php解析exe文件--exeinfo.php

ywg

　　pe_viewer.class.php
　　<?/*** PE_VIEWER** 获取exe文件信息*** @version    ExeInfo.php,v 1.0 2008/04/1 04:39:03 $** exsample:* $file = "cmd.exe";* $pe = new PE_VIEWER( $file );* $pe->out();**/define("IMAGE_NUMBEROF_DIRECTORY_ENTRIES",16);class PE_VIEWER {private     $fileName;private     $cliMode;/***文件指针*/private     $fp;/***DOS Header*/private     $dosHeader;/***Nt eader*/private     $ntHeaders;private     $ntHeadersOffset;/***Option Header*/private     $optHeader;private     $optHeaderOffset;private     $fileHeader;private     $fileHeaderOffset;private     $section;private     $sectionOffset;private     $dataDirectory;private     $dataDirectoryOffset;function __construct( $fileName ) {isset( $fileName ) || die( "文件名不能为空" );$this->cliMode = ( substr( php_sapi_name( ), 0, 3 ) == 'cli' ) ? true : false;if ( file_exists( $fileName ) ) {$this->fileName = $fileName;} else {$paths = explode( PATH_SEPARATOR , ($this->cliMode) ? $_SERVER['Path'] : $_SERVER['PATH'] );array_push( $paths, dirname(__FILE__));foreach ( $paths as $key => $path ) {if ( file_exists( $path. DIRECTORY_SEPARATOR . $fileName ) ) {$this->fileName = $path. DIRECTORY_SEPARATOR . $fileName;break;}}isset( $this->fileName) or die( "指定的文件名无效" );}$this->fp = fopen( $this->fileName, 'rb' );$this->initial( );}function    __destruct( ) {if(is_resource( $this->fp ) )fclose( $this->fp );}private function    initial( ) {is_resource( $this->fp ) || die("无效文件句柄");$this->dosHeader["e_magic"] = $this->getChar( 2 );$this->moveTo( 0x3C );$this->dosHeader["e_lfanew"] = $this->getDword( );$this->ntHeadersOffset = $this->dosHeader["e_lfanew"];$this->fileHeaderOffset = $this->ntHeadersOffset + 4;$this->optHeaderOffset = $this->fileHeaderOffset + 20;$this->dataDirectoryOffset = $this->optHeaderOffset + 0x60;$this->moveTo( $this->fileHeaderOffset + 16);$this->sectionOffset = $this->optHeaderOffset + $this->getWord();}private function    moveTo( $offset ) {fseek( $this->fp, $offset, SEEK_SET );}private function    moveFromCur( $offset ) {fseek( $this->fp, $offset, SEEK_CUR );}private function    getWord( ) {$data = unpack( "S", fread( $this->fp, 2 ) );return $data[1];}private function    getDword( ) {$data = unpack( "i", fread( $this->fp, 4 ) );return $data[1];}private function    getByte( ) {$data = unpack( "c", fread( $this->fp, 1 ) );return $data[1];}private function    getChar( $length = 1 ) {return fread( $this->fp, $length );}public function    getDosHeader() {return $this->dosHeader;}public function    getFileHeader( $return=true ) {$this->moveTo( $this->fileHeaderOffset );$this->fileHeader["Machion"] = $this->getWord();$this->fileHeader["NumberOfSections"] = $this->getWord();$this->fileHeader["TimeDateStamp"] = $this->getDword();$this->fileHeader["PointerToSymbolTable"] = $this->getDword();$this->fileHeader["NumberOfSymbols"] = $this->getDword();$this->fileHeader["SizeOfOptionalHeader"] = $this->getWord();$this->fileHeader["Characteristics"] = $this->getWord();if ( $return ) {return $this->fileHeader;}}public function    getOptionalHeader( $return=true ) {$this->moveTo( $this->optHeaderOffset );$this->OptHeader['Magic'] = $this->getWord();$this->optHeader['LinkerVersion'] = $this->getByte() .'