FunctionList.InsertColumn(1,L"模块名",LVCFMT_LEFT,150);
FunctionList.InsertColumn(2,L"函数名",LVCFMT_LEFT,150);
FunctionList.InsertColumn(3,L"函数地址",LVCFMT_LEFT,150);
HMODULE hMod;
//hMod = GetModuleHandle(str.pszProcessName);
hMod= GetModuleHandle(NULL);
IMAGE_DOS_HEADER *pDosHeader =(IMAGE_DOS_HEADER*)hMod;
IMAGE_OPTIONAL_HEADER *pOptHeader = (IMAGE_OPTIONAL_HEADER *)((BYTE*) hMod+pDosHeader->e_lfanew+24);
IMAGE_IMPORT_DESCRIPTOR * pImportDesc = (IMAGE_IMPORT_DESCRIPTOR *)((BYTE*)hMod+pOptHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
int nItemNum = 0;
nItemNum = FunctionList.GetItemCount();
CString funcId;
while(pImportDesc->FirstThunk){
char* pszDllName = (char*)((BYTE*)hMod+pImportDesc->Name);
//一个IMAGE_THUNK_DATA 就是一个双字，它指定了一个导入函数
IMAGE_THUNK_DATA *pThunk=(IMAGE_THUNK_DATA*)((BYTE*)hMod+pImportDesc->OriginalFirstThunk);
int n = 0;
while(pThunk->u1.Function){
//取得函数名称。hint/name 表向前2个字节是函数序号，后面才是函数名字字符串
char* pszFunName =(char*)((BYTE*)hMod+(DWORD)pThunk->u1.AddressOfData+2);
//获取函数地址。IAT表就是一个DWORD类型的数组，每个成员记录一个函数的地址
PDWORD lpAddr =(DWORD*)((BYTE*)hMod+pImportDesc->FirstThunk)+n;
CString dallName(pszDllName);
CString funcName(pszFunName);
funcId.Format(L"%ld",lpAddr);
FunctionList.InsertItem(nItemNum,L"APIMonitor.exe");
FunctionList.SetItemText(nItemNum,1,dallName);
FunctionList.SetItemText(nItemNum,2,funcName);
FunctionList.SetItemText(nItemNum,3,funcId);
n++;
pThunk++;
}
pImportDesc++;
}
希望读取函数的名字，发生错误。
APIMonitor.exe 中的 0x758ae0db 处有未经处理的异常: 0xC0000005: 读取位置 0x80960014 时发生访问冲突
输出的类容：
“APIMonitor.exe”: 已加载“C:\Users\huoping\Documents\Visual Studio 2010\Projects\APIMonitor\Debug\APIMonitor.exe”，已加载符号。
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\ntdll.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\kernel32.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\KernelBase.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\user32.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\gdi32.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\lpk.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\usp10.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\msvcrt.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\advapi32.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\sechost.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\rpcrt4.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\sspicli.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\cryptbase.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\msimg32.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\comdlg32.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\shlwapi.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\shell32.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\winspool.drv”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\ole32.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\oleaut32.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\oledlg.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\GdiPlus.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\oleacc.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\imm32.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\msctf.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\winmm.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\uxtheme.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\dwmapi.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Program Files (x86)\kingsoft\kingsoft antivirus\kwsui.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\psapi.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\version.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“D:\金山卫士\KSafe\ksfmon.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\ws2_32.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\nsi.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Program Files (x86)\McAfee\SiteAdvisor\sahook.dll”，Cannot find or open the PDB file
线程 'Win32 线程' (0xa368) 已退出，返回值为 0 (0x0)。
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\cryptsp.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\rsaenh.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\RpcRtRemote.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\clbcatq.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\ExplorerFrame.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\duser.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\dui70.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\propsys.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Program Files (x86)\Common Files\PPLiveNetwork\kernel\VAProxyD.dll”，Cannot find or open the PDB file
“APIMonitor.exe”: 已加载“C:\Windows\SysWOW64\msvcp60.dll”，Cannot find or open the PDB file
Warning: no message line prompt for ID 0x0000.
Warning: no message line prompt for ID 0x8003.
Warning: no message line prompt for ID 0x8003.
Warning: no message line prompt for ID 0x8003.
Warning: no message line prompt for ID 0x8003.
APIMonitor.exe 中的 0x758ae0db 处最可能的异常: 0xC0000005: 读取位置 0x80960014 时发生访问冲突
APIMonitor.exe 中的 0x758ae0db 处有未经处理的异常: 0xC0000005: 读取位置 0x80960014 时发生访问冲突
