private void LoadExports()
        {
            // TODO: Unnamed exports (detect exports with only an ordinal).

            string        libraryname   = header.assembly.path.Substring(header.assembly.path.LastIndexOf('\\') + 1);
            DataDirectory exportdatadir = header.OptionalHeader.DataDirectories[(int)DataDirectoryName.Export];

            if (exportdatadir.targetOffset.FileOffset == 0)
            {
                return;
            }

            image.SetOffset(exportdatadir.TargetOffset.FileOffset);

            exportDirectory = image.ReadStructure <Structures.IMAGE_EXPORT_DIRECTORY>();

            OffsetConverter offsetConverter           = new OffsetConverter(exportdatadir.Section);
            uint            functionoffset            = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfFunctions);
            uint            functionnameoffset        = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfNames);
            uint            functionnameordinaloffset = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfNameOrdinals);

            for (uint i = 0; i < exportDirectory.NumberOfFunctions; i++)
            {
                image.SetOffset(functionoffset);
                uint functionRVA = image.Reader.ReadUInt32();
                image.SetOffset(functionnameoffset);
                uint functionNameRVA = image.Reader.ReadUInt32();
                image.SetOffset(functionnameordinaloffset);
                uint functionNameOrdinal = image.Reader.ReadUInt32();

                string name = image.ReadZeroTerminatedString(offsetConverter.RvaToFileOffset(functionNameRVA));

                exports.Add(new ExportMethod(libraryname, name, functionNameRVA, functionRVA, (ushort)(i + exportDirectory.Base)));

                functionoffset            += 4;
                functionnameoffset        += 4;
                functionnameordinaloffset += 4;
            }
        }
Beispiel #2
0
        public void LoadData()
        {
            if (ntHeader.IsManagedAssembly)
            {
                image.Stream.Seek(ntHeader.OptionalHeader.DataDirectories[(int)DataDirectoryName.Clr]._targetOffset.FileOffset, SeekOrigin.Begin);

                parent._rawOffset = (uint)image.Position;
                parent._rawHeader = image.ReadStructure <Structures.IMAGE_COR20_HEADER>();

                Section targetsection = Section.GetSectionByFileOffset(ntHeader.Sections, parent._rawOffset);
                offsetConverter = new OffsetConverter(targetsection);

                LoadDirectories();
            }
        }
        internal void LoadData(bool ignoreHeaderNumbers)
        {
            CheckDosHeader();

            dosHeader = image.ReadStructure <Structures.IMAGE_DOS_HEADER>();

            ntheaderoffset = image.Stream.Position;

            image.Stream.Seek(dosHeader.e_lfanew, SeekOrigin.Begin);

            ntHeadersSignature = image.Reader.ReadUInt32();

            ReadFileHeader();
            ReadOptionalHeader();


            Dictionary <uint, Structures.IMAGE_DATA_DIRECTORY> rawdatadirs = ConstructDataDirectories(ignoreHeaderNumbers);

            ReadSections();

            CompleteDataDirectories(rawdatadirs);
        }