通过pe结构获取exe或者dll文件的依赖库

void printDependsDLLs(const char * filePath)
{
  //通过pe的格式来找到引用的dll
  HANDLE hFile = CreateFile(filePath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
  if( hFile == INVALID_HANDLE_VALUE)
  {
    printf("找不到模块路径\n");
    return;
  }
  HANDLE hFileMap = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
  if(hFileMap == NULL || hFileMap == INVALID_HANDLE_VALUE)
  {
    printf("maping fail");
    return;
  }
  LPBYTE lpbaseAddress = (LPBYTE)MapViewOfFile(hFileMap, FILE_MAP_READ, 0, 0, 0);
  if(lpbaseAddress == NULL)
  {
    printf("could not map view of file");
    return;
  }
  PIMAGE_DOS_HEADER pDosHeader =(PIMAGE_DOS_HEADER)lpbaseAddress;
  //PIMAGE_NT_HEADERS pNtHeaders =(PIMAGE_NT_HEADERS)(lpbaseAddress + pDosHeader->e_lfanew);
  PIMAGE_NT_HEADERS pNtHeaders = ImageNtHeader(lpbaseAddress);
  DWORD rva_import_table = pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
  if(rva_import_table == 0)
  {
    printf("not import table");
    UnmapViewOfFile(lpbaseAddress);
    CloseHandle(hFileMap);
    CloseHandle(hFile);
    return;
  }
  PIMAGE_IMPORT_DESCRIPTOR pImageTable = (PIMAGE_IMPORT_DESCRIPTOR)ImageRvaToVa(pNtHeaders, lpbaseAddress, rva_import_table, NULL);
  IMAGE_IMPORT_DESCRIPTOR null_iid;
  //IMAGE_THUNK_DATA null_thunk;
  memset(&null_iid, 0, sizeof(null_iid));
  //memset(&null_thunk, 0, sizeof(null_thunk));
  for(int i = 0; memcmp(pImageTable + i, &null_iid, sizeof(null_iid)) != 0; i++)
  {
    LPCSTR szDllName=(LPCSTR)ImageRvaToVa(pNtHeaders, lpbaseAddress, pImageTable[i].Name, NULL);
    printf(szDllName);
    printf("\n");
  }
  UnmapViewOfFile(lpbaseAddress);
  CloseHandle(hFileMap);
  CloseHandle(hFile);
}

posted @ 2016-11-23 13:52  hbcdr  阅读(398)  评论(0)    收藏  举报