FONCTIONS IMPORTÉES/EXPORTÉES D'UN EXECUTABLE (WIN32)

#define _WIN32_WINNT 0x0500 
#include <windows.h>
#include <commctrl.h>
#include <commdlg.h>
#include "resource.h"
#pragma comment(lib, "comctl32.lib")
#pragma comment(lib, "comdlg32.lib")


HWND hMain, hTree, hPath;
char szImagePath[260], szCurrentDirectory[260];
char szMsgError[64] = "Erreur: ";


//------------------------------------------------------------------------------------------
// DisplayError: affiche un message d'erreur dans une messagebox
//------------------------------------------------------------------------------------------
int DisplayError(char * pszText, DWORD dwError)
{
	ultoa(dwError, szMsgError + 8, 10);
	MessageBox(hMain, pszText, szMsgError, MB_ICONERROR);
return 1;
}


//------------------------------------------------------------------------------------------
// DisplayImportExport: affiche dans le treeview les fonctions importées/exportées de 
// l'executable szImagePath
//------------------------------------------------------------------------------------------
int DisplayImportExport(void)
{
	char buffer[512], *b;
	TVITEMEX tvitem;                         // structure utilisée pour modifier des items
	TVINSERTSTRUCT tvi;                      // structure utilisée pour ajouter des items
	HTREEITEM hImportItem, hExportItem;      // handle des 2 items a la racine du treeview
	HTREEITEM hFunctionItem, hForwardItem;   // handle des 2 child items de l'item hExportItem

	// on charge le fichier
	BYTE *pBase = (BYTE*) LoadLibraryEx(szImagePath, 0, DONT_RESOLVE_DLL_REFERENCES);
	if(!pBase)
	{
		DisplayError("Erreur lors du chargement du module.", GetLastError());
		return 0;
	}

	// trouve et verifie la signature du fichier
	IMAGE_NT_HEADERS32 *pNTHeader = (IMAGE_NT_HEADERS32*)(pBase + ((IMAGE_DOS_HEADER*)pBase)->e_lfanew);
	if(pNTHeader->Signature != IMAGE_NT_SIGNATURE)
	{
		DisplayError("Signature PE invalide.", GetLastError());
		FreeLibrary((HMODULE)pBase);
		return 0;
	}

	// trouve les addresses des header COFF file et Optionnal/PE
	IMAGE_FILE_HEADER *pFileHeader = (IMAGE_FILE_HEADER*) &pNTHeader->FileHeader;
	IMAGE_OPTIONAL_HEADER32 *pPEHeader = (IMAGE_OPTIONAL_HEADER32*) &pNTHeader->OptionalHeader;

	// on trouve les RVA de l'Import Directory Table et de l'Export Directory Table
	// ainsi que leurs addresses virtuelles & leurs tailles
	IMAGE_IMPORT_DESCRIPTOR *pImportDirectoryTable = (IMAGE_IMPORT_DESCRIPTOR*)(pBase + pPEHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
	DWORD dwImportDirectorySize = (DWORD) pPEHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size;
	DWORD dwExportRVA = pPEHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
	IMAGE_EXPORT_DIRECTORY  *pExportDirectoryTable = (IMAGE_EXPORT_DIRECTORY*)(pBase + dwExportRVA);
	DWORD dwExportDirectorySize = (DWORD) pPEHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size;
	DWORD dwExportEndRVA = dwExportRVA + dwExportDirectorySize;

	// vide le treeview et desactive le redraw
	SendMessage(hTree, TVM_DELETEITEM, 0, 0);
	SendMessage(hTree, WM_SETREDRAW, 0, 0);

	// ajout des deux items a la racine du treeview
	buffer[0] = 0;
	tvi.hParent = 0;
	tvi.hInsertAfter = TVI_ROOT;
	tvi.item.mask = TVIF_TEXT;
	tvi.item.pszText = buffer;
	hImportItem = (HTREEITEM) SendMessage(hTree, TVM_INSERTITEM, 0, (long) &tvi);
	hExportItem = (HTREEITEM) SendMessage(hTree, TVM_INSERTITEM, 0, (long) &tvi);

