PE文件之导入表

1. 导入表

2. 显示导入表信息的例子

; 作用: 将RVA地址转成FOA即文件偏移
; 参数: _pFileHdr 	指向读到内存中文件的基址指针
;       _dwRVA 		目标RVA地址
; 返回: 目标RVA转成文件偏移的值
RVA2FOA PROC USES esi edi edx, _pFileHdr:PTR BYTE, _dwRVA:DWORD
	
	mov esi, _pFileHdr 
	assume esi:ptr IMAGE_DOS_HEADER
	; 获取PE头
	mov edi, [esi].e_lfanew
	assume esi:nothing
	add edi, esi 
	assume edi:ptr IMAGE_NT_HEADERS32
	; 获取节数
	movzx ecx, [edi].FileHeader.NumberOfSections
	assume edi:nothing
	; 获取节表地址
	add edi, SIZEOF IMAGE_NT_HEADERS32
	assume edi:ptr IMAGE_SECTION_HEADER
L0:
	mov edx, _dwRVA
	cmp edx, [edi].VirtualAddress
	jb @F

	mov eax, [edi].VirtualAddress
	add eax, [edi].SizeOfRawData
	cmp edx, eax
	jae @F

	sub edx, [edi].VirtualAddress
	add edx, [edi].PointerToRawData
	mov eax, edx
	jmp Ending
@@:
	add edi, SIZEOF IMAGE_SECTION_HEADER
	loop L0
	xor eax, eax
Ending:
	ret

RVA2FOA ENDP

.data 
Crlf 				BYTE 0dh, 0ah, 0
szDllName 			BYTE "导出表: %s", 0dh, 0ah, 0
szSep				BYTE "---------------------------", 0dh, 0ah, 0
szINTRVA			BYTE "OriginalFirstThunk: 0x%08X", 0dh, 0ah, 0
szTimeStmp  		BYTE "TimeDateStamp: 0x%08X", 0dh, 0ah, 0
szForwarderChain	BYTE "ForwarderChain: 0x%08X", 0dh, 0ah, 0
szNameRVA			BYTE "Name: 0x%08X", 0dh, 0ah, 0
szFirstThunk		BYTE "FirstThunk: 0x%08X", 0dh, 0ah, 0dh, 0ah, 0
szFnInfo			BYTE "%hd %s", 0dh, 0ah, 0

szBuf				BYTE 64 DUP(0)

.code 
; 作用: 打印输出导入表信息
; 参数: _pFileHdr 	指向读到内存中文件的基址指针
; 返回: 无
_getImportTblInfo PROC _pFileHdr:PTR BYTE
	pushad 
	mov esi, _pFileHdr
	assume esi:PTR IMAGE_DOS_HEADER
	add esi, [esi].e_lfanew 
	assume esi:PTR IMAGE_NT_HEADERS32 
	mov esi, [esi].OptionalHeader.DataDirectory[8].VirtualAddress
	push esi
	mov eax, _pFileHdr
	push eax 
	call RVA2FOA

	mov esi, eax 
	add esi, _pFileHdr 
	assume esi:PTR IMAGE_IMPORT_DESCRIPTOR 

L0:
	; 确定导入表是否结束
	mov edx, [esi].Name1
	test edx, edx 
	jnz @F 
	jmp Ending 
@@:
	mov edx, [esi].OriginalFirstThunk
	test edx, edx 
	jnz @F 
	jmp Ending 
@@:
	mov edx, [esi].TimeDateStamp
	test edx, edx 
	jnz @F 
	jmp Ending 
@@:
	mov edx, [esi].ForwarderChain
	test edx, edx 
	jnz @F 
	jmp Ending 
@@:
	mov edx, [esi].FirstThunk
	test edx, edx 
	jnz @F 
	jmp Ending 
@@:
	; 进行IAT显示
	mov edx, [esi].Name1 
	push edx 
	push _pFileHdr 
	call RVA2FOA 
	add eax, _pFileHdr
	; 显示dll名称
	invoke wsprintf, OFFSET szBuf, OFFSET szDllName, eax 
	invoke crt_printf, OFFSET szBuf 
	invoke crt_printf, OFFSET szSep
	; 显示OriginalFirstThunk的RVA地址
	invoke wsprintf, OFFSET szBuf, OFFSET szINTRVA, [esi].OriginalFirstThunk 
	invoke crt_printf, OFFSET szBuf
	; 显示时间戳
	invoke wsprintf, OFFSET szBuf, OFFSET szTimeStmp, [esi].TimeDateStamp 
	invoke crt_printf, OFFSET szBuf
	; 显示ForwarderChain
	invoke wsprintf, OFFSET szBuf, OFFSET szForwarderChain, [esi].ForwarderChain 
	invoke crt_printf, OFFSET szBuf
	; 显示Name的RVA地址
	invoke wsprintf, OFFSET szBuf, OFFSET szNameRVA, [esi].Name1 
	invoke crt_printf, OFFSET szBuf
	; 显示FirstThunk的RVA地址
	invoke wsprintf, OFFSET szBuf, OFFSET szFirstThunk, [esi].FirstThunk 
	invoke crt_printf, OFFSET szBuf
	; 打印具体函数信息
	; 获取INT的RVA地址, 把VA转成FOA
	push [esi].OriginalFirstThunk
	push _pFileHdr 
	call RVA2FOA
	add eax, _pFileHdr
L1:
	assume eax:PTR IMAGE_THUNK_DATA 
	mov ebx, [eax].u1.Function
	test ebx, ebx 
	jz NextDesc
	push eax 
	mov eax, [eax].u1.Function
	test eax, 80000000h
	jnz BySeq
	push eax 
	push _pFileHdr
	call RVA2FOA
	add eax, _pFileHdr
	assume eax:PTR IMAGE_IMPORT_BY_NAME 
	movzx edx, WORD PTR [eax].Hint
	lea ebx, [eax].Name1 
	invoke wsprintf, OFFSET szBuf, OFFSET szFnInfo, edx, ebx
	invoke crt_printf, OFFSET szBuf
	pop eax 
	add eax, SIZEOF IMAGE_THUNK_DATA
	jmp @F 
BySeq:
	
@@:
	jmp L1 
NextDesc:
	push OFFSET Crlf
	call crt_printf
	push OFFSET Crlf
	call crt_printf
	add esi, SIZEOF IMAGE_IMPORT_DESCRIPTOR
	jmp L0
Ending:
	popad 
	ret 

_getImportTblInfo ENDP 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170

运行的部分截图:

3. 导入表图

(完)