protected bool ReadOptionalImport(FByteFile file) { FModuleInfoCollection modules = _import.Modules; modules.Clear(); SImageDataDirectory idd = _ntHeader.OptionalHeader.DataDirectory[(int)EImageDirectoryEntry.Import]; if (idd.VirtualAddress == 0) { return(false); } // Read modules int vaddress = ConvertRva(idd.VirtualAddress); int size = Marshal.SizeOf(typeof(SImageImportDescriptor)); while (true) { SImageImportDescriptor impDesc = (SImageImportDescriptor)file.GetStruct(vaddress, typeof(SImageImportDescriptor)); if (impDesc.Name == 0) { break; } FModuleInfo module = new FModuleInfo(); module.NameAddress = impDesc.Name; module.Name = file.GetString(ConvertRva(impDesc.Name)); module.FirstThunk = impDesc.FirstThunk; module.OriginalFirstThunk = impDesc.OriginalFirstThunk; ReadTrunks(file, module); modules.Push(module); vaddress += size; } return(true); }
protected bool ReadTrunks(FByteFile file, FModuleInfo module) { // Trunk int ftSize = Marshal.SizeOf(typeof(SImageThunkData32)); int pOrgFt = ConvertRva(module.OriginalFirstThunk); int pFt = ConvertRva(module.FirstThunk); while (true) { SImageThunkData32 origThunk = (SImageThunkData32)file.GetStruct(pOrgFt, typeof(SImageThunkData32)); SImageThunkData32 realThunk = (SImageThunkData32)file.GetStruct(pFt, typeof(SImageThunkData32)); if (origThunk.Function == 0) { break; } if ((origThunk.Ordinal & 0x80000000) == 0x80000000) { break; } // Read name SImageImportByName impName = (SImageImportByName)file.GetStruct(ConvertRva(origThunk.AddressOfData), typeof(SImageImportByName)); if (impName.Name[0] == 0) { break; } // TrunkInfo FTrunkInfo trunk = new FTrunkInfo(); trunk.Name = RAscii.GetString(impName.Name); trunk.Address = origThunk.Function; trunk.Entry = (IntPtr)realThunk.Function; trunk.Hint = impName.Hint; module.Trunks.Push(trunk); // Loop pOrgFt += ftSize; pFt += ftSize; } return(true); }