c++ - 地址的奇怪错误

Question

我有几个问题要解决，请帮忙!
我的第一个问题是 表达式必须是指向完整对象类型的指针 但我通过添加 解决了这个问题& 在变量之前，我做对了吗？
下面的代码片段。

    LPVOID dll;
    PIMAGE_DOS_HEADER dos;
    dll = LoadLibraryA(a[1]);
    dos = (PIMAGE_DOS_HEADER)dll;
    nt = (PIMAGE_NT_HEADERS)(&dll+dos->e_lfanew);

下一个问题是我的程序输出总是不同的，为什么？
我的程序应该向我显示所有地址和函数名称，代码如下。

#include<stdio.h>
#include<windows.h>
#include<winternl.h>


int main(int i, char* a[]) {
    LPVOID dll, faddr;
    PIMAGE_DOS_HEADER dos;
    PIMAGE_NT_HEADERS nt;
    PIMAGE_EXPORT_DIRECTORY exp;

    PWORD f_addr_list, f_name_list;
    PWORD f_ord_list;
    DWORD rva;
    LPSTR fname;


    if (i != 2) {
        printf("error");
        return 0;
    }

    dll = LoadLibraryA(a[1]);
    if (dll == NULL) {
        printf("failed to load");
        return 0;
    }

    dos = (PIMAGE_DOS_HEADER)dll;
    nt = (PIMAGE_NT_HEADERS)(dll+dos->e_lfanew);
    exp = (PIMAGE_EXPORT_DIRECTORY)(&dll + nt->OptionalHeader.DataDirectory[0].VirtualAddress);

    f_addr_list = (PDWORD)(&dll + exp->AddressOfFunctions);
    f_name_list = (PDWORD)(&dll + exp->AddressOfNames);
    f_ord_list = (PWORD)(&dll + exp->AddressOfNameOrdinals);
    
    printf("Total function names: %ld\nTotal Function: %ld\n", exp->NumberOfNames, exp->NumberOfFunctions);
    printf("Address\t\t\t\t\Function Name\n");
    printf("-------\t\t\t\t\t----------\n");

    for (i = 0; i < exp->NumberOfNames; i++)
    {
        fname = (LPSTR)dll + f_name_list[i];
        rva = f_ord_list[i];
        faddr = &dll + f_addr_list[rva];
        printf("%p\t\t\t\t%s\n", faddr, fname);


    }

    FreeLibrary(dll);
    return 0;

}

示例输出:

C:\Users\user\Project2\Debug>Project2.exe user32.dll
Total function names: 2
Total Function: 11914128
Address                         Function Name
-------                                 ----------

C:\Users\user\Project2\Debug>Project2.exe user32.dll
Total function names: 2
Total Function: 11914128
Address                         Function Name
-------                                 ----------

C:\Users\user\Project2\Debug>Project2.exe user32.dll
Total function names: 22826784
Total Function: 2
Address                         Function Name
-------                                 ----------

里面有什么问题？

Answer 1

在WIN OS下模块句柄是库的基地址 加载到内存中。
添加 &地址前不解决问题 ，但会创建一个更大的间接寻址，从而导致内存违规(现在您使用变量的地址 dll 作为模块基地址)。
您不能对 void 指针进行数学运算，因为 void没有阻止正确位移计算的尺寸。将你的基指针设为 BYTE指针，而不是给出 1 的基本大小。
您尝试做的工作代码是:

#include<stdio.h>
#include<windows.h>
#include<winternl.h>

int main(int i, char *a[])
{
    LPVOID faddr;
    BYTE *dll;
    PIMAGE_DOS_HEADER dos;
    PIMAGE_NT_HEADERS nt;
    PIMAGE_EXPORT_DIRECTORY exp;

    PDWORD f_addr_list, f_name_list;
    PWORD f_ord_list;
    DWORD rva;
    LPSTR fname;

    if (i != 2)
    {
        printf("error\n");
        return 0;
    }

    dll = (BYTE *)LoadLibraryA(a[1]);
    if (dll == NULL)
    {
        printf("failed to load\n");
        return 0;
    }

    dos = (PIMAGE_DOS_HEADER)dll;
    nt  = (PIMAGE_NT_HEADERS) (dll + dos->e_lfanew);
    exp = (PIMAGE_EXPORT_DIRECTORY) (dll + nt->OptionalHeader.DataDirectory[0].VirtualAddress);

    f_addr_list = (PDWORD) (dll + exp->AddressOfFunctions);
    f_name_list = (PDWORD) (dll + exp->AddressOfNames);
    f_ord_list  = (PWORD) (dll + exp->AddressOfNameOrdinals);

    printf("Total function names: %ld\nTotal Function: %ld\n", exp->NumberOfNames, exp->NumberOfFunctions);
    printf("Address\t\t\t\tFunction Name\n");
    printf("-------\t\t\t\t\t----------\n");

    for (i = 0; i < exp->NumberOfNames; i++)
    {
        fname = (LPSTR)(dll + f_name_list[i]);
        rva   = f_ord_list[i];
        faddr = dll + f_addr_list[rva];
        printf("%p\t\t\t\t%s\n", faddr, fname);
    }

    FreeLibrary((LPVOID)dll);
    return 0;

}