DWORD PrintImportDirectory(PVOID FileBuffer) {
    PIMAGE_DOS_HEADER  PDos_Header = NULL;
    PIMAGE_NT_HEADERS PNT_Header = NULL;
    PIMAGE_FILE_HEADER PFile_Header = NULL;
    PIMAGE_OPTIONAL_HEADER POptional_Header = NULL;
    PIMAGE_SECTION_HEADER PSection = NULL;
    PIMAGE_DATA_DIRECTORY PData_Directory = NULL;
    PIMAGE_IMPORT_DESCRIPTOR PImport = NULL;//导入表
    PVOID TemFileBuffer = FileBuffer;
    if (!TemFileBuffer) {
        printf("PrintRelocation:传入文件无效!\n");
        return 0;
    }
    if (*((PWORD)TemFileBuffer) != IMAGE_DOS_SIGNATURE) {
        printf("PrintRelocation:不含MZ标识,不是可执行文件!\n");
        return 0;
    }
    PDos_Header = (PIMAGE_DOS_HEADER)((DWORD)TemFileBuffer);
    if (*(PDWORD((DWORD)TemFileBuffer + PDos_Header->e_lfanew)) != IMAGE_NT_SIGNATURE) {
        printf("PrintRelocation:不含PE标识!\n");
        return 0;
    }
    PFile_Header = (PIMAGE_FILE_HEADER)((DWORD)TemFileBuffer + PDos_Header->e_lfanew + 0x4);//初始化数据
    POptional_Header = (PIMAGE_OPTIONAL_HEADER)((DWORD)TemFileBuffer + PDos_Header->e_lfanew + 0x18);
    PSection = (PIMAGE_SECTION_HEADER)((DWORD)POptional_Header + PFile_Header->SizeOfOptionalHeader);
    PData_Directory = (PIMAGE_DATA_DIRECTORY)((DWORD)POptional_Header->DataDirectory);
    DWORD Import_Foa = RvaToFoa(PData_Directory[1].VirtualAddress, TemFileBuffer);
    PImport = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD)TemFileBuffer + Import_Foa);//导入表初始化
    //解析部分
    while (!(PImport->FirstThunk == 0 && PImport->OriginalFirstThunk == 0)) {
        DWORD OriginalFirstThunk_Foa = RvaToFoa(PImport->OriginalFirstThunk, TemFileBuffer);
        DWORD Name_Foa = RvaToFoa(PImport->Name, TemFileBuffer);
        DWORD OriginalFirstThunk = *(PDWORD)((DWORD)TemFileBuffer + OriginalFirstThunk_Foa);
        printf("%s\n", PVOID((DWORD)TemFileBuffer + Name_Foa));
        printf("--------------OriginalFirstThunk-------------\n");
        printf("OriginalFirstThunk--Rva:%x--Foa:%x\n", PImport->OriginalFirstThunk, OriginalFirstThunk_Foa);
        while (OriginalFirstThunk) {
            if (OriginalFirstThunk & 0x80000000) {
                printf("按照序号导出:%x\n", OriginalFirstThunk & 0x0fff);
            }
            else {
                PIMAGE_IMPORT_BY_NAME Pby = (PIMAGE_IMPORT_BY_NAME)((DWORD)TemFileBuffer + RvaToFoa(OriginalFirstThunk, TemFileBuffer));
                printf("按照名字导出:Hint%x Name:%s\n ", Pby->Hint, Pby->Name);
            }
            //OriginalFirstThunk指向下一个
            PImport->OriginalFirstThunk += 4;
            OriginalFirstThunk_Foa = RvaToFoa(PImport->OriginalFirstThunk, TemFileBuffer);
            OriginalFirstThunk = *(PDWORD)((DWORD)TemFileBuffer + OriginalFirstThunk_Foa);

        }
        DWORD FirstThunk_Foa = RvaToFoa(PImport->FirstThunk, TemFileBuffer);
        DWORD FirstThunk = *(PDWORD)((DWORD)TemFileBuffer + FirstThunk_Foa);
        printf("--------------FirstThunk-------------\n");
        printf("FirstThunk--Rva:%x--Foa:%x\n", PImport->FirstThunk, FirstThunk_Foa);
        while (FirstThunk) {
            if (FirstThunk & 0x80000000) {
                printf("按照序号导出:%x\n", FirstThunk & 0x0fff);                
            }
            else {
                PIMAGE_IMPORT_BY_NAME Pby = (PIMAGE_IMPORT_BY_NAME)((DWORD)TemFileBuffer + RvaToFoa(FirstThunk, TemFileBuffer));
                printf("按照名字导出:Hint:%x Name:%s\n", Pby->Hint, Pby->Name);
            }
            //FirstThunk 指向下一个;
            PImport->FirstThunk += 4;
            FirstThunk_Foa = RvaToFoa(PImport->FirstThunk, TemFileBuffer);
            FirstThunk = *(PDWORD)((DWORD)TemFileBuffer + FirstThunk_Foa);
        }
        PImport++;
        printf("--------------------------\n");
    }
}

11_13_1.JPG

最后修改:2020 年 11 月 13 日
如果觉得我的文章对你有用,请随意赞赏