DWORD MappedPeFile::getIatVa(const char *module, const char *name)
{
	for (PIMAGE_IMPORT_DESCRIPTOR imp = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD)m_pDOS + rva2FileOffset(m_pNT->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress)); 
		imp->Characteristics != 0; 
		imp++) {

		const char *szModule = (const char*)((DWORD)m_pDOS + rva2FileOffset(imp->Name));
		if (stricmp(module, szModule) != 0) {
			continue;
		}

		for (PIMAGE_THUNK_DATA originalThunk = (PIMAGE_THUNK_DATA)((DWORD)m_pDOS + rva2FileOffset(imp->OriginalFirstThunk)),
			firstThunk = (PIMAGE_THUNK_DATA)((DWORD)m_pDOS + rva2FileOffset(imp->FirstThunk));
			originalThunk->u1.Function != 0;
			originalThunk++, firstThunk++) {
				if (originalThunk->u1.Function & IMAGE_ORDINAL_FLAG32) {
					if ((DWORD)name == IMAGE_ORDINAL32(originalThunk->u1.Function)) {
						return ptr2va(&firstThunk->u1.Function);
					}
				} else {
					const char *importName = (const char*)((PIMAGE_IMPORT_BY_NAME)((DWORD)m_pDOS + rva2FileOffset(originalThunk->u1.AddressOfData)))->Name;
					if (!stricmp(name, importName)) {
						return ptr2va(&firstThunk->u1.Function);
					}
				}
			}
	}

	return 0;
}
Example #2
0
  FARPROC PatchImportOld(char* sourceModule, char* importModule, LPCSTR name, void* patchFunction)
  {
    if ( !name )
      return NULL;

    HMODULE tempModule = GetModuleHandleA(sourceModule);
    if ( !tempModule )
      return NULL;

    IMAGE_THUNK_DATA32* importOrigin = _GetImportsList(sourceModule, importModule);
    if ( !importOrigin )
      return NULL;

    DWORD* importFunction = _GetFunctionsList(sourceModule, importModule);
    if ( !importFunction )
      return NULL;

    for (u32 i = 0; importOrigin[i].u1.Ordinal != 0; i++)
    {
      if (IMAGE_SNAP_BY_ORDINAL32(importOrigin[i].u1.Ordinal) && (DWORD)name < 0xFFFF)
      {
        if (IMAGE_ORDINAL32(importOrigin[i].u1.Ordinal) == IMAGE_ORDINAL32((DWORD)name))
        {
          FARPROC oldFxn = (FARPROC)importFunction[i];
          WriteMem(&importFunction[i], &patchFunction, 4);
          return oldFxn;
        }
      }
      else
      {
#pragma warning(suppress: 6387)
        if (_strcmpi(name, (const char*)((PIMAGE_IMPORT_BY_NAME)((u32)importOrigin[i].u1.AddressOfData + (u32)tempModule))->Name) == 0)
        {
          FARPROC oldFxn = (FARPROC)importFunction[i];
          WriteMem(&importFunction[i], &patchFunction, 4);
          return oldFxn;
        }
      }
    }
    return NULL;
  }
Example #3
0
//==============================================================================
bool PEFile::readImportTable() {
    DWORD tableRVA = peHeaders.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
    DWORD tableOffset = rvaToOffset(tableRVA);
    if (tableOffset == 0) {
        return false;
    }

    ZeroMemory(&importTable, sizeof(PE_IMPORT_DLL));

    IMAGE_IMPORT_DESCRIPTOR* importDesc = (IMAGE_IMPORT_DESCRIPTOR*)(peMemory + tableOffset);
    IMAGE_THUNK_DATA* importThunk;
    PE_IMPORT_DLL* importDll = &this->importTable;
    PE_IMPORT_FUNCTION* importFunction;

    while (true) {
        importDll->DllName = (char*)(peMemory + rvaToOffset(importDesc->Name));
        if (importDesc->OriginalFirstThunk > 0) {
            importThunk = (IMAGE_THUNK_DATA*)(peMemory + rvaToOffset(importDesc->OriginalFirstThunk));
        } else {
            importThunk = (IMAGE_THUNK_DATA*)(peMemory + rvaToOffset(importDesc->FirstThunk));
        }

