滴水三期逆向基础系列(四)-解析导出表

本来开开心心一遍过，自己写的DLL的文件也能解析出来，突然，我从崩坏3桌面版随便找了一个DLL拖进了我的程序，发现运行不正常，没想那么多，就去排查代码逻辑问题，从上到下看了个遍，发现，代码本没问题，后来，我突然发现，这是个64位PE文件（我不是应该早点发现吗！！），然后，改了一下，运行成功。

VOID ReturnAllExport(
	IN LPVOID pFileBuffer
){
	if(is64Bit){
		PIMAGE_DOS_HEADER idh = NULL;
		PIMAGE_NT_HEADERS64 inh = NULL;
		PIMAGE_OPTIONAL_HEADER64 ioh = NULL;
		PIMAGE_SECTION_HEADER ish = NULL;

		idh = (PIMAGE_DOS_HEADER)pFileBuffer;
		inh = (PIMAGE_NT_HEADERS64)((DWORD)pFileBuffer + idh->e_lfanew);
		ioh = &inh->OptionalHeader;
		ish = (PIMAGE_SECTION_HEADER)((DWORD)ioh + inh->FileHeader.SizeOfOptionalHeader);
	
		PIMAGE_DATA_DIRECTORY pdd = ioh->DataDirectory;
		cout << "=====" << hex << inh->OptionalHeader.DataDirectory[0].VirtualAddress << endl;
		if(pdd[0].VirtualAddress == 0){
			cout << "不存在导出表..." << endl;
			return ;
		}
		DWORD ExportVirtualAddrTemp = pdd[0].VirtualAddress;
		//ExportVirtualAddrTemp = 0x1060;
		DWORD ExportVirtualAddr = RVAToFOA(ExportVirtualAddrTemp, pFileBuffer);
		cout << hex << "ExportVirtualAddr = " << ExportVirtualAddr << endl;
	 
		PIMAGE_EXPORT_DIRECTORY ped = (PIMAGE_EXPORT_DIRECTORY)(ExportVirtualAddr + (DWORD)pFileBuffer);
		cout << hex << "-----------IMAGE_EXPORT_DIRECTORY---------" << endl;
		cout << hex << "-exportRVA                   = " << ExportVirtualAddrTemp       << endl;
		cout << hex << "-exportSize                  = " << pdd[0].Size                    << endl;
		cout << hex << "-exportName                  = " << ped->Name                   << endl;
		printf(        "-exportNameString            = %s\n", RVAToFOA(ped->Name, pFileBuffer) + (DWORD)pFileBuffer);
		cout << hex << "-exportBase                  = " << ped->Base                   << endl;
		cout << hex << "-exportNumberOfFunctions     = " << ped->NumberOfFunctions      << endl;
		cout << hex << "-exportNumberOfNames         = " << ped->NumberOfNames          << endl;
		cout << hex << "-exportAddressOfFunctions    = " << ped->AddressOfFunctions     << endl;
		cout << hex << "-exportAddressOfNames        = " << ped->AddressOfNames         << endl;
		cout << hex << "-exportAddressOfNameOrdinals = " << ped->AddressOfNameOrdinals  << endl;
		cout << hex << "-FunctionsDetail-------------------------------------------------" << endl;
		cout << hex << "-\t\tOrdinal\t\tRVA\t\tFunctionName" << endl;

		DWORD *addrFunctions = (DWORD *)((DWORD)pFileBuffer + RVAToFOA(ped->AddressOfFunctions, pFileBuffer));
		DWORD *addrName = (DWORD *)((DWORD)pFileBuffer + RVAToFOA(ped->AddressOfNames, pFileBuffer));
		WORD  *addrOrdinals = (WORD  *)((DWORD)pFileBuffer + RVAToFOA(ped->AddressOfNameOrdinals, pFileBuffer));
		DWORD i, j;
		for(i = 0; i < ped->NumberOfFunctions; i++){
			if(addrFunctions[i] == 0){
				continue;
			}
			for(j = 0; j < ped->NumberOfNames; j++){
				if(addrOrdinals[j] == i){
					printf("-\t\t%04x\t\t%08x\t%s\n", ped->Base + i, addrFunctions[i], RVAToFOA(addrName[j], pFileBuffer) + (DWORD)pFileBuffer);
					break;
				}
			}
			if(j != ped->NumberOfNames){
				continue;
			}
			else{
				printf("-\t\t%04x\t\t%08x\t%s\n", ped->Base + i, addrFunctions[i],"-----------------");
			}
		
