如何用遍历Import表的方式获得进程引用模块名称和函数名称?(100分)

nwskyblue · 2003-05-21

Dll名称可以搞定, 可是里面的函数名实在出不来,下面是我的代码 type   PIMAGE_IMPORT_DESCRIPTOR=^TIMAGE_IMPORT_DESCRIPTOR;   TIMAGE_IMPORT_DESCRIPTOR=record   OriginalFirstThunk

WORD;   TimeDateStamp

WORD;                 ForwarderChain

WORD;                   Name

WORD;   FirstThunk

WORD;                     end; type   PIMAGE_IMPORT_BY_NAME=^TIMAGE_IMPORT_BY_NAME;   TIMAGE_IMPORT_BY_NAME=record     Hint : Word;     Name : byte; end; type   PIMAGE_THUNK_DATA = ^TIMAGE_THUNK_DATA;   TIMAGE_THUNK_DATA=record     OrdinalOrAddressOfData

DWORD;//PIMAGE_IMPORT_BY_NAME; end; procedure TForm1.Button1Click(Sender: TObject); var   size,add,findex : DWORD;   pvalue:string;   ff:string;   han : THandle;   pp

IMAGE_IMPORT_DESCRIPTOR;   pf,pf1

IMAGE_IMPORT_BY_NAME;   pp1,pp2

IMAGE_THUNK_DATA;   p,p1,p2

ointer;   pch,pch1,pch2,f1,f2,pch3,pch4: PChar; begin   getmem(f1,12);   getmem(f2,12);   memo1.Lines.Clear;//放DLL名   memo2.Lines.Clear;//放函数名   try   han := getmodulehandle('project1.exe');   p :=Pointer(han);   p1 :=ImageDirectoryEntryToData(p,true,Image_directory_entry_import,size);   if p1=nil then     exit;   pp :=PIMAGE_IMPORT_DESCRIPTOR(p1);   pch1 :=PChar(p);   while pp.Name<>0 do   begin   pch :=pch1+pp.name;   memo1.Lines.Add(pch);   pp1 :=PIMAGE_THUNK_DATA(pch1+pp.FirstThunk);    if pp.OriginalFirstThunk=0 then       pp1 :=PIMAGE_THUNK_DATA(pch1+pp.FirstThunk)     else       pp1 :=PIMAGE_THUNK_DATA(pch1+pp.OriginalFirstThunk);      strpcopy(f1,inttohex(pp1.OrdinalOrAddressOfData,8));      strpcopy(f2,'80000000');         //判断函数是按序数引入的还是按函数名引入    if strcomp(f1,f2)=0 then     while pp1.OrdinalOrAddressOfData<>0 do     begin       findex:=GetLowWord(inttohex(pp1.OrdinalOrAddressOfData,8));       memo2.Lines.Add(inttostr(findex));       inc(pp1);     end     else         while pp1.OrdinalOrAddressOfData<>nil do     begin       p2 := pointer(pp1.OrdinalOrAddressOfData);       pf1 :=PIMAGE_IMPORT_BY_NAME(p2);       pch2:=PChar(addr(pp))+(pf1.name and $0ffff);       memo2.Lines.Add(pch2);       inc(pp1);     end;   inc(pp);   end;   finally     freemem(f1);     freemem(f2);   end; end;

如何用遍历Import表的方式获得进程引用模块名称和函数名称?(100分)

nwskyblue

Unregistered / Unconfirmed

Similar threads