.idata数据的解析
每类Section代表不同的数据,不同的数据存储组织方式一定是有非常大区别的。代码段与资源段一定区别巨大,这意味着我需要一个一个的学习每个段的解析。
idata段解析
这个段主要存储的是导入符号信息。昨天花了很多时间研究符号的获取,但就在刚刚开始就卡壳了,很多人都是说读取了IMAGE_IMPORT_DESCRIPTOR,就可以获取到链接库名称,但这个字段是一个地址,我根本不能理解这个地址如何对应到文件中的偏移,后来是今天才突然恍然大悟,原来那个是相对虚拟地址,而段头结构中还有一个相对虚拟地址,用来指示段数据被加载到内存后的相对虚拟地址,用段偏移+链接库名称相对虚拟地址-段头结构中的相对虚拟地址就是链接库名称在文件中的偏移。这个计算与基地址一丁点关系都没有,不明白很多文章在将这里的时候来时说基地址问题,有啥联系,白让我浪费脑细胞。
关于地址转换问题想明白后,其余都是浮云,只要按照其它教程中提到的方法遍历就行,实在不行,看我写的代码就行了。
另外这次代码做了改动,直接将所有知道的细节都输出到xml文件中,用于以后分析,是否将文件中的每个字节都真的明白了。是否还有很多数据游离于我们分析的结构外?
代码:
#include<iostream>
#include<Windows.h>
#include<sstream>
#include<string>
#include<vector>
#include <map>
FILE* fpOutput =NULL;
// 对文件数据信息分类
//主要目的是更加准确的确定每个数据的位置
struct Section
{
intm_iStart;
intm_iEnd;
std::stringm_strSectionName;
std::map<std::string,std::string>m_mapProperties;
std::vector<Section*>vecChild;
};
std::vector<Section*>g_vecSection;
void AddSection(intiOffset,int iLen,const char* pName)
{
Section*s = new Section;
s->m_iStart= iOffset;
s->m_iEnd = iOffset + iLen;
s->m_strSectionName= pName;
g_vecSection.push_back(s);
}
void AddSection(intiOffset,int iLen,const char* pName,conststd::map<std::string,std::string>& mapProperties)
{
Section*s = new Section;
s->m_iStart= iOffset;
s->m_iEnd = iOffset + iLen;
s->m_strSectionName= pName;
s->m_mapProperties = mapProperties;
g_vecSection.push_back(s);
}
voidAddChild(std::vector<Section*>& vecChild,Section* pS)
{
for(size_ti=0; i<vecChild.size(); i++)
{
if(pS->m_iStart>=vecChild[i]->m_iStart&&
pS->m_iEnd<= vecChild[i]->m_iEnd)
{
returnAddChild(vecChild[i]->vecChild,pS);
}
}
vecChild.push_back(pS);
}
voidOutputInfo(std::vector<Section*>& vecS)
{
for(size_ti=0; i<vecS.size(); i++)
{
std::stringstreamstream;
stream<<"<SectionName=\""<<vecS[i]->m_strSectionName<<"\"Start=\""<<vecS[i]->m_iStart<<"\"End=\""<<vecS[i]->m_iEnd<<"\" ";
std::map<std::string,std::string>::iteratorit = vecS[i]->m_mapProperties.begin();
for(;it != vecS[i]->m_mapProperties.end(); it++)
{
stream<<it->first<<"=\""<<it->second<<"\"";
}
stream<<">"<<std::endl;
fprintf(fpOutput,"%s",stream.str().c_str());
OutputInfo(vecS[i]->vecChild);
std::stringstreamstream1;
stream1<<"</Section>"<<std::endl;
fprintf(fpOutput,"%s",stream1.str().c_str());
}
}
void OutputSection()
{
std::map<int,std::map<int,Section*>>mapS;
for(size_ti=0; i<g_vecSection.size(); i++)
mapS[g_vecSection[i]->m_iStart][g_vecSection[i]->m_iEnd]= g_vecSection[i];
Section*root = new Section;
root->m_iStart= -1;
root->m_iEnd = 200000000;
std::map<int,std::map<int,Section*>>::iteratorit = mapS.begin();
for(;it!=mapS.end(); it++)
{
Section*pT = NULL;
std::map<int,Section*>::iteratoritT = it->second.begin();
for(;itT != it->second.end(); itT++)
{
if(pT!= NULL)
itT->second->vecChild.push_back(pT);
pT= itT->second;
}
AddChild(root->vecChild,pT);
}
fpOutput= fopen("Output.xml","w+");
OutputInfo(root->vecChild);
fclose(fpOutput);
//销毁数据
deleteroot;
for(size_ti=0; i<g_vecSection.size(); i++)
deleteg_vecSection[i];
g_vecSection.clear();
}
int main(intargc,char** argv)
{
FILE*fp = fopen(argv[1],"rb");
if(!fp)
{
std::cerr<<"Readfile error!\n";
return-1;
}
fseek(fp,0,SEEK_END);
intiLen = ftell(fp)+1;
fseek(fp,0,SEEK_SET);
char*pC = new char[iLen];
intiRead = fread(pC,1,iLen,fp);
fclose(fp);
AddSection(0,iRead,"FileContent");
//解析
IMAGE_DOS_HEADER* m_pDOSHeader= (IMAGE_DOS_HEADER*)(pC);
intiDosHeaderSize = sizeof(IMAGE_DOS_HEADER);
AddSection(0,iDosHeaderSize,"IMAGE_DOS_HEADER");
IMAGE_NT_HEADERS* m_pNTHeaders32= (IMAGE_NT_HEADERS *) ((BYTE*)m_pDOSHeader +
m_pDOSHeader->e_lfanew);
intiNTHeaderSize = sizeof(IMAGE_NT_HEADERS);
AddSection(m_pDOSHeader->e_lfanew,iNTHeaderSize,"IMAGE_NT_HEADERS");
intiSectionStart = m_pDOSHeader->e_lfanew + iNTHeaderSize;
std::vector<IMAGE_SECTION_HEADER*>vecSectionHeaders;
for(inti=0; i<m_pNTHeaders32->FileHeader.NumberOfSections; i++)
