2013-01-04 61 views
0

所以我加载paltalk.exe作为一个参数为我的C++命令行程序,我得到这样的输出:取出.exe模块导入表序号并找到导入模块函数名称?

[Walk_Imports]: Imported DLL [0] WSOCK32.dll 
-------------------------------------------------- 
[Import_By_Ordinal]: address: 80000016 
[Import_By_Ordinal]: address: 80000003 
[Import_By_Ordinal]: address: 80000073 
[Import_By_Ordinal]: address: 80000017 
[Import_By_Ordinal]: address: 80000015 
[Import_By_Ordinal]: address: 8000000B 
[Import_By_Ordinal]: address: 80000014 
[Import_By_Ordinal]: address: 8000000E 
[Import_By_Ordinal]: address: 8000000A 
[Import_By_Ordinal]: address: 80000034 
[Import_By_Ordinal]: address: 80000011 
[Import_By_Ordinal]: address: 80000013 
[Import_By_Ordinal]: address: 80000010 
[Import_By_Ordinal]: address: 80000009 
[Import_By_Ordinal]: address: 80000002 
[Import_By_Ordinal]: address: 80000008 
[Import_By_Ordinal]: address: 8000006F 
[Import_By_Ordinal]: address: 80000097 
[Import_By_Ordinal]: address: 80000012 
[Import_By_Ordinal]: address: 80000004 
[Import_By_Ordinal]: address: 8000000F 
[Import_By_Ordinal]: address: 8000000C 

22 functions imported (22 ordinal) 

的Paltalk进口的wsock32.dll确定好消息。我走进它,我看到那里所有的序号。

如何把这些进口序的名字,并用C或C++加载的wsock32.dll走出口表序号名称与相应的功能名称相匹配?

我希望这是足够的信息来获得我的问题。如果不是,我可以添加更多信息。

感谢

+0

通过序号输出的要点是**不提供函数名称。 –

回答

1

通过关于移植可执行基础设施这样一个宽泛的问题,看看马特·皮特里克http://www.wheaty.net以及他是如何实现在PEDUMP的这些细节的检索(提供的代码)。