A、初识IAT
B、IAT表相关结构
C、读出IAT项
D、编写代码测试分析
E、HOOK IAT
F、测试分析
A、认识IAT表 导入函数表
B、IAT表相关结构
PIMAGE_DOS_HEADER
//->e_lfanew //PE文件头偏移值
PIMAGE_NT_HEADERS //->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress
PIMAGE_IMPORT_DESCRIPTOR
//.FirstThunk //IAT偏移
PIMAGE_THUNK_DATA
// u1.Function
//文件名 IAT.H
#include <windows.h>
VOID __stdcall mySleep(DWORD m)
{
MessageBoxA(0,"Hook 成功","IAT hook",MB_OK);
}
PVOID EnumAPI()
{
PBYTE ImageBase;
PIMAGE_THUNK_DATA r;
PIMAGE_NT_HEADERS pNtHeader;
PIMAGE_IMPORT_DESCRIPTOR pImport;
//取得DOS头基址
ImageBase=(PBYTE)GetModuleHandle(NULL);//0x400000
//PE头=ImageBase+[ImageBase+3c]
pNtHeader = (PIMAGE_NT_HEADERS) (ImageBase + ((PIMAGE_DOS_HEADER) ImageBase)->e_lfanew);
//IMAGE_DIRECTORY_ENTRY_IMPORT值为1 表示import tabale
pImport = (PIMAGE_IMPORT_DESCRIPTOR)
(ImageBase + pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
////遍历整个 输入表
for (; pImport->Name; pImport++)
{
printf("导入模块:%s\n",ImageBase+pImport->Name);
//遍历IAT信息 PIMAGE_THUNK_DATA基址
for (r = (PIMAGE_THUNK_DATA) (ImageBase + pImport->FirstThunk); r->u1.Function; r++) //枚举函数地址
{ if (Sleep==(PVOID)r->u1.Function)
{ DWORD pSleep=(DWORD)(&r->u1.Function);
__asm
{
mov ebx,pSleep /// mov ebx,0x42A190
lea eax,mySleep
mov [ebx],eax
}
}
printf("Function=%x \n", &(r->u1.Function));
}
}
return NULL;
}
int main(int argc, char* argv[])
{ //MessageBoxA(0,NULL,NULL,MB_OK) ;
//MessageBoxW(0,NULL,NULL,MB_OK);
EnumAPI();
Sleep(111);
return 0;
}