Exe文件导入api表，导入DLL和段表的输出统计

无须多言，直接代码，原理看《加密与解密》第三版

 

#pragma warning(disable:4786)
#include<windows.h>
#include<stdio.h>
#include<iostream>
#include<winnt.h>
#include<stdlib.h>
#include<imagehlp.h>
#include<cstring>
#include<string>
#include<vector>
#include<string.h>
using namespace std;
/////////////////////
#pragma comment(lib,"imagehlp.lib")
/////////////////////
vector<string>DLL;//使用的dll
vector<string>API;//api函数
vector<string>SEG;//段
typedef struct _MAP_FILE_STRUCT
{
    HANDLE hFile;
    HANDLE hMapping;
    LPVOID ImageBase;
}MAP_FILE_STRUCT,*PMAP_FILE_STRUCT;
/////////////////////
#define GETTHUNK(pImportDesc) ((DWORD)                                                                                       \
    (                                                                                                                    \
    (PIMAGE_IMPORT_DESCRIPTOR)pImportDesc->OriginalFirstThunk ?                                                     \
                (PIMAGE_IMPORT_DESCRIPTOR)pImportDesc->OriginalFirstThunk:(PIMAGE_IMPORT_DESCRIPTOR)pImportDesc->FirstThunk ) \
)
/////////////////////
bool load(LPTSTR lpFilename,PMAP_FILE_STRUCT &p)
{
    HANDLE hFile=CreateFile(lpFilename,GENERIC_READ,FILE_SHARE_READ,NULL,
        OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL,0);
    if(!hFile)
    {
        cout<<"file open error"<<endl;
        return false;
    }
    HANDLE hMapping=CreateFileMapping(hFile,NULL,PAGE_READONLY,0,0,NULL);
    if(!hMapping)
    {
        cout<<"file map error"<<endl;
        return false;
    }
    LPVOID ImageBase=MapViewOfFile(hMapping,FILE_MAP_READ,0,0,0);
    if(!ImageBase)
    {
        cout<<"file load error"<<endl;
        return false;
    }
    p->hFile=hFile;
    p->hMapping=hMapping;
    p->ImageBase=ImageBase;
    return true;
}
/////////////////////////////
bool IsPE(LPVOID ImageBase)
{
    PIMAGE_DOS_HEADER pdos=NULL;
    PIMAGE_NT_HEADERS pnt=NULL;
    pdos=(PIMAGE_DOS_HEADER)ImageBase;
    if(pdos->e_magic!=IMAGE_DOS_SIGNATURE)
    {
        cout<<"not MZ"<<endl;
        return false;
    }
    pnt=(PIMAGE_NT_HEADERS)((DWORD)pdos+pdos->e_lfanew);
    if(pnt->Signature!=IMAGE_NT_SIGNATURE)
    {
        cout<<"not PE"<<endl;
        return false;
    }
    return true;
}
/////////////////////////////
PIMAGE_NT_HEADERS  GetNtHead(LPVOID ImageBase)
{
    if(!IsPE(ImageBase))
    {
        return NULL;
    }
    PIMAGE_NT_HEADERS  pnt;
    PIMAGE_DOS_HEADER  pdos;
    pdos=(PIMAGE_DOS_HEADER)ImageBase;
    pnt=(PIMAGE_NT_HEADERS)((DWORD)pdos+pdos->e_lfanew);
    return pnt;
}
/////////////////////////////
PIMAGE_OPTIONAL_HEADER GetOptionalHead(LPVOID ImageBase)
{
    PIMAGE_DOS_HEADER pdos=NULL;
    PIMAGE_NT_HEADERS pnt=NULL;
    PIMAGE_OPTIONAL_HEADER poptional=NULL;
    pnt=GetNtHead(ImageBase);
    poptional=&(pnt->OptionalHeader);
    return poptional;
}
/////////////////////////////
LPVOID RvaToPtr(PIMAGE_NT_HEADERS pNtH,LPVOID ImageBase,DWORD dwRVA)
{
    return ImageRvaToVa(pNtH,ImageBase,dwRVA,NULL);
}
/////////////////////////////
LPVOID GetDirectoryEntry(LPVOID ImageBase,USHORT DirectoryKind)
{
    DWORD dataaddress;
    PIMAGE_NT_HEADERS pnt=NULL;
    PIMAGE_OPTIONAL_HEADER poptional=NULL;
    pnt=GetNtHead(ImageBase);
    poptional=GetOptionalHead(ImageBase);
    dataaddress=poptional->DataDirectory[DirectoryKind].VirtualAddress;
    LPVOID pdirdata=RvaToPtr(pnt,ImageBase,dataaddress);
    if(!pdirdata)
    {
        cout<<"imagervatova() error"<<endl;
        return NULL;
    }
    return pdirdata;
}
/////////////////////////////
PIMAGE_IMPORT_DESCRIPTOR GetFirstImportAddress(LPVOID ImageBase)
{
    PIMAGE_IMPORT_DESCRIPTOR pimport=NULL;
    pimport=(PIMAGE_IMPORT_DESCRIPTOR)GetDirectoryEntry(ImageBase,IMAGE_DIRECTORY_ENTRY_IMPORT);
    if(!pimport)
    {
        cout<<"GetDirectoryEntry() error"<<endl;
        return NULL;
    }
    return pimport;
}

