我将源程序改了一下,贴出来,希望对大家有帮助.
#include <windows.h>
#include <stdio.h>
#include <conio.h>
#include <imagehlp.h>
#pragma comment(lib,"kernel32.lib")
#pragma comment(lib,"user32.lib")
#pragma comment(lib,"dbghelp.lib")
//下面这两个函数是由彭春华的TestDebug中的API分析函数改来的
void AnalysisExportFunction(void *pAddBase, const char* szDllName)
{
PIMAGE_DOS_HEADER pdosHdr;
PIMAGE_NT_HEADERS pntHdr;
char decodestr[256];
memset(decodestr,0,256);
pdosHdr = (PIMAGE_DOS_HEADER)pAddBase;
// 检查是不是PE文件
if(pdosHdr->e_magic != IMAGE_DOS_SIGNATURE)
return;
// 计算偏移量，跳过DOS检查代码
pntHdr = (PIMAGE_NT_HEADERS)(pdosHdr->e_lfanew + (DWORD)pAddBase);
if(pntHdr->Signature != IMAGE_NT_SIGNATURE)
return;
PIMAGE_EXPORT_DIRECTORY pExport;
DWORD dwSize;
// 得到导出表的地址
pExport = (PIMAGE_EXPORT_DIRECTORY)ImageDirectoryEntryToData(pAddBase, false,
IMAGE_DIRECTORY_ENTRY_EXPORT, &dwSize);
// 有没有导出表
if(pExport == NULL)
return ;
DWORD pExportBegin, pExportEnd;
// 得到导出表的在内存中的地址和大小
pExportBegin = (DWORD)pntHdr->OptionalHeader.DataDirectory[
IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
pExportEnd = pExportBegin + dwSize;
PWORD pOrdFun;
// 得到函数名指针
char** spName = (char**)ImageRvaToVa(pntHdr, pAddBase, pExport->AddressOfNames, 0);
// 得到函数的入口地址指针
PDWORD pFun = (PDWORD)ImageRvaToVa(pntHdr, pAddBase,
pExport->AddressOfFunctions, 0);
// 得到函数顺序表指针
pOrdFun = (PWORD)ImageRvaToVa(pntHdr, pAddBase, pExport->AddressOfNameOrdinals, 0);
if(pFun == 0)
return;
// 得到函数名及函数入口地址
for(int i = 0; i<pExport->NumberOfFunctions; i++)
{
char* pName = 0;
// 得到函数入口指针
DWORD pFunPoint = *(pFun + i);
if(pFunPoint == 0)
continue;
// DLL的Forword函数不处理
if(pFunPoint > pExportBegin && pFunPoint < pExportEnd)
continue;
// 根据顺序号得到函数名
for(int j = 0; j<pExport->NumberOfNames; j++)
{
if(*(pOrdFun + j) == i)
{
pName = (char*)ImageRvaToVa(pntHdr, pAddBase, (ULONG)*(spName + j), 0);
break;
}
}
if(pName)
{
UnDecorateSymbolName(pName,decodestr,256,UNDNAME_COMPLETE);
printf("%s\n",decodestr);
}
}
}
void AnalysisFunction(const char* szDllName)
{
HANDLE hFile = CreateFile(szDllName,
GENERIC_READ,
FILE_SHARE_READ |FILE_SHARE_WRITE,
0,
OPEN_EXISTING,
FILE_FLAG_SEQUENTIAL_SCAN,
0);
if (hFile ==INVALID_HANDLE_VALUE)
{
printf("could not open file");
}
HANDLE hMap = CreateFileMapping(hFile, 0, PAGE_READONLY, 0, 0, 0);
if(hMap == 0) // 失败
{
CloseHandle(hFile);
printf("Create Map file failed\n");
return;
}
LPVOID pMap = MapViewOfFile(hMap, FILE_MAP_READ, 0, 0, 0);
if(pMap)
{
AnalysisExportFunction(pMap, szDllName);
}
UnmapViewOfFile(pMap);
CloseHandle(hMap);
CloseHandle(hFile);
}
void main(int argc, const TCHAR* argv[] )
{
if(argc<2)
{
printf("usage: decode.exe dllname\n");
return;
}
AnalysisFunction(argv[1]);
}
