private ImportMethod[] ReadImportMethods(Structures.IMAGE_IMPORT_DESCRIPTOR rawImportDir) { List <ImportMethod> methods = new List <ImportMethod>(); int currentIndex = 0; uint baseoffset = offsetConverter.RvaToFileOffset(rawImportDir.OriginalFirstThunk); uint baseft = offsetConverter.RvaToFileOffset(rawImportDir.FirstThunk); while (true) { uint methodOffset = 0; uint ftOffset = 0; ulong ofunction = ReadFunctionValue(baseoffset, currentIndex, out methodOffset); ulong ft = ReadFunctionValue(baseft, currentIndex, out ftOffset); if (ofunction == 0 && ft == 0) { break; } ushort hint = 0; string name = ReadFunctionName(ofunction, out hint); uint rva = (uint)(rawImportDir.FirstThunk + (currentIndex * (header.OptionalHeader.Is32Bit ? sizeof(uint) : sizeof(ulong)))); methods.Add(new ImportMethod((uint)ofunction, (uint)ft, rva, hint, name)); //advance to next function value image.SetOffset(methodOffset + (header.OptionalHeader.Is32Bit ? sizeof(uint) : sizeof(ulong))); currentIndex++; } return(methods.ToArray()); }
internal LibraryReference(PeImage image, uint offset, Structures.IMAGE_IMPORT_DESCRIPTOR rawDescriptor, string libraryName, ImportMethod[] importMethods) { this._image = image; this._offset = offset; this._rawDescriptor = rawDescriptor; this.LibraryName = libraryName; this.ImportMethods = importMethods; }
private string ReadLibraryName(Structures.IMAGE_IMPORT_DESCRIPTOR rawImportDir) { uint nameoffset = offsetConverter.RvaToFileOffset(rawImportDir.NameRVA); return(image.ReadZeroTerminatedString(nameoffset)); }