bool IBinaryConverter <ImageExportDirectory> .Convert(ref ImageExportDirectory s, uint startOffset, uint size) { NameAddress = s.AddressOfNames; FunctionAddress = s.AddressOfFunctions; OrdinalAddress = s.AddressOfNameOrdinals; OrdinalBase = s.Base; Count = s.NumberOfNames; ModuleNameAddress = s.Name; UpdateFileInfo(DefaultName, startOffset, size); return(true); }
public void ImageExportDirectoryConstructorWorks_Test() { var exportDirectory = new ImageExportDirectory(new BufferFile(RawStructures.RawExportDirectory), 2); Assert.Equal((uint)0x33221100, exportDirectory.Characteristics); Assert.Equal((uint)0x77665544, exportDirectory.TimeDateStamp); Assert.Equal((ushort)0x9988, exportDirectory.MajorVersion); Assert.Equal((ushort)0xbbaa, exportDirectory.MinorVersion); Assert.Equal(0xffeeddcc, exportDirectory.Name); Assert.Equal((uint)0x55443322, exportDirectory.Base); Assert.Equal((uint)0x44332211, exportDirectory.NumberOfFunctions); Assert.Equal(0x88776655, exportDirectory.NumberOfNames); Assert.Equal(0xccbbaa99, exportDirectory.AddressOfFunctions); Assert.Equal((uint)0x00ffeedd, exportDirectory.AddressOfNames); Assert.Equal((uint)0x55443322, exportDirectory.AddressOfNameOrdinals); }
public PeHeaderReader(RemoteProcess process, IntPtr moduleBase) : base(process, moduleBase) { DosHeader = new ImageDosHeader(process, moduleBase); NtHeader = new ImageNtHeader(process, moduleBase + (int)DosHeader.e_lfanew, Is64Bit); var numSections = (int)NtHeader.FileHeader.NumberOfSections; var secHeaderStart = DosHeader.e_lfanew + NtHeader.FileHeader.SizeOfOptionalHeader + 0x18; SectionHeaders = new ImageSectionHeaders(process, moduleBase + (int)secHeaderStart, numSections); var exportDirVa = NtHeader.OptionalHeader.DataDirectory[0].VirtualAddress; if (exportDirVa != 0) { ExportDirectory = new ImageExportDirectory(process, moduleBase + (int)exportDirVa); } }
public ExportDirectoryBuffer(ImageExportDirectory exportDirectory, IOffsetConverter converter) { if (exportDirectory == null) { throw new ArgumentNullException("exportDirectory"); } _converter = converter; Segments.Add(_exportDirectory = exportDirectory); Segments.Add(_nameSegment = DataSegment.CreateAsciiString(_exportDirectory.Name, true)); Segments.Add(_nameRvaTable = new SimpleFileSegmentBuilder()); Segments.Add(_nameOrdinalTable = new SimpleFileSegmentBuilder()); Segments.Add(_addressesTable = new SimpleFileSegmentBuilder()); Segments.Add(_namesTable = new SimpleFileSegmentBuilder()); foreach (var export in exportDirectory.Exports) { AddSymbolExport(export); } }
public void PersistentExports() { var assembly = CreateTempAssembly(); assembly.NetDirectory.MetadataHeader.UnlockMetadata(); var exportDirectory = new ImageExportDirectory { Name = "somefile.dll", OrdinalBase = 2, Exports = { new ImageSymbolExport(0x1234), new ImageSymbolExport(0x5678, "MyNamedExport1"), new ImageSymbolExport(0x9ABC), new ImageSymbolExport(0xDEF0, "MyNamedExport2"), } }; assembly.ExportDirectory = exportDirectory; using (var stream = new MemoryStream()) { assembly.Write(new BinaryStreamWriter(stream), new CompactNetAssemblyBuilder(assembly)); assembly = WindowsAssembly.FromBytes(stream.ToArray()); Assert.NotNull(assembly.ExportDirectory); Assert.Equal(exportDirectory.Name, assembly.ExportDirectory.Name); Assert.Equal(exportDirectory.Exports.Count, assembly.ExportDirectory.Exports.Count); for (int i = 0; i < assembly.ExportDirectory.Exports.Count; i++) { var original = exportDirectory.Exports[i]; var newExport = assembly.ExportDirectory.Exports[i]; Assert.Equal(original.Rva, newExport.Rva); Assert.Equal(original.Name, newExport.Name); } } }