Hi
I am trying to get list of import module names from PE file. But i can not find the solution.
This is my code:

CString CPE::GetImportModuleNames(CString str_SectionHdrName)
{
CString c;


IMAGE_DOS_HEADER * dosheader=(IMAGE_DOS_HEADER *)g_pMappedFileBase;
    IMAGE_OPTIONAL_HEADER * opthdr =(IMAGE_OPTIONAL_HEADER *)
                    ((BYTE*)dosheader+dosheader->e_lfanew+24);

    IMAGE_IMPORT_DESCRIPTOR * descriptor=(IMAGE_IMPORT_DESCRIPTOR *)
    ((BYTE*)dosheader+
    opthdr->DataDirectory.VirtualAddress);

// (?)

return c;
}


In Documentation, it says:

" The IMAGE_IMPORT_DESCRIPTOR struct consists of five fields :

  Union {
DWORD Characteristics;
PIMAGE_THUNK_DATA OriginalFirstThunk;
  };
  DWORD TimeDateStamp;
  DWORD ForwarderChain;
  DWORD Name;
  PIMAGE_THUNK_DATA FirstThunk;"
...
"Name contains the a pointer (RVA) to the ASCII name of the DLL."

How can i retrieve the name of modules from that pointer(RVA).
Now i think i must write a loop and get the names but i couldn't do the the last step.

while(?)
{
descriptor->Name (?)
}

Could you please help me.
Thank you.
Posted on 2007-10-17 04:05:34 by portyum
Have a look at Iczelion's PE tutorials, this one explains the basics of the import table :

http://win32assembly.online.fr/pe-tut6.html
Posted on 2007-10-17 13:01:29 by Vortex