	// ajoute les items enfants de l'item hImport 
	DWORD dwTotalCount = 0;
	if(dwImportDirectorySize)
	{
		// une itération par dll qui contient des fonctions importées
		for(; pImportDirectoryTable->Name; pImportDirectoryTable++)
		{
			// ajoute un item enfant a hImport, contenant le nom d'une dll
			tvi.hParent = hImportItem;
			tvi.hInsertAfter = TVI_SORT;
			tvi.item.pszText = (char*)(pBase + pImportDirectoryTable->Name);
			tvi.hParent = (HTREEITEM) SendMessage(hTree, TVM_INSERTITEM, 0, (long) &tvi);

			// addresse base du module courant
			HMODULE hModDLL = GetModuleHandle(tvi.item.pszText);
			tvi.item.pszText = buffer;

			// CORRECTION BUG: certains linker mettent OriginalFirstThunk à zéro, et ne produisent pas
			// d'Import Lookup Table les noms/ordinaux des fonctions se trouvent donc dans le tableau 
			// pointé par FirstThunk, et il n'est pas possible d'obtenir l'adresse des fonctions importées
			if(!pImportDirectoryTable->OriginalFirstThunk) // bug du linker
			{
				IMAGE_THUNK_DATA32 *pImportLookup = (IMAGE_THUNK_DATA32*)(pBase + pImportDirectoryTable->FirstThunk);
				for(DWORD i=0; pImportLookup->u1.Function; pImportLookup++, i++, dwTotalCount++)
				{
					if(pImportLookup->u1.Function & 0x80000000)
					{
						wsprintf(buffer, "%03u  Import par Ordinal: 0x%08x", i, pImportLookup->u1.Ordinal & 0x7FFFFFFF);
					}
					else
					{
						wsprintf(buffer, "%03u  <not bound>  %s", i, pBase + pImportLookup->u1.AddressOfData+2);
					}

					// on ajoute l'item
					SendMessage(hTree, TVM_INSERTITEM, 0, (long) &tvi);
				}
			}
			else
			{
				// trouve les addresses de l'Import Lookup Table (nom des fonctions) et de l'Import
				// Address Table (addresse des fonctions importées)
				IMAGE_THUNK_DATA32 *pImportLookup = (IMAGE_THUNK_DATA32*)(pBase + pImportDirectoryTable->OriginalFirstThunk);
				IMAGE_THUNK_DATA32 *pImportAddress = (IMAGE_THUNK_DATA32*)(pBase + pImportDirectoryTable->FirstThunk);

				for(DWORD i=0; pImportLookup->u1.Function; pImportLookup++, pImportAddress++, i++, dwTotalCount++)
				{
					// si le bit de poid fort de l'import lookup est a 1, la fonction est importée par
					// ordinal, sinon elle est importée par nom
					if(pImportLookup->u1.Function & 0x80000000)
					{
						wsprintf(buffer, "%03u  Import par Ordinal: 0x%08x", i, pImportLookup->u1.Ordinal & 0x7FFFFFFF);
					}
					else
					{
						wsprintf(buffer, "%03u  0x%08x  %s", i, pImportAddress->u1.Function - (DWORD)hModDLL, pBase + pImportLookup->u1.AddressOfData+2);
					}

					// on ajoute l'item
					SendMessage(hTree, TVM_INSERTITEM, 0, (long) &tvi);
				}
			}
		}	
	}

	// met a jour le texte de l'item "Import"
	strcpy(buffer, "Imports ["); b = buffer + 9;
	ultoa(dwTotalCount, b, 10); while(*b) b++;
	*b++ = ']'; *b = 0;
	tvitem.mask = TVIF_HANDLE | TVIF_TEXT;
	tvitem.pszText = buffer;
	tvitem.hItem = hImportItem;
	SendMessage(hTree, TVM_SETITEM, 0, (long) &tvitem);

