ICO资源提取

阿杰

1. DWORD GetRawOfFile(char *pImage, DWORD dwRVA)
   
2. {
   
3. PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER )pImage;
   
4. PIMAGE_NT_HEADERS pNtHeads = (PIMAGE_NT_HEADERS)((DWORD)pDos + pDos->e_lfanew);
   
5. 
   
6. DWORD NumOfSection = pNtHeads->FileHeader.NumberOfSections;
   
7. PIMAGE_SECTION_HEADER pSectionHead = (PIMAGE_SECTION_HEADER )(sizeof(IMAGE_FILE_HEADER) + 4 + pNtHeads->FileHeader.SizeOfOptionalHeader + (DWORD)pNtHeads);
   
8. DWORD RawOfEntryPoint = 0;
   
9. DWORD RawinSection = 0;
   
10. WORD count=0;
    
11. while(count<NumOfSection)
    
12. {
    
13. if((dwRVA >= pSectionHead->VirtualAddress)
    
14. &&(dwRVA < pSectionHead->VirtualAddress+pSectionHead->Misc.VirtualSize))
    
15. {
    
16. RawinSection=dwRVA-pSectionHead->VirtualAddress;
    
17. RawOfEntryPoint=pSectionHead->PointerToRawData+RawinSection;
    
18. break;
    
19. }
    
20. pSectionHead++;
    
21. count++;
    
22. }
    
23. 
    
24. if (RawOfEntryPoint == 0)
    
25. {
    
26. ::MessageBox(NULL, "PE file is a error file", NULL, NULL);
    
27. return 0;
    
28. }
    
29. return RawOfEntryPoint;
    
30. 
    
31. }
    
32. 
    
33. 
    
34. //2字节对齐
    
35. #pragma pack (2)
    
36. 
    
37. typedef struct _ICONDIRENTRY
    
38. {
    
39. BYTE bWidth; //宽 16或32
    
40. BYTE bHeight; //高 16或32
    
41. BYTE bColorCount; //Number of colors in image (0 if >=8bpp)
    
42. BYTE bReserved; //保留，必须是0
    
43. WORD wPlanes; //图片的位面数
    
44. WORD wBitCount; //每个象素的位数
    
45. DWORD dwBytesInRes; //图像字节长度
    
46. DWORD dwImageOffset; //图像文件偏移
    
47. } ICONDIRENTRY;
    
48. //ICON文件头，22字节
    
49. 
    
50. typedef struct _ICONDIR
    
51. {
    
52. WORD idReserved; //保留，必须是00 00
    
53. WORD idType; //文件类型，1表示icon即01 00
    
54. WORD idCount; //图片个数，1个即01 00
    
55. 
    
56. //in fact data blow is a struct named ICONDIRENTRY
    
57. BYTE bWidth; //宽 16或32
    
58. BYTE bHeight; //高 16或32
    
59. BYTE bColorCount; //Number of colors in image (0 if >=8bpp)
    
60. BYTE bReserved; //保留，必须是0
    
61. WORD wPlanes; //图片的位面数
    
62. WORD wBitCount; //每个象素的位数
    
63. DWORD dwBytesInRes; //图像字节长度
    
64. DWORD dwImageOffset; //图像文件偏移
    
65. } ICONDIR;
    
66. 
    
67. 
    
68. void CGetICODlg::OnOK()
    
69. {
    
70. HANDLE hFile = ::CreateFile("a.exe", GENERIC_READ, NULL, NULL, OPEN_EXISTING, NULL, NULL);
    
71. if (hFile == INVALID_HANDLE_VALUE)
    
72. {
    
73. AfxMessageBox("Open error");
    
74. return ;
    
75. }
    
76. DWORD dwFileSize = ::GetFileSize(hFile, NULL);
    
77. if (dwFileSize == 0)
    
78. {
    
79. AfxMessageBox("Error file!");
    
80. return ;
    
81. }
    
82. char *pImage = new char[dwFileSize];
    
83. if (pImage == NULL)
    
84. {
    
85. return ;
    
86. }
    
87. memset(pImage, 0, dwFileSize);
    
88. DWORD dwBeRead = 0;
    
89. ReadFile(hFile, pImage, dwFileSize, &dwBeRead, NULL);
    
90. if (dwBeRead != dwFileSize)
    
91. {
    
92. AfxMessageBox("Read Error!");
    
93. return ;
    
94. }
    
95. 
    
96. PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER )pImage;
    
97. PIMAGE_NT_HEADERS pNtHeads = (PIMAGE_NT_HEADERS)((DWORD)pDos + pDos->e_lfanew);
    
98. 
    
99. if (pDos->e_magic != 0x5A4d)
    
100. {
     
101. return ;
     
102. }
     
103. if (pNtHeads->Signature != 0x00004550)
     
104. {
     
105. return ;
     
106. }
     
107. 
     
108. 
     
109. //DataDirectory的第二项是资源表
     
110. if ( pNtHeads->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress == 0 &&
     
111. pNtHeads->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].Size == 0 )
     
112. {//资源表为空
     
113. return;
     
114. }
     
115. 
     
