管理人の独り言（プログラミング関連）

1862： ◆adhRKFl5jU：2009/05/02(土) 11:07:40: 書いた。
-----
#include <cstdio>
#include <cstring>
#include <windows.h>

using namespace std;

#define P(base, p) ((void*)(((DWORD)base) + ((DWORD)p)))
namespace{
inline void *GetSectionBase(void *base, DWORD p){
PIMAGE_DOS_HEADER pImageDos = (PIMAGE_DOS_HEADER)base;
PIMAGE_NT_HEADERS32 pImageNt = (PIMAGE_NT_HEADERS32)P(base, pImageDos->e_lfanew);
PIMAGE_SECTION_HEADER pImageSection = IMAGE_FIRST_SECTION(pImageNt);

for(; pImageSection->VirtualAddress; ++pImageSection){
if(p - pImageSection->VirtualAddress <= pImageSection->SizeOfRawData){
//この値が0になる可能性はかなり低いと思われる。
return (void*)((DWORD)base - pImageSection->VirtualAddress + pImageSection->PointerToRawData);
}
}
return NULL;
}
}

int main(int argc, char **argv){
HANDLE hFile = CreateFile(TEXT("Sleipnir.exe"), GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);

if(hFile == INVALID_HANDLE_VALUE){
MessageBox(NULL, TEXT("CreateFile Error!"), NULL, MB_OK);
return -1;
}

HANDLE hMap = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);

if(hMap == NULL){
MessageBox(NULL, TEXT("CreateFileMapping Error!"), NULL, MB_OK);
return -1;
}

const LPVOID p = MapViewOfFile(hMap, FILE_MAP_READ, 0, 0, 0);

if(p == NULL){
MessageBox(NULL, TEXT("MapViewOfFile"), NULL, MB_OK);
return -1;
}

PIMAGE_DOS_HEADER pImageDos = (PIMAGE_DOS_HEADER)p;

PIMAGE_NT_HEADERS32 pImageNt = (PIMAGE_NT_HEADERS32)P(p, pImageDos->e_lfanew);

PIMAGE_DATA_DIRECTORY pImageData = &pImageNt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];

if(pImageData->VirtualAddress == 0){
MessageBox(NULL, TEXT("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!"), NULL, MB_OK);
return -1;
}

void *idataBase = GetSectionBase(p, pImageData->VirtualAddress);
if(idataBase == NULL){
MessageBox(NULL, TEXT("GetSectionBase Error"), NULL, MB_OK);
return -1;
}

PIMAGE_IMPORT_DESCRIPTOR pImageImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)P(idataBase, pImageData->VirtualAddress);

for(; pImageImportDescriptor->Name; ++pImageImportDescriptor){
char *moduleName = (char *)P(idataBase, pImageImportDescriptor->Name);
//printf("%s\n", moduleName);
if(strcmpi(moduleName, "kernel32.dll") == 0){
void *INTBase = GetSectionBase(p, pImageImportDescriptor->OriginalFirstThunk);
PIMAGE_THUNK_DATA pOrgImageThunkData = (PIMAGE_THUNK_DATA)P(INTBase, pImageImportDescriptor->OriginalFirstThunk);
for(; pOrgImageThunkData->u1.AddressOfData; ++pOrgImageThunkData){
if(0x80000000 & (DWORD)pOrgImageThunkData){
MessageBox(NULL, TEXT("pOrgImageThunkData Error"), NULL, MB_OK);
}else{
void *nameBase = GetSectionBase(p, pOrgImageThunkData->u1.AddressOfData);
PIMAGE_IMPORT_BY_NAME pImageImportByName = (PIMAGE_IMPORT_BY_NAME)P(nameBase, pOrgImageThunkData->u1.AddressOfData);
char *funcName = (char*)&pImageImportByName->Name;
if(strcmp(funcName, "CreateMutexW") == 0){
puts("unicode版");
return 0;
}
}
}
puts("mbcs版");
return 0;
}
}

//ここまで達しないはず。
return -1;
}

※書き込む際の注意事項はこちら

※画像アップローダーはこちら

（画像を表示できるのは「画像リンクのサムネイル表示」がオンの掲示板に限ります）