滴水三期 资源表解析

void Resource()
{

int fileSize = 0;DWORD ResourceTableAddress = 0;
LPVOID pFileBuffer = NULL;
//将文件读取到缓冲区PIMAGE_DOS_HEADER pDosHeader = NULL;
PIMAGE_NT_HEADERS pNTHeader = NULL;
PIMAGE_FILE_HEADER pPEHeader = NULL;
PIMAGE_OPTIONAL_HEADER32 pOptionHeader = NULL;
PIMAGE_SECTION_HEADER pSectionHeader = NULL;PIMAGE_RESOURCE_DIRECTORY ResourceTable, ResourceTable_Buf, ResourceTable2, ResourceTable3 = NULL;//资源表fileSize = ReadPEFile(FilePath, &pFileBuffer);if (fileSize == 0)
{printf("ReadPEFile失败！！\n");
}//DOS头
pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;
//NT头
pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pFileBuffer + pDosHeader->e_lfanew);
//标准PE头
pPEHeader = (PIMAGE_FILE_HEADER)((DWORD)pNTHeader + 4);
//可选PE头
pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)((DWORD)pPEHeader + IMAGE_SIZEOF_FILE_HEADER);
//首个节表
pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pOptionHeader + pPEHeader->SizeOfOptionalHeader);ResourceTableAddress = RvaToFileOffset(pFileBuffer, pOptionHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress);ResourceTable = (PIMAGE_RESOURCE_DIRECTORY)((PBYTE)pFileBuffer + ResourceTableAddress);ResourceTable_Buf = ResourceTable;//备份DWORD ResourceNumber = ResourceTable->NumberOfIdEntries + ResourceTable->NumberOfNamedEntries;for (int i = 0; i < ResourceNumber; i++)
{PIMAGE_RESOURCE_DIRECTORY_ENTRY Data = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((PBYTE)ResourceTable + 0x10+ i * 0x08);if (!Data->NameIsString){printf("Data->Id: %d\n", Data->Id);}else{PIMAGE_RESOURCE_DIR_STRING_U pstcString = (PIMAGE_RESOURCE_DIR_STRING_U)((DWORD)ResourceTable_Buf + Data->NameOffset);WCHAR szStr[MAX_PATH] = { 0 };memcpy_s(szStr, MAX_PATH, pstcString->NameString, pstcString->Length * sizeof(WCHAR));printf("资源字符串: %ls\n", szStr);}//第二层ResourceTable2= (PIMAGE_RESOURCE_DIRECTORY)((PBYTE)ResourceTable_Buf + Data->OffsetToDirectory);DWORD Number2 = ResourceTable2->NumberOfIdEntries + ResourceTable2->NumberOfNamedEntries;printf("Number2->%d\n", Number2);for (int t = 0; t < Number2; t++){PIMAGE_RESOURCE_DIRECTORY_ENTRY Data2 = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((PBYTE)ResourceTable2 + 0x10 + t * 0x08);if (!Data2->NameIsString){printf("Data2->Id: %d\n", Data2->Id);}else{PIMAGE_RESOURCE_DIR_STRING_U pstcString = (PIMAGE_RESOURCE_DIR_STRING_U)((DWORD)ResourceTable_Buf + Data2->NameOffset);WCHAR szStr[MAX_PATH] = { 0 };memcpy_s(szStr, MAX_PATH, pstcString->NameString, pstcString->Length * sizeof(WCHAR));printf("资源字符串: %ls\n", szStr);}//第三层ResourceTable3 = (PIMAGE_RESOURCE_DIRECTORY)((PBYTE)ResourceTable_Buf + Data2->OffsetToDirectory);DWORD Number3 = ResourceTable3->NumberOfIdEntries + ResourceTable3->NumberOfNamedEntries;printf("Number3->%d\n", Number3);for (int C = 0; C < Number3; C++){PIMAGE_RESOURCE_DIRECTORY_ENTRY Data3 = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)((PBYTE)ResourceTable3 + 0x10 + C * 0x08);PIMAGE_DATA_DIRECTORY DATA_DIRE = (PIMAGE_DATA_DIRECTORY)((PBYTE)ResourceTable_Buf + Data3->OffsetToDirectory);printf("->->->数据RVA:%x\t数据大小:%x\n", DATA_DIRE->VirtualAddress, DATA_DIRE->Size);}}}

}