{
IMAGE_SECTION_HEADER*pSectionHeader = (IMAGE_SECTION_HEADER*)((BYTE*)m_pDOSHeader +
iSectionStart+ i*sizeof(IMAGE_SECTION_HEADER));
vecSectionHeaders.push_back(pSectionHeader);
AddSection(iSectionStart+i*sizeof(IMAGE_SECTION_HEADER),sizeof(IMAGE_SECTION_HEADER),"IMAGE_SECTION_HEADER");
}
intiCurPos = iSectionStart +m_pNTHeaders32->FileHeader.NumberOfSections*sizeof(IMAGE_SECTION_HEADER);
AddSection(iSectionStart,m_pNTHeaders32->FileHeader.NumberOfSections*sizeof(IMAGE_SECTION_HEADER),"IMAGE_SECTION_HEADERs");
//idata
//IMAGE_IMPORT_DESCRIPTOR数组
//没有指示数组大小的信息,只有不停读取,如果读取到空信息,那么就是结束了
for(size_ti=0; i<vecSectionHeaders.size(); i++)
{
std::stringstrN = (char*)(vecSectionHeaders[i]->Name);
AddSection(vecSectionHeaders[i]->PointerToRawData,vecSectionHeaders[i]->SizeOfRawData,strN.c_str());
if(strN== ".idata")
{
intiReadNum = 0;
while(1)
{
IMAGE_IMPORT_DESCRIPTOR*pD = (IMAGE_IMPORT_DESCRIPTOR*)(pC + vecSectionHeaders[i]->PointerToRawData+ iReadNum*sizeof(IMAGE_IMPORT_DESCRIPTOR));
AddSection(vecSectionHeaders[i]->PointerToRawData+iReadNum*sizeof(IMAGE_IMPORT_DESCRIPTOR),sizeof(IMAGE_IMPORT_DESCRIPTOR),"IMAGE_IMPORT_DESCRIPTOR");
iReadNum++;
if(pD->FirstThunk== 0)
break;
//name
intiNameAddress = vecSectionHeaders[i]->PointerToRawData + pD->Name -vecSectionHeaders[i]->VirtualAddress;
std::stringstrName = pC+iNameAddress;
{
std::map<std::string,std::string>mapP;
mapP["name"]= strName;
AddSection(iNameAddress,strName.length(),"Dll_Import_Name",mapP);
}
std::vector<std::string>vecImportFuns;
//OriginalThunk
intiThunkNum = 0;
while(1)
{
//OriginalFirstThunk
intiOriginalFirstThunkAddress =iThunkNum*sizeof(IMAGE_THUNK_DATA)+vecSectionHeaders[i]->PointerToRawData +pD->OriginalFirstThunk - vecSectionHeaders[i]->VirtualAddress;
IMAGE_THUNK_DATA*pThunkData = (IMAGE_THUNK_DATA*)(pC+iOriginalFirstThunkAddress);
AddSection(iOriginalFirstThunkAddress,sizeof(IMAGE_THUNK_DATA),"IMAGE_THUNK_DATA");
iThunkNum++;
if(pThunkData->u1.AddressOfData== 0)
break;
intiHitAddress = vecSectionHeaders[i]->PointerToRawData +pThunkData->u1.AddressOfData - vecSectionHeaders[i]->VirtualAddress;
IMAGE_IMPORT_BY_NAME*pImportName = (IMAGE_IMPORT_BY_NAME*)(pC+iHitAddress);
vecImportFuns.push_back((char*)(pImportName->Name));
std::map<std::string,std::string>mapP;
mapP["name"]= vecImportFuns[vecImportFuns.size()-1];
AddSection(iHitAddress,2+vecImportFuns[vecImportFuns.size()-1].length()+1,"IMAGE_IMPORT_BY_NAME",mapP);
}
AddSection(vecSectionHeaders[i]->PointerToRawData+ pD->OriginalFirstThunk -vecSectionHeaders[i]->VirtualAddress,iThunkNum*sizeof(IMAGE_THUNK_DATA),"IMAGE_THUNK_DATAs");
//Thunk
iThunkNum= 0;
while(1)
{
//OriginalFirstThunk
intiFirstThunkAddress =iThunkNum*sizeof(IMAGE_THUNK_DATA)+vecSectionHeaders[i]->PointerToRawData +pD->FirstThunk - vecSectionHeaders[i]->VirtualAddress;
IMAGE_THUNK_DATA*pThunkData = (IMAGE_THUNK_DATA*)(pC+iFirstThunkAddress);
AddSection(iFirstThunkAddress,sizeof(IMAGE_THUNK_DATA),"Import_Address_Table");
iThunkNum++;
if(pThunkData->u1.AddressOfData== 0)
break;
}
AddSection(vecSectionHeaders[i]->PointerToRawData+ pD->FirstThunk -vecSectionHeaders[i]->VirtualAddress,iThunkNum*sizeof(IMAGE_THUNK_DATA),"Import_Address_Tables");
}
}
}
OutputSection();
return0;
}
xml输出示例:
<Section Name="FileContent" Start="0" End="27648" >
<Section Name="IMAGE_DOS_HEADER" Start="0" End="64" >
<Section Name=".textbss" Start="0" End="0" >
</Section>
</Section>
<Section Name="IMAGE_NT_HEADERS" Start="224" End="472" >
</Section>
<Section Name="IMAGE_SECTION_HEADERs" Start="472" End="752" >
<Section Name="IMAGE_SECTION_HEADER" Start="472" End="512" >
</Section>
<Section Name="IMAGE_SECTION_HEADER" Start="512" End="552" >
</Section>
<Section Name="IMAGE_SECTION_HEADER" Start="552" End="592" >
</Section>
<Section Name="IMAGE_SECTION_HEADER" Start="592" End="632" >
