE Then
  598. num = num - IMAGE_SCN_MEM_WRITE
  599. temp = "MEM_WRITE or "
  600. End If
  601. End If
  602.  
  603. For i = UBound(arr) To 0 Step -1
  604. If (num - arr(i)) >= 0 Then
  605. num = num - arr(i)
  606. temp = temp & sec_chract(arr(i)) & " or "
  607. End If
  608. Next
  609. secton_chracteritics = Mid(temp, 1, Len(temp) - 3)
  610. End Function
  611.  
  612. Private Function type_debug(num As Integer) As String
  613. Select Case num
  614. Case IMAGE_DEBUG_TYPE_UNKNOWN
  615. type_debug = "UNKNOWN"
  616. Case IMAGE_DEBUG_TYPE_COFF
  617. type_debug = "COFF"
  618. Case IMAGE_DEBUG_TYPE_CODEVIEW
  619. type_debug = "CODEVIEW"
  620. Case IMAGE_DEBUG_TYPE_FPO
  621. type_debug = "FPO"
  622. Case IMAGE_DEBUG_TYPE_MISC
  623. type_debug = "MISC"
  624. Case IMAGE_DEBUG_TYPE_EXCEPTION
  625. type_debug = "EXCEPTION"
  626. Case IMAGE_DEBUG_TYPE_FIXUP
  627. type_debug = "FIXUP"
  628. Case IMAGE_DEBUG_TYPE_OMAP_TO_SRC
  629. type_debug = "OMAP_TO_SRC"
  630. Case IMAGE_DEBUG_TYPE_OMAP_FROM_SRC
  631. type_debug = "OMAP_FROM_SRC"
  632. Case IMAGE_DEBUG_TYPE_BORLAND
  633. type_debug = "BORLAND"
  634. Case IMAGE_DEBUG_TYPE_RESERVED10
  635. type_debug = "RESERVED10"
  636. End Select
  637. End Function
  638.  
  639. Private Function dir(num As Long, dirres As Long) As String
  640. dir = vbNullString
  641.  
  642. If num And IMAGE_ORDINAL_FLAG32 Then
  643. num = num - IMAGE_ORDINAL_FLAG32
  644.  
  645. Dim bitdir As Byte
  646. Dim countdir As Integer
  647. Dim desdir As Long
  648. desdir = dirres + num
  649. CopyMemory countdir, ByVal desdir, 2
  650. desdir = desdir + 2
  651. While countdir > 0
  652. CopyMemory bitdir, ByVal desdir, 1
  653. dir = dir & Chr(bitdir)
  654. desdir = desdir + 2
  655. countdir = countdir - 1
  656. Wend
  657.  
  658. Else
  659.  
  660. Select Case num
  661. Case 1
  662. dir = "CURSOR"
  663. Case 2
  664. dir = "BITMAP"
  665. Case 3
  666. dir = "ICON"
  667. Case 5
  668. dir = "DIALOG"
  669. Case 6
  670. dir = "STRING"
  671. Case 11
  672. dir = "MESSAGE_TABLE"
  673. Case 12
  674. dir = "GROUP_CURSOR"
  675. Case 14
  676. dir = "GROUP_ICON"
  677. Case 16
  678. dir = "VERSION"
  679. Case 22
  680. dir = "ANIICON"
  681. Case 24
  682. dir = "MANIFEST"
  683. Case Else
  684. dir = "???"
  685. End Select
  686. End If
  687. End Function
  688.  
  689. Private Function cero_dir(num As String) As String
  690. diff = 4 - Len(num)
  691. cero_dir = num
  692. For i = 1 To diff
  693. cero_dir = "0" & cero_dir
  694. Next
  695. End Function
  696.  
  697. Private Function msb(num) As Long
  698. msb = num
  699. If num And IMAGE_ORDINAL_FLAG32 Then
  700. msb = num - IMAGE_ORDINAL_FLAG32
  701. End If
  702. End Function
  703.  
  704. Private Function obtener_string(base As Long, rva As Long, tipo As Integer, raw As Long) As String
  705. Dim nom As Byte
  706. Dim desp As Long
  707. If rva <= 2 Then
  708. Exit Function
  709. End If
  710. desp = base + rva - raw
  711. CopyMemory nom, ByVal desp, tipo
  712. While nom
  713. temp = temp & Chr(nom)
  714. desp = desp + 1
  715. CopyMemory nom, ByVal desp, tipo
  716. Wend
  717. obtener_string = temp
  718. End Function
  719.  
