Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #include "stdafx.h"
- #include <Windows.h>
- #include <stdlib.h>
- //Begin prototypes
- void usage();
- //Begin main entrypoint
- int _tmain(int argc, _TCHAR* argv[])
- {
- //Check we have correct amount of arguments
- if(argc != 2)
- {
- usage();
- return 0;
- }
- HANDLE hInFile, hMappedFile, pMemFile;
- TCHAR* cInFilePath = argv[1];
- hInFile = CreateFile( cInFilePath,
- GENERIC_READ,
- FILE_SHARE_READ|FILE_SHARE_WRITE,
- NULL,
- OPEN_EXISTING,
- FILE_FLAG_SEQUENTIAL_SCAN,
- NULL);
- if(hInFile == INVALID_HANDLE_VALUE)
- {
- printf("Error '%d' opening file: %s\n", GetLastError(), argv[1]);
- return 1;
- }
- DWORD dwFLen = GetFileSize(hInFile, NULL);
- hMappedFile = CreateFileMapping( hInFile,
- NULL,
- PAGE_READONLY | SEC_COMMIT,
- 0,
- dwFLen,
- NULL);
- if(hMappedFile == NULL)
- {
- printf("Error '%d' creating mapping of input file\n", GetLastError());
- return 2;
- }
- pMemFile = MapViewOfFile( hMappedFile,
- FILE_MAP_READ,
- 0,
- 0,
- dwFLen);
- if(pMemFile == NULL)
- {
- printf("Error '%d' mapping view of file!\n", GetLastError());
- return 3;
- }
- //Primary pointers to DOS and NT header structures
- PIMAGE_DOS_HEADER pImgDosHeader;
- PIMAGE_NT_HEADERS pImgNtHeaders;
- //Get the DOS stub of the module and verify
- pImgDosHeader = (PIMAGE_DOS_HEADER)pMemFile;
- if(pImgDosHeader->e_magic != IMAGE_DOS_SIGNATURE)
- {
- printf("File does not have a valid DOS stub.\n");
- return 4;
- }
- //Get pointer to the NT header from the module and verify
- pImgNtHeaders = (PIMAGE_NT_HEADERS)((DWORD)pMemFile + (DWORD)pImgDosHeader->e_lfanew);
- if(pImgNtHeaders->Signature != IMAGE_NT_SIGNATURE)
- {
- printf("Invalid NT header.\n");
- return 5;
- }
- //Get a pointer to the import table
- PIMAGE_IMPORT_DESCRIPTOR piidImportTableAddr;
- piidImportTableAddr = (PIMAGE_IMPORT_DESCRIPTOR)(pImgNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress + (DWORD)pMemFile);
- while(piidImportTableAddr->FirstThunk != 0)
- {
- //Itterate over every IMAGE_IMPORT_DESCRIPTOR structure, extracting the names of the DLLs to import
- char* name = (char*)(piidImportTableAddr->Name + (DWORD)pMemFile);
- //Do nothing for now
- piidImportTableAddr++;
- }
- //Close handles
- UnmapViewOfFile(pMemFile);
- CloseHandle(hMappedFile);
- CloseHandle(hInFile);
- return 0;
- }
- void usage(void)
- {
- printf("Usage: \n");
- printf("inputfile\n");
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement