Ejemplo n.º 1
0
        public CodeSection Handle(PeHeader PeHeader, PeSectionHeader Header, BinaryReader r)
        {
            var cs = new ExportSection {
                SectionHeader = Header
            };

            // Read Export directory table
            var exportDirTbl = Misc.FromBinaryReader <ExportDirectoryTable>(r);

            // Read export address table
            //r.BaseStream.Position = PeHeader.OptionalHeader32.ImageBase + exportDirTbl.OrdinalTableRVA;
            var exportAddressTable = new List <ExportOrdinalTableEntry>(exportDirTbl.AddressTableEntries);

            for (int i = exportDirTbl.AddressTableEntries; i > 0; i--)
            {
                var u  = r.ReadUInt32();
                var u2 = r.ReadUInt32();
                exportAddressTable.Add(new ExportOrdinalTableEntry
                {
                    ExportRVA    = u,
                    ForwarderRVA = u2
                });
            }

            // Export Name Pointer Table
            //r.BaseStream.Position = PeHeader.OptionalHeader32.ImageBase + exportDirTbl.NamePointerRVA;
            var exportNamePointers = new List <uint>(exportDirTbl.NamePointerCount);

            for (int i = exportDirTbl.NamePointerCount; i > 0; i--)
            {
                exportNamePointers.Add(r.ReadUInt32());
            }

            // Export Ordinal Table
            //r.BaseStream.Position = PeHeader.OptionalHeader32.ImageBase + exportDirTbl.OrdinalTableRVA;
            var symbolAddressLookup = new List <ushort>(exportDirTbl.AddressTableEntries);

            // Export name table
            var exportNames = new List <string>(exportDirTbl.NamePointerCount);

            for (int i = exportDirTbl.NamePointerCount; i > 0; i--)
            {
                var  sb = new StringBuilder();
                char c;
                while ((c = (char)r.ReadByte()) != '\0')
                {
                    sb.Append(c);
                }
                exportNames.Add(sb.ToString());
            }

            return(cs);
        }
Ejemplo n.º 2
0
        public CodeSection Handle(PeHeader PeHeader, PeSectionHeader Header, BinaryReader r)
        {
            var cs = new ExportSection { SectionHeader = Header };

            // Read Export directory table
            var exportDirTbl = Misc.FromBinaryReader<ExportDirectoryTable>(r);

            // Read export address table
            //r.BaseStream.Position = PeHeader.OptionalHeader32.ImageBase + exportDirTbl.OrdinalTableRVA;
            var exportAddressTable = new List<ExportOrdinalTableEntry>(exportDirTbl.AddressTableEntries);

            for (int i = exportDirTbl.AddressTableEntries; i > 0; i--)
            {
                var u = r.ReadUInt32();
                var u2 = r.ReadUInt32();
                exportAddressTable.Add(new ExportOrdinalTableEntry
                {
                    ExportRVA = u,
                    ForwarderRVA = u2
                });
            }

            // Export Name Pointer Table
            //r.BaseStream.Position = PeHeader.OptionalHeader32.ImageBase + exportDirTbl.NamePointerRVA;
            var exportNamePointers = new List<uint>(exportDirTbl.NamePointerCount);

            for (int i = exportDirTbl.NamePointerCount; i > 0; i--)
                exportNamePointers.Add(r.ReadUInt32());

            // Export Ordinal Table
            //r.BaseStream.Position = PeHeader.OptionalHeader32.ImageBase + exportDirTbl.OrdinalTableRVA;
            var symbolAddressLookup = new List<ushort>(exportDirTbl.AddressTableEntries);

            // Export name table
            var exportNames = new List<string>(exportDirTbl.NamePointerCount);

            for (int i = exportDirTbl.NamePointerCount; i > 0; i--)
            {
                var sb = new StringBuilder();
                char c;
                while ((c = (char)r.ReadByte()) != '\0')
                    sb.Append(c);
                exportNames.Add(sb.ToString());
            }

            return cs;
        }