PE文件导入表解析

版权声明：本文为YuanChuang文章，未经博主允许转载。 https://blog.csdn.net/zzy1448331580/article/details/90715387

#include <Windows.h>

#include <iostream>
#include <string>
#include <fstream>
#include <memory>
using namespace std;

int rva_to_file(PIMAGE_SECTION_HEADER pSection,int nSectionNum,int nRva)
{
	int nRet = 0;
	for (int nIndex = 0; nIndex < nSectionNum; nIndex++)
	{
		if (pSection[nIndex].VirtualAddress <= nRva && nRva < pSection[nIndex + 1].VirtualAddress)
		{
			nRet = nRva - pSection[nIndex].VirtualAddress + pSection[nIndex].PointerToRawData;
			break;
		}
	}
	return nRet;
}

void analizy_to_cout(const string& strFilePath)
{
	if (strFilePath.empty())
	{
		cout << "input file is null" << endl;
		return;
	}

	fstream cFile(strFilePath, ios::binary | ios::in);
	if (!cFile)
	{
		cout << "file open fail" << endl;
		return;
	}

	IMAGE_DOS_HEADER stDos;
	cFile.read((char*)&stDos,sizeof(IMAGE_DOS_HEADER));
	
	IMAGE_NT_HEADERS stNt;
	cFile.seekg(stDos.e_lfanew, ios::beg);
	cFile.read((char*)&stNt, sizeof(IMAGE_NT_HEADERS));

	if (!stNt.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress)
	{
		cout << "the file has not import" << endl;
		cFile.close();
		return;
	}

	int nSectionNum = stNt.FileHeader.NumberOfSections;
	shared_ptr<IMAGE_SECTION_HEADER> pShareSection(new IMAGE_SECTION_HEADER[nSectionNum]);
	PIMAGE_SECTION_HEADER pSection = pShareSection.get();

	cFile.read((char*)pSection, sizeof(IMAGE_SECTION_HEADER)*nSectionNum);
	

	int nImportOffset = rva_to_file(pSection, nSectionNum, stNt.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
	if (!nImportOffset)
	{
		cout << "export offset fail" << endl;
		cFile.close();
		return;
	}

	int nBeginImport = nImportOffset;
	int nImportCount = 0;

	IMAGE_IMPORT_DESCRIPTOR stImport;
	IMAGE_THUNK_DATA stThunk;
	char szModule[50];
	short nHint;
	char szFunc[50];
	cFile.seekg(nImportOffset+((nImportCount++)*sizeof(IMAGE_IMPORT_DESCRIPTOR)), ios::beg);
	cFile.read((char*)&stImport, sizeof(IMAGE_IMPORT_DESCRIPTOR));

	while (stImport.OriginalFirstThunk)
	{
		cFile.seekg(rva_to_file(pSection, nSectionNum, stImport.Name), ios::beg);
		cFile.get(szModule, 50);

		cout << "module is " << szModule << endl;

		int nBeginThunk = rva_to_file(pSection, nSectionNum, stImport.OriginalFirstThunk);
		int nThunkCount = 0;
		cFile.seekg(nBeginThunk + ((nThunkCount++) * sizeof(IMAGE_THUNK_DATA)), ios::beg);
		cFile.read((char*)&stThunk, sizeof(IMAGE_THUNK_DATA));

		while (stThunk.u1.AddressOfData)
		{
			if (IMAGE_SNAP_BY_ORDINAL32(stThunk.u1.AddressOfData))
			{
				cout << "[ID:" << hex << (stThunk.u1.Ordinal & 0xffff) << "]" << endl;
			}
			else
			{
				cFile.seekg(rva_to_file(pSection, nSectionNum, stThunk.u1.AddressOfData), ios::beg);
				cFile.read((char*)&nHint, sizeof(short));
				cFile.get(szFunc, 50);

				cout << "[ID:" << hex << nHint << "]\t\t"
					<< "[Name:" << szFunc << "]"
					<< endl;
			}
			cFile.seekg(nBeginThunk + ((nThunkCount++) * sizeof(IMAGE_THUNK_DATA)), ios::beg);
			cFile.read((char*)&stThunk, sizeof(IMAGE_THUNK_DATA));
		}

		cFile.seekg(nImportOffset + ((nImportCount++) * sizeof(IMAGE_IMPORT_DESCRIPTOR)), ios::beg);
		cFile.read((char*)&stImport, sizeof(IMAGE_IMPORT_DESCRIPTOR));

	}

	cFile.close();
}

int main(_In_ int argc, 
	_In_reads_(argc) _Pre_z_ char** argv, 
	_In_z_ char** envp)
{
	cout << "Please input target file" << endl;

	string strFilePath;
	cin >> strFilePath;
	analizy_to_cout(strFilePath);

	system("pause");
	return 0;
}