.'. $this->getByte();$this->optHeader['SizeOfCode'] = $this->getDword();$this->optHeader['SizeOfInitializedData'] = $this->getDword();$this->optHeader['SizeOfUninitializedData'] = $this->getDword();$this->optHeader['AddressOfEntryPoint'] = $this->getDword();$this->optHeader['BaseOfCode'] = $this->getDword();$this->optHeader['BaseOfData'] = $this->getDword();$this->optHeader['ImageBase'] = $this->getDword();$this->optHeader['SectionAlignment'] = $this->getDword();$this->optHeader['FileAlignment'] = $this->getDword();$this->optHeader['OperatingSystemVersion'] = $this->getWord() . '.' .$this->getWord();$this->optHeader['ImageVersion'] = $this->getWord(). '.' .$this->getWord();$this->optHeader['SubsystemVersion'] = $this->getWord(). '.' .$this->getWord();$this->optHeader['Reserved1'] = $this->getDword();$this->optHeader['SizeOfImage'] = $this->getDword();$this->optHeader['SizeOfHeaders'] = $this->getDword();$this->optHeader['CheckSum'] = $this->getDword();$this->optHeader['Subsystem'] = $this->getWord();$this->optHeader['DllCharacteristics'] = $this->getWord();$this->optHeader['SizeOfStackReserve'] = $this->getDWord();$this->optHeader['SizeOfStackCommit'] = $this->getDWord();$this->optHeader['SizeOfHeapReserve'] = $this->getDWord();$this->optHeader['SizeOfHeapCommit'] = $this->getDWord();$this->optHeader['LoaderFlags'] = $this->getDWord();$this->optHeader['NumberOfRvaAndSizes'] = $this->getDWord();if ( $return ) {return $this->optHeader;  }}public function    getDataDirectory( $return=true ) {$this->moveTo( $this->dataDirectoryOffset );$names = array("Export","Import","Resource","Exception","Security","BaseRelocate","Debug","Architecture","GlobalPtr","TLS","LoadConfig","Bound","ImportAddress","DelayLoadImport","COM","Reserved");for( $i = 0; $i < IMAGE_NUMBEROF_DIRECTORY_ENTRIES; $i++ ) {$this->dataDirectory[$i]["Name"] = $names[$i];$this->dataDirectory[$i]["Offset"] = $this->getDword();$this->dataDirectory[$i]["Size"] = $this->getDword();}if ($return) {return $this->dataDirectory;}}public function    getSection( $return=true ) {$this->moveTo( $this->fileHeaderOffset +2);$secCount = $this->getWord();$this->moveTo( $this->sectionOffset );for( $i = 0; $i < $secCount; $i++ ) {$this->section[$i]['Name'] = $this->getChar( 8 );$this->section[$i]['VirtualSize'] = $this->getDword( );$this->section[$i]['VirtualAddress'] = $this->getDword( );$this->section[$i]['SizeOfRawData'] = $this->getDword( );$this->section[$i]['PointerToRawData'] = $this->getDword( );$this->section[$i]['PointerToRelocations'] = $this->getDword( );$this->section[$i]['PointerToLinenumbers'] = $this->getDword( );$this->section[$i]['NumberOfRelocations'] = $this->getWord( );$this->section[$i]['NumberOfLinenumbers'] = $this->getWord( );$this->section[$i]['Characteristics'] = $this->getDword( );}if ($return) {return $this->section;}          }public function    out() {$this->getFileHeader(false);$this->getOptionalHeader(false);$this->getDataDirectory(false);$this->getSection(false);$buffer = '<?xml version="1.0" encoding="utf-8"?