PE文件和COFF文件格式分析——导出表

IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; 

#define IMAGE_DIRECTORY_ENTRY_EXPORT          0   // Export Directory
#define IMAGE_DIRECTORY_ENTRY_IMPORT          1   // Import Directory
#define IMAGE_DIRECTORY_ENTRY_RESOURCE        2   // Resource Directory
#define IMAGE_DIRECTORY_ENTRY_EXCEPTION       3   // Exception Directory
#define IMAGE_DIRECTORY_ENTRY_SECURITY        4   // Security Directory
#define IMAGE_DIRECTORY_ENTRY_BASERELOC       5   // Base Relocation Table
#define IMAGE_DIRECTORY_ENTRY_DEBUG           6   // Debug Directory
//      IMAGE_DIRECTORY_ENTRY_COPYRIGHT       7   // (X86 usage)
#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE    7   // Architecture Specific Data
#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR       8   // RVA of GP
#define IMAGE_DIRECTORY_ENTRY_TLS             9   // TLS Directory
#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG    10   // Load Configuration Directory
#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT   11   // Bound Import Directory in headers
#define IMAGE_DIRECTORY_ENTRY_IAT            12   // Import Address Table
#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT   13   // Delay Load Import Descriptors
#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14   // COM Runtime descriptor

typedef struct _IMAGE_EXPORT_DIRECTORY {
    DWORD   Characteristics;
    DWORD   TimeDateStamp;
    WORD    MajorVersion;
    WORD    MinorVersion;
    DWORD   Name;
    DWORD   Base;
    DWORD   NumberOfFunctions;
    DWORD   NumberOfNames;
    DWORD   AddressOfFunctions;     // RVA from base of image
    DWORD   AddressOfNames;         // RVA from base of image
    DWORD   AddressOfNameOrdinals;  // RVA from base of image
} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;

// 导出表信息
typedef struct _IMAGE_Export_Address_Table_
{
    union {
        DWORD dwExportRVA;
        DWORD dwForwarderRVA;
    };
}IMAGE_Export_Address_Table, *pIMAGE_Export_Address_Table;

typedef struct _IMAGE_Export_Name_Pointer_Table_ {
    DWORD dwPointer;
}IMAGE_Export_Name_Pointer_Table,*pIMAGE_Export_Name_Pointer_Table;

lpFunc = ExportAddressTable[ExportNameTable.find(FuncName)]

typedef struct _IMAGE_Export_Ordinal_Table_ {
    WORD dwOrdinal;
}IMAGE_Export_Ordinal_Table,*pIMAGE_Export_Ordinal_Table;

Characteristics;        0x00000000
TimeDateStamp;          0x3B7D74B7
MajorVersion;           0x0000
MinorVersion;           0x0000
Name;                   0x00002E6C
Base;                   0x00000001
NumberOfFunctions;      0x00000002 
NumberOfNames;          0x00000002
AddressOfFunctions;     0x00002E58
AddressOfNames;         0x00002E60
AddressOfNameOrdinals;  0x00002E68

i = Search_ExportNamePointerTable (ExportName);
ordinal = ExportOrdinalTable [i];
SymbolRVA = ExportAddressTable [ordinal - OrdinalBase];

LIBRARY	"DllTestIndex"
EXPORTS
	Ret1 @2.
	Ret2 @4
	Ret3 @8
	Ret4 @6

typedef int(WINAPI* PRetN)();

void ExprotFunc(LPSTR lpFileName) {
    HMODULE hDll = NULL;
    do {
        printf("%s\n", lpFileName);
        hDll = LoadLibraryA(lpFileName);
        if ( NULL == hDll ) {
            break;
        }
        for ( int nIndex = 0; nIndex <  10; nIndex ++ ) {
            PRetN pRetn = (PRetN)GetProcAddress( hDll, (LPCSTR)(LPVOID)(nIndex) );
            if ( NULL != pRetn ) {
                printf("nIndex is %d: Value is %d\n",nIndex,pRetn());
            }
        }
        FreeLibrary(hDll);
    } while (0);
}

int _tmain(int argc, _TCHAR* argv[])
{
    ExprotFunc("DllTestIndex.dll");
    ExprotFunc("DllTestIndex_Modify.dll");
    system("pause");
	return 0;
}

