没什么难度,体力活
//打印导出表
BOOL PrintExportTable(BYTE* fileName) {
PVOID pFileBuffer = FileToFileBuffer(fileName);
PIMAGE_DOS_HEADER pDosHeader = pFileBuffer;
PIMAGE_NT_HEADERS pNTHeader = (DWORD)pDosHeader + pDosHeader->e_lfanew;
if (pNTHeader->Signature != IMAGE_NT_SIGNATURE) {
printf("File is not PE\n");
free(pFileBuffer);
return FALSE;
}
PIMAGE_FILE_HEADER pFileHeader = &pNTHeader->FileHeader;
PIMAGE_OPTIONAL_HEADER pOptHeader = (DWORD)pFileHeader + sizeof(IMAGE_FILE_HEADER);
PIMAGE_SECTION_HEADER pSecHeader = (DWORD)pOptHeader + pFileHeader->SizeOfOptionalHeader;
PIMAGE_EXPORT_DIRECTORY pExportTable = VAToFOA(pOptHeader->DataDirectory[0].VirtualAddress, pFileBuffer);
printf("name:%08x\n", pExportTable->Name);
printf("Base:%08x\n", pExportTable->Base);
printf("NumberOfFunctions:%08x\n", pExportTable->NumberOfFunctions);
printf("NumberOfNames:%08x\n", pExportTable->NumberOfNames);
PDWORD pAddrOfFunctionsFOA = VAToFOA(pExportTable->AddressOfFunctions, pFileBuffer);
for (size_t i = 0; i < pExportTable->NumberOfFunctions; i++) {
printf("Function Address:%08x\n", *(pAddrOfFunctionsFOA + i));
}
PDWORD pAddrOfNameFOA = VAToFOA(pExportTable->AddressOfNames, pFileBuffer);
for (size_t i = 0; i < pExportTable->NumberOfNames; i++) {
PBYTE name = VAToFOA(*(pAddrOfNameFOA + i), pFileBuffer);
printf("Function name:%s\n", name);
}
PWORD pAddrOfNameOrdinalsFOA = VAToFOA(pExportTable->AddressOfNameOrdinals, pFileBuffer);
for (size_t i = 0; i < pExportTable->NumberOfNames; i++) {
printf("Function name ordinals:%04x\n", *(pAddrOfNameOrdinalsFOA + i));
}
return TRUE;
}
//根据名字寻找函数地址
PVOID GetFunctionAddrByName(PVOID pFileBuffer, PBYTE pFunctionName) {
PIMAGE_DOS_HEADER pDosHeader = pFileBuffer;
PIMAGE_NT_HEADERS pNTHeader = (DWORD)pDosHeader + pDosHeader->e_lfanew;
if (pNTHeader->Signature != IMAGE_NT_SIGNATURE) {
printf("File is not PE\n");
free(pFileBuffer);
return FALSE;
}
PIMAGE_FILE_HEADER pFileHeader = &pNTHeader->FileHeader;
PIMAGE_OPTIONAL_HEADER pOptHeader = (DWORD)pFileHeader + sizeof(IMAGE_FILE_HEADER);
PIMAGE_SECTION_HEADER pSecHeader = (DWORD)pOptHeader + pFileHeader->SizeOfOptionalHeader;
PIMAGE_EXPORT_DIRECTORY pExportTable = VAToFOA(pOptHeader->DataDirectory[0].VirtualAddress, pFileBuffer);
PDWORD pAddrOfNamesFOA = VAToFOA(pExportTable->AddressOfNames, pFileBuffer);
for (size_t i = 0; i < pExportTable->NumberOfNames; i++) {
PBYTE pName = VAToFOA(*(pAddrOfNamesFOA + i), pFileBuffer);
if (!strcmp(pName,pFunctionName)) {
PWORD pAddrOfOrdinalsFOA = VAToFOA(pExportTable->AddressOfNameOrdinals, pFileBuffer);
PDWORD pFunctionAddrFOA = VAToFOA(pExportTable->AddressOfFunctions, pFileBuffer);
PVOID pFunctionAddr = *(pFunctionAddrFOA + *(pAddrOfOrdinalsFOA + i));
printf("Found it!Function Address:0x%08p\n", pFunctionAddr);
return pFunctionAddr;
}
}
printf("cant find it\n");
return 0;
}
//根据序号寻找,多写了一点还把名字算出来了
PVOID GetFunctionAddrByOrdinals(PVOID pFileBuffer, DWORD ordinals) {
PIMAGE_DOS_HEADER pDosHeader = pFileBuffer;
PIMAGE_NT_HEADERS pNTHeader = (DWORD)pDosHeader + pDosHeader->e_lfanew;
if (pNTHeader->Signature != IMAGE_NT_SIGNATURE) {
printf("File is not PE\n");
free(pFileBuffer);
return FALSE;
}
PIMAGE_FILE_HEADER pFileHeader = &pNTHeader->FileHeader;
PIMAGE_OPTIONAL_HEADER pOptHeader = (DWORD)pFileHeader + sizeof(IMAGE_FILE_HEADER);
PIMAGE_SECTION_HEADER pSecHeader = (DWORD)pOptHeader + pFileHeader->SizeOfOptionalHeader;
PIMAGE_EXPORT_DIRECTORY pExportTable = VAToFOA(pOptHeader->DataDirectory[0].VirtualAddress, pFileBuffer);
DWORD number = ordinals - pExportTable->Base;
if (number >= pExportTable->NumberOfFunctions) {
printf("cant find it\n");
return 0;
}
PBYTE pName = 0;
if (number >= pExportTable->NumberOfNames) {
pName = "no name";
}
else {
PWORD pAddressOrdinalsFOA = VAToFOA(pExportTable->AddressOfNameOrdinals, pFileBuffer);
PDWORD pAddressNamesFOA = VAToFOA(pExportTable->AddressOfNames, pFileBuffer);
for (size_t i = 0; i < pExportTable->NumberOfNames; i++) {
if (number == pAddressOrdinalsFOA[i]) {
pName = VAToFOA(pAddressNamesFOA[i], pFileBuffer);
break;
}
}
}
PDWORD pFunctionAddressFOA = VAToFOA(pExportTable->AddressOfFunctions, pFileBuffer);
printf("Found it!Function name:%s address:%08x\n", pName, *(pFunctionAddressFOA + number));
return *(pFunctionAddressFOA + number);
}