	// ajoute les items enfants de l'item hExport
	dwTotalCount = 0;
	if(dwExportDirectorySize)
	{
		DWORD dwFuncsCount = 0, dwForwardsCount = 0, dwOrdinal = 0, dwFuncRVA = 0;

		// on trouve le nombre de symbole exportés, ainsi que les addresses de diverses choses:
		// Export Function Table: contient les RVA des fonctions, 
		// Export Name Table: contient les RVA des noms des fonctions au format asciiz
		// Export Ordinal Table: index des RVA des fonctions
		DWORD dwExportNamesCount = (DWORD) pExportDirectoryTable->NumberOfNames;
		DWORD *pAddressTable = (DWORD*)(pBase + pExportDirectoryTable->AddressOfFunctions);
		DWORD *pNameTable = (DWORD*)(pBase + pExportDirectoryTable->AddressOfNames);
		WORD *pOrdinalTable = (WORD*)(pBase + pExportDirectoryTable->AddressOfNameOrdinals);

		// ajoute deux child item a hExport: hFunctionItem et hForwardItem
		buffer[0] = 0;
		tvi.hParent = hExportItem;
		hFunctionItem = (HTREEITEM) SendMessage(hTree, TVM_INSERTITEM, 0, (long) &tvi);
		hForwardItem = (HTREEITEM) SendMessage(hTree, TVM_INSERTITEM, 0, (long) &tvi);

		// on cherche le type du symbole (forwarder ou fonction/variable) et on ajoute un child item
		// a hFunctionItem ou hForwardItem
		for(; dwExportNamesCount; pOrdinalTable++, pNameTable++, dwExportNamesCount--)
		{
			dwOrdinal = (DWORD) *pOrdinalTable;
			dwFuncRVA = pAddressTable[dwOrdinal];
			dwOrdinal += pExportDirectoryTable->Base;

			// si dwFuncRVA est dans l'Export Table, c'est un forwarder, sinon c'est une fonction
			if(dwExportRVA < dwFuncRVA && dwFuncRVA < dwExportEndRVA)
			{
				dwForwardsCount++;
				wsprintf(buffer, "%03u  %s --->  %s", dwOrdinal, pBase + *pNameTable, pBase + dwFuncRVA);
				tvi.hParent = hForwardItem;
				SendMessage(hTree, TVM_INSERTITEM, 0, (long) &tvi);
			}
			else
			{
				dwFuncsCount++;
				wsprintf(buffer, "%03u  0x%08x  %s", dwOrdinal, dwFuncRVA, pBase + *pNameTable);
				tvi.hParent = hFunctionItem;
				SendMessage(hTree, TVM_INSERTITEM, 0, (long) &tvi);
			}
		}
		dwTotalCount = dwFuncsCount + dwForwardsCount;

		// met a jour le texte des items functions et forward
		// si l'un des items a 0 child item, on le suprime
		tvitem.hItem = hFunctionItem;
		if(dwFuncsCount)
		{
			strcpy(buffer, "Functions ["); b = buffer + 11;
			ultoa(dwFuncsCount, b, 10); while(*b) b++;
			*b++ = ']'; *b = 0;
			SendMessage(hTree, TVM_SETITEM, 0, (long) &tvitem);
		}
		else SendMessage(hTree, TVM_DELETEITEM, 0, (long) hFunctionItem);
		tvitem.hItem = hForwardItem;
		if(dwForwardsCount)
		{
			strcpy(buffer, "Forwarders ["); b = buffer + 12;
			ultoa(dwForwardsCount, b, 10); while(*b) b++;
			*b++ = ']'; *b = 0;
			SendMessage(hTree, TVM_SETITEM, 0, (long) &tvitem);
		}
		else SendMessage(hTree, TVM_DELETEITEM, 0, (long) hForwardItem);
	}

