PVOID OperateExportTable(LPCSTR FileName,CString FunctionsName,PVOID Replace,PVOID Original)
{
	HANDLE File=NULL;
	HANDLE Mapping=NULL;
	PVOID View=NULL;
	PVOID Value=NULL;
	PIMAGE_DOS_HEADER DosHeader=NULL;
	PIMAGE_NT_HEADERS NTHeader=NULL;
	PIMAGE_OPTIONAL_HEADER OptionalHeader=NULL; 
	PIMAGE_EXPORT_DIRECTORY ExportDirectory=NULL; 
	PWORD Ordinals=NULL;
	PDWORD Functions=NULL;
	PDWORD Names=NULL;
	SIZE_T Size=0;
	DWORD Index=0;
//映射磁盘文件入内存供操作
	File=CreateFile(FileName,GENERIC_READ|GENERIC_WRITE,FILE_SHARE_READ|FILE_SHARE_WRITE,NULL,OPEN_EXISTING,FILE_FLAG_SEQUENTIAL_SCAN,NULL);
	if (File==INVALID_HANDLE_VALUE)
	{
		AfxMessageBox(_T("创建文件失败..."));
		goto Exit;
	}
	Mapping=CreateFileMapping(File,NULL,PAGE_READWRITE|SEC_COMMIT,0,Size,NULL); 
	if (Mapping==NULL)
	{
		AfxMessageBox(_T("创建文件映射失败..."));
		goto Exit;
	}
	View=MapViewOfFile(Mapping,FILE_MAP_ALL_ACCESS,0,0,Size);
	if (View==NULL)
	{
		AfxMessageBox(_T("创建映射视图失败..."));
		goto Exit;
	}
//验证文件是否为有效的PE格式
	DosHeader=(PIMAGE_DOS_HEADER)View;
	if (DosHeader->e_magic!=IMAGE_DOS_SIGNATURE)
	{
		AfxMessageBox(_T("此文件非PE格式..."));
		goto Exit;
	}
	NTHeader=(PIMAGE_NT_HEADERS)((DWORD)DosHeader+DosHeader->e_lfanew);
	if (NTHeader->Signature!=IMAGE_NT_SIGNATURE)
	{
		AfxMessageBox(_T("此文件非PE格式..."));
		goto Exit;
	}
//读出文件导出表和相关RVA
	ExportDirectory=(PIMAGE_EXPORT_DIRECTORY)((DWORD)DosHeader+(NTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress)-0xc00);
	Ordinals=(PWORD)((DWORD)DosHeader+ExportDirectory->AddressOfNameOrdinals-0xc00);
	Functions=(PDWORD)((DWORD)DosHeader+ExportDirectory->AddressOfFunctions-0xc00);
	Names=(PDWORD)((DWORD)DosHeader+ExportDirectory->AddressOfNames-0xc00);
//替换导出表原函数的位置
	for (Index;Index<ExportDirectory->NumberOfFunctions;Index++)
	{

		if (FunctionsName.Compare((LPCSTR)((DWORD)DosHeader+Names[Index]-0xc00))==0)
		{
			//此处希望大牛指教。自己的函数地址。通过怎么样的计算可以替换文件导出表中。原函数的RVA呢？
			//这样的EAT HOOK该怎么做？
		}
	}

Exit:
	if (View!=NULL)
	{
		UnmapViewOfFile(View);
	}
	if (Mapping!=NULL)
	{
		CloseHandle(Mapping);
	}
	if (File==NULL)
	{
		CloseHandle(File);
	}
	return Value;
}

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)