Пример #1
0
        public void RefreshExportTable()
        {
            var ExportedFunctions = new List <FunctionSnapshot>();

            if (Functions != null)
            {
                Functions.RemoveAll(delegate(FunctionSnapshot fs) { return(fs.FuncType == FunctionType.Exported); });
            }
            var          is64bitDll   = false;
            var          isManagedDll = false;
            LOADED_IMAGE loadedImage;

            OnyxNative.MapAndLoad(FileName, null, out loadedImage, true, true);

            if (loadedImage.MappedAddress != IntPtr.Zero)
            {
                uint size;
                IMAGE_EXPORT_DIRECTORY ExportDir;
                var pExportDir = OnyxNative.ImageDirectoryEntryToData(loadedImage.MappedAddress, false, OnyxNative.IMAGE_DIRECTORY_ENTRY_EXPORT, out size);

                if (pExportDir == IntPtr.Zero)
                {
                    isManagedDll = true;
                    return; // Managed dll;
                }

                ExportDir = (IMAGE_EXPORT_DIRECTORY)Marshal.PtrToStructure(pExportDir, typeof(IMAGE_EXPORT_DIRECTORY));

                var pFuncNames     = OnyxNative.RvaToVa(loadedImage, ExportDir.AddressOfNames);
                var pFuncAdressess = OnyxNative.RvaToVa(loadedImage, ExportDir.AddressOfFunctions);
                var pFuncOrdinals  = OnyxNative.RvaToVa(loadedImage, ExportDir.AddressOfNameOrdinals);

                for (uint i = 0; i < ExportDir.NumberOfNames; i++)
                {
                    var funcName =
                        Marshal.PtrToStringAnsi((IntPtr)OnyxNative.RvaToVa(loadedImage, (IntPtr)Marshal.ReadInt32((IntPtr)((pFuncNames.ToInt64() + 4 * i)))));
                    var funcOrdinal = (UInt16)(Marshal.ReadInt16((IntPtr)(pFuncOrdinals.ToInt64() + sizeof(UInt16) * i)));
                    var funcAddress = (IntPtr)(Marshal.ReadInt32((IntPtr)(pFuncAdressess.ToInt64() + sizeof(UInt32) * funcOrdinal)));
                    funcOrdinal += (UInt16)ExportDir.Base;
                    var fs = new FunctionSnapshot(funcName, funcAddress, funcOrdinal, FunctionType.Exported, this);
                    ExportedFunctions.Add(fs);
                    FunctionFound(this, new EventArgs <FunctionSnapshot>(fs));
                }
            }
            else
            {
                throw new Win32Exception(Marshal.GetLastWin32Error());
            }

            if (Functions == null)
            {
                Functions = new List <FunctionSnapshot>();
            }
            Functions.AddRange(ExportedFunctions);
        }
Пример #2
0
        public uint GetExportedFunctionsCount()
        {
            LOADED_IMAGE loadedImage;

            OnyxNative.MapAndLoad(FileName, null, out loadedImage, true, true);
            if (loadedImage.MappedAddress != IntPtr.Zero)
            {
                uint size;
                IMAGE_EXPORT_DIRECTORY ExportDir;
                var pExportDir = OnyxNative.ImageDirectoryEntryToData(loadedImage.MappedAddress, false, OnyxNative.IMAGE_DIRECTORY_ENTRY_EXPORT, out size);

                if (pExportDir == IntPtr.Zero)
                {
                    return(0); // Managed dll;
                }

                ExportDir = (IMAGE_EXPORT_DIRECTORY)Marshal.PtrToStructure(pExportDir, typeof(IMAGE_EXPORT_DIRECTORY));
                return(ExportDir.NumberOfNames);
            }
            else
            {
                throw new Win32Exception(Marshal.GetLastWin32Error());
            }
        }