protected bool ReadOptionalImport(FByteFile file)
{
FModuleInfoCollection modules = _import.Modules;
modules.Clear();
SImageDataDirectory idd = _ntHeader.OptionalHeader.DataDirectory[(int)EImageDirectoryEntry.Import];
if (idd.VirtualAddress == 0)
{
return(false);
}
// Read modules
int vaddress = ConvertRva(idd.VirtualAddress);
int size = Marshal.SizeOf(typeof(SImageImportDescriptor));
while (true)
{
SImageImportDescriptor impDesc = (SImageImportDescriptor)file.GetStruct(vaddress, typeof(SImageImportDescriptor));
if (impDesc.Name == 0)
{
break;
}
FModuleInfo module = new FModuleInfo();
module.NameAddress = impDesc.Name;
module.Name = file.GetString(ConvertRva(impDesc.Name));
module.FirstThunk = impDesc.FirstThunk;
module.OriginalFirstThunk = impDesc.OriginalFirstThunk;
ReadTrunks(file, module);
modules.Push(module);
vaddress += size;
}
return(true);
}
protected bool ReadTrunks(FByteFile file, FModuleInfo module)
{
// Trunk
int ftSize = Marshal.SizeOf(typeof(SImageThunkData32));
int pOrgFt = ConvertRva(module.OriginalFirstThunk);
int pFt = ConvertRva(module.FirstThunk);
while (true)
{
SImageThunkData32 origThunk = (SImageThunkData32)file.GetStruct(pOrgFt, typeof(SImageThunkData32));
SImageThunkData32 realThunk = (SImageThunkData32)file.GetStruct(pFt, typeof(SImageThunkData32));
if (origThunk.Function == 0)
{
break;
}
if ((origThunk.Ordinal & 0x80000000) == 0x80000000)
{
break;
}
// Read name
SImageImportByName impName = (SImageImportByName)file.GetStruct(ConvertRva(origThunk.AddressOfData), typeof(SImageImportByName));
if (impName.Name[0] == 0)
{
break;
}
// TrunkInfo
FTrunkInfo trunk = new FTrunkInfo();
trunk.Name = RAscii.GetString(impName.Name);
trunk.Address = origThunk.Function;
trunk.Entry = (IntPtr)realThunk.Function;
trunk.Hint = impName.Hint;
module.Trunks.Push(trunk);
// Loop
pOrgFt += ftSize;
pFt += ftSize;
}
return(true);
}
