Esempio n. 1
0
        /// <summary>
        /// Attaches 32-bit specific info about imported functions.
        /// </summary>
        private bool AttachImportData(ref ImportFunctionModule.ImageImportData32 r, UnmanagedDataReader s, uint delta, ImportFunctionModule m)
        {
            if (m == null)
            {
                return(false);
            }

            // check if there is any data attached:
            if (r.OrdinalOrAddressOfData == 0)
            {
                return(false);
            }

            if (r.IsOrdinal)
            {
                ImportFunctionModule.ImageImportData32 thunk = new ImportFunctionModule.ImageImportData32();

                if (s.ReadAt(ref thunk, m.FirstThunk - delta))
                {
                    m.Add(new ImportFunctionDescription(r.Ordinal, m.IsBinded ? thunk.OrdinalOrAddressOfData : 0));
                }
            }
            else
            {
                ImportFunctionModule.ImageImportByName funName = new ImportFunctionModule.ImageImportByName();
                ImportFunctionModule.ImageImportData32 thunk   = new ImportFunctionModule.ImageImportData32();

                if (s.ReadAt(ref thunk, m.FirstThunk - delta))
                {
                    if (s.ReadAt(ref funName, r.OrdinalOrAddressOfData - delta))
                    {
                        m.Add(new ImportFunctionDescription(
                                  s.ReadStringAnsiAt(r.OrdinalOrAddressOfData - delta + sizeof(short)),
                                  m.IsBinded ? thunk.OrdinalOrAddressOfData : 0,
                                  (uint)funName.Hint));
                    }
                }
            }

            return(true);
        }
Esempio n. 2
0
 bool IBinaryAppender <ImportFunctionModule.ImageImportData32, ReaderWithOffsetArgs> .Attach(ref ImportFunctionModule.ImageImportData32 s, uint size, ReaderWithOffsetArgs arg)
 {
     return(AttachImportData(ref s, arg.Source, arg.Delta, arg.Tag as ImportFunctionModule));
 }