1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
| #include<stdio.h>
#include<stdlib.h>
#include<string.h>
long n;
unsigned int elfanew;
unsigned int sizeofimage;
unsigned int sizeofheads;
unsigned short numberofsections;
unsigned short sizeofoptionalheader;
int startsectiontable;
void* dllread()
{
FILE* fp = fopen("mydll.dll","rb");
void* p;
if(fp == NULL)
{
printf("failed");
exit(0);
}
fseek(fp,0,2);
n = ftell(fp);
p = malloc(n);
if(p == NULL)
{
printf("failed");
exit(0);
}
fseek(fp,0,0);
fread(p,1,n,fp);
fclose(fp);
return p;
}
int rva2foa(char* p,int rva)
{
int i;
if(rva<=sizeofheads)
{
return rva;
}
for(i=0;i<numberofsections;i++)
{
int va = *(int*)(p + startsectiontable + i*0x28 + 0xc);
int sord = *(int*)(p + startsectiontable + i*0x28 + 0x10);
int ptrd = *(int*)(p + startsectiontable + i*0x28 + 0x14);
if(rva>=va && rva<=va+sord)
{
return ptrd + (rva - va);
}
}
printf("error");
exit(1);
}
void showinfo(char* p)
{
int exportrva;
int exportfoa;
exportrva = *(int*)(p + elfanew + 4 + 0x14 + 0x60 + 0*0x8);
exportfoa = rva2foa(p,exportrva);
printf("---------------------\n");
printf("infomations:\n");
printf("Characteristic: 0x%x\n",*(int*)(p + exportfoa));
printf("TimeDateStamp: 0x%x\n",*(int*)(p + exportfoa + 0x4));
printf("MajorVersion: 0x%x\n",*(short*)(p + exportfoa + 0x8));
printf("MinorVersion: 0x%x\n",*(short*)(p + exportfoa + 0xa));
printf("Name: 0x%x\n",*(int*)(p + exportfoa + 0xc));
printf("Base: 0x%x\n",*(int*)(p + exportfoa + 0x10));
printf("NumberOfFunctions: 0x%x\n",*(int*)(p + exportfoa + 0x14));
printf("NumberOfNames: 0x%x\n",*(int*)(p + exportfoa + 0x18));
printf("AddressOfFunctions: 0x%x\n",*(int*)(p + exportfoa + 0x1c));
printf("AddressOfNames: 0x%x\n",*(int*)(p + exportfoa + 0x20));
printf("AddressOfNameOrdinals: 0x%x\n",*(int*)(p + exportfoa + 0x24));
}
int GetFunctionAddrByName(char* p,char* str)
{
int exportrva;
int exportfoa;
int AddressOfFunctions;
int AddressOfNameOrdinals;
int AddressOfNames;
int af;
int ano;
int an;
int Base;
int NumberOfNames;
int i;
exportrva = *(int*)(p + elfanew + 4 + 0x14 + 0x60 + 0*0x8);
exportfoa = rva2foa(p,exportrva);
AddressOfFunctions = *(int*)(p + exportfoa + 0x1c);
AddressOfNameOrdinals = *(int*)(p + exportfoa + 0x24);
AddressOfNames = *(int*)(p + exportfoa + 0x20);
Base = *(int*)(p + exportfoa + 0x10);
NumberOfNames = *(int*)(p + exportfoa + 0x18);
af = rva2foa(p,AddressOfFunctions);
ano = rva2foa(p,AddressOfNameOrdinals);
an = rva2foa(p,AddressOfNames);
for(i=0;i<NumberOfNames;i++)
{
int namefoa;
int namerva = *(int*)(p + an + i*4);
namefoa = rva2foa(p,namerva);
if(strcmp(p+namefoa,str) == 0)
{
break;
}
}
if(i == NumberOfNames)
{
printf("There is no such function");
exit(1);
}
int ordinals = *(short*)(p + ano + i*2);
int result = *(int*)(p + af + ordinals*4);
return result;
}
int GetFunctionAddrByOrdinals(char* p,int ordinal)
{
int exportrva;
int exportfoa;
int AddressOfFunctions;
int af;
int Base;
exportrva = *(int*)(p + elfanew + 4 + 0x14 + 0x60 + 0*0x8);
exportfoa = rva2foa(p,exportrva);
AddressOfFunctions = *(int*)(p + exportfoa + 0x1c);
Base = *(int*)(p + exportfoa + 0x10);
af = rva2foa(p,AddressOfFunctions);
int result = *(int*)(p + af + ((ordinal - Base)*4));
return result;
}
int main()
{
char* p;
p = (char*)dllread();
elfanew = *(unsigned int*)(p + 0x3c);
sizeofheads = *(unsigned int*)(p + elfanew + 4 + 0x14 + 0x3c);
numberofsections = *(unsigned short*)(p + elfanew + 4 + 2);
sizeofoptionalheader = *(unsigned short*)(p + elfanew + 4 + 0x10);
startsectiontable = elfanew + 4 + 0x14 + sizeofoptionalheader;
showinfo(p);
int showrva = GetFunctionAddrByName(p,"show");
printf("the rva of show is 0x%x\n",showrva);
int HelloWorldrva = GetFunctionAddrByOrdinals(p,1);
printf("the rva of HelloWorld is 0x%x\n",HelloWorldrva);
return 0;
}
|