</Section>
<Section Name="IMAGE_SECTION_HEADER" Start="632" End="672" >
</Section>
<Section Name="IMAGE_SECTION_HEADER" Start="672" End="712" >
</Section>
<Section Name="IMAGE_SECTION_HEADER" Start="712" End="752" >
</Section>
</Section>
<Section Name=".text" Start="1024" End="13824" >
</Section>
<Section Name=".rdata" Start="13824" End="21504" >
</Section>
<Section Name=".data" Start="21504" End="22016" >
</Section>
<Section Name=".idata" Start="22016" End="24576" >
<Section Name="IMAGE_IMPORT_DESCRIPTOR" Start="22016" End="22036" >
</Section>
<Section Name="IMAGE_IMPORT_DESCRIPTOR" Start="22036" End="22056" >
</Section>
<Section Name="IMAGE_IMPORT_DESCRIPTOR" Start="22056" End="22076" >
</Section>
<Section Name="IMAGE_THUNK_DATAs" Start="22076" End="22192" >
<Section Name="IMAGE_THUNK_DATA" Start="22076" End="22080" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22080" End="22084" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22084" End="22088" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22088" End="22092" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22092" End="22096" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22096" End="22100" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22100" End="22104" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22104" End="22108" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22108" End="22112" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22112" End="22116" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22116" End="22120" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22120" End="22124" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22124" End="22128" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22128" End="22132" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22132" End="22136" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22136" End="22140" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22140" End="22144" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22144" End="22148" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22148" End="22152" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22152" End="22156" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22156" End="22160" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22160" End="22164" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22164" End="22168" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22168" End="22172" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22172" End="22176" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22176" End="22180" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22180" End="22184" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22184" End="22188" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22188" End="22192" >
</Section>
</Section>
<Section Name="IMAGE_THUNK_DATAs" Start="22252" End="22360" >
<Section Name="IMAGE_THUNK_DATA" Start="22252" End="22256" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22256" End="22260" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22260" End="22264" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22264" End="22268" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22268" End="22272" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22272" End="22276" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22276" End="22280" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22280" End="22284" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22284" End="22288" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22288" End="22292" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22292" End="22296" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22296" End="22300" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