绑定导入表

typedef struct _IMAGE_BOUND_IMPORT_DESCRIPTOR {
    DWORD   TimeDateStamp;
    WORD    OffsetModuleName;
    WORD    NumberOfModuleForwarderRefs;    // Array of zero or more IMAGE_BOUND_FORWARDER_REF follows
} IMAGE_BOUND_IMPORT_DESCRIPTOR,  *PIMAGE_BOUND_IMPORT_DESCRIPTOR;

typedef struct _IMAGE_BOUND_FORWARDER_REF {
    DWORD   TimeDateStamp;
    WORD    OffsetModuleName;
    WORD    Reserved;
} IMAGE_BOUND_FORWARDER_REF, *PIMAGE_BOUND_FORWARDER_REF;

#include "stdafx.h"
#include "PeTool.h"
#include "string.h"
 
#define SRC "C:\\Windows\\System32\\notepad.exe"
 
//解析导入表
void printBound(){
    //定义pe头结构指针
    PIMAGE_DOS_HEADER dosHeader = NULL;        //dos头指针
    PIMAGE_FILE_HEADER peHeader = NULL;        //pe头指针
    PIMAGE_OPTIONAL_HEADER32 opHeader = NULL;    //可选pe头指针
    PIMAGE_DATA_DIRECTORY dataDir = NULL;        //数据目录指针
    PIMAGE_BOUND_IMPORT_DESCRIPTOR boundDir= NULL;    //绑定导入表指针
    PIMAGE_BOUND_FORWARDER_REF bondRef = NULL;    //绑定依赖指针
 
    //1.将文件读入内存
    LPVOID pFileBuffer = NULL;
    DWORD fileSize = ReadPEFile(SRC, &pFileBuffer);
    if(!pFileBuffer){
        printf("读取dll文件失败\n");
        return;
    }
 
    //2.初始化头结构指针
    dosHeader = (PIMAGE_DOS_HEADER) pFileBuffer;
    peHeader = (PIMAGE_FILE_HEADER) ((DWORD)pFileBuffer + dosHeader->e_lfanew + 4);
    opHeader = (PIMAGE_OPTIONAL_HEADER32) ((DWORD)peHeader + IMAGE_SIZEOF_FILE_HEADER);
    dataDir = opHeader ->DataDirectory;
 
    //绑定导入表在头中，而不再节中
    DWORD boundDirRVA = dataDir[11].VirtualAddress;
    boundDir = (PIMAGE_BOUND_IMPORT_DESCRIPTOR)((DWORD)pFileBuffer + boundDirRVA);
    PIMAGE_BOUND_IMPORT_DESCRIPTOR currentBound = boundDir;
    
    //3.输出绑定导入表信息
    while(currentBound -> TimeDateStamp){
        getchar();
        LPSTR moduleName = (LPSTR) ((DWORD)(currentBound->OffsetModuleName) + (DWORD)boundDir);
        printf("\n=================%s=============\n", moduleName);
        printf("时间戳：%d\n",currentBound->TimeDateStamp );
        int i = currentBound->NumberOfModuleForwarderRefs;
        printf("依赖dll个数：%d\n", i);
        
        if(i>0){
            bondRef = (PIMAGE_BOUND_FORWARDER_REF) ((DWORD) currentBound + 8);
            printf("***********依赖dll***********\n");
            printf("依赖dll\t时间戳\n");
            for(int j=0;j<i;j++){
                LPSTR refName = LPSTR((DWORD)((bondRef + j)->OffsetModuleName) + (DWORD)boundDir);
                DWORD refTime = (bondRef + j) -> TimeDateStamp;
                printf("%s\t%d\n",refName,refTime);
            }
            currentBound = currentBound + (i+1);
        }else{
            currentBound++;
        }
    }
}
 
int main(int argc, char* argv[])
{
    //输出导入表信息
    printBound();
    getchar();
}