/// <summary> /// Attaches 64-bit specific info about imported functions. /// </summary> private bool AttachImportData(ref ImportFunctionModule.ImageImportData64 r, UnmanagedDataReader s, uint delta, ImportFunctionModule m) { if (m == null) { return(false); } // check if there is any data attached: if (r.OrdinalOrAddressOfData == 0) { return(false); } if (r.IsOrdinal) { ImportFunctionModule.ImageImportData64 thunk = new ImportFunctionModule.ImageImportData64(); if (s.ReadAt(ref thunk, m.FirstThunk - delta)) { m.Add(new ImportFunctionDescription(r.Ordinal, m.IsBinded ? thunk.OrdinalOrAddressOfData : 0)); } } else { ImportFunctionModule.ImageImportByName funName = new ImportFunctionModule.ImageImportByName(); ImportFunctionModule.ImageImportData64 thunk = new ImportFunctionModule.ImageImportData64(); if (s.ReadAt(ref thunk, m.FirstThunk - delta)) { if (s.ReadAt(ref funName, (uint)r.OrdinalOrAddressOfData - delta)) { m.Add(new ImportFunctionDescription( s.ReadStringAnsiAt((uint)r.OrdinalOrAddressOfData - delta + sizeof(short)), m.IsBinded ? thunk.OrdinalOrAddressOfData : 0, (uint)funName.Hint)); } } } return(true); }
bool IBinaryAppender <ImportFunctionModule.ImageImportData64, ReaderWithOffsetArgs> .Attach(ref ImportFunctionModule.ImageImportData64 s, uint size, ReaderWithOffsetArgs arg) { return(AttachImportData(ref s, arg.Source, arg.Delta, arg.Tag as ImportFunctionModule)); }