22300" End="22304" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22304" End="22308" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22308" End="22312" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22312" End="22316" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22316" End="22320" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22320" End="22324" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22324" End="22328" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22328" End="22332" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22332" End="22336" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22336" End="22340" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22340" End="22344" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22344" End="22348" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22348" End="22352" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22352" End="22356" >
</Section>
<Section Name="IMAGE_THUNK_DATA" Start="22356" End="22360" >
</Section>
</Section>
<Section Name="Import_Address_Tables" Start="22420" End="22536" >
<Section Name="Import_Address_Table" Start="22420" End="22424" >
</Section>
<Section Name="Import_Address_Table" Start="22424" End="22428" >
</Section>
<Section Name="Import_Address_Table" Start="22428" End="22432" >
</Section>
<Section Name="Import_Address_Table" Start="22432" End="22436" >
</Section>
<Section Name="Import_Address_Table" Start="22436" End="22440" >
</Section>
<Section Name="Import_Address_Table" Start="22440" End="22444" >
</Section>
<Section Name="Import_Address_Table" Start="22444" End="22448" >
</Section>
<Section Name="Import_Address_Table" Start="22448" End="22452" >
</Section>
<Section Name="Import_Address_Table" Start="22452" End="22456" >
</Section>
<Section Name="Import_Address_Table" Start="22456" End="22460" >
</Section>
<Section Name="Import_Address_Table" Start="22460" End="22464" >
</Section>
<Section Name="Import_Address_Table" Start="22464" End="22468" >
</Section>
<Section Name="Import_Address_Table" Start="22468" End="22472" >
</Section>
<Section Name="Import_Address_Table" Start="22472" End="22476" >
</Section>
<Section Name="Import_Address_Table" Start="22476" End="22480" >
</Section>
<Section Name="Import_Address_Table" Start="22480" End="22484" >
</Section>
<Section Name="Import_Address_Table" Start="22484" End="22488" >
</Section>
<Section Name="Import_Address_Table" Start="22488" End="22492" >
</Section>
<Section Name="Import_Address_Table" Start="22492" End="22496" >
</Section>
<Section Name="Import_Address_Table" Start="22496" End="22500" >
</Section>
<Section Name="Import_Address_Table" Start="22500" End="22504" >
</Section>
<Section Name="Import_Address_Table" Start="22504" End="22508" >
</Section>
<Section Name="Import_Address_Table" Start="22508" End="22512" >
</Section>
<Section Name="Import_Address_Table" Start="22512" End="22516" >
</Section>
<Section Name="Import_Address_Table" Start="22516" End="22520" >
</Section>
<Section Name="Import_Address_Table" Start="22520" End="22524" >
</Section>
<Section Name="Import_Address_Table" Start="22524" End="22528" >
</Section>
<Section Name="Import_Address_Table" Start="22528" End="22532" >
</Section>
<Section Name="Import_Address_Table" Start="22532" End="22536" >
</Section>
</Section>
<Section Name="Import_Address_Tables" Start="22596" End="22704" >
<Section Name="Import_Address_Table" Start="22596" End="22600" >
</Section>
<Section Name="Import_Address_Table" Start="22600" End="22604" >
</Section>
<Section Name="Import_Address_Table" Start="22604" End="22608" >
</Section>
<Section Name="Import_Address_Table" Start="22608" End="22612" >
</Section>
<Section Name="Import_Address_Table" Start="22612" End="22616" >
</Section>