BOOL CGetPEInfo::GetExportInfo()
{
    BOOL bSuc = ( 0 == m_ExpDir.Characteristics ) ? TRUE : FALSE;
    if ( FALSE == bSuc ) {
        _ASSERT(FALSE);
    }

	m_ExpFullInfo.ExpDir = m_ExpDir;

    std::string wszTime;
    if ( FALSE == GetTime( m_ExpDir.TimeDateStamp, wszTime ) ) {
        _ASSERT(FALSE);
    }

	m_ExpFullInfo.wszTime = wszTime;

    std::string wszDllName;
    DWORD dwNameRA = 0;
    if ( FALSE == GetRAByRVA( m_ExpDir.Name, dwNameRA ) ) {
        _ASSERT(FALSE);
    }
    else {
        LPBYTE lpFileName = m_lpFileStart + dwNameRA;
        if ( lpFileName < m_lpFileStart || lpFileName > m_lpFileEnd ) {
            wszDllName.clear();
        }
        else {
            wszDllName = (LPSTR)lpFileName;
        }
    }
	m_ExpFullInfo.szImgName = wszDllName;

	MapIMAGE_Export_Address_Table MapImageExpAddrTable;
	DWORD dwFunAddrTableRA = 0;
	if ( FALSE ==  GetRAByRVA( m_ExpDir.AddressOfFunctions, dwFunAddrTableRA ) ) {
        if ( 0 != m_ExpDir.AddressOfFunctions ) {
            //_ASSERT(FALSE);
        }
        else {
        }
	}
	else {
		LPBYTE lpStart = m_lpFileStart + dwFunAddrTableRA;
		for ( WORD i = 0; i < m_ExpDir.NumberOfFunctions; i++ ) {
			IMAGE_Export_Address_Table ImgExpAddrTable;
            if ( FALSE == SafeCopy( &ImgExpAddrTable, lpStart, sizeof(IMAGE_Export_Address_Table)) ) {
                break;
            }
			MapImageExpAddrTable[i] = ImgExpAddrTable;
			lpStart += sizeof(IMAGE_Export_Address_Table);
		}
	}

	MapIMAGE_Export_Name_Pointer_Table MapImageExpNamePointerTable;
	DWORD dwFunNameTableRA = 0;
	if ( FALSE == GetRAByRVA( m_ExpDir.AddressOfNames, dwFunNameTableRA ) ) {
        if ( 0 != m_ExpDir.AddressOfNames ) {
            _ASSERT(FALSE);
        }
        else {
        }
	}
	else {
		LPBYTE lpStart = m_lpFileStart + dwFunNameTableRA;
		for ( DWORD i = 0; i < m_ExpDir.NumberOfNames; i++ ) {
			IMAGE_Export_Name_Pointer_Table ImgExpNamePointer;
            if ( FALSE == SafeCopy( &ImgExpNamePointer, lpStart , sizeof(IMAGE_Export_Name_Pointer_Table) ) ) {
                break;
            }
			MapImageExpNamePointerTable[i] = ImgExpNamePointer;
			lpStart += sizeof(IMAGE_Export_Name_Pointer_Table);
		}
	}

	MapIMAGE_Export_Ordinal_Table MapImageExpOrdinalTable;
	DWORD dwOrdinalTableRA = 0;
	if ( FALSE == GetRAByRVA( m_ExpDir.AddressOfNameOrdinals, dwOrdinalTableRA ) ) {
        if (  0 != m_ExpDir.AddressOfNameOrdinals ) {
            _ASSERT(FALSE);
        }
        else {
            //C:\Config.Msi\1ecac1a.rbf
        }
	}
	else {
		LPBYTE lpStart = m_lpFileStart + dwOrdinalTableRA;
		for ( WORD i = 0; i < m_ExpDir.NumberOfNames; i++ ) {
			IMAGE_Export_Ordinal_Table ImgExpOrdinalTable;
            if ( FALSE == SafeCopy( &ImgExpOrdinalTable, lpStart, sizeof(IMAGE_Export_Ordinal_Table) ) ) {
                break;
            }
			MapImageExpOrdinalTable[i] = ImgExpOrdinalTable;
			lpStart += sizeof(IMAGE_Export_Ordinal_Table);
		}
	}

