示例#1
0
        public unsafe ICollection <ImportedLibrary> GetImports()
        {
            var dir = OptionalHeader.ImportDirectory;

            if (dir.Size == 0)
            {
                return(null);
            }

            var offset  = RvaToFileOffset(dir.VirtualAddress);
            var pe64    = IsPE64;
            var size    = pe64 ? 8 : 4;
            var imports = new List <ImportedLibrary>(8);

            for (; ;)
            {
                var importDirectory = Read <IMAGE_IMPORT_DIRECTORY>(offset);
                if (importDirectory.ImportLookupTable == 0)
                {
                    importDirectory.ImportLookupTable = importDirectory.ImportAddressTable;
                }
                if (importDirectory.ImportLookupTable == 0)
                {
                    break;
                }

                ImportedLibrary library           = null;
                var             importLookupTable = RvaToFileOffset(importDirectory.ImportLookupTable);
                var             hintNameTable     = RvaToFileOffset(importDirectory.ImportAddressTable);
                var             nameOffset        = RvaToFileOffset(importDirectory.NameRva);

                var pointer = importLookupTable;
                for (; ;)
                {
                    var ordinal = -1;
                    var nameRva = 0;
                    if (pe64)
                    {
                        var lvalue = Read <ulong>(pointer);
                        if (lvalue == 0)
                        {
                            break;
                        }

                        var isOrdinal = (lvalue & (1UL << 63)) > 0;
                        if (isOrdinal)
                        {
                            ordinal = (ushort)(lvalue & 0xffff);
                        }
                        else
                        {
                            nameRva = (int)(lvalue & ((1L << 31) - 1));
                        }
                    }
                    else
                    {
                        var ivalue = Read <uint>(pointer);
                        if (ivalue == 0)
                        {
                            break;
                        }
                        if ((ivalue & 0x80000000) > 0)
                        {
                            ordinal = (ushort)(ivalue & 0xffff);
                        }
                        else
                        {
                            nameRva = (int)(ivalue & ((1L << 31) - 1));
                        }
                    }

                    if (library == null)
                    {
                        var bytes = new sbyte[128];
                        fixed(sbyte *p = bytes)
                        {
                            ReadArray(nameOffset, bytes, 0, bytes.Length);
                            library = new ImportedLibrary {
                                LibraryName = new string(p)
                            };
                        }
                    }

                    if (nameRva > 0)
                    {
                        var offset2 = RvaToFileOffset(nameRva);
                        var hint    = Read <ushort>(offset2);
                        var chars   = new List <byte>();
                        for (; ;)
                        {
                            var ch = Read <byte>(offset2 + 2 + chars.Count);
                            if (ch == 0)
                            {
                                var symbol = new ImportedSymbol {
                                    Name = Encoding.ASCII.GetString(chars.ToArray()),
                                    Hint = hint,
                                };
                                if (symbol.Name.Contains("@@"))
                                {
                                    symbol.UndecoratedName = GetUndecoratedName(symbol.Name);
                                }
                                library.Symbols.Add(symbol);
                                break;
                            }
                            chars.Add(ch);
                        }
                        ;
                    }

                    pointer += size;
                }
                imports.Add(library);
                library = null;

                offset += 20;
            }

            return(imports);
        }
示例#2
0
        ImportedSymbol GetSymbolFromImport(int pointer)
        {
            bool pe64    = IsPE64;
            var  ordinal = -1;
            var  nameRva = 0;

            if (pe64)
            {
                var lvalue = Read <ulong>(pointer);
                if (lvalue == 0)
                {
                    return(null);
                }

                var isOrdinal = (lvalue & (1UL << 63)) > 0;
                if (isOrdinal)
                {
                    ordinal = (ushort)(lvalue & 0xffff);
                }
                else
                {
                    nameRva = (int)(lvalue & ((1L << 31) - 1));
                }
            }
            else
            {
                var ivalue = Read <uint>(pointer);
                if (ivalue == 0)
                {
                    return(null);
                }
                if ((ivalue & 0x80000000) > 0)
                {
                    ordinal = (ushort)(ivalue & 0xffff);
                }
                else
                {
                    nameRva = (int)(ivalue & ((1L << 31) - 1));
                }
            }

            if (nameRva > 0)
            {
                var offset2 = RvaToFileOffset(nameRva);
                var hint    = Read <ushort>(offset2);
                var chars   = new List <byte>();
                for (; ;)
                {
                    var ch = Read <byte>(offset2 + 2 + chars.Count);
                    if (ch == 0)
                    {
                        var symbol = new ImportedSymbol {
                            Name = Encoding.ASCII.GetString(chars.ToArray()),
                            Hint = hint,
                        };
                        if (symbol.Name.Contains("@@"))
                        {
                            symbol.UndecoratedName = GetUndecoratedName(symbol.Name);
                        }
                        return(symbol);
                    }
                    chars.Add(ch);
                }
                ;
            }
            return(null);
        }