		}
	}else{
		PIMAGE_DOS_HEADER idh = NULL;
		PIMAGE_NT_HEADERS inh = NULL;
		PIMAGE_OPTIONAL_HEADER ioh = NULL;
		PIMAGE_SECTION_HEADER ish = NULL;

		idh = (PIMAGE_DOS_HEADER)pFileBuffer;
		inh = (PIMAGE_NT_HEADERS)((DWORD)pFileBuffer + idh->e_lfanew);
		ioh = &inh->OptionalHeader;
		ish = (PIMAGE_SECTION_HEADER)((DWORD)ioh + inh->FileHeader.SizeOfOptionalHeader);
	
		PIMAGE_DATA_DIRECTORY pdd = ioh->DataDirectory;
		cout << "=====" << hex << inh->OptionalHeader.DataDirectory[0].VirtualAddress << endl;
		if(pdd[0].VirtualAddress == 0){
			cout << "不存在导出表..." << endl;
			return ;
		}
		DWORD ExportVirtualAddrTemp = pdd[0].VirtualAddress;
		//ExportVirtualAddrTemp = 0x1060;
		DWORD ExportVirtualAddr = RVAToFOA(ExportVirtualAddrTemp, pFileBuffer);
		cout << hex << "ExportVirtualAddr = " << ExportVirtualAddr << endl;
	 
		PIMAGE_EXPORT_DIRECTORY ped = (PIMAGE_EXPORT_DIRECTORY)(ExportVirtualAddr + (DWORD)pFileBuffer);
		cout << hex << "-----------IMAGE_EXPORT_DIRECTORY---------" << endl;
		cout << hex << "-exportRVA                   = " << ExportVirtualAddrTemp       << endl;
		cout << hex << "-exportSize                  = " << pdd[0].Size                    << endl;
		cout << hex << "-exportName                  = " << ped->Name                   << endl;
		printf(        "-exportNameString            = %s\n", RVAToFOA(ped->Name, pFileBuffer) + (DWORD)pFileBuffer);
		cout << hex << "-exportBase                  = " << ped->Base                   << endl;
		cout << hex << "-exportNumberOfFunctions     = " << ped->NumberOfFunctions      << endl;
		cout << hex << "-exportNumberOfNames         = " << ped->NumberOfNames          << endl;
		cout << hex << "-exportAddressOfFunctions    = " << ped->AddressOfFunctions     << endl;
		cout << hex << "-exportAddressOfNames        = " << ped->AddressOfNames         << endl;
		cout << hex << "-exportAddressOfNameOrdinals = " << ped->AddressOfNameOrdinals  << endl;
		cout << hex << "-FunctionsDetail-------------------------------------------------" << endl;
		cout << hex << "-\t\tOrdinal\t\tRVA\t\tFunctionName" << endl;

		DWORD *addrFunctions = (DWORD *)((DWORD)pFileBuffer + RVAToFOA(ped->AddressOfFunctions, pFileBuffer));
		DWORD *addrName = (DWORD *)((DWORD)pFileBuffer + RVAToFOA(ped->AddressOfNames, pFileBuffer));
		WORD  *addrOrdinals = (WORD  *)((DWORD)pFileBuffer + RVAToFOA(ped->AddressOfNameOrdinals, pFileBuffer));
		DWORD i, j;
		for(i = 0; i < ped->NumberOfFunctions; i++){
			if(addrFunctions[i] == 0){
				continue;
			}
			for(j = 0; j < ped->NumberOfNames; j++){
				if(addrOrdinals[j] == i){
					printf("-\t\t%04x\t\t%08x\t%s\n", ped->Base + i, addrFunctions[i], RVAToFOA(addrName[j], pFileBuffer) + (DWORD)pFileBuffer);
					break;
				}
			}
			if(j != ped->NumberOfNames){
				continue;
			}
			else{
				printf("-\t\t%04x\t\t%08x\t%s\n", ped->Base + i, addrFunctions[i],"-----------------");
			}
		
		}
	}
	
	
}