能力值:
( LV2,RANK:10 )
|
-
-
2 楼
书上已经狠详细了,再仔细看看吧
|
能力值:
( LV2,RANK:10 )
|
-
-
3 楼
void printET(LPVOID ImageBase)
{
PIMAGE_DOS_HEADER pDosHeader=NULL;
PIMAGE_NT_HEADERS pNtHeaderHeader=NULL;
PIMAGE_EXPORT_DIRECTORY pExport=NULL;
pDosHeader=(PIMAGE_DOS_HEADER)ImageBase;
pNtHeaderHeader=(PIMAGE_NT_HEADERS)((DWORD)pDosHeader+pDosHeader->e_lfanew);
pExport=GetExportTable(ImageBase);
if(pExport==NULL)
return;
char * pszModuleName=(char *)ImageRvaToVa(pNtHeaderHeader,ImageBase,pExport->Name,NULL);
printf("模块的真实名称%s\n",pszModuleName);
int n;
n=pExport->NumberOfFunctions;
printf("模块中函数个数:%d\n",n);
DWORD *AddressF=(DWORD *)ImageRvaToVa(pNtHeaderHeader,ImageBase,pExport->AddressOfFunctions,NULL);
DWORD *AddressName=(DWORD *)ImageRvaToVa(pNtHeaderHeader,ImageBase,pExport->AddressOfNames,NULL);
WORD *AddressNameO=(WORD *)ImageRvaToVa(pNtHeaderHeader,ImageBase,pExport->AddressOfNameOrdinals,NULL);
for(int i=0;i<n;i++)
{
printf("函数的名称:%-30s,地址:%-4x,顺列号:%d\n",
(char *)ImageRvaToVa(pNtHeaderHeader,ImageBase,*AddressName,NULL),*AddressF,*AddressNameO);
AddressName++;
AddressF++;
AddressNameO++;
}
}
|
能力值:
( LV6,RANK:90 )
|
-
-
4 楼
個人發了一個Pe文件註解,
這是我的筆記,不妨下來看看
希望對你有用
|
|
|