获得PE文件输入表和输出表

#include <windows.h>
#include <iostream>
#include<ImageHlp.h>
#pragma comment(lib,"imagehlp.lib")
using namespace std;
int main()
{
    char* strExePath="C:\\Windows\\System32\\kernel32.dll";
    //打开文件
    HANDLE hFile=::CreateFile(strExePath,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);
    if(NULL==hFile)
    {
        cout<<"CreateFile error:"<<GetLastError()<<endl;
        return 0;
    }
    cout<<"CreateFile successfully\n";
    //创建内存映像
    HANDLE hMap=CreateFileMappingA(hFile,NULL,PAGE_READONLY,0,0,NULL);
    if(NULL==hMap)
    {
        cout<<"CreateFileMappingA error:"<<GetLastError()<<endl;
        return 0;
    }
    cout<<"CreateFilemappingA successfully\n";
    //获得文件基地址
    LPVOID lpImageBase=MapViewOfFile(hMap,FILE_MAP_READ,0,0,0);
    if(NULL==lpImageBase)
    {
        cout<<"MapViewOfFile error:"<<GetLastError()<<endl;
        return 0;
    }
    cout<<"MapViewOfFile successfully\n";
    //获得DOS头部指针
    PIMAGE_DOS_HEADER pDos=(PIMAGE_DOS_HEADER)lpImageBase;
    if(pDos->e_magic==IMAGE_DOS_SIGNATURE)
        cout<<"DOS 头部检测成功\n";
    else    
    {
        cout<<"并非exe文件\n";
    }
    //获得NT文件头
    PIMAGE_NT_HEADERS pNtHeader;
    pNtHeader = (PIMAGE_NT_HEADERS)((DWORD)pDos + pDos->e_lfanew);
    if(pNtHeader->Signature==IMAGE_NT_SIGNATURE)
    {
        cout<<"可用exe文件\n";
    }

    //获得文件头部
    PIMAGE_FILE_HEADER pFile=(PIMAGE_FILE_HEADER)(&pNtHeader->FileHeader);
    //获得可选头部
    PIMAGE_OPTIONAL_HEADER pOptionalHeader=(PIMAGE_OPTIONAL_HEADER)(&pNtHeader->OptionalHeader);
    //获得区段头
    PIMAGE_SECTION_HEADER pSectionHeader;     
    pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pOptionalHeader + pFile->SizeOfOptionalHeader);
    PIMAGE_SECTION_HEADER pSectionUse=pSectionHeader;
    for(int i=0;i<pFile->NumberOfSections;i++)
    {
        char tmp[256]={0};
        wsprintf(tmp,"%s",pSectionUse->Name);
        cout<<tmp<<endl;                                
        //pSectionHeader+=sizeof(PIMAGE_SECTION_HEADER);
        pSectionUse++;
    }
    //获得输出表
    PIMAGE_EXPORT_DIRECTORY pExportDir=(PIMAGE_EXPORT_DIRECTORY)ImageRvaToVa(pNtHeader,lpImageBase,pOptionalHeader->DataDirectory[0].VirtualAddress,&pSectionHeader);
    cout<<"输出函数个数是："<<pExportDir->NumberOfNames<<endl;
    DWORD **ppdwNames = (DWORD **)pExportDir->AddressOfNames;
    ppdwNames = (PDWORD*)ImageRvaToVa(pNtHeader,
            lpImageBase, (DWORD)ppdwNames, 0);
    DWORD ppdwFunc = (DWORD )pExportDir->AddressOfFunctions;
    for(int i=0;i<1;i++)
    {
       char *szFunc=(PSTR)ImageRvaToVa(pNtHeader, lpImageBase, (DWORD)*ppdwNames, 0);
       DWORD dwAddress=(DWORD)ImageRvaToVa(pNtHeader, lpImageBase, (DWORD)ppdwFunc, 0);
       cout<<szFunc<<"::"<<dwAddress<<endl;  
       ppdwNames++;
    }
    DWORD* pFuncAddress=(DWORD*)pExportDir->AddressOfNameOrdinals;



    
    //获得输入表
    PIMAGE_IMPORT_DESCRIPTOR pImportDir ;
    cout<<"通过寻找OrignalFirstThunk\n";
    pImportDir = (PIMAGE_IMPORT_DESCRIPTOR)ImageRvaToVa(pNtHeader,lpImageBase,(DWORD)pOptionalHeader->DataDirectory[1].VirtualAddress,&pSectionHeader);
    while((pImportDir->Name)!=NULL)
    {

    cout<<(char*)ImageRvaToVa(pNtHeader,lpImageBase,pImportDir->Name,&pSectionHeader)<<endl<<endl;;
    PIMAGE_THUNK_DATA thunk_data=(PIMAGE_THUNK_DATA)ImageRvaToVa(pNtHeader,lpImageBase,pImportDir->OriginalFirstThunk,&pSectionHeader);
    while((thunk_data->u1.AddressOfData)!=NULL)
    {
    PIMAGE_IMPORT_BY_NAME he=(PIMAGE_IMPORT_BY_NAME)ImageRvaToVa(pNtHeader,lpImageBase,thunk_data->u1.AddressOfData,&pSectionHeader);     
    cout<<he->Hint<<":"<<he->Name<<endl;
    thunk_data++;
    }
    pImportDir++;
    cout<<endl;
    }        

    
    return 0;

}