  720. Private Function desp_offset(dirbase As Long, rva As Long) As Long
  721. Dim image_dos_head As IMAGE_DOS_HEADER
  722. Dim image_nt_header As IMAGE_NT_HEADERS
  723. Dim image_section_head As IMAGE_SECTION_HEADER
  724. Dim despl As Long
  725. CopyMemory image_dos_head, ByVal (dirbase), Len(image_dos_head)
  726. despl = dirbase + image_dos_head.e_lfanew
  727. CopyMemory image_nt_header, ByVal (despl), IMAGE_SIZEOF_NT_HEADER
  728. nos = image_nt_header.FileHeader.NumberOfSections
  729. despl = despl + IMAGE_SIZEOF_NT_HEADER
  730. CopyMemory image_section_head, ByVal (despl), Len(image_section_head)
  731. desp_offset = 0
  732. Do While nos
  733. If rva >= image_section_head.VirtualAddress Then
  734. temp = image_section_head.VirtualAddress + image_section_head.SizeOfData
  735. If rva < temp Then
  736. desp_offset = image_section_head.VirtualAddress - image_section_head.PData
  737. Exit Do
  738. End If
  739. End If
  740. nos = nos - 1
  741. despl = despl + Len(image_section_head)
  742. CopyMemory image_section_head, ByVal (despl), Len(image_section_head)
  743. Loop
  744. End Function
  745.  
  746. Private Function analizador_pe(archivo As String, list As ListBox)
  747. Dim lngdirbase As Long
  748. Dim image_dos_head As IMAGE_DOS_HEADER
  749. Dim image_nt_header As IMAGE_NT_HEADERS
  750. Dim image_section_head() As IMAGE_SECTION_HEADER
  751. Dim raw_offset As Long
  752. Dim va As Long
  753. Dim tam As Long
  754. Dim r As Long
  755. Dim addr As Long
  756. Dim ord As Integer
  757. list.Clear
  758.  
  759. hArch = CreateFile(archivo, GENERIC_READ, FILE_SHARE_READ, ByVal 0&, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0)
  760. If hArch = INVALID_HANDLE_VALUE Then
  761. MsgBox "El Archivo NO se Pudo Abrir", vbExclamation, "Error"
  762. Exit Function
  763. End If
  764.  
  765. hMap = CreateFileMapping(hArch, ByVal 0&, PAGE_READONLY, 0, 0, 0)
  766. CloseHandle hArch
  767. If hMap = 0 Then
  768. MsgBox "NO se pudo Crear el Objeto de Mapeo", vbExclamation, "Error"
  769. Exit Function
  770. End If
  771.  
  772. lngdirbase = MapViewOfFile(hMap, FILE_MAP_READ, 0, 0, 0)
  773. CloseHandle hMap
  774. If lngdirbase = 0 Then
  775. MsgBox "NO se ha Podido Mapear el Archivo en Memoria", vbExclamation, "Error"
  776. Exit Function
  777. End If
  778.  
  779. CopyMemory image_dos_head, ByVal lngdirbase, Len(image_dos_head)
  780. If image_dos_head.e_magic = IMAGE_DOS_SIGNATURE Then
  781. CopyMemory image_nt_header, ByVal (image_dos_head.e_lfanew + lngdirbase), Len(image_nt_header)
  782. If image_nt_header.Signature = IMAGE_NT_SIGNATURE Then
  783.  