        importDll->Functions = new PE_IMPORT_FUNCTION();
        ZeroMemory(importDll->Functions, sizeof(PE_IMPORT_FUNCTION));
        importFunction = importDll->Functions;
        while (true) {
            if ((importThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG32) == IMAGE_ORDINAL_FLAG32) {
                importFunction->FunctionId = IMAGE_ORDINAL32(importThunk->u1.Ordinal);
            } else {
                DWORD nameOffset = rvaToOffset(importThunk->u1.AddressOfData);
                importFunction->FunctionName = (char*)(peMemory + nameOffset + 2);
            }

            importThunk = (IMAGE_THUNK_DATA*)((char*)importThunk + sizeof(IMAGE_THUNK_DATA));
            if (importThunk->u1.AddressOfData == 0) {
                break;
            }
            importFunction->Next = new PE_IMPORT_FUNCTION();
            ZeroMemory(importFunction->Next, sizeof(PE_IMPORT_FUNCTION));
            importFunction = importFunction->Next;
        }

        importDesc = (IMAGE_IMPORT_DESCRIPTOR*)((char*)importDesc + sizeof(IMAGE_IMPORT_DESCRIPTOR));
        if (importDesc->Name == 0) {
            break;
        }
        importDll->Next = new PE_IMPORT_DLL();
        ZeroMemory(importDll->Next, sizeof(PE_IMPORT_DLL));
        importDll = importDll->Next;
    }

    return true;
}
Example #4
0
HRESULT PE_PrintImport(PBYTE pBase, IMAGE_DATA_DIRECTORY DataImport, BOOL bImport)
{
	HRESULT                      result = S_OK;
	PIMAGE_IMPORT_DESCRIPTOR     pImportBlack = NULL;
	PIMAGE_THUNK_DATA32 	 	 pFirstThunkData32 = NULL;
	PIMAGE_THUNK_DATA32 	   	 pOriginalThunkData32 = NULL;
	PIMAGE_IMPORT_BY_NAME 		 pImageImportByName = NULL;
	pImportBlack = PIMAGE_IMPORT_DESCRIPTOR(pBase + DataImport.VirtualAddress);

	if (!pImportBlack || !DataImport.Size)
	{
		dprintf("没有导入表 \n");
		return S_OK ;
	}
	char                       *pDllName = NULL;
	if (bImport)
	{
		while (pImportBlack->Name != 0 && pImportBlack->Characteristics != 0)
		{
			pFirstThunkData32 = (PIMAGE_THUNK_DATA32)((ULONG)pBase + (ULONG)(pImportBlack->FirstThunk));
			pOriginalThunkData32 = (PIMAGE_THUNK_DATA32)((ULONG)pBase + (ULONG)(pImportBlack->OriginalFirstThunk));
			pDllName = (PCHAR)((ULONG_PTR)pBase + (ULONG_PTR)pImportBlack->Name);
			dprintf("DLL  name  is  %s\n", pDllName);
			dprintf("序号      相对偏移      函数地址      函数名称 \n");
			while (pOriginalThunkData32->u1.Ordinal != 0)
			{
				if (IMAGE_SNAP_BY_ORDINAL32(pOriginalThunkData32->u1.Ordinal))
				{
					dprintf("%04d    0x%08x    0x%08x    无\n", IMAGE_ORDINAL32(pOriginalThunkData32->u1.Ordinal), (ULONG_PTR)pOriginalThunkData32 - (ULONG_PTR)pBase, *pFirstThunkData32);
				}
				else
				{
					pImageImportByName = (PIMAGE_IMPORT_BY_NAME)((UCHAR*)pBase + pOriginalThunkData32->u1.AddressOfData);
					dprintf("%04d    0x%08x    0x%08x    %s\n", pImageImportByName->Hint, (ULONG_PTR)pOriginalThunkData32->u1.AddressOfData, *pFirstThunkData32, pImageImportByName->Name);
				}
				pOriginalThunkData32++;
				pFirstThunkData32++;
			}
			pImportBlack++;
		}
	}
	return result;
}