PE文件结构（五）延迟导入表,资源表以及其他数据表

延迟导入表

延迟导入表主要是为了加快进程的运载速度而存在,其具体结构如下:

typedef struct _IMAGE_DELAYLOAD_DESCRIPTOR {
   
    union {
                                    //这个联合体是该表的属性
        DWORD AllAttributes;
        struct {
   
            DWORD RvaBased : 1;             // Delay load version 2
            DWORD ReservedAttributes : 31;
        } DUMMYSTRUCTNAME;
    } Attributes;

    DWORD DllNameRVA;                       // RVA to the name of the target library (NULL-terminate ASCII string)
    DWORD ModuleHandleRVA;                  // RVA to the HMODULE caching location (PHMODULE)
    DWORD ImportAddressTableRVA;            // RVA to the start of the IAT (PIMAGE_THUNK_DATA)
    DWORD ImportNameTableRVA;               // RVA to the start of the name table (PIMAGE_THUNK_DATA::AddressOfData)
    DWORD BoundImportAddressTableRVA;       // RVA to an optional bound IAT
    DWORD UnloadInformationTableRVA;        // RVA to an optional unload info table
    DWORD TimeDateStamp;                    // 0 if not bound,时间戳
                                            // Otherwise, date/time of the target DLL

} IMAGE_DELAYLOAD_DESCRIPTOR, *PIMAGE_DELAYLOAD_DESCRIPTOR;

解析函数如下:

//解析延迟导入表的函数
void DelayImportTable(char * buffer)
{
   
	//Dos头
	PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)buffer;
	//PE头
	PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(pDos->e_lfanew + buffer);
	//定义数据目录表中的延迟导入表
	PIMAGE_DATA_DIRECTORY pImportDir = (pNt->OptionalHeader.DataDirectory + IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT);
	//填充延迟导入表的数据结构
	PIMAGE_DELAYLOAD_DESCRIPTOR pDelayLoad = (PIMAGE_DELAYLOAD_DESCRIPTOR)(RvaToOffset(pImportDir->VirtualAddress, buffer) + buffer);
	//打印属性
	while (pDelayLoad->DllNameRVA != NULL)
	{
   
		char* szDllName = (char*)(RvaToOffset(pDelayLoad->DllNameRVA, buffer) + buffer);
		printf("DllName:%s\n", szDllName);
		printf("Attributes:%08X\n", pDelayLoad->Attributes);
		printf("ModuleHandleRVA:%08X\n", pDelayLoad->ModuleHandleRVA);
		printf("ImportAddressTableRVA:%08X\n", pDelayLoad->ImportAddressTableRVA);
		printf("ImportNameTableRVA:%08X\n", pDelayLoad->ImportNameTableRVA);
		printf("BoundImportAddressTableRVA:%08X\n", pDelayLoad->BoundImportAddressTableRVA);
		printf("UnloadInformationTableRVA:%08X\n", pDelayLoad->UnloadInformationTableRVA);
		printf("TimeDateStamp:%08X\n\n", pDelayLoad->TimeDateStamp);
		pDelayLoad++;
	}
}

运行结果:

资源表

资源表主要有三层构成,从根目录表开始,有资源