return (LPVOID) (e32rp? (e32rp->e32_vbase + e32rp->e32_entryrva) : 0);两个值相加就是程序入口的虚拟地址了。
}
TOCentry的结构如下:
typedef struct TOCentry { // MODULE BIB section structure
DWORD dwFileAttributes;
FILETIME ftTime;
DWORD nFileSize;
LPSTR lpszFileName;
ULONG ulE32Offset; // Offset to E32 structure 这个指向E32的结构指针。
ULONG ulO32Offset; // Offset to O32 structure
ULONG ulLoadOffset; // MODULE load buffer offset
} TOCentry, *LPTOCentry
e32_rom的结构如下:
typedef struct e32_rom {
unsigned short e32_objcnt; /* Number of memory objects */
unsigned short e32_imageflags; /* Image flags */
unsigned long e32_entryrva; /* Relative virt. addr. of entry point */这个是程序入口点的相对虚拟地址
unsigned long e32_vbase; /* Virtual base address of module */这个是程序加载的虚拟地址
unsigned short e32_subsysmajor;/* The subsystem major version number */
unsigned short e32_subsysminor;/* The subsystem minor version number */
unsigned long e32_stackmax; /* Maximum stack size */
unsigned long e32_vsize; /* Virtual size of the entire image */
unsigned long e32_sect14rva; /* section 14 rva */
unsigned long e32_sect14size; /* section 14 size */
unsigned long e32_timestamp; /* Time EXE/DLL was created/modified */
struct info e32_unit[ROM_EXTRA]; /* Array of extra info units */
unsigned short e32_subsys; /* The subsystem type */
} e32_rom
e32_unit这个值,不太清楚是不是程序导出表的相对地址。如果是的话就可以通过e32_vbase和它这两个值查找kernell内的函数。找到想要的函数地址再把它映射过来,应该就能调用了。