public static async Task <Exports> GetAsync(PortableExecutableImage image)
{
var directory = await ExportDirectory.GetAsync(image).ConfigureAwait(false);
if (directory == null)
{
return(null);
}
var functionAddresses = await ExportTable.GetFunctionAddressTableAsync(image, directory).ConfigureAwait(false);
if (functionAddresses == null)
{
return(null);
}
var nameAddresses = await ExportTable.GetNameAddressTableAsync(image, directory).ConfigureAwait(false);
if (nameAddresses == null)
{
return(null);
}
var ordinals = await ExportTable.GetOrdinalTableAsync(image, directory).ConfigureAwait(false);
if (ordinals == null)
{
return(null);
}
return(await GetAsync(image, directory, functionAddresses, nameAddresses, ordinals).ConfigureAwait(false));
}
public static async Task <ExportTable <uint> > GetNameAddressTableAsync(PortableExecutableImage image, ExportDirectory directory = null)
{
if (directory == null)
{
directory = await ExportDirectory.GetAsync(image).ConfigureAwait(false);
}
var calc = image.GetCalculator();
var section = calc.RVAToSection(directory.AddressOfNames);
var fileOffset = calc.RVAToOffset(section, directory.AddressOfNames);
var imageBase = image.NTHeaders.OptionalHeader.ImageBase;
var size = directory.NumberOfNames * sizeof(uint);
var location = new Location(image, fileOffset, directory.AddressOfNames, imageBase + directory.AddressOfNames, size, size, section);
var stream = image.GetStream();
stream.Seek(fileOffset.ToInt64(), SeekOrigin.Begin);
var addresses = new uint[directory.NumberOfNames];
try
{
for (var i = 0; i < directory.NumberOfNames; i++)
{
addresses[i] = await stream.ReadUInt32Async().ConfigureAwait(false);
}
}
catch (Exception ex)
{
throw new PortableExecutableImageException(image, "Could not read address of name from stream.", ex);
}
var dataDirectory = image.NTHeaders.DataDirectories[DataDirectoryType.ExportTable];
var table = new ExportTable <uint>(image, dataDirectory, location, directory, addresses);
return(table);
}