您的位置：首页 > 其它

内核分析PE获取DLL导出函数地址

2012-03-17 14:19 513 查看

来自：http://hi.baidu.com/lynnux/blog/item/cb2829459efeef2ccefca32b.html

内核分析PE获取DLL导出函数地址
2009年10月22日星期四 23:45

存档而已，别笑我菜哈~~~

DWORD GetDllFunctionAddress(char* lpFunctionName, PUNICODE_STRING pDllName)

{

HANDLE hThread, hSection, hFile, hMod;

SECTION_IMAGE_INFORMATION sii;

IMAGE_DOS_HEADER* dosheader;

IMAGE_OPTIONAL_HEADER* opthdr;

IMAGE_EXPORT_DIRECTORY* pExportTable;

DWORD* arrayOfFunctionAddresses;

DWORD* arrayOfFunctionNames;

WORD* arrayOfFunctionOrdinals;

DWORD functionOrdinal;

DWORD Base, x, functionAddress;

char* functionName;

STRING ntFunctionName, ntFunctionNameSearch;

PVOID BaseAddress = NULL;

SIZE_T size=0;

OBJECT_ATTRIBUTES oa = {sizeof oa, 0, pDllName, OBJ_CASE_INSENSITIVE};

IO_STATUS_BLOCK iosb;

ZwOpenFile(&hFile, FILE_EXECUTE | SYNCHRONIZE, &oa, &iosb, FILE_SHARE_READ, FILE_SYNCHRONOUS_IO_NONALERT);

oa.ObjectName = 0;

ZwCreateSection(&hSection, SECTION_ALL_ACCESS, &oa, 0,PAGE_EXECUTE, SEC_IMAGE, hFile);

ZwMapViewOfSection(hSection, NtCurrentProcess(), &BaseAddress, 0, 1000, 0, &size, (SECTION_INHERIT)1, MEM_TOP_DOWN, PAGE_READWRITE);

ZwClose(hFile);

hMod = BaseAddress;

dosheader = (IMAGE_DOS_HEADER *)hMod;

opthdr =(IMAGE_OPTIONAL_HEADER *) ((BYTE*)hMod+dosheader->e_lfanew+24);

pExportTable =(IMAGE_EXPORT_DIRECTORY*)((BYTE*) hMod + opthdr->DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT]. VirtualAddress);

arrayOfFunctionAddresses = (DWORD*)( (BYTE*)hMod + pExportTable->AddressOfFunctions);

arrayOfFunctionNames = (DWORD*)( (BYTE*)hMod + pExportTable->AddressOfNames);

arrayOfFunctionOrdinals = (WORD*)( (BYTE*)hMod + pExportTable->AddressOfNameOrdinals);

Base = pExportTable->Base;

RtlInitString(&ntFunctionNameSearch, lpFunctionName);

for(x = 0; x < pExportTable->NumberOfFunctions; x++)

{

functionName = (char*)( (BYTE*)hMod + arrayOfFunctionNames[x]);

RtlInitString(&ntFunctionName, functionName);

functionOrdinal = arrayOfFunctionOrdinals[x] + Base - 1;

functionAddress = (DWORD)( (BYTE*)hMod + arrayOfFunctionAddresses[functionOrdinal]);

if (RtlCompareString(&ntFunctionName, &ntFunctionNameSearch, TRUE) == 0)

{

ZwClose(hSection);

return functionAddress;

}

}

ZwClose(hSection);

return 0;

}

内容来自用户分享和网络整理，不保证内容的准确性，如有侵权内容，可联系管理员处理

标签：

相关文章推荐

新的分享

章节导航