读取IMAGE_EXPORT_DIRECTORY以查找导出的函数名称会导致访问冲突

Question

我按如下方式阅读IMAGE_EXPORT_DIRECTORY

    PIMAGE_EXPORT_DIRECTORY ExportDirectory = (PIMAGE_EXPORT_DIRECTORY)((DWORD)dosHeader + ConvertRVA(PEImageOptionalHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress,
        FirstSectionHeader,PEFileImageHeader));

我想访问AddressOfNames的这个works.Then。

PDWORD* ExportedFunctions;
ExportedFunctions = (PDWORD *)((DWORD)dosHeader + ConvertRVA(ExportDirectory->AddressOfNames,FirstSectionHeader,PEFileImageHeader));

现在，如何找到导出函数的名称呢？ConvertRVA()的定义如下

DWORD ConvertRVA(DWORD rva,PIMAGE_SECTION_HEADER FirstSectionHeader,PIMAGE_FILE_HEADER PEFileImageHeader)
{
    int j=0;
    auto i =FirstSectionHeader;
    for(;j<PEFileImageHeader->NumberOfSections ;i++,j++)
    {
        if(rva>=i->VirtualAddress && rva<i->VirtualAddress + i->Misc.VirtualSize)
            break;
    }
    return rva+i->PointerToRawData-i->VirtualAddress;
}

Answer 1

我找到了一个方法来做到这一点。

 PDWORD ExportedFunctions;
    ExportedFunctions = (PDWORD )((DWORD)dosHeader + ConvertRVA(ExportDirectory->AddressOfNames,FirstSectionHeaderBest,PEFileImageHeader));



    for(int i=0;i<ExportDirectory->NumberOfNames;i++)
    {
        LPSTR aaaa=(PCHAR)((DWORD)dosHeader + ConvertRVA((DWORD)ExportedFunctions[0],FirstSectionHeaderBest,PEFileImageHeader)); 
        std::cout<<aaaa<<std::endl;
    }