><EXE FileName="'.$this->fileName.'" >';$buffer .= '<IMAGE_DOS_HEADER><e_magic Conten="DOS头标志">'.$this->dosHeader["e_magic"].'</e_magic>';$buffer .= '<e_lfanew Content="PE文件信息块偏移">'.sprintf( "%02X",$this->dosHeader["e_lfanew"] ).'</e_lfanew></IMAGE_DOS_HEADER>';$buffer .= '<IMAGE_FILE_HEADER Content="文件头">';$buffer .= "<Machion>".sprintf( "%04X", $this->fileHeader["Machion"] )."</Machion>";      $buffer .= '<NumberOfSections Content="节数目">'. $this->fileHeader["NumberOfSections"] ."</NumberOfSections>";$buffer .= '<TimeDateStamp Content="时间戳 '.date(" Y-m-m H:i:s",$this->fileHeader["TimeDateStamp"]).'">'.sprintf( "%08X", $this->fileHeader["TimeDateStamp"] )."</TimeDateStamp>";$buffer .= '<PointerToSymbolTable>'.sprintf( "%08X", $this->fileHeader["PointerToSymbolTable"] )."</PointerToSymbolTable>";$buffer .= "<NumberOfSymbols>".sprintf( "%08X", $this->fileHeader["NumberOfSymbols"] )."</NumberOfSymbols>";$buffer .= '<SizeOfOptionalHeader>'.sprintf( "%04X", $this->fileHeader["SizeOfOptionalHeader"] )."</SizeOfOptionalHeader>";$buffer .= '<Characteristics>'.sprintf( "%04X", $this->fileHeader["Characteristics"] )."</Characteristics>";$buffer .= '</IMAGE_FILE_HEADER>';$buffer .= '<IMAGE_OPTION_HEADER Content="可选头">';$buffer .= '<Magic>'.sprintf( "%04X",$this->OptHeader['Magic'] ).'</Magic>';$buffer .= '<LinkerVersion Content="链接器版本">'. $this->optHeader['LinkerVersion'] ."</LinkerVersion>";$buffer .= '<SizeOfCode Content="代码尺寸">'.sprintf( "%08X",$this->optHeader['SizeOfCode'] ).'</SizeOfCode>';$buffer .= '<SizeOfInitializedData Content="初始化数据尺寸">'.sprintf( "%08X",$this->optHeader['SizeOfInitializedData'] ).'</SizeOfInitializedData>';$buffer .= '<SizeOfUninitializedData Content="未初始化数据尺寸">'.sprintf( "%08X",$this->optHeader['SizeOfUninitializedData'] ).'</SizeOfUninitializedData>';$buffer .= '<AddressOfEntryPoint Content="程序入口点">'.sprintf( "%08X",$this->optHeader['AddressOfEntryPoint'] ).'</AddressOfEntryPoint>';$buffer .= '<BaseOfCode Content="代码基地址">'.sprintf( "%08X",$this->optHeader['BaseOfCode'] ).'</BaseOfCode>';$buffer .= '<BaseOfData Content="数据基地址">'.sprintf( "%08X",$this->optHeader['BaseOfData'] ).'</BaseOfData>';$buffer .= '<ImageBase>'.sprintf( "%08X",$this->optHeader['ImageBase'] ).'</ImageBase>';$buffer .= '<SectionAlignment Content="节对齐尺寸">'.sprintf( "%08X",$this->optHeader['SectionAlignment'] ).'</SectionAlignment>';$buffer .= '<FileAlignment Content="文件对齐尺寸">'.sprintf( "%08X",$this->optHeader['FileAlignment'] ).'</FileAlignment>';$buffer .= '<OperatingSystemVersion Content="操作系统版本">'.$this->optHeader['OperatingSystemVersion'] .'</OperatingSystemVersion>';$buffer .= '<ImageVersion Content="映像版本">'.$this->optHeader['ImageVersion'].'</ImageVersion>';$buffer .= '<SubsystemVersion Content="操作系统子版本">'.$this->optHeader['SubsystemVersion'].'</SubsystemVersion>';$buffer .