重建导入地址表 IAT 时 HMODULE 处理错误

Question

我遇到的问题是这样的：

badboy 代码行：

HMODULE handle = (HMODULE)pLoadLibraryA((LPCSTR)(codeBase + importDesc->Name));

这是一个很好的输出，但它错过了以下功能： (ijl11.dll & libcef.dll)

我试过了：

如果我让 HMODULE 处理“全局”，则输出良好但缺少两个 dll 的输出。

如果我将 HMODULE 句柄设置为“本地函数”，则输出良好但缺少两个 dll。

如果我将 HMODULE 句柄设置为“for 循环的本地”，则输出良好但缺少两个 dll。

---

badboy 代码行：

static HMODULE handle = (HMODULE)pLoadLibraryA((LPCSTR)(codeBase + importDesc->Name));

“静态”的输出为我提供了两个缺失的 dll 函数。

问题：为什么使用 static 会给我两个缺少的 dll 函数的输出？虽然使用非静态不会给我正确的输出。

另外，为什么同时使用这两种方式当然会得到我正在寻找的输出？

到目前为止我的结论： 手柄有问题。

但是使用 non-static 给了我很好的输出，而使用 static 给了我废话输出但给了我两个缺少的 dll 导入函数的输出。

我不明白。谁能解释一下？

代码：

// Custom Module Struct
typedef struct
{
    PIMAGE_NT_HEADERS NT_Headers;
    unsigned char *codeBase;
    HMODULE *modules;
    int numModules;
    int initialized;
} MEMORYMODULE, *PMEMORYMODULE;

    //HMODULE handle;
    int BuildImportTable(PMEMORYMODULE module)
    {
        int result = 1;
        //HMODULE handle;

        unsigned char *codeBase = module->codeBase;
        PIMAGE_DATA_DIRECTORY directory = GET_HEADER_DICTIONARY(module, IMAGE_DIRECTORY_ENTRY_IMPORT);

        printf("Directory Size: %d\n", directory->Size);
        if (directory->Size > 0)
        {
            PIMAGE_IMPORT_DESCRIPTOR importDesc = (PIMAGE_IMPORT_DESCRIPTOR)(codeBase + directory->VirtualAddress);

            // Check Each Import Descriptor
            for (; !pIsBadReadPtr(importDesc, sizeof(IMAGE_IMPORT_DESCRIPTOR)) && importDesc->Name; importDesc++) {

                // loop scope                   
                PIMAGE_THUNK_DATA thunkILT;
                PIMAGE_THUNK_DATA thunkIAT;

                // Load Each Library By Name
                printf("\n\n\n[BuildImportTable]: Trying To Load: %s\n", codeBase + importDesc->Name);
                static HMODULE handle = (HMODULE)pLoadLibraryA((LPCSTR)(codeBase + importDesc->Name));
                if (handle != NULL){
                    printf("[BuildImportTable]: Loaded: %s\n", codeBase + importDesc->Name);
                }

                if (handle == INVALID_HANDLE_VALUE) {
                    result = 0;
                    printf("[BuildImportTable]: Handle NULL\n");
                    break;
                }

                //// Build Out Module Structure Members
                //HMODULE *p = (HMODULE*)MemRealloc( module->modules, (module->numModules + 1) * ( sizeof(HMODULE) ) );
                //module->modules = p;
                //if (module->modules == NULL) {
                //  result = 0;
                //  printf("[BuildImportTable]: Modules NULL\n");
                //  break;
                //}

                //// Store Allocated Library
                //module->modules[module->numModules++] = handle; // Load Library Handle

                // OriginalFirstThunk - Names are stored in ILT.            
                if ( importDesc->OriginalFirstThunk ) {             

                    // Get RVA of the Import Lookup Table (ILT)
                    thunkILT = (PIMAGE_THUNK_DATA)(importDesc->OriginalFirstThunk);
                    if (thunkILT == NULL) { printf("[BuildImportTable]: thunkILT RVA NULL\n"); continue;  }

                    // Get VA to (ILT)
                    thunkILT = (PIMAGE_THUNK_DATA)( codeBase + importDesc->OriginalFirstThunk);
                    if (thunkILT == NULL) { printf("[BuildImportTable]: codeBase + thunkILT RVA NULL\n"); continue; }

