exeファイルのimport sectionのアドレス取得したい (ID:38306)

名前

ホームページ(ブログ、Twitterなど)のURL (省略可)

本文 delphi で exeファイルのimport sectionを取得したいですが どうやるのでしょうか？ APIがあるみたいですが自力でやりたいです。 http://bbs.wankuma.com/index.cgi?mode=al2&namber=46936&KLOG=79を みましたが「VirtualAddress - PointerToRawData を データディクショナリの RVA から引いてやれば、ファイル上での位置がわかります」の部分がよくわかりません。 下記途中までのソース program peExe; {$APPTYPE CONSOLE} uses SysUtils,Classes,windows; type IMAGE_DOS_HEADER = record // DOS .EXE header e_magic:word; // Magic number e_cblp:word; // Bytes on last page of file e_cp:word; // Pages in file e_crlc:word; // Relocations e_cparhdr:word; // Size of header in paragraphs e_minalloc:word; // Minimum extra paragraphs needed e_maxalloc:word; // Maximum extra paragraphs needed e_ss:word; // Initial (relative) SS value e_sp:word; // Initial SP value e_csum:word; // Checksum e_ip:word; // Initial IP value e_cs:word; // Initial (relative) CS value e_lfarlc:word; // File address of relocation table e_ovno:word; // Overlay number e_res:array [0..3] of word; // Reserved words e_oemid:word; // OEM identifier (for e_oeminfo) e_oeminfo:word; // OEM information; e_oemid specific e_res2:array[0..9] of word; // Reserved words e_lfanew:dword; // File address of new exe header end; IMAGE_FILE_HEADER = record Machine:WORD; NumberOfSections:WORD; TimeDateStamp:DWORD; PointerToSymbolTable:DWORD; NumberOfSymbols:DWORD; SizeOfOptionalHeader:WORD; Characteristics:WORD; end; IMAGE_DATA_DIRECTORY = record RVA:DWORD; Size:DWORD; end; IMAGE_OPTIONAL_HEADER32 = record // // Standard fields. // Magic:word; MajorLinkerVersion:BYTE; MinorLinkerVersion:BYTE; SizeOfCode:DWORD; SizeOfInitializedData:DWORD; SizeOfUninitializedData:DWORD; AddressOfEntryPoint:DWORD; BaseOfCode:DWORD; BaseOfData:DWORD; // // NT additional fields. // ImageBase:DWORD ; SectionAlignment:DWORD; FileAlignment:DWORD; MajorOperatingSystemVersion:WORD ; MinorOperatingSystemVersion:WORD ; MajorImageVersion:WORD ; MinorImageVersion:WORD ; MajorSubsystemVersion:WORD ; MinorSubsystemVersion:WORD ; Win32VersionValue:DWORD ; SizeOfImage:DWORD ; SizeOfHeaders:DWORD ; CheckSum:DWORD ; Subsystem:WORD ; DllCharacteristics:WORD ; SizeOfStackReserve:DWORD ; SizeOfStackCommit:DWORD ; SizeOfHeapReserve:DWORD ; SizeOfHeapCommit:DWORD ; LoaderFlags:DWORD ; NumberOfRvaAndSizes:DWORD ; DataDirectory:array [0..15] of IMAGE_DATA_DIRECTORY; end; IMAGE_NT_HEADERS = record Signature:DWORD; FileHeader:IMAGE_FILE_HEADER; OptionalHeader:IMAGE_OPTIONAL_HEADER32; end; IMAGE_SECTION_HEADER = record Name:array[0..7] of BYTE; Misc:DWORD; VirtualAddress:DWORD; SizeOfRawData:DWORD; PointerToRawData:DWORD; PointerToRelocations:DWORD; PointerToLinenumbers:DWORD; NumberOfRelocations:WORD; NumberOfLinenumbers:WORD; Characteristics:DWORD; end; IMAGE_IMPORT_DESCRIPTOR = record OriginalFirstThunk:DWORD; // RVA to original unbound IAT (PIMAGE_THUNK_DATA) TimeDateStamp:DWORD; ForwarderChain:DWORD; // -1 if no forwarders Name:DWORD; FirstThunk:DWORD; // RVA to IAT (if bound this IAT has actual addresses) end; function toLittleE(val:word):word;overload; begin result := val shl 8; result := result or (val shr 8); end; function toLittleE(val:dword):dword;overload; begin result := val shl 24; result := result or ( ($0000FF00 and val) shl 8); result := result or ( ($00FF0000 and val) shr 8); result := result or ( ($FF000000 and val) shr 24); //result := result or (val shr 8); end; const dosfmt = ' Magic number=%s'+#13#10 +' File address of new exe header=%s'; ntfmt = ' Signature=%s'; filefmt =' Machine=%s'+#13#10 +' NumberOfSections=%s'; dirfmt ='no=%2d' +' rva=%s'+#13#10 +' size=%s'; optfmt = ' AddressOfEntryPoint=%s'+#13#10 +' BaseOfCode=%s'+#13#10 +' BaseOfData=%s'+#13#10 +' ImageBase=%s'+#13#10 +' SectionAlignment=%s'+#13#10 +' SizeOfStackReserve=%s'+#13#10 +' SizeOfStackCommit=%s'+#13#10 +' SizeOfHeapReserve=%s'+#13#10 +' SizeOfHeapCommit=%s'+#13#10 +' NumberOfRvaAndSizes=%s'+#13#10; scfmt = ' Name:(%s)'+#13#10 +' VirtualSize:%s'+#13#10 +' SizeOfRawData:%s'+#13#10 +' PointerToRawData:%s'+#13#10 +' Characteristics:%s'; var binFile:TFileStream; dosHeader:IMAGE_DOS_HEADER; ntHeader:IMAGE_NT_HEADERS; scHeader:IMAGE_SECTION_HEADER; ipHeader:IMAGE_IMPORT_DESCRIPTOR; Buf: array[0..SizeOf(IMAGE_DOS_HEADER) * 2] of Char; i,j:Integer; temp:String; importAddr:DWORD; begin { TODO -oUser -cConsole Main : この下にコードを記述してください } Writeln(paramStr(1)); binFile := TFileStream.Create(ParamStr(1),fmOpenRead); binFile.Read(dosHeader,sizeof(IMAGE_DOS_HEADER)); Writeln('[IMAGE_DOS_HEADER]'); Writeln(format(dosfmt, [IntToHex(dosHeader.e_magic,4) ,IntToHex(dosHeader.e_lfanew,2)])); binFile.Seek($100,soFromBeginning); binFile.Read(ntHeader,sizeof(IMAGE_NT_HEADERS)); Writeln('[IMAGE_NT_HEADERS]'); Writeln(format(ntfmt,[IntToHex(ntHeader.Signature,8)])); Writeln('[IMAGE_FILE_HEADER]'); Writeln(format(filefmt,[IntToHex(ntHeader.FileHeader.Machine,4),IntToHex(ntHeader.FileHeader.NumberOfSections,4)])); Writeln('[IMAGE_OPTIONAL_HEADER32]'); Writeln(format(optfmt,[IntToHex(ntHeader.OptionalHeader.AddressOfEntryPoint,8) ,IntToHex(ntHeader.OptionalHeader.BaseOfCode,8) ,IntToHex(ntHeader.OptionalHeader.BaseOfData,8) ,IntToHex(ntHeader.OptionalHeader.ImageBase,8) ,IntToHex(ntHeader.OptionalHeader.SectionAlignment,8) ,IntToHex(ntHeader.OptionalHeader.SizeOfStackReserve,8) ,IntToHex(ntHeader.OptionalHeader.SizeOfStackCommit,8) ,IntToHex(ntHeader.OptionalHeader.SizeOfHeapReserve,8) ,IntToHex(ntHeader.OptionalHeader.SizeOfHeapCommit,8) ,IntToHex(ntHeader.OptionalHeader.NumberOfRvaAndSizes,8)])); Writeln('[IMAGE_DATA_DIRECTORY]'); for i:=0 to ntHeader.OptionalHeader.NumberOfRvaAndSizes - 1 do begin writeln(format(dirfmt,[i ,IntToHex(ntHeader.OptionalHeader.DataDirectory[i].RVA,8) ,IntToHex(ntHeader.OptionalHeader.DataDirectory[i].SIZE,8)])); end; Writeln('[IMAGE_SECTION_HEADER]'); for i := 0 to ntHeader.FileHeader.NumberOfSections - 1 do begin binFile.Read(scHeader,sizeof(IMAGE_SECTION_HEADER)); temp := ''; for j := 0 to 7 do temp := temp + char(scHeader.Name[j]); writeln(format(scfmt,[temp ,IntToHex(scHeader.Misc,8) ,IntToHex(scHeader.SizeOfRawData,8) ,IntToHex(scHeader.PointerToRawData,8) ,IntToHex(scHeader.Characteristics,8)])); if temp = '.idata'+#0#0 then importAddr := scHeader.PointerToRawData; end; Writeln('[インポートセクション]'); binFile.Seek(importAddr,soFromBeginning); binFile.Read(ipHeader,sizeof(IMAGE_IMPORT_DESCRIPTOR)); binFile.Read(temp,$36); /// readln; end.