打印导入表

一、流程

1、File-> FileBuffer
2、定位导入表
3、循环导入表
4、获取导入表名字
5、获取INT表RVA
6、获取INT表的地址和序号
7、循环打印INT表的内容
8、获取IAT表RVA
9、获取IAT表的地址和序号
10、循环打印IAT表的内容

二、演示

1、File-> FileBuffer
2、定位导入表

   PIMAGE_DOS_HEADER pDosHeader = NULL;//DOS头
        PIMAGE_NT_HEADERS pNtHeader = NULL;//NT头
        PIMAGE_FILE_HEADER pFileHeader = NULL;//标准PE头
        PIMAGE_OPTIONAL_HEADER pOptionalHeader = NULL;//拓展PE头
        PIMAGE_IMPORT_DESCRIPTOR pImportDirectory = NULL; //导入表结构体

        pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;
        pNtHeader = (PIMAGE_NT_HEADERS)((DWORD)pDosHeader + pDosHeader->e_lfanew);
        pFileHeader = (PIMAGE_FILE_HEADER)((DWORD)pNtHeader + 4);
        pOptionalHeader = (PIMAGE_OPTIONAL_HEADER)((DWORD)pFileHeader + IMAGE_SIZEOF_FILE_HEADER);


		DWORD ImportRva = pOptionalHeader->DataDirectory[1].VirtualAddress;	//导入表Rva
		DWORD ImportFoa = 0;

		//	(1)、判断导入表是否存在
		if (ImportRva == 0)
		{
			printf("导入表不存在!\n");
			return;
		}

		ImportFoa = RvaToFoa(ImportRva,pFileBuffer);//导入表FOA

		if (ImportFoa == 0)
		{
			printf("ImportFoa  Rva转Foa失败!\n");
			return;
		}

		pImportDirectory = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD)pFileBuffer + ImportFoa);//获取导入表地址

3、循环导入表

while (pImportDirectory->FirstThunk && pImportDirectory->OriginalFirstThunk)
		{
			pImportDirectory++;
		}

4、获取导入表名字

printf("=========================ImportTable %s Start=============================\n", (PBYTE)((DWORD)pFileBuffer + RvaToFoa(pImportDirectory->Name,pFileBuffer)));