DLL – 导入地址表中的Thunk表？

分类：Windows作者：佚名
什么是与EXE文件中用于导入外部DLL中使用的函数的导入地址表相关的thunk表？

这个thunk表只是一个包含“Thunks”到其他函数的表吗？

Thunk是Import表(IMAGE_DIRECTORY_ENTRY_IMPORT)和Delay Import Table(IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT)的一部分.它们被描述为 http://msdn.microsoft.com/en-us/library/ms809762.aspx.

我将查看我的旧源代码,稍后将发布一个工作代码,该代码将这些表转储包含绑定信息.

更新：

这是我喜欢的一个旧程序中的代码.它仅支持32位PE,但可以轻松修改为64位.顺便说一句,你可以看到,它还转储绑定信息.要测试这个绑定要转储的PE与bind.exe(例如,使用bind.exe -u -v Test.dll).

代码由大约1000行组成,因此我无法在此处发布.我收到一条错误消息

哎呀！无法提交您的修改,因为：
>身体限制为30000个字符;你输入了55095

所以我把它放在这里：http://www.ok-soft-gmbh.com/ForStackOverflow/PEInfo.c.我希望代码能够更好地帮助你作为一个长篇描述.

更新2：我看到我的旧答案不适合搜索引擎.所以我在下面包含了PEInfo.c的代码部分(函数DumpImports和DumpExports)：

void MakeIdent (UINT nOffset)
{
    for (; nOffset; nOffset--)
        printf ("    ");    // 4 blanks
}

void DumpDword (UINT nOffset,LPCSTR pszPrefix,DWORD dw)
{
    MakeIdent(nOffset);

    if (dw < 100)
        printf ("%s: %d\n",pszPrefix,dw);
    else if (dw%(256*256) == 0)
        printf ("%s: 0x%X\n",dw);
    else
        printf ("%s: %d (0x%X)\n",dw,dw);
}

void DumpTimeDateStamp (UINT nOffset,LPCSTR pszTimeDateStampPrefix,DWORD dwTimeDateStamp)
{
    //struct tm tmTime;//= localtime_s ((time_t *)&dwTimeDateStamp);
    //errno_t err = localtime_s (&tmTime,((time_t *)&dwTimeDateStamp));

    struct tm *ptmTime = _localtime32 ((__time32_t *)&dwTimeDateStamp);
    SYstemTIME stSystemTime;
    static CHAR szString[128];

    stSystemTime.wYear = (WORD)(1900 + ptmTime->tm_year);
    stSystemTime.wMonth = (WORD)(ptmTime->tm_mon + 1);
    stSystemTime.wDay = (WORD)ptmTime->tm_mday;
    stSystemTime.wDayOfWeek = (WORD)(ptmTime->tm_wday + 1);
    stSystemTime.wHour = (WORD)ptmTime->tm_hour;
    stSystemTime.wMinute = (WORD)ptmTime->tm_min;
    stSystemTime.wSecond = (WORD)ptmTime->tm_sec;
    stSystemTime.wMilliseconds = 0;

    MakeIdent(nOffset);
    printf ("%s: 0x%8X (",pszTimeDateStampPrefix,dwTimeDateStamp);

    if (GetDateFormatA (LOCALE_USER_DEFAULT,&stSystemTime,NULL,szString,sizeof(szString)/sizeof(TCHAR)) != 0) {
        printf (szString);
    }

    if (GetTimeFormatA (LOCALE_USER_DEFAULT,sizeof(szString)/sizeof(TCHAR)) != 0) {
        if (szString[0] != 0)
            printf (" ");
        printf (szString);
    }
    printf (")\n");
}

void DumpImports (UINT nOffset,IMAGE_OPTIONAL_HEADER32 *pOptionalHeader,PBYTE pbyFile,IMAGE_SECTION_HEADER *pSectionHeader,IMAGE_NT_HEADERS32 *pNtHeader) // header of the section,which contains export section
{
    IMAGE_IMPORT_DESCRIPTOR *pImportDescriptor = (IMAGE_IMPORT_DESCRIPTOR *)((PBYTE)pbyFile + pSectionHeader->PointerToRawData +
        pOptionalHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress - pSectionHeader->VirtualAddress);
    DWORD dwBoundImportVA = pOptionalHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress;
    IMAGE_BOUND_IMPORT_DESCRIPTOR *pFirstBoundImportDescriptor = NULL,*pBoundImportDescriptor;

