PE导出导出表

关注

转载最新推荐文章于 2026-04-05 03:01:33 发布 1.1k 阅读 AI 写同款· GEO 优化 ›

PE文件——导入表&导出表&函数覆盖 PE文件的基本结构图第一个字段4D 5A被定义成字符“MZ”作为识别标志，后面的一些字段指明了入口地址、堆栈位置和重定位表位置等。对于PE文件来说，有用的是最后的e_lfanew字段，这个字段指出了真正的PE文件头在文件中的位置，这个位置总是以8字节为单位对齐的。判断是否是PE文件 1.使用Winhex工具，从文件头4D 5A（MZ）开始，跳转3C（即偏移3C）； 2.跳转后可读取到数据为0000 00B0； 3.再跳转到地址0000 00B0； 4.若该地址数据为50 45（即PE）就为PE 阅读详情

// export_test.cpp : Defines the entry point for the console application.
//
#include "stdafx.h"
#include "windows.h"
int export_jixi(unsigned long pmodule ,char *function)
{
 if(pmodule == 0)
  return -1;
 if(IMAGE_DOS_SIGNATURE != *(unsigned short*)pmodule)
  return -1;
 unsigned long peheader=pmodule + *(unsigned long*)(pmodule + 0x3C);
 if(IMAGE_NT_SIGNATURE != *(unsigned long*)peheader)
  return -1;
 unsigned long export=*(unsigned long*)(peheader + 0x78) + pmodule;
 if(export == pmodule)
  return -1;
 unsigned long base=0;
 unsigned long numoffunction=0;
 unsigned long numofname=0;
 unsigned long *addrofname=NULL;
 unsigned long *addroffunction=NULL;
 unsigned short *addroforgname=NULL;
 //printf("base:%d name:%s\r\n" ,*(unsigned long*)(export+0x10) ,*(unsigned long*)(export+0x0C)+pmodule);
 numoffunction = *(unsigned long*)(export + 0x14);
 numofname = *(unsigned long*)(export + 0x18);
 //printf("numoffunction :%d ,numofname :%d \r\n" ,numoffunction ,numofname);
 addrofname = (unsigned long*)(*(unsigned long*)(export + 0x20) + pmodule);
 addroforgname = (unsigned short*)(*(unsigned long*)(export + 0x24) + pmodule);
 addroffunction = (unsigned long*)(*(unsigned long*)(export + 0x1C) + pmodule);
 int index=0;
 for (int i=0 ;i<numofname ;i++)
 {
  if(!strncmp(function ,(char*)(addrofname[i]+pmodule) ,strlen(function)))
  {
    index =base + addroforgname[i];
    return addroffunction[index] + pmodule;
  }
 }
 return 0;
 
}
int main(int argc, char* argv[])
{
 HMODULE hlib=LoadLibrary("kernel32");
 printf("%x\r\n" ,export_jixi((unsigned long)hlib ,"GetProcAddress"));
 return 0;
}

收录于