  784. list.AddItem "Offset hacia PE_HEADER: " & Hex(image_dos_head.e_lfanew) & "h"
  785. '''''''''''''
  786. 'cabecera pe'
  787. '''''''''''''
  788. list.AddItem "Imagen Base " & Hex(image_nt_header.OptionalHeader.ImageBase) & "h"
  789. list.AddItem "Direccion del Punto de Entrada(RVA) " & Hex(image_nt_header.OptionalHeader.AddressOfEntryPoint) & "h"
  790. list.AddItem "Base of Code " & Hex(image_nt_header.OptionalHeader.BaseOfCode) & "h"
  791. list.AddItem "Maquina: " & maquina(image_nt_header.FileHeader.Machine)
  792. list.AddItem "Memoria reservada para el arhcivo: " & Hex(image_nt_header.OptionalHeader.SizeOfImage) & "h"
  793. list.AddItem "time to data stamp: " & Hex(image_nt_header.FileHeader.TimeDateStamp) & "h"
  794. list.AddItem "Caracteristicas: " & Hex(image_nt_header.FileHeader.Characteristics) & "h"
  795. list.AddItem chracteritics(CLng(image_nt_header.FileHeader.Characteristics))
  796. list.AddItem "Subsistema: " & subsystem(image_nt_header.OptionalHeader.subsystem)
  797. list.AddItem "Carcteristicas Dll:" & Hex(image_nt_header.OptionalHeader.DllCharacteristics)
  798. Select Case image_nt_header.OptionalHeader.Magic
  799. Case ROM_IMAGE
  800. magi = "ROM_IMAGE"
  801. Case NORMAL_EXECUTABLE_IMAGE
  802. magi = "NORMAL_EXECUTABLE_IMAGE"
  803. Case Else
  804. magi = "UNKNOWN"
  805. End Select
  806. list.AddItem "Tipo de Fichero: " & magi
  807. For i = 0 To IMAGE_NUMBEROF_DIRECTORY_ENTRIES - 1
  808. If image_nt_header.OptionalHeader.DataDirectory(i).size Then
  809. list.AddItem "DIRECTORIO " & directorio(i) & ": "
  810. list.AddItem "Direccion Virtual: " & Hex(image_nt_header.OptionalHeader.DataDirectory(i).VirtualAddress) & "h"
  811. list.AddItem "Tamaño: " & Hex(image_nt_header.OptionalHeader.DataDirectory(i).size) & "h"
  812. End If
  813. Next
  814. '''''''''''''''''''
  815. 'tabla de seciones'
  816. '''''''''''''''''''
  817. list.AddItem "Numero de Secciones " & image_nt_header.FileHeader.NumberOfSections
  818. list.AddItem "SECCIONES: "
  819. ReDim image_section_head(0 To image_nt_header.FileHeader.NumberOfSections - 1)
  820. For i = 0 To image_nt_header.FileHeader.NumberOfSections - 1
  821. tam = lngdirbase + image_dos_head.e_lfanew + IMAGE_SIZEOF_NT_HEADER + Len(image_section_head(0)) * i
  822. CopyMemory image_section_head(i), ByVal (tam), Len(image_section_head(0))
  823. sección = ""
  824. For j = 0 To 7
  825. sección = sección & Chr(image_section_head(i).SectionName(j))
  826. Next
  827. list.AddItem "Nombre de la sección " & i + 1 & "  " & sección
  828. list.AddItem "Direccion Virtual " & Hex(image_section_head(i).VirtualAddress) & "h"
  829. list.AddItem "pointer to raw data " & Hex(image_section_head(i).PData) & "h"
  830. list.AddItem "size of raw data " & Hex(image_section_head(i).SizeOfData) & "h"
  831. list.AddItem "Caractersiticas de la sección " & Hex(image_section_head(i).Characteristics) & "h"
  832. list.AddItem secton_chracteritics(image_section_head(i).Characteristics)
  833. list.AddItem "Fin de la sección"
  834. Next
  835. list.AddItem "Fin de las Secciones"
  836. '''''''''''''''''''
  837. 'directorio bound'
  838. '''''''''''''''''''
  839. If image_nt_header.OptionalHeader.DataDirectory(11).size Then
  840. list.AddItem "DIRECTORIO BOUND_IMPORT"
  841. Dim bound_import_descriptor As IMAGE_BOUND_IMPORT_DESCRIPTOR
  842. raw_offset = desp_offset(lngdirbase, image_nt_header.OptionalHeader.DataDirectory(11).VirtualAddress)
  843. tam = lngdirbase + image_nt_header.OptionalHeader.DataDirectory(11).VirtualAddress
