通过pe结构获取exe或者dll文件的依赖库
void printDependsDLLs(const char * filePath)
{
//通过pe的格式来找到引用的dll
HANDLE hFile = CreateFile(filePath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
if( hFile == INVALID_HANDLE_VALUE)
{
printf("找不到模块路径\n");
return;
}
HANDLE hFileMap = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
if(hFileMap == NULL || hFileMap == INVALID_HANDLE_VALUE)
{
printf("maping fail");
return;
}
LPBYTE lpbaseAddress = (LPBYTE)MapViewOfFile(hFileMap, FILE_MAP_READ, 0, 0, 0);
if(lpbaseAddress == NULL)
{
printf("could not map view of file");
return;
}
PIMAGE_DOS_HEADER pDosHeader =(PIMAGE_DOS_HEADER)lpbaseAddress;
//PIMAGE_NT_HEADERS pNtHeaders =(PIMAGE_NT_HEADERS)(lpbaseAddress + pDosHeader->e_lfanew);
PIMAGE_NT_HEADERS pNtHeaders = ImageNtHeader(lpbaseAddress);
DWORD rva_import_table = pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
if(rva_import_table == 0)
{
printf("not import table");
UnmapViewOfFile(lpbaseAddress);
CloseHandle(hFileMap);
CloseHandle(hFile);
return;
}
PIMAGE_IMPORT_DESCRIPTOR pImageTable = (PIMAGE_IMPORT_DESCRIPTOR)ImageRvaToVa(pNtHeaders, lpbaseAddress, rva_import_table, NULL);
IMAGE_IMPORT_DESCRIPTOR null_iid;
//IMAGE_THUNK_DATA null_thunk;
memset(&null_iid, 0, sizeof(null_iid));
//memset(&null_thunk, 0, sizeof(null_thunk));
for(int i = 0; memcmp(pImageTable + i, &null_iid, sizeof(null_iid)) != 0; i++)
{
LPCSTR szDllName=(LPCSTR)ImageRvaToVa(pNtHeaders, lpbaseAddress, pImageTable[i].Name, NULL);
printf(szDllName);
printf("\n");
}
UnmapViewOfFile(lpbaseAddress);
CloseHandle(hFileMap);
CloseHandle(hFile);
}

浙公网安备 33010602011771号