#include <windows.h>
#include <stdio.h>
int main(void)
{
HMODULE hMod = GetModuleHandle("kernel32.dll");
PIMAGE_DOS_HEADER peFile;
PIMAGE_NT_HEADERS peHeader;
PIMAGE_OPTIONAL_HEADER peOptionalH;
PIMAGE_DATA_DIRECTORY DataDir;
PIMAGE_EXPORT_DIRECTORY ExportTable;
DWORD numberOfFunction;
DWORD *pName, *pFunc;
size_t i;
if(!hMod) return 1;
peFile = (PIMAGE_DOS_HEADER)hMod;
if(peFile->e_magic != IMAGE_DOS_SIGNATURE)
{
printf("This file isn't a valid DOS file.\n");
return 1;
}
peHeader = (PIMAGE_NT_HEADERS)((DWORD)peFile + peFile->e_lfanew);
if(peHeader->Signature != IMAGE_NT_SIGNATURE)
{
printf("This file isn't a valid PE file.\n");
return 1;
}
peOptionalH = &peHeader->OptionalHeader;
DataDir = &peOptionalH->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
ExportTable = (PIMAGE_EXPORT_DIRECTORY)((DWORD)peFile + DataDir->VirtualAddress);
numberOfFunction = ExportTable->NumberOfFunctions;
printf("%d functions and %d names loaded.\n", ExportTable->NumberOfFunctions, ExportTable->NumberOfNames);
pName = (DWORD*)((DWORD)peFile + ExportTable->AddressOfNames);
pFunc = (DWORD*)((DWORD)peFile + ExportTable->AddressOfFunctions);
for(i=0;i<numberOfFunction;i++)
{
printf("function founded : %s (%x)\n", (DWORD)peFile + *pName, (DWORD)peFile + *pFunc);
pName++;
pFunc++;
}
return 0;
}