是老a培训课程的一段代码， 后来我发现在agp中也有，如下：
BOOLEAN EunmEATTable(PVOID ulModuleBase)
{
PIMAGE_DOS_HEADER pDosHeader;
PIMAGE_NT_HEADERS NtDllHeader;
IMAGE_OPTIONAL_HEADER opthdr;
ULONG_PTR* arrayOfFunctionAddresses;
ULONG_PTR* arrayOfFunctionNames;
WORD* arrayOfFunctionOrdinals;
ULONG_PTR functionOrdinal;
ULONG_PTR Base, x, functionAddress;
IMAGE_EXPORT_DIRECTORY *pExportTable;
char *functionName;
__try
{
pDosHeader=(PIMAGE_DOS_HEADER)ulModuleBase;
if (pDosHeader->e_magic!=IMAGE_DOS_SIGNATURE)
{
DbgPrint("IMAGE_DOS_SIGNATURE failed\r\n");
return FALSE;
}
NtDllHeader=(PIMAGE_NT_HEADERS)(ULONG_PTR)((ULONG_PTR)pDosHeader+pDosHeader->e_lfanew);
if (NtDllHeader->Signature!=IMAGE_NT_SIGNATURE)
{
DbgPrint("IMAGE_NT_SIGNATURE failed\r\n");
return FALSE;
}
opthdr = NtDllHeader->OptionalHeader;
pExportTable =(IMAGE_EXPORT_DIRECTORY*)((ULONG_PTR)ulModuleBase + opthdr.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT]. VirtualAddress); //得到导出表
arrayOfFunctionAddresses = (ULONG_PTR*)((ULONG_PTR)ulModuleBase + pExportTable->AddressOfFunctions); //地址表
arrayOfFunctionNames = (ULONG_PTR*)((BYTE*)ulModuleBase + pExportTable->AddressOfNames); //函数名表
arrayOfFunctionOrdinals = (WORD*)((BYTE*)ulModuleBase + pExportTable->AddressOfNameOrdinals);
Base = pExportTable->Base;
for(x = 0; x < pExportTable->NumberOfFunctions; x++)
{
functionName = (char*)((BYTE*)ulModuleBase + arrayOfFunctionNames[x]);
functionOrdinal = arrayOfFunctionOrdinals[x] + Base - 1;
functionAddress = (ULONG_PTR)((BYTE*)ulModuleBase + arrayOfFunctionAddresses[functionOrdinal]);
DbgPrint("%s:0x%08X\r\n",functionName,functionAddress);
}
}__except(EXCEPTION_EXECUTE_HANDLER){
}
return FALSE;
}
//疑问
1. pExportTable->NumberOfFunctions 我感觉应该是 pExportTable->NumberOfNames
否则下面的 functionName = (char*)((BYTE*)ulModuleBase + arrayOfFunctionNames[x]); 会越界的，毕竟有的dll 是用序号导出的
2. functionOrdinal = arrayOfFunctionOrdinals[x] + Base - 1; 这是得到导出序号，我感觉应该是 functionOrdinal = arrayOfFunctionOrdinals[x] - Base
我后来又baidu了一个文章，讲得挺细
http://blog.csdn.net/evi10r/article/details/7216467
v校和老A是老前辈了，我不太相信他们的代码会有多大的问题，但和网上的讲解差好多，我好纠结啊
[课程]Linux pwn 探索篇！
