Beispiel #1
0
        internal ImageImportDll(MappedImage mappedImage, ImageImportDescriptor* descriptor)
        {
            _mappedImage = mappedImage;
            _descriptor = descriptor;

            if (_descriptor->OriginalFirstThunk != 0)
                _lookupTable = _mappedImage.RvaToVa(_descriptor->OriginalFirstThunk);
            else
                _lookupTable = _mappedImage.RvaToVa(_descriptor->FirstThunk);

            if (_lookupTable != null)
            {
                int i = 0;

                if (_mappedImage.Magic == Win32.Pe32Magic)
                {
                    while (((int*)_lookupTable)[i] != 0)
                        i++;
                }
                else if (_mappedImage.Magic == Win32.Pe32PlusMagic)
                {
                    while (((long*)_lookupTable)[i] != 0)
                        i++;
                }

                _count = i;
            }
        }
Beispiel #2
0
        public ImageImportEntry GetEntry(int index)
        {
            if (index >= _count)
            {
                return(ImageImportEntry.Empty);
            }

            if (_mappedImage.Magic == Win32.Pe32Magic)
            {
                int entry = ((int *)_lookupTable)[index];

                // Is this entry using an ordinal?
                if ((entry & 0x80000000) != 0)
                {
                    return(new ImageImportEntry()
                    {
                        Ordinal = (short)(entry & 0xffff)
                    });
                }
                else
                {
                    ImageImportByName *nameEntry = (ImageImportByName *)_mappedImage.RvaToVa(entry);

                    return(new ImageImportEntry()
                    {
                        NameHint = nameEntry->Hint,
                        Name = new string((sbyte *)&nameEntry->Name)
                    });
                }
            }
            else if (_mappedImage.Magic == Win32.Pe32PlusMagic)
            {
                long entry = ((long *)_lookupTable)[index];

                // Is this entry using an ordinal?
                if (((ulong)entry & 0x8000000000000000) != 0)
                {
                    return(new ImageImportEntry()
                    {
                        Ordinal = (short)(entry & 0xffff)
                    });
                }
                else
                {
                    ImageImportByName *nameEntry = (ImageImportByName *)_mappedImage.RvaToVa((int)(entry & 0xffffffff));

                    return(new ImageImportEntry()
                    {
                        NameHint = nameEntry->Hint,
                        Name = new string((sbyte *)&nameEntry->Name)
                    });
                }
            }

            return(ImageImportEntry.Empty);
        }
Beispiel #3
0
        internal ImageExports(MappedImage mappedImage)
        {
            _mappedImage = mappedImage;
            _dataDirectory = mappedImage.GetDataEntry(ImageDataEntry.Export);
            _exportDirectory = mappedImage.GetExportDirectory();

            if (_exportDirectory != null)
            {
                _addressTable = (int*)mappedImage.RvaToVa(_exportDirectory->AddressOfFunctions);
                _namePointerTable = (int*)mappedImage.RvaToVa(_exportDirectory->AddressOfNames);
                _ordinalTable = (short*)mappedImage.RvaToVa(_exportDirectory->AddressOfNameOrdinals);
            }
        }
        internal ImageExports(MappedImage mappedImage)
        {
            _mappedImage     = mappedImage;
            _dataDirectory   = mappedImage.GetDataEntry(ImageDataEntry.Export);
            _exportDirectory = mappedImage.GetExportDirectory();

            if (_exportDirectory != null)
            {
                _addressTable     = (int *)mappedImage.RvaToVa(_exportDirectory->AddressOfFunctions);
                _namePointerTable = (int *)mappedImage.RvaToVa(_exportDirectory->AddressOfNames);
                _ordinalTable     = (short *)mappedImage.RvaToVa(_exportDirectory->AddressOfNameOrdinals);
            }
        }
Beispiel #5
0
        public ImageExportEntry GetEntry(int index)
        {
            if (_exportDirectory == null || _namePointerTable == null || _ordinalTable == null)
            {
                return(ImageExportEntry.Empty);
            }
            if (index >= _exportDirectory->NumberOfFunctions)
            {
                return(ImageExportEntry.Empty);
            }

            ImageExportEntry entry = new ImageExportEntry();

            entry.Ordinal = (short)(_ordinalTable[index] + _exportDirectory->Base);

            if (index < _exportDirectory->NumberOfNames)
            {
                entry.Name = new string((sbyte *)_mappedImage.RvaToVa(_namePointerTable[index]));
            }

            return(entry);
        }
Beispiel #6
0
        internal ImageImportDll(MappedImage mappedImage, ImageImportDescriptor *descriptor)
        {
            _mappedImage = mappedImage;
            _descriptor  = descriptor;

            if (_descriptor->OriginalFirstThunk != 0)
            {
                _lookupTable = _mappedImage.RvaToVa(_descriptor->OriginalFirstThunk);
            }
            else
            {
                _lookupTable = _mappedImage.RvaToVa(_descriptor->FirstThunk);
            }

            // Do a quick scan.
            if (_lookupTable != null)
            {
                int i = 0;

                if (_mappedImage.Magic == Win32.Pe32Magic)
                {
                    while (((int *)_lookupTable)[i] != 0)
                    {
                        i++;
                    }
                }
                else if (_mappedImage.Magic == Win32.Pe32PlusMagic)
                {
                    while (((long *)_lookupTable)[i] != 0)
                    {
                        i++;
                    }
                }

                _count = i;
            }
        }