I took a look. I think all that’s going on is that he is calculating the
location of the directory entry; pData is that address, cast as a (byte *).
This guy’s stuff is unusual. In particular, he is making up his
structures, like IMAGE_IMPORT_MODULE_DIRECTORY. Also, as I mentioned
before, all of this will break with 64-bit PE modules, which are
probably as close to as common as their 32-bit counterparts these days.
Finally, if you’re trying to figure out what is going on, the use of
classes makes things more difficult, in my opinion.
I would recommend that you use the standard types and sources. Here are
a few places to start:
WINNT.H - Search for “IMAGE”
http://msdn.microsoft.com/msdnmag/issues/02/02/PE/default.aspx
This is the first of two articles by Matt Pietrek that are about as old
as me, but still very good and come with code. I would start here.
If you haven’t already, get a hold of copy of the most recent COFF PE
spec, which Microsoft seems to have buried as deep as possible:
http://www.microsoft.com/whdc/system/platform/firmware/PECOFF.mspx
Good luck,
mm
xxxxx@gmail.com wrote:
Thank you very much MM
I understood what you mean.
I used ImageRvaToVa() and ImageRvaToSection and changed my code as you said:
CString CPE::GetImportModuleNames(CString str_SectionHdrName)
{
CString c;
IMAGE_DOS_HEADER * dosheader=(IMAGE_DOS_HEADER *)g_pMappedFileBase;
IMAGE_OPTIONAL_HEADER * opthdr =(IMAGE_OPTIONAL_HEADER *)
((BYTE*)dosheader+dosheader->e_lfanew+24);
IMAGE_IMPORT_DESCRIPTOR * descriptor=(IMAGE_IMPORT_DESCRIPTOR *)
((BYTE*)dosheader+
opthdr->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
void* virtualAddress = ImageRvaToVa(loi.FileHeader, g_pMappedFileBase, descriptor->Name, &(loi.LastRvaSection));
PIMAGE_SECTION_HEADER pish = ImageRvaToSection(loi.FileHeader,g_pMappedFileBase,descriptor->Name);
while(descriptor->Name)
{
//(?)
}
return c;
}
Now i have both va and section. In that article http://www.jps.at/pefile.html
while (pid->dwRVAModuleName)
{
/* Allocate buffer for absolute string offsets. */
pModule[nCnt] = (char *)(pData +
(pid->dwRVAModuleName-idsh.VirtualAddress));
…
}
It calculates with this:
(pData +(pid->dwRVAModuleName-idsh.VirtualAddress));
I have both name and Virtualadress but not pData
for pData:
It used something different in ImageDirectoryOffset function which is defined top of the page.
Could you help me the calculate “pdata”.
If i am not wrong anywhere, i think this is the last thing i have to do.
Thank you again for your long answer.