  844. CopyMemory bound_import_descriptor, ByVal tam, Len(bound_import_descriptor)
  845. While Not ((bound_import_descriptor.NumberOfModuleForwarderRefs = 0) And (bound_import_descriptor.OffsetModuleName = 0))
  846. list.AddItem "time to data stamp " & Hex(bound_import_descriptor.TimeDateStamp) & "h"
  847. list.AddItem "Nombre del Modulo: " & obtener_string(lngdirbase, image_nt_header.OptionalHeader.DataDirectory(11).VirtualAddress + bound_import_descriptor.OffsetModuleName, 1, raw_offset)
  848. list.AddItem "Offset al Nombre del Modulo " & Hex(bound_import_descriptor.OffsetModuleName) & "h"
  849. tam = tam + Len(bound_import_descriptor)
  850. CopyMemory bound_import_descriptor, ByVal tam, Len(bound_import_descriptor)
  851. Wend
  852. list.AddItem "Fin del Directorio BOUND_IMPORT"
  853. Else
  854. list.AddItem "NO HAY DIRECTORIO BOUND_IMPORT"
  855. End If
  856. '''''''''''''''''''''''''''''
  857. 'directorio de importaciones'
  858. '''''''''''''''''''''''''''''
  859. If image_nt_header.OptionalHeader.DataDirectory(1).size Then
  860. Dim image_import As IMAGE_IMPORT_DESCRIPTOR
  861. raw_offset = desp_offset(lngdirbase, image_nt_header.OptionalHeader.DataDirectory(1).VirtualAddress)
  862. list.AddItem "DIRECTORIO DE IMPORTACIONES"
  863. tam = lngdirbase + image_nt_header.OptionalHeader.DataDirectory(1).VirtualAddress - raw_offset
  864. CopyMemory image_import, ByVal (tam), Len(image_import)
  865. i = 0
  866. While Not ((image_import.FirstThunk = 0) And (image_import.ForwarderChain = 0) And (image_import.Name = 0) And (image_import.OriginalFirstThunk = 0) And (image_import.TimeDateStamp = 0))
  867.  
  868. list.AddItem "Importacion " & i + 1
  869. list.AddItem "Nombre del Archivo: " & obtener_string(lngdirbase, image_import.Name, 1, raw_offset)
  870. list.AddItem "(RVA) Nombre: " & Hex(image_import.Name) & "h"
  871. list.AddItem "ForwarderChain " & Hex(image_import.ForwarderChain) & "h"
  872. list.AddItem "TimeDateStamp " & Hex(image_import.TimeDateStamp) & "h"
  873. list.AddItem "(RVA) Tabla de Importacion por Direcciones: " & Hex(image_import.FirstThunk) & "h"
  874. list.AddItem "(RVA) Tabla de Importacion de Nombres: " & Hex(image_import.OriginalFirstThunk) & "h"
  875.  
  876. If image_import.OriginalFirstThunk Then
  877.  
  878. r = lngdirbase + image_import.OriginalFirstThunk - raw_offset
  879. nof = 0
  880. CopyMemory va, ByVal r, 4
  881. While va
  882. If va And IMAGE_ORDINAL_FLAG32 Then
  883. va = msb(va)
  884. nom = "por Ordinal " & Hex(va) & "h"
  885. Else
  886. nom = obtener_string(lngdirbase, va + 2, 2, raw_offset)
  887. End If
  888. tam = lngdirbase - raw_offset + nof * 4 + image_import.FirstThunk
  889. CopyMemory addr, ByVal tam, 4
  890. list.AddItem "Funcion Importada: " & nom & "  --> IAT:  " & Hex(addr) & "h"
  891. nof = nof + 1
  892. r = r + 4
  893. CopyMemory va, ByVal r, 4
  894. Wend
  895.  
  896. Else
  897.  
  898. r = lngdirbase + image_import.FirstThunk - raw_offset
  899. CopyMemory va, ByVal r, 4
  900. While va
  901. list.AddItem "Funcion Importada: " & Hex(va) & "h"
  902. r = r + 4
  903. CopyMemory va, ByVal r, 4
  904. Wend
  905.  
  906. End If
  907.  
  908. i = i + 1
  909. tam = lngdirbase + i * Len(image_import) + image_nt_header.OptionalHeader.DataDirectory(1).VirtualAddress - raw_offset
  910. CopyMemory image_import, ByVal (tam), Len(image_import)
  911. Wend
  912. list.AddItem "Fin del Directorio de Importaciones"
  913.  
  914. Else
  915. list.AddItem "EL ARCHIVO NO IMPORTA FUNCIONES"
  916.  
