Last active
March 1, 2018 08:37
-
-
Save Kiterai/c7724a035c3cf05332f5f4b526e6309a to your computer and use it in GitHub Desktop.
show self IAT
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <iostream> | |
using namespace std; | |
#include <windows.h> | |
#include <imagehlp.h> | |
#pragma comment(lib,"imagehlp.lib") | |
int main(void) | |
{ | |
HMODULE hMod = GetModuleHandle(NULL); | |
ULONG ulSize; | |
PIMAGE_IMPORT_DESCRIPTOR pImgDesc = (PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData(hMod, TRUE, IMAGE_DIRECTORY_ENTRY_IMPORT, &ulSize); | |
cout << hex; | |
for (size_t i = 0; pImgDesc[i].OriginalFirstThunk != NULL; i++) | |
{ | |
cout << "ImportDescriptorAddr:" << (pImgDesc + i) << endl; | |
cout << endl; | |
cout << "FirstOriginalThunk:" << pImgDesc[i].OriginalFirstThunk << endl; | |
cout << "Name:" << pImgDesc[i].Name << " " << reinterpret_cast<BYTE*>(hMod) + pImgDesc[i].Name << endl; | |
cout << "FirstThunk:" << pImgDesc[i].FirstThunk << endl; | |
cout << endl; | |
PIMAGE_THUNK_DATA oriThunk = reinterpret_cast<PIMAGE_THUNK_DATA>(reinterpret_cast<BYTE*>(hMod) + pImgDesc[i].OriginalFirstThunk); | |
PIMAGE_THUNK_DATA thunk = reinterpret_cast<PIMAGE_THUNK_DATA>(reinterpret_cast<BYTE*>(hMod) + pImgDesc[i].FirstThunk); | |
for (size_t j = 0; oriThunk[j].u1.AddressOfData != NULL; j++) | |
{ | |
cout << "OriginalThunk:" << oriThunk[j].u1.AddressOfData << endl; | |
PIMAGE_IMPORT_BY_NAME impName = reinterpret_cast<PIMAGE_IMPORT_BY_NAME>(reinterpret_cast<BYTE*>(hMod) + oriThunk[j].u1.AddressOfData); | |
cout << impName->Hint << endl; | |
cout << impName->Name << endl; | |
cout << endl; | |
cout << "Thunk:" << thunk[j].u1.Function << endl; | |
cout << endl; | |
cout << endl; | |
} | |
} | |
return 0; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment