【PE学习-------导入表】

输出 打印 PE文件的  导入表信息

// ImportTable.cpp : 定义控制台应用程序的入口点。
//

#include "stdafx.h"
#include <Windows.h>
#include <DbgHelp.h>

#pragma comment(lib,"Dbghelp.lib")
PIMAGE_NT_HEADERS g_pNt = NULL;

//判断文件是否为PE文件
BOOL CheckPeFile(LPVOID ImageBase)
{
    PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)ImageBase;
    if (pDos->e_magic != IMAGE_DOS_SIGNATURE)
    {
        return FALSE;
    }
    PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)((DWORD)(ImageBase) + pDos->e_lfanew);
    if (pNt->Signature != IMAGE_NT_SIGNATURE)
    {
        return FALSE;
    }
    g_pNt = pNt;
    return TRUE;
}

//获取导入表的信息
void GetImportInfo(LPVOID ImageBase, PIMAGE_NT_HEADERS pNtHeader)
{
    DWORD dwRva = pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
    LPVOID ImportVirtual = ImageRvaToVa(pNtHeader, ImageBase, dwRva, NULL);
    PIMAGE_IMPORT_DESCRIPTOR pImport = (PIMAGE_IMPORT_DESCRIPTOR)ImportVirtual;
    DWORD dwCount = 0;
    while (pImport->FirstThunk)
    {
        LPVOID name = ImageRvaToVa(pNtHeader, ImageBase, pImport->Name, NULL);
        printf("DllName:  %s\n", (char*)name);
        printf("OriginalFirstThunk:   0x%08X\n", pImport->OriginalFirstThunk);
        printf("TimeDateStamp:        0x%08X\n", pImport->TimeDateStamp);
        printf("ForwarderChain:       0x%08X\n", pImport->ForwarderChain);
        printf("Name:                 0x%08X\n", pImport->Name);
        printf("FirstThunk:           0x%08X\n", pImport->FirstThunk);
        LPVOID thunkRva = ImageRvaToVa(pNtHeader, ImageBase, pImport->OriginalFirstThunk ? \
            pImport->OriginalFirstThunk:pImport->FirstThunk, NULL);
        PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA)thunkRva;
        printf("    FunctionAddress        Hint        FunctionName        \n");
        while(pThunk->u1.Function)
        {
            printf("    0x%08X", pThunk->u1.Function);
            LPVOID byName = ImageRvaToVa(pNtHeader, ImageBase, (DWORD)pThunk->u1.AddressOfData, NULL);
            PIMAGE_IMPORT_BY_NAME pByName = PIMAGE_IMPORT_BY_NAME(byName);
            printf("        0x%04X", pByName->Hint);
            printf("      %s\n", (char*)pByName->Name);
            pThunk++;
        }
        dwCount++;
        pImport++;
    }
    printf("The total Import Table is %d\n", dwCount);

}
int _tmain(int argc, _TCHAR* argv[])
{

    if (argc != 2)
    {
        printf("请输入参数！\n");
        return -1;
    }
    HANDLE hFile = CreateFile(argv[1], GENERIC_READ, 0, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
    if (hFile == INVALID_HANDLE_VALUE)
    {
        printf("Error createfile %d\n", GetLastError());
        return -1;
    }
    DWORD dwFileSize = GetFileSize(hFile, NULL);
    HANDLE hMap = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, dwFileSize, NULL);
    if (hMap == NULL)
    {
        CloseHandle(hFile);
        return -1;
    }
    //映射文件到内存中
    LPVOID ImageBase = MapViewOfFile(hMap, FILE_MAP_READ, 0, 0, dwFileSize);
    if (ImageBase == NULL)
    {
        CloseHandle(hFile);
        UnmapViewOfFile(hMap);
        return -1;
    }
    printf("MapView success !\n");
    if (!CheckPeFile(ImageBase))
    {
        printf("This is  not PE file\n");
        return 0;
    }
    printf("-----------------------Import--Information---------------------------\n");
    
    GetImportInfo(ImageBase, g_pNt);
    printf("----------------------------End--------------------------------------\n");
    CloseHandle(hFile);
    UnmapViewOfFile(hMap);
    return 0;
}

初学PE文件，有不足的地方请指出;高手飘过 

可编译代码下载地址点击打开链接