| Subject: | Problem with listing the import names |
| Date: | Wed, 10 Jun 2015 15:14:35 +0530 |
| To: | "bug-Win32-PEFile [...] rt.cpan.org" <bug-win32-pefile [...] rt.cpan.org> |
| From: | Ashish Shirodkar <ashish_shirodkar [...] live.com> |
Hi,
I'm a Software Engineer and was writing a PE file parser using Perl.
I noticed that "my @importNames = $pe->getImportNames();" returns a list of all the named entry points.
But the problem with this function is it does not give me the list of DLL's present in the import table in order in which they are actually present in PE file import table.
Is there any other functionality which will return me ARRAY of DLL's present in import table? in the order they are actually listed in PE file import table?
Perl List always return random list (because it stores result in hash)
I need this functionality to check if my DLL appears first in import table.
For example the below C code will print the DLL's present in the import table in the ORDER which they appear in PE file import table.
#include<windows.h>#include<stdio.h>int main(int argc,char *argv[]){ if(argc<2) { printf("\nUsage : ImportDirParser.exe TargetExe\n"); ExitProcess(0); } HANDLE hFile,hFileMap; DWORD dwImportDirectoryVA,dwSectionCount,dwSection=0,dwRawOffset; LPVOID lpFile; PIMAGE_DOS_HEADER pDosHeader; PIMAGE_NT_HEADERS pNtHeaders; PIMAGE_SECTION_HEADER pSectionHeader; PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor; PIMAGE_THUNK_DATA pThunkData; hFile = CreateFile(argv[1],GENERIC_READ,FILE_SHARE_READ,0,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0); if(hFile==INVALID_HANDLE_VALUE) ExitProcess(1); hFileMap = CreateFileMapping(hFile,0,PAGE_READONLY,0,0,0); lpFile = MapViewOfFile(hFileMap,FILE_MAP_READ,0,0,0); pDosHeader = (PIMAGE_DOS_HEADER)lpFile; pNtHeaders = (PIMAGE_NT_HEADERS)((DWORD)lpFile+pDosHeader->e_lfanew); dwSectionCount = pNtHeaders->FileHeader.NumberOfSections; dwImportDirectoryVA = pNtHeaders->OptionalHeader.DataDirectory[1].VirtualAddress; pSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD)pNtHeaders+sizeof(IMAGE_NT_HEADERS)); for(;dwSection < dwSectionCount && pSectionHeader->VirtualAddress <= dwImportDirectoryVA;pSectionHeader++,dwSection++); pSectionHeader--; dwRawOffset = (DWORD)lpFile+pSectionHeader->PointerToRawData; pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)(dwRawOffset+(dwImportDirectoryVA-pSectionHeader->VirtualAddress)); for(;pImportDescriptor->Name!=0;pImportDescriptor++) { printf("\nDLL Name : %s\n\n",dwRawOffset+(pImportDescriptor->Name-pSectionHeader->VirtualAddress)); /*printf("\nDLL Name : %x\n\n",dwRawOffset+(pImportDescriptor->Name-pSectionHeader->VirtualAddress)); */ } UnmapViewOfFile(lpFile); CloseHandle(hFileMap); CloseHandle(hFile); return 0;}
Let me know if there is any such functionality available in perl.
Regards,Ashish Shirodkar