Warning: file_get_contents(/data/phpspider/zhask/data//catemap/0/windows/15.json): failed to open stream: No such file or directory in /data/phpspider/zhask/libs/function.php on line 167

Warning: Invalid argument supplied for foreach() in /data/phpspider/zhask/libs/tag.function.php on line 1116

Notice: Undefined index: in /data/phpspider/zhask/libs/function.php on line 180

Warning: array_chunk() expects parameter 1 to be array, null given in /data/phpspider/zhask/libs/function.php on line 181
Windows 阅读PE32+;第'节;原始数据_Windows_Portable Executable - Fatal编程技术网

Windows 阅读PE32+;第'节;原始数据

Windows 阅读PE32+;第'节;原始数据,windows,portable-executable,Windows,Portable Executable,我正在尝试读取x64 exe的.pdata部分。 我将文件映射到内存,查找.pdata节,然后使用它的指针或WDATA来获取节的实际数据… 但是我的“pdata”指针指向一个非法地址:( 我就是这么做的: void* mappingHandle = CreateFileMapping(fileHandle, NULL, PAGE_READONLY, 0,

我正在尝试读取x64 exe的.pdata部分。 我将文件映射到内存,查找.pdata节,然后使用它的指针或WDATA来获取节的实际数据…
但是我的“pdata”指针指向一个非法地址:(
我就是这么做的:

void* mappingHandle = CreateFileMapping(fileHandle,
                    NULL,
                    PAGE_READONLY,
                    0,
                    1,
                    NULL);
char* fileMemory  = (char*)MapViewOfFile(mappingHandle, FILE_MAP_READ, 0, 0, 1);
IMAGE_DOS_HEADER* dosHeader = (IMAGE_DOS_HEADER*)fileMemory;
IMAGE_SECTION_HEADER* pdataSectionHeader = NULL;
if (dosHeader->e_magic == IMAGE_DOS_SIGNATURE) // "MZ" signature
{
    IMAGE_NT_HEADERS* ntHeaders = (IMAGE_NT_HEADERS*)(fileMemory + dosHeader->e_lfanew);
    if (ntHeaders->Signature == IMAGE_NT_SIGNATURE) // Supposed to be "PE"
    {
        unsigned int sectionCount = ntHeaders->FileHeader.NumberOfSections; 
        IMAGE_SECTION_HEADER* sectionHeaders = IMAGE_FIRST_SECTION(ntHeaders);
        pdataSectionHeader = sectionHeaders + 3; // Going to .pdata section.
    }
}
unsigned long pdataSize = pdataSectionHeader->SizeOfRawData;
char* pdata = fileMemory + pdataSectionHeader->PointerToRawData; 

有人能告诉我我做错了什么吗?

问题在于我将文件映射到内存的方式。
我应该这样做:

void* mappingHandle = CreateFileMapping(fileHandle,
                    NULL,
                    PAGE_READONLY,
                    0,
                    0, //Here: 0 instead of 1
                    NULL);