Represents an exported function.
 public void ToString01606()
 {
     string s;
     ExportFunction s0 = new ExportFunction((string)null, 0u, (ushort)0);
     s = this.ToString01(s0);
     Assert.AreEqual<string>
     ("ExportFunction\nName                :\t          \nAddress             :\t         0\nOrdinal             :\t         0\n",
      s);
     Assert.IsNotNull((object)s0);
     Assert.AreEqual<string>((string)null, s0.Name);
     Assert.AreEqual<uint>(0u, s0.Address);
     Assert.AreEqual<ushort>((ushort)0, s0.Ordinal);
 }
Beispiel #2
0
        ExportFunction[] ParseExportedFunctions(byte[] buff, IMAGE_EXPORT_DIRECTORY ed, IMAGE_SECTION_HEADER[] sh)
        {
            var expFuncs          = new ExportFunction[ed.NumberOfNames];
            var funcOffsetPointer = Utility.RVAtoFileMapping(ed.AddressOfFunctions, sh);
            var ordOffset         = Utility.RVAtoFileMapping(ed.AddressOfNameOrdinals, sh);
            var nameOffsetPointer = Utility.RVAtoFileMapping(ed.AddressOfNames, sh);

            var funcOffset = Utility.BytesToUInt32(buff, funcOffsetPointer);

            for (UInt32 i = 0; i < expFuncs.Length; i++)
            {
                var namePtr      = Utility.BytesToUInt32(buff, nameOffsetPointer + sizeof(UInt32) * i);
                var nameAdr      = Utility.RVAtoFileMapping(namePtr, sh);
                var name         = Utility.GetName(nameAdr, buff);
                var ordinalIndex = (UInt32)Utility.GetOrdinal(ordOffset + sizeof(UInt16) * i, buff);
                var ordinal      = ordinalIndex + ed.Base;
                var address      = Utility.BytesToUInt32(buff, funcOffsetPointer + sizeof(UInt32) * ordinalIndex);

                expFuncs[i] = new ExportFunction(name, address, (UInt16)ordinal);
            }

            return(expFuncs);
        }