................
PIMAGE_SECTION_HEADER pSectionHeader;
char szName[IMAGE_SIZEOF_SHORT_NAME+1];
RtlZeroMemory(szName,IMAGE_SIZEOF_SHORT_NAME+1);
RtlZeroMemory(buffer,IMAGE_SIZEOF_SHORT_NAME+1); DWORD NumberOfSections=pNtHeader->FileHeader.NumberOfSections;
LPVOID pSectionBegin=(BYTE*)pAddr+pNtHeader->OptionalHeader.SizeOfHeaders;
for(DWORD i=0;i<NumberOfSections;i++)
{
pSectionHeader=(PIMAGE_SECTION_HEADER)((BYTE*)pSectionBegin+i*sizeof IMAGE_SECTION_HEADER);
CopyMemory(szName,pSectionHeader->Name,IMAGE_SIZEOF_SHORT_NAME);
TRACE(szName);
RtlZeroMemory(szName,IMAGE_SIZEOF_SHORT_NAME+1);
RtlZeroMemory(buffer,IMAGE_SIZEOF_SHORT_NAME+1); }
...............
代码如上,我取得的PE SECTION的名称是乱码,而不是“.text”等规则的字符串
该怎么转化呢?
谢谢
PIMAGE_SECTION_HEADER pSectionHeader;
char szName[IMAGE_SIZEOF_SHORT_NAME+1];
RtlZeroMemory(szName,IMAGE_SIZEOF_SHORT_NAME+1);
RtlZeroMemory(buffer,IMAGE_SIZEOF_SHORT_NAME+1); DWORD NumberOfSections=pNtHeader->FileHeader.NumberOfSections;
LPVOID pSectionBegin=(BYTE*)pAddr+pNtHeader->OptionalHeader.SizeOfHeaders;
for(DWORD i=0;i<NumberOfSections;i++)
{
pSectionHeader=(PIMAGE_SECTION_HEADER)((BYTE*)pSectionBegin+i*sizeof IMAGE_SECTION_HEADER);
CopyMemory(szName,pSectionHeader->Name,IMAGE_SIZEOF_SHORT_NAME);
TRACE(szName);
RtlZeroMemory(szName,IMAGE_SIZEOF_SHORT_NAME+1);
RtlZeroMemory(buffer,IMAGE_SIZEOF_SHORT_NAME+1); }
...............
代码如上,我取得的PE SECTION的名称是乱码,而不是“.text”等规则的字符串
该怎么转化呢?
谢谢
但是我改成这样还是不行。
如下,怎么办?
PIMAGE_SECTION_HEADER pSectionHeader;
char szName[IMAGE_SIZEOF_SHORT_NAME+1];
RtlZeroMemory(szName,IMAGE_SIZEOF_SHORT_NAME+1); DWORD NumberOfSections=pNtHeader->FileHeader.NumberOfSections;
LPVOID pSectionBegin=pNtHeader+sizeof IMAGE_NT_HEADERS;//(BYTE*)pAddr+pNtHeader->OptionalHeader.SizeOfHeaders;
pSectionHeader=(PIMAGE_SECTION_HEADER)pSectionBegin;
for(DWORD i=0;i<NumberOfSections;i++)
{
CopyMemory(szName,pSectionHeader->Name,IMAGE_SIZEOF_SHORT_NAME);
TRACE(szName);
RtlZeroMemory(szName,IMAGE_SIZEOF_SHORT_NAME+1);
pSectionHeader+=sizeof IMAGE_SECTION_HEADER; }