Printing out the names of implicitly linked dll's from .idata section in a PE file

This is a discussion on Printing out the names of implicitly linked dll's from .idata section in a PE file within the Windows Programming forums, part of the Platform Specific Boards category; I am trying to write a code which is supposed to print out the names of all the imported dll's ...

  1. #1
    Registered User
    Join Date
    Aug 2011
    Posts
    384

    Printing out the names of implicitly linked dll's from .idata section in a PE file

    I am trying to write a code which is supposed to print out the names of all the imported dll's in the exe by using the 'name' field of the IMAGE_IMPORT_DESCRIPTOR structure in the .idata section of the exe, but the program seems to be getting stuck in an infinite loop. Can someone please tell me how to get the names printed out correctly...


    Code:
        #include<iostream>
        #include<Windows.h>
        #include<stdio.h>
        #include<WinNT.h>
    
        int main()
        {
            FILE *fp; 
            int i;
    
            if((fp = fopen("c:\\Linked List.exe","rb"))==NULL)
                std::cout<<"unable to open";
    
    
            IMAGE_DOS_HEADER imdh;
            fread(&imdh,sizeof(imdh),1,fp);
            fseek(fp,imdh.e_lfanew,0);
    
            IMAGE_NT_HEADERS imnth;
            fread(&imnth,sizeof(imnth),1,fp);
    
            IMAGE_SECTION_HEADER *pimsh;
            pimsh = (IMAGE_SECTION_HEADER *)malloc(sizeof(IMAGE_SECTION_HEADER) * imnth.FileHeader.NumberOfSections);
    
            long t;
    
            fread(pimsh,sizeof(IMAGE_SECTION_HEADER),imnth.FileHeader.NumberOfSections,fp);
    
            for(i=0;i<imnth.FileHeader.NumberOfSections;i++)
            {
                if(!strcmp((char *)pimsh->Name,".idata"))
                    t = pimsh->PointerToRawData;
                pimsh++;
            }
    
            fseek(fp,t,0);
    
            IMAGE_IMPORT_DESCRIPTOR iid;
            char c;
    
            while(1)
            {
                fread(&iid,sizeof(iid),1,fp);
    
                if(iid.Characteristics == NULL)
                    break;
    
                t = ftell(fp);
    
                fseek(fp,(long)iid.Name,0);
    
                while(c=fgetc(fp))
                    printf("%c",c);
                printf("\n");
    
                fseek(fp,t,0);
    
            }
        }

  2. #2
    - - - - - - - - oogabooga's Avatar
    Join Date
    Jan 2008
    Posts
    2,808
    The reason for the infinite loop is that you're not checking for EOF from fgetc(). If you print out iid.Name you'll see that it's past the end of the file (at least for the file I tested). It probably represents a virtual address in memory for use after the image has been mapped, not a file offset. There should be a number stored somewhere that you can subtract from it to get the file offset.

    Get this tool, FileAlyzer. When installed, it adds a right-click menu item "Analyze with FileAlyzer". It shows the file in hex, lets you search for strings (right-click, pick "Scan for strings", then pick the Filenames tab at the right) and most helpfully for your needs, shows the MZ and PE headers and also the PE Imports, etc.

    Using it I found that the strings you want exist at iid.Name - 74752 (0x12400). However, I can't see where that number is stored and I've already spent about 20 minutes playing around with it, so that's it for me!

    Oh yeah, there's also this docx file describing the PE format.
    Last edited by oogabooga; 03-11-2012 at 10:05 PM.
    The cost of software maintenance increases with the square of the programmer's creativity. - Robert D. Bliss

  3. #3
    Registered User
    Join Date
    Aug 2011
    Posts
    384
    Quote Originally Posted by oogabooga View Post
    Get this tool, FileAlyzer. When installed, it adds a right-click menu item "Analyze with FileAlyzer". It shows the file in hex, lets you search for strings (right-click, pick "Scan for strings", then pick the Filenames tab at the right) and most helpfully for your needs, shows the MZ and PE headers and also the PE Imports, etc.

    Using it I found that the strings you want exist at iid.Name - 74752 (0x12400). However, I can't see where that number is stored
    Thanks for the tip, I can carry on from here.

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. Printing all the variable names in a program.
    By Fatima Rizwan in forum C++ Programming
    Replies: 3
    Last Post: 09-29-2010, 09:59 AM
  2. Adding directory/file names to a linked list
    By thoseion in forum C Programming
    Replies: 13
    Last Post: 12-08-2006, 12:13 PM
  3. Threads, Linked Lists, Semaphores, Critical Section ...
    By _jr in forum Windows Programming
    Replies: 4
    Last Post: 06-21-2006, 08:14 AM
  4. was previously implicitly declared to return `int'
    By Schwarzhelm in forum C Programming
    Replies: 1
    Last Post: 10-14-2003, 10:13 PM
  5. is there a way to write the file names in a folder in a text file?
    By Commander in forum A Brief History of Cprogramming.com
    Replies: 2
    Last Post: 08-15-2002, 05:11 PM

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21