                    // Offset Linear Address to get valid data
                    //thunkILT = (PIMAGE_THUNK_DATA)rvaToPtr( (DWORD)thunkILT, module->NT_Headers, (DWORD)codeBase );               
                } 

                // FirstThunk - ( i.e., the array of linear addresses built by the loader ).
                if (importDesc->FirstThunk){

                    // The RVA of the Import Address Table (IAT) 
                    thunkIAT = (PIMAGE_THUNK_DATA)(importDesc->FirstThunk);
                    if (thunkIAT == NULL) { printf("[BuildImportTable]: thunkIAT RVA NULL\n"); continue; }

                    // Get VA to (IAT).
                    thunkIAT = (PIMAGE_THUNK_DATA)(codeBase + importDesc->FirstThunk);
                    if (thunkIAT == NULL) { printf("[BuildImportTable]: codeBase + thunkIAT RVA NULL\n"); continue; }
                }

                while( (thunkILT->u1.AddressOfData != 0) || thunkILT->u1.Ordinal != 0 )
                {
                    if ( IMAGE_SNAP_BY_ORDINAL(thunkILT->u1.Ordinal) ) {

                        // BY ORDINAL
                        printf("[BuildImportTable]: OLD thunkIAT->Function: 0x%08X\n", thunkIAT->u1.Function);
                        /*HMODULE hModule = GetModuleHandle((LPCSTR)(codeBase + importDesc->Name));
                        if (hModule != NULL){*/
                            thunkIAT->u1.Function = (DWORD)pGetProcAddress(handle, (LPCSTR)IMAGE_ORDINAL(thunkILT->u1.Ordinal));
                            if (thunkIAT->u1.Function == NULL){ 
                                printf("[BuildImportTable]: Procedure Not Found By Ordinal\n");
                                printf("[BuildImportTable]: HMODULE: 0x%08X ERROR: %d\n", handle, GetLastError());
                                thunkILT++; 
                                break; 
                            }
                            printf("[BuildImportTable]: NEW thunkIAT->Function: 0x%08X\n", thunkIAT->u1.Function);
                            printf("[BuildImportTable]: Ordinal: 0x%08X\n", thunkILT->u1.Ordinal);
                            thunkILT++;
                        //}
                        //else{ 
                        //  printf("[BuildImportTable]: HMODULE: 0x%08X ERROR: %d\n", hModule, GetLastError());
                        //  thunkILT++;  break; }

                    } else {

                        // if statement scope
                        PIMAGE_IMPORT_BY_NAME NameData;
                        NameData = (PIMAGE_IMPORT_BY_NAME)( thunkILT->u1.AddressOfData );
                        if (NameData == NULL) { printf("[BuildImportTable]: NameData RVA NULL\n"); break; }
                        NameData = (PIMAGE_IMPORT_BY_NAME)( codeBase + thunkILT->u1.AddressOfData );
                        if (NameData == NULL) { printf("[BuildImportTable]: codeBase + NameData RVA NULL\n"); break; }

                        // BY NAME
                        printf("[BuildImportTable]: OLD thunkIAT->Function: 0x%08X\n", thunkIAT->u1.Function);
                        thunkIAT->u1.Function = (DWORD)pGetProcAddress(handle, NameData->Name);
                        if (thunkIAT->u1.Function == NULL){ printf("[BuildImportTable]: Procedure Not Found By Name\n"); break; }
                        printf("[BuildImportTable]: NEW thunkIAT->Function: 0x%08X\n", thunkIAT->u1.Function);
                        printf("[BuildImportTable]: ThunkData->Name: %s\n", NameData->Name);
                        thunkILT++;                 
                    }

                    // CHECK NEW IAT
                    if ( thunkIAT == 0 ) {
                        result = 0;
                        printf("[BuildImportTable]: NEW IAT NULL\n");
                        break;
                    }

                    // Increment
                    thunkIAT++;

                } // End of Thunk Loop

            } // End of for Loop
        } // Director Size

        _getch();
        return result;
    }

Answer 1

（答案）：

我通过确保 loadlibrary 具有正确的模块位置解决了上述问题。通过这样做，给了我每个模块的正确句柄。

我使用了 procmon 并过滤了应用程序，并在 CreateFile() 上放置了一个过滤器，显示加载库正在搜索模块的区域。该模块不在任何列出的位置内。

因此，我将从这里开始提供 loadlibrary 完整路径以阻止上述问题。

感谢您过来阅读我的问题。认为它解决了:)