Void ImPortD () {
DWORD dwDataStartRVA;//input table of RVA
PIMAGE_IMPORT_DESCRIPTOR pImportDesc;//a pointer to the input table
//IMAGE_DIRECTORY_ENTRY_IMPORT=1
DwDataStartRVA=ycOptionalHeader - & gt; DataDirectory [IMAGE_DIRECTORY_ENTRY_IMPORT] VirtualAddress;
if (! DwDataStartRVA)
return;
//RVA VA, pay attention to the VA is the PE file in this process space mapping of VA
PImportDesc=(PIMAGE_IMPORT_DESCRIPTOR) ImageRvaToVa (ycNTHeader ImageBase, dwDataStartRVA, NULL);
//analysis IID array members until members of 0

While (pImportDesc - & gt; FirstThunk) {//while (pImportDesc - & gt; OriginalFirstThunk
//the IID array members value:
PImportDesc - & gt; OriginalFirstThunk;//INT RVA
PImportDesc - & gt; TimeDateStamp;
PImportDesc - & gt; ForwarderChain;
PImportDesc - & gt; Name;//the Name RVA
PImportDesc - & gt; FirstThunk;//IAT RVA
PImportDesc++;//pointer + +, under the number 1 group
}//end while
//analysis a. DLL corresponding INT or members of the IAT array
CMemAddr char cOrd [30], [30], * FuncName;//function sequence number, address, function name
DWORD dwThunk;//OriginalFirstThunk or FirstThunk value
DWORD * pdwRVA=NULL;//OriginalFirstThunk or FirstThunk RVA pointer
DWORD * pdwThunk=NULL;//IMAGE_THUNK_DATA pointer
PIMAGE_IMPORT_BY_NAME pByName=NULL;//BY_NAME pointer
//get the first IID
PImportDesc=(PIMAGE_IMPORT_DESCRIPTOR) ImageRvaToVa (ycNTHeader ImageBase, dwDataStartRVA, NULL);
While (pImportDesc - & gt; FirstThunk) {//pImportDesc - & gt; OriginalFirstThun
//OriginalFirstThunk or FirstThunk 32-bit values
DwThunk=pImportDesc - & gt; OriginalFirstThunk;
//OriginalFirstThunk or FirstThunk RVA values
PdwRVA=(DWORD *) dwThunk;
//IMAGE_THUNK_DATA VA
PdwThunk=(DWORD *) ImageRvaToVa (ycNTHeader ImageBase, dwThunk, NULL);

if (! PdwThunk)
return;

While (* pdwThunk)//to INT or IAT array
{
If (HIWORD (* pdwThunk)==0 x8000) {//judgment ThunkValue highest value 0? 1
//printf (" serial number ");
}//is the serial number
The else {//function name is
//the next cycle processing function
+ + pdwRVA;//OriginalFirstThunk or FirstThunk RVA values + +
+ + pdwThunk;//IMAGE_THUNK_DATA pointer
}//end while
}
PImportDesc++;//cycle, 1. DLL import function
}//end while
Printf (" IID=% X \ n ", (int) pImportDesc - (int) ImageBase);
Printf (" name=% X \ n ", (char *) ImageRvaToVa (ycNTHeader ImageBase, pImportDesc - & gt; The Name, NULL));