    //DumpDword (nOffset,TEXT("characteristics"),pImportDescriptor->characteristics);
    if (dwBoundImportVA) {
        UINT i;
        IMAGE_SECTION_HEADER *pFirstSectionHeader = (IMAGE_SECTION_HEADER *)((PBYTE)pOptionalHeader + //sizeof(IMAGE_OPTIONAL_HEADER32));
                                                                                pNtHeader->FileHeader.SizeOfOptionalHeader);

        for (i=0; i<pNtHeader->FileHeader.NumberOfSections; i++) {
            if (pFirstSectionHeader[i].VirtualAddress <= dwBoundImportVA &&
                dwBoundImportVA < pFirstSectionHeader[i].VirtualAddress + pFirstSectionHeader[i].Misc.VirtualSize) {

                pFirstBoundImportDescriptor = (IMAGE_BOUND_IMPORT_DESCRIPTOR *)((PBYTE)pbyFile + pFirstSectionHeader[i].PointerToRawData +
                                            dwBoundImportVA - pFirstSectionHeader[i].VirtualAddress);
                break;
            }
        }
        if (i >= pNtHeader->FileHeader.NumberOfSections)
            pFirstBoundImportDescriptor = (IMAGE_BOUND_IMPORT_DESCRIPTOR *)((PBYTE)pbyFile + dwBoundImportVA);
    }

    for (;pImportDescriptor->characteristics; pImportDescriptor++) {
        IMAGE_THUNK_DATA *pOriginalFirstThunk = (IMAGE_THUNK_DATA *)((PBYTE)pbyFile + pSectionHeader->PointerToRawData +
            pImportDescriptor->OriginalFirstThunk - pSectionHeader->VirtualAddress);
        IMAGE_THUNK_DATA *pFirstThunk = (IMAGE_THUNK_DATA *)((PBYTE)pbyFile + pSectionHeader->PointerToRawData +
            pImportDescriptor->FirstThunk - pSectionHeader->VirtualAddress);
        IMAGE_THUNK_DATA *pOriginalThunk,*pThunk;

        MakeIdent(nOffset);
        printf ("%s ",pbyFile + pSectionHeader->PointerToRawData + pImportDescriptor->Name - pSectionHeader->VirtualAddress);
        //DumpDword (nOffset,TEXT("Ordinal Base"),pExportDirectory->Base);

        if (pImportDescriptor->TimeDateStamp == 0) {
            //MakeIdent(nOffset);
            printf ("(DLL is Not bound)\n");
        }
        else if (pImportDescriptor->TimeDateStamp == -1) {
            //if bound,and real date\time stamp
            //                                    //     in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND)
            //MakeIdent(nOffset);
            printf ("(DLL bound with New BIND)\n");
        }
        else {
            //MakeIdent(nOffset);
            printf ("(DLL bound with Old BIND) ");
            DumpTimeDateStamp (nOffset,"TimeDateStamp",pImportDescriptor->TimeDateStamp);
        }

        MakeIdent(nOffset+1);
        if (pImportDescriptor->TimeDateStamp)   // if bound
            printf (TEXT("      Ordinal          hint BoundAddrs Name\n"));
        else
            printf (TEXT("      Ordinal          hint Name\n"));

        for (pOriginalThunk=pOriginalFirstThunk,pThunk=pFirstThunk; pOriginalThunk->u1.AddressOfData; pOriginalThunk++,pThunk++) {
            if (IMAGE_SNAP_BY_ORDINAL32(pOriginalThunk->u1.Ordinal)) {
                MakeIdent(nOffset+1);
                // Ordinal
                if (pImportDescriptor->TimeDateStamp)
                    printf (TEXT("%4u (0x%04X)               0x%08X\n"),pOriginalThunk->u1.Ordinal & ~IMAGE_ORDINAL_FLAG32,pOriginalThunk->u1.Ordinal^IMAGE_ORDINAL_FLAG32,pThunk->u1.AddressOfData);
                else
                    // pThunk->u1.AddressOfData == pOriginalThunk->u1.Ordinal so don't print it 
                    printf (TEXT("%4u (0x%04X)\n"),pOriginalThunk->u1.Ordinal^IMAGE_ORDINAL_FLAG32);
            }
            else {
                IMAGE_IMPORT_BY_NAME *pImportByName = (IMAGE_IMPORT_BY_NAME *) (pOriginalThunk->u1.AddressOfData +
                    (PBYTE)pbyFile + pSectionHeader->PointerToRawData - pSectionHeader->VirtualAddress);

