滴水逆向三期 PE基础 绑定导入表

分析

系统软件会有绑定导入表 也就是IAT已经被设定为函数地址, 但是WIN10中即便是记事本也没了, 只能用xp的notepad代替.
这个表的目的是减少程序启动时间, 在导入表中时间戳为-1时代表有绑定导入表.

OffsetModule这个值需要加上第一个IMAGE_BOUND_IMPORT_DESCRIPTOR的地址, 而不是当前dll的地址

NumOfModuleForwarderRefs表示当前dll所需要的其它dll, 在当前绑定导入表之后紧跟的结构就是

typedef struct _IMAGE_BOUND_FORWARDER_REF {
         DWORD TimeDateStamp;
         WORD OffsetModuleName;
         WORD Reserved;
} IMAGE_BOUND_FORWARDER_REF, *PIMAGE_BOUND_FORWARDER_REF;

由于结构相同, 写程序也方便, 顺着遍历即可, 最后一步再根据个数来给FORWARDER_REF进行标记.
如图, 分为三步

1 遍历BoundImportDescriptor

2 遍历DLL: Name TIme

3 给FORWARDER_REF进行标记

第三步因为具有相同结构我就直接加了个变量给它们标记一下, 想输出不同格式再写一遍主体即可

代码

1 打印BoundImportDescriptor

while (pBoundImportDescriptor->TimeDateStamp)
{
	DWORD timeStamp = pBoundImportDescriptor->TimeDateStamp;
	DWORD offsetMoudleName = pBoundImportDescriptor->OffsetModuleName;
	DWORD numOfMoudleForwarderRefs = pBoundImportDescriptor->NumberOfModuleForwarderRefs;
	printf("TimeDateStamp: %x,    OffsetModuleName: %x,    NumOfMoudleForwarderRefs: %x\n\n", timeStamp, offsetMoudleName, numOfMoudleForwarderRefs);

	pBoundImportDescriptor++;
}

2 3 打印dll名称和时间

//时间
time_t rawtime = timeStamp;
struct tm* timeinfo;
char timeStr[80];
timeinfo = localtime((time_t *)&rawtime);
strftime(timeStr, 80, "GMT:%Y-%m-%d %I:%M:%S\n", timeinfo);
printf("%s", timeStr);

//名称
char *NameOfDLL = (char *)((DWORD)pFileBuffer + FOA_BoundImportDescriptor + offsetModuleName);
printf("DLL's Name: %s\n\n", NameOfDLL);

结果

3 标记FORWARDER_REFS

在循环外加一个currentDLL_NOMFR代表当前DLL依附的DLL数目
最终代码

pDataDirectory = header.pOptionalHeader->DataDirectory;
FOA_BoundImportDescriptor = RvaDataToFoaData(pFileBuffer, (*(pDataDirectory + 11)).VirtualAddress, FALSE);
pBoundImportDescriptor = (PIMAGE_BOUND_IMPORT_DESCRIPTOR)((DWORD)pFileBuffer + FOA_BoundImportDescriptor);
DWORD currentDLL_NOMFR = 0;

while (pBoundImportDescriptor->TimeDateStamp)
{
	if (currentDLL_NOMFR)
	{
		printf("The following %d items are ForwarderRefs\n", currentDLL_NOMFR--);
		printf("--------------------------------------------------------------------------------\n");
	}

	DWORD timeStamp = pBoundImportDescriptor->TimeDateStamp;
	DWORD offsetModuleName = pBoundImportDescriptor->OffsetModuleName;
	DWORD numOfModuleForwarderRefs = pBoundImportDescriptor->NumberOfModuleForwarderRefs;
	printf("TimeDateStamp: %x    OffsetModuleName: %x    NumOfModuleForwarderRefs: %xh\n", timeStamp, offsetModuleName, numOfModuleForwarderRefs);

	//NumOfMouleForwarderRefs
	if (numOfModuleForwarderRefs)
	{
		printf("Current DLL has forwarder_ref(s): %xh \n",numOfModuleForwarderRefs);
		currentDLL_NOMFR = numOfModuleForwarderRefs;
	}

	//TimeStamp
	time_t rawtime = timeStamp;
	struct tm* timeinfo;
	char timeStr[80];
	timeinfo = localtime((time_t *)&rawtime);
	strftime(timeStr, 80, "GMT:%Y-%m-%d %I:%M:%S\n", timeinfo);
	printf("%s", timeStr);

	//DLL' Name
	//偏移只需用第一个绑定导入表的即可 后续不变
	char *NameOfDLL = (char *)((DWORD)pFileBuffer + FOA_BoundImportDescriptor + offsetModuleName);
	printf("DLL's Name: %s\n\n", NameOfDLL);

	pBoundImportDescriptor++;;
		
}

结果

一点问题

貌似没啥用了这个表, 我在win10找了一圈没发现有绑定导入表的文件
ps: 建了个学习讨论群, 欢迎新朋友加入:1094301686