打印导出表，还有两个莫名其妙的函数-优快云博客

本文链接：https://blog.youkuaiyun.com/pluginL/article/details/137362181

文章介绍了如何在Windows可执行文件（PE文件）中解析导出表，包括名称、基地址、函数数量和地址，以及两个辅助函数GetFunctionAddrByName和GetFunctionAddrByOrdinals，用于根据函数名或序号查找函数地址。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

没什么难度，体力活

//打印导出表
BOOL PrintExportTable(BYTE* fileName) {
	PVOID pFileBuffer = FileToFileBuffer(fileName);
	PIMAGE_DOS_HEADER pDosHeader = pFileBuffer;
	PIMAGE_NT_HEADERS pNTHeader = (DWORD)pDosHeader + pDosHeader->e_lfanew;
	if (pNTHeader->Signature != IMAGE_NT_SIGNATURE) {
		printf("File is not PE\n");
		free(pFileBuffer);
		return FALSE;
	}
	PIMAGE_FILE_HEADER pFileHeader = &pNTHeader->FileHeader;
	PIMAGE_OPTIONAL_HEADER pOptHeader = (DWORD)pFileHeader + sizeof(IMAGE_FILE_HEADER);
	PIMAGE_SECTION_HEADER pSecHeader = (DWORD)pOptHeader + pFileHeader->SizeOfOptionalHeader;
	PIMAGE_EXPORT_DIRECTORY pExportTable = VAToFOA(pOptHeader->DataDirectory[0].VirtualAddress, pFileBuffer);
	printf("name:%08x\n", pExportTable->Name);
	printf("Base:%08x\n", pExportTable->Base);
	printf("NumberOfFunctions:%08x\n", pExportTable->NumberOfFunctions);
	printf("NumberOfNames:%08x\n", pExportTable->NumberOfNames);
	PDWORD pAddrOfFunctionsFOA = VAToFOA(pExportTable->AddressOfFunctions, pFileBuffer);
	for (size_t i = 0; i < pExportTable->NumberOfFunctions; i++) {
		printf("Function Address:%08x\n", *(pAddrOfFunctionsFOA + i));
	}
	PDWORD pAddrOfNameFOA = VAToFOA(pExportTable->AddressOfNames, pFileBuffer);
	for (size_t i = 0; i < pExportTable->NumberOfNames; i++) {
		PBYTE name = VAToFOA(*(pAddrOfNameFOA + i), pFileBuffer);
		printf("Function name:%s\n", name);
	}
	PWORD pAddrOfNameOrdinalsFOA = VAToFOA(pExportTable->AddressOfNameOrdinals, pFileBuffer);
	for (size_t i = 0; i < pExportTable->NumberOfNames; i++) {
		printf("Function name ordinals:%04x\n", *(pAddrOfNameOrdinalsFOA + i));
	}
	return TRUE;
}

//根据名字寻找函数地址
PVOID GetFunctionAddrByName(PVOID pFileBuffer, PBYTE pFunctionName) {
	PIMAGE_DOS_HEADER pDosHeader = pFileBuffer;
	PIMAGE_NT_HEADERS pNTHeader = (DWORD)pDosHeader + pDosHeader->e_lfanew;
	if (pNTHeader->Signature != IMAGE_NT_SIGNATURE) {
		printf("File is not PE\n");
		free(pFileBuffer);
		return FALSE;
	}
	PIMAGE_FILE_HEADER pFileHeader = &pNTHeader->FileHeader;
	PIMAGE_OPTIONAL_HEADER pOptHeader = (DWORD)pFileHeader + sizeof(IMAGE_FILE_HEADER);
	PIMAGE_SECTION_HEADER pSecHeader = (DWORD)pOptHeader + pFileHeader->SizeOfOptionalHeader;
	PIMAGE_EXPORT_DIRECTORY pExportTable = VAToFOA(pOptHeader->DataDirectory[0].VirtualAddress, pFileBuffer);
	PDWORD pAddrOfNamesFOA = VAToFOA(pExportTable->AddressOfNames, pFileBuffer);
	for (size_t i = 0; i < pExportTable->NumberOfNames; i++) {
		PBYTE pName = VAToFOA(*(pAddrOfNamesFOA + i), pFileBuffer);
		if (!strcmp(pName,pFunctionName)) {
			PWORD pAddrOfOrdinalsFOA = VAToFOA(pExportTable->AddressOfNameOrdinals, pFileBuffer);
			PDWORD pFunctionAddrFOA = VAToFOA(pExportTable->AddressOfFunctions, pFileBuffer);
			PVOID pFunctionAddr = *(pFunctionAddrFOA + *(pAddrOfOrdinalsFOA + i));
			printf("Found it!Function Address:0x%08p\n", pFunctionAddr);
			return pFunctionAddr;
		}
	}
	printf("cant find it\n");
	return 0;
}

//根据序号寻找，多写了一点还把名字算出来了
PVOID GetFunctionAddrByOrdinals(PVOID pFileBuffer, DWORD ordinals) {
	PIMAGE_DOS_HEADER pDosHeader = pFileBuffer;
	PIMAGE_NT_HEADERS pNTHeader = (DWORD)pDosHeader + pDosHeader->e_lfanew;
	if (pNTHeader->Signature != IMAGE_NT_SIGNATURE) {
		printf("File is not PE\n");
		free(pFileBuffer);
		return FALSE;
	}
	PIMAGE_FILE_HEADER pFileHeader = &pNTHeader->FileHeader;
	PIMAGE_OPTIONAL_HEADER pOptHeader = (DWORD)pFileHeader + sizeof(IMAGE_FILE_HEADER);
	PIMAGE_SECTION_HEADER pSecHeader = (DWORD)pOptHeader + pFileHeader->SizeOfOptionalHeader;
	PIMAGE_EXPORT_DIRECTORY pExportTable = VAToFOA(pOptHeader->DataDirectory[0].VirtualAddress, pFileBuffer);
	DWORD number = ordinals - pExportTable->Base;
	if (number >= pExportTable->NumberOfFunctions) {
		printf("cant find it\n");
		return 0;
	}
	PBYTE pName = 0;
	if (number >= pExportTable->NumberOfNames) {
		pName = "no name";
	}
	else {
		PWORD pAddressOrdinalsFOA = VAToFOA(pExportTable->AddressOfNameOrdinals, pFileBuffer);
		PDWORD pAddressNamesFOA = VAToFOA(pExportTable->AddressOfNames, pFileBuffer);
		for (size_t i = 0; i < pExportTable->NumberOfNames; i++) {
			if (number == pAddressOrdinalsFOA[i]) {
				pName = VAToFOA(pAddressNamesFOA[i], pFileBuffer);
				break;
			}
		}
	}
	PDWORD pFunctionAddressFOA = VAToFOA(pExportTable->AddressOfFunctions, pFileBuffer);
	printf("Found it!Function name:%s address:%08x\n", pName, *(pFunctionAddressFOA + number));
	return *(pFunctionAddressFOA + number);
}