<Section Name="Import_Address_Table" Start="22616" End="22620" >
</Section>
<Section Name="Import_Address_Table" Start="22620" End="22624" >
</Section>
<Section Name="Import_Address_Table" Start="22624" End="22628" >
</Section>
<Section Name="Import_Address_Table" Start="22628" End="22632" >
</Section>
<Section Name="Import_Address_Table" Start="22632" End="22636" >
</Section>
<Section Name="Import_Address_Table" Start="22636" End="22640" >
</Section>
<Section Name="Import_Address_Table" Start="22640" End="22644" >
</Section>
<Section Name="Import_Address_Table" Start="22644" End="22648" >
</Section>
<Section Name="Import_Address_Table" Start="22648" End="22652" >
</Section>
<Section Name="Import_Address_Table" Start="22652" End="22656" >
</Section>
<Section Name="Import_Address_Table" Start="22656" End="22660" >
</Section>
<Section Name="Import_Address_Table" Start="22660" End="22664" >
</Section>
<Section Name="Import_Address_Table" Start="22664" End="22668" >
</Section>
<Section Name="Import_Address_Table" Start="22668" End="22672" >
</Section>
<Section Name="Import_Address_Table" Start="22672" End="22676" >
</Section>
<Section Name="Import_Address_Table" Start="22676" End="22680" >
</Section>
<Section Name="Import_Address_Table" Start="22680" End="22684" >
</Section>
<Section Name="Import_Address_Table" Start="22684" End="22688" >
</Section>
<Section Name="Import_Address_Table" Start="22688" End="22692" >
</Section>
<Section Name="Import_Address_Table" Start="22692" End="22696" >
</Section>
<Section Name="Import_Address_Table" Start="22696" End="22700" >
</Section>
<Section Name="Import_Address_Table" Start="22700" End="22704" >
</Section>
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="22764" End="22781" name="_CRT_RTC_INITW" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="22782" End="22804" name="_configthreadlocale" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="22804" End="22823" name="__setusermatherr" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="22824" End="22835" name="_commode" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="22836" End="22845" name="_fmode" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="22846" End="22863" name="__set_app_type" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="22864" End="22877" name="_amsg_exit" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="22878" End="22895" name="__wgetmainargs" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="22896" End="22904" name="_exit" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="22904" End="22918" name="_XcptFilter" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="22918" End="22927" name="_cexit" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="22928" End="22935" name="exit" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="22936" End="22949" name="__winitenv" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="22950" End="22970" name="_CrtSetCheckCount" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="22970" End="22987" name="_CrtDbgReportW" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="22988" End="23000" name="_initterm" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23000" End="23014" name="_initterm_e" >
</Section>
<Section