通过符号文件获取函数地址_解析符号表获取函数地址

//通过符号文件获取函数地址
 
#include <windows.h>
#include <stdio.h>
#include <Dbghelp.h>
#include <tchar.h>
#include "ntdll.h"
#pragma comment(lib,"dbghelp.lib")
 
//注意：需要这两个文件
//dbghelp.dll	
//symsrv.dll
 
//获取函数地址PDB
ULONG_PTR GetFunctionAddressPDB(HMODULE hMod, const WCHAR * szApiName)
{
	//定义变量
	BYTE memory[0x2000] = {0};
 
	//参数效验
	if (hMod == NULL)return NULL;
	if (szApiName == NULL)return NULL;
 
 
	ZeroMemory(memory, sizeof(memory));
	SYMBOL_INFOW * syminfo = (SYMBOL_INFOW *)memory;
	syminfo->SizeOfStruct = sizeof(SYMBOL_INFOW);
	syminfo->MaxNameLen = MAX_SYM_NAME;
	syminfo->ModBase = (ULONG_PTR)hMod;
 
	if (!SymFromNameW(GetCurrentProcess(), szApiName, syminfo))
	{
		printf("SymFromName %ws returned error : %d\n", szApiName, GetLastError());
		return 0;
	}
 
	return (ULONG_PTR)syminfo->Address;
}
 
//符号获取函数地址
PVOID SymGetProcAddress(LPCWSTR szDllName, LPCWSTR szApiName)
{
	//变量定义
	TCHAR symbolPath[0x2000] = { 0 };
	TCHAR szPath[MAX_PATH] = { 0 };
 
	//参数效验
	if (szDllName == NULL)return NULL;
	if (szApiName == NULL)return NULL;
 
 
	GetModuleFileName(0, szPath, ARRAYSIZE(szPath));
	TCHAR * temp = _tcsrchr(szPath, TEXT('\\'));
	if (temp == NULL)return NULL;
	*temp = 0;
	_tcscat_s(symbolPath, TEXT("SRV*"));
	_tcscat_s(symbolPath, szPath);
	_tcscat_s(symbolPath, TEXT("*http://msdl.microsoft.com/download/symbols"));
	SymSetOptions(SYMOPT_UNDNAME | SYMOPT_DEFERRED_LOADS | SYMOPT_FAVOR_COMPRESSED);
	if (!SymInitializeW(GetCurrentProcess(), symbolPath, TRUE))
	{
		return NULL;
	}
 
	HMODULE hDll = GetModuleHandle(szDllName);
	PVOID lpRet = NULL;
	lpRet = (PVOID)GetFunctionAddressPDB(hDll, szApiName);
	SymCleanup(GetCurrentProcess());
 
	return lpRet;
}
 
 
 
 
int main(void)
{
 
	PVOID lpFuntAddressRet = NULL;
	if (GetModuleHandle(TEXT("kernelbase.dll")))
	{
		//高版本系统
		lpFuntAddressRet = SymGetProcAddress(TEXT("ntdll.dll"), TEXT("ZwReadVirtualMemory"));
		//lpRet = SymGetProcAddress(TEXT("ntdll.dll"), TEXT("RtlDispatchAPC"));
	}
	else
	{
		lpFuntAddressRet = SymGetProcAddress(TEXT("kernel32.dll"), TEXT("ZwReadVirtualMemory"));
		//lpRet = SymGetProcAddress(TEXT("kernel32.dll"), TEXT("BaseDispatchAPC"));
	}
	printf("%p", lpFuntAddressRet);
	return 0;
}