  917. End If
  918. '''''''''''''''''''''''''''''
  919. 'directorio de exportaciones'
  920. '''''''''''''''''''''''''''''
  921. If image_nt_header.OptionalHeader.DataDirectory(0).size Then
  922. Dim image_export As IMAGE_EXPORT_DIRECTORY
  923. raw_offset = desp_offset(lngdirbase, image_nt_header.OptionalHeader.DataDirectory(0).VirtualAddress)
  924. CopyMemory image_export, ByVal (lngdirbase + image_nt_header.OptionalHeader.DataDirectory(0).VirtualAddress - raw_offset), Len(image_export)
  925. list.AddItem "DIRECTORIO DE EXPORTACIONES "
  926. list.AddItem "Nombre Original: " & obtener_string(lngdirbase, image_export.Name, 1, raw_offset)
  927. list.AddItem "(RVA) Nombre" & Hex(image_export.Name) & "h"
  928. list.AddItem "time to data stamp " & Hex(image_export.TimeDateStamp) & "h"
  929. list.AddItem "Numero de Funciones Exportadas " & image_export.NumberOfFunctions
  930. list.AddItem "Numero de Nombres Exportados " & image_export.NumberOfNames
  931. list.AddItem "(RVA) Tabla de Exportacion por Direcciones: " & Hex(image_export.AddressOfFunctions) & "h"
  932. list.AddItem "(RVA) Tabla de Nombres: " & Hex(image_export.AddressOfNames) & "h"
  933. list.AddItem "(RVA) Tabla de Ordinales : " & Hex(image_export.AddressOfNameOrdinals) & "h"
  934.  
  935. If image_export.NumberOfNames Then
  936.  
  937. r = lngdirbase + image_export.AddressOfNames - raw_offset
  938. CopyMemory va, ByVal r, 4
  939. nof = 0
  940. While nof < image_export.NumberOfNames
  941. nom = obtener_string(lngdirbase, CLng(va), 2, raw_offset)
  942. tam = lngdirbase - raw_offset + nof * 2 + image_export.AddressOfNameOrdinals
  943. CopyMemory ord, ByVal tam, 2
  944. tam = lngdirbase - raw_offset + ord * 4 + image_export.AddressOfFunctions
  945. CopyMemory addr, ByVal tam, 4
  946. list.AddItem "Funcion Exportada:  " & nom & "  Ordinal  " & (ord + image_export.base) & "  --> EAT:  " & Hex(addr) & "h"
  947. r = r + 4
  948. nof = nof + 1
  949. CopyMemory va, ByVal r, 4
  950. Wend
  951.  
  952. Else
  953.  
  954. r = lngdirbase + image_export.AddressOfFunctions - raw_offset
  955. nof = 0
  956. CopyMemory va, ByVal r, 4
  957. While nof < image_export.NumberOfFunctions
  958. list.AddItem "Funcion Exportada: " & Hex(va) & "h"
  959. r = r + 4
  960. nof = nof + 1
  961. CopyMemory va, ByVal r, 4
  962. Wend
  963.  
  964. End If
  965.  
  966. list.AddItem "Fin del Directorio de Exportaciones"
  967. Else
  968. list.AddItem "EL ARCHIVO NO EXPORTA FUNCIONES"
  969.  
  970. End If
  971. '''''''''''''''''''''
  972. 'directorio de debug'
  973. '''''''''''''''''''''
  974. If image_nt_header.OptionalHeader.DataDirectory(6).size Then
  975. Dim image_debug() As IMAGE_DEBUG_DIRECTORY
  976. raw_offset = desp_offset(lngdirbase, image_nt_header.OptionalHeader.DataDirectory(6).VirtualAddress)
  977. ReDim image_debug(0 To image_nt_header.OptionalHeader.DataDirectory(6).size / Len(image_debug(0)))
  978. list.AddItem "DIRECTORIO DE DEBUG"
  979. For i = 0 To UBound(image_debug) - 1
  980. tam = lngdirbase + image_nt_header.OptionalHeader.DataDirectory(6).VirtualAddress - raw_offset + i * Len(image_debug(0))
  981. CopyMemory image_debug(i), ByVal tam, Len(image_debug(i))
  982. list.AddItem "Subdirectorio de Debug " & i + 1
  983. list.AddItem "time to data stamp: " & Hex(image_debug(i).TimeDateStamp) & "h"