Name="Dll_Import_Name" Start="23014" End="23027" name="MSVCR100D.dll" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23028" End="23048" name="?terminate@@YAXXZ" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23048" End="23063" name="_controlfp_s" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23064" End="23081" name="_invoke_watson" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23082" End="23092" name="_unlock" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23092" End="23106" name="__dllonexit" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23106" End="23114" name="_lock" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23114" End="23124" name="_onexit" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23124" End="23150" name="_except_handler4_common" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23150" End="23171" name="_crt_debugger_hook" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23172" End="23188" name="EncodePointer" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23188" End="23210" name="InterlockedExchange" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23210" End="23218" name="Sleep" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23218" End="23247" name="InterlockedCompareExchange" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23248" End="23269" name="HeapSetInformation" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23270" End="23300" name="SetUnhandledExceptionFilter" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23300" End="23316" name="DecodePointer" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23316" End="23342" name="QueryPerformanceCounter" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23342" End="23357" name="GetTickCount" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23358" End="23379" name="GetCurrentThreadId" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23380" End="23402" name="GetCurrentProcessId" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23402" End="23428" name="GetSystemTimeAsFileTime" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23428" End="23450" name="WideCharToMultiByte" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23450" End="23470" name="IsDebuggerPresent" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23470" End="23492" name="MultiByteToWideChar" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23492" End="23509" name="RaiseException" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23510" End="23521" name="lstrlenA" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23522" End="23539" name="GetProcAddress" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23540" End="23555" name="LoadLibraryW" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23556" End="23567" name="HeapFree" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23568" End="23580" name="HeapAlloc" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23580" End="23597" name="GetProcessHeap" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23598" End="23619" name="GetModuleFileNameW" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23620" End="23635" name="VirtualQuery" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23636" End="23650" name="FreeLibrary" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23650" End="23669" name="TerminateProcess" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23670" End="23690" name="GetCurrentProcess" >
</Section>
<Section Name="IMAGE_IMPORT_BY_NAME" Start="23690" End="23717" name="UnhandledExceptionFilter" >
</Section>
<Section Name="Dll_Import_Name" Start="23718" End="23730" name="KERNEL32.dll" >
</Section>
</Section>
<Section Name=".rsrc" Start="24576" End="26112" >
</Section>
<Section Name=".reloc" Start="26112" End="27648" >
</Section>
</Section>
.idata数据的解析的更多相关文章
- NPOI操作EXCEL(三)——反射机制进行excel表格数据的解析
我们先来回忆回忆上篇文章讲到的通过xml配置文件实现excel批量模板解析的整体思路: 1.对每个excel模板制定xml配置规则集,实现xml配置文件的解析服务 2.为每个excel模板制定DTO, ...
- XML数据的解析
XML数据的解析 相比于JSON数据解析而言,XML数据解析可能会让更多的童鞋感觉到吃力,对我来说,同样认为JSON数据好像让人感觉比较友好,不过对于程序开发者来说,无非就是这两种数据解析占比较大的部 ...
- 解剖SQLSERVER 第四篇 OrcaMDF里对dates类型数据的解析(译)
解剖SQLSERVER 第四篇 OrcaMDF里对dates类型数据的解析(译) http://improve.dk/parsing-dates-in-orcamdf/ 在SQLSERVER里面有几 ...
- android基础---->JSON数据的解析
上篇博客,我们谈到了XML两种常用的解析技术,详细可以参见我的博客(android基础---->XMl数据的解析).网络传输另外一种数据格式JSON就是我们今天要讲的,它是比XML体积更小的数据 ...
