#include <stdio.h>
#include <string.h>
#include <windows.h>
#include <winnt.h>
#include <tlhelp32.h>
#define DIE_IFNOT(cond, msg) if(!(cond)) fprintf(stderr, "%s\n", msg), exit(1);

void DisplayImportTableEx(HANDLE hProcess, HMODULE hModImage);
HMODULE RemoteGetModuleHandle(DWORD dwProcessId, LPCSTR lpModuleName);
FARPROC RemoteGetProcAddress(HMODULE hModule, HMODULE hModuleRemote, LPCSTR lpProcName);

static DWORD dwCRT; // address of CreateRemoteThread

int main(void) {
    DWORD dwProcessId;
    printf("Process ID (Current = %d): ", GetCurrentProcessId());
    if(scanf("%u", &dwProcessId) < 1) return 1;

    HMODULE hModRemote;
    printf("EXE/DLL Base Address: 0x");
    scanf("%p", &hModRemote);

    CreateRemoteThread(0, 0, 0, 0, 0, 0, 0); // Test

    dwCRT = (DWORD) RemoteGetProcAddress(GetModuleHandle(TEXT("kernel32.dll")), RemoteGetModuleHandle(dwProcessId, "kernel32.dll"), "CreateRemoteThread");

    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId);
    DisplayImportTableEx(hProcess, hModRemote);
    CloseHandle(hProcess);

    return 0;
}

void DisplayImportTableEx(HANDLE hProcess, HMODULE hModImage) {
    DWORD cbRead;
    IMAGE_DOS_HEADER idh;
    DIE_IFNOT(ReadProcessMemory(hProcess, hModImage, &idh, sizeof idh, &cbRead), "[!] Failed to read process memory!");
    DIE_IFNOT(idh.e_magic == IMAGE_DOS_SIGNATURE, "[!] Invalid DOS Signature!");

    IMAGE_NT_HEADERS inh;
    DIE_IFNOT(ReadProcessMemory(hProcess, (PCHAR)hModImage + idh.e_lfanew, &inh, sizeof inh, &cbRead), "[!] Failed to read process memory!");
    DIE_IFNOT(inh.Signature == IMAGE_NT_SIGNATURE, "[!] Invalid PE Signature!");

    IMAGE_DATA_DIRECTORY dirImport = inh.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
    DIE_IFNOT(dirImport.VirtualAddress && dirImport.Size, "[!] No Import Table Found!");

    PIMAGE_IMPORT_DESCRIPTOR lpImportDesc = (PIMAGE_IMPORT_DESCRIPTOR) ((PCHAR)hModImage + dirImport.VirtualAddress);
    IMAGE_IMPORT_DESCRIPTOR impDesc;
    DIE_IFNOT(ReadProcessMemory(hProcess, lpImportDesc, &impDesc, sizeof impDesc, &cbRead), "[!] Failed to read process memory!");
    while(lpImportDesc->Characteristics) {
        printf("[+] %s\n", (LPCSTR)((PCHAR)hModImage + lpImportDesc->Name));

        PIMAGE_THUNK_DATA lpImportThunk = (PIMAGE_THUNK_DATA) ((PCHAR)hModImage + lpImportDesc->FirstThunk);
        IMAGE_THUNK_DATA impThunk;
        DIE_IFNOT(ReadProcessMemory(hProcess, lpImportThunk, &impThunk, sizeof impThunk, &cbRead), "[!] Failed to read process memory!");
        while(impThunk.u1.Function) {
            printf("\t[+] Function: 0x%08lX", impThunk.u1.Function);

            if((DWORD)impThunk.u1.Function == dwCRT) {
                printf(" (Gotcha! This is CreateRemoteThread)");
            }

            putchar('\n');
            DIE_IFNOT(ReadProcessMemory(hProcess, ++lpImportThunk, &impThunk, sizeof impThunk, &cbRead), "[!] Failed to read process memory!");
        }

        DIE_IFNOT(ReadProcessMemory(hProcess, ++lpImportDesc, &impDesc, sizeof impDesc, &cbRead), "[!] Failed to read process memory!");
    }
}

HMODULE RemoteGetModuleHandle(DWORD dwProcessId, LPCSTR lpModuleName) {
    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessId);
    if(hSnapshot != INVALID_HANDLE_VALUE) {
        MODULEENTRY32 me = {sizeof(MODULEENTRY32)};
        BOOL bRet = Module32First(hSnapshot, &me);
        while(bRet) {
            if(!strcmpi(me.szModule, lpModuleName))
                return me.hModule;
            bRet = Module32Next(hSnapshot, &me);
        }
        CloseHandle(hSnapshot);
    }
    return NULL;
}

FARPROC RemoteGetProcAddress(HMODULE hModule, HMODULE hModuleRemote, LPCSTR lpProcName) {
    FARPROC fp = GetProcAddress(hModule, lpProcName);
    if(!fp) return NULL;

    return (FARPROC)( (PCHAR)fp - (PCHAR)hModule + (PCHAR)hModuleRemote );
}