  984. list.AddItem "Tipo: " & type_debug(CInt(image_debug(i).Type))
  985. list.AddItem "RVA: " & Hex(image_debug(i).AddressOfRawData) & "h"
  986. list.AddItem "Tamaño: " & image_debug(i).SizeOfData
  987. list.AddItem "Data Offset: " & Hex(image_debug(i).PointerToRawData) & "h"
  988. list.AddItem "Fin del Subdirectorio"
  989. Next
  990. list.AddItem "Fin del Directorio de Debug"
  991. Else
  992. list.AddItem "NO HAY DIRECTORIO DE DEBUG"
  993. End If
  994. ''''''''''''''''''''''''
  995. 'directorio de recursos'
  996. ''''''''''''''''''''''''
  997. If image_nt_header.OptionalHeader.DataDirectory(2).size Then
  998. raw_offset = desp_offset(lngdirbase, image_nt_header.OptionalHeader.DataDirectory(2).VirtualAddress)
  999. list.AddItem "DIRECTORIO DE RECURSOS"
  1000. ''''''
  1001. 'Type'
  1002. ''''''
  1003. Dim image_resource As IMAGE_RESOURCE_DIRECTORY
  1004. CopyMemory image_resource, ByVal (lngdirbase + image_nt_header.OptionalHeader.DataDirectory(2).VirtualAddress - raw_offset), Len(image_resource)
  1005. n_rsc = image_resource.NumberOfNamedEntries + image_resource.NumberOfIdEntries
  1006. Dim rsc() As RESORUCE
  1007. Dim nom_d() As String
  1008. ReDim rsc(n_rsc - 1)
  1009. ReDim nom_d(n_rsc - 1)
  1010. For i = 0 To n_rsc - 1
  1011. tam = lngdirbase + image_nt_header.OptionalHeader.DataDirectory(2).VirtualAddress - raw_offset + Len(image_resource) + Len(rsc(0)) * i
  1012. CopyMemory rsc(i), ByVal tam, Len(rsc(0))
  1013. nom_d(i) = dir(rsc(i).Id, lngdirbase + image_nt_header.OptionalHeader.DataDirectory(2).VirtualAddress - raw_offset)
  1014. Next
  1015. ''''''
  1016. 'Name'
  1017. ''''''
  1018. Dim rsc_2() As RESORUCE
  1019. Dim my_re() As my_res
  1020. cont = 0
  1021. Dim image_resource_2() As IMAGE_RESOURCE_DIRECTORY
  1022. ReDim image_resource_2(n_rsc - 1)
  1023. For i = 0 To n_rsc - 1
  1024. tam = lngdirbase + image_nt_header.OptionalHeader.DataDirectory(2).VirtualAddress - raw_offset + msb(rsc(i).Offset_to_directory)
  1025. CopyMemory image_resource_2(i), ByVal tam, Len(image_resource)
  1026. n_res = image_resource_2(i).NumberOfNamedEntries + image_resource_2(i).NumberOfIdEntries
  1027. ReDim rsc_2(n_res - 1)
  1028. ReDim Preserve my_re(cont + n_res)
  1029. r = 0
  1030. For j = 0 To n_res - 1
  1031. r = tam + Len(image_resource) + j * Len(rsc(0))
  1032. CopyMemory rsc_2(j), ByVal (r), Len(rsc(0))
  1033. my_re(j + cont).nombre_res = nom_d(i) & " " & cero_dir(CStr(Hex(rsc_2(j).Id)))
  1034. my_re(j + cont).rva = msb(rsc_2(j).Offset_to_directory)
  1035. Next
  1036. cont = cont + n_res
  1037. Next
  1038. ''''''''''
  1039. 'Language'
  1040. ''''''''''
  1041. Dim image_resource_3() As IMAGE_RESOURCE_DIRECTORY
  1042. Dim rsc_3() As RESORUCE
  1043. cont = 0
  1044. Dim rva_to_de() As my_res
  1045. ReDim image_resource_3(UBound(my_re) - 1)
  1046. For i = 0 To UBound(my_re) - 1
  1047. tam = lngdirbase + image_nt_header.OptionalHeader.DataDirectory(2).VirtualAddress - raw_offset + my_re(i).rva
  1048. CopyMemory image_resource_3(i), ByVal tam, Len(image_resource)
  1049. n_res = image_resource_3(i).NumberOfNamedEntries + image_resource_3(i).NumberOfIdEntries
  1050. r = 0
  1051. ReDim rsc_3(n_res)
  1052. ReDim Preserve rva_to_de(cont + n_res)
  1053. For j = 0 To n_res - 1
