[Help]Externally listing functions in the IAT.

Sup, so I wanted to list the functions in the IAT of another process without having to inject a module into it so I decided to do this. |:

Anyway, it's extremely messy and probably inefficient, I had to use ReadProcessMemory quite a bit to achieve what I wanted, anyways, it works...

Here ya' go, I tested it using calculator, as you can see.

[highlight=cpp]
#include <windows.h>
#include <iostream>
#include <tlhelp32.h>

using namespace std;

void DisplayIAT(unsigned long processid)
{
PROCESSENTRY32 ProcEnt;
ProcEnt.dwSize = sizeof( PROCESSENTRY32 );

HANDLE Snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPALL,0);


Process32First(Snapshot,&ProcEnt);

do {
if(ProcEnt.th32ProcessID == processid)
{
break;
}
}while(Process32Next(Snapshot,&ProcEnt));

MODULEENTRY32 ModEnt;
ModEnt.dwSize = sizeof( MODULEENTRY32 );

HMODULE hMod;
HANDLE Snapshot1 = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,ProcEnt .th32ProcessID);

Module32First(Snapshot1,&ModEnt);
do {
if( strcmp(ProcEnt.szExeFile,ModEnt.szModule) == 0 )
{
hMod = ModEnt.hModule;
break;
}
}while(Module32Next(Snapshot1,&ModEnt));

cout << hex << (int)hMod << endl;
cout << ModEnt.szModule << endl;

HANDLE handle = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_READ,0,ProcEnt.th32ProcessID);

unsigned char* temp;

//DOS
IMAGE_DOS_HEADER* pDos;
temp = new unsigned char[sizeof(IMAGE_DOS_HEADER)];
ReadProcessMemory(handle,(LPVOID)hMod,(LPVOID)temp ,sizeof(IMAGE_DOS_HEADER),0);
pDos = (IMAGE_DOS_HEADER*)temp;
temp = 0;

//HEADER
IMAGE_OPTIONAL_HEADER* pHeader;
temp = new unsigned char[sizeof(IMAGE_OPTIONAL_HEADER)];
ReadProcessMemory(handle,(LPVOID)( (BYTE*)hMod + pDos->e_lfanew + 24 ),(LPVOID)temp,sizeof(IMAGE_OPTIONAL_HEADER),0);
pHeader = (IMAGE_OPTIONAL_HEADER*)temp;
temp = 0;

//DESCRIPTOR
IMAGE_IMPORT_DESCRIPTOR* pDescriptor;
temp = new unsigned char[sizeof(IMAGE_IMPORT_DESCRIPTOR)];
ReadProcessMemory(handle,(LPVOID)( (BYTE*)hMod + pHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress ),(LPVOID)temp,sizeof(IMAGE_IMPORT_DESCRIPTOR),0);
pDescriptor = (IMAGE_IMPORT_DESCRIPTOR*)temp;
temp = 0;

int i = 0;
while( pDescriptor->FirstThunk )
{
IMAGE_THUNK_DATA* pThunk;
temp = new unsigned char[sizeof(IMAGE_THUNK_DATA)];
ReadProcessMemory(handle,(LPVOID)( (BYTE*)hMod + pDescriptor->OriginalFirstThunk ),(LPVOID)temp,sizeof(IMAGE_THUNK_DATA),0);
pThunk = (IMAGE_THUNK_DATA*)temp;
temp = 0;

i+= sizeof(IMAGE_IMPORT_DESCRIPTOR);

char modName[24];
ReadProcessMemory(handle,(LPVOID)( (BYTE*)hMod + pDescriptor->Name ),modName,24,0);
cout << "\n\n" << modName << "\n\n" << endl;

int n = 0;
while(pThunk->u1.Function)
{
n+=4;

char funcName[100];
ReadProcessMemory(handle,(LPVOID)( (BYTE*)hMod + (DWORD)pThunk->u1.AddressOfData + 2 ),funcName,100,0);

temp = new unsigned char[sizeof(IMAGE_THUNK_DATA)];
ReadProcessMemory(handle,(LPVOID)( (BYTE*)hMod + pDescriptor->OriginalFirstThunk + n ),(LPVOID)temp,sizeof(IMAGE_THUNK_DATA),0);
pThunk = (IMAGE_THUNK_DATA*)temp;
temp = 0;

cout << funcName << endl;
}

temp = new unsigned char[sizeof(IMAGE_IMPORT_DESCRIPTOR)];
ReadProcessMemory(handle,(LPVOID)( (BYTE*)hMod + pHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress + i),(LPVOID)temp,sizeof(IMAGE_IMPORT_DESCRIPTOR),0) ;
pDescriptor = (IMAGE_IMPORT_DESCRIPTOR*)temp;
temp = 0;
}

}

int main()
{
DWORD pid;
HWND hwnd = FindWindow(0,"Calculator");
GetWindowThreadProcessId(hwnd,&pid);
DisplayIAT(pid);

cin.get();
}
[/highlight]

Yep.

▓▓▓▓▓▓▓▓▓▓
▓▓▓ -__- ▓▓▓
▓▓▓▓▓▓▓▓▓▓

Huh?

I didn't know that the pe structure was loaded into memory...
Strange...