读取 IMAGE_EXPORT_DIRECTORY 以查找导出的函数名称会导致访问冲突

Question

我正在阅读IMAGE_EXPORT_DIRECTORY如下

    PIMAGE_EXPORT_DIRECTORY ExportDirectory = (PIMAGE_EXPORT_DIRECTORY)((DWORD)dosHeader + ConvertRVA(PEImageOptionalHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress,
        FirstSectionHeader,PEFileImageHeader));

这个 works.Then 我想访问 AddressOfNames。

PDWORD* ExportedFunctions;
ExportedFunctions = (PDWORD *)((DWORD)dosHeader + ConvertRVA(ExportDirectory->AddressOfNames,FirstSectionHeader,PEFileImageHeader));

现在如何找到导出函数的名称？ConvertRVA() 定义为

DWORD ConvertRVA(DWORD rva,PIMAGE_SECTION_HEADER FirstSectionHeader,PIMAGE_FILE_HEADER PEFileImageHeader)
{
    int j=0;
    auto i =FirstSectionHeader;
    for(;j<PEFileImageHeader->NumberOfSections ;i++,j++)
    {
        if(rva>=i->VirtualAddress && rva<i->VirtualAddress + i->Misc.VirtualSize)
            break;
    }
    return rva+i->PointerToRawData-i->VirtualAddress;
}

Answer 1

我找到了一种方法。

 PDWORD ExportedFunctions;
    ExportedFunctions = (PDWORD )((DWORD)dosHeader + ConvertRVA(ExportDirectory->AddressOfNames,FirstSectionHeaderBest,PEFileImageHeader));



    for(int i=0;i<ExportDirectory->NumberOfNames;i++)
    {
        LPSTR aaaa=(PCHAR)((DWORD)dosHeader + ConvertRVA((DWORD)ExportedFunctions[0],FirstSectionHeaderBest,PEFileImageHeader)); 
        std::cout<<aaaa<<std::endl;
    }

读取 IMAGE_EXPORT_DIRECTORY 以查找导出的函数名称会导致访问冲突

Reading IMAGE_EXPORT_DIRECTORY to find exported function names causes access violation

c++

windows

portable-executable