PE (Portable Executable) file reading in C

In summary, to search for a specific string in a PE file using C, you can use the Windows API functions EnumSections, MapViewOfFile, ReadProcessMemory, and FindString. These functions allow you to iterate through the sections of a PE file and search for the string in sections with the "executable" flag. However, these functions may not be available on other platforms and alternative methods may need to be used.
  • #1
anonim
40
2
TL;DR Summary
I try to find string in PE file.
I need to read PE file. I need to search word in PE file. Search is required to cover only the sections with the “executable” flag. And I need to specify the section where the word found. How can I do this in C? I hope you can help me. And I cannot use 3rd party libraries. This is my task and this is the rule..
I mean a searching sting in sections with the "executable" flags. I do not want to search string in non executable parts.
 
Technology news on Phys.org
  • #2
The best way to do this in C is by using the Windows API. The Windows API provides you with a set of functions that allow you to read and parse Portable Executable (PE) files. Specifically, you can use the following functions:

• EnumSections: This function allows you to enumerate the sections of a PE file. You can use this to get the list of sections along with their flags.
• MapViewOfFile: This function allows you to map a view of a PE file into memory. This view can then be used to access the data within the PE file.
• ReadProcessMemory: This function allows you to read data from a process' memory. This can be used to access the data within sections of the PE file.
• FindString: This function allows you to search for a given string within a memory block.

Using these functions, you can iterate through the sections of a PE file and search each one for the desired string. If the string is found in a section with the "executable" flag, you can then mark the section as containing the searched string.

It should be noted that while these functions are available in the Windows API, they may not always be available on other platforms. In this case, you may need to use a different set of functions or libraries to read and parse PE files.
 

Related to PE (Portable Executable) file reading in C

1. What is a PE (Portable Executable) file?

A PE file is a file format used in Windows operating systems to store executable code, data, and resources. It is the standard file format for executables, DLLs, and other Windows system files.

2. How do I read a PE file in C?

To read a PE file in C, you can use the Windows API functions provided by the operating system. These functions include CreateFile, ReadFile, SetFilePointer, and CloseHandle. These functions allow you to open the PE file, read its contents, and manipulate its structure.

3. What information can I extract from a PE file?

A PE file contains various information, including the entry point address, import and export tables, resource data, and relocation data. You can also extract information about the file's sections, such as their names, sizes, and characteristics. Additionally, you can retrieve the file's header information, including the machine type, number of sections, and timestamp.

4. How can I parse a PE file's structure in C?

In C, you can use the IMAGE_NT_HEADERS structure to parse a PE file's structure. This structure contains information about the file's header, optional header, and section headers. By accessing the members of this structure, you can navigate through the file's structure and extract the necessary information.

5. Can I modify a PE file using C?

Yes, you can modify a PE file using C. By using the Windows API functions mentioned earlier, you can access and manipulate the file's structure and contents. However, it is essential to be cautious when making modifications to a PE file, as it can potentially cause the file to be corrupted or unable to run properly.

Similar threads

  • Programming and Computer Science
Replies
2
Views
482
  • Programming and Computer Science
Replies
29
Views
2K
  • Programming and Computer Science
Replies
6
Views
1K
Replies
6
Views
1K
  • Programming and Computer Science
Replies
4
Views
776
  • Programming and Computer Science
Replies
14
Views
4K
  • Programming and Computer Science
Replies
1
Views
3K
  • Programming and Computer Science
Replies
3
Views
917
  • Programming and Computer Science
Replies
3
Views
1K
  • Programming and Computer Science
Replies
5
Views
1K
Back
Top