  1054. r = tam + Len(image_resource) + j * Len(rsc(0))
  1055. CopyMemory rsc_3(j), ByVal r, Len(rsc(0))
  1056. rva_to_de(j + cont).rva = rsc_3(j).Offset_to_directory
  1057. rva_to_de(j + cont).nombre_res = my_re(i).nombre_res & " " & cero_dir(CStr(Hex(rsc_3(j).Id)))
  1058. Next
  1059. cont = cont + n_res
  1060. Next
  1061. '''''''''''''''''''''''''''
  1062. 'image resource data entry'
  1063. '''''''''''''''''''''''''''
  1064. Dim data_entry() As IMAGE_RESOURCE_DATA_ENTRY
  1065. ReDim data_entry(UBound(rva_to_de) - 1)
  1066. For i = 0 To UBound(rva_to_de) - 1
  1067. tam = lngdirbase + image_nt_header.OptionalHeader.DataDirectory(2).VirtualAddress - raw_offset + rva_to_de(i).rva
  1068. CopyMemory data_entry(i), ByVal tam, Len(data_entry(0))
  1069. list.AddItem "Directorio " & rva_to_de(i).nombre_res
  1070. list.AddItem "(RVA) Datos: " & Hex(data_entry(i).OffsetToData) & "h"
  1071. list.AddItem "Tamaño " & data_entry(i).size
  1072. list.AddItem "Code Page " & Hex(data_entry(i).CodePage) & "h"
  1073. list.AddItem "Fin del Directorio"
  1074. Next
  1075.  
  1076. list.AddItem "Fin del Directorio de Recursos"
  1077.  
  1078. Else
  1079. list.AddItem "NO HAY DIRECTORIO DE RECURSOS"
  1080. End If
  1081.  
  1082. UnmapViewOfFile lngdirbase
  1083.  
  1084. Else
  1085. UnmapViewOfFile lngdirbase
  1086. MsgBox "No es Formato PE Valido", vbExclamation
  1087. Exit Function
  1088. End If
  1089.  
  1090. Else
  1091. UnmapViewOfFile lngdirbase
  1092. MsgBox "No es un Formato Pe Valido", vbExclamation
  1093. Exit Function
  1094. End If
  1095.  
  1096. End Function
  1097.  
  1098. Private Sub Abrir_Click()
  1099. Dim ofn As OPENFILENAME
  1100. ofn.lStructSize = Len(ofn)
  1101. ofn.hwndOwner = Me.hWnd
  1102. ofn.hInstance = App.hInstance
  1103. 'extensiones *.exe *.dll *.sys *.ocx *.cpl .src
  1104. ofn.lpstrFilter = "Archivos Ejecutables (*.exe)" & vbNullChar & "*.exe" & vbNullChar & "Librerias de Enlace Dinamico (*.dll)" & vbNullChar & "*.dll" & vbNullChar & "Controles Active X (*.ocx)" & vbNullChar & "*.ocx" & vbNullChar & "Archivos de Panel de Control (*.cpl)" & vbNullChar & "*.cpl" & vbNullChar & "Archivos del Sistema (*.sys)" & vbNullChar & "*.sys" & vbNullChar & "Screensavers (*.scr)" & vbNullChar & "*.scr" & vbNullChar
  1105. ofn.lpstrFile = Space$(254)
  1106. ofn.nMaxFile = 255
  1107. ofn.lpstrFileTitle = Space$(254)
  1108. ofn.nMaxFileTitle = 255
  1109. ofn.lpstrTitle = "Analizar archivos"
  1110. ofn.flags = 0
  1111. If GetOpenFileName(ofn) Then
  1112. Form1.MousePointer = vbHourglass
  1113. Call analizador_pe(ofn.lpstrFile, List1)
  1114. If List1.ListCount > 0 Then: Me.Caption = Trim(ofn.lpstrFile)
  1115. Form1.MousePointer = vbArrow
  1116. End If
  1117. End Sub
  1118.  
  1119. Private Sub arch_Click()
  1120. If List1.ListCount > 0 Then
  1121. Me.Limpiar.Enabled = True
  1122. Else
  1123. Me.Limpiar.Enabled = False
  1124. End If
  1125. End Sub
  1126.  
  1127. Private Sub Form_Load()
  1128. Me.Caption = "Analizador PE by MALEK"
  1129. List1.Height = 3180
  1130. List1.Width = 5895
  1131. End Sub
  1132.  
  1133. Private Sub Form_Resize()
  1134. If (Form1.Width - 350) > 0 Then: List1.Width = Form1.Width - 350
  1135. If (Form1.Height - 850) > 0 Then: List1.Height = Form1.Height - 850
  1136. End Sub
  1137.  
