Beispiel #1
0
        /// <inheritdoc />
        protected override IList <ImportedSymbol> GetSymbols()
        {
            var result = new OwnedCollection <IImportedModule, ImportedSymbol>(this);

            if (IsEmpty)
            {
                return(result);
            }

            bool is32Bit = _context.File.OptionalHeader.Magic == OptionalHeaderMagic.Pe32;

            (ulong ordinalMask, int pointerSize) = is32Bit
                ? (0x8000_0000ul, sizeof(uint))
                : (0x8000_0000_0000_0000ul, sizeof(ulong));

            if (!_context.File.TryCreateReaderAtRva(_lookupRva, out var lookupItemReader))
            {
                _context.BadImage($"Imported module \"{Name}\" has an invalid import lookup thunk table RVA.");
                return(result);
            }

            while (true)
            {
                ImportedSymbol entry;

                ulong lookupItem = lookupItemReader.ReadNativeInt(is32Bit);
                if (lookupItem == 0)
                {
                    break;
                }

                if ((lookupItem & ordinalMask) != 0)
                {
                    entry = new ImportedSymbol((ushort)(lookupItem & 0xFFFF));
                }
                else
                {
                    uint hintNameRva = (uint)(lookupItem & 0xFFFFFFFF);
                    if (!_context.File.TryCreateReaderAtRva(hintNameRva, out var reader))
                    {
                        _context.BadImage($"Invalid Hint-Name RVA for import {Name}!#{result.Count.ToString()}.");
                        entry = new ImportedSymbol(0, "<<<INVALID_NAME_RVA>>>");
                    }
                    else
                    {
                        entry = new ImportedSymbol(reader.ReadUInt16(), reader.ReadAsciiString());
                    }
                }

                entry.AddressTableEntry = _context.File.GetReferenceToRva((uint)(_addressRva + result.Count * pointerSize));
                result.Add(entry);
            }

            return(result);
        }
Beispiel #2
0
        /// <inheritdoc />
        protected override IList <ImportedSymbol> GetSymbols()
        {
            var result = new List <ImportedSymbol>();

            if (IsEmpty)
            {
                return(result);
            }

            ulong ordinalMask = _peFile.OptionalHeader.Magic == OptionalHeaderMagic.Pe32
                ? 0x8000_0000ul
                : 0x8000_0000_0000_0000ul;

            var lookupItems = ReadEntries(_lookupRva);
            var addresses   = ReadEntries(_addressRva);

            for (int i = 0; i < lookupItems.Count; i++)
            {
                ImportedSymbol entry;

                ulong lookupItem = lookupItems[i];
                if ((lookupItem & ordinalMask) != 0)
                {
                    entry = new ImportedSymbol((ushort)(lookupItem & 0xFFFF));
                }
                else
                {
                    uint hintNameRva = (uint)(lookupItem & 0xFFFFFFFF);
                    var  reader      = _peFile.CreateReaderAtRva(hintNameRva);
                    entry = new ImportedSymbol(reader.ReadUInt16(), reader.ReadAsciiString());
                }

                entry.Address = addresses[i];

                result.Add(entry);
            }

            return(result);
        }