打印导入表

打印这个表比较简单，看图说话水准

//打印导入表
VOID PrintImportTalbe(PVOID fileName) {
	PVOID pFileBuffer = FileToFileBuffer(fileName);
	//定位导入表
	PIMAGE_DOS_HEADER pDosHeader = pFileBuffer;
	PIMAGE_NT_HEADERS pNTHeader = (DWORD)pDosHeader + pDosHeader->e_lfanew;
	if (pNTHeader->Signature != IMAGE_NT_SIGNATURE) {
		printf("File is not PE\n");
		free(pFileBuffer);
		return FALSE;
	}
	PIMAGE_FILE_HEADER pFileHeader = &pNTHeader->FileHeader;
	PIMAGE_OPTIONAL_HEADER pOptHeader = (DWORD)pFileHeader + sizeof(IMAGE_FILE_HEADER);
	PIMAGE_SECTION_HEADER pSecHeader = (DWORD)pOptHeader + pFileHeader->SizeOfOptionalHeader;
	PIMAGE_IMPORT_DESCRIPTOR pImportTable =
		VAToFOA(pOptHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress, pFileBuffer);
	while (pImportTable->OriginalFirstThunk) {
		printf("-------------------------------------\n");
		printf("%s\n", (PBYTE)VAToFOA(pImportTable->Name,pFileBuffer));
		PDWORD pThunkData = VAToFOA(pImportTable->OriginalFirstThunk, pFileBuffer);
		while (*pThunkData) {
			if (*pThunkData) {
				if (*pThunkData & 0x80000000) {
					printf("function import by ordinals:%x\n", *pThunkData & 0x7fffffff);
				}
				else {
					printf("function import by name:");
					PIMAGE_IMPORT_BY_NAME pImportByName = VAToFOA(*pThunkData, pFileBuffer);
					printf("%s\n", pImportByName->Name);
				}
			}
			pThunkData++;
		}
		pImportTable++;
	}
	free(pFileBuffer);
}