版权声明:本文为YuanChuang文章,未经博主允许转载。 https://blog.csdn.net/zzy1448331580/article/details/90715387
#include <Windows.h>
#include <iostream>
#include <string>
#include <fstream>
#include <memory>
using namespace std;
int rva_to_file(PIMAGE_SECTION_HEADER pSection,int nSectionNum,int nRva)
{
int nRet = 0;
for (int nIndex = 0; nIndex < nSectionNum; nIndex++)
{
if (pSection[nIndex].VirtualAddress <= nRva && nRva < pSection[nIndex + 1].VirtualAddress)
{
nRet = nRva - pSection[nIndex].VirtualAddress + pSection[nIndex].PointerToRawData;
break;
}
}
return nRet;
}
void analizy_to_cout(const string& strFilePath)
{
if (strFilePath.empty())
{
cout << "input file is null" << endl;
return;
}
fstream cFile(strFilePath, ios::binary | ios::in);
if (!cFile)
{
cout << "file open fail" << endl;
return;
}
IMAGE_DOS_HEADER stDos;
cFile.read((char*)&stDos,sizeof(IMAGE_DOS_HEADER));
IMAGE_NT_HEADERS stNt;
cFile.seekg(stDos.e_lfanew, ios::beg);
cFile.read((char*)&stNt, sizeof(IMAGE_NT_HEADERS));
if (!stNt.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress)
{
cout << "the file has not import" << endl;
cFile.close();
return;
}
int nSectionNum = stNt.FileHeader.NumberOfSections;
shared_ptr<IMAGE_SECTION_HEADER> pShareSection(new IMAGE_SECTION_HEADER[nSectionNum]);
PIMAGE_SECTION_HEADER pSection = pShareSection.get();
cFile.read((char*)pSection, sizeof(IMAGE_SECTION_HEADER)*nSectionNum);
int nImportOffset = rva_to_file(pSection, nSectionNum, stNt.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
if (!nImportOffset)
{
cout << "export offset fail" << endl;
cFile.close();
return;
}
int nBeginImport = nImportOffset;
int nImportCount = 0;
IMAGE_IMPORT_DESCRIPTOR stImport;
IMAGE_THUNK_DATA stThunk;
char szModule[50];
short nHint;
char szFunc[50];
cFile.seekg(nImportOffset+((nImportCount++)*sizeof(IMAGE_IMPORT_DESCRIPTOR)), ios::beg);
cFile.read((char*)&stImport, sizeof(IMAGE_IMPORT_DESCRIPTOR));
while (stImport.OriginalFirstThunk)
{
cFile.seekg(rva_to_file(pSection, nSectionNum, stImport.Name), ios::beg);
cFile.get(szModule, 50);
cout << "module is " << szModule << endl;
int nBeginThunk = rva_to_file(pSection, nSectionNum, stImport.OriginalFirstThunk);
int nThunkCount = 0;
cFile.seekg(nBeginThunk + ((nThunkCount++) * sizeof(IMAGE_THUNK_DATA)), ios::beg);
cFile.read((char*)&stThunk, sizeof(IMAGE_THUNK_DATA));
while (stThunk.u1.AddressOfData)
{
if (IMAGE_SNAP_BY_ORDINAL32(stThunk.u1.AddressOfData))
{
cout << "[ID:" << hex << (stThunk.u1.Ordinal & 0xffff) << "]" << endl;
}
else
{
cFile.seekg(rva_to_file(pSection, nSectionNum, stThunk.u1.AddressOfData), ios::beg);
cFile.read((char*)&nHint, sizeof(short));
cFile.get(szFunc, 50);
cout << "[ID:" << hex << nHint << "]\t\t"
<< "[Name:" << szFunc << "]"
<< endl;
}
cFile.seekg(nBeginThunk + ((nThunkCount++) * sizeof(IMAGE_THUNK_DATA)), ios::beg);
cFile.read((char*)&stThunk, sizeof(IMAGE_THUNK_DATA));
}
cFile.seekg(nImportOffset + ((nImportCount++) * sizeof(IMAGE_IMPORT_DESCRIPTOR)), ios::beg);
cFile.read((char*)&stImport, sizeof(IMAGE_IMPORT_DESCRIPTOR));
}
cFile.close();
}
int main(_In_ int argc,
_In_reads_(argc) _Pre_z_ char** argv,
_In_z_ char** envp)
{
cout << "Please input target file" << endl;
string strFilePath;
cin >> strFilePath;
analizy_to_cout(strFilePath);
system("pause");
return 0;
}