2021-09-23导出表ordinal寻址

逆向工程核心原理书上的使用序号寻找导出函数的地址具有误导性
其实很简单，就是用你要查询的序号-Base，得到地址数组的索引，再获得地址
我自己用c语言实现了GetProcAddress的序号寻址代码贴在下面

#include 
#include 
#include 
#define DLL_NAME _T("kernel32.dll")
#define PROC_NAME _T("AcquireSRWLockExclusive")
FARPROC WINAPI GetMyProcAddress(_In_ HMODULE hModule, _In_ LPCSTR lpProcName);

int _tmain()
{
    HMODULE hDll = GetModuleHandle(DLL_NAME);
    //FARPROC procAddress = GetMyProcAddress(hDll,(LPCSTR)1);
    FARPROC procAddress = GetProcAddress(hDll, (LPCSTR)1);
    return NULL;
}

FARPROC WINAPI GetMyProcAddress(_In_ HMODULE hModule, _In_ LPCSTR lpProcName) {
    PIMAGE_DOS_HEADER dos = NULL;
    PIMAGE_NT_HEADERS nt = NULL;
    PIMAGE_EXPORT_DIRECTORY export_dir = NULL;
    dos = (PIMAGE_DOS_HEADER)hModule;
    nt = (PIMAGE_NT_HEADERS)((DWORD)dos->e_lfanew + (DWORD)dos);
    export_dir = (PIMAGE_EXPORT_DIRECTORY)(nt->OptionalHeader.DataDirectory[0].VirtualAddress + (DWORD)dos);
    DWORD dwBase = export_dir->Base;
    DWORD *pAddressOfFunction = (DWORD *)(export_dir->AddressOfFunctions+(DWORD)hModule);
    DWORD dwName = (DWORD)lpProcName;
    if (dwName &0xFFFF0000 != 0) {
        //当以函数名来寻址
    }
    
    if(dwName< dwBase || (dwName- dwBase)+1>export_dir->NumberOfFunctions)
        return NULL;
    return (FARPROC)(pAddressOfFunction[dwName - dwBase]+(DWORD)hModule);

    return NULL;
}