Пример #1
0
        protected void ReadOptionalExport(FByteFile file)
        {
            _export.Clear();
            FFunctionInfos      functions = _export.Functions;
            SImageDataDirectory idd       = _ntHeader.OptionalHeader.DataDirectory[(int)EImageDirectoryEntry.Export];

            if (idd.VirtualAddress != 0)
            {
                SImageExportDirectory imgExp = (SImageExportDirectory)file.GetStruct(ConvertRva(idd.VirtualAddress), typeof(SImageExportDirectory));
                _export.Data = imgExp;
                _export.Name = file.GetString(ConvertRva(imgExp.Name));
                // Read function
                int funcCount = imgExp.NumberOfFunctions;
                int funcAddr  = ConvertRva(imgExp.AddressOfFunctions);
                for (int n = 0; n < funcCount; n++, funcAddr += RInt.BYTE_SIZE)
                {
                    FFunctionInfo function = new FFunctionInfo();
                    function.FunctionIndex      = (int)(n + imgExp.Base);
                    function.FunctionAddress    = file.GetUint32(funcAddr);
                    function.FunctionAddressRva = ConvertRva(function.FunctionAddress);
                    functions.Push(function);
                }
                // Read function names
                int nameCount   = imgExp.NumberOfNames;
                int nameAddr    = ConvertRva(imgExp.AddressOfNames);
                int nameOrdAddr = ConvertRva(imgExp.AddressOfNameOrdinals);
                for (int n = 0; n < nameCount; n++, nameAddr += RInt.BYTE_SIZE, nameOrdAddr += RShort.BYTE_SIZE)
                {
                    int           funcIndex = file.GetUint16(nameOrdAddr);
                    FFunctionInfo function  = functions[funcIndex];
                    function.NameAddress    = file.GetUint32(nameAddr);
                    function.NameAddressRva = ConvertRva(function.NameAddress);
                    function.Name           = file.GetString(function.NameAddressRva);
                }
            }
        }