qq_41490873的博客

【代码】PE结构~

#include <Windows.h> #include<stdio.h> #include <imagehlp.h> #include <locale.h> #pragma comment(lib,"DbgHelp.lib") BOOL CALLBACK CallBackProc(PSYMBOL_INFO pSymInfo, ULONG SymbolSize, PVOID UserContext) { printf("函数名: %s\r\n地址: %0

导出表结构 typedef struct _IMAGE_EXPORT_DIRECTORY { DWORD Characteristics; DWORD TimeDateStamp; WORD MajorVersion; WORD MinorVersion; DWORD Name; //指向该导出表文件名 （RVA） DWORD Base;//导出表的起始序号 （序号表的......

#include"stdafx.h" #include <windows.h> #include <stdio.h> #include <vector> #define uint16_t USHORT #define uint32_t DWORD typedef struct _UNICODE_STRING { uint16_t Length; uint16_t MaximumLength; _Field_size_bytes_part_(MaximumLengt

#include"stdafx.h" #include <windows.h> VOID __stdcall mySleep(DWORD m) { MessageBoxA(0, "Hook 成功", "IAT hook", MB_OK); } PVOID EnumAPI() { PBYTE ImageBase; PIMAGE_THUNK_DATA r; PIMAGE_NT_HEADERS pNtHeader; PIMAGE_IMPORT_DESCRIPTOR pImport; //

#define SIZEOF_SECTIONHEADER 0x28 DWORD RVA_To_FOA(LPVOID lpImageBase, DWORD dwImageRVA) { //1.判断文件对齐与内存对齐是否一样 判断 dwRVA与ImageBase的大小 是否为正确的虚拟地址 //2.获得在内存中的RVA （dwVirtualAddress-dwImageBase） //3.判断RVA在哪个节中（循环判断 循环次数为节表的数量 节表中的virtualaddress R

数据目录表的第二项为导入表 导入表结构 typedef struct _IMAGE_IMPORT_DESCRIPTOR { DWORD OriginalFirstThunk;//指向INT表 导入名字表 DWORD TimeDateStamp; DWORD ForwarderChain; DWORD Name; DWORD FirstThunk;//指向IAT...

通过数据目录表的第三个结构可以得到资源表的RVA typedef struct _IMAGE_DATA_DIRECTORY { DWORD VirtualAddress; DWORD Size; } IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY; typedef struct _IMAGE_RESOURCE_DIRECTORY ...