                MakeIdent(nOffset+1);
                // Hint - Index into the Export Name Pointer Table. A match is attempted first with this value.
                // If it fails,a binary search is performed on the DLL’s Export Name Pointer Table.
                if (pImportDescriptor->TimeDateStamp)   // if bound
                    printf (TEXT("%18u (0x%04X) 0x%08X %hs\n"),pImportByName->Hint,pThunk->u1.AddressOfData,pImportByName->Name);
                else
                    printf (TEXT("%18u (0x%04X) %hs\n"),pImportByName->Name);
            }
        }
    }

    if (pFirstBoundImportDescriptor) {
        MakeIdent(nOffset);
        printf ("PE Header contains the following bound import information:\n");

        for (pBoundImportDescriptor=pFirstBoundImportDescriptor; pBoundImportDescriptor->TimeDateStamp;
            pBoundImportDescriptor = (IMAGE_BOUND_IMPORT_DESCRIPTOR *)((PBYTE)(pBoundImportDescriptor+1) + pBoundImportDescriptor->NumberOfModuleForwarderRefs*sizeof(IMAGE_BOUND_FORWARDER_REF))) {
            PSTR pszDllName = (PSTR) ((DWORD)pFirstBoundImportDescriptor + pBoundImportDescriptor->OffsetModuleName);
            IMAGE_BOUND_FORWARDER_REF *pRef = (IMAGE_BOUND_FORWARDER_REF *)(pBoundImportDescriptor+1);

            MakeIdent(nOffset+1);
            printf ("Bound to %hs",pszDllName);
            DumpTimeDateStamp (0,"",pBoundImportDescriptor->TimeDateStamp);
            if (pBoundImportDescriptor->NumberOfModuleForwarderRefs) {
                UINT i;

                for (i=0;i<pBoundImportDescriptor->NumberOfModuleForwarderRefs;i++) {
                    PSTR pszDllName = (PSTR) ((DWORD)pFirstBoundImportDescriptor + pRef->OffsetModuleName);

                    MakeIdent(nOffset+2);
                    printf ("Contained forwarders bound to %hs",pszDllName);
                    DumpTimeDateStamp (0,pRef->TimeDateStamp);
                }
            }
        }
    }
}

void DumpExports (UINT nOffset,IMAGE_SECTION_HEADER *pSectionHeader) // header of the section,which contains export section
{
    UINT i;
    UINT iNames;
    PDWORD pdwAddressOfFunctions;
    PWORD pwordinals;
    PDWORD pdwNameRVA;
    IMAGE_EXPORT_DIRECTORY *pExportDirectory = (IMAGE_EXPORT_DIRECTORY *)((PBYTE)pbyFile + pSectionHeader->PointerToRawData +
        pOptionalHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress - pSectionHeader->VirtualAddress);
    DWORD dwVAExportStart = pOptionalHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
    DWORD dwVAExportEnd = pOptionalHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress + 
                          pOptionalHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size;

    DumpDword (nOffset,pExportDirectory->characteristics);
    DumpTimeDateStamp (nOffset,pExportDirectory->TimeDateStamp);

    MakeIdent(nOffset);
    printf ("DllName: %s\n",pbyFile + pSectionHeader->PointerToRawData + pExportDirectory->Name - pSectionHeader->VirtualAddress);
    DumpDword (nOffset,pExportDirectory->Base);

    MakeIdent(nOffset);
    printf (TEXT("Version: %d.%d\n"),pExportDirectory->MajorVersion,pExportDirectory->MinorVersion);

