一个PE查看器的外壳程序

最新推荐文章于 2024-06-26 15:04:49 发布

原创最新推荐文章于 2024-06-26 15:04:49 发布 · 154 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#青少年编程 #程序人生

这篇博客介绍了如何利用ASM汇编语言编写一个PE（Portable Executable）文件查看器。作者提供了源代码PEDump.asm和PEDump.rc，并且详细阐述了编译过程。文章末尾附有程序的截图，展示了程序的实际运行效果。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

PEDump.asm

.386
.model flat,stdcall
option casemap:none

include windows.inc
include user32.inc
includelib user32.lib
include kernel32.inc
includelib kernel32.lib
include comdlg32.inc
includelib comdlg32.lib


ICO_MAIN equ 1000
IDM_MAIN equ 10001
IDM_LOOK  equ 10004
IDD_MAIN equ 1000
IDC_INFO equ 1001
IDR_MENU1 equ 10000
IDM_OPEN equ 10002
IDM_EXIT equ 10003
IDM_ORI equ 10005

.data 
	hInstance dd ?
	hRichEdit dd ?
	hWinMain dd ?
	hWinEdit dd ?
	szFileName db MAX_PATH dup(?)
	
.const 
	szDllEdit db 'RichEd20.dll',0
	szClassEdit db 'RichEdit20A',0
	szFont db '宋体',0
	szTest db 'OPEN!',0
	
.code
	_init proc 
		
		;富文本编辑框需要使用的结构体:
		local @stCf:CHARFORMAT
		;获取富文本编辑框句柄
		invoke GetDlgItem,hWinMain,IDC_INFO
		mov hWinEdit,eax
		
		;设置图标
		invoke LoadIcon,hInstance,ICO_MAIN
		invoke SendMessage,hWinMain,WM_SETICON,ICON_BIG,eax
		
		;设置编辑控件
		invoke SendMessage,hWinEdit,EM_SETTEXTMODE,TM_PLAINTEXT,0
		invoke RtlZeroMemory,addr @stCf,sizeof @stCf
		mov @stCf.cbSize,sizeof @stCf
		mov @stCf.dwMask,CFM_FACE or CFM_SIZE or CFM_BOLD
		mov @stCf.yHeight,9*20
		invoke lstrcpy,addr @stCf.szFaceName,addr szFont
		invoke SendMessage,hWinEdit,EM_SETCHARFORMAT,0,addr @stCf
		invoke SendMessage,hWinEdit,EM_EXLIMITTEXT,0,-1
		ret
		
	_init endp
	
	;对话框过程
	_ProcDlgMain proc uses ebx esi edi hWnd,uMsg,wParam,lParam
		
		mov eax,uMsg
		.if eax == WM_CLOSE
			invoke EndDialog,hWnd,NULL
		
		.elseif eax == WM_INITDIALOG
			push hWnd
			pop hWinMain
			call _init
		
		.elseif eax == WM_COMMAND
			mov eax,wParam
			.if ax == IDM_EXIT
				invoke EndDialog,hWnd,NULL
			.elseif ax == IDM_OPEN
				invoke MessageBox,hWnd,offset szTest,offset szTest,0
			.endif
			
		.else
			mov eax,FALSE
			ret	
		.endif
		mov eax,TRUE
		ret
		
	_ProcDlgMain endp
	
	start:
		
		invoke LoadLibrary,addr szDllEdit
		mov hRichEdit,eax
		invoke GetModuleHandle,NULL
		mov hInstance,eax
		invoke DialogBoxParam,hInstance,IDD_MAIN,NULL,offset _ProcDlgMain,NULL
		invoke FreeLibrary,hRichEdit
		invoke ExitProcess,0
		
	end start

PEDump.rc

#define IDM_MAIN 10001
#define IDM_LOOK 10004
#define ICO_MAIN 1000
#define IDD_MAIN 1000
#define IDC_INFO 1001
#define IDR_MENU1 10000
#define IDM_OPEN 10002
#define IDM_EXIT 10003
#define IDM_ORI 10005

ICO_MAIN ICON DISCARDABLE "main.ico"

IDD_MAIN DIALOGEX 10,10,726,327
CAPTION "PE基本信息by凉x"
FONT 8,"MS Sans Serif",0,0,0
MENU IDR_MENU1
STYLE 0x10CF0000
BEGIN
  CONTROL "",IDC_INFO,"RichEdit20A",0x50010000,0,0,726,327,0x00000200
END

IDR_MENU1 MENU
BEGIN
  POPUP "file"
  BEGIN
    MENUITEM "openFile",IDM_OPEN
    MENUITEM "exit",IDM_EXIT
  END
  POPUP "look"
  BEGIN
    MENUITEM "ori",IDM_ORI
  END
END

编译命令：

ml /c /coff PEDump.asm
rc PEDump.rc
link /subsystem:windows PEDump.obj PEDump.res

程序截图：
在这里插入图片描述