pe中获得icon的大小,该如何解决
pe中获得icon的大小
image_resource_directory = new (IMAGE_RESOURCE_DIRECTORY);
firstAdd = new (IMAGE_RESOURCE_DIRECTORY);
dirSec = new (IMAGE_RESOURCE_DIRECTORY);
dirThird = new (IMAGE_RESOURCE_DIRECTORY);
entrySec = new (IMAGE_RESOURCE_DIRECTORY_ENTRY);
entryThird = new (IMAGE_RESOURCE_DIRECTORY_ENTRY);
entryData = new (IMAGE_RESOURCE_DATA_ENTRY);
DWORD dwOffset=RVA2Offset(image_nt_headers-> OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress);
image_resource_directory = (PIMAGE_RESOURCE_DIRECTORY)((char*)pMem + dwOffset);
image_resource_directory_entry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(image_resource_directory + sizeof(image_resource_directory));
for (i=0;i <image_resource_directory-> NumberOfIdEntries+image_resource_directory-> NumberOfNamedEntries;i++,image_resource_directory_entry ++)
{
if(image_resource_directory_entry-> Id==3)
if (image_resource_directory_entry-> OffsetToData&0x80000000)
{
image_resource_directory_entry-> OffsetToData&0x7fffffff;
dwOffset = RVA2Offset(image_resource_directory_entry-> OffsetToData);
dirSec = (PIMAGE_RESOURCE_DIRECTORY)(image_resource_directory + dwOffset);
entrySec = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(dirSec + sizeof(IMAGE_RESOURCE_DIRECTORY));
for(k=0;k <dirSec-> NumberOfIdEntries + dirSec-> NumberOfNamedEntries;k++,entrySec++)
{
if(entrySec-> OffsetToData&0x80000000)
entrySec-> OffsetToData&0x7fffffff;
dirThird = (PIMAGE_RESOURCE_DIRECTORY)(image_resource_directory + entrySec-> OffsetToData);
entryThird = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(dirThird + sizeof(IMAGE_RESOURCE_DIRECTORY));
dwOffset = RVA2Offset(entryThird-> OffsetToData);
entryData = (PIMAGE_RESOURCE_DATA_ENTRY)(image_resource_directory + dwOffset);
DWORD dwIconSize=entryData-> Size;
}
}
}
我的目的是得到pe中icon的地址,我打开一个exe文件后得到icon(entryData)的size是0,而这个文件是有icon的,为什么?
------解决方案--------------------
或许该文件不是十分符合PE规范
或者你的程序定位错了
image_resource_directory = new (IMAGE_RESOURCE_DIRECTORY);
firstAdd = new (IMAGE_RESOURCE_DIRECTORY);
dirSec = new (IMAGE_RESOURCE_DIRECTORY);
dirThird = new (IMAGE_RESOURCE_DIRECTORY);
entrySec = new (IMAGE_RESOURCE_DIRECTORY_ENTRY);
entryThird = new (IMAGE_RESOURCE_DIRECTORY_ENTRY);
entryData = new (IMAGE_RESOURCE_DATA_ENTRY);
DWORD dwOffset=RVA2Offset(image_nt_headers-> OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress);
image_resource_directory = (PIMAGE_RESOURCE_DIRECTORY)((char*)pMem + dwOffset);
image_resource_directory_entry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(image_resource_directory + sizeof(image_resource_directory));
for (i=0;i <image_resource_directory-> NumberOfIdEntries+image_resource_directory-> NumberOfNamedEntries;i++,image_resource_directory_entry ++)
{
if(image_resource_directory_entry-> Id==3)
if (image_resource_directory_entry-> OffsetToData&0x80000000)
{
image_resource_directory_entry-> OffsetToData&0x7fffffff;
dwOffset = RVA2Offset(image_resource_directory_entry-> OffsetToData);
dirSec = (PIMAGE_RESOURCE_DIRECTORY)(image_resource_directory + dwOffset);
entrySec = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(dirSec + sizeof(IMAGE_RESOURCE_DIRECTORY));
for(k=0;k <dirSec-> NumberOfIdEntries + dirSec-> NumberOfNamedEntries;k++,entrySec++)
{
if(entrySec-> OffsetToData&0x80000000)
entrySec-> OffsetToData&0x7fffffff;
dirThird = (PIMAGE_RESOURCE_DIRECTORY)(image_resource_directory + entrySec-> OffsetToData);
entryThird = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(dirThird + sizeof(IMAGE_RESOURCE_DIRECTORY));
dwOffset = RVA2Offset(entryThird-> OffsetToData);
entryData = (PIMAGE_RESOURCE_DATA_ENTRY)(image_resource_directory + dwOffset);
DWORD dwIconSize=entryData-> Size;
}
}
}
我的目的是得到pe中icon的地址,我打开一个exe文件后得到icon(entryData)的size是0,而这个文件是有icon的,为什么?
------解决方案--------------------
或许该文件不是十分符合PE规范
或者你的程序定位错了