PE学习2-导出表

.codeGetExportTableAddr proc @lpMem:dword;取得导出表的地址LOCAL @lpExportTableAddr:dwordpushadmov esi, dword ptr[@lpMem]assume esi:ptr IMAGE_DOS_HEADERadd esi, [esi].e_lfanewassume esi:ptr IMAGE_NT_HEADERSlea eax, [esi].OptionalHeader.DataDirectorymov @lpExportTableAddr, eaxassume esi:nothingpopadmov eax, @lpExportTableAddrretGetExportTableAddr endpAnalysisExportTable proc @lpMem:dwordLOCAL @lpOffsetAddressOfFunctions:dwordLOCAL @lpOffsetAddressOfNames:dwordLOCAL @lpOffsetAddressOfNameOrdinals:dwordpushadinvoke GetExportTableAddr, @lpMemmov esi, eaxassume esi:ptr IMAGE_DATA_DIRECTORYmov eax, [esi].VirtualAddressPrintHex eaxmov eax, [esi].isizePrintHex eaxinvoke RvaToOffset, @lpMem, [esi].VirtualAddressadd eax, @lpMemPrintHex eaxmov esi, eaxassume esi:ptr IMAGE_EXPORT_DIRECTORYinvoke RvaToOffset, @lpMem,[esi].nName;得到指向DLL名字的RVA在PE文件中的偏移add eax, @lpMemPrintStringByAddr eaxinvoke RvaToOffset, @lpMem, [esi].AddressOfFunctions;导出函数地址数组地址（RVA），转换成PE文件中的偏移add eax, @lpMemmov @lpOffsetAddressOfFunctions, eaxinvoke RvaToOffset, @lpMem, [esi].AddressOfNamesadd eax, @lpMemmov @lpOffsetAddressOfNames, eax;导出函数名字数组地址invoke RvaToOffset, @lpMem, [esi].AddressOfNameOrdinalsadd eax, @lpMemmov @lpOffsetAddressOfNameOrdinals, eax;名字序号数组地址RVA在PE文件中的偏移invoke AnalysisAddressOfNames, @lpMem, @lpOffsetAddressOfFunctions, @lpOffsetAddressOfNames,/ @lpOffsetAddressOfNameOrdinals, [esi].NumberOfFunctions, [esi].nBaseassume esi:nothingpopadretAnalysisExportTable endpAnalysisAddressOfNames proc @lpMem:dword, @lpOffsetAddressOfFunctions:dword, @lpOffsetAddressOfNames:dword, @lpOffsetAddressOfNameOrdinals:dword,/ @dwNumberOfFunctions:dword, @dwBase:dwordLOCAL @dwIndex:dwordpushadmov @dwIndex, 0xor ebx, ebx.while ebx < @dwNumberOfFunctionsmov edi, dword ptr[@lpOffsetAddressOfFunctions]mov eax, dword ptr[edi + ebx * 4]PrintText "函数地址："PrintHex eaxmov edi, dword ptr[@lpOffsetAddressOfNameOrdinals]mov eax, @dwIndexmov ecx, @dwNumberOfFunctionscldrepnz scasw.if ZERO?mov esi, edisub esi, @lpOffsetAddressOfNameOrdinals;如果指定索引在函数名序号表中能找到，则必定有一个函数名字符串与之对应sub esi, 2shl esi, 1add esi, @lpOffsetAddressOfNamesinvoke RvaToOffset, @lpMem, dword ptr[esi]add eax, @lpMemPrintText "函数名称："PrintStringByAddr eax.endifmov eax, ebxadd eax, @dwBasePrintText "函数序号："PrintHex eaxinc ebxinc @dwIndex.endwpopadretAnalysisAddressOfNames endp