private ImportMethod[] ReadImportMethods(Structures.IMAGE_IMPORT_DESCRIPTOR rawImportDir)
        {
            List <ImportMethod> methods = new List <ImportMethod>();

            int  currentIndex = 0;
            uint baseoffset   = offsetConverter.RvaToFileOffset(rawImportDir.OriginalFirstThunk);
            uint baseft       = offsetConverter.RvaToFileOffset(rawImportDir.FirstThunk);

            while (true)
            {
                uint methodOffset = 0;
                uint ftOffset     = 0;

                ulong ofunction = ReadFunctionValue(baseoffset, currentIndex, out methodOffset);
                ulong ft        = ReadFunctionValue(baseft, currentIndex, out ftOffset);

                if (ofunction == 0 && ft == 0)
                {
                    break;
                }

                ushort hint = 0;
                string name = ReadFunctionName(ofunction, out hint);

                uint rva = (uint)(rawImportDir.FirstThunk + (currentIndex * (header.OptionalHeader.Is32Bit ? sizeof(uint) : sizeof(ulong))));
                methods.Add(new ImportMethod((uint)ofunction, (uint)ft, rva, hint, name));

                //advance to next function value
                image.SetOffset(methodOffset + (header.OptionalHeader.Is32Bit ? sizeof(uint) : sizeof(ulong)));
                currentIndex++;
            }
            return(methods.ToArray());
        }
示例#2
0
 internal LibraryReference(PeImage image, uint offset, Structures.IMAGE_IMPORT_DESCRIPTOR rawDescriptor, string libraryName, ImportMethod[] importMethods)
 {
     this._image         = image;
     this._offset        = offset;
     this._rawDescriptor = rawDescriptor;
     this.LibraryName    = libraryName;
     this.ImportMethods  = importMethods;
 }
        private string ReadLibraryName(Structures.IMAGE_IMPORT_DESCRIPTOR rawImportDir)
        {
            uint nameoffset = offsetConverter.RvaToFileOffset(rawImportDir.NameRVA);

            return(image.ReadZeroTerminatedString(nameoffset));
        }