Example #1
0
        public ImpExports(BinaryReader reader, MModule mod)
        {
            ArrayList            ides = new ArrayList();
            ImportDirectoryEntry ide  = null;

            _exports = new ExportRecord[0];
            _ith     = new ImportDirectoryEntry[0];

            //imports

            if (mod.ModHeaders.OSHeaders.PEHeader.DataDirs[1].Rva != 0)
            {
                uint start, end;
                start = mod.ModHeaders.Rva2Offset(mod.ModHeaders.OSHeaders.PEHeader.DataDirs[1].Rva);
                end   = mod.ModHeaders.OSHeaders.PEHeader.DataDirs[1].Size + start;

                reader.BaseStream.Position = start;

                while (reader.BaseStream.Position < end)
                {
                    ide = new ImportDirectoryEntry(reader, mod);

                    //in older PEs it seems there is no null terminating entry, but in .NET ones there is.
                    if (ide.Name == null)
                    {
                        break;
                    }
                    else
                    {
                        ides.Add(ide);
                    }
                }

                _ith = (ImportDirectoryEntry[])ides.ToArray(typeof(ImportDirectoryEntry));
            }

            //exports

            if (mod.ModHeaders.OSHeaders.PEHeader.DataDirs[0].Rva != 0)
            {
                reader.BaseStream.Position = mod.ModHeaders.Rva2Offset(mod.ModHeaders.OSHeaders.PEHeader.DataDirs[0].Rva);
                _extab = new ExportDirTable(reader, mod);

                _expAddrTab = new uint[_extab.AddressTableEntries];
                _expNameTab = new string[_extab.NamePointerCount];
                _expOrdTab  = new uint[_extab.NamePointerCount];

                reader.BaseStream.Position = mod.ModHeaders.Rva2Offset(_extab.ExportAddressTableRVA);

                for (int i = 0; i < _extab.AddressTableEntries; ++i)
                {
                    _expAddrTab[i] = reader.ReadUInt32();
                }

                reader.BaseStream.Position = mod.ModHeaders.Rva2Offset(_extab.OrdinalRVA);

                for (int i = 0; i < _extab.NamePointerCount; ++i)
                {
                    _expOrdTab[i] = reader.ReadUInt16();
                }

                reader.BaseStream.Position = mod.ModHeaders.Rva2Offset(_extab.NamePointerRVA);

                for (int i = 0; i < _extab.NamePointerCount; ++i)
                {
                    _expNameTab[i] = mod.StringFromRVA(reader, reader.ReadUInt32());
                }

                //assemble array of exportrecords
                uint len = _extab.AddressTableEntries;
                if (len > _extab.NamePointerCount)
                {
                    len = _extab.NamePointerCount;
                }
                _exports = new ExportRecord[len];
                for (int i = 0; i < len; ++i)
                {
                    _exports[i] = new ExportRecord(_expOrdTab[i], _expAddrTab[i], _expNameTab[i]);
                }
            }
        }
Example #2
0
		public ImpExports(BinaryReader reader, MModule mod)
		{
			ArrayList ides = new ArrayList();
			ImportDirectoryEntry ide = null;

			_exports = new ExportRecord[0];
			_ith = new ImportDirectoryEntry[0];

			//imports 

			if (mod.ModHeaders.OSHeaders.PEHeader.DataDirs[1].Rva != 0)
			{

				uint start, end;
				start = mod.ModHeaders.Rva2Offset(mod.ModHeaders.OSHeaders.PEHeader.DataDirs[1].Rva);
				end = mod.ModHeaders.OSHeaders.PEHeader.DataDirs[1].Size + start;

				reader.BaseStream.Position = start;

				while (reader.BaseStream.Position < end)
				{
					ide = new ImportDirectoryEntry(reader, mod);

					//in older PEs it seems there is no null terminating entry, but in .NET ones there is.
					if (ide.Name == null)
					{
						break;
					}
					else
					{
						ides.Add(ide);
					}
				}

				_ith = (ImportDirectoryEntry[])ides.ToArray(typeof(ImportDirectoryEntry));
			}

			//exports

			if (mod.ModHeaders.OSHeaders.PEHeader.DataDirs[0].Rva != 0)
			{
			
				reader.BaseStream.Position = mod.ModHeaders.Rva2Offset(mod.ModHeaders.OSHeaders.PEHeader.DataDirs[0].Rva);
				_extab = new ExportDirTable(reader, mod);

				_expAddrTab = new uint[_extab.AddressTableEntries];
				_expNameTab = new string[_extab.NamePointerCount];
				_expOrdTab = new uint[_extab.NamePointerCount];

				reader.BaseStream.Position = mod.ModHeaders.Rva2Offset(_extab.ExportAddressTableRVA);

				for(int i=0; i< _extab.AddressTableEntries; ++i)
				{
					_expAddrTab[i] = reader.ReadUInt32();
				}

				reader.BaseStream.Position = mod.ModHeaders.Rva2Offset(_extab.OrdinalRVA);

				for(int i=0; i< _extab.NamePointerCount; ++i)
				{
					_expOrdTab[i] = reader.ReadUInt16();
				}

				reader.BaseStream.Position = mod.ModHeaders.Rva2Offset(_extab.NamePointerRVA);

				for(int i=0; i< _extab.NamePointerCount; ++i)
				{
					_expNameTab[i] = mod.StringFromRVA(reader, reader.ReadUInt32());
				}

				//assemble array of exportrecords
				uint len = _extab.AddressTableEntries;
				if (len > _extab.NamePointerCount) len = _extab.NamePointerCount;
				_exports = new ExportRecord[len];
				for(int i=0; i < len; ++i)
				{
					_exports[i] = new ExportRecord(_expOrdTab[i], _expAddrTab[i], _expNameTab[i]);
				}
			}

		}