DLL注入_修改导入表(2)

在内存中查看dll函数

(一) PE内存镜像分析

• dll_main.exe NT_HEADERS = E8H

• IMAGE_BASE(memory) = NT_HEADERS -> IMAGE_OPTIONAL_HEADER32-> ImageBase (NT+34H)

E8H + +34H = 11CH   ,查看11CH的内容
 Offset    0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F   Ascii

00000110  CE 6A 00 00 00 10 00 00 00 30 01 00 00 00 40 00  蝚......0...@.

IMAGE_BASE(mem) = 0x0040 0000H ,程序装入的首选VA地址

SectionAlignment(mem) = NT_HEADERS -> IMAGE_OPTIONAL_HEADER32 -> SectionAlignment (NT+38H)

E8H + +38H = 120H   ,查看120H的内容
 Offset    0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F   Ascii

00000120  00 10 00 00 00 10 00 00 04 00 00 00 00 00 00 00  .............

SectionAlignment(mem) = 1000H ,块在内存中的对齐大小

NumberOfSections = NT_HEADERS->IMAGE_FILE_HEADER-> NumberOfSections (NT+