DisplayIAT

#include <windows.h>
#include <stdio.h>

DWORD_PTR rva2offset(DWORD_PTR lpBaseAddress, DWORD rva, PIMAGE_NT_HEADERS pNtHeader)
{
    DWORD dwIndex = 0;
    DWORD_PTR dwOffset = 0;
    DWORD dwNumberOfSections = pNtHeader->FileHeader.NumberOfSections;
    PIMAGE_SECTION_HEADER pSectionHeader = IMAGE_FIRST_SECTION(pNtHeader);

    for (dwIndex = 0; dwIndex < dwNumberOfSections; ++pSectionHeader)
    {
        DWORD dwLow = pSectionHeader->VirtualAddress;
        DWORD dwHigh = dwLow + pSectionHeader->Misc.VirtualSize;

        if (rva >= dwLow && rva < dwHigh)
        {
            dwOffset = lpBaseAddress + rva - dwLow + pSectionHeader->PointerToRawData;
            break;
        }
    }
    return dwOffset;
}

BOOL dumpImports(LPVOID lpBaseAddress)
{
    PIMAGE_DOS_HEADER pDosHeader;
    PIMAGE_NT_HEADERS pNtHeader;
    IMAGE_OPTIONAL_HEADER optionalHeader;
    IMAGE_DATA_DIRECTORY importDirectory;
    DWORD dwImpotStartRVA;
    PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor;

    pDosHeader = (PIMAGE_DOS_HEADER)lpBaseAddress;
    if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE)
        return FALSE;
    printf("DOS signature: 0x%04X\tVerified\n", pDosHeader->e_magic);

    pNtHeader = (PIMAGE_NT_HEADERS)((DWORD_PTR)lpBaseAddress + pDosHeader->e_lfanew);
    if (pNtHeader->Signature != IMAGE_NT_SIGNATURE)
        return FALSE;
    printf("PE signature: 0x%08X\tVerified\n", pNtHeader->Signature);

    optionalHeader = pNtHeader->OptionalHeader;
    if (optionalHeader.Magic != IMAGE_NT_OPTIONAL_HDR32_MAGIC && optionalHeader.Magic != IMAGE_NT_OPTIONAL_HDR64_MAGIC)
        return FALSE;
    printf("OptionalHeader magic: 0x%04X\tVerified\n", optionalHeader.Magic);

    importDirectory = optionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
    dwImpotStartRVA = importDirectory.VirtualAddress;
    pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)rva2offset((DWORD_PTR)lpBaseAddress, importDirectory.VirtualAddress, pNtHeader);
    if (pImportDescriptor == NULL)
    {
        printf("First import descriptor is NULL\n");
        return FALSE;
    }

    DWORD dwIndex = -1;
    while (pImportDescriptor[++dwIndex].Characteristics != 0)
    {
        PIMAGE_THUNK_DATA pINT;
        PIMAGE_THUNK_DATA pIAT;
        PIMAGE_IMPORT_BY_NAME pNameData;
        DWORD nFunctions = 0;
        DWORD nOrdinalFunctions = 0;

        char *dllName = (char *)rva2offset((DWORD_PTR)lpBaseAddress, pImportDescriptor[dwIndex].Name, pNtHeader);

        if (dllName == NULL)
            printf("\nImported DLL[%d]\tNULL name\n", dwIndex);
        else
            printf("\nImported DLL[%d]\t%s\n", dwIndex, dllName);

        printf("-------------------------------------------\n");

        pINT = (PIMAGE_THUNK_DATA)(pImportDescriptor[dwIndex].OriginalFirstThunk);
        pIAT = (PIMAGE_THUNK_DATA)(pImportDescriptor[dwIndex].FirstThunk);
        if (pINT == NULL)
        {
            printf("Empty INT pointer\n");
            return FALSE;
        }
        if (pIAT == NULL)
        {
            printf("Empty IAT pointer\n");
            return FALSE;
        }

        pINT = (PIMAGE_THUNK_DATA)rva2offset((DWORD_PTR)lpBaseAddress, pImportDescriptor[dwIndex].OriginalFirstThunk, pNtHeader);
        pIAT = (PIMAGE_THUNK_DATA)rva2offset((DWORD_PTR)lpBaseAddress, pImportDescriptor[dwIndex].FirstThunk, pNtHeader);
        if (pINT == NULL)
        {
            printf("Empty INT\n");
            return FALSE;
        }
        if (pIAT == NULL)
        {
            printf("Empty IAT\n");
            return FALSE;
        }

        while (pINT->u1.AddressOfData != 0)
        {
            if (!(pINT->u1.Ordinal & IMAGE_ORDINAL_FLAG))
            {
                pNameData = (PIMAGE_IMPORT_BY_NAME)(pINT->u1.AddressOfData);
                pNameData = (PIMAGE_IMPORT_BY_NAME)rva2offset((DWORD_PTR)lpBaseAddress, (DWORD)pNameData, pNtHeader);
                printf("%s", pNameData->Name);
                printf("\tAddress: 0x%p\n", pIAT->u1.Function);
            }
            else
            {
                nOrdinalFunctions++;
            }
            pIAT++;
            pINT++;
            nFunctions++;
        }
        printf("%d functions imported (%d ordinal)\n", nFunctions, nOrdinalFunctions);
    }
    return TRUE;
}

int main(int argc, char *argv[])
{
    char *fileName;
    HANDLE hFile;
    HANDLE hFileMapping;
    LPVOID lpBaseAddress;

    if (argc < 2)
    {
        printf("not enough arguments\n");
        return -1;
    }
    fileName = argv[1];

    hFile = CreateFileA(fileName, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    if (hFile == INVALID_HANDLE_VALUE)
    {
        printf("CreateFile() failed\n");
        return -1;
    }

    hFileMapping = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
    if (hFileMapping == NULL)
    {
        CloseHandle(hFile);
        printf("CreateFileMapping() failed\n");
        return -1;
    }

    lpBaseAddress = MapViewOfFile(hFileMapping, FILE_MAP_READ, 0, 0, 0);
    if (lpBaseAddress == NULL)
    {
        CloseHandle(hFile);
        CloseHandle(hFileMapping);
        printf("MapViewOfFile() failed\n");
        return -1;
    }

    if (!dumpImports(lpBaseAddress))
        printf("Failed to dump imports\n");

    CloseHandle(hFile);
    CloseHandle(hFileMapping);
    UnmapViewOfFile(lpBaseAddress);

    return 0;
}