#include <stdio.h>
#include <windows.h>
 
int main(int argc, char *argv[]){
	if(argc != 2){
		printf("Pasale un parametro !");
		return EXIT_FAILURE;
	}
	HANDLE fichero = CreateFile((LPCTSTR)argv[1], GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
	if(fichero == INVALID_HANDLE_VALUE){
		printf("Error abriendo el fichero");
		return EXIT_FAILURE;
	}
	printf("IAT de %s\n", argv[1]);
	DWORD size = GetFileSize(fichero, NULL);
	byte *buf = (byte *)malloc(size);
	DWORD bytesleidos;
	ReadFile(fichero, buf, size, &bytesleidos, NULL);
	if(size == bytesleidos){
		PIMAGE_DOS_HEADER pIDH = (PIMAGE_DOS_HEADER)buf;
		if(pIDH->e_magic == IMAGE_DOS_SIGNATURE){ //MZ
	        PIMAGE_NT_HEADERS pINH = (PIMAGE_NT_HEADERS)&buf[pIDH->e_lfanew];
			unsigned long ITdir = pINH->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
			PIMAGE_SECTION_HEADER pISH;
			for(int i = 0; i < pINH->FileHeader.NumberOfSections; i++){
				pISH = (PIMAGE_SECTION_HEADER)&buf[pIDH->e_lfanew + sizeof(IMAGE_NT_HEADERS) + i*sizeof(IMAGE_SECTION_HEADER)];
				if(pISH->VirtualAddress <= ITdir && pISH->VirtualAddress + pISH->SizeOfRawData > ITdir){
					printf("Tabla IAT encontrada en sección: %s\n", pISH->Name);
					break;
				}
			}
			if(i != pINH->FileHeader.NumberOfSections){
				printf("Inicio FisicalAddress de la IAT: 0x%08X\n", pISH->PointerToRawData + ITdir - pISH->VirtualAddress);
				printf("Inicio VirtualAddress de la IAT: 0x%08X\n", pINH->OptionalHeader.ImageBase + ITdir);
				PIMAGE_IMPORT_DESCRIPTOR pIID = (PIMAGE_IMPORT_DESCRIPTOR)&buf[ITdir - pISH->VirtualAddress + pISH->PointerToRawData];
				while(pIID->Characteristics != 0){
					printf("%s:\n", &buf[pIID->Name - pISH->VirtualAddress + pISH->PointerToRawData]);
					PIMAGE_THUNK_DATA pITD = (PIMAGE_THUNK_DATA)&buf[pIID->OriginalFirstThunk - pISH->VirtualAddress + pISH->PointerToRawData];
					while(pITD->u1.AddressOfData != NULL){
						PIMAGE_IMPORT_BY_NAME pIIBN = (PIMAGE_IMPORT_BY_NAME)&buf[(unsigned long)pITD->u1.AddressOfData - pISH->VirtualAddress + pISH->PointerToRawData];
						printf("  %s\n", pIIBN->Name);
						pITD++;
					}
					pIID++;
				}
			}
		}
	}
	free(buf);
	CloseHandle(fichero);
	return EXIT_SUCCESS;
}

					while(pITD->u1.AddressOfData != NULL){
						if((DWORD)pITD->u1.AddressOfData & 0x80000000)
							printf("  Ord: %d\n", (DWORD)pITD->u1.AddressOfData & 0x7FFFFFFF);
						else{
							PIMAGE_IMPORT_BY_NAME pIIBN = (PIMAGE_IMPORT_BY_NAME)&buf[(DWORD)pITD->u1.AddressOfData - pISH->VirtualAddress + pISH->PointerToRawData];
							printf("  %s\n", pIIBN->Name);
						}
						pITD++;
					}