public ImportModuleTable Clone()
{
var copy = new ImportModuleTable();
CopyTo(copy);
return(copy);
}
protected void CopyTo(ImportModuleTable copy)
{
copy._dllName = _dllName;
copy._forwarderChain = _forwarderChain;
foreach (var childNode in _list)
{
var copyChildNode = childNode.Clone();
copy._list.Add(copyChildNode);
copyChildNode._parent = this;
}
}
internal static unsafe ImportModuleTable Load(IBinaryAccessor accessor, PEImage image)
{
ImportTableHeader header;
fixed(byte *pBuff = accessor.ReadBytes(sizeof(ImportTableHeader)))
{
header = *(ImportTableHeader *)pBuff;
}
if (header.Name == 0 || (header.ImportLookupTableRVA == 0 && header.ImportAddressTableRVA == 0))
{
return(null);
}
// Save position
long position = accessor.Position;
var module = new ImportModuleTable();
module._forwarderChain = header.ForwarderChain;
// Dll name
accessor.Position = image.ResolvePositionToSectionData(header.Name);
module._dllName = accessor.ReadNullTerminatedString(Encoding.ASCII);
// Set RVA to ImportLookupTable or ImportAddressTable. Both tables are equivalent.
if (header.ImportLookupTableRVA != 0)
{
accessor.Position = image.ResolvePositionToSectionData(header.ImportLookupTableRVA);
}
else
{
accessor.Position = image.ResolvePositionToSectionData(header.ImportAddressTableRVA);
}
if (image.Is32Bits)
{
// Read IMAGE_THUNK_DATA32 structures
var thunkDataList = new List <uint>();
while (true)
{
uint entryData = accessor.ReadUInt32();
if (entryData == 0)
{
break;
}
thunkDataList.Add(entryData);
}
foreach (uint thunkData in thunkDataList)
{
string name = null;
int ordinal;
if ((thunkData & 0x80000000) != 0)
{
// Import by ordinal.
ordinal = (int)(thunkData & 0x7fffffff);
}
else
{
// Import by name.
uint hintNameRVA = (thunkData & 0x7fffffff);
accessor.Position = image.ResolvePositionToSectionData(hintNameRVA);
ordinal = accessor.ReadUInt16();
name = accessor.ReadNullTerminatedString(Encoding.ASCII);
}
var entry = new ImportEntry(name, ordinal);
entry._parent = module;
module._list.Add(entry);
}
}
else
{
// Read IMAGE_THUNK_DATA64 structures
var thunkDataList = new List <ulong>();
while (true)
{
ulong entryData = accessor.ReadUInt64();
if (entryData == 0)
{
break;
}
thunkDataList.Add(entryData);
}
foreach (ulong thunkData in thunkDataList)
{
string name = null;
int ordinal;
if ((thunkData & 0x8000000000000000) != 0)
{
// Import by ordinal.
ordinal = (int)(thunkData & 0x7fffffffffffffff);
}
else
{
// Import by name.
uint hintNameRVA = (uint)(thunkData & 0x7fffffffffffffff);
accessor.Position = image.ResolvePositionToSectionData(hintNameRVA);
ordinal = accessor.ReadUInt16();
name = accessor.ReadNullTerminatedString(Encoding.ASCII);
}
var entry = new ImportEntry(name, ordinal);
entry._parent = module;
module._list.Add(entry);
}
}
// Restore position
accessor.Position = position;
return(module);
}
