Search code examples
winapiexecutableexeportable-executable

Unexpected output

The following code is supposed to print out the names of all the sections in the specified exe (c:\linked list.exe in this case), but it produces some bizarre output.

#include<iostream>
#include<Windows.h>
#include<stdio.h>
#include<WinNT.h>

int main()
{
    FILE *fp; 
    int i;

    if((fp = fopen("c:\\Linked List.exe","rb"))==NULL)
        std::cout<<"unable to open";


    IMAGE_DOS_HEADER imdh;
    fread(&imdh,sizeof(imdh),1,fp);


    IMAGE_NT_HEADERS imnth;
    fread(&imnth,sizeof(imnth),1,fp);

    IMAGE_SECTION_HEADER *pimsh;
    pimsh = (IMAGE_SECTION_HEADER *)malloc(sizeof(IMAGE_SECTION_HEADER) * imnth.FileHeader.NumberOfSections);

    fread(pimsh,sizeof(IMAGE_SECTION_HEADER),imnth.FileHeader.NumberOfSections,fp);

    for(i=0;i<imnth.FileHeader.NumberOfSections;i++)
    {
        printf("%s\n",pimsh->Name);
        pimsh++;
    }

}
Solution

  • the issue with you code, is which you are not reading for the correct location the IMAGE_NT_HEADERS struture, you must set the offset of the file to the value of imdh.e_lfanew using fseek(fp, imdh.e_lfanew, 0); and then read the IMAGE_NT_HEADERS record.

    Try this modified code.

    #include "stdafx.h"
#include<iostream>
#include<Windows.h>
#include<stdio.h>
#include<WinNT.h>

int main()
{
    FILE *fp; 
    int i;

    if((fp = fopen("c:\\Linked List.exe","rb"))==NULL)
        std::cout<<"unable to open";

    IMAGE_DOS_HEADER imdh;
    fread(&imdh,sizeof(imdh),1,fp);

    //set the pointer of the file to the location of the IMAGE_NT_HEADERS record
    fseek(fp, imdh.e_lfanew, 0);
    IMAGE_NT_HEADERS imnth;
    fread(&imnth,sizeof(imnth),1,fp);

    IMAGE_SECTION_HEADER *pimsh;
    pimsh = (IMAGE_SECTION_HEADER *)malloc(sizeof(IMAGE_SECTION_HEADER) * imnth.FileHeader.NumberOfSections);

    fread(pimsh,sizeof(IMAGE_SECTION_HEADER),imnth.FileHeader.NumberOfSections,fp);

    for(i=0;i<imnth.FileHeader.NumberOfSections;i++)
    {
        printf("%s\n",pimsh->Name);
        pimsh++;
    }

    getchar();
}

    Also take a look to these articles about the PE Format.