/// <summary>
/// Reads the Export Address Table (EAT) of this module from live memory
/// </summary>
/// <param name="memUtils">MemUtils-instance that is used to read data</param>
/// <param name="imageBase">Base-address pf this module in memory</param>
/// <param name="ied">The _IMAGE_EXPORT_DIRECTORY of this module</param>
/// <returns></returns>
public Tuple <string, int>[] ReadExportedFunctions(MemUtils memUtils, IntPtr imageBase,
_IMAGE_EXPORT_DIRECTORY ied)
{
var functions = new List <Tuple <string, int> >();
var lpFunctions = (IntPtr)(imageBase.ToInt64() + ied.AddressOfFunctions);
var lpNames = (IntPtr)(imageBase.ToInt64() + ied.AddressOfNames);
for (var i = 0; i < ied.NumberOfFunctions; i++)
{
var address = memUtils.Read <int>((IntPtr)(lpFunctions.ToInt64() + i * 4));
var name = "?";
if (lpFunctions != lpNames)
{
var nameAddress = memUtils.Read <int>((IntPtr)(lpNames.ToInt64() + i * 4));
name = memUtils.ReadString((IntPtr)(imageBase.ToInt64() + nameAddress), 64, Encoding.ASCII);
}
functions.Add(new Tuple <string, int>(name, address));
}
return(functions.ToArray());
}
/// <summary>
/// Reads the Export Address Table (EAT) of this module from live memory
/// </summary>
/// <param name="memUtils">MemUtils-instance that is used to read data</param>
/// <param name="imageBase">Base-address pf this module in memory</param>
/// <param name="ied">The _IMAGE_EXPORT_DIRECTORY of this module</param>
/// <returns></returns>
public Tuple<string, int>[] ReadExportedFunctions(MemUtils memUtils, IntPtr imageBase,
_IMAGE_EXPORT_DIRECTORY ied)
{
var functions = new List<Tuple<string, int>>();
var lpFunctions = (IntPtr) (imageBase.ToInt64() + ied.AddressOfFunctions);
var lpNames = (IntPtr) (imageBase.ToInt64() + ied.AddressOfNames);
for (var i = 0; i < ied.NumberOfFunctions; i++)
{
var address = memUtils.Read<int>((IntPtr) (lpFunctions.ToInt64() + i*4));
var name = "?";
if (lpFunctions != lpNames)
{
var nameAddress = memUtils.Read<int>((IntPtr) (lpNames.ToInt64() + i*4));
name = memUtils.ReadString((IntPtr) (imageBase.ToInt64() + nameAddress), 64, Encoding.ASCII);
}
functions.Add(new Tuple<string, int>(name, address));
}
return functions.ToArray();
}
/// <summary>
/// Reads the name of this module from live-memory
/// </summary>
/// <param name="memUtils">MemUtils-instance that is used to read data</param>
/// <param name="ied">The _IMAGE_EXPORT_DIRECTORY of this module</param>
/// <param name="imageBase">Base-address pf this module in memory</param>
/// <returns></returns>
public string ReadName(MemUtils memUtils, _IMAGE_EXPORT_DIRECTORY ied, IntPtr imageBase)
{
return(memUtils.ReadString((IntPtr)(imageBase.ToInt64() + ied.Name), 32, Encoding.ASCII));
}
/// <summary>
/// Reads the name of this module from live-memory
/// </summary>
/// <param name="memUtils">MemUtils-instance that is used to read data</param>
/// <param name="ied">The _IMAGE_EXPORT_DIRECTORY of this module</param>
/// <param name="imageBase">Base-address pf this module in memory</param>
/// <returns></returns>
public string ReadName(MemUtils memUtils, _IMAGE_EXPORT_DIRECTORY ied, IntPtr imageBase)
{
return memUtils.ReadString((IntPtr) (imageBase.ToInt64() + ied.Name), 32, Encoding.ASCII);
}