• WINDOWS黑客基础(6):查看文件里面的导入表


    int main(void)
    {
        HANDLE hFile = CreateFile("D:\Shipyard.exe",
                                   GENERIC_READ,
                                   FILE_SHARE_READ,
                                   NULL,
                                   OPEN_EXISTING,
                                   FILE_ATTRIBUTE_NORMAL,
                                   NULL);
    
        HANDLE hFileMapping = CreateFileMapping(hFile,NULL,FILE_READ_ONLY,0,0,NULL);
    
        LPBYTE lpBaseAddress = (LPBYTE)MapViewOfFile(hFileMapping,FILE_MAP_READ,0,0,0);
        
        PIMAGE_DOS_HEADER pDostHeader = (PIMAGE_DOS_HEADER)lpBaseAddress;
    
        PIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)(lpBaseAddress + pDostHeader->e_lfanew);
        
        DWORD rva_import_table = pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
    
        PIMAGE_IMPORT_DESCRIPTOR pImport = 
            (PIMAGE_IMPORT_DESCRIPTOR)ImageRvaToVa(pNtHeader,
                                                   lpBaseAddress,
                                                   rva_import_table,
                                                   NULL);
    
        IMAGE_THUNK_DATA *data = NULL;
    
        while ( pImport->Name != NULL)
        {
            LPCTSTR szDllName = (LPCTSTR)ImageRvaToVa(pNtHeader,lpBaseAddress,pImport->Name,NULL);
            
            PIMAGE_THUNK_DATA pThunk = 
                (PIMAGE_THUNK_DATA)ImageRvaToVa(pNtHeader,
                                                lpBaseAddress,
                                                pImport->OriginalFirstThunk,
                                                NULL);
    
            printf("%s
    ",szDllName);
    
            while (pThunk->u1.Function)
            {
                if (pThunk->u1.AddressOfData & IMAGE_ORDINAL_FLAG32)
                {
                    printf("序号:%d
    ",pThunk->u1.AddressOfData & 0xffff);
                }
                else
                {
                    PIMAGE_IMPORT_BY_NAME pFunName = 
                        (PIMAGE_IMPORT_BY_NAME)ImageRvaToVa(
                        pNtHeader,
                        lpBaseAddress,
                        pThunk->u1.AddressOfData,
                        NULL
                        );
    
                    printf("%s
    ",pFunName->Name);
                }
                pThunk++;
            }
    
            pImport ++;
        }
    }

    这节也没什么难的,主要还是PE文件的解析,还要会运用ImageRvatoVa这个函数还取得对应的内存地址,就能解析出来了

  • 相关阅读:
    kotlin 通过 下标比对
    textarea元素调整
    jquery给两个标签绑定一个事件
    开发过程中遇到的错误
    response.setHeader各种用法详解
    如何在eclipse里删除一个类 然后SVN服务器也同时删了这个类
    @pathvariable 与@requestparam 写rest接口时遇到的
    $.getJSON
    easyUI学习
    jQuery validator addMethod 动态提示信息
  • 原文地址:https://www.cnblogs.com/linyilong3/p/3209946.html
Copyright © 2020-2023  润新知