#include "stdafx.h"
#include <Windows.h>
DWORD RVA2Offset(PIMAGE_NT_HEADERS pNTHeader, DWORD dwRVA)
{
PIMAGE_SECTION_HEADER pSection = (PIMAGE_SECTION_HEADER)((DWORD)pNTHeader + sizeof(IMAGE_NT_HEADERS));
for(int i = 0; i < pNTHeader->FileHeader.NumberOfSections; i++)
{
if(dwRVA >= pSection[i].VirtualAddress && dwRVA < (pSection[i].VirtualAddress + pSection[i].SizeOfRawData))
{
return pSection[i].PointerToRawData + (dwRVA - pSection[i].VirtualAddress);
}
}
return 0;
}
int _tmain(int argc, _TCHAR* argv[])
{
HANDLE hFile = CreateFile(argv[1], GENERIC_ALL, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL);
HANDLE hMapping = CreateFileMapping(hFile, NULL, PAGE_READWRITE, 0, 0, NULL);
PVOID pbFile = MapViewOfFile(hMapping, FILE_MAP_ALL_ACCESS, 0, 0, 0);
if(INVALID_HANDLE_VALUE == hFile || NULL == hMapping || NULL == pbFile)
{
printf("\n\t---------- The File Inexistence! ----------\n");
goto EXIT;
}
PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)pbFile;
PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((DWORD)pbFile + pDosHeader->e_lfanew);
if(0x00004550 != pNTHeader->Signature)
{
printf("\n\t---------- Lawless PE File! ----------\n");
goto EXIT;
}
DWORD dwExportOffset = RVA2Offset(pNTHeader, pNTHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
PIMAGE_EXPORT_DIRECTORY pExport = (PIMAGE_EXPORT_DIRECTORY)((DWORD)pbFile + dwExportOffset);
DWORD dwFunctionNameOffset = (DWORD)pbFile + RVA2Offset(pNTHeader, pExport->Name);
DWORD* pdwNamesAddress = (DWORD*)((DWORD)pbFile + RVA2Offset(pNTHeader, pExport->AddressOfNames));
DWORD* pdwFunctionAddress = (DWORD*)((DWORD)pbFile + RVA2Offset(pNTHeader, pExport->AddressOfFunctions));
WORD* pwOrdinals = (WORD*)((DWORD)pbFile + RVA2Offset(pNTHeader, pExport->AddressOfNameOrdinals));
if(0 == pExport->NumberOfFunctions)
{
printf("\n\t---------- No Export Tabel! ----------\n");
goto EXIT;
}
printf("FileName: %s\n", dwFunctionNameOffset);
printf("NumberOfFunctions: %d\n", pExport->NumberOfFunctions);
printf("NumberOfNames: %d\n\n", pExport->NumberOfNames);
printf("NameExport:\n\n");
for(int i = 0; i < pExport->NumberOfNames; i++)
{
DWORD dwFunctionAddress = pdwFunctionAddress[pwOrdinals[i]];
DWORD pdwFunNameOffset = (DWORD)pbFile + RVA2Offset(pNTHeader, pdwNamesAddress[i]);
printf("[ExportNum]: %-4d [Name]: %-30s [RVA]: 0x%08X\n", pExport->Base + i, pdwFunNameOffset, dwFunctionAddress);
}
printf("\nNumberExport:\n\n");
for(int i = 0; i < pExport->NumberOfFunctions - pExport->NumberOfNames; i++)
{
printf("[ExportNum]: %-4d [RVA]: 0x%08X\n", pExport->Base + i, pdwFunctionAddress[i]);
}
printf("\n");
EXIT:
if(NULL != pbFile)
{
UnmapViewOfFile(pbFile);
}
if(NULL != hMapping)
{
CloseHandle(hMapping);
}
if (INVALID_HANDLE_VALUE != hFile)
{
CloseHandle(hFile);
}
return 0;
}