Win32汇编：汇编版PE结构解析器

		mov esi,lpMemory
		assume esi:ptr IMAGE_DOS_HEADER
		movzx eax,[esi].e_magic         ; 读取DOS的头部
		movzx eax,[esi].e_ss            ; DOS代码段的初始堆栈段
		movzx eax,[esi].e_sp            ; DOS代码段的初始堆栈指针
		movzx eax,[esi].e_cs            ; DOS代码的入口地址
		movzx eax,[esi].e_ip            ; DOS代码的入口IP
		movzx eax,[esi].e_lfanew        ; 指向了PE文件的开头(重要)

.data
	szFileName db "lyshark.exe",0h
	hFile dd ?
	hMapFile dd ?
	lpMemory dd ?
	szText db "这是一个PE可执行文件 !",0h
.code
	main PROC
	; 打开文件,并创建内存映射镜像
		invoke	CreateFile,addr szFileName,GENERIC_READ,FILE_SHARE_READ or \
			FILE_SHARE_WRITE,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_ARCHIVE,NULL
		mov hFile,eax
		invoke CreateFileMapping,hFile,NULL,PAGE_READONLY,0,0,NULL
		mov hMapFile,eax
		invoke MapViewOfFile,eax,FILE_MAP_READ,0,0,0
		mov lpMemory,eax
; -------------------------------------------------------------------
	; 检测PE文件是否有效,是否是一个正常的PE
		mov esi,lpMemory
		assume esi:ptr IMAGE_DOS_HEADER
		; 判断是否为DOS文件头部
		.if [esi].e_magic == IMAGE_DOS_SIGNATURE
			add esi,[esi].e_lfanew              ; 递增指针
			assume esi:ptr IMAGE_NT_HEADERS
			; 判断是否为PE可执行文件
			.if [esi].Signature == IMAGE_NT_SIGNATURE
				invoke MessageBox,NULL,addr szText,0,MB_OK
			.endif
		.endif
; -------------------------------------------------------------------
		invoke UnmapViewOfFile,addr lpMemory
		invoke ExitProcess,NULL
	main ENDP
END main

	.386
	.model flat,stdcall
	option casemap:none

include windows.inc
include user32.inc
includelib user32.lib
include kernel32.inc
includelib kernel32.lib
include masm32.inc
includelib masm32.lib

.data
	szFileName db "lyshark.exe",0h
	hFile dd ?
	hMapFile dd ?
	lpMemory dd ?
	lpBuffer db 2048 dup(?)
.const
	szMsg	db	"----------------------------------------",0dh,0ah
		db	"运行平台：           0x%04X",0dh,0ah
		db	"节区数量：           %d",0dh,0ah
		db	"文件属性：           0x%04X",0dh,0ah
		db	"时间标记:            %d",0dh,0ah
		db	"镜像装入基址：       0x%08X",0dh,0ah
		db	"程序的入口RVA：      0x%08X",0dh,0ah
		db	"代码节起始RVA：      0x%08X",0dh,0ah
		db	"数据节起始RVA：      0x%08X",0dh,0ah
		db	"----------------------------------------",0dh,0ah,0
.code
	main PROC
	; 打开文件,并创建内存映射镜像
		invoke	CreateFile,addr szFileName,GENERIC_READ,FILE_SHARE_READ or \
			FILE_SHARE_WRITE,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_ARCHIVE,NULL
		mov hFile,eax
		invoke CreateFileMapping,hFile,NULL,PAGE_READONLY,0,0,NULL
		mov hMapFile,eax
		invoke MapViewOfFile,eax,FILE_MAP_READ,0,0,0
		mov lpMemory,eax
		mov esi,lpMemory

		assume	esi:ptr IMAGE_DOS_HEADER
		add esi,[esi].e_lfanew
		assume esi:ptr IMAGE_NT_HEADERS
		invoke wsprintf,addr lpBuffer,addr szMsg,\
			[esi].FileHeader.Machine, \                 ; 运行平台
			[esi].FileHeader.NumberOfSections, \        ; 节区数目
			[esi].FileHeader.Characteristics, \         ; 文件属性
			[esi].FileHeader.TimeDateStamp, \           ; 时间标记
			[esi].OptionalHeader.ImageBase, \           ; 镜像基址
			[esi].OptionalHeader.AddressOfEntryPoint, \ ; 入口RVA地址
			[esi].OptionalHeader.BaseOfCode, \          ; 代码节起始RVA
			[esi].OptionalHeader.BaseOfData
		invoke StdOut,addr lpBuffer
		invoke ExitProcess,NULL
	main ENDP
END main

	.386
	.model flat,stdcall
	option casemap:none

include windows.inc
include user32.inc
includelib user32.lib
include kernel32.inc
includelib kernel32.lib
include masm32.inc
includelib masm32.lib

.data
	szFileName db "lyshark.exe",0h
	hFile dd ?
	hMapFile dd ?
	lpMemory dd ?
	lpBuffer db 2048 dup(?)
.const
	szMsg	db	"----------------------------------------------------------",0dh,0ah
		db	"节区名称  节区大小  虚拟地址  Raw_尺寸  Raw_偏移  节区属性",0dh,0ah
		db	"----------------------------------------------------------",0dh,0ah,0
	szFmt	db	"%s  %08X  %08X  %08X  %08X  %08X",0dh,0ah,0
.code
	main PROC
		invoke	CreateFile,addr szFileName,GENERIC_READ,FILE_SHARE_READ or \
			FILE_SHARE_WRITE,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_ARCHIVE,NULL
		mov hFile,eax
		invoke CreateFileMapping,hFile,NULL,PAGE_READONLY,0,0,NULL
		mov hMapFile,eax
		invoke MapViewOfFile,eax,FILE_MAP_READ,0,0,0
		mov lpMemory,eax
		mov esi,lpMemory

		assume	esi:ptr IMAGE_DOS_HEADER     ; 指向DOS开头
		add esi,[esi].e_lfanew               ; 递增指针到PE结构开头
		assume esi:ptr IMAGE_NT_HEADERS
		
		invoke StdOut,addr szMsg                        ; 输出提示信息
		movzx ecx,[esi].FileHeader.NumberOfSections     ; 取出节的数量,作为循环条件
		add esi,sizeof IMAGE_NT_HEADERS      ; 指向.text节
		assume esi:ptr IMAGE_SECTION_HEADER  ; 指向节中的SECTION
		.repeat
			push ecx      ; wsprintf影响ecx寄存器,所以这里必须压栈保存数据
			mov eax,[esi].VirtualAddress
			
			invoke wsprintf,addr lpBuffer,addr szFmt,esi, \   ; 节区名称
				[esi].Misc.VirtualSize, \                 ; 节区大小
				[esi].VirtualAddress, \                   ; 虚拟地址
				[esi].SizeOfRawData, \                    ; Raw_尺寸
				[esi].PointerToRawData, \                 ; Raw_偏移
				[esi].Characteristics                     ; 节区属性
			invoke StdOut,addr lpBuffer                       ; 打印节区信息
			pop ecx
			add esi,sizeof IMAGE_SECTION_HEADER
		.untilcxz
		invoke ExitProcess,NULL
	main ENDP
END main