Просматриваем заголовок исполняемого файла

 
В Интернете можно найти достаточное количество информации о формате исполняемых файлов.
В данном примере мне хотелось бы показать Вам как можно получить данные из заголовка.
Для примера нужно создать консольное приложение, вот собственно код: 

#include <iostream>
#include <windows.h>
#include <conio.h>
using namespace std;

#define NTSIGNATURE(a) ((LPVOID)((BYTE *)a + ((PIMAGE_DOS_HEADER)a)->e_lfanew))

int main()
{
 HANDLE hStd = GetStdHandle(STD_OUTPUT_HANDLE);SetConsoleTitle("[ViewHeader] Code by Lazy_elf");
 HMODULE hMod = GetModuleHandle(NULL);
 if(hMod)
 {
 SetConsoleTextAttribute(hStd,FOREGROUND_INTENSITY|FOREGROUND_RED|FOREGROUND_GREEN|FOREGROUND_BLUE);
 //_IMAGE_DOS_HEADER
 cout<<"---------------------------\n"<<"_IMAGE_DOS_HEADER:"<<endl<<"---------------------------"<<endl;
 SetConsoleTextAttribute(hStd,FOREGROUND_RED|FOREGROUND_GREEN|FOREGROUND_BLUE);
 PIMAGE_DOS_HEADER pDH = (PIMAGE_DOS_HEADER)hMod;
 cout<<"Magic number "<<hex<<pDH->e_magic;
if(pDH->e_magic == IMAGE_DOS_SIGNATURE){cout<<"(MZ)"<<endl;}else{cout<<"(not MZ)"<<endl;}
 cout<<"Bytes on last page of file "<<pDH->e_cblp<<endl;
 cout<<"Pages in file "<<pDH->e_cp<<endl;
 cout<<"Relocations "<<pDH->e_crlc<<endl;
 cout<<"Size of header in paragraphs "<<pDH->e_cparhdr<<endl;
 cout<<"Minimum extra paragraphs needed "<<pDH->e_minalloc<<endl;
 cout<<"Maximum extra paragraphs needed "<<pDH->e_maxalloc<<endl;
 cout<<"Initial (relative) SS value "<<pDH->e_ss<<endl;
 cout<<"Initial SP value "<<pDH->e_sp<<endl;
 cout<<"Checksum "<<pDH->e_csum<<endl;
 cout<<"Initial IP value "<<pDH->e_ip<<endl;
 cout<<"Initial (relative) CS value "<<pDH->e_cs<<endl;
 cout<<"File address of relocation table "<<pDH->e_lfarlc<<endl;
 cout<<"Overlay number "<<pDH->e_ovno<<endl;
 cout<<"Reserved words "<<pDH->e_res<<endl;
 cout<<"OEM identifier (for e_oeminfo) "<<pDH->e_oemid<<endl;
 cout<<"OEM information "<<pDH->e_oeminfo<<endl;
 cout<<"Reserved words "<<pDH->e_res2<<endl;
 cout<<"File address of new exe header "<<pDH->e_lfanew<<endl;
 //_IMAGE_NT_HEADERS
 SetConsoleTextAttribute(hStd,FOREGROUND_INTENSITY|FOREGROUND_RED|FOREGROUND_GREEN|FOREGROUND_BLUE);
 cout<<"---------------------------\n"<<"_IMAGE_NT_HEADERS:"<<endl<<"---------------------------"<<endl;
 SetConsoleTextAttribute(hStd,FOREGROUND_RED|FOREGROUND_GREEN|FOREGROUND_BLUE);
 PIMAGE_NT_HEADERS pPEH = (PIMAGE_NT_HEADERS)NTSIGNATURE(pDH);
 cout<<"Signature "<<pPEH->Signature;
if(pPEH->Signature == IMAGE_NT_SIGNATURE){cout<<"(PE)"<<endl;}else{cout<<"(not PE)"<<endl;}
 IMAGE_FILE_HEADER iFH =(IMAGE_FILE_HEADER)pPEH->FileHeader;
 cout<<"Machine "<<hex<<iFH.Machine<<endl;
 cout<<"NumberOfSections "<<iFH.NumberOfSections<<endl;
 cout<<"TimeDateStamp "<<iFH.TimeDateStamp<<endl;
 cout<<"PointerToSymbolTable "<<iFH.PointerToSymbolTable<<endl;
 cout<<"NumberOfSymbols "<<iFH.NumberOfSymbols<<endl;
 cout<<"SizeOfOptionalHeader "<<iFH.SizeOfOptionalHeader<<endl;
 cout<<"Characteristics "<<iFH.Characteristics<<endl;
 //_IMAGE_OPTIONAL_HEADER
 SetConsoleTextAttribute(hStd,FOREGROUND_INTENSITY|FOREGROUND_RED|FOREGROUND_GREEN|FOREGROUND_BLUE);
 IMAGE_OPTIONAL_HEADER32 iOH = (IMAGE_OPTIONAL_HEADER32)pPEH->OptionalHeader; 
 cout<<"---------------------------\n"<<"_IMAGE_OPTIONAL_HEADER:"<<endl<<"---------------------------"<<endl;