    DumpDword (nOffset,TEXT("Number of exported functions"),pExportDirectory->NumberOfFunctions);
    DumpDword (nOffset,TEXT("Number of functions exported by name"),pExportDirectory->NumberOfNames);

    MakeIdent(nOffset+1);
    printf (TEXT("Ordn hint RVA      Name\n"));

    pdwAddressOfFunctions = (PDWORD)(pbyFile + pSectionHeader->PointerToRawData + pExportDirectory->AddressOfFunctions - pSectionHeader->VirtualAddress);
    pwordinals = (PWORD)(pbyFile + pSectionHeader->PointerToRawData + pExportDirectory->AddressOfNameordinals - pSectionHeader->VirtualAddress);
    pdwNameRVA = (PDWORD)(pbyFile + pSectionHeader->PointerToRawData + pExportDirectory->AddressOfNames - pSectionHeader->VirtualAddress);

    for (iNames = 0; iNames < pExportDirectory->NumberOfNames; iNames++) {
        MakeIdent(nOffset+1);

        // AddressOfFunctions MUST be ouf of Export Directory. If it is not so,it is a Forwarding entry
        if (pdwAddressOfFunctions[pwordinals[iNames]] < dwVAExportStart ||
            pdwAddressOfFunctions[pwordinals[iNames]] > dwVAExportEnd)
            // AddressOfFunctions is normaly in .text section and export table in .edata or .rdata section,so
            // AddressOfFunctions must be not in Export Directory
            printf("%4u %4u %08X %s\n",pwordinals[iNames] + pExportDirectory->Base,iNames,pdwAddressOfFunctions[pwordinals[iNames]],(pbyFile + pSectionHeader->PointerToRawData + pdwNameRVA[iNames] - pSectionHeader->VirtualAddress));
        else
            printf("%4u %4u          %s (forwarded to %s)\n",(pbyFile + pSectionHeader->PointerToRawData + pdwNameRVA[iNames] - pSectionHeader->VirtualAddress),(PSTR)(pbyFile + pSectionHeader->PointerToRawData + pdwAddressOfFunctions[pwordinals[iNames]] - pSectionHeader->VirtualAddress));
    }

    // print functions exported by ordinal
    for (i = 0; i < pExportDirectory->NumberOfFunctions; i++) {
        if (pdwAddressOfFunctions[i] != 0) {
            // if EXPORTS in DEF-file look like 
            //
            // EXPORTS
            //    Message1  @100
            //    Message2  @200
            //    Message3  @300
            //    Message4  @400
            //    Message5  @500
            // it will be added in export section 401 (500-100+1) entries. 5 from there with not 0 address and the rest
            // empty entries with 0
            // we will dump only not empty entries

            UINT iNames;
            WORD wOrdinal = (WORD)(i + pExportDirectory->Base);

            // try to find (i + pExportDirectory->Base) ordinal in the list of pwordinals
            for (iNames = 0; iNames<pExportDirectory->NumberOfNames; iNames++) {
                if (pdwAddressOfFunctions[pwordinals[iNames]] == pdwAddressOfFunctions[i])
                    break;
            }

            if (iNames >= pExportDirectory->NumberOfNames) {
                // if not found as exported by name,print it here
                MakeIdent(nOffset+1);
                if (pdwAddressOfFunctions[i] < pSectionHeader->VirtualAddress ||
                    pdwAddressOfFunctions[i] > pSectionHeader->VirtualAddress + pSectionHeader->Misc.VirtualSize)
                    printf("%4u      %08X [NONAME]\n",wOrdinal,pdwAddressOfFunctions[i]);
                else
                    printf("%4u               [NONAME] (forwarded to %s)\n",(PSTR)(pbyFile + pSectionHeader->PointerToRawData + pdwAddressOfFunctions[i] - pSectionHeader->VirtualAddress));
            }
        }
    }
}

版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容， 请发送邮件至 dio@foxmail.com 举报，一经查实，本站将立刻删除。

