Пример #1
0
        public ImageImportEntry GetEntry(int index)
        {
            if (index >= _count)
            {
                return(ImageImportEntry.Empty);
            }

            if (_mappedImage.Magic == Win32.Pe32Magic)
            {
                int entry = ((int *)_lookupTable)[index];

                // Is this entry using an ordinal?
                if ((entry & 0x80000000) != 0)
                {
                    return(new ImageImportEntry()
                    {
                        Ordinal = (short)(entry & 0xffff)
                    });
                }
                else
                {
                    ImageImportByName *nameEntry = (ImageImportByName *)_mappedImage.RvaToVa(entry);

                    return(new ImageImportEntry()
                    {
                        NameHint = nameEntry->Hint,
                        Name = new string((sbyte *)&nameEntry->Name)
                    });
                }
            }
            else if (_mappedImage.Magic == Win32.Pe32PlusMagic)
            {
                long entry = ((long *)_lookupTable)[index];

                // Is this entry using an ordinal?
                if (((ulong)entry & 0x8000000000000000) != 0)
                {
                    return(new ImageImportEntry()
                    {
                        Ordinal = (short)(entry & 0xffff)
                    });
                }
                else
                {
                    ImageImportByName *nameEntry = (ImageImportByName *)_mappedImage.RvaToVa((int)(entry & 0xffffffff));

                    return(new ImageImportEntry()
                    {
                        NameHint = nameEntry->Hint,
                        Name = new string((sbyte *)&nameEntry->Name)
                    });
                }
            }

            return(ImageImportEntry.Empty);
        }
Пример #2
0
        private static ThunkPredicate CreatePredicate(string function)
        {
            return((module, thunk) =>
            {
                if (ImageOrdinal.UsingOrdinals(thunk->Ordinal))
                {
                    return false;
                }

                ImageImportByName *import = (ImageImportByName *)thunk->AddressOfData.AsPtr(module);
                string name = new string(import->Name);

                if (String.Equals(function, name, StringComparison.OrdinalIgnoreCase))
                {
                    return true;
                }

                return false;
            });
        }