public static List <ExportEntry> GetExports(FilePath targetFile) { var invoker = new DumpBinInvoker(); invoker.Arguments.Add("/EXPORTS"); invoker.Arguments.Add(targetFile.FullName); invoker.Run(); char[] splitChars = new char[] { ' ', '\t' }; bool hasStarted = false; var exports = new List <ExportEntry>(); foreach (string line in invoker.Outputs) { string trimmed = line.Trim(); if (string.IsNullOrEmpty(trimmed)) { continue; } if (!hasStarted) { if (trimmed.Contains("ordinal") && trimmed.Contains("hint") && trimmed.Contains("RVA") && trimmed.Contains("name")) { hasStarted = true; } continue; } if (trimmed.Equals("Summary")) { break; } string[] parts = trimmed.Split(splitChars, StringSplitOptions.RemoveEmptyEntries); if (parts.Length < 4) { throw new Exception("Unrecognized text in dumpbin.exe EXPORTS output: \n " + trimmed + "\n"); } if (!IsDecimalString(parts[0]) || !IsHexString(parts[1]) || !IsHexString(parts[2])) { throw new Exception("Unrecognized text in dumpbin.exe EXPORTS output: \n " + trimmed + "\n"); } #if false // Additional information skipped. string sOrdinal = parts[0]; string sHint = parts[1]; #endif string sRVA = parts[2]; int nameStart = trimmed.IndexOf(sRVA); string name = trimmed.Substring(nameStart + sRVA.Length).Trim(); if (!TryParseExportEntry(name, out string prototype, out string decoratedName)) { throw new Exception("Unrecognized text in dumpbin.exe EXPORTS output: \n " + trimmed + "\n"); } exports.Add(new ExportEntry(targetFile, prototype, decoratedName, decoratedName)); } return(exports); }
public static List <DumpBinExportsRecord> GetExports_Obsolete(string inputFilename) { if (!File.Exists(inputFilename)) { throw new FileNotFoundException(inputFilename); } var invoker = new DumpBinInvoker(); invoker.Arguments.Add("/EXPORTS"); invoker.Arguments.Add(inputFilename); invoker.Run(); char[] splitChars = new char[] { ' ', '\t' }; bool hasStarted = false; var records = new List <DumpBinExportsRecord>(); foreach (string line in invoker.Outputs) { string trimmed = line.Trim(); if (string.IsNullOrEmpty(trimmed)) { continue; } if (!hasStarted) { if (trimmed.Contains("ordinal") && trimmed.Contains("hint") && trimmed.Contains("RVA") && trimmed.Contains("name")) { hasStarted = true; } continue; } if (trimmed.Equals("Summary")) { break; } string[] parts = trimmed.Split(splitChars, StringSplitOptions.RemoveEmptyEntries); if (parts.Length < 4) { throw new Exception("Unrecognized text in dumpbin.exe EXPORTS output: \n " + trimmed + "\n"); } string sOrdinal = parts[0]; string sHint = parts[1]; string sRVA = parts[2]; int nameStart = trimmed.IndexOf(sRVA); string name = trimmed.Substring(nameStart + sRVA.Length).Trim(); DumpBinExportsRecord record = new DumpBinExportsRecord() { Ordinal = int.Parse(sOrdinal), Hint = int.Parse(sHint, System.Globalization.NumberStyles.AllowHexSpecifier), RVA = uint.Parse(sRVA, System.Globalization.NumberStyles.AllowHexSpecifier), Name = name }; record.TryParse(); records.Add(record); } return(records); }
public static List <CallEntry> GetCallsFromDisasm(FilePath targetFile, ImportTable importTable, ExportTable exportTable) { var invoker = new DumpBinInvoker(); invoker.Arguments.Add("/DISASM"); invoker.Arguments.Add(targetFile.FullName); invoker.Run(); DisasmParser parsedResult = new DisasmParser(targetFile, invoker.Outputs, importTable.Symbols); parsedResult.Run(); return(parsedResult.Calls); }
public static List <string> GetDependents(string inputFilename) { if (!File.Exists(inputFilename)) { throw new FileNotFoundException(inputFilename); } var results = new List <string>(); var invoker = new DumpBinInvoker(); invoker.Arguments.Add("/DEPENDENTS"); invoker.Arguments.Add(inputFilename); invoker.Run(); bool hasStarted = false; foreach (string line in invoker.Outputs) { string trimmed = line.Trim(); if (string.IsNullOrEmpty(trimmed)) { continue; } if (!hasStarted) { if (trimmed.Equals("Image has the following dependencies:", StringComparison.Ordinal)) { hasStarted = true; } continue; } if (trimmed.Equals("Summary")) { break; } if (trimmed.Equals("Image has the following delay load dependencies:", StringComparison.Ordinal)) { break; } results.Add(trimmed); } return(results); }
public static List <ImportEntry> GetImports(FilePath targetFile) { var invoker = new DumpBinInvoker(); invoker.Arguments.Add("/IMPORTS"); invoker.Arguments.Add(targetFile.FullName); invoker.Run(); char[] splitChars = new char[] { ' ', '\t' }; int lineCount = invoker.Outputs.Count; bool hasStarted = false; var imports = new List <ImportEntry>(); FileHint calleeFileHint = null; for (int lineIndex = 0; lineIndex < lineCount; ++lineIndex) { string line = invoker.Outputs[lineIndex]; if (!hasStarted) { if (line.Trim().Equals("Section contains the following imports:", StringComparison.InvariantCulture)) { hasStarted = true; } continue; } else { if (line.Trim().Equals("Summary", StringComparison.InvariantCulture)) { break; } } string[] parts = line.Split(splitChars, StringSplitOptions.RemoveEmptyEntries); if (parts.Length == 0) { continue; } if (parts.Length == 1) { calleeFileHint = new FileHint(parts[0]); continue; } else if (parts.Length == 2) { if (!IsHexString(parts[0])) { throw new Exception("Expects imported function to start with hexadecimal value. Text: \n" + line + "\n"); } if (calleeFileHint == null) { throw new Exception("Invalid execution flow: missing file name"); } string strValue = parts[0]; string remainder = line.Substring(line.IndexOf(strValue) + strValue.Length).Trim(); imports.Add(new ImportEntry(targetFile, calleeFileHint, remainder, remainder)); } else if (parts.Length > 2) { if (!IsHexString(parts[0])) { throw new Exception("Expects additional information to start with hexadecimal value. Text: \n" + line + "\n"); } #if false // additional information skipped string strValue = parts[0]; string remainder = line.Substring(line.IndexOf(strValue) + strValue.Length).Trim(); currentInfo.AdditionalInfos.Add(remainder, strValue); #endif } } return(imports); }