116. //资源开始的RVA
     
117. DWORD dwOffset = GetRawOfFile(pImage, pNtHeads->OptionalHeader.DataDirectory[2].VirtualAddress);
     
118. 
     
119. PIMAGE_RESOURCE_DIRECTORY pFirstDir = (PIMAGE_RESOURCE_DIRECTORY )(dwOffset + pImage);
     
120. PIMAGE_RESOURCE_DIRECTORY_ENTRY pFirstDirEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY )(pFirstDir + 1);
     
121. 
     
122. PIMAGE_RESOURCE_DIRECTORY pSecondDir = NULL;
     
123. PIMAGE_RESOURCE_DIRECTORY_ENTRY pSecondDirEntry = NULL;
     
124. 
     
125. PIMAGE_RESOURCE_DIRECTORY pThirdDir = NULL;
     
126. PIMAGE_RESOURCE_DIRECTORY_ENTRY pThirdDirEntry = NULL;
     
127. 
     
128. PIMAGE_RESOURCE_DIRECTORY_ENTRY pTempDirEntry = NULL;
     
129. PIMAGE_RESOURCE_DATA_ENTRY pSourceData = NULL;
     
130. UINT uNum1 = pFirstDir->NumberOfIdEntries + pFirstDir->NumberOfNamedEntries ;
     
131. //第一层
     
132. for (UINT i=0 ;i<uNum1; i++)
     
133. {
     
134. pTempDirEntry = pFirstDirEntry + i;
     
135. if (pTempDirEntry->Id != 3)
     
136. {
     
137. continue;
     
138. }
     
139. //id == 3 图标资源
     
140. pSecondDir = (PIMAGE_RESOURCE_DIRECTORY)(pTempDirEntry->OffsetToDirectory + (DWORD)pFirstDir);
     
141. pSecondDirEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(pSecondDir + 1);
     
142. UINT uNum2 = pSecondDir->NumberOfIdEntries + pSecondDir->NumberOfNamedEntries;
     
143. //第二层
     
144. for (UINT j=0; j<uNum2; j++)
     
145. {
     
146. pTempDirEntry = pSecondDirEntry + j;
     
147. if (pTempDirEntry->DataIsDirectory == 0x01)
     
148. {//第三层
     
149. pThirdDir = (PIMAGE_RESOURCE_DIRECTORY)(pTempDirEntry->OffsetToDirectory + (DWORD)pFirstDir);
     
150. pThirdDirEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(pThirdDir + 1);
     
151. ASSERT(pThirdDir->NumberOfIdEntries + pThirdDir->NumberOfNamedEntries == 1);
     
152. pSourceData = (PIMAGE_RESOURCE_DATA_ENTRY)(pThirdDirEntry->OffsetToDirectory + (DWORD)pFirstDir);
     
153. char szText[100] = {0};
     
154. sprintf(szText, "RVA:%.8X FileOffset:%.8X Size:%.8X", pSourceData->OffsetToData, GetRawOfFile(pImage, pSourceData->OffsetToData), pSourceData->Size);
     
155. m_list.AddString(szText);
     
156. static int iName = 0;
     
157. sprintf(szText, "ICOFILE_%d.ico", ++iName);
     
158. HANDLE hFileico = ::CreateFile(szText, GENERIC_WRITE, NULL, NULL, CREATE_ALWAYS, NULL, NULL);
     
159. if (hFile == INVALID_HANDLE_VALUE)
     
160. {
     
161. ::MessageBox(NULL, "Open error", NULL, NULL);
     
162. return ;
     
163. }
     
164. ICONDIR tempiCon;
     
165. tempiCon.idReserved = 0;
     
166. tempiCon.idCount = 1;
     
167. tempiCon.idType = 1;
     
168. tempiCon.bWidth = 0x10;
     
169. tempiCon.bHeight = 0x10;
     
170. tempiCon.wPlanes = 0x0010;
     
171. tempiCon.dwImageOffset = 22;
     
172. tempiCon.dwBytesInRes = pSourceData->Size;
     
173. 
     
174. DWORD dwWrite = 0;
     
175. WriteFile(hFileico, &tempiCon, sizeof(tempiCon), &dwWrite, NULL);
     
176. if (dwWrite != sizeof(tempiCon))
     
177. {
     
178. ::MessageBox(NULL, "write error", NULL, NULL);
     
179. return ;
     
180. }
     
181. 
     
182. WriteFile(hFileico, (void *)(GetRawOfFile(pImage, pSourceData->OffsetToData) + (DWORD)pImage), pSourceData->Size, &dwWrite, NULL);
     
183. if (dwWrite != pSourceData->Size)
     
184. {
     
185. ::MessageBox(NULL, "write error", NULL, NULL);
     
186. return ;
     
187. }
     
188. CloseHandle(hFileico);
     
189. }
     
190. }
     
191. 
     
192. }
     
193. CloseHandle(hFile);
     
194. }

复制代码