VOID PERead::ReadExportTable()
{
PIMAGE_DATA_DIRECTORY pData
=
this
-
>pOp
-
>DataDirectory;
DWORD x
=
pData
-
>VirtualAddress;
/
/
相对虚拟地址 RVA
DWORD foaExportTableAddress
=
RvaToFoa(pData
-
>VirtualAddress);
if
(foaExportTableAddress
=
=
0
) {
cout <<
"当前程序没有导出表"
<< endl;
cout << endl;
return
VOID();
}
PCHAR directoryExport
=
((PCHAR)this
-
>pDos)
+
foaExportTableAddress;
PIMAGE_EXPORT_DIRECTORY pEd
=
(PIMAGE_EXPORT_DIRECTORY)directoryExport;
DWORD foaAddressOfFunctions
=
RvaToFoa(pEd
-
>AddressOfFunctions);
DWORD foaAddressOfNameOrdinals
=
RvaToFoa(pEd
-
>AddressOfNameOrdinals);
DWORD foaAddressOfNames
=
RvaToFoa(pEd
-
>AddressOfNames);
PCHAR foaName
=
(PCHAR)this
-
>pDos
+
RvaToFoa(pEd
-
>Name);
cout <<
hex
<<
"导出表Characteristics: \t\t"
<< pEd
-
>Characteristics << endl;
cout <<
hex
<<
"导出表TimeDateStamp: \t\t"
<< pEd
-
>TimeDateStamp << endl;
cout <<
hex
<<
"导出表MajorVersion: \t\t"
<< pEd
-
>MajorVersion << endl;
cout <<
hex
<<
"导出表MinorVersion: \t\t"
<< pEd
-
>MinorVersion << endl;
cout <<
"导出表名称: \t\t\t"
<< foaName << endl;
cout <<
hex
<<
"导出表Base: \t\t\t"
<< pEd
-
>Base << endl;
cout <<
hex
<<
"导出表NumberOfFunctions: \t"
<< pEd
-
>NumberOfFunctions << endl;
cout <<
hex
<<
"导出表NumberOfNames: \t\t"
<< pEd
-
>NumberOfNames << endl;
cout <<
hex
<<
"导出表AddressOfFunctions: \t"
<< pEd
-
>AddressOfFunctions <<
"\tfoa: "
<< foaAddressOfFunctions << endl;
cout <<
hex
<<
"导出表AddressOfNames: \t"
<< pEd
-
>AddressOfNames <<
"\tfoa: "
<< foaAddressOfNames << endl;
cout <<
hex
<<
"导出表AddressOfNameOrdinals: \t"
<< pEd
-
>AddressOfNameOrdinals <<
"\tfoa: "
<< foaAddressOfNameOrdinals << endl;
cout << endl;
PCHAR nameAddress
=
(PCHAR)this
-
>pDos
+
foaAddressOfNames;
PCHAR tempNameAddress
=
(PCHAR)this
-
>pDos
+
foaAddressOfNames;
PCHAR tempFoaAddressOfNameOrdinals
=
(PCHAR)this
-
>pDos
+
foaAddressOfNameOrdinals;
PDWORD pFoaFunction
=
(PDWORD)((PCHAR)this
-
>pDos
+
foaAddressOfFunctions);
PWORD pFoaOrdinals
=
(PWORD)((PCHAR)this
-
>pDos
+
foaAddressOfNameOrdinals);
PWORD pTempFoaOrdinals
=
pFoaOrdinals;
PDWORD pFoaNames
=
(PDWORD)((PCHAR)this
-
>pDos
+
foaAddressOfNames);
/
/
根据导出函数地址 来进行遍历并打印出所有的导出函数信息
for
(size_t i
=
0
; i < pEd
-
>NumberOfFunctions; i
+
+
)
{
pTempFoaOrdinals
=
pFoaOrdinals;
/
/
打印函数地址 并获取到函数序号 从序号表中找到对应的序号 再找到对应函数的名称 没有名称的则写空
if
(
*
pFoaFunction
=
=
0
) {
pFoaFunction
+
+
;
continue
;
}
/
/
1.
获取到文件中当前函数所在的地址
cout << dec <<
"第"
<< i
+
1
<<
"个RVA函数地址为:"
;
cout <<
hex
<<
*
pFoaFunction;
cout <<
"\tFOA函数地址为:"
<< RvaToFoa(
*
pFoaFunction);
/
/
2.
找到序号
int
ordinal
=
0
;
for
(size_t j
=
0
; j < pEd
-
>NumberOfNames; j
+
+
)
{
if
(
*
pTempFoaOrdinals
=
=
i) {
ordinal
=
j;
break
;
}
if
(j
=
=
pEd
-
>NumberOfNames
-
1
&& ordinal
=
=
0
&& j !
=
0
) {
ordinal
=
-
1
;
break
;
}
pTempFoaOrdinals
+
+
;
}
/
/
3.
找到名称
if
(ordinal
=
=
-
1
) {
/
/
当前函数不是以函数名称进行导出的
cout << dec <<
"\t\t导出序号为:"
<< i
+
pEd
-
>Base <<
"\t\t导出名称为:N/A"
<< endl;
}
else
{
PDWORD name
=
pFoaNames
+
ordinal;
cout << dec <<
"\t\t导出序号为:"
<< i
+
pEd
-
>Base <<
"\t\t导出名称为:"
<< (PCHAR)(((DWORD)this
-
>pDos)
+
RvaToFoa(
*
name)) << endl;
}
pFoaFunction
+
+
;
}
return
VOID();
}