相关推荐

Windows注册表操作基础代码
Windows注册表操作基础代码 Windows下对注册表进行操作使用的一段基础代码Reg.h:#pragmaonce#include&lt;assert.h&gt;#include&lt;windows.h&gt;classReg{HKEYhkey;public:voidopen(HKEYroot
黑客常用WinAPI函数整理
黑客常用WinAPI函数整理之前的博客写了很多关于Windows编程的内容，在Windows环境下的黑客必须熟练掌握底层API编程。为了使读者对黑客常用的Windows API有个更全面的了解以及方便日后使用API方法的查询，特将这些常用的API按照7大分类进行整理如下，希望对大家的学习有所帮助。一
一个简单的Windows Socket可复用框架
一个简单的Windows Socket可复用框架说起网络编程，无非是建立连接，发送数据，接收数据，关闭连接。曾经学习网络编程的时候用Java写了一些小的聊天程序，Java对网络接口函数的封装还是很简单实用的，但是在Windows下网络编程使用的Socket就显得稍微有点繁琐。这里介绍一个自己封装的一
Windows文件操作基础代码
Windows文件操作基础代码 Windows下对文件进行操作使用的一段基础代码File.h，首先是File类定义：#pragmaonce#include&lt;Windows.h&gt;#include&lt;assert.h&gt;classFile{HANDLEhFile;//文件句柄publ
Winpcap基础代码
Winpcap基础代码 使用Winpcap进行网络数据的截获和发送都需要的一段代码：#include&lt;PCAP.H&gt;#pragmacomment(lib,&quot;wpcap.lib&quot;)//#pragmacomment(lib,&quot;ws2_32.lib&quot;)#
使用vbs脚本进行批量编码转换
使用vbs脚本进行批量编码转换 最近需要使用SourceInsight查看分析在Linux系统下开发的项目代码，我们知道Linux系统中文本文件默认编码格式是UTF-8，而Windows中文系统中的默认编码格式是Gb2312。系统内的编码格式有所区别倒无伤大雅，关键的是SourceInsigh...
缓冲区溢出攻击
缓冲区溢出攻击缓冲区溢出（Buffer Overflow）是计算机安全领域内既经典而又古老的话题。随着计算机系统安全性的加强，传统的缓冲区溢出攻击方式可能变得不再奏效，相应的介绍缓冲区溢出原理的资料也变得“大众化”起来。其中看雪的《0day安全：软件漏洞分析技术》一书将缓冲区溢出攻击的原理阐述得简洁
Windows字符集的统一与转换
Windows字符集的统一与转换一、字符集的历史渊源在Windows编程时经常会遇到编码转换的问题，一直以来让刚接触的人摸不着头脑。其实只要弄清Win32程序使用的字符编码方式就清楚了，图1展示了一个Win32控制台项目的属性中的字符集选项。这里有两个不同的字符集：一个是Unicode字符集，另一个
远程线程注入引出的问题
远程线程注入引出的问题一、远程线程注入基本原理远程线程注入——相信对Windows底层编程和系统安全熟悉的人并不陌生，其主要核心在于一个Windows API函数CreateRemoteThread，通过它可以在另外一个进程中注入一个线程并执行。在提供便利的同时，正是因为如此，使得系统内部出现了安全
windows系统启动项怎么打开
windows系统启动项怎么打开
win10系统文件夹的只读属性去不掉怎么办
win10系统文件夹的只读属性去不掉怎么办
windows.old可以删掉吗？
windows.old可以删掉吗？
windows的网络功能主要通过什么来实现？
windows的网络功能主要通过什么来实现？
win10系统以太网不见了怎么办
win10系统以太网不见了怎么办
win10安装cad缺少net组件怎么办
win10安装cad缺少net组件怎么办
win10系统鼠标移动方向相反怎么办
win10系统鼠标移动方向相反怎么办
如何ping局域网内所有IP
如何ping局域网内所有IP
windows10的系统保留分区有什么用
windows10的系统保留分区有什么用
win10系统无法删除账户怎么办
win10系统无法删除账户怎么办
win10系统音频服务未响应怎么办
win10系统音频服务未响应怎么办
pythonJavaScriptjavaHTMLPHPreactjsC#AndroidCSSNode.jssqlrpython-3.xMysqLjQueryc++pandasFlutterangularIOSdjangolinuxswifttypescript路由器JSON路由器设置无线路由器h3c华三华三路由器设置华三路由器电脑软件教程arraysdocker软件图文教程Cvue.jslaravelspring-boot