Пример #1
0
        private void LoadExports()
        {
            // TODO: Unnamed exports (detect exports with only an ordinal).

            string        libraryname   = header._assembly._path.Substring(header._assembly._path.LastIndexOf('\\') + 1);
            DataDirectory exportdatadir = header.OptionalHeader.DataDirectories[(int)DataDirectoryName.Export];

            if (exportdatadir._targetOffset.FileOffset == 0)
            {
                return;
            }

            image.SetOffset(exportdatadir.TargetOffset.FileOffset);

            exportDirectory = image.ReadStructure <Structures.IMAGE_EXPORT_DIRECTORY>();

            OffsetConverter offsetConverter           = new OffsetConverter(exportdatadir.Section);
            uint            functionoffset            = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfFunctions);
            uint            functionnameoffset        = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfNames);
            uint            functionnameordinaloffset = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfNameOrdinals);

            for (uint i = 0; i < exportDirectory.NumberOfFunctions; i++)
            {
                image.SetOffset(functionoffset);
                uint functionRVA = image.Reader.ReadUInt32();
                image.SetOffset(functionnameoffset);
                uint functionNameRVA = image.Reader.ReadUInt32();
                image.SetOffset(functionnameordinaloffset);
                uint functionNameOrdinal = image.Reader.ReadUInt32();

                string name = image.ReadZeroTerminatedString(offsetConverter.RvaToFileOffset(functionNameRVA));

                exports.Add(new ExportMethod(libraryname, name, functionNameRVA, functionRVA, (ushort)(i + exportDirectory.Base)));

                functionoffset            += 4;
                functionnameoffset        += 4;
                functionnameordinaloffset += 4;
            }
        }
Пример #2
0
        private void LoadExports()
        {
            // TODO: Unnamed exports (detect exports with only an ordinal).

            string libraryname = header._assembly._path.Substring(header._assembly._path.LastIndexOf('\\') + 1);
            DataDirectory exportdatadir = header.OptionalHeader.DataDirectories[(int)DataDirectoryName.Export];

            if (exportdatadir._targetOffset.FileOffset == 0)
                return;

            image.SetOffset(exportdatadir.TargetOffset.FileOffset);

            exportDirectory = image.ReadStructure<Structures.IMAGE_EXPORT_DIRECTORY>();

            OffsetConverter offsetConverter = new OffsetConverter(exportdatadir.Section);
            uint functionoffset = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfFunctions);
            uint functionnameoffset = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfNames);
            uint functionnameordinaloffset = offsetConverter.RvaToFileOffset(exportDirectory.AddressOfNameOrdinals);

            for (uint i = 0; i < exportDirectory.NumberOfFunctions; i++)
            {
                image.SetOffset(functionoffset);
                uint functionRVA = image.Reader.ReadUInt32();
                image.SetOffset(functionnameoffset);
                uint functionNameRVA = image.Reader.ReadUInt32();
                image.SetOffset(functionnameordinaloffset);
                uint functionNameOrdinal = image.Reader.ReadUInt32();

                string name = image.ReadZeroTerminatedString(offsetConverter.RvaToFileOffset(functionNameRVA));

                exports.Add(new ExportMethod(libraryname, name, functionNameRVA, functionRVA, (ushort)(i + exportDirectory.Base)));

                functionoffset += 4;
                functionnameoffset += 4;
                functionnameordinaloffset += 4;

            }
        }