	// met a jour le texte de l'item "Export"
	strcpy(buffer, "Exports ["); b = buffer + 9;
	ultoa(dwTotalCount, b, 10); while(*b) b++;
	*b++ = ']'; *b = 0;
	tvitem.hItem = hExportItem;
	SendMessage(hTree, TVM_SETITEM, 0, (long) &tvitem);

	// ré-active le dessin du treeview et expand les deux branches principales
	SendMessage(hTree, WM_SETREDRAW, 1, 0);
	SendMessage(hTree, TVM_EXPAND, TVE_EXPAND, (long)hImportItem);
	SendMessage(hTree, TVM_EXPAND, TVE_EXPAND, (long)hExportItem);
	FreeLibrary((HMODULE)pBase);
return 1;
}


//------------------------------------------------------------------------------------------
// AskForPath: func qui ouvre la common dialog "openfilename"
//------------------------------------------------------------------------------------------
int AskForPath(void)
{
	OPENFILENAME ofn;
	szImagePath[0] = 0;
	ZeroMemory(&ofn, sizeof(OPENFILENAME));

	ofn.lStructSize = sizeof(OPENFILENAME);
	ofn.hwndOwner = hMain;
	ofn.lpstrFile = szImagePath;
	ofn.nMaxFile = 256;
	ofn.Flags	= OFN_PATHMUSTEXIST | OFN_FILEMUSTEXIST | OFN_HIDEREADONLY | OFN_LONGNAMES;
	ofn.lpstrFilter	= "Executables (*.EXE, *.DLL)\0*.exe;*.dll\0";
	ofn.nFilterIndex = 1;
	ofn.lpstrInitialDir = szCurrentDirectory;

	// l'utilisateur n'a pas selectionné de fichier
	if(!GetOpenFileName(&ofn)) return 0;

	GetCurrentDirectory(260, szCurrentDirectory);
	SetWindowText(hPath, szImagePath);
return 1;
}


//---------------------------------------------------------------------------------------------
// DialogProc: callback de la fenetre principale
//---------------------------------------------------------------------------------------------
BOOL __stdcall DialogProc(HWND hDlg, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
	switch(uMsg) 
	{
	case WM_INITDIALOG:
		hMain = hDlg;
		hPath = GetDlgItem(hDlg, IDC_PATH);
		hTree = GetDlgItem(hDlg, IDC_TREE);
		GetSystemDirectory(szCurrentDirectory, 260);
		PostMessage(hDlg, WM_COMMAND, IDOK, 0);
	return 1;
	case WM_COMMAND:
		switch(LOWORD(wParam)) 
		{
		case IDOK:
			if(AskForPath()) 
				DisplayImportExport();
		return 0;
		case IDCANCEL:
			EndDialog(hDlg, 0);
		}
	}
return 0;
}


//---------------------------------------------------------------------------------------------
// WinMain
//---------------------------------------------------------------------------------------------
int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, PSTR szCmdLine, int iCmdShow)
{
	INITCOMMONCONTROLSEX ictrl;
	ictrl.dwSize = sizeof(INITCOMMONCONTROLSEX);
	ictrl.dwICC = ICC_TREEVIEW_CLASSES;
	InitCommonControlsEx(&ictrl);
	DialogBoxParam(hInstance, "MainDialog", 0, DialogProc, 0);
return 0;
}

Télécharger le zip

23 août 2004 00:38:45 :

petit oubli

25 août 2004 01:31:11 :

correction d'un bug dû a un autre bug de certains linkers qui ne produisent pas d'Import Lookup Table. On peut alors seulement connaitre le nom ou l'ordinal de la fonction importée mais pas son addresse. L'explication du bug est ici: http://win32assembly.online.fr/files/pe1.zip dans le fichier pe.txt, a la ligne 1260.