 SetConsoleTextAttribute(hStd,FOREGROUND_INTENSITY|FOREGROUND_GREEN);
 cout<<"// Standard fields."<<endl;
 SetConsoleTextAttribute(hStd,FOREGROUND_RED|FOREGROUND_GREEN|FOREGROUND_BLUE);
 cout<<"Magic "<<iOH.Magic<<endl;
 cout<<"Major.Minor(LinkerVersion) "<<dec<<(int)iOH.MajorLinkerVersion<<"."<<(int)iOH.MinorLinkerVersion<<endl;
 cout<<"SizeOfCode "<<hex<<iOH.SizeOfCode<<endl;
 cout<<"SizeOfInitializedData "<<iOH.SizeOfInitializedData<<endl;
 cout<<"SizeOfUninitializedData "<<iOH.SizeOfUninitializedData<<endl;
 cout<<"AddressOfEntryPoint "<<iOH.AddressOfEntryPoint<<endl;
 cout<<"BaseOfCode "<<iOH.BaseOfCode<<endl;
 cout<<"BaseOfData "<<iOH.BaseOfData<<endl;
 SetConsoleTextAttribute(hStd,FOREGROUND_INTENSITY|FOREGROUND_GREEN);
 cout<<"// NT additional fields."<<endl;
 SetConsoleTextAttribute(hStd,FOREGROUND_RED|FOREGROUND_GREEN|FOREGROUND_BLUE);
 cout<<"ImageBase "<<iOH.ImageBase<<endl;
 cout<<"SectionAlignment "<<iOH.SectionAlignment<<endl;
 cout<<"FileAlignment "<<iOH.FileAlignment<<endl;
 cout<<"Major.Minor(OS Version) "<<iOH.MajorOperatingSystemVersion<<"."<<iOH.MinorOperatingSystemVersion<<endl;
 cout<<"Major.Minor(ImageVersion) "<<iOH.MajorImageVersion<<"."<<iOH.MinorImageVersion<<endl;
 cout<<"Major.Minor(SubsystemVersion) "<<iOH.MajorSubsystemVersion<<"."<<iOH.MinorSubsystemVersion<<endl;
 cout<<"Win32VersionValue "<<iOH.Win32VersionValue<<endl;
 cout<<"SizeOfImage "<<iOH.SizeOfImage<<endl;
 cout<<"SizeOfHeaders "<<iOH.SizeOfHeaders<<endl;
 cout<<"CheckSum "<<iOH.CheckSum<<endl;
 cout<<"Subsystem "<<iOH.Subsystem<<endl;
 cout<<"DllCharacteristics "<<iOH.DllCharacteristics<<endl;
 cout<<"SizeOfStackReserve "<<iOH.SizeOfStackReserve<<endl;
 cout<<"SizeOfStackCommit "<<iOH.SizeOfStackCommit<<endl;
 cout<<"SizeOfHeapReserve "<<iOH.SizeOfHeapReserve<<endl;
 cout<<"SizeOfHeapCommit "<<iOH.SizeOfHeapCommit<<endl;
 cout<<"LoaderFlags "<<iOH.LoaderFlags<<endl;
 cout<<"NumberOfRvaAndSizes "<<iOH.NumberOfRvaAndSizes<<endl;
 //_IMAGE_DATA_DIRECTORY
 for(int i=0;i<=14;i++){
 SetConsoleTextAttribute(hStd,FOREGROUND_INTENSITY|FOREGROUND_GREEN);
 if(i==0){cout<<"[IMAGE_DIRECTORY_ENTRY_EXPORT] ";}
 if(i==1){cout<<"[IMAGE_DIRECTORY_ENTRY_IMPORT] ";}
 if(i==2){cout<<"[IMAGE_DIRECTORY_ENTRY_RESOURCE] ";}
 if(i==3){cout<<"[IMAGE_DIRECTORY_ENTRY_EXCEPTION] ";}
 if(i==4){cout<<"[IMAGE_DIRECTORY_ENTRY_SECURITY] ";}
 if(i==5){cout<<"[IMAGE_DIRECTORY_ENTRY_BASERELOC] ";}
 if(i==6){cout<<"[IMAGE_DIRECTORY_ENTRY_DEBUG] ";}
 if(i==7){cout<<"[IMAGE_DIRECTORY_ENTRY_ARCHITECTURE] ";}
 if(i==8){cout<<"[IMAGE_DIRECTORY_ENTRY_GLOBALPTR] ";}
 if(i==9){cout<<"[IMAGE_DIRECTORY_ENTRY_TLS] ";}
 if(i==10){cout<<"[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG] ";}
 if(i==11){cout<<"[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT] ";}
 if(i==12){cout<<"[IMAGE_DIRECTORY_ENTRY_IAT] ";}
 if(i==13){cout<<"[IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT] ";}
 if(i==14){cout<<"[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR]";}
 SetConsoleTextAttribute(hStd,FOREGROUND_RED|FOREGROUND_GREEN|FOREGROUND_BLUE);
 cout<<"[VirtualAddress|Size] "<<"["<<iOH.DataDirectory[i].VirtualAddress<<"|"<<iOH.DataDirectory[i].Size<<"]"<<endl;}
 }else{cout<<"Error load module..."<<endl;}
 FreeLibrary(hMod);

 cout<<"\nPress any key to continue"<<endl;
 while (!getch());
 return 0;
}