c – 如何阅读C中的导入目录表

>获取文件的内存映射基址.
>获取指向IMAGE_NT_HEADERS结构的指针.
>获取指向IMAGE_SECTION_HEADER结构的指针.
> DataDirectory是OptionalHeader的最后128个字节,而后者又是PE头IMAGE_NT_HEADERS的最终成员.
该结构有2个成员,包含数据结构的位置和大小.
如果要查找有关dll名称的信息,首先要从数据目录中找到导入目录的RVA(相对虚拟地址),在原始部分数据中找到该地址,现在您有一个IMAGE_IMPORT_DESCRIPTOR数组.通过检查Name字段指向的字符串,获取与映射图像相关的此数组的成员.

我不会描述可移植可执行文件格式的结构,但您可以查看以下链接：
Peering Inside the PE
Microsoft Systems Journal

你的代码中的一些变量没有被声明,这是令人困惑的,但坚持你的骨架代码我写它,以便它符合你的问题.

DWORD Rva2Offset(DWORD rva,PIMAGE_SECTION_HEADER psh,PIMAGE_NT_HEADERS pnt);
int _tmain(int argc,_TCHAR* argv[])
{
LPCWSTR fNmae=L"C:Windowssystem32notepad.exe";
HANDLE handle=CreateFile(fNmae/*"messagebox.exe"*/,0);
DWORD byteread,size=GetFileSize(handle,NULL);
PVOID virtualpointer=VirtualAlloc(NULL,PAGE_READWRITE);
ReadFile(handle,NULL);
CloseHandle(handle);
// Get pointer to NT header
PIMAGE_NT_HEADERS           ntheaders=(PIMAGE_NT_HEADERS)(PCHAR(virtualpointer) + PIMAGE_DOS_HEADER(virtualpointer)-> e_lfanew);   
PIMAGE_SECTION_HEADER       pSech=IMAGE_FIRST_SECTION(ntheaders);//Pointer to first section header
PIMAGE_IMPORT_DESCRIPTOR    pImportDescriptor; //Pointer to import descriptor 
__try
{
    if(ntheaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size != 0)/*if size of the table is 0 - Import Table does not exist */
    {
        pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD_PTR)virtualpointer +
                            Rva2Offset(ntheaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress,pSech,ntheaders));
        LPSTR libname[256];
        size_t i=0;
        // Walk until you reached an empty IMAGE_IMPORT_DESCRIPTOR
        while(pImportDescriptor->Name != NULL)
        {
            printf("Library Name   :");
            //Get the name of each DLL
            libname[i]=(PCHAR)((DWORD_PTR)virtualpointer + Rva2Offset(pImportDescriptor->Name,ntheaders));
            printf("%sn",libname[i]);
            pImportDescriptor++; //advance to next IMAGE_IMPORT_DESCRIPTOR
            i++;

        }

    }
    else
    {
        printf("No Import Table!n");
        return 1;
    }
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
    if(EXCEPTION_ACCESS_VIOLATION == GetExceptionCode())
    {
        printf("Exception: EXCEPTION_ACCESS_VIOLATIONn");
        return 1;
    }

}
if(virtualpointer)
    VirtualFree(virtualpointer,MEM_DECOMMIT);

return 0;
}
 /*Convert Virtual Address to File Offset */
DWORD Rva2Offset(DWORD rva,PIMAGE_NT_HEADERS pnt)
{
    size_t i = 0;
    PIMAGE_SECTION_HEADER pSeh;
    if(rva == 0)
    {
            return (rva);
    }
    pSeh = psh;
    for(i = 0; i < pnt->FileHeader.NumberOfSections; i++)
    {
            if(rva >= pSeh->VirtualAddress && rva < pSeh->VirtualAddress +
               pSeh->Misc.VirtualSize)
            {
                    break;
            }
            pSeh++;
    }
    return (rva - pSeh->VirtualAddress + pSeh->PointerToRawData);
}