	EXPORT_TABLE_FULL_INFO ExpTableFullInfo;

    if ( 0 != m_ExpDir.Base && 1 != m_ExpDir.Base ) {
        _ASSERT(FALSE);
    }
    
	if ( m_ExpDir.NumberOfNames != m_ExpDir.NumberOfFunctions ) {
		// _ASSERT(FALSE);
	}

	//  应该按地址数量来算
	for ( MapIMAGE_Export_Address_TableIter ImgExpAdIter = MapImageExpAddrTable.begin();
		ImgExpAdIter != MapImageExpAddrTable.end();
		ImgExpAdIter++ )
	{
		std::string strName;
		strName.empty();

		ExpTableFullInfo.wHint = 0xFFFF;
		ExpTableFullInfo.wOrdinal = ImgExpAdIter->first + (WORD)m_ExpDir.Base;

        DWORD dwRVA = ImgExpAdIter->second.dwExportRVA;
        if ( FALSE == IsRVAinSection( dwRVA, IMAGE_DIRECTORY_ENTRY_EXPORT )
            && 0 != dwRVA ) {
                ExpTableFullInfo.bForwarderRVA = FALSE;
                ExpTableFullInfo.dwRVA.dwExportRVA = dwRVA;
        }
        else
        {
            ExpTableFullInfo.dwRVA.dwForwarderRVA = dwRVA;
            ExpTableFullInfo.bForwarderRVA = TRUE;

            DWORD dwForwarderRA;
            if ( FALSE == GetRAByRVA( ExpTableFullInfo.dwRVA.dwForwarderRVA, dwForwarderRA ) ) {
                if (  0 != ExpTableFullInfo.dwRVA.dwForwarderRVA ) {
                    _ASSERT(FALSE);
                }
                else {
                    // C:\4f1b3cac6fdc7b2cb9092b46e7c0fc71\Mobile Partner-dial\Mobile Partner-dial\mfc40u.dll
                    // _ASSERT(FALSE);
                }
                //continue;
            }
            else {
                ExpTableFullInfo.strForwarder = (LPSTR)(m_lpFileStart + dwForwarderRA);
            }
        }

		MapIMAGE_Export_Ordinal_TableIter ImgExpOrdIter = MapImageExpOrdinalTable.begin();
		for ( ;
			ImgExpOrdIter != MapImageExpOrdinalTable.end();
			ImgExpOrdIter++ )
		{
			if ( ImgExpAdIter->first != ImgExpOrdIter->second.dwOrdinal ) {
				continue;
			}

			ExpTableFullInfo.wHint = ImgExpOrdIter->first;

			for ( MapIMAGE_Export_Name_Pointer_TableIter ImgExpNamePointerIter = MapImageExpNamePointerTable.begin();
				ImgExpNamePointerIter != MapImageExpNamePointerTable.end();
				ImgExpNamePointerIter++ )
			{
				if ( ImgExpNamePointerIter->first != ExpTableFullInfo.wHint ) {
					continue;
				}
				DWORD dwNamePointerRA = 0;
				if ( FALSE == GetRAByRVA( ImgExpNamePointerIter->second.dwPointer, dwNamePointerRA ) ) {
                    continue;
				}
				else {
					strName =(LPSTR)(m_lpFileStart + dwNamePointerRA);
				}
				break;
			}
			break;
		}

        ExpTableFullInfo.strFuncName = strName;

		m_ExpFullInfo.vecExpTable.push_back( ExpTableFullInfo );
	}

    return bSuc;
}