Printing out the names of implicitly linked dll's from .idata section in a portable executable

前端 未结 2 973
余生分开走
余生分开走 2021-01-27 04:48

I am trying to write a code which is supposed to print out the names of all the imported dll\'s in the exe by using the \'name\' field of the IMAGE_IMPORT_DESCRIPTOR structure i

2条回答
  •  悲哀的现实
    2021-01-27 05:33

    The answer by mox is right on all points, however I would also like to add another solution - load the file as an image to read the data.
    This is achieved very simply using LoadLibraryEx with just one line of code.

    Base = LoadLibraryEx("c:\Linked List.exe", 0, DONT_RESOLVE_DLL_REFERENCES);
    

    This load and maps your executable as an image, so no need for opening/reading/mapping or converting rva to raw offsets.

    With the DONT_RESOLVE_DLL_REFERENCES flag the image is uninitialized, so all import data is untouched, and entrypoint code is not executed. The executable is just mapped into memory.

    You can simply use Base + Rva to find imported dll name - or any other kind of PE information.
    Free the executable image after use with FreeLibrary(Base)

提交回复
热议问题