寻找导入表

Demo.cpp

// Demo.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include "stdafx.h"

int _tmain(int argc, _TCHAR* argv[])
{

	HMODULE hModule = GetModuleHandle(NULL);
	printf("start: %p\n",hModule);

	PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)hModule;
	if(pDosHeader->e_magic !=  IMAGE_DOS_SIGNATURE) {
		printf("unkonw file type\n");
		return -1;
	}

	PIMAGE_NT_HEADERS pHeader = (PIMAGE_NT_HEADERS)((char *)hModule + pDosHeader->e_lfanew);
	if(pHeader->Signature != IMAGE_NT_SIGNATURE){
		printf("unkonw file type\n");
		return -1;
	}

	IMAGE_DATA_DIRECTORY importDirectory = pHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
	printf("导入表 VirtualAddress = %x, size = %x\n", importDirectory.VirtualAddress, importDirectory.Size);

	//寻找导入表位置
	PIMAGE_IMPORT_DESCRIPTOR pImport = (PIMAGE_IMPORT_DESCRIPTOR)((char *)hModule + importDirectory.VirtualAddress);
	while(pImport->OriginalFirstThunk != 0){
		printf("Name :%s\n",(char *)hModule + pImport->Name);
		PIMAGE_THUNK_DATA pThunkData = (PIMAGE_THUNK_DATA)((char *)hModule + pImport->OriginalFirstThunk );
		PIMAGE_THUNK_DATA pFunctionAddressThunkData = (PIMAGE_THUNK_DATA)((char *)hModule + pImport->FirstThunk );
		while(pThunkData->u1.AddressOfData!=0){
			PIMAGE_IMPORT_BY_NAME pImportName = (PIMAGE_IMPORT_BY_NAME)((char *)hModule + pThunkData->u1.AddressOfData );
			printf("Function :%s - 0x%x\n",pImportName->Name,pFunctionAddressThunkData->u1.AddressOfData);
			pThunkData += 1;
			pFunctionAddressThunkData ++;
		}
		pImport += 1;
	}
	getchar();
	return 0;
}