示例#1
0
        private static bool SafeGetExportTableInfo(IntPtr processHandle, IntPtr moduleHandle, out IMAGE_EXPORT_DIRECTORY ied, out uint[] nameOffsets)
        {
            ied         = default;
            nameOffsets = Array2.Empty <uint>();
            if (!NativeProcess.ReadUInt32Internal((void *)processHandle, (byte *)moduleHandle + 0x3C, out uint ntHeaderOffset))
            {
                return(false);
            }
            if (!NativeProcess.Is64BitProcessInternal((void *)processHandle, out bool is64Bit))
            {
                return(false);
            }
            uint iedRVA;

            if (is64Bit)
            {
                if (!NativeProcess.ReadUInt32Internal((void *)processHandle, (byte *)moduleHandle + ntHeaderOffset + 0x88, out iedRVA))
                {
                    return(false);
                }
            }
            else
            {
                if (!NativeProcess.ReadUInt32Internal((void *)processHandle, (byte *)moduleHandle + ntHeaderOffset + 0x78, out iedRVA))
                {
                    return(false);
                }
            }

            fixed(void *p = &ied)
            {
                if (!NativeProcess.ReadInternal((void *)processHandle, (byte *)moduleHandle + iedRVA, p, IMAGE_EXPORT_DIRECTORY.UnmanagedSize))
                {
                    return(false);
                }
            }

            if (ied.NumberOfNames == 0)
            {
                return(true);
            }
            nameOffsets = new uint[ied.NumberOfNames];
            fixed(void *p = nameOffsets)
            {
                if (!NativeProcess.ReadInternal((void *)processHandle, (byte *)moduleHandle + ied.AddressOfNames, p, ied.NumberOfNames * 4))
                {
                    return(false);
                }
            }

            return(true);
        }