C语言编写控制台下PE分析工具（四）

八、获取输入表信息

1、获取输入表地址

PIMAGE_IMPORT_DESCRIPTOR GetFirstImportDesc(LPVOID ImageBase)

{

if (!ImageBase)

{

return nullptr;

}

PIMAGE_IMPORT_DESCRIPTOR pID = (PIMAGE_IMPORT_DESCRIPTOR)GetDirectoryEntryToData(ImageBase, IMAGE_DIRECTORY_ENTRY_IMPORT);

if (!pID)

{

return nullptr;

}

return pID;

}

2、输出输入dll

void ShowImportDirectory(PMAP_FILE_STRUCT stMapFile)

{

PIMAGE_IMPORT_DESCRIPTOR pID = GetFirstImportDesc(stMapFile->ImageBase);

if (!pID)

{

return;

}

PIMAGE_NT_HEADERS pNH = GetNtHeaders(stMapFile->ImageBase);

if (!pNH)

{

return;

}

printf("\n\n[Import Table]\n");

printf("%-15s %s %s %s %s %s\n","DLLName", "OrigFstThunk", "TDStamp", "ForderChin",

"Name", "FirstThunk");

while (pID->FirstThunk)

{

char *dllName = (char *)ImageRvaToVa(pNH, stMapFile->ImageBase, pID->Name, NULL);

printf("%-15s %08lX %08lX %08lX %08lX %08lX\n", dllName, pID->OriginalFirstThunk, pID->TimeDateStamp, pID->ForwarderChain,

pID->Name, pID->FirstThunk);

pID++;

}

}

结果如图所示：