exportdlg.asm

汇编写的pe文件信息查看工具

AppendText proc hDlg:DWORD,pText:DWORD 
		invoke SendDlgItemMessage,hDlg,IDC_EDIT_EXPORT,EM_REPLACESEL,0,pText 
		 
		invoke SendDlgItemMessage,hDlg,IDC_EDIT_EXPORT,EM_SETSEL,-1,0 
		ret 
AppendText endp 


_ShowExport	proc	_lpFileBase,_lpPEHeader,hWnd
		local	@szBuffer[1024]:byte,@szSectionName[16]:byte
		local	@dwIndex,@lpAddressOfNames,@lpAddressOfNameOrdinals

		pushad
		mov	esi,_lpPEHeader
		assume	esi:ptr IMAGE_NT_HEADERS

; 从数据目录中获取导出表的位置
		mov	eax,[esi].OptionalHeader.DataDirectory.VirtualAddress
		.if	! eax
			invoke	MessageBox,hExportDlg,addr szErrNoExport,NULL,MB_OK
			assume	esi:nothing
			assume	edi:nothing
			popad
			ret
		.endif
		invoke	_RVAToOffset,_lpPEHeader,eax
		add	eax,_lpFileBase
		mov	edi,eax

; 显示一些常用的信息
		assume	edi:ptr IMAGE_EXPORT_DIRECTORY
		invoke	_RVAToOffset,_lpPEHeader,[edi].nName
		add	eax,_lpFileBase
		mov	ecx,eax
		invoke	_GetRVAInSection,_lpPEHeader,[edi].nName
		invoke	wsprintf,addr @szBuffer,addr szExport,eax,ecx,[edi].nBase,\
			[edi].NumberOfFunctions,[edi].NumberOfNames,[edi].AddressOfFunctions,\
			[edi].AddressOfNames,[edi].AddressOfNameOrdinals
		invoke AppendText,hWnd,addr @szBuffer 
		invoke	_RVAToOffset,_lpPEHeader,[edi].AddressOfNames
		add	eax,_lpFileBase
		mov	@lpAddressOfNames,eax
		invoke	_RVAToOffset,_lpPEHeader,[edi].AddressOfNameOrdinals
		add	eax,_lpFileBase
		mov	@lpAddressOfNameOrdinals,eax
		invoke	_RVAToOffset,_lpPEHeader,[edi].AddressOfFunctions
		add	eax,_lpFileBase
		mov	esi,eax		;esi --> 函数地址表

; 循环显示导出函数的信息
		mov	ecx,[edi].NumberOfFunctions
		mov	@dwIndex,0		
		@@:
			pushad

; 在按名称导出的索引表中
			mov	eax,@dwIndex
			push	edi
			mov	ecx,[edi].NumberOfNames
			cld
			mov	edi,@lpAddressOfNameOrdinals
			repnz	scasw
			.if	ZERO?	;找到函数名称
				sub	edi,@lpAddressOfNameOrdinals
				sub	edi,2
				shl	edi,1
				add	edi,@lpAddressOfNames
				invoke	_RVAToOffset,_lpPEHeader,dword ptr [edi]
				add	eax,_lpFileBase
			.else
				mov	eax,offset szExportByOrd
			.endif
			pop	edi

; 序号 --> ecx
			mov	ecx,@dwIndex
			add	ecx,[edi].nBase
			invoke	wsprintf,addr @szBuffer,addr szFunName,\
				ecx,dword ptr [esi],eax
			invoke AppendText,hWnd,addr @szBuffer
			popad
			add	esi,4
			inc	@dwIndex
		loop	@B
		assume	esi:nothing
		assume	edi:nothing
		popad
		ret
_ShowExport	endp



;输出表对话框
_ProcDlgExport	proc	uses ebx edi esi hWnd,wMsg,wParam,lParam
			mov	eax,wMsg
		.if	eax == WM_CLOSE
			invoke  EndDialog,hWnd,NULL

		.elseif	eax ==  WM_INITDIALOG
			push	hWnd
			pop	hExportDlg
			invoke	SendDlgItemMessage,hWnd,IDC_EDIT_EXPORT,EM_SETLIMITTEXT,0,0 
			invoke	_UnLoadFile,offset stMapFile
			invoke	_LoadIsPEFile,offset szFileName,offset stMapFile,hWnd
			invoke	_ShowExport,stMapFile.ImageBase,stMapFile.lpPEHeader,hWnd
			ret
		.else	
			mov	eax,FALSE
			ret
		.endif	
		mov	eax,TRUE
		ret
_ProcDlgExport	endp