查看PE文件导入表


这个博客空间主席帮申请下来快一年了,都快忘了。最近一直在学习PE文件,贴段代码,功能如题,自己学习写的练习程序,VC2005编译,控制台程序,有很多不严谨和不完善的地方!

#include "stdafx.h"
#include <Windows.h>

DWORD RVA2Offset(PIMAGE_NT_HEADERS pNTHeader, DWORD dwRVA)
{
PIMAGE_SECTION_HEADER pSection = (PIMAGE_SECTION_HEADER)((DWORD)pNTHeader + sizeof(IMAGE_NT_HEADERS));

for(int i = 0; i < pNTHeader->FileHeader.NumberOfSections; i++)
{
if(dwRVA >= pSection[i].VirtualAddress && dwRVA < (pSection[i].VirtualAddress + pSection[i].SizeOfRawData))
{
return pSection[i].PointerToRawData + (dwRVA - pSection[i].VirtualAddress);
}
}

return 0;
}


int _tmain(int argc, _TCHAR* argv[])
{
HANDLE hFile = CreateFile(argv[1], GENERIC_ALL, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL);
HANDLE hMapping = CreateFileMapping(hFile, NULL, PAGE_READWRITE, 0, 0, NULL);
PVOID pbFile = MapViewOfFile(hMapping, FILE_MAP_ALL_ACCESS, 0, 0, 0);

if(INVALID_HANDLE_VALUE == hFile || NULL == hMapping || NULL == pbFile)
{
printf("\n\t---------- The File Inexistence! ----------\n");
goto EXIT;
}

PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)pbFile;
PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pbFile + pDosHeader->e_lfanew);

if(0x00004550 != pNTHeader->Signature)
{
printf("\n\t---------- Lawless PE File! ----------\n");
goto EXIT;
}

DWORD dwImportOffset = RVA2Offset(pNTHeader, pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
PIMAGE_IMPORT_DESCRIPTOR pImport = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD)pbFile + dwImportOffset);

DWORD dwOriginalThunkOffset = 0;
DWORD dwThunkData = 0;
PIMAGE_IMPORT_BY_NAME pImageFunName = NULL;
PIMAGE_THUNK_DATA pThunkData = NULL;

for(int i = 0; i < pNTHeader->OptionalHeader.DataDirectory[1].Size / sizeof(IMAGE_IMPORT_DESCRIPTOR) - 1; i++)
{
printf("[DLL Name]: %s\n\n", ((DWORD)pbFile + RVA2Offset(pNTHeader, pImport[i].Name)));

pThunkData = (PIMAGE_THUNK_DATA)((DWORD)pbFile + RVA2Offset(pNTHeader, pImport[i].FirstThunk));

for(int j = 0; pThunkData[j].u1.Ordinal != 0; j++)
{
if(pThunkData[j].u1.Ordinal & IMAGE_ORDINAL_FLAG32)
{
printf(" [%03d] --- Number: %04d Name: <NULL>\n", j + 1, pThunkData[j].u1.Ordinal & 0xFFFF);
}
else
{
pImageFunName = (PIMAGE_IMPORT_BY_NAME)((DWORD)pbFile + RVA2Offset(pNTHeader, pThunkData[j].u1.AddressOfData));
printf(" [%03d] --- Number: %04d Name: %s\n", j + 1, pImageFunName->Hint, pImageFunName->Name);
}
}

printf("\n");
}

EXIT:
if(NULL != pbFile)
{
UnmapViewOfFile(pbFile);
}

if(NULL != hMapping)
{
CloseHandle(hMapping);
}

if (INVALID_HANDLE_VALUE != hFile)
{
CloseHandle(hFile);
}

return 0;
}

优质内容筛选与推荐>>
1、sqlserver获取本月最后一天
2、从C简单程序的汇编代码入手,以理解计算机工作原理。
3、vb.net与c#相互转换工具
4、bzoj 2599
5、VMWare玩CentOS之一:利用NAT上网


长按二维码向我转账

受苹果公司新规定影响,微信 iOS 版的赞赏功能被关闭,可通过二维码转账支持公众号。

    阅读
    好看
    已推荐到看一看
    你的朋友可以在“发现”-“看一看”看到你认为好看的文章。
    已取消,“好看”想法已同步删除
    已推荐到看一看 和朋友分享想法
    最多200字,当前共 发送

    已发送

    朋友将在看一看看到

    确定
    分享你的想法...
    取消

    分享想法到看一看

    确定
    最多200字,当前共

    发送中

    网络异常,请稍后重试

    微信扫一扫
    关注该公众号