  1138. Private Sub Guardar_Click()
  1139. Dim buffer As String * MAX_PATH
  1140. Dim wfd As WIN32_FIND_DATA
  1141. Dim st As SYSTEMTIME
  1142. If List1.ListCount > 0 Then
  1143. Form1.MousePointer = vbHourglass
  1144. Set fso = CreateObject("Scripting.FileSystemObject")
  1145. archivo = Me.Caption
  1146. pos = InStr(1, StrReverse(archivo), "\", vbBinaryCompare)
  1147. pos_arc = Len(archivo) - pos + 1
  1148. Path = Mid(archivo, 1, pos_arc - 1)
  1149. nombre_arch = Mid(archivo, pos_arc + 1, Len(archivo))
  1150. 'Call GetModuleFileName(0&, buffer, 255)
  1151. 'directory = Replace(buffer, Chr(0), vbNullString)
  1152. file = App.Path & "\" & Mid(nombre_arch, 1, Len(nombre_arch) - 4) & ".txt"
  1153. hwnd_ff = FindFirstFile(archivo, wfd)
  1154. Call FileTimeToSystemTime(wfd.ftCreationTime, st)
  1155. Call FindClose(hwnd_ff)
  1156. fso.CreateTextFile file
  1157. Set file = fso.GetFile(file)
  1158. Set ts = file.OpenAsTextStream(8)
  1159. ts.writeline "Ubicacion: " & Path
  1160. ts.writeline "Archivo: " & nombre_arch
  1161. ts.writeline "Creado: " & st.wDay & "\" & st.wMonth & "\" & st.wYear
  1162. ts.writeline "Tamaño: " & (wfd.nFileSizeHigh * MAXDWORD + wfd.nFileSizeLow) & " bytes"
  1163. ts.writeline ""
  1164. ts.writeline "ANALISIS PE"
  1165. ts.writeline ""
  1166. For i = 0 To List1.ListCount - 1
  1167. List1.ListIndex = i
  1168. ts.writeline Trim(List1.Text)
  1169. Next
  1170. ts.Close
  1171. List1.ListIndex = 0
  1172. Form1.MousePointer = vbArrow
  1173. MsgBox "La Informacion ha Sido Guardada Correctamente " & vbCrLf & file, vbOKOnly
  1174. Else
  1175. MsgBox "Debe Analizar Algun Archivo", vbInformation
  1176. End If
  1177. End Sub
  1178.  
  1179. Private Sub Limpiar_Click()
  1180. Me.Caption = "Analizador PE by MALEK"
  1181. List1.Clear
  1182. End Sub
  1183.  
  1184. Private Sub Salir_Click()
  1185. Call ExitProcess(0&)
  1186. End Sub
  1187.  

--------------------------------- fin del code -------------------------------------

los tipos del directorio de recursos no los tengo todos y no he podido encontrarlos todos, ahi solo estan los basico.

cualquier suguerencia o comentario favor responder malektaus27A@gmail.com




« Última modificación: 30 Enero 2008, 21:28 pm por ||MadAntrax|| » En línea

~~
Ex-Staff
*
Desconectado Desconectado

Mensajes: 2.981


Ver Perfil WWW
Re: formato portable ejecutable
« Respuesta #1 en: 31 Enero 2008, 18:12 pm »

No lo probé, pero parece qrecoje un buen numero de datos, ta chulo ;)


En línea

Páginas: [1] Ir Arriba Respuesta Imprimir 

Ir a:  

Mensajes similares
Asunto Iniciado por Respuestas Vistas Último mensaje
(eBook) Formato portable ejecutable bajo windows
Ingeniería Inversa
m0rf 2 3,062 Último mensaje 5 Agosto 2011, 17:56 pm
por .:UND3R:.
Forma de hacer app en php portable (ejecutable).
PHP
Graphixx 1 7,095 Último mensaje 24 Diciembre 2011, 12:41 pm
por #!drvy
Injectar codigo en PE (Portable Ejecutable) « 1 2 »
Programación C/C++
70N1 11 5,799 Último mensaje 12 Octubre 2013, 15:04 pm
por 70N1
WAP2 - Aviso Legal - Powered by SMF 1.1.21 | SMF © 2006-2008, Simple Machines