string ReadFunctionName(ExportTable et, int index) { for (int i = 0; i < et.NumberOfNames; i++) { if (et.NameOrdinals [i] != index) continue; SetPositionToAddress (et.AddressesOfNames [i]); return ReadZeroTerminatedString (); } return string.Empty; }
public override void VisitExportTable(ExportTable et) { SetPositionToAddress (m_image.PEOptionalHeader.DataDirectories.ExportTable.VirtualAddress); et.Characteristics = m_binaryReader.ReadUInt32 (); et.TimeDateStamp = m_binaryReader.ReadUInt32 (); et.MajorVersion = m_binaryReader.ReadUInt16 (); et.MinorVersion = m_binaryReader.ReadUInt16 (); //et.Name = m_binaryReader.ReadUInt32 (); et.Base = m_binaryReader.ReadUInt32 (); et.NumberOfFunctions = m_binaryReader.ReadUInt32 (); et.NumberOfNames = m_binaryReader.ReadUInt32 (); et.AddressOfFunctions = m_binaryReader.ReadUInt32 (); et.AddressOfNames = m_binaryReader.ReadUInt32 (); et.AddressOfNameOrdinals = m_binaryReader.ReadUInt32 (); et.AddressesOfFunctions = ReadArrayOfRVA (et.AddressOfFunctions, et.NumberOfFunctions); et.AddressesOfNames = ReadArrayOfRVA (et.AddressOfNames, et.NumberOfNames); et.NameOrdinals = ReadArrayOfUInt16 (et.AddressOfNameOrdinals, et.NumberOfNames); et.Names = new string [et.NumberOfFunctions]; for (int i = 0; i < et.NumberOfFunctions; i++) { if (et.AddressesOfFunctions [i] == 0) continue; et.Names [i] = ReadFunctionName (et, i); } }