挂钩IAT地址不正确

Question

我正在尝试找到在测试应用程序中导入的wglGetProcAddress(OpenGl32.dll)的条目.由于某种原因,名称为"wglGetProcAddress"的导入确实指向通过在Opengl32.dll上调用GetModuleHandle和GetProcAddress返回的相同函数.

可执行文件已加载到内存中,并且是一个当前暂停其线程的进程.以下代码正确读取由该可执行文件导入的名称模块及其功能.因此,IAT不应包含RVAs,因为它已被加载.

HMODULE h = GetModuleHandle("OPENGL32.dll");
DWORD expect_addr = (DWORD)GetProcAddress(h, "wglGetProcAddress");

PIMAGE_IMPORT_DESCRIPTOR import_desc = (PIMAGE_IMPORT_DESCRIPTOR)(pmem + import_dir);
while (import_desc->Name)
{
    PIMAGE_THUNK_DATA thunk = (PIMAGE_THUNK_DATA)(pmem + import_desc->OriginalFirstThunk);
    while (thunk->u1.Function)
    {
        PIMAGE_IMPORT_BY_NAME import = (PIMAGE_IMPORT_BY_NAME)(pmem + thunk->u1.AddressOfData);

        printf("%s 0x%X\n", import->Name, thunk->u1.Function);
        if ((DWORD)expect_addr == (DWORD)thunk->u1.Function)
        {
            printf("Found wglGetProcAddress\n");
        }
        else if (!strcmp((const char*)import->Name, "wglGetProcAddress"))
        {
            printf("Found wglGetProcAddress's import, but the function has a different value.\n");
        }
        ++thunk;
    }

    ++import_desc;
}

来自该原始值的GetProcAddress返回XX变化的地址60XXC245,但是thunk-> u1.Function总是返回0xA46D8.thunk-> u1(Function,AddressOfData,Ordinal和ForwarderString)中的所有内容都具有相同的值.导入描述符和导入的名称是正确的.有谁看到我错过了什么？

编辑:我正在尝试别的东西:我正在扫描pmem(内存中的可执行文件的图像),因为我期望的是IAT条目,但是它找不到:

HMODULE h = GetModuleHandle("OPENGL32.dll");
DWORD expect_addr = (DWORD)GetProcAddress(h, "wglGetProcAddress");

printf("Looking for 0x%X\n", expect_addr);
for (int i = 0; i < pmem_size - sizeof(DWORD); i++)
{
    if (*(DWORD*)(pmem + i) == expect_addr)
    {
        printf("0x%X at 0x%X\n", *(DWORD*)(pmem + i), i);
    }
}

已解决:我没有意识到,但使用CREATE_SUSPENDED调用CreateProcess可以防止Windows加载程序使用实际地址填充FirstThunk.如果我让进程运行一秒钟然后挂起线程,它就会很好地挂接IAT地址.现在我必须寻找一种方法来解决这个问题.

Answer 1

u1.Function表示条目的相对偏移量（如果设置了IMAGE_IMPORT_BY_NAME该位，则为序号条目）。IMAGE_ORDINAL_FLAG这就是为什么它与 from 的值不匹配GetProcAddress，因为它不是函数的地址，而是函数导入条目的地址。

当您找到与您的函数匹配的 thunk 时，您也需要使用它来查找链接器更改的虚拟地址，形成其他thunk列表。改变你的代码，这样它就会产生：

while (import_desc->Name)
{
    PIMAGE_THUNK_DATA thunk = (PIMAGE_THUNK_DATA)((DWORD)GetModuleHandle(NULL) + import_desc->OriginalFirstThunk);
    int i = 0;
    while (thunk->u1.Function)
    {
        PIMAGE_IMPORT_BY_NAME import = (PIMAGE_IMPORT_BY_NAME)((DWORD)GetModuleHandle(NULL) + thunk->u1.AddressOfData);

        void** p = (void**)((DWORD)GetModuleHandle(NULL) + import_desc->FirstThunk);
        printf("%s 0x%X\n", import->Name, p[i]);//thunk->u1.Function);
        if ((DWORD)expect_addr == (DWORD)p[i])
        {
            printf("Found wglGetProcAddress\n");
        }
        else if (!strcmp((const char*)import->Name, "wglGetProcAddress"))
        {
            printf("Found wglGetProcAddress's import, but the function has a different value.\n");
        }
        ++thunk;
    }

    ++import_desc;
}

为了获取 IAT 条目，我的做法略有不同：

inline const void** GetImportAddress(HMODULE hModule, IMAGE_IMPORT_DESCRIPTOR* pTable, size_t nThunk)
{
    const void** pAddressBlock = (const void**)((DWORD)hModule + pTable->FirstThunk);
    return &pAddressBlock[nThunk];      
}

const void** GetImport(HMODULE hModule, const char* szDll, const char* szFunction)
{
    const char* szDllName = NULL;
    IMAGE_IMPORT_DESCRIPTOR* pTable = GetImportDescriptor(hModule);
    while(pTable->Characteristics != 0 && (szDllName = GetImportTableName(hModule,pTable)) != NULL)
    {
        if(!lstrcmpiA(szDll,szDllName))
        {
            IMAGE_THUNK_DATA* pThunkData = GetThunk(hModule,pTable);
            if(pThunkData != NULL)
            {
                size_t nThunk = 0;
                while(pThunkData->u1.AddressOfData != 0)
                {
                    if(pThunkData->u1.Ordinal & IMAGE_ORDINAL_FLAG)
                    {
                        if(IMAGE_ORDINAL32(pThunkData->u1.Ordinal) == (DWORD)szFunction)
                            return GetImportAddress(hModule,pTable,nThunk);
                    }
                    else
                    {
                        IMAGE_IMPORT_BY_NAME* pImport = GetImport(hModule,pThunkData);
                        if(!lstrcmpA(szFunction,(const char*)pImport->Name))
                            return GetImportAddress(hModule,pTable,nThunk);
                    }

                    nThunk++;
                    pThunkData++;
                }
            }
        }

        pTable++;
    }

    return NULL;
}