uint32_t get_iat_size(PIMAGE_DOS_HEADER dos_header,uint32_t import_rva)
{
if (import_rva == 0)//ntdll没有导入表
{
return 0;
}
LPBYTE import_va = (LPBYTE)dos_header + import_rva;
PIMAGE_IMPORT_DESCRIPTOR imp_desc = (PIMAGE_IMPORT_DESCRIPTOR)import_va;
uint32_t iat_fun_number = 0;
while (true)
{
if (imp_desc->Name)
{
PIMAGE_THUNK_DATA thunk1 = (PIMAGE_THUNK_DATA)((LPBYTE)dos_header + imp_desc->OriginalFirstThunk);
for (;;)
{
if (thunk1->u1.Ordinal == 0)
{
iat_fun_number++; //函数结尾0算一个函数
break;
}
iat_fun_number++;
thunk1 += 1;
}
imp_desc += 1; //下一个dll导入函数数组
}
else
{
break;
}
}
return iat_fun_number * sizeof(PVOID);
}
获取导入表的大小
最新推荐文章于 2022-09-05 22:28:31 发布