{
MEMORY_BASIC_INFORMATION mbi;
return ((::VirtualQuery(GetSelfModuleHandle, &mbi, sizeof(mbi)) != 0)
? (HMODULE) mbi.AllocationBase : NULL);
}
HMODULE hmd =LoadLibrary(_T("C:/Documents and Settings/Administrator/桌面/NOTEPAD.EXE"));
ULONG size;
PIMAGE_IMPORT_DESCRIPTOR pImport=(PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData
(hmd,true,IMAGE_DIRECTORY_ENTRY_IMPORT,&size);
while (pImport->FirstThunk)
{
char *pDllName = (char *)((BYTE *)hmd+pImport->Name);
printf("DLL文件名:%s\n", pDllName);
//通过OriginalFirstThunk定位到IMAGE_THUNK_DATA结构数组
IMAGE_THUNK_DATA *Thunk = (IMAGE_THUNK_DATA *)((BYTE *)hmd + pImport->OriginalFirstThunk);
while (Thunk->u1.Function)
{
//判断函数是用函数名导入的还是序号导入的
if (Thunk->u1.Ordinal & 0xffff)
{
//输出序号
printf("从此DLL导出的函数序号为:%x\n",Thunk->u1.Ordinal&0xffff);
}
else//得到IMAGE_IMPORT_BY_NAME结构中的函数名
{
IMAGE_IMPORT_BY_NAME *importname = (IMAGE_IMPORT_BY_NAME *)((BYTE *)lpdata + Thunk->u1.AddressOfData);
printf("从此DLL导出的函数名为:%s\n",importname->Name);
}
Thunk++;
}
pImport++;
}