I load the entire PE into an std::vector<Byte> fileContent
using std::fstream
.
Then I obtain the executable's dos header:
IMAGE_DOS_HEADER* imageDosHeader = (IMAGE_DOS_HEADER*)fileContent.data();
After that, I check whether the PE is valid(MZ
and PE00
signatures).
If it is, I get its import descriptor:
IMAGE_IMPORT_DESCRIPTOR* imageImportDescriptor = (IMAGE_IMPORT_DESCRIPTOR*)((DWORD)imageDosHeader + imageNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
//Note: the VirtualAddress field equals 0x4FFC, so I assume it's valid
Now, I iterate through the dlls and try to display their names as following:
for(DWORD i = 0; ; i++)
{
bool isCurrentDllValid = true;
//if all fields of the current dll are zeros, then this dll is the last one, so break the outer loop
for(DWORD j = 0; j < sizeof(IMAGE_IMPORT_DESCRIPTOR); j++)
{
if((*(DWORD*)((DWORD)&imageImportDescriptor[i] + j)))
break;
else if(j == sizeof(IMAGE_IMPORT_DESCRIPTOR) - 1)
isCurrentDllValid = false;
}
if(!isCurrentDllValid)
break;
char* dllName = (char*)((DWORD)imageDosHeader + imageImportDescriptor[i].Name);
The problem is: an attempt to display the dllName
causes crash.
Also, the Name
field is an RVA, but its value is 0x6C61766E
(the same thing is with the rest of the fields, the smallest one is TimeDateStamp
with 0x637465
, still abnormal one), while size of the PE is less than 0x7000
.
In hex editor, RVA of e.g. "KERNEL32.dll"
is 0x46F0
.
Have you any idea why is it so? Am I missing something really simple?