零基础逆向工程22_PE结构06_导入表

导入表结构

typedef struct _IMAGE_IMPORT_DESCRIPTOR {

    union {

        DWORD   Characteristics;

        DWORD   OriginalFirstThunk;         						//RVA 指向IMAGE_THUNK_DATA结构数组

    };

    DWORD   TimeDateStamp;               						//时间戳

    DWORD   ForwarderChain;

    DWORD   Name;						//RVA,指向dll名字，该名字已0结尾

    DWORD   FirstThunk;                 						//RVA,指向IMAGE_THUNK_DATA结构数组

} IMAGE_IMPORT_DESCRIPTOR;

typedef IMAGE_IMPORT_DESCRIPTOR UNALIGNED *PIMAGE_IMPORT_DESCRIPTOR;

PE文件加载前：

PE文件加载后：

typedef struct _IMAGE_THUNK_DATA32 {

    union {

        PBYTE  ForwarderString;

        PDWORD Function;

        DWORD Ordinal;						//序号

        PIMAGE_IMPORT_BY_NAME  AddressOfData;						//指向IMAGE_IMPORT_BY_NAME

    } u1;

} IMAGE_THUNK_DATA32;

typedef IMAGE_THUNK_DATA32 * PIMAGE_THUNK_DATA32;

typedef struct _IMAGE_IMPORT_BY_NAME {

    WORD    Hint;						//可能为空，编译器决定 如果不为空 是函数在导出表中的索引

    BYTE    Name[1];						//函数名称，以0结尾

} IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;

打印导入表的过程：

1.定位导入表：

目录项目的第2个结构就是导入表

typedef struct _IMAGE_DATA_DIRECTORY {

    DWORD   VirtualAddress;					//RVA 指向导入表结构

    DWORD   Size;

} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;

	将RVA转换成FOA

typedef struct _IMAGE_IMPORT_DESCRIPTOR {

    union {

        DWORD   Characteristics;

        DWORD   OriginalFirstThunk;

    };

    DWORD   TimeDateStamp;

    DWORD   ForwarderChain;

    DWORD   Name;

    DWORD   FirstThunk;

} IMAGE_IMPORT_DESCRIPTOR;

typedef IMAGE_IMPORT_DESCRIPTOR UNALIGNED *PIMAGE_IMPORT_DESCRIPTOR;

......

typedef struct _IMAGE_IMPORT_DESCRIPTOR {

    union {

        DWORD   Characteristics;

        DWORD   OriginalFirstThunk;

    };

    DWORD   TimeDateStamp;

    DWORD   ForwarderChain;

    DWORD   Name;

    DWORD   FirstThunk;

} IMAGE_IMPORT_DESCRIPTOR;

typedef IMAGE_IMPORT_DESCRIPTOR UNALIGNED *PIMAGE_IMPORT_DESCRIPTOR;

sizeOf(IMAGE_IMPORT_DESCRIPTOR) 个 0  代表导入表结束

2.输出DLL名字

typedef struct _IMAGE_IMPORT_DESCRIPTOR {

    union {

        DWORD   Characteristics;

        DWORD   OriginalFirstThunk;

    };

    DWORD   TimeDateStamp;

    DWORD   ForwarderChain;

    DWORD   Name;				 RVA 指向一个以0结尾的字符串  是DLL的名字

    DWORD   FirstThunk;

} IMAGE_IMPORT_DESCRIPTOR;

typedef IMAGE_IMPORT_DESCRIPTOR UNALIGNED *PIMAGE_IMPORT_DESCRIPTOR;

3.遍历OriginalFirstThunk

4.遍历FirstThunk