通过符号表找到系统未导出及函数地址源码.docVIP

通过符号表找到系统未导出的函数地址源码作 者: FlyToTheSpace时 间: 2007-12-09,19:24链 接: /showthread.php?t=56284说明：第一步设置符号表路径．比如　E:\WINDOWS\system32\Symbols\第二步指定系统动态库，比如user32.dll第三步指定系统库函数名比如ValidateHwnd.如果调用成功的话，返回值就为未导出的库函数地址．例外说明．使用ollydbg设置好了符号表路径，好像是没有效果．只有把符号文件放到系统目录\system32\symbols\里面才能加载．class ProcedureAddrRetrieve{public:ProcedureAddrRetrieve(TCHAR *PdbSearchPath,DWORD _Options = NULL);~ProcedureAddrRetrieve();BOOL LoadSymbol(TCHAR *DllName);BOOL EnumSymbol(TCHAR *pSearchMask = NULL);DWORD64 RetrieveAddr(TCHAR *_szProcedureName);protected:private:BOOL GetFileSize( const TCHAR* pFileName, DWORD FileSize );static BOOL CALLBACK EnumSymbolsCallback( SYMBOL_INFO* pSymInfo, ULONG SymbolSize, PVOID UserContext );DWORD64 ModBase64;char szProcedureName[MAX_PATH];DWORD64 Address;};void test();#include windows.h#include tchar.h#include io.h#include stdio.h#include dbghelp.h#include stdio.h#include lib.h#pragma comment( lib, dbghelp.lib )void test(){ProcedureAddrRetrieve par(E:\\WINDOWS\\system32\\Symbols\\);par.LoadSymbol(User32.dll);par.RetrieveAddr(ValidateHwnd);}ProcedureAddrRetrieve::ProcedureAddrRetrieve(TCHAR *PdbSearchPath,DWORD _Options ){BOOL bRet = FALSE; ZeroMemory(this,sizeof(ProcedureAddrRetrieve));// Set options DWORD Options = SymGetOptions(); // SYMOPT_DEBUG option asks DbgHelp to print additional troubleshooting // messages to debug output - use the debuggers Debug Output window // to view the messages Options =Options | SYMOPT_DEBUG | _Options/*|SYMOPT_ALLOW_ABSOLUTE_SYMBOLS*/; SymSetOptions( Options );// Initialize DbgHelp and load symbols for all modules of the current process bRet = SymInitialize ( ??? GetCurrentProcess(), // Process handle of the current process ??? PdbSearchPath,???????????????? // user-defined search path - use default ??? FALSE???????????????? // Do not load symbols for modules in the current process ??? ); if( !bRet ) {??? _tprintf(_T(Error: SymInitialize() failed. Error code: %u