#define ibaseDD *(PDWORD)&ibase
BOOL GetHeaders(PUCHAR ibase,
                PIMAGE_FILE_HEADER *pfh,
                PIMAGE_OPTIONAL_HEADER *poh,
                PIMAGE_SECTION_HEADER *psh)
{
        PIMAGE_DOS_HEADER mzhead=(PIMAGE_DOS_HEADER)ibase;
        if    ((mzhead->e_magic!=IMAGE_DOS_SIGNATURE) ||        
                (ibaseDD[mzhead->e_lfanew]!=IMAGE_NT_SIGNATURE))
                return FALSE;
        *pfh=(PIMAGE_FILE_HEADER)&ibase[mzhead->e_lfanew];
        if (((PIMAGE_NT_HEADERS)*pfh)->Signature!=IMAGE_NT_SIGNATURE)
                return FALSE;
        *pfh=(PIMAGE_FILE_HEADER)((PBYTE)*pfh+sizeof(IMAGE_NT_SIGNATURE));
        *poh=(PIMAGE_OPTIONAL_HEADER)((PBYTE)*pfh+sizeof(IMAGE_FILE_HEADER));
        if ((*poh)->Magic!=IMAGE_NT_OPTIONAL_HDR32_MAGIC)
                return FALSE;
        *psh=(PIMAGE_SECTION_HEADER)((PBYTE)*poh+sizeof(IMAGE_OPTIONAL_HEADER));
        return TRUE;
}
void GetKernelModuleList()
{
PVOID base_addr
PIMAGE_FILE_HEADER pFileHeader;
PIMAGE_OPTIONAL_HEADER pOptHeader;
PIMAGE_SECTION_HEADER pSecHeader;
ULONG vaImportDir;
PIMAGE_IMPORT_DESCRIPTOR pImportDesc;
USHORT i, sectionCount;
PCHAR moduleName;

KdVersionBlock = (PDBGKD_GET_VERSION64)(*(ULONG *)(0xffdff000 + 0x34));
base_addr = (PULONG)(ULONG)(KdVersionBlock->KernBase);

if (!GetHeaders(base_addr, &pFileHeader, &pOptHeader, &pSecHeader))
        return;
sectionCount = pFileHeader->NumberOfSections;
vaImportDir = pOptHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
for (i = 0; i < sectionCount; i++, pSecHeader++)
{
        if (DirVirtualAddress >= pSecHeader->VirtualAddress &&
                DirVirtualAddress < pSecHeader->VirtualAddress + pSecHeader->SizeOfRawData)
                break;
}
//以上代码，调试其中跟踪都正常
//pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)((ULONG)base_addr + vaImportDir); //直接基址+VirtualAddress和下面的方法得到的pImportDesc都是无效地址，Why?
pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)((ULONG)base_addr + vaImportDir - pSecHeader->VirtualAddress + pSecHeader->PointerToRawData);
        if (pImportDesc == NULL)
        {
                return;
        }
        if(!MmIsAddressValid(pImportDesc))
        {
//程序运行到此，调试显示pImportDesc地址无效，why?
                return;
        }
        for (; pImportDesc->Name; pImportDesc++)
        {
                moduleName = (PCHAR)(base_addr + pImportDesc->Name);
                //...
        }
}
网上看到两种方法获取IAT：
pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)((ULONG)base_addr + vaImportDir);
OR
pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)((ULONG)base_addr + vaImportDir - pSecHeader->VirtualAddress + pSecHeader->PointerToRawData);
得到的pImportDesc都是无效地址，Why?
还有为什么会有两种方法啊，有什么区别，什么时候改用哪种方法？迷糊！

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课