Esempio n. 1
0
        /// <inheritdoc />
        protected override IList <ImportedSymbol> GetSymbols()
        {
            var result = new List <ImportedSymbol>();

            if (IsEmpty)
            {
                return(result);
            }

            ulong ordinalMask = _peFile.OptionalHeader.Magic == OptionalHeaderMagic.Pe32
                ? 0x8000_0000ul
                : 0x8000_0000_0000_0000ul;

            var lookupItems = ReadEntries(_lookupRva);
            var addresses   = ReadEntries(_addressRva);

            for (int i = 0; i < lookupItems.Count; i++)
            {
                ImportedSymbol entry;

                ulong lookupItem = lookupItems[i];
                if ((lookupItem & ordinalMask) != 0)
                {
                    entry = new ImportedSymbol((ushort)(lookupItem & 0xFFFF));
                }
                else
                {
                    uint hintNameRva = (uint)(lookupItem & 0xFFFFFFFF);
                    var  reader      = _peFile.CreateReaderAtRva(hintNameRva);
                    entry = new ImportedSymbol(reader.ReadUInt16(), reader.ReadAsciiString());
                }

                entry.Address = addresses[i];

                result.Add(entry);
            }

            return(result);
        }
Esempio n. 2
0
        /// <summary>
        /// Reads a module import entry from an input stream.
        /// </summary>
        /// <param name="peFile">The PE file containing the module import.</param>
        /// <param name="reader">The input stream.</param>
        public SerializedImportedModule(PEFile peFile, IBinaryStreamReader reader)
        {
            _peFile        = peFile;
            _lookupRva     = reader.ReadUInt32();
            TimeDateStamp  = reader.ReadUInt32();
            ForwarderChain = reader.ReadUInt32();
            uint nameRva = reader.ReadUInt32();

            if (nameRva != 0)
            {
                Name = _peFile.CreateReaderAtRva(nameRva).ReadAsciiString();
            }
            _addressRva = reader.ReadUInt32();
        }