如何读取内存中的 AddressOfEntryPoint答案

【问题标题】：How to read AddressOfEntryPoint in memory如何读取内存中的 AddressOfEntryPoint
【发布时间】：2017-08-14 08:53:04
【问题描述】：

我正在分析恶意软件，该恶意软件尝试将新文件写入其他进程。他们将新文件的数据保存在以 MZ 开头的内存中。如何知道PE文件在内存中的入口地址？

【问题讨论】：

如果您可以提供更多详细信息，请在堆栈交换reverse engineering site 上提出此问题。几位专业的恶意软件分析师在那里回答恶意软件分析问题。我们希望有更多关于恶意软件的问题

标签： reverse-engineering malware ida

【解决方案1】：

找到下面的方法来找到入口点的地址以及读取各种头参数。

LPCSTR fileName; //exe file to parse
HANDLE hFile; 
HANDLE hFileMapping;
LPVOID lpFileBase;
PIMAGE_DOS_HEADER dosHeader;
PIMAGE_NT_HEADERS peHeader;

hFile = CreateFileA(fileName,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0);

if(hFile==INVALID_HANDLE_VALUE)
{
    printf("\n CreateFile failed in read mode \n");
    return 1;
}

hFileMapping = CreateFileMapping(hFile,NULL,PAGE_READONLY,0,0,NULL);

if(hFileMapping==0)
{
    printf("\n CreateFileMapping failed \n");
    CloseHandle(hFile);
    return 1;
}

lpFileBase = MapViewOfFile(hFileMapping,FILE_MAP_READ,0,0,0);

if(lpFileBase==0)
{
    printf("\n MapViewOfFile failed \n");
    CloseHandle(hFileMapping);
    CloseHandle(hFile);
    return 1;
}

dosHeader = (PIMAGE_DOS_HEADER) lpFileBase;  //pointer to dos headers

if(dosHeader->e_magic==IMAGE_DOS_SIGNATURE)
{
    //if it is executable file print different fileds of structure
    //dosHeader->e_lfanew : RVA for PE Header
    printf("\n DOS Signature (MZ) Matched");

    //pointer to PE/NT header
    peHeader = (PIMAGE_NT_HEADERS) ((u_char*)dosHeader+dosHeader->e_lfanew);

    if(peHeader->Signature==IMAGE_NT_SIGNATURE)
    {
        printf("\n PE Signature (PE) Matched \n");

        //address of entry point
        //peHeader->OptionalHeader.AddressOfEntryPoint

    }
    UnmapViewOfFile(lpFileBase);
    CloseHandle(hFileMapping);
    CloseHandle(hFile);
    return 0;
}
else
{
    printf("\n DOS Signature (MZ) Not Matched \n");
    UnmapViewOfFile(lpFileBase);
    CloseHandle(hFileMapping);
    CloseHandle(hFile);
    return 1;
}

【讨论】：