Displaying the IAT list from within a injected dll

#include"stdafx.h"

#include<stdio.h>

#include<windows.h>

#include<Dbghelp.h>

#include<fstream>

std::ofstream myfile;

#pragmacomment(lib,"Dbghelp.lib")

//#include <win_adapter.h>

void GetIAT();

void handle_imports(BYTE* image_base, PIMAGE_IMPORT_DESCRIPTOR imp_desc);

 

HANDLE Console;

DWORD Written;

char ConsoleBuffer[64];

BOOL APIENTRY DllMain( HMODULE hModule,

DWORD ul_reason_for_call,

LPVOID lpReserved

)

{

switch (ul_reason_for_call)

{

case DLL_PROCESS_ATTACH:

GetIAT();

case DLL_THREAD_ATTACH:

case DLL_THREAD_DETACH:

case DLL_PROCESS_DETACH:

break;

}

return TRUE;

}

void GetIAT()

{

AllocConsole();

BYTE* image_base = (BYTE*)GetModuleHandleA(NULL);

//printf("image_base: %p\n", image_base);


myfile.open("c:\\users\\Anddos\\Desktop\\iat-dll.txt");

if(!myfile.is_open())

{

MessageBox(NULL,"Failed to Make File","",0);

}

else

{

MessageBox(NULL,"Created File","",0);

}

 

Console = GetStdHandle(STD_OUTPUT_HANDLE);

sprintf(ConsoleBuffer,"%p\n",image_base);

WriteConsole(Console,ConsoleBuffer,strlen(ConsoleBuffer),&Written,0);

// MessageBox(NULL,"GetAIT","",0);

PIMAGE_DOS_HEADER dos_header = (PIMAGE_DOS_HEADER)image_base;

PIMAGE_NT_HEADERS nt_header = (PIMAGE_NT_HEADERS)(image_base + dos_header->e_lfanew);

PIMAGE_IMPORT_DESCRIPTOR imp_desc = (PIMAGE_IMPORT_DESCRIPTOR)(

image_base + nt_header->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);

handle_imports(image_base, imp_desc);

 

 

}

void handle_imports(BYTE* image_base, PIMAGE_IMPORT_DESCRIPTOR imp_desc)

{

if (!imp_desc)

return;

//printf("imports:\n");

sprintf(ConsoleBuffer,"%s\n","imports:");

// WriteConsole(Console,ConsoleBuffer,strlen(ConsoleBuffer),&Written,0);

//sprintf(OutBuffer,"%s %d %s %d\n","NumVertices",NumVertices,"primCount",primCount);

myfile << ConsoleBuffer;

 

// looping over all imported dlls

// The last directory entry is empty (filled with null values)

for (int i = 0; imp_desc[i].Characteristics != 0; i++)

{

//printf(" * %s\n", (char*)(image_base + imp_desc[i].Name));

Sleep(500);

sprintf(ConsoleBuffer," * %s\n", (char*)(image_base + imp_desc[i].Name));

// WriteConsole(Console,ConsoleBuffer,strlen(ConsoleBuffer),&Written,0);

myfile << ConsoleBuffer;

PIMAGE_THUNK_DATA orig_first_thunk = (PIMAGE_THUNK_DATA)(image_base + imp_desc[i].OriginalFirstThunk);

PIMAGE_THUNK_DATA first_thunk = (PIMAGE_THUNK_DATA)(image_base + imp_desc[i].FirstThunk);

// looping ovetr all imported functions

// The last entry is set to zero (NULL) to indicate the end of the table

for (int j = 0; orig_first_thunk[j].u1.Function != 0; j++)

{

PIMAGE_IMPORT_BY_NAME orig_imports_by_name = (PIMAGE_IMPORT_BY_NAME)(

image_base + orig_first_thunk[j].u1.AddressOfData);

//printf("\t%s (%08x)\n", (char*)orig_imports_by_name->Name, first_thunk[j].u1.Function);

sprintf(ConsoleBuffer,"\t%s (%08x)\n", (char*)orig_imports_by_name->Name, first_thunk[j].u1.Function);

//WriteConsole(Console,ConsoleBuffer,strlen(ConsoleBuffer),&Written,0);

myfile << ConsoleBuffer;

}

}

}