打印绑定导入表

void printBoundImport(char* buffer)
{
    PIMAGE_DOS_HEADER pDosH = (PIMAGE_DOS_HEADER)(buffer);
    PIMAGE_NT_HEADERS pNTH = (PIMAGE_NT_HEADERS)(buffer + pDosH->e_lfanew);
    PIMAGE_FILE_HEADER pFH = (PIMAGE_FILE_HEADER)((char*)pNTH + 0x4);
    PIMAGE_OPTIONAL_HEADER pOH = (PIMAGE_OPTIONAL_HEADER)((char*)pFH + 0x14);
    int opHeaderLen = int(pFH->SizeOfOptionalHeader);
    PIMAGE_SECTION_HEADER pSecH = (PIMAGE_SECTION_HEADER)((char*)pOH + opHeaderLen);
    PIMAGE_DATA_DIRECTORY pdd = (PIMAGE_DATA_DIRECTORY)(&(pOH->DataDirectory[11]));
    int BIDVA = pdd->VirtualAddress;
    if (BIDVA == 0)
    {
        cout << "无绑定导入表" << endl;
        exit(0);
    }
    PIMAGE_BOUND_IMPORT_DESCRIPTOR pBID = (PIMAGE_BOUND_IMPORT_DESCRIPTOR)((char*)buffer + rvaTofoa(BIDVA,buffer));
    //cout << hex << rvaTofoa(BIDVA, buffer) << endl;
    char* offsetBegin = (char*)pBID;
    while (pBID->OffsetModuleName != 0)
    {
        char myStr[25] = { 0 };
        time_t cur_t = pBID->TimeDateStamp;
        struct tm* t = gmtime(&cur_t);
        t->tm_hour += 8;//转为北京时间记的要加8
        std::string myFormat = "%Y-%m-%d:%H:%M:%S";
        strftime(myStr, sizeof(myStr), myFormat.c_str(), t);
        for (int i = 0; myStr[i]; ++i)
        {
            cout << myStr[i];
        }
        cout << endl;
        int offsetModuleName = pBID->OffsetModuleName;
        char* nameFA = offsetModuleName + offsetBegin;
        printf("%s\r\n", nameFA);
        int numOfref = pBID->NumberOfModuleForwarderRefs;
        if (numOfref == 0)
        {
            pBID = (PIMAGE_BOUND_IMPORT_DESCRIPTOR)(pBID + 1);
        }
        else
        {
            pBID = (PIMAGE_BOUND_IMPORT_DESCRIPTOR)(pBID + numOfref);
        }
    }
}