修复动态链接库.so的导入表

此文为从内存中dump下来的内存，其中程序头部表需要重新修复，程序各个节点也需要修改

其他可在网上找到源码，此文写出自己修复导入表的部分

此文dump下的.so导出表可在Symbol Table上找到导入项，在String Table中可找到对应的字符串，然后在RELPLT节区配置与导入表对应的地址，则可修复.so的导入表配置

1.找到GLOBAL_OFFSET_TABLE区域

int FixTool::find_GLOBAL_OFFSET_TABLE_Pos(char* buffer_new)
{
	int i = 0;

	for (i; i < shdr[GOT].sh_size; i += 4 )
	{
		buffer_new + shdr[GOT].sh_offset + i;
		if (*(long*)(buffer_new + shdr[GOT].sh_offset + i) == 0 && *(int*)(buffer_new + shdr[GOT].sh_offset + i + 8) == 0)
		{
			break;
        }
	}
	
	return shdr[GOT].sh_offset + i;
}

修复函数:

void FixTool::fix_Import_table(char* buffer_new)
{
	int GLOBALPos = find_GLOBAL_OFFSET_TABLE_Pos(buffer_new);

	int Relplt = shdr[RELPLT].sh_offse;//链接表起始地址
	int ReLen = shdr[RELPLT].sh_size / 8;//链接表的个数
	int ImportBaseAddr = shdr[STRTAB].sh_offset + 4;//导入函数起始地址
    
    //ELF Symbol Table
	int SymbolAddr = shdr[DYNSYM].sh_offset;//名称
	int SymbolSize = shdr[DYNSYM].sh_size/0x10;//size

	//ELF String Table
	int FuncNameAddr = shdr[DYNSTR].sh_offset;//名称
	int FuncNameSize = shdr[DYNSTR].sh_size;//size

	map<int, int> ImportList;
    int j = 0;
	FILE* fw = fopen("Text.txt", "wb");
	for (int i = 0; i < SymbolSize; i++)
	{
		Elf32_Sym sym =  *(Elf32_Sym *)(buffer_new + SymbolAddr + i * 0x10);
		if (sym.st_shndx == 0 && (sym.st_info == 0x12 || sym.st_info == 0x11))
		{
			ImportList.insert(make_pair(sym.st_name, j));
			j++;
		}
		else
		{
			string  FuncName = string(buffer_new + sym.st_name + FuncNameAddr);
			fwrite(FuncName.c_str(), FuncName.length(), 1, fw);
			fwrite("\n", 1, 1, fw);
		}
    }
	fclose(fw);

    for (int i = 0; i < ReLen; i++)
	{
		Elf32_Rel rel = *(Elf32_Rel *)(buffer_new + Relplt + i * 8);
		int index = (rel.r_info >> 8);
		Elf32_Sym sym = *(Elf32_Sym *)(buffer_new + SymbolAddr + index * 0x10);
		if (ImportList.count(sym.st_name))//string value = *(string *)(buffer_new + FuncNameAddr + sym.st_name);
		{
			int ImportAddr = ImportList[sym.st_name] * 4 + ImportBaseAddr;
			char buff[5];
            buff[0] = ImportAddr & 0xFF;
			buff[1] = (ImportAddr >> 8) & 0xFF;
			buff[2] = (ImportAddr >> 16) & 0xFF;
			buff[3] = (ImportAddr >> 24) & 0xFF;
            memcpy(buffer_new + GLOBALPos + 12, buff, 4);
			GLOBALPos += 4;
		}
	}
    return;
}