VB PE导出/输入表演示(进程版)

最新推荐文章于 2021-03-21 18:19:01 发布

chenhui530

最新推荐文章于 2021-03-21 18:19:01 发布

阅读量2.5k

点赞数

分类专栏： VB原创文章标签： vb integer image descriptor function import

本文链接：https://blog.csdn.net/chenhui530/article/details/2005397

版权

这个VB程序展示了如何读取PE文件的导出和导入表。通过使用`OpenProcess`、`ReadProcessMemory`等API，程序获取进程路径，并遍历导出表和导入表，列出导出函数和输入函数的详细信息。用户可以输入PE文件路径，程序将显示对应的导出和输入函数列表。

摘要由CSDN通过智能技术生成

frmMain.frm

Option Explicit
Private Declare Sub InitCommonControls Lib "comctl32.dll" ()

Private Function IsArraryInitialize(strArray() As String) As Boolean
    On Error GoTo ErrHandle
    Dim i As Long
    i = UBound(strArray)
    IsArraryInitialize = True
    Exit Function
ErrHandle:
    IsArraryInitialize = False
End Function

Private Function IsObjArraryInitialize(objArray() As ImportDetailInfo) As Boolean
    On Error GoTo ErrHandle
    Dim i As Long
    i = UBound(objArray)
    IsObjArraryInitialize = True
    Exit Function
ErrHandle:
    IsObjArraryInitialize = False
End Function

Private Sub cmdExit_Click()
Unload Me
End Sub

Private Sub cmdExport_Click()
    Dim pExportInfo As ExportInfo, i As Integer
    lstExport.Clear
    Call GetProcessPath(Val(txtPath.Text))
    If GetExportTable(Val(txtPath.Text), pExportInfo) Then
        lstExport.AddItem pExportInfo.strDllName & "导出函数列表："
        If IsArraryInitialize(pExportInfo.strFuns) Then
            For i = 0 To UBound(pExportInfo.strFuns)
                lstExport.AddItem "     " & pExportInfo.strFuns(i)
            Next
        End If
    End If
End Sub

Private Sub cmdImport_Click()
    Dim pImportInfo As ImportInfo, i As Integer, j As Integer
    lstImport.Clear
    Call GetProcessPath(Val(txtPath.Text))
    If GetImportTable(Val(txtPath.Text), pImportInfo) Then
        lstImport.AddItem pImportInfo.strExePath & "输入函数列表："
        If IsObjArraryInitialize(pImportInfo.pDetailInfo) Then
            For i = 0 To UBound(pImportInfo.pDetailInfo)
                lstImport.AddItem "     模块：" & pImportInfo.pDetailInfo(i).strDllName & ""
                If IsArraryInitialize(pImportInfo.pDetailInfo(i).strFuns) Then
                    For j = 0 To UBound(pImportInfo.pDetailInfo(i).strFuns)
                        lstImport.AddItem "          " & pImportInfo.pDetailInfo(i).strFuns(j)
                    Next
                End If
            Next
        End If
    End If
End Sub

Private Sub Form_Initialize()
InitCommonControls
End Sub

modPEInfo.bas

Option Explicit

Private Const PROCESS_QUERY_INFORMATION As Long = 1024
Private Const PROCESS_VM_READ As Long = 16

Private Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Private Declare Function OpenProcess Lib "kernel32.dll" (ByVal dwDesiredAccessas As Long, ByVal bInheritHandle As Long, ByVal dwProcId As Long) As Long

Private Declare Function NtQueryInformationProcess Lib "ntdll.dll" (ByVal ProcessHandle As Long, _
                                ByVal ProcessInformationClass As PROCESSINFOCLASS, _
                                ByVal ProcessInformation As Long, _
                                ByVal ProcessInformationLength As Long, _
                                ByRef ReturnLength As Long) As Long

Private Enum PROCESSINFOCLASS
    ProcessBasicInformation = 0
    ProcessQuotaLimits
    ProcessIoCounters
    ProcessVmCounters
    ProcessTimes
    ProcessBasePriority
    ProcessRaisePriority
    ProcessDebugPort
    ProcessExceptionPort
    ProcessAccessToken
    ProcessLdtInformation
    ProcessLdtSize
    ProcessDefaultHardErrorMode
    ProcessIoPortHandlers
    ProcessPooledUsageAndLimits
    ProcessWorkingSetWatch
    ProcessUserModeIOPL
    ProcessEnableAlignmentFaultFixup
    ProcessPriorityClass
    ProcessWx86Information
    ProcessHandleCount
    ProcessAffinityMask
    ProcessPriorityBoost
    ProcessDeviceMap
    ProcessSessionInformation
    ProcessForegroundInformation
    ProcessWow64Information
    ProcessImageFileName
    ProcessLUIDDevice