public unsafe ICollection <ImportedLibrary> GetImports() { var dir = OptionalHeader.ImportDirectory; if (dir.Size == 0) { return(null); } var offset = RvaToFileOffset(dir.VirtualAddress); var pe64 = IsPE64; var size = pe64 ? 8 : 4; var imports = new List <ImportedLibrary>(8); for (; ;) { var importDirectory = Read <IMAGE_IMPORT_DIRECTORY>(offset); if (importDirectory.ImportLookupTable == 0) { importDirectory.ImportLookupTable = importDirectory.ImportAddressTable; } if (importDirectory.ImportLookupTable == 0) { break; } ImportedLibrary library = null; var importLookupTable = RvaToFileOffset(importDirectory.ImportLookupTable); var hintNameTable = RvaToFileOffset(importDirectory.ImportAddressTable); var nameOffset = RvaToFileOffset(importDirectory.NameRva); var pointer = importLookupTable; for (; ;) { var ordinal = -1; var nameRva = 0; if (pe64) { var lvalue = Read <ulong>(pointer); if (lvalue == 0) { break; } var isOrdinal = (lvalue & (1UL << 63)) > 0; if (isOrdinal) { ordinal = (ushort)(lvalue & 0xffff); } else { nameRva = (int)(lvalue & ((1L << 31) - 1)); } } else { var ivalue = Read <uint>(pointer); if (ivalue == 0) { break; } if ((ivalue & 0x80000000) > 0) { ordinal = (ushort)(ivalue & 0xffff); } else { nameRva = (int)(ivalue & ((1L << 31) - 1)); } } if (library == null) { var bytes = new sbyte[128]; fixed(sbyte *p = bytes) { ReadArray(nameOffset, bytes, 0, bytes.Length); library = new ImportedLibrary { LibraryName = new string(p) }; } } if (nameRva > 0) { var offset2 = RvaToFileOffset(nameRva); var hint = Read <ushort>(offset2); var chars = new List <byte>(); for (; ;) { var ch = Read <byte>(offset2 + 2 + chars.Count); if (ch == 0) { var symbol = new ImportedSymbol { Name = Encoding.ASCII.GetString(chars.ToArray()), Hint = hint, }; if (symbol.Name.Contains("@@")) { symbol.UndecoratedName = GetUndecoratedName(symbol.Name); } library.Symbols.Add(symbol); break; } chars.Add(ch); } ; } pointer += size; } imports.Add(library); library = null; offset += 20; } return(imports); }
ImportedSymbol GetSymbolFromImport(int pointer) { bool pe64 = IsPE64; var ordinal = -1; var nameRva = 0; if (pe64) { var lvalue = Read <ulong>(pointer); if (lvalue == 0) { return(null); } var isOrdinal = (lvalue & (1UL << 63)) > 0; if (isOrdinal) { ordinal = (ushort)(lvalue & 0xffff); } else { nameRva = (int)(lvalue & ((1L << 31) - 1)); } } else { var ivalue = Read <uint>(pointer); if (ivalue == 0) { return(null); } if ((ivalue & 0x80000000) > 0) { ordinal = (ushort)(ivalue & 0xffff); } else { nameRva = (int)(ivalue & ((1L << 31) - 1)); } } if (nameRva > 0) { var offset2 = RvaToFileOffset(nameRva); var hint = Read <ushort>(offset2); var chars = new List <byte>(); for (; ;) { var ch = Read <byte>(offset2 + 2 + chars.Count); if (ch == 0) { var symbol = new ImportedSymbol { Name = Encoding.ASCII.GetString(chars.ToArray()), Hint = hint, }; if (symbol.Name.Contains("@@")) { symbol.UndecoratedName = GetUndecoratedName(symbol.Name); } return(symbol); } chars.Add(ch); } ; } return(null); }