private void LoadExports() { // TODO: Unnamed exports (detect exports with only an ordinal). string libraryname = header.assembly.path.Substring(header.assembly.path.LastIndexOf('\\') + 1); DataDirectory exportdatadir = header.OptionalHeader.DataDirectories[(int)DataDirectoryName.Export]; if (exportdatadir.targetOffset.FileOffset == 0) { return; } image.SetOffset(exportdatadir.TargetOffset.FileOffset); exportDirectory = image.ReadStructure <Structures.IMAGE_EXPORT_DIRECTORY>(); OffsetConverter offsetConverter = new OffsetConverter(exportdatadir.Section); uint functionoffset = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfFunctions); uint functionnameoffset = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfNames); uint functionnameordinaloffset = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfNameOrdinals); for (uint i = 0; i < exportDirectory.NumberOfFunctions; i++) { image.SetOffset(functionoffset); uint functionRVA = image.Reader.ReadUInt32(); image.SetOffset(functionnameoffset); uint functionNameRVA = image.Reader.ReadUInt32(); image.SetOffset(functionnameordinaloffset); uint functionNameOrdinal = image.Reader.ReadUInt32(); string name = image.ReadZeroTerminatedString(offsetConverter.RvaToFileOffset(functionNameRVA)); exports.Add(new ExportMethod(libraryname, name, functionNameRVA, functionRVA, (ushort)(i + exportDirectory.Base))); functionoffset += 4; functionnameoffset += 4; functionnameordinaloffset += 4; } }
public void LoadData() { if (ntHeader.IsManagedAssembly) { image.Stream.Seek(ntHeader.OptionalHeader.DataDirectories[(int)DataDirectoryName.Clr]._targetOffset.FileOffset, SeekOrigin.Begin); parent._rawOffset = (uint)image.Position; parent._rawHeader = image.ReadStructure <Structures.IMAGE_COR20_HEADER>(); Section targetsection = Section.GetSectionByFileOffset(ntHeader.Sections, parent._rawOffset); offsetConverter = new OffsetConverter(targetsection); LoadDirectories(); } }
internal void LoadData(bool ignoreHeaderNumbers) { CheckDosHeader(); dosHeader = image.ReadStructure <Structures.IMAGE_DOS_HEADER>(); ntheaderoffset = image.Stream.Position; image.Stream.Seek(dosHeader.e_lfanew, SeekOrigin.Begin); ntHeadersSignature = image.Reader.ReadUInt32(); ReadFileHeader(); ReadOptionalHeader(); Dictionary <uint, Structures.IMAGE_DATA_DIRECTORY> rawdatadirs = ConstructDataDirectories(ignoreHeaderNumbers); ReadSections(); CompleteDataDirectories(rawdatadirs); }