/////////////////////////////
bool ShowImportDllInfo(LPVOID ImageBase)
{
    char *szdllname;
    PIMAGE_NT_HEADERS pnt=NULL;
    PIMAGE_IMPORT_DESCRIPTOR pimport=NULL;
    pnt=GetNtHead(ImageBase);
    pimport=GetFirstImportAddress(ImageBase);
    if(!pimport)
    {
        cout<<"GetFirstImportAddress() error"<<endl;
        return 0;
    }
    //cout<<">>>====DLL INFO====<<<"<<endl;
    while(pimport->FirstThunk)
    {
        szdllname=(char*)RvaToPtr(pnt,ImageBase,pimport->Name);
        DLL.push_back(szdllname);
        ///////////////////difficult point////////////////////
        pimport++;
    }
    return 1;
}
/////////////////////////////
bool GetImportFuncInfo(LPVOID ImageBase)
{
    char* funcname;
    PIMAGE_IMPORT_BY_NAME pbyname=NULL;
    DWORD *pthunk=NULL;
    DWORD dwthunk;
    PIMAGE_IMPORT_DESCRIPTOR pstart=NULL;
    PIMAGE_NT_HEADERS pnt=NULL;
    pstart=GetFirstImportAddress(ImageBase);
    dwthunk=GETTHUNK(pstart);
    pnt=GetNtHead(ImageBase);
    pthunk=(DWORD*)RvaToPtr(pnt,ImageBase,dwthunk);
    if(!pthunk)
    {
        cout<<"RvaToVa() fail"<<endl;
        return 0;
    }
    //cout<<endl<<">>>====FUNC INFO====<<<"<<endl;
    while(*pthunk)//防止导入表被破坏造成死循环
    {
        if(HIWORD(*pthunk)==0x8000)
        {
            funcname=(char*)IMAGE_ORDINAL32(*pthunk);
        }
        else
        {
            pbyname=(PIMAGE_IMPORT_BY_NAME)RvaToPtr(pnt,ImageBase,(DWORD)(*pthunk));
            if(pbyname)
            {
                funcname=(char*)pbyname->Name;
            }
            else
            {
                funcname=(char*)(DWORD*)(*pthunk);
            }
        }
        API.push_back(funcname);
        //if(API.size()>=80)break;
        pthunk++;
    }
    return 1;
}
/////////////////////////////
bool GetSEG(LPVOID ImageBase)
{
    //PIMAGE_DOS_HEADER pdos=NULL;
    PIMAGE_NT_HEADERS pnh=NULL;
    PIMAGE_FILE_HEADER pfh=NULL;
    PIMAGE_SECTION_HEADER psh=NULL;
    pnh=GetNtHead(ImageBase);
    pfh=(PIMAGE_FILE_HEADER)&pnh->FileHeader;
    int num=pfh->NumberOfSections;
    psh=IMAGE_FIRST_SECTION(pnh);
    int i,j;
    for( i=0;i<num&&psh;i++,psh++)
    {
        //cout<<psh->Name<<endl;
        string tmp;
        for( j=0;j<8;j++)
        {
            char ch=psh->Name[j];
            if(ch=='.'||(ch>='a'&&ch<='z')||(ch>='A'&&ch<='Z'))
            {
                tmp+=psh->Name[j];
            }
        }
        SEG.push_back(tmp);
    }
    return 1;
}
bool GetAll(string s)
{
    SEG.clear();
    DLL.clear();
    API.clear();
    LPTSTR filename=(LPTSTR )s.c_str();
    PMAP_FILE_STRUCT map;
    map=(PMAP_FILE_STRUCT)malloc(sizeof(MAP_FILE_STRUCT));
    if(!load(filename,map))
    {
        cout<<"load() error"<<endl;
        return 0;
    }
    if(!IsPE(map->ImageBase))
    {
        cout<<"ispe() error"<<endl;
        return 0;
    }
    if(!GetSEG(map->ImageBase))return 0;
    if(!ShowImportDllInfo(map->ImageBase))return 0;
    if(!GetImportFuncInfo(map->ImageBase))return 0;
    return 1;
}
int main()
{
    //freopen("a.txt","w",stdout);
    string s;
    printf("输入文件目录:");
    while(cin>>s)
    {
        if(GetAll(s))
        {
            int i;
            printf("API=%d\n",API.size());
            for(i=0;i<API.size();i++)
            {
                printf("%s\n",API[i].c_str());
            }printf("\n");
            printf("SEG=%d\n",SEG.size());
            for(i=0;i<SEG.size();i++)
            {
                printf("%s\n",SEG[i].c_str());
            }printf("\n");
            
            printf("DLL=%d\n",DLL.size());
            for(i=0;i<DLL.size();i++)
            {
                printf("%s\n",DLL[i].c_str());
            }printf("\n");
        }
        else
        {
            printf("fail!\n");
        }
        printf("输入文件目录:");
    }
    return 0;
}