zoukankan      html  css  js  c++  java
  • 零基础逆向工程22_PE结构06_导入表

    导入表结构

    typedef struct _IMAGE_IMPORT_DESCRIPTOR {									
        union {									
            DWORD   Characteristics;           									
            DWORD   OriginalFirstThunk;         						//RVA 指向IMAGE_THUNK_DATA结构数组			
        };									
        DWORD   TimeDateStamp;               						//时间戳			
        DWORD   ForwarderChain;              									
        DWORD   Name;						//RVA,指向dll名字,该名字已0结尾			
        DWORD   FirstThunk;                 						//RVA,指向IMAGE_THUNK_DATA结构数组			
    } IMAGE_IMPORT_DESCRIPTOR;									
    typedef IMAGE_IMPORT_DESCRIPTOR UNALIGNED *PIMAGE_IMPORT_DESCRIPTOR;
    
    

    PE文件加载前:

    PE文件加载后:

    typedef struct _IMAGE_THUNK_DATA32 {												
        union {												
            PBYTE  ForwarderString;												
            PDWORD Function;												
            DWORD Ordinal;						//序号						
            PIMAGE_IMPORT_BY_NAME  AddressOfData;						//指向IMAGE_IMPORT_BY_NAME						
        } u1;												
    } IMAGE_THUNK_DATA32;												
    typedef IMAGE_THUNK_DATA32 * PIMAGE_THUNK_DATA32;												
    
    typedef struct _IMAGE_IMPORT_BY_NAME {												
        WORD    Hint;						//可能为空,编译器决定 如果不为空 是函数在导出表中的索引						
        BYTE    Name[1];						//函数名称,以0结尾						
    } IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;		
    

    打印导入表的过程:

    1.定位导入表:

    目录项目的第2个结构就是导入表
    
    typedef struct _IMAGE_DATA_DIRECTORY {
        DWORD   VirtualAddress;					//RVA 指向导入表结构
        DWORD   Size;
    } IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
    
    	将RVA转换成FOA
    
    typedef struct _IMAGE_IMPORT_DESCRIPTOR {
        union {
            DWORD   Characteristics;
            DWORD   OriginalFirstThunk;
        };
        DWORD   TimeDateStamp;
        DWORD   ForwarderChain;
        DWORD   Name;
        DWORD   FirstThunk;
    } IMAGE_IMPORT_DESCRIPTOR;
    typedef IMAGE_IMPORT_DESCRIPTOR UNALIGNED *PIMAGE_IMPORT_DESCRIPTOR;
    
    ......
    
    typedef struct _IMAGE_IMPORT_DESCRIPTOR {
        union {
            DWORD   Characteristics;
            DWORD   OriginalFirstThunk;
        };
        DWORD   TimeDateStamp;
        DWORD   ForwarderChain;
        DWORD   Name;
        DWORD   FirstThunk;
    } IMAGE_IMPORT_DESCRIPTOR;
    typedef IMAGE_IMPORT_DESCRIPTOR UNALIGNED *PIMAGE_IMPORT_DESCRIPTOR;
    
    
    sizeOf(IMAGE_IMPORT_DESCRIPTOR) 个 0  代表导入表结束
    

    2.输出DLL名字

    typedef struct _IMAGE_IMPORT_DESCRIPTOR {
        union {
            DWORD   Characteristics;
            DWORD   OriginalFirstThunk;
        };
        DWORD   TimeDateStamp;
        DWORD   ForwarderChain;
        DWORD   Name;				 RVA 指向一个以0结尾的字符串  是DLL的名字
        DWORD   FirstThunk;
    } IMAGE_IMPORT_DESCRIPTOR;
    typedef IMAGE_IMPORT_DESCRIPTOR UNALIGNED *PIMAGE_IMPORT_DESCRIPTOR;
    

    3.遍历OriginalFirstThunk

    4.遍历FirstThunk

  • 相关阅读:
    c# winform连接sql2000实例
    项目部署后水晶报表显示出错
    获取父窗体的工作区域
    字符转换 btye[] 和string
    水晶报表 详细资料全部显示
    c# 获取和取消本地打印队列
    zoj 3329 One Person Game(数学期望)
    poj 1753 Flip Game(枚举)
    SRM 556 DIV2
    zoj 2671 Cryptography(矩阵+线段树)
  • 原文地址:https://www.cnblogs.com/flatcc/p/7628044.html
Copyright © 2011-2022 走看看