void CImportDir::ShowModuleInfo(vector<PIMAGE_SECTION_HEADER> Section)
{
//删除掉模块栏的所有条目
m_modulelist.DeleteAllItems();
//删除所有vector中模块
mymodulename.clear();
PeMisicInfo miscinfo=ReturnMiscInfo();
PIMAGE_NT_HEADERS32 LocalHeaders=miscinfo.nt_headeras;
DWORD dumpaddr=(DWORD)miscinfo.Dumpaddr;
m_dumpaddr=dumpaddr;
WORD optional_header_size=LocalHeaders->FileHeader.SizeOfOptionalHeader;
PIMAGE_OPTIONAL_HEADER32 Optional_header=&LocalHeaders->OptionalHeader;
PIMAGE_DATA_DIRECTORY pDataDir = (PIMAGE_DATA_DIRECTORY)Optional_header->DataDirectory;
//导入表的地址
DWORD my_export_rva=pDataDir[1].VirtualAddress;
DWORD Import_Table_Section_ShiftAddr;
DWORD OA;
//数据段的RVA
for(int a=0;a<Section.size();a++)
{
if(Section[a]->VirtualAddress>my_export_rva)
{
m_OA=OA=Section[a-1]->VirtualAddress-Section[a-1]->PointerToRawData;
Import_Table_Section_ShiftAddr=my_export_rva-OA;
break;
}
}
if(Import_Table_Section_ShiftAddr==0xcccccccc)
{
MessageBox(L"未初始化",L"错误",MB_OK);
return;
}
//获取输入表信息
IMAGE_IMPORT_DESCRIPTOR *my_Import_Data=(PIMAGE_IMPORT_DESCRIPTOR)(Import_Table_Section_ShiftAddr+(DWORD)dumpaddr);
PIMAGE_THUNK_DATA32 pInt;
//判断的条件是因为大多数情况IMAGE_THUNK_DATA 会指向一个IMPORT_BY_NAME 结束的时候会以一个
//全零的IMAGE_THUNK_DATA结束
if(pInt=(PIMAGE_THUNK_DATA32)my_Import_Data->OriginalFirstThunk)
{
while(my_Import_Data->Name)
{
MYIMAGE_IMPORT_DESCRIPTOR my_image_des={0};
DWORD pszDllName_Addr=my_Import_Data->Name-OA+dumpaddr;
my_image_des.dllname=pszDllName_Addr;
my_image_des.my_image_descriptor.FirstThunk=my_Import_Data->FirstThunk;
my_image_des.my_image_descriptor.OriginalFirstThunk=my_Import_Data->OriginalFirstThunk;
my_image_des.my_image_descriptor.ForwarderChain=my_Import_Data->ForwarderChain;
my_image_des.my_image_descriptor.Name=my_Import_Data->Name;
mymodulename.push_back(my_image_des);
my_Import_Data++;
}
for(int a=0;a<mymodulename.size();a++)
{
CString myid;
myid.Format(L"%d",a);
char* mychar;
m_modulelist.InsertItem(LVIF_TEXT | LVIF_STATE,a, myid,(a % 2) == 0 ? LVIS_SELECTED : 0, LVIS_SELECTED,0,0);
for(int i=1;i<6;i++)
{
LPCWCH OutputChar[4]={0};
CString mymoduleinfo;
switch (i)
{
case 1:
MyUtil.ConvertUtf8ToUnicode((char*)mymodulename[a].dllname,*OutputChar);
mymoduleinfo.Format(L"%s",*OutputChar);
m_modulelist.SetItemText(a,i,mymoduleinfo);
break;
case 2:
mymoduleinfo.Format(L"0x%X",mymodulename[a].my_image_descriptor.OriginalFirstThunk);
m_modulelist.SetItemText(a,i,mymoduleinfo);
break;
case 3:
mymoduleinfo.Format(L"0x%X",mymodulename[a].my_image_descriptor.ForwarderChain);
m_modulelist.SetItemText(a,i,mymoduleinfo);
break;
case 4:
mymoduleinfo.Format(L"0x%X",mymodulename[a].my_image_descriptor.Name);
m_modulelist.SetItemText(a,i,mymoduleinfo);
break;
case 5:
mymoduleinfo.Format(L"0x%X",mymodulename[a].my_image_descriptor.FirstThunk);
m_modulelist.SetItemText(a,i,mymoduleinfo);
break;
default:
break;
}
}
}
}
}