- Android 之 json数据的解析(jsonReader)
json数据的解析相对而言,还是比较容易的,实现的代码也十分简单.这里用的是jsonReade方法来进行json数据解析. 1.在解析之前,大家需要知道什么是json数据. json数据存储的对象是无 ...
- Json--Android中数据文件解析(Json解析--从服务器端获取数据并且解析,显示在客户端上面)
前面学习过了使用SAX解析XML数据(点击进入:SAX解析XML数据),今天学习Json解析: 首先说一下Json数据的最基本的特点,Json数据是一系列的键值对的集合,和XML数据来比,Json数据 ...
- Android通过类对象的方式实现JSON数据的解析
1.通过主Activity的Button按钮实现数据的解析 public class MainActivity extends Activity { //定义一个包含Json格式的字符对象 priva ...
- iOS开发网络篇—JSON数据的解析
iOS开发网络篇—JSON数据的解析 iOS开发网络篇—JSON介绍 一.什么是JSON JSON是一种轻量级的数据格式,一般用于数据交互 服务器返回给客户端的数据,一般都是JSON格式或者XML格式 ...
- iOS开发网络篇—XML数据的解析
iOS开发网络篇—XML数据的解析 iOS开发网络篇—XML介绍 一.XML简单介绍 XML:全称是Extensible Markup Language,译作“可扩展标记语言” 跟JSON一样,也是 ...
随机推荐
- 抽象类(abstract class)和 接口(interface)
PHP中的 抽象类(abstract class)和 接口(interface) 一. 抽象类abstract class 1 .抽象类是指在 class 前加了 abstract 关键字且存在抽象方 ...
- CF 224 B Array
给你n个数,求[l, r] 的一段数,a[l] - a[r] 一共含有k个不相同的数,且sum a[l, r] 最小的那一段. 用队列维护当前数段中不同元素的个数即可. #include<ios ...
- MSSQL - 存储过程Return返回值
1.存储过程中不使用外部参数. 存储过程: SET ANSI_NULLS ON GO SET QUOTED_IDENTIFIER ON GO -- ========================== ...
- linux命令:ftp
1. 登录: ftp IP_ADDR : 根据提示输入USER_NAME PASS_WORD 或: ftp -i -n IP_ADDR user USER_NAME PASS ...
- 矩形、占位符组件——axure线框图部件库介绍
矩形组件和占位符没有太多的区别,这里我们主要讲解矩形组件的操作和使用,占位符的操作各位可以按照矩形的操作方法进行练习一下. 矩形组件是一个矩形,它可以用来做很多的工作,比如页面上需要一块蓝色的背景,就 ...
- poj 3778
这就是个超级水题……!!!!写一写来纪念一下自己的错误…… 如果某个学生的的成绩是其他俩个或三个学生成绩的和则给予奖励 直接暴力,所以一开始直接用数组标记两个人或三个人的和,但是忽略了这种情况 20( ...
- 纯win32实现PNG图片透明窗体
#include <windows.h> #include <gdiplus.h> /* GDI+ startup token */ ULONG_PTR gdiplusSta ...
- 实现StatusBar的Flat风格
效果见右图,OfficeXP里就是这样的风格,其实实现很简单,不必专门在网上找别人控件. 把StatusBar的SimplePanel设为False,点击Panels添加StatusPanel,把所有 ...
- 刚写好的读取多网卡IP地址的函数
虽然现在一机多网卡已经很普遍(像Notebook带有线.无线.蓝芽等),但是找一个现成的能够一次过读出所有网卡IP地址的函数实在是难,无奈自己写了一个,好东西谁用谁知道. //uses WinSock ...
- 后台调用外部程序的完美实现(使用CreateDesktop建立隐藏桌面)
最近在做的一个软件,其中有一部分功能需要调用其它的软件来完成,而那个软件只有可执行文件,根本没有源代码,幸好,我要做的事不难,只需要在我的程序启动后,将那个软件打开,在需要的时候,对其中的一个文本矿设 ...