IMAGE_EXPORT_DIRECTORY

<span style="font-size:12px;">typedef struct _IMAGE_EXPORT_DIRECTORY {
	DWORD Characteristics;
	DWORD TimeDateStamp;			//creation time date stamp
	WORD MajorVersion;
	WORD MinorVersion;
	DWORD Name;						//address of library file name
	DWORD Base;						//ordinal base
	DWORD NumberOfFunctions;		//number of functions
	DWORD NumberOfNames;			//number of names
	DWORD AddressOfFunctions;		//address of function start address array
	DWORD AddressOfNames;			//address of function name string array
	DWORD AddressOfNameOrdinals;	//address of ordinal array
} IMAGE_EXPORT_DIRECTORYM, *pIMAGE_EXPORT_DIRECTORY;</span>

NumberOfFunctions       实际Export函数的个数

NumberOfNames           Export函数中具名的函数个数

AddressOfFunctions      Export函数地址数组(数组元素个数 == NumberOfFunctions)    

AddressOfNames           函数名称地址数组(数组元素个数 == NumberOfNames)

AddressOfNameOrdinals    Ordinal地址数组(数组元素个数 == NumberOfNames)

GetProcAddress()操作原理

1.利用AddressOfNames 成员转到 “函数名称数组”

2.“函数名称数组“中存储着字符串地址。通过比较(strcmp)字符串，查找指定的函数名称(此时数组的索引称为name_index)

3.利用AddressOfNameOrdinals成员，转到orinal数组

4.在orinal数组中通过name_index查找相应orinal值

5.利用AddressOfFunctions成员转到”函数地址数组“(EAT)

6.在”函数地址数组”中将刚刚求得的ordinal用作数组索引，获得指定函数的起始地址