= '<Reserved1 Content="保留">'.sprintf( "%08X",$this->optHeader['Reserved1'] ).'</Reserved1>';$buffer .= '<SizeOfImage Content="映像尺寸">'.sprintf( "%08X",$this->optHeader['SizeOfImage'] ).'</SizeOfImage>';$buffer .= '<SizeOfHeaders Content="头数目">'.sprintf( "%08X",$this->optHeader['SizeOfHeaders'] ).'</SizeOfHeaders>';$buffer .= '<CheckSum Content="文件校验码">'.sprintf( "%08X",$this->optHeader['CheckSum'] ).'</CheckSum>';$buffer .= '<Subsystem Content="子系统">'.sprintf( "%04X",$this->optHeader['Subsystem'] ).'</Subsystem>';$buffer .= '<DllCharacteristics Content="动态链接库属性">'.sprintf( "%04X",$this->optHeader['DllCharacteristics'] ).'</DllCharacteristics>';$buffer .= '<SizeOfStackReserve Content="保留堆栈大小">'.sprintf( "%08X",$this->optHeader['SizeOfStackReserve'] ).'</SizeOfStackReserve>';$buffer .= '<SizeOfStackCommit>'.sprintf( "%08X",$this->optHeader['SizeOfStackCommit'] ).'</SizeOfStackCommit>';$buffer .= '<SizeOfHeapReserve Content="保留堆大小">'.sprintf( "%08X",$this->optHeader['SizeOfHeapReserve'] ).'</SizeOfHeapReserve>';$buffer .= '<SizeOfHeapCommit>'.sprintf( "%04X",$this->optHeader['SizeOfHeapCommit'] ).'</SizeOfHeapCommit>';$buffer .= '<LoaderFlags>'.sprintf( "%08X",$this->optHeader['LoaderFlags'] ).'</LoaderFlags>';$buffer .= '<NumberOfRvaAndSizes>'.sprintf( "%08X",$this->optHeader['NumberOfRvaAndSizes'] ).'</NumberOfRvaAndSizes>';$buffer .= '<IMAGE_DATA_DIRECTORY Content="数据目录">';foreach ($this->dataDirectory as $key=>$val) {$buffer .= '<Directory Offset="'.sprintf( "%08X",$val['Offset']).'" Size="'.sprintf( "%08X",$val['Size']).'" >'.$val['Name'].'</Directory>';}$buffer .= '</IMAGE_DATA_DIRECTORY>';$buffer .= '</IMAGE_OPTION_HEADER>';$buffer .= '<SECTION_TABLE Content="节表">';foreach ($this->section as $key=>$val) {$buffer .= '<Section>';$buffer .= '<Name>'.trim($val['Name']).'</Name>';$buffer .= '<VirtualSize>'.sprintf( "%08X", $val['VirtualSize'] ).'</VirtualSize>';$buffer .= '<VirtualAddress>'.sprintf( "%08X", $val['VirtualAddress'] ).'</VirtualAddress>';$buffer .= '<VirtualSize>'.sprintf( "%08X", $val['VirtualSize'] ).'</VirtualSize>';$buffer .= '<SizeOfRawData>'.sprintf( "%08X", $val['VirtualSize'] ).'</SizeOfRawData>';$buffer .= '<PointerToRawData>'.sprintf( "%08X", $val['PointerToRawData'] ).'</PointerToRawData>';$buffer .= '<PointerToRelocations>'.sprintf( "%08X", $val['PointerToRelocations'] ).'</PointerToRelocations>';$buffer .= '<PointerToLinenumbers>'.sprintf( "%08X", $val['PointerToLinenumbers'] ).'</PointerToLinenumbers>';$buffer .= '<NumberOfRelocations>'.sprintf( "%04X", $val['NumberOfRelocations'] ).'</NumberOfRelocations>';$buffer .= '<NumberOfLinenumbers>'.sprintf( "%04X", $val['NumberOfLinenumbers'] ).'</NumberOfLinenumbers>';$buffer .= '<Characteristics>'.sprintf( "%08X", $val['Characteristics'] ).'</Characteristics>';$buffer .= '</Section>';}$buffer .= '</SECTION_TABLE>';$buffer .= '</EXE>';echo $buffer;}}/**Sample*/
　　exe.php
　　<?phpinclude(dirname(__FILE__).'/pe_viewer.class.php');$file = "test.exe";$pe = new PE_VIEWER( $file );$pe->out();?>