DWORD PrintImportDirectory(PVOID FileBuffer) {
PIMAGE_DOS_HEADER PDos_Header = NULL;
PIMAGE_NT_HEADERS PNT_Header = NULL;
PIMAGE_FILE_HEADER PFile_Header = NULL;
PIMAGE_OPTIONAL_HEADER POptional_Header = NULL;
PIMAGE_SECTION_HEADER PSection = NULL;
PIMAGE_DATA_DIRECTORY PData_Directory = NULL;
PIMAGE_IMPORT_DESCRIPTOR PImport = NULL;//导入表
PVOID TemFileBuffer = FileBuffer;
if (!TemFileBuffer) {
printf("PrintRelocation:传入文件无效!\n");
return 0;
}
if (*((PWORD)TemFileBuffer) != IMAGE_DOS_SIGNATURE) {
printf("PrintRelocation:不含MZ标识,不是可执行文件!\n");
return 0;
}
PDos_Header = (PIMAGE_DOS_HEADER)((DWORD)TemFileBuffer);
if (*(PDWORD((DWORD)TemFileBuffer + PDos_Header->e_lfanew)) != IMAGE_NT_SIGNATURE) {
printf("PrintRelocation:不含PE标识!\n");
return 0;
}
PFile_Header = (PIMAGE_FILE_HEADER)((DWORD)TemFileBuffer + PDos_Header->e_lfanew + 0x4);//初始化数据
POptional_Header = (PIMAGE_OPTIONAL_HEADER)((DWORD)TemFileBuffer + PDos_Header->e_lfanew + 0x18);
PSection = (PIMAGE_SECTION_HEADER)((DWORD)POptional_Header + PFile_Header->SizeOfOptionalHeader);
PData_Directory = (PIMAGE_DATA_DIRECTORY)((DWORD)POptional_Header->DataDirectory);
DWORD Import_Foa = RvaToFoa(PData_Directory[1].VirtualAddress, TemFileBuffer);
PImport = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD)TemFileBuffer + Import_Foa);//导入表初始化
//解析部分
while (!(PImport->FirstThunk == 0 && PImport->OriginalFirstThunk == 0)) {
DWORD OriginalFirstThunk_Foa = RvaToFoa(PImport->OriginalFirstThunk, TemFileBuffer);
DWORD Name_Foa = RvaToFoa(PImport->Name, TemFileBuffer);
DWORD OriginalFirstThunk = *(PDWORD)((DWORD)TemFileBuffer + OriginalFirstThunk_Foa);
printf("%s\n", PVOID((DWORD)TemFileBuffer + Name_Foa));
printf("--------------OriginalFirstThunk-------------\n");
printf("OriginalFirstThunk--Rva:%x--Foa:%x\n", PImport->OriginalFirstThunk, OriginalFirstThunk_Foa);
while (OriginalFirstThunk) {
if (OriginalFirstThunk & 0x80000000) {
printf("按照序号导出:%x\n", OriginalFirstThunk & 0x0fff);
}
else {
PIMAGE_IMPORT_BY_NAME Pby = (PIMAGE_IMPORT_BY_NAME)((DWORD)TemFileBuffer + RvaToFoa(OriginalFirstThunk, TemFileBuffer));
printf("按照名字导出:Hint%x Name:%s\n ", Pby->Hint, Pby->Name);
}
//OriginalFirstThunk指向下一个
PImport->OriginalFirstThunk += 4;
OriginalFirstThunk_Foa = RvaToFoa(PImport->OriginalFirstThunk, TemFileBuffer);
OriginalFirstThunk = *(PDWORD)((DWORD)TemFileBuffer + OriginalFirstThunk_Foa);
}
DWORD FirstThunk_Foa = RvaToFoa(PImport->FirstThunk, TemFileBuffer);
DWORD FirstThunk = *(PDWORD)((DWORD)TemFileBuffer + FirstThunk_Foa);
printf("--------------FirstThunk-------------\n");
printf("FirstThunk--Rva:%x--Foa:%x\n", PImport->FirstThunk, FirstThunk_Foa);
while (FirstThunk) {
if (FirstThunk & 0x80000000) {
printf("按照序号导出:%x\n", FirstThunk & 0x0fff);
}
else {
PIMAGE_IMPORT_BY_NAME Pby = (PIMAGE_IMPORT_BY_NAME)((DWORD)TemFileBuffer + RvaToFoa(FirstThunk, TemFileBuffer));
printf("按照名字导出:Hint:%x Name:%s\n", Pby->Hint, Pby->Name);
}
//FirstThunk 指向下一个;
PImport->FirstThunk += 4;
FirstThunk_Foa = RvaToFoa(PImport->FirstThunk, TemFileBuffer);
FirstThunk = *(PDWORD)((DWORD)TemFileBuffer + FirstThunk_Foa);
}
PImport++;
printf("--------------------------\n");
}
}
最后修改:2020 年 11 月 13 日
© 允许规范转载