【PE学习-------导入表】

最新推荐文章于 2024-10-11 23:59:48 发布

原创最新推荐文章于 2024-10-11 23:59:48 发布 · 791 阅读

0 ·

CC 4.0 BY-SA版权

本文提供了一段C++代码，用于解析PE文件的导入表信息，包括DLL名称、时间戳等，并展示了如何读取导入函数的名称及地址。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

输出打印 PE文件的导入表信息

// ImportTable.cpp : 定义控制台应用程序的入口点。
//

#include "stdafx.h"
#include <Windows.h>
#include <DbgHelp.h>

#pragma comment(lib,"Dbghelp.lib")
PIMAGE_NT_HEADERS g_pNt = NULL;

//判断文件是否为PE文件
BOOL CheckPeFile(LPVOID ImageBase)
{
   PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)ImageBase;
   if (pDos->e_magic != IMAGE_DOS_SIGNATURE)
   {
       return FALSE;
   }
   PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)((DWORD)(ImageBase) + pDos->e_lfanew);
   if (pNt->Signature != IMAGE_NT_SIGNATURE)
   {
       return FALSE;
   }
   g_pNt = pNt;
   return TRUE;
}

//获取导入表的信息
void GetImportInfo(LPVOID ImageBase, PIMAGE_NT_HEADERS pNtHeader)
{
   DWORD dwRva = pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
   LPVOID ImportVirtual = ImageRvaToVa(pNtHeader, ImageBase, dwRva, NULL);
   PIMAGE_IMPORT_DESCRIPTOR pImport = (PIMAGE_IMPORT_DESCRIPTOR)ImportVirtual;
   DWORD dwCount = 0;
   while (pImport->FirstThunk)
   {
       LPVOID name = ImageRvaToVa(pNtHeader, ImageBase, pImport->Name, NULL);
       printf("DllName: %s\n", (char*)name);
       printf("OriginalFirstThunk:   0x%08X\n", pImport->OriginalFirstThunk);
       printf("TimeDateStamp:        0x%08X\n", pImport->TimeDateStamp);
       printf("ForwarderChain:       0x%08X\n", pImport->ForwarderChain);
       printf("Name:                 0x%08X\n", pImport->Name);
       printf("FirstThunk:           0x%08X\n", pImport->FirstThunk);
       LPVOID thunkRva = ImageRvaToVa(pNtHeader, ImageBase, pImport->OriginalFirstThunk ? \
           pImport->OriginalFirstThunk:pImport->FirstThunk, NULL);
       PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA)thunkRva;
       printf("   FunctionAddress       Hint       FunctionName       \n");
       while(pThunk->u1.Function)
       {
           printf("   0x%08X", pThunk->u1.Function);
           LPVOID byName = ImageRvaToVa(pNtHeader, ImageBase, (DWORD)pThunk->u1.AddressOfData, NULL);
           PIMAGE_IMPORT_BY_NAME pByName = PIMAGE_IMPORT_BY_NAME(byName);
           printf("       0x%04X", pByName->Hint);
           printf("      %s\n", (char*)pByName->Name);
           pThunk++;
       }
       dwCount++;
       pImport++;
   }
   printf("The total Import Table is %d\n", dwCount);

}
int _tmain(int argc, _TCHAR* argv[])
{

   if (argc != 2)
   {
       printf("请输入参数！\n");
       return -1;
   }
   HANDLE hFile = CreateFile(argv[1], GENERIC_READ, 0, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
   if (hFile == INVALID_HANDLE_VALUE)
   {
       printf("Error createfile %d\n", GetLastError());
       return -1;
   }
   DWORD dwFileSize = GetFileSize(hFile, NULL);
   HANDLE hMap = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, dwFileSize, NULL);
   if (hMap == NULL)
   {
       CloseHandle(hFile);
       return -1;
   }
    //映射文件到内存中
   LPVOID ImageBase = MapViewOfFile(hMap, FILE_MAP_READ, 0, 0, dwFileSize);
   if (ImageBase == NULL)
   {
       CloseHandle(hFile);
       UnmapViewOfFile(hMap);
       return -1;
   }
   printf("MapView success !\n");
   if (!CheckPeFile(ImageBase))
   {
       printf("This is not PE file\n");
       return 0;
   }
   printf("-----------------------Import--Information---------------------------\n");

   GetImportInfo(ImageBase, g_pNt);
   printf("----------------------------End--------------------------------------\n");
   CloseHandle(hFile);
   UnmapViewOfFile(hMap);
   return 0;
}

初学PE文件，有不足的地方请指出;高手飘过

可编译代码下载地址点击打开链接