//变量申明
        PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)Base;
        PIMAGE_NT_HEADERS32 pNtHeader32;
        PIMAGE_NT_HEADERS64 pNtHeader64;
        PIMAGE_IMPORT_DESCRIPTOR pIatDes;
        PIMAGE_IMPORT_BY_NAME ImportByName;
        BOOLEAN b64 = FALSE;
        NTSTATUS ns=STATUS_NOT_FOUND;

        //首先检查是否是有效的PE结构
        if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE)
        {
                DbgPrint("PIMAGE_DOS_HEADER,获取出错");
                return STATUS_INVALID_IMAGE_FORMAT;
        }
        DbgPrint("PIMAGE_DOS_HEADER,获取成功");
        //得到NT头
        pNtHeader32 = (PIMAGE_NT_HEADERS32)((PUCHAR)Base + pDosHeader->e_lfanew);
        if (pNtHeader32->Signature != IMAGE_NT_SIGNATURE)
        {
                DbgPrint("PIMAGE_NT_HEADERS32,获取出错");
                return STATUS_INVALID_IMAGE_FORMAT;
        }
        DbgPrint("PIMAGE_NT_HEADERS32,获取成功");

        if (pNtHeader32->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64) //64bit
        {
                b64 = TRUE;
                pNtHeader64 = (PIMAGE_NT_HEADERS64)((PUCHAR)Base+((PIMAGE_DOS_HEADER)Base)->e_lfanew);
                pIatDes = (PIMAGE_IMPORT_DESCRIPTOR)((PUCHAR)Base + pNtHeader64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
        }
        else if(pNtHeader32->FileHeader.Machine == IMAGE_FILE_MACHINE_I386) //32bit
        {
                pIatDes = (PIMAGE_IMPORT_DESCRIPTOR)((PUCHAR)Base + pNtHeader32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
        }
        else
        {
                return STATUS_INVALID_IMAGE_FORMAT;
        }

        for (;pIatDes->Name;pIatDes++)
        {
                //如果是64位
                if (b64)
                {
                        PIMAGE_THUNK_DATA64 pThunk64;
                        for (pThunk64 = (PIMAGE_THUNK_DATA64)((PUCHAR)Base+pIatDes->FirstThunk);pThunk64->u1.Function;pThunk64++)
                        {
                                DbgPrint("64bit-->Import Module %s[0x%08x]\r\n",(PCSTR)((PUCHAR)Base+pIatDes->Name),(ULONG_PTR)pThunk64->u1.Function);
                        }
                }
                else
                {
                        PIMAGE_THUNK_DATA32 pThunk32;
                        for (pThunk32 = (PIMAGE_THUNK_DATA32)((PUCHAR)Base+pIatDes->FirstThunk);pThunk32->u1.Function;pThunk32++)
                        {
                                DbgPrint("32bit-->Import Module %s[0x%08x]\r\n",(PCSTR)((PUCHAR)Base+pIatDes->Name),(ULONG_PTR)pThunk32->u1.Function);
                        }
                }
        }
        return STATUS_SUCCESS;
}

还有一个问题，“(PUCHAR)Base”这里为什么用PUCHAR而不是PULONG之类的！！

[注意]看雪招聘，专注安全领域的专业人才平台！