CreateFileMapping 其实应该没有关系!
以下供参考.
procedure TForm1.Button1Click(Sender: TObject);
var
s,FHeader:string;
f,map:Thandle;
p
ointer;
pDOSHeader
IMAGEDOSHEADER ;
pNTHeader
IMAGENTHEADERS ;
ntOff:longInt;
nS,i,RVA:integer;
tt:TTimeStamp;
pis
IMAGESECTIONHEADER ;
pImport
IMAGE_IMPORT_DESCRIPTOR;
pTHUNK
IMAGE_THUNK_DATA;
pIMPORTNAME
IMAGE_IMPORT_BY_NAME;
begin
if not(dg1.execute) then exit;
s:=dg1.filename;
try
button2.click;
memo1.clear;
f:=CreateFile(pchar(s),GENERIC_READ ,0,
nil,OPEN_EXISTING,FILE_ATTRIBUTE_ARCHIVE,0);
Map:=CreateFileMapping(F,NiL,PAGE_READONLY,0,0,Nil);
p:=MapViewOfFile(Map,FILE_MAP_READ,0,0,0);
//p:=pointer(getmodulehandle('C:/My Documents/setnetpath.exe'));
if not(showname) then
p:=pointer(getmodulehandle(nil));
pDosHeader:=PIMAGEDOSHEADER(p);
//showmessage(inttohex(pDosHeader.e_magic,8));
// showmessage(inttostr(pDosHeader._lfanew));
ntOff:=pDosHeader._lfanew;
pNTHeader:=PIMAGENTHEADERS(dword(p)+ntOff);
// showmessage(inttohex(pntHeader.Signature,8));
fHeader:='Machine:0x'+inttohex(pntHeader.FileHeader.Machine ,8);
fHeader:=fHeader+#13#10+'NumberOfSections:'+inttostr(pntHeader.FileHeader.NumberOfSections);
nS:=pntHeader.FileHeader.NumberOfSections;
tt.Time :=HiWord(pntHeader.FileHeader.TimeDateStamp);
tt.Date :=LoWord(pntHeader.FileHeader.TimeDateStamp);
fHeader:=fHeader+#13#10+'TimeDateStamp:'+DateTimeToStr(TimeStampToDateTime(tt));
fHeader:=fHeader+#13#10+'SizeOfOptionalHeader:'+inttostr(pntHeader.FileHeader.SizeOfOptionalHeader);
fHeader:=fHeader+#13#10+'Characteristics:0x'+inttohex(pntHeader.FileHeader.Characteristics,8);
// showmessage(fheader);
memo1.Lines.Add(fheader);
memo1.Lines.Add('========');
fHeader:='AddressOfPoint RVA:0x'+inttohex(pntHeader.OptionalHeader.AddressOfEntryPoint,8);
fHeader:=fHeader+#13#10+'ImageBase:0x'+inttohex(pntHeader.OptionalHeader.ImageBase,8);
fHeader:=fHeader+#13#10+'SectionAlignment:0x'+inttohex(pntHeader.OptionalHeader.SectionAlignment,8);
fHeader:=fHeader+#13#10+'FileAlignment:0x'+inttohex(pntHeader.OptionalHeader.FileAlignment,8);
fHeader:=fHeader+#13#10+'SubsystemVersion:'+inttostr(pntHeader.OptionalHeader.MajorSubsystemVersion)+'.'+inttostr(pntHeader.OptionalHeader.MinorSubsystemVersion);
fHeader:=fHeader+#13#10+'SizeOfImage:0x'+inttohex(pntHeader.OptionalHeader.SizeOfImage,8);
fHeader:=fHeader+#13#10+'SizeOfHeaders:0x'+inttohex(pntHeader.OptionalHeader.SizeOfHeaders,8);
// showmessage(fheader);
//SHOWMESSAGE(INTTOSTR(sizeof(IMAGE_NT_HEADERS)+NToFF ))
//248 448 504
memo1.Lines.Add(fheader);
fHeader:='Import VirtualAddress:0x'+inttohex(pntHeader.OptionalHeader.DataDirectory[1].VirtualAddress ,8);
fHeader:=fHeader+#13#10+' Size:0x'+inttohex(pntHeader.OptionalHeader.DataDirectory[1].size ,8);
memo1.Lines.Add(fheader);
memo1.lines.add(SectionName(pIMAGESECTIONHEADER(dword(pNTHeader)+sizeof(IMAGE_NT_HEADERS)),ns));
RVA:=RvaToOffset(p,pntHeader.OptionalHeader.DataDirectory[1].VirtualAddress);
pImport:=pIMAGE_IMPORT_DESCRIPTOR(dword(p)+RVA);
memo1.Lines.Add('=====================================');
memo1.Lines.Add('=====================================');
//inc(pImport);
while pImport.name>0 do
begin
Rva:=RvaToOffset(p,pImport.name);
//showmessage('Ok');
s:=pchar(dword(p)+rva);
s:=s+#13#10+' OriginalFirstThunk: 0x'+inttohex(pImport.OriginalFirstThunk,8);
s:=s+#13#10+' FirstThunk: 0x'+inttohex(pImport.FirstThunk,8);
rva:=RvaToOffset(p,pImport.FirstThunk);
memo1.lines.add(s);
pThunk:=pImage_thunk_data(dword(p)+rva);
i:=0;
while pThunk.pname>0 do
begin
if not(hooked) and (pthunk.pname=pp) then
begin
pthunk.pname:=dword(@MyMsg);
//showmessage('OkKKKKKK');
end;
if (hooked) and (pthunk.pname=dword(@MyMsg)) then
begin
pthunk.pname:=pp;
//showmessage('OkKKKKKK');
end;
if not(showname) then
begin
memo1.lines.add(inttostr(i)+' '+inttohex(pthunk.pname,8));
end
else
begin
rva:=RvaToOffset(p,pThunk.pname);
pImportName:=pIMAGE_IMPORT_BY_NAME(dword(p)+rva);
// showmessage(pchar(@pImportName.name));
s:=inttostr(i)+' **** '+pchar(@pImportName.name);
memo1.lines.add(s);
// showmessage('Ok');
end;
inc(i);
inc(pThunk);
end;
inc(pImport);
end;
memo1.Lines.Add('=====================================');
memo1.Lines.Add('=====================================');
hooked:=not(hooked);
if pntHeader.Signature=IMAGE_NT_SIGNATURE
then showmessage('ok')
else showmessage('No!!');
except
showmessage('No!!');
end;
////////////////////
UnmapViewOfFile(p);
closehandle(Map);
closehandle(f);
end;