//功能:得到某个API函数(导入函数)代码地址
//参数:
//pImport: PIMAGE_IMPORT_DESCRIPTOR
//pProcName: 函数名或序号
const FARPROC GetFunctionFARPROC(
PIMAGE_IMPORT_DESCRIPTOR pImport, LPCSTR pProcName)
{
PIMAGE_THUNK_DATA pThunk;
pThunk = (PIMAGE_THUNK_DATA) RVA2Ptr(pImport->
OriginalFirstThunk);
for (int i=0; pThunk->u1.Function; i++)
{
bool match;
if ( pThunk->u1.Ordinal & 0x80000000 ) // by ordinal
match = (pThunk->u1.Ordinal & 0xFFFF) ==
((DWORD) pProcName);
else
match = stricmp(pProcName, RVA2Ptr((unsigned)
pThunk->u1.AddressOfData)+2) == 0;
if ( match )
return (FARPROC)*((unsigned *) RVA2Ptr(pImport->FirstThunk)+i);
//pImport->FirstThunk:
//该字段是指向一32位以00结束的RVA偏移地址串,此地址串中每个地址描述一个输入函数(函数在内存中的地址的地址),
//它在输入表中的顺序是可变的。
pThunk ++;
}
return NULL;
}