Skip to content

Instantly share code, notes, and snippets.

@Kiterai
Last active March 1, 2018 08:37
Show Gist options
  • Save Kiterai/c7724a035c3cf05332f5f4b526e6309a to your computer and use it in GitHub Desktop.
Save Kiterai/c7724a035c3cf05332f5f4b526e6309a to your computer and use it in GitHub Desktop.
show self IAT
#include <iostream>
using namespace std;
#include <windows.h>
#include <imagehlp.h>
#pragma comment(lib,"imagehlp.lib")
int main(void)
{
HMODULE hMod = GetModuleHandle(NULL);
ULONG ulSize;
PIMAGE_IMPORT_DESCRIPTOR pImgDesc = (PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData(hMod, TRUE, IMAGE_DIRECTORY_ENTRY_IMPORT, &ulSize);
cout << hex;
for (size_t i = 0; pImgDesc[i].OriginalFirstThunk != NULL; i++)
{
cout << "ImportDescriptorAddr:" << (pImgDesc + i) << endl;
cout << endl;
cout << "FirstOriginalThunk:" << pImgDesc[i].OriginalFirstThunk << endl;
cout << "Name:" << pImgDesc[i].Name << " " << reinterpret_cast<BYTE*>(hMod) + pImgDesc[i].Name << endl;
cout << "FirstThunk:" << pImgDesc[i].FirstThunk << endl;
cout << endl;
PIMAGE_THUNK_DATA oriThunk = reinterpret_cast<PIMAGE_THUNK_DATA>(reinterpret_cast<BYTE*>(hMod) + pImgDesc[i].OriginalFirstThunk);
PIMAGE_THUNK_DATA thunk = reinterpret_cast<PIMAGE_THUNK_DATA>(reinterpret_cast<BYTE*>(hMod) + pImgDesc[i].FirstThunk);
for (size_t j = 0; oriThunk[j].u1.AddressOfData != NULL; j++)
{
cout << "OriginalThunk:" << oriThunk[j].u1.AddressOfData << endl;
PIMAGE_IMPORT_BY_NAME impName = reinterpret_cast<PIMAGE_IMPORT_BY_NAME>(reinterpret_cast<BYTE*>(hMod) + oriThunk[j].u1.AddressOfData);
cout << impName->Hint << endl;
cout << impName->Name << endl;
cout << endl;
cout << "Thunk:" << thunk[j].u1.Function << endl;
cout << endl;
cout << endl;
}
}
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment