public ImageImportEntry GetEntry(int index) { if (index >= _count) { return(ImageImportEntry.Empty); } if (_mappedImage.Magic == Win32.Pe32Magic) { int entry = ((int *)_lookupTable)[index]; // Is this entry using an ordinal? if ((entry & 0x80000000) != 0) { return(new ImageImportEntry() { Ordinal = (short)(entry & 0xffff) }); } else { ImageImportByName *nameEntry = (ImageImportByName *)_mappedImage.RvaToVa(entry); return(new ImageImportEntry() { NameHint = nameEntry->Hint, Name = new string((sbyte *)&nameEntry->Name) }); } } else if (_mappedImage.Magic == Win32.Pe32PlusMagic) { long entry = ((long *)_lookupTable)[index]; // Is this entry using an ordinal? if (((ulong)entry & 0x8000000000000000) != 0) { return(new ImageImportEntry() { Ordinal = (short)(entry & 0xffff) }); } else { ImageImportByName *nameEntry = (ImageImportByName *)_mappedImage.RvaToVa((int)(entry & 0xffffffff)); return(new ImageImportEntry() { NameHint = nameEntry->Hint, Name = new string((sbyte *)&nameEntry->Name) }); } } return(ImageImportEntry.Empty); }
private static ThunkPredicate CreatePredicate(string function) { return((module, thunk) => { if (ImageOrdinal.UsingOrdinals(thunk->Ordinal)) { return false; } ImageImportByName *import = (ImageImportByName *)thunk->AddressOfData.AsPtr(module); string name = new string(import->Name); if (String.Equals(function, name, StringComparison.OrdinalIgnoreCase)) { return true; } return false; }); }