2013-01-04 18 views
0

所以我加載paltalk.exe作爲一個參數爲我的C++命令行程序,我得到這樣的輸出:取出.exe模塊導入表序號並找到導入模塊函數名稱?

[Walk_Imports]: Imported DLL [0] WSOCK32.dll 
-------------------------------------------------- 
[Import_By_Ordinal]: address: 80000016 
[Import_By_Ordinal]: address: 80000003 
[Import_By_Ordinal]: address: 80000073 
[Import_By_Ordinal]: address: 80000017 
[Import_By_Ordinal]: address: 80000015 
[Import_By_Ordinal]: address: 8000000B 
[Import_By_Ordinal]: address: 80000014 
[Import_By_Ordinal]: address: 8000000E 
[Import_By_Ordinal]: address: 8000000A 
[Import_By_Ordinal]: address: 80000034 
[Import_By_Ordinal]: address: 80000011 
[Import_By_Ordinal]: address: 80000013 
[Import_By_Ordinal]: address: 80000010 
[Import_By_Ordinal]: address: 80000009 
[Import_By_Ordinal]: address: 80000002 
[Import_By_Ordinal]: address: 80000008 
[Import_By_Ordinal]: address: 8000006F 
[Import_By_Ordinal]: address: 80000097 
[Import_By_Ordinal]: address: 80000012 
[Import_By_Ordinal]: address: 80000004 
[Import_By_Ordinal]: address: 8000000F 
[Import_By_Ordinal]: address: 8000000C 

22 functions imported (22 ordinal) 

的Paltalk進口的wsock32.dll確定好消息。我走進它,我看到那裏所有的序號。

如何把這些進口序的名字,並用C或C++加載的wsock32.dll走出口表序號名稱與相應的功能名稱相匹配?

我希望這是足夠的信息來獲得我的問題。如果不是,我可以添加更多信息。

感謝

+0

通過序號輸出的要點是**不提供函數名稱。 –

回答

1

通過關於移植可執行基礎設施這樣一個寬泛的問題,看看馬特·皮特里克http://www.wheaty.net以及他是如何實現